Bug 138537 - [ata] [panic] Memory modified after free
Summary: [ata] [panic] Memory modified after free
Status: Closed Overcome By Events
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 9.0-CURRENT
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-09-04 18:50 UTC by Jonathan Hanna
Modified: 2018-02-18 07:53 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Hanna 2009-09-04 18:50:02 UTC
Panic, while reading one DVD and writing another, in case it matters.

#0  doadump () at pcpu.h:246
246     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) #0  doadump () at pcpu.h:246
#1  0xc08a538f in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:416
#2  0xc08a5672 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:579
#3  0xc0b23347 in mtrash_ctor (mem=0xcb546920, size=16, arg=0x0, flags=258)
    at /usr/src/sys/vm/uma_dbg.c:137
#4  0xc0b22899 in uma_zalloc_arg (zone=0xc188c700, udata=0x0, flags=258)
    at /usr/src/sys/vm/uma_core.c:1997
#5  0xc0891854 in malloc (size=4, mtp=0xc6c97118, flags=258) at uma.h:305
#6  0xc6ba4e10 in zfs_kmem_alloc () from /boot/kernel/zfs.ko
#7  0xc6bc07d8 in dmu_buf_hold_array_by_dnode () from /boot/kernel/zfs.ko
#8  0xc6bc0f85 in dmu_buf_hold_array () from /boot/kernel/zfs.ko
#9  0xc6bc11b3 in dmu_read_uio () from /boot/kernel/zfs.ko
#10 0xc6c390e8 in zfs_freebsd_read () from /boot/kernel/zfs.ko
#11 0xc0c0e03a in VOP_READ_APV (vop=0x0, a=0xc34d5048) at vnode_if.c:887
#12 0xc0b3ea4b in vnode_pager_generic_getpages (vp=0xd17bd218, m=0xf5f02bbc,
    bytecount=4096, reqpage=0) at vnode_if.h:384
#13 0xc09220e9 in vop_stdgetpages (ap=0xf5f02ac4)
    at /usr/src/sys/kern/vfs_default.c:658
#14 0xc0c0c97b in VOP_GETPAGES_APV (vop=0xc0dc8060, a=0xf5f02ac4)
    at vnode_if.c:2603
#15 0xc0b3dac4 in vnode_pager_getpages (object=0xd078bc38, m=0xf5f02bbc,
    count=1, reqpage=0) at vnode_if.h:1134
#16 0xc0b2531f in vm_fault (map=0xcc84b910, vaddr=879652864,
    fault_type=1 '\001', fault_flags=Variable "fault_flags" is not available.
) at vm_pager.h:131
#17 0xc0c007d9 in trap_pfault (frame=0xf5f02d38, usermode=1, eva=879652864)
    at /usr/src/sys/i386/i386/trap.c:823
#18 0xc0c0112e in trap (frame=0xf5f02d38) at /usr/src/sys/i386/i386/trap.c:396
#19 0xc0be3aab in calltrap () at /usr/src/sys/i386/i386/exception.s:165
#20 0x080496d3 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb)


Demsg from core:

...
acd0: FAILURE - READ_TOC ILLEGAL REQUEST asc=0x24 ascq=0x00
acd0: FAILURE - READ_TOC ILLEGAL REQUEST asc=0x24 ascq=0x00
acd0: FAILURE - READ_TOC ILLEGAL REQUEST asc=0x24 ascq=0x00
(cd0:ata0:0:0:0): READ TOC/PMA/ATIP. CDB: 43 0 0 0 0 0 0 0 4 0
(cd0:ata0:0:0:0): CAM Status: SCSI Status Error
(cd0:ata0:0:0:0): SCSI Status: Check Condition
(cd0:ata0:0:0:0): ILLEGAL REQUEST asc:24,0
(cd0:ata0:0:0:0): Invalid field in CDB
(cd0:ata0:0:0:0): Unretryable error
acd0: FAILURE - unknown CMD (0x03) ILLEGAL REQUEST asc=0x24 ascq=0x00
acd1: FAILURE - READ_TOC ILLEGAL REQUEST asc=0x24 ascq=0x00
acd1: FAILURE - READ_TOC ILLEGAL REQUEST asc=0x24 ascq=0x00
acd1: FAILURE - READ_TOC ILLEGAL REQUEST asc=0x24 ascq=0x00
(cd1:ata1:0:0:0): READ TOC/PMA/ATIP. CDB: 43 0 0 0 0 0 0 0 4 0
(cd1:ata1:0:0:0): CAM Status: SCSI Status Error
(cd1:ata1:0:0:0): SCSI Status: Check Condition
(cd1:ata1:0:0:0): ILLEGAL REQUEST asc:24,0
(cd1:ata1:0:0:0): Invalid field in CDB
(cd1:ata1:0:0:0): Unretryable error
acd1: WARNING - TEST_UNIT_READY taskqueue timeout - completing request directly
acd1: WARNING - TEST_UNIT_READY freeing taskqueue zombie request
acd1: WARNING - TEST_UNIT_READY taskqueue timeout - completing request directly
acd1: WARNING - TEST_UNIT_READY freeing taskqueue zombie request
acd1: WARNING - unknown CMD (0x4a) taskqueue timeout - completing request directly
acd1: WARNING - unknown CMD (0x4a) freeing taskqueue zombie request
Memory modified after free 0xcb546920(12) val=5e040600 @ 0xcb546920
panic: Most recently used by ata_generic
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2009-09-06 19:30:13 UTC
Responsible Changed
From-To: freebsd-bugs->freebsd-fs

Over to maintainer(s).
Comment 2 Mark Linimon freebsd_committer freebsd_triage 2009-09-07 09:42:07 UTC
Responsible Changed
From-To: freebsd-fs->freebsd-bugs

pjd says this is probably a problem in the ata driver that just 
happens to be detected by zfs.
Comment 3 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 07:58:46 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped
Comment 4 Alex Kozlov freebsd_committer freebsd_triage 2018-02-18 07:53:54 UTC
The atapicd(4) was removed after import of new ata stack.