From owner-freebsd-bugs@FreeBSD.ORG  Wed May 25 20:33:15 2011
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 37884106564A;
	Wed, 25 May 2011 20:33:15 +0000 (UTC)
	(envelope-from j@uriah.heep.sax.de)
Received: from uriah.heep.sax.de (uriah.heep.sax.de [213.240.137.9])
	by mx1.freebsd.org (Postfix) with ESMTP id D9CC58FC08;
	Wed, 25 May 2011 20:33:14 +0000 (UTC)
Received: by uriah.heep.sax.de (Postfix, from userid 107)
	id 92FC627; Wed, 25 May 2011 22:33:13 +0200 (MET DST)
Date: Wed, 25 May 2011 22:33:13 +0200
From: Joerg Wunsch <j@uriah.heep.sax.de>
To: FreeBSD-gnats-submit@freebsd.org, freebsd-bugs@FreeBSD.org
Message-ID: <20110525203313.GA11763@uriah.heep.sax.de>
References: <20110524060026.E8285AA@uriah.heep.sax.de>
	<201105240610.p4O6A94E003499@freefall.freebsd.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <201105240610.p4O6A94E003499@freefall.freebsd.org>
X-Phone: +49-351-2012 669
X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F  93 21 E0 7D F9 12 D6 4E
X-GPG-Fingerprint: 5E84 F980 C3CA FD4B B584  1070 F48C A81B 69A8 5873
User-Agent: Mutt/1.5.20 (2009-06-14)
Cc: 
Subject: Re: kern/157287: re0: INVARIANTS panic (Memory modified after free)
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 25 May 2011 20:33:15 -0000

Some more analysis on the stack trace:

re_attach+0x118a corresponds to re_allocmem(), line 1085:

        /* Allocate DMA'able memory for the RX ring */

        error = bus_dmamem_alloc(sc->rl_ldata.rl_rx_list_tag,
            (void **)&sc->rl_ldata.rl_rx_list,
            BUS_DMA_WAITOK | BUS_DMA_COHERENT | BUS_DMA_ZERO,
            &sc->rl_ldata.rl_rx_list_map);

callee bus_dmamem_alloc+0x8a is i386/i386/busdma_machdep.c,
bus_dmamem_alloc() line 526:

        /* 
         * XXX:
         * (dmat->alignment < dmat->maxsize) is just a quick hack; the exact
         * alignment guarantees of malloc need to be nailed down, and the
         * code below should be rewritten to take that into account.
         *
         * In the meantime, we'll warn the user if malloc gets it wrong.
         */
        if ((dmat->maxsize <= PAGE_SIZE) &&
           (dmat->alignment < dmat->maxsize) &&
            dmat->lowaddr >= ptoa((vm_paddr_t)Maxmem)) {
                *vaddr = malloc(dmat->maxsize, M_DEVBUF, mflags);
        } else {

I could not spot anything obvious though.

-- 
cheers, J"org               .-.-.   --... ...--   -.. .  DL8DTL

http://www.sax.de/~joerg/                        NIC: JW11-RIPE
Never trust an operating system you don't have sources for. ;-)