Robert Watson
2006-Mar-06 09:35 UTC
vm_page_free: pindex(0), busy(0), PG_BUSY(0), hold(0) panic: vm_page_free: freeing free page
Got the attached panic + trace on a build server today when doing a parallel
buildworld.
Unread portion of the kernel message buffer:
vm_page_free: pindex(0), busy(0), PG_BUSY(0), hold(0)
panic: vm_page_free: freeing free page
Uptime: 2d20h44m8s
Dumping 1022 MB (2 chunks)
chunk 0: 1MB (159 pages) ... ok
chunk 1: 1022MB (261616 pages) 1006 990 974 958 942 926 910 894 878 862 846
830 814 798 782 766 750 734 718 702 686 670 654 638 622 606 590 574 558 542
526 510 494 478 462 446 430 414 398 382 366 350 334 318 302 286 270 254 238
222 206 190 174 158 142 126 110 94 78 62 46 30 14
#0 doadump () at pcpu.h:165
165 pcpu.h: No such file or directory.
in pcpu.h
(kgdb) bt
#0 doadump () at pcpu.h:165
#1 0xc064a012 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399
#2 0xc064a2a8 in panic (fmt=0xc08aa63a "vm_page_free: freeing free
page")
at /usr/src/sys/kern/kern_shutdown.c:555
#3 0xc07c7c2b in vm_page_free_toq (m=0xc1b6f330)
at /usr/src/sys/vm/vm_page.c:1023
#4 0xc07c7295 in vm_page_free (m=0xc1b6f330) at /usr/src/sys/vm/vm_page.c:403
#5 0xc07c4cd1 in vm_object_terminate (object=0xc57de630)
at /usr/src/sys/vm/vm_object.c:631
#6 0xc07c4bab in vm_object_deallocate (object=0xc57de630)
at /usr/src/sys/vm/vm_object.c:564
#7 0xc07c174e in vm_map_entry_delete (map=0xc518dce4, entry=0xc5110aa0)
at /usr/src/sys/vm/vm_map.c:2207
#8 0xc07c191b in vm_map_delete (map=0xc518dce4, start=3328910128,
end=3217031168) at /usr/src/sys/vm/vm_map.c:2300
#9 0xc07c197c in vm_map_remove (map=0xc518dce4, start=0, end=3217031168)
at /usr/src/sys/vm/vm_map.c:2319
#10 0xc0631fe3 in exit1 (td=0xc554d900, rv=0) at vm_map.h:211
#11 0xc06319ac in sys_exit (td=0xc554d900, uap=0x0)
at /usr/src/sys/kern/kern_exit.c:97
#12 0xc0825edb in syscall (frame {tf_fs = 59, tf_es = 59, tf_ds = 59,
tf_edi = 0, tf_esi = 1, tf_ebp =
-1077944200, tf_isp = -278880924, tf_ebx = -1077941067, tf_edx = 134626912,
tf_ecx = 6, tf_eax = 1, tf_trapno = 12, tf_err = 2, tf_eip = 672758583, tf_cs
= 51, tf_eflags = 658, tf_esp = -1077944324, tf_ss = 59})
at /usr/src/sys/i386/i386/trap.c:981
#13 0xc0814d5f in Xint0x80_syscall () at
/usr/src/sys/i386/i386/exception.s:200
#14 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) up
#1 0xc064a012 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399
399 doadump();
(kgdb) up
#2 0xc064a2a8 in panic (fmt=0xc08aa63a "vm_page_free: freeing free
page")
at /usr/src/sys/kern/kern_shutdown.c:555
555 boot(bootopt);
(kgdb) up
#3 0xc07c7c2b in vm_page_free_toq (m=0xc1b6f330)
at /usr/src/sys/vm/vm_page.c:1023
1023 panic("vm_page_free: freeing free
page");
(kgdb) inspect *m
$1 = {pageq = {tqe_next = 0xc1b4b330, tqe_prev = 0xc0966a60}, listq = {
tqe_next = 0xc1276878, tqe_prev = 0xc87de668}, left = 0x0,
right = 0xc210be98, object = 0x0, pindex = 0, phys_addr = 663449600, md = {
pv_list_count = 0, pv_list = {tqh_first = 0x0, tqh_last = 0xc1b6f35c}},
queue = 24, flags = 128, pc = 23, wire_count = 0, cow = 0, hold_count = 0,
act_count = 5 '\005', busy = 0 '\0', valid = 0 '\0',
dirty = 0 '\0'}
(kgdb) up
#4 0xc07c7295 in vm_page_free (m=0xc1b6f330) at /usr/src/sys/vm/vm_page.c:403
403 vm_page_free_toq(m);
(kgdb) up
#5 0xc07c4cd1 in vm_object_terminate (object=0xc57de630)
at /usr/src/sys/vm/vm_object.c:631
631 vm_page_free(p);
(kgdb) inspect *p
Cannot access memory at address 0x0
(kgdb) inspect *object
$2 = {mtx = {mtx_object = {lo_class = 0xc08f26e4,
lo_name = 0xc08a966d "vm object",
lo_type = 0xc08aa45e "standard object", lo_flags = 4390912,
lo_list = {
tqe_next = 0x0, tqe_prev = 0x0}, lo_witness = 0x0},
mtx_lock = 3310672128, mtx_recurse = 0}, object_list = {
tqe_next = 0xc63cd18c, tqe_prev = 0xc62d62b8}, shadow_head = {
lh_first = 0x0}, shadow_list = {le_next = 0x0, le_prev = 0xc82815d8},
memq = {tqh_first = 0xc1b6f330, tqh_last = 0xc1fb94e8}, root = 0xc210be98,
size = 8, generation = 13, ref_count = 0, shadow_count = 0, type = 0
'\0',
flags = 8584, pg_color = 27, paging_in_progress = 0,
resident_page_count = 6, backing_object = 0x0,
backing_object_offset = 20480, pager_object_list = {tqe_next = 0x0,
tqe_prev = 0x0}, handle = 0x0, un_pager = {vnp = {vnp_size = 512}, devp =
{
devp_pglist = {tqh_first = 0x200, tqh_last = 0x0}}, swp = {
swp_bcount = 512}}}
(kgdb) up
#6 0xc07c4bab in vm_object_deallocate (object=0xc57de630)
at /usr/src/sys/vm/vm_object.c:564
564 vm_object_terminate(object);
(kgdb) up
#7 0xc07c174e in vm_map_entry_delete (map=0xc518dce4, entry=0xc5110aa0)
at /usr/src/sys/vm/vm_map.c:2207
2207 vm_object_deallocate(object);
(kgdb) up
#8 0xc07c191b in vm_map_delete (map=0xc518dce4, start=3328910128,
end=3217031168) at /usr/src/sys/vm/vm_map.c:2300
2300 vm_map_entry_delete(map, entry);
(kgdb) inspect *map
$3 = {header = {prev = 0xc66ae2a8, next = 0xc66b2330, left = 0x0, right = 0x0,
start = 0, end = 3217031168, avail_ssize = 0, adj_free = 0, max_free = 0,
object = {vm_object = 0x0, sub_map = 0x0}, offset = 0, eflags = 0,
protection = 0 '\0', max_protection = 0 '\0', inheritance =
0 '\0',
wired_count = 0, lastr = 0}, lock = {sx_object = {lo_class = 0xc08f3aac,
lo_name = 0xc08a9dbd "user map", lo_type = 0xc08a9dbd
"user map",
lo_flags = 3866624, lo_list = {tqe_next = 0x0, tqe_prev = 0x0},
lo_witness = 0x0}, sx_lock = 0xc0952234, sx_cnt = -1, sx_shrd_cv = {
cv_description = 0xc08a9dbd "user map", cv_waiters = 0},
sx_shrd_wcnt = 0, sx_excl_cv = {cv_description = 0xc08a9dbd "user
map",
cv_waiters = 0}, sx_excl_wcnt = 0, sx_xholder = 0xc554d900},
system_mtx = {mtx_object = {lo_class = 0xc08f26e4,
lo_name = 0xc08a9db2 "system map", lo_type = 0xc08a9db2
"system map",
lo_flags = 4390912, lo_list = {tqe_next = 0x0, tqe_prev = 0x0},
lo_witness = 0x0}, mtx_lock = 4, mtx_recurse = 0}, nentries = 12,
size = 1372160, timestamp = 93, needs_wakeup = 0 '\0', system_map = 0
'\0',
flags = 0 '\0', root = 0xc66b8330, pmap = 0xc518dda4}
(kgdb) up
#9 0xc07c197c in vm_map_remove (map=0xc518dce4, start=0, end=3217031168)
at /usr/src/sys/vm/vm_map.c:2319
2319 result = vm_map_delete(map, start, end);
(kgdb) up
#10 0xc0631fe3 in exit1 (td=0xc554d900, rv=0) at vm_map.h:211
211 {
(kgdb) inspect *td
$4 = {td_proc = 0xc554c624, td_ksegrp = 0xc4b104e0, td_plist = {
tqe_next = 0x0, tqe_prev = 0xc554c634}, td_kglist = {tqe_next = 0x0,
tqe_prev = 0xc4b104ec}, td_slpq = {tqe_next = 0x0, tqe_prev = 0xc546a880},
td_lockq = {tqe_next = 0x0, tqe_prev = 0xef634c2c}, td_runq = {
tqe_next = 0x0, tqe_prev = 0xc554c63c}, td_selq = {tqh_first = 0x0,
tqh_last = 0xc554d930}, td_sleepqueue = 0xc546a880,
td_turnstile = 0xc4fda080, td_umtxq = 0xc54b1d80, td_tid = 100115,
td_flags = 16842754, td_inhibitors = 0, td_pflags = 0, td_dupfd = 0,
td_wchan = 0x0, td_wmesg = 0x0, td_lastcpu = 0 '\0', td_oncpu = 0
'\0',
td_owepreempt = 0 '\0', td_locks = 0, td_blocked = 0x0, td_ithd =
0x0,
td_lockname = 0x0, td_contested = {lh_first = 0x0}, td_sleeplocks = 0x0,
td_intr_nesting_level = 0, td_pinned = 0, td_mailbox = 0x0,
td_ucred = 0xc59efe00, td_standin = 0x0, td_upcall = 0x0, td_sticks = 1580,
td_uuticks = 0, td_usticks = 0, td_intrval = 0, td_oldsigmask = {__bits = {
0, 0, 0, 0}}, td_sigmask = {__bits = {0, 0, 0, 0}}, td_siglist = {
__bits = {0, 0, 0, 0}}, td_generation = 4, td_sigstk = {ss_sp = 0x0,
ss_size = 0, ss_flags = 4}, td_kflags = 0, td_xsig = 0,
td_profil_addr = 0, td_profil_ticks = 0, td_base_pri = 193 '?',
td_priority = 193 '?', td_pcb = 0xef609d90, td_state = TDS_RUNNING,
td_retval = {0, 134626912}, td_slpcallout = {c_links = {sle = {
sle_next = 0x0}, tqe = {tqe_next = 0x0, tqe_prev = 0xd8b05058}},
c_time = 247449857, c_arg = 0xc554d900,
c_func = 0xc0668410 <sleepq_timeout>, c_mtx = 0x0, c_flags = 16},
td_frame = 0xef609d38, td_kstack_obj = 0xc554fe70, td_kstack = 4016078848,
td_kstack_pages = 2, td_altkstack_obj = 0x0, td_altkstack = 0,
td_altkstack_pages = 0, td_critnest = 0, td_md = {md_spinlock_count = 0,
md_saved_flags = 582}, td_sched = 0xc554da54}
(kgdb) inspect *td->td_proc
$5 = {p_list = {le_next = 0xc50c8a3c, le_prev = 0xc0952f84}, p_ksegrps = {
tqh_first = 0xc4b104e0, tqh_last = 0xc4b104e4}, p_threads = {
tqh_first = 0xc554d900, tqh_last = 0xc554d908}, p_suspended = {
tqh_first = 0x0, tqh_last = 0xc554c63c}, p_ucred = 0xc59efe00, p_fd = 0x0,
p_fdtol = 0x0, p_stats = 0xc5161e00, p_limit = 0xc8e8ad00,
p_sigacts = 0xc90cb000, p_flag = 24578, p_sflag = 1, p_state = PRS_NORMAL,
p_pid = 33761, p_hash = {le_next = 0x0, le_prev = 0xc4a8ff84}, p_pglist = {
le_next = 0x0, le_prev = 0xc50c8a8c}, p_pptr = 0xc50c8a3c, p_sibling = {
le_next = 0x0, le_prev = 0xc50c8aa0}, p_children = {lh_first = 0x0},
p_mtx = {mtx_object = {lo_class = 0xc08f26e4,
lo_name = 0xc0894ece "process lock",
lo_type = 0xc0894ece "process lock", lo_flags = 4390912,
lo_list = {
tqe_next = 0x0, tqe_prev = 0x0}, lo_witness = 0x0}, mtx_lock = 4,
mtx_recurse = 0}, p_oppid = 0, p_vmspace = 0xc518dce4, p_swtime = 0,
p_realtimer = {it_interval = {tv_sec = 0, tv_usec = 0}, it_value = {
tv_sec = 0, tv_usec = 0}}, p_rux = {rux_runtime = {sec = 0,
frac = 79150977401680154}, rux_uticks = 1, rux_sticks = 1547,
rux_iticks = 0, rux_uu = 0, rux_su = 0, rux_iu = 0}, p_crux = {
rux_runtime = {sec = 0, frac = 3898975394652827504}, rux_uticks = 17,
rux_sticks = 13, rux_iticks = 0, rux_uu = 0, rux_su = 0, rux_iu = 0},
p_profthreads = 0, p_maxthrwaits = 0, p_traceflag = 0, p_tracevp = 0x0,
p_tracecred = 0x0, p_textvp = 0xc4e29110, p_siglist = {__bits = {0, 0, 0,
0}}, p_lock = 0 '\0', p_sigiolst = {slh_first = 0x0}, p_sigparent
= 20,
p_sig = 0, p_code = 0, p_stops = 0, p_stype = 0, p_step = 0 '\0',
p_pfsflags = 0 '\0', p_nlminfo = 0x0, p_aioinfo = 0x0, p_singlethread
= 0x0,
p_suspcount = 0, p_xthread = 0x0, p_boundary_count = 0,
p_procscopegrp = 0x0, p_magic = 3203398350,
p_comm = "sh\000e\000\000r", '\0' <repeats 12 times>,
p_pgrp = 0xc5346100,
p_sysent = 0xc0934c20, p_args = 0x0, p_cpulimit = 9223372036854775807,
p_nice = 4 '\004', p_xstat = 0, p_klist = {kl_list = {slh_first =
0x0},
kl_lock = 0xc062f934 <knlist_mtx_lock>,
kl_unlock = 0xc062f968 <knlist_mtx_unlock>,
kl_locked = 0xc062f9a4 <knlist_mtx_locked>, kl_lockarg = 0xc554c68c},
p_numthreads = 1, p_numksegrps = 1, p_md = {md_ldt = 0x0}, p_itcallout = {
c_links = {sle = {sle_next = 0x0}, tqe = {tqe_next = 0x0,
tqe_prev = 0x0}}, c_time = 0, c_arg = 0x0, c_func = 0, c_mtx = 0x0,
c_flags = 16}, p_acflag = 0, p_ru = 0xc59e4400, p_peers = 0x0,
p_leader = 0xc554c624, p_emuldata = 0x0, p_label = 0x0, p_sched =
0xc554c830}
Robert N M Watson