On Sun, Jul 14, 2019 at 11:03:54PM +0300, Konstantin Belousov wrote:
> On Sun, Jul 14, 2019 at 03:34:20PM -0400, Mark Johnston wrote:
> > On Sun, Jul 14, 2019 at 01:14:57AM +0300, Konstantin Belousov wrote:
> > > On Sat, Jul 13, 2019 at 04:50:57PM -0500, Larry Rosenman wrote:
> > > > I have cores. Ideas?
> > > > svn rev: r349976
> > > >
> > > > [I] ➜ more core.txt.12
> > > > borg.lerctr.org dumped core - see /var/crash/vmcore.12
> > > >
> > > > Sat Jul 13 16:47:03 CDT 2019
> > > >
> > > > FreeBSD borg.lerctr.org 13.0-CURRENT FreeBSD 13.0-CURRENT r349976
> > > > LER-MINIMAL amd64
> > > >
> > > > panic: vm_page_free_prep: freeing mapped page 0xfffff82031044790
> > >
> > > What was the process which caused the panic ? Was it threaded ?
> >
> > I looked at some of the kernel dumps. In all cases the crashing process
> > is postgres. We have:
> >
> > (kgdb) p/x *m->md.pv_list.tqh_first
> > $20 = {
> > pv_va = 0x801c00000,
> > pv_next = {
> > tqe_next = 0xfffff80b3aacb568,
> > tqe_prev = 0xfffff81faf7ecbe8
> > }
> > }
> > (kgdb) p/x *m->md.pv_list.tqh_first->pv_next.tqe_next
> > $21 = {
> > pv_va = 0x801c00000,
> > pv_next = {
> > tqe_next = 0x0,
> > tqe_prev = 0xfffff80b3ab905d0
> > }
> > }
> >
> > We can find the corresponding pmaps for these mappings by going
> > through the corresponding pv_chunks. Then I looked up the other
> > processes with mappings of the page. They are also postgres processes.
> > We have:
> >
> > $33 = {
> > prev = 0xfffff818baa2be00,
> > next = 0xfffff80e7e9875b0,
> > left = 0xfffff814df7a6310,
> > right = 0xfffff80e7e9875b0,
> > start = 0x801c00000,
> > end = 0x80aa4a000,
> > next_read = 0x801c00000,
> > max_free = 0x3000,
> > object = {
> > vm_object = 0xfffff80bbeb94400,
> > sub_map = 0xfffff80bbeb94400
> > },
> > offset = 0x600000,
> > eflags = 0x0,
> The eflags value is slightly strange.
Yeah, I'd expect MAP_ENTRY_COW.
> > protection = 0x3,
> > max_protection = 0x7,
> > inheritance = 0x0,
> > read_ahead = 0xf,
> > wired_count = 0x0,
> > cred = 0x0,
> > wiring_thread = 0x0
> > }
> >
> > and
> >
> > (kgdb) p $33->object.vm_object->ref_count
> > $34 = 0
> > (kgdb) p $33->object.vm_object->shadow_count
> > $35 = 5
> What is the object type ? Can you please print the object(s) ?
OBJT_DEFAULT.
$34 = {
lock = {
lock_object = {
lo_name = 0xffffffff808571d4 "vm object",
lo_flags = 627245056,
lo_data = 0,
lo_witness = 0x0
},
rw_lock = 18446735366207213568
},
object_list = {
tqe_next = 0xfffff80bbeb94500,
tqe_prev = 0xfffff80bbeb94320
},
shadow_head = {
lh_first = 0xfffff8066f43b600
},
shadow_list = {
le_next = 0xfffff815ca45de00,
le_prev = 0xfffff80665064438
},
memq = {
tqh_first = 0xfffff81faf7ecbb0,
tqh_last = 0xfffff81fb1719ec0
},
rtree = {
rt_root = 18446735385885095616
},
size = 37995,
domain = {
dr_policy = 0x0,
dr_iter = 0
},
generation = 1,
ref_count = 0,
shadow_count = 5,
memattr = 6 '\006',
type = 0 '\000',
flags = 4104,
pg_color = 5632,
paging_in_progress = 0,
resident_page_count = 26097,
backing_object = 0x0,
backing_object_offset = 0,
pager_object_list = {
tqe_next = 0x0,
tqe_prev = 0x0
},
rvq = {
lh_first = 0x0
},
handle = 0x0,
un_pager = {
vnp = {
vnp_size = 81,
writemappings = 0
},
devp = {
devp_pglist = {
tqh_first = 0x51,
tqh_last = 0x0
},
ops = 0x0,
dev = 0x0
},
sgp = {
sgp_pglist = {
tqh_first = 0x51,
tqh_last = 0x0
}
},
swp = {
swp_tmpfs = 0x51,
swp_blks = {
pt_root = 0
}
}
},
cred = 0xfffff8104e939600,
charge = 149336064,
umtx_data = 0x0
}