From owner-freebsd-current@FreeBSD.ORG Sat Mar 7 19:32:52 2009 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 83C71106566B for ; Sat, 7 Mar 2009 19:32:52 +0000 (UTC) (envelope-from taku@tackymt.homeip.net) Received: from basalt.tackymt.homeip.net (unknown [IPv6:2001:3e0:577:0:20d:61ff:fecc:2253]) by mx1.freebsd.org (Postfix) with ESMTP id 27F458FC0A for ; Sat, 7 Mar 2009 19:32:52 +0000 (UTC) (envelope-from taku@tackymt.homeip.net) Received: from localhost (localhost [127.0.0.1]) by basalt.tackymt.homeip.net (Postfix) with ESMTP id E80931074B for ; Sun, 8 Mar 2009 04:32:50 +0900 (JST) X-Virus-Scanned: amavisd-new at tackymt.homeip.net Received: from localhost ([127.0.0.1]) by localhost (basalt.tackymt.homeip.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cApFe5esEXFV for ; Sun, 8 Mar 2009 04:32:48 +0900 (JST) Received: from biotite (biotite.tackymt.homeip.net [IPv6:2001:3e0:577:0:216:cfff:febc:1472]) by basalt.tackymt.homeip.net (Postfix) with ESMTP for ; Sun, 8 Mar 2009 04:32:48 +0900 (JST) Date: Sun, 8 Mar 2009 04:32:49 +0900 From: "YAMAMOTO, Taku" To: freebsd-current@freebsd.org Message-Id: <20090308043249.37e17467.taku@tackymt.homeip.net> Organization: Trans New Technology, Inc. X-Mailer: Sylpheed 2.4.8 (GTK+ 2.12.9; i386-portbld-freebsd8.0) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Subject: Duplicate free in ffs_getextattr() with UFS_ACL X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 07 Mar 2009 19:32:52 -0000 Greetings, I've come across the following duplicate free when tracking down the occational page fault panic. (kgdb) x/s panicstr 0xc08a7cc0: "Duplicate free of item 0xc4c9a290 from zone 0xc108c380(16)\n" (kgdb) bt #0 0xc05de3bd in doadump () #1 0xc05de964 in boot () #2 0xc05dedf8 in panic () #3 0xc075062b in uma_dbg_free () #4 0xc074f448 in uma_zfree_arg () #5 0xc05cd536 in free () #6 0xc0735a30 in ffs_close_ea () #7 0xc0736131 in ffs_getextattr () #8 0xc06751a7 in vn_extattr_get () #9 0xc0739086 in ufs_getacl () #10 0xc07433c6 in ufs_access () #11 0xc0655a18 in vfs_cache_lookup () #12 0xc07d48fd in VOP_LOOKUP_APV () #13 0xc065be19 in lookup () #14 0xc065cdce in namei () #15 0xc066bb6d in kern_statat_vnhook () #16 0xc066bcaf in kern_statat () #17 0xc066bce7 in kern_lstat () #18 0xc066bd7b in lstat () #19 0xc07c44ec in syscall () #20 0xc07aaab0 in Xint0x80_syscall () #21 0x00000033 in ?? () Previous frame inner to this frame (corrupt stack?) The source tree is csupped at 2009-02-22T12:00:00Z. I think the problem is that ffs_getextattr() depends on vp's being exclusively locked but that no longer is true when ufs_access() are going to retrieve an ACL. Virtually yours, -- -|-__ YAMAMOTO, Taku | __ < - A chicken is an egg's way of producing more eggs. -