NetBSD Problem Report #46193

From cheusov@tut.by  Wed Mar 14 15:22:39 2012
Return-Path: <cheusov@tut.by>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	by www.NetBSD.org (Postfix) with ESMTP id 0EBB963B946
	for <gnats-bugs@gnats.netbsd.org>; Wed, 14 Mar 2012 15:22:39 +0000 (UTC)
Message-Id: <s93399bb59c.fsf@work.imb.invention.com>
Date: Wed, 14 Mar 2012 17:56:31 +0300
From: cheusov@tut.by
To: gnats-bugs@gnats.NetBSD.org
Subject: 6.0_BETA crash
X-Send-Pr-Version: 3.95

>Number:         46193
>Category:       kern
>Synopsis:       6.0_BETA crash (amap_extend -> kmem_intr_free -> kmem_size_check)
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    chs
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Mar 14 15:25:00 +0000 2012
>Closed-Date:    Mon Apr 16 14:24:53 +0000 2012
>Last-Modified:  Mon Apr 16 14:24:53 +0000 2012
>Originator:     Aleksey Cheusov
>Release:        NetBSD 6.0_BETA
>Organization:
>Environment:
System: NetBSD work.imb.invention.com 6.0_BETA NetBSD 6.0_BETA (GENERIC) #0: Mon Mar 12 17:25:05 FET 2012 cheusov@work.imb.invention.com:/srv/obj-current/sys/arch/i386/compile/GENERIC i386
Architecture: i386
Machine: i386
>Description:
NetBSD-6.0_BETA crashes. Stacktrace is below.
Two days old netbsd-6 sources.

Kernel is mostly GENERIC. Changes:
  options        DEBUG
  makeoptions    DEBUG="-g"

#0  0xc05c4a03 in maybe_dump (howto=260) at /srv/src_netbsd_current/sys/arch/i386/i386/machdep.c:878
878                     dumpsys();
#0  0xc05c4a03 in maybe_dump (howto=260) at /srv/src_netbsd_current/sys/arch/i386/i386/machdep.c:878
#1  cpu_reboot (howto=260, bootstr=0x0) at /srv/src_netbsd_current/sys/arch/i386/i386/machdep.c:903
#2  0xc07c1c1a in vpanic (fmt=0xc0c174a8 "kmem_free(%p, %zu) != allocated size %zu", ap=0xf3a46968 "\210\034\237I\371") at /srv/src_netbsd_current/sys/kern/subr_prf.c:308
#3  0xc07c1cbf in panic (fmt=0xc0c174a8 "kmem_free(%p, %zu) != allocated size %zu") at /srv/src_netbsd_current/sys/kern/subr_prf.c:205
#4  0xc07b881a in kmem_size_check (sz=<unavailable>, p=0xcd9f1c80) at /srv/src_netbsd_current/sys/kern/subr_kmem.c:439
#5  kmem_intr_free (p=0xcd9f1c80, size=248) at /srv/src_netbsd_current/sys/kern/subr_kmem.c:236
#6  0xc08ad91a in amap_extend (entry=0xcba81900, addsize=36864, flags=2) at /srv/src_netbsd_current/sys/uvm/uvm_amap.c:616
#7  0xc08bcad2 in uvm_mapent_trymerge (map=0xc59c487c, entry=0xca802dc8, flags=1) at /srv/src_netbsd_current/sys/uvm/uvm_map.c:4481
#8  0xc08ad1de in amap_copy (map=0xc59c487c, entry=0xca802dc8, flags=2, startva=<optimized out>, endva=<optimized out>) at /srv/src_netbsd_current/sys/uvm/uvm_amap.c:812
#9  0xc08b4e74 in uvmfault_amapcopy (ufi=<optimized out>) at /srv/src_netbsd_current/sys/uvm/uvm_fault.c:237
#10 uvm_fault_check (maxprot=false, ranons=<optimized out>, flt=0xf3a46c40, ufi=0xf3a46c60) at /srv/src_netbsd_current/sys/uvm/uvm_fault.c:1022
#11 uvm_fault_internal (orig_map=0xc59c487c, vaddr=2037485568, access_type=2, fault_flag=0) at /srv/src_netbsd_current/sys/uvm/uvm_fault.c:877
#12 0xc081df28 in trap (frame=0xf3a46d48) at /srv/src_netbsd_current/sys/arch/i386/i386/trap.c:678
#13 0xc010d08f in ?? ()

>How-To-Repeat:
No idea. This happens after two days of work.
>Fix:
unknown

>Release-Note:

>Audit-Trail:

From: David Holland <dholland-bugs@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/46193: 6.0_BETA crash
Date: Sat, 17 Mar 2012 13:24:59 +0000

 (send to gnats-admin instead of gnats-bugs)

    ------

 From: Aleksey Cheusov <cheusov@tut.by>
 To: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
 Subject: Re: kern/46193: 6.0_BETA crash
 Date: Thu, 15 Mar 2012 12:39:47 +0300

 One more crash of the system. Stacktrace is below.
 It happens on exit of midori web browser.
 I'm not sure weather this new crash is related to the old one or not.

 #0  0xc05c4a03 in maybe_dump (howto=260) at
 /srv/src_netbsd_current/sys/arch/i386/i386/machdep.c:878
 #1  cpu_reboot (howto=260, bootstr=0x0) at
 /srv/src_netbsd_current/sys/arch/i386/i386/machdep.c:903
 #2  0xc07c1c1a in vpanic (fmt=0xc0c2098f "trap", ap=0xf36c5a24
 "garbage A"Zl\363A"Zl\363w\302\212\300\b") at
 /srv/src_netbsd_current/sys/kern/subr_prf.c:308
 #3  0xc07c1cbf in panic (fmt=0xc0c2098f "trap") at
 /srv/src_netbsd_current/sys/kern/subr_prf.c:205
 #4  0xc081e860 in trap (frame=0xf36c5ac4) at
 /srv/src_netbsd_current/sys/arch/i386/i386/trap.c:396
 #5  0xc010d08f in ?? ()
 #6  0xc08bbad1 in uvm_map_unreference_amap (flags=0, entry=0x0) at
 /srv/src_netbsd_current/sys/uvm/uvm_map.c:883
 #7  uvm_unmap_detach (first_entry=0x0, flags=0) at
 /srv/src_netbsd_current/sys/uvm/uvm_map.c:2362
 #8  0xc08be856 in uvmspace_free (vm=0xc3f79a24) at
 /srv/src_netbsd_current/sys/uvm/uvm_map.c:4186
 #9  0xc05425d7 in exit1 (l=0xc54f0540, rv=0) at
 /srv/src_netbsd_current/sys/kern/kern_exit.c:327
 #10 0xc0542e32 in sys_exit (l=0xc54f0540, uap=0xf36c5cf4,
 retval=0xf36c5d1c) at /srv/src_netbsd_current/sys/kern/kern_exit.c:184
 #11 0xc07e63cd in sy_call (rval=0xf36c5d1c, uap=0xf36c5cf4,
 l=0xc54f0540, sy=0xc0cb192c) at
 /srv/src_netbsd_current/sys/sys/syscallvar.h:61
 #12 syscall (frame=0xf36c5d48) at
 /srv/src_netbsd_current/sys/arch/x86/x86/syscall.c:179
 #13 0xc01005d6 in ?? ()

Responsible-Changed-From-To: kern-bug-people->chs
Responsible-Changed-By: chs@NetBSD.org
Responsible-Changed-When: Sun, 18 Mar 2012 01:28:37 +0000
Responsible-Changed-Why:
I'm looking at this.


From: "Chuck Silvers" <chs@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/46193 CVS commit: src/sys/uvm
Date: Sun, 8 Apr 2012 20:47:11 +0000

 Module Name:	src
 Committed By:	chs
 Date:		Sun Apr  8 20:47:11 UTC 2012

 Modified Files:
 	src/sys/uvm: uvm_amap.c

 Log Message:
 initialize amap per-page reference counts before changing the amap's
 overall reference count.  this fixes the crashes seen for the last 9 months
 with web browers and plugins, which was also the cause of PR 46193.


 To generate a diff of this commit:
 cvs rdiff -u -r1.106 -r1.107 src/sys/uvm/uvm_amap.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Jeff Rizzo" <riz@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/46193 CVS commit: [netbsd-6] src/sys/uvm
Date: Mon, 9 Apr 2012 18:13:11 +0000

 Module Name:	src
 Committed By:	riz
 Date:		Mon Apr  9 18:13:11 UTC 2012

 Modified Files:
 	src/sys/uvm [netbsd-6]: uvm_amap.c

 Log Message:
 Pull up following revision(s) (requested by chs in ticket #173):
 	sys/uvm/uvm_amap.c: revision 1.107
 initialize amap per-page reference counts before changing the amap's
 overall reference count.  this fixes the crashes seen for the last 9 months
 with web browers and plugins, which was also the cause of PR 46193.


 To generate a diff of this commit:
 cvs rdiff -u -r1.105.2.1 -r1.105.2.2 src/sys/uvm/uvm_amap.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: chs@NetBSD.org
State-Changed-When: Mon, 16 Apr 2012 14:24:53 +0000
State-Changed-Why:
fixed


>Unformatted:

Home	PR Database Search