Bug 279243 - panic: Memory modified after free, Most recently used by solaris
Summary: panic: Memory modified after free, Most recently used by solaris
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 14.0-STABLE
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2024-05-23 08:12 UTC by Andriy Gapon
Modified: 2024-05-23 15:10 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andriy Gapon freebsd_committer freebsd_triage 2024-05-23 08:12:39 UTC
This happens on every other boot for me.
When it happens it always happens when loading nvidia driver.

<118>Mounting local filesystems:.
<118>Mounting ZFS filesystems: (354/354)
<118>Loading kernel modules:
nvidia0: <NVIDIA GeForce GTX 1660> on vgapci0
vgapci0: child nvidia0 requested pci_enable_io
vgapci0: child nvidia0 requested pci_enable_io
<6>nvidia-modeset: Loading NVIDIA Kernel Mode Setting Driver for UNIX platforms  550.54.14  Thu Feb 22 01:05:40 UTC 2024
sysctl_warn_reuse: can't re-use a leaf (hw.dri.debug)!
<6>[drm] [nvidia-drm] [GPU ID 0x00000100] Loading driver
Memory modified after free 0xfffff800207cf900(376) val=1010000 @ 0xfffff800207cf900
panic: Most recently used by solaris

cpuid = 2
time = 1716443221
KDB: stack backtrace:
db_trace_self_wrapper() at 0xffffffff80614c2b = db_trace_self_wrapper+0x2b/frame 0xfffffe01985cc060
kdb_backtrace() at 0xffffffff8094a037 = kdb_backtrace+0x37/frame 0xfffffe01985cc110
vpanic() at 0xffffffff808fba29 = vpanic+0x169/frame 0xfffffe01985cc250
panic() at 0xffffffff808fb803 = panic+0x43/frame 0xfffffe01985cc2b0
mtrash_ctor() at 0xffffffff80bb25ee = mtrash_ctor+0x7e/frame 0xfffffe01985cc2d0
item_ctor() at 0xffffffff80bb1818 = item_ctor+0x108/frame 0xfffffe01985cc320
uma_zalloc_arg() at 0xffffffff80baac3b = uma_zalloc_arg+0x10b/frame 0xfffffe01985cc360
malloc() at 0xffffffff808d4f60 = malloc+0x70/frame 0xfffffe01985cc3a0
os_alloc_mem() at 0xffffffff857de5f7 = os_alloc_mem+0x37/frame 0xfffffe01985cc3c0
_nv013606rm() at 0xffffffff854fc874 = _nv013606rm+0x34/frame 0xfffffe01a322fc00
Uptime: 42s

"Most recently used by solaris" makes me think that the problem is in ZFS.
Also, because the module loading happens right after mounting ZFS filesystems.

The zone is "malloc-384".
24 initial bytes are affected:

(kgdb) x/48a item
0xfffff800207cf900:     0x1010000       0x0
0xfffff800207cf910:     0x0     0xdeadc0dedeadc0de
0xfffff800207cf920:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf930:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf940:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf950:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf960:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf970:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf980:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf990:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf9a0:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf9b0:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf9c0:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf9d0:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf9e0:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cf9f0:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cfa00:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cfa10:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cfa20:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cfa30:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cfa40:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cfa50:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cfa60:     0xdeadc0dedeadc0de      0xdeadc0dedeadc0de
0xfffff800207cfa70:     0xdeadc0dedeadc0de      0xffffffff8121a800 <M_SOLARIS>
Comment 1 Vladimir Druzenko freebsd_committer freebsd_triage 2024-05-23 10:28:25 UTC
Did you install the nvidia driver from ports or from packages?
How do you load it? Have you tried another load options?
Have you tried other driver versions?
Comment 2 Andriy Gapon freebsd_committer freebsd_triage 2024-05-23 12:46:47 UTC
(In reply to Vladimir Druzenko from comment #1)
nvidia driver is only a victim here, it simply allocates memory and the allocator sees that the memory has been tampered with.