From owner-freebsd-current@freebsd.org Sun Jul 14 20:04:02 2019 Return-Path: Delivered-To: freebsd-current@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id BA8CEA4D66 for ; Sun, 14 Jul 2019 20:04:02 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from kib.kiev.ua (kib.kiev.ua [IPv6:2001:470:d5e7:1::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 457038A1AD; Sun, 14 Jul 2019 20:04:02 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from tom.home (kib@localhost [127.0.0.1]) by kib.kiev.ua (8.15.2/8.15.2) with ESMTPS id x6EK3seb075320 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO); Sun, 14 Jul 2019 23:03:57 +0300 (EEST) (envelope-from kostikbel@gmail.com) DKIM-Filter: OpenDKIM Filter v2.10.3 kib.kiev.ua x6EK3seb075320 Received: (from kostik@localhost) by tom.home (8.15.2/8.15.2/Submit) id x6EK3sA7075319; Sun, 14 Jul 2019 23:03:54 +0300 (EEST) (envelope-from kostikbel@gmail.com) X-Authentication-Warning: tom.home: kostik set sender to kostikbel@gmail.com using -f Date: Sun, 14 Jul 2019 23:03:54 +0300 From: Konstantin Belousov To: Mark Johnston Cc: Larry Rosenman , Freebsd current Subject: Re: panic: vm_page_free_prep: freeing mapped page Message-ID: <20190714200354.GT47193@kib.kiev.ua> References: <20190713221457.GP47193@kib.kiev.ua> <20190714193420.GC82719@raichu> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20190714193420.GC82719@raichu> User-Agent: Mutt/1.12.1 (2019-06-15) X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED,BAYES_00, DKIM_ADSP_CUSTOM_MED,FORGED_GMAIL_RCVD,FREEMAIL_FROM, NML_ADSP_CUSTOM_MED autolearn=no autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on tom.home X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jul 2019 20:04:02 -0000 On Sun, Jul 14, 2019 at 03:34:20PM -0400, Mark Johnston wrote: > On Sun, Jul 14, 2019 at 01:14:57AM +0300, Konstantin Belousov wrote: > > On Sat, Jul 13, 2019 at 04:50:57PM -0500, Larry Rosenman wrote: > > > I have cores. Ideas? > > > svn rev: r349976 > > > > > > [I] ➜ more core.txt.12 > > > borg.lerctr.org dumped core - see /var/crash/vmcore.12 > > > > > > Sat Jul 13 16:47:03 CDT 2019 > > > > > > FreeBSD borg.lerctr.org 13.0-CURRENT FreeBSD 13.0-CURRENT r349976 > > > LER-MINIMAL amd64 > > > > > > panic: vm_page_free_prep: freeing mapped page 0xfffff82031044790 > > > > What was the process which caused the panic ? Was it threaded ? > > I looked at some of the kernel dumps. In all cases the crashing process > is postgres. We have: > > (kgdb) p/x *m->md.pv_list.tqh_first > $20 = { > pv_va = 0x801c00000, > pv_next = { > tqe_next = 0xfffff80b3aacb568, > tqe_prev = 0xfffff81faf7ecbe8 > } > } > (kgdb) p/x *m->md.pv_list.tqh_first->pv_next.tqe_next > $21 = { > pv_va = 0x801c00000, > pv_next = { > tqe_next = 0x0, > tqe_prev = 0xfffff80b3ab905d0 > } > } > > We can find the corresponding pmaps for these mappings by going > through the corresponding pv_chunks. Then I looked up the other > processes with mappings of the page. They are also postgres processes. > We have: > > $33 = { > prev = 0xfffff818baa2be00, > next = 0xfffff80e7e9875b0, > left = 0xfffff814df7a6310, > right = 0xfffff80e7e9875b0, > start = 0x801c00000, > end = 0x80aa4a000, > next_read = 0x801c00000, > max_free = 0x3000, > object = { > vm_object = 0xfffff80bbeb94400, > sub_map = 0xfffff80bbeb94400 > }, > offset = 0x600000, > eflags = 0x0, The eflags value is slightly strange. > protection = 0x3, > max_protection = 0x7, > inheritance = 0x0, > read_ahead = 0xf, > wired_count = 0x0, > cred = 0x0, > wiring_thread = 0x0 > } > > and > > (kgdb) p $33->object.vm_object->ref_count > $34 = 0 > (kgdb) p $33->object.vm_object->shadow_count > $35 = 5 What is the object type ? Can you please print the object(s) ? > > So it seems that there is some problem with vm_object reference > counting; I'd expect a vm_map_entry reference to be counted in the > ref_count field, and we have at least two such references. > > Larry, could you open a bugzilla PR for this panic?