panic: sf_buf_free: freeing free sf_buf

[Peter Avalos]

On Mon, Sep 29, 2008 at 11:08:35AM -0400, Peter Avalos wrote:
> Got this running -HEAD:
> 
> panic: sf_buf_free: freeing free sf_buf

Just got a similar one:

panic: vm_fault: unrecoverable fault at 0xdeadc000 in entry 0xc0428d00
mp_lock = 00000001; cpuid = 1
Trace beginning at frame 0xd73cbb44
panic(d73cbb68,d73cbb90,d73cbb94,d73cbbb4,d73cbbc4) at panic+0x14d
panic(c0377718,deadc000,c0428d00,13f5ce8,c0320cf3) at panic+0x14d
vm_fault(c04259e0,deadc000,1,0,deadc114) at vm_fault+0xe2
trap_pfault(ac,c024279f,c3f28000,c03f5ce8,0) at trap_pfault+0xd9
trap(d73cbc40) at trap+0x4ab
calltrap() at calltrap+0xd
--- trap 0, eip = 0, esp = 0xd73cbc84, ebp = 0xdeadc0de ---
panic: vm_fault: unrecoverable fault at 0xdeadc000 in entry 0xc0428d00
mp_lock = 00000001; cpuid = 1
boot() called on cpu#1
Uptime: 1d1h44m35s

dumping to dev #da/0x20001, blockno 378927

(kgdb) bt
#0  dumpsys () at ./machine/thread.h:83
#1  0xc01b386d in boot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:375
#2  0xc01b3b30 in panic (fmt=0xc0377718 "vm_fault: unrecoverable fault
at %p in entry %p") at /usr/src/sys/kern/kern_shutdown.c:800
#3  0xc02b7863 in vm_fault (map=0xc04259e0, vaddr=3735928832,
fault_type=1 '\001', fault_flags=0) at /usr/src/sys/vm/vm_fault.c:301
#4  0xc032249d in trap_pfault (frame=0xd73cba3c, usermode=0, eva=0) at
/usr/src/sys/platform/pc32/i386/trap.c:1029
#5  0xc0322b1c in trap (frame=0xd73cba3c) at
/usr/src/sys/platform/pc32/i386/trap.c:721
#6  0xc030fd37 in calltrap () at
/usr/src/sys/platform/pc32/i386/exception.s:785
#7  0xc030eddf in db_read_bytes (addr=3735929058, size=4,
data=0xd73cbaa0 "Eø0À") at
/usr/src/sys/platform/pc32/i386/db_interface.c:207
#8  0xc0151414 in db_get_value (addr=3735929058, size=4, is_signed=0) at
/usr/src/sys/ddb/db_access.c:58
#9  0xc030f987 in db_stack_trace_cmd (addr=-683885756, have_addr=1,
count=1018, modif=0x0) at /usr/src/sys/platform/pc32/i386/db_trace.c:132
#10 0xc030fbee in db_print_backtrace () at
/usr/src/sys/platform/pc32/i386/db_trace.c:443
#11 0xc01b3b14 in panic (fmt=0xc0377718 "vm_fault: unrecoverable fault
at %p in entry %p") at /usr/src/sys/kern/kern_shutdown.c:796
#12 0xc02b7863 in vm_fault (map=0xc04259e0, vaddr=3735928832,
fault_type=1 '\001', fault_flags=0) at /usr/src/sys/vm/vm_fault.c:301
#13 0xc032249d in trap_pfault (frame=0xd73cbc40, usermode=0, eva=0) at
/usr/src/sys/platform/pc32/i386/trap.c:1029
#14 0xc0322b1c in trap (frame=0xd73cbc40) at
/usr/src/sys/platform/pc32/i386/trap.c:721
#15 0xc030fd37 in calltrap () at
/usr/src/sys/platform/pc32/i386/exception.s:785
#16 0xc02c116e in vm_page_unwire (m=0xdeadc0de, activate=0) at
/usr/src/sys/sys/thread2.h:127
#17 0xc01e9bcc in sf_buf_mfree (arg=0xc3fb3660) at
/usr/src/sys/kern/uipc_syscalls.c:1385
#18 0xc01e2198 in m_free (m=0xed5aad00) at
/usr/src/sys/kern/uipc_mbuf.c:979
#19 0xc01e24c4 in m_freem (m=0xed5aad00) at
/usr/src/sys/kern/uipc_mbuf.c:1009
#20 0xc0180d47 in em_txeof (adapter=0xda5646c0) at
/usr/src/sys/dev/netif/em/if_em.c:2650
#21 0xc0182140 in em_poll (ifp=0xda5646c0, cmd=POLL_ONLY, count=5) at
/usr/src/sys/dev/netif/em/if_em.c:1182
#22 0xc01abbac in netisr_poll (msg=0xd388035c) at
/usr/src/sys/kern/kern_poll.c:647
#23 0xc0232a50 in netmsg_service (msg=0xd388035c, mpsafe_mode=1,
mplocked=0) at /usr/src/sys/net/netisr.c:279
#24 0xc0232e3c in netmsg_service_loop (arg=0xc03f6aa8) at
/usr/src/sys/net/netisr.c:333
#25 0xc01bac3e in lwkt_deschedule_self (td=Cannot access memory at
address 0x8
) at /usr/src/sys/kern/lwkt_thread.c:228
Backtrace stopped: previous frame inner to this frame (corrupt stack?)


Uploading the kernel and vmcore to leaf (*.20).

--Peter
Attachment:
pgp00004.pgp
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pgp00004.pgp
Type: application/octet-stream
Size: 197 bytes
Desc: "Description: PGP signature"
URL: <http://lists.dragonflybsd.org/pipermail/bugs/attachments/20080930/6e078160/attachment-0022.obj>