Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 1 Feb 2005 16:12:30 -0800
From:      Kris Kennaway <kris@obsecurity.org>
To:        Kris Kennaway <kris@obsecurity.org>
Cc:        jroberson@chesapeake.net
Subject:   Re: Panic: Memory modified after free
Message-ID:  <20050202001230.GA21847@xor.obsecurity.org>
In-Reply-To: <20050202000613.GA9758@xor.obsecurity.org>
References:  <20050130094616.GA76093@peter.osted.lan> <20050202000613.GA9758@xor.obsecurity.org>

next in thread | previous in thread | raw e-mail | index | archive | help

--5vNYLRcllDrimb99
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Feb 01, 2005 at 04:06:13PM -0800, Kris Kennaway wrote:
> On Sun, Jan 30, 2005 at 10:46:16AM +0100, Peter Holm wrote:
> > With GENERIC HEAD from Jan 28 20:19 UTC +  mpsafe_vfs =3D 1 I got:
> >=20
> > Memory modified after free 0xc1d7c100(124) val=3Dc23fa000 @ 0xc1d7c164
> >=20
> > panic(c083d005,c083b16e,c083cfd6,c1d7c100,7c) at panic+0xef
> > mtrash_ctor(c1d7c100,80,0,402) at mtrash_ctor+0x4d
> > uma_zalloc_arg(c10526e0,0,402) at uma_zalloc_arg+0x14c
> > malloc(68,c08bcd60,402,c094f0c0,0) at malloc+0xae
> > inodedep_lookup(c167a000,193a1,1,cf261be0,c094f0c0) at inodedep_lookup+=
0xa7
> > softdep_change_linkcnt(c213b578,c6bc54f0,c65f3f88,c213b578,c1c39270) at=
 softdep_change_linkcnt+0x31
> > ufs_dirremove(c17d83a8,c213b578,100800c,0,cf261c48) at ufs_dirremove+0x=
12d
> > ufs_remove(cf261c4c) at ufs_remove+0x4b
> > VOP_REMOVE_AP(cf261c4c) at VOP_REMOVE_AP+0x62
> > kern_unlink(c1add2e0,bfbfe940,0,cf261d40,c07bd6c3) at kern_unlink+0x167
> > unlink(c1add2e0,cf261d14,1,28,292) at unlink+0x12
> > syscall(2804002f,bfbf002f,bfbf002f,2804f6c0,bfbfeb14) at syscall+0x213
> >=20
> > More info at http://www.holm.cc/stress/log/cons112.html
>=20
> > panic: Most recently used by inodedep
>=20
> You can try to use DEBUG_MEMGUARD with M_INODEDEP to find this.  I'll
> add that to my SMP package machines to see if I can trigger it too.

Well, that didn't work:

panic: MEMGUARD: Cannot handle objects > PAGE_SIZE

CC'ing Bosko, the memguard author.

Kris



--5vNYLRcllDrimb99
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)

iD8DBQFCABrtWry0BWjoQKURAvPZAJ4gNR5IUTv3w9O7XShoI2+w9y5EHgCgn0cZ
fyrB4nC2A3uaOxtHs2YfJrI=
=SL4U
-----END PGP SIGNATURE-----

--5vNYLRcllDrimb99--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050202001230.GA21847>