kern/145211: Memory modified after free

[Marius Strobl]

The following reply was made to PR sparc64/145211; it has been noted by GNATS.

From: Marius Strobl <marius at alchemy.franken.de>
To: bug-followup at FreeBSD.org, nwf at cs.jhu.edu
Cc:  
Subject: Re: kern/145211: Memory modified after free
Date: Thu, 1 Apr 2010 13:23:59 +0200

 >  
 > Memory modified after free 0xfffff80005675000(2048) val=dead0003 @ 0xfffff80005675000
 > Memory modified after free 0xfffff8000564c800(2048) val=dead0003 @ 0xfffff8000564c800
 > panic: pcib: PCI bus B error AFAR 0 AFSR 0 PCI CSR 0x10730b2aff IOMMU 0x3060003 STATUS 0x2a0
 
 This is the IOMMU reporting an error as STX_PCI_CTRL_MMU_ERR is set in
 the PCI CSR and TOM_PCI_IOMMU_ERR is set in the IOMMO CSR. Moreover the
 TOM_PCI_IOMMU_INVALID_ERR set in the latter suggests that a DMA buffer
 was used after it had been unloaded (and thus the TTE invalidated). So
 it's quite likely that both the UMA and the IOMMU complaints are caused
 by the same problem. Unfortunately, neither allows to identify the
 culprit. If you could move the traffic in question from bge2 to bge1
 and either use r206020 or the following patch that should allow to
 identify at least the driver involved, i.e. ata(4) or bge(4), by
 additionally indicating whether pcib0 or pcib3 triggered the panic.
 http://people.freebsd.org/~marius/psycho_schizo_device_get_nameunit.diff
 
 Which version of if_bge.c were you running when the panic occurred?
 
 Marius