Date: Sun, 09 Jun 2002 23:40:09 -0700 From: Terry Lambert <tlambert2@mindspring.com> To: Arun Sharma <arun@sharma-home.net> Cc: freebsd-hackers@freebsd.org Subject: Re: 0xdeadxxxx ? Message-ID: <3D0449C9.27338938@mindspring.com> References: <20020610002316.GA6628@sharma-home.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Arun Sharma wrote: > I just got a kernel mode page fault. I'd like to find out more > about > > > fault virtual address = 0xdeadc162 > > It looks like the address is meant to signal a particular class of > error. Which one ? 0xdeadc162 - 0xdeadc0de = 0x00000084 = 132 decimal Look for a short value that's getting set to 132. If you'd done a traceback on the fault and identified the code, then finding out what the short value involved was, to know whether that was a += 132 or an = 49506 or a -= 16029. My guess would be a reference counted object whose count was a short, overflowed, and then was subsequently increment 132 times... OR a long reference count whose references were all releases, but a pointer to the object itself was not properly NULL'ed out, and it the reference was increment 132 times. Knowing the size of the object would help identify it. So would enabling allocator debugging, and making a free of a freed object cause a panic, rather than just printing out a warning (the traceback on *that* panix would identify the erroneous free). You would probably benefit, as well, by making sure the ref counts themselves were not in the areas that got blown over by "0xdeadc0de" (the first 12 bytes) of any structure. Basically, this looks very much like a free error, where a free of a unfreed object ends up getting pointered to. Another thing to look for... lok for objects that would be aligned on a 132 byte boundary (probably, this is a pointer that's overwritten by "0xdeadc0de", and then referenced with a non-zero index for some object that's some power of two divisible into 132-sized. I had a similar error with the cred reference counts that I found when I was the first person to get FreeBSD to go over 32767 simultaneous network connections off a single listen socket (if you will remember). -- Terry To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3D0449C9.27338938>