Conference turris::digital_unix

9392.0. "panic "freeing free mblk" by EDSCLU::KELLY () Fri Apr 04 1997 13:52

The crash shows that a panic was caused when "freemsg()" was called to
free a streams message block.  The panic string "freeing free mblk" suggest that
the mblk has already been freed.

Is it correct to say that the message blocks and data blocks for the message
have already been deallocated and calling "freemsg() again will
cause a panic ?

Is there a way to determine if the message block has already been freed before
calling
"freemsg()" ?  Sometimes the message blocks get freed in a driver that does not
belong
to us.

Any help or suggestions would be appreciated.

Thanks,

Jim Kelly

================================================================================
* EDITED CRASH DATA
================================================================================
ECnet/OSI for
DECnet/OSI for
Digital UNIX
_host_version: Sep 15 20:21 OSF1 V3.2 (Rev. 214.61)
Sep 15 20:21 OSF1 V3.2 (Rev. 214.61)
Sep 15 16:15 OSF1 V3.2 (Rev. 214.61)
Sep 15 16:15 OSF1 V3.2 (Rev. 214.61)
DECnet/OSI for Digital UNIX V3.2A-0 (Rev. 23.19); Fri Sep 15 13:21:53 EDT 1995
DECnet/OSI for Digital UNIX V3.2A-0 (Rev. 23.19); Fri Sep 15 13:21:53 EDT 1995
Digital UNIX V3.2D-1 (Rev. 41); Thu Oct 24 23:25:31 CDT 1996
_crash_version: Sep 15 20:21 OSF1 V3.2 (Rev. 214.61)
Sep 15 20:21 OSF1 V3.2 (Rev. 214.61)
Sep 15 16:15 OSF1 V3.2 (Rev. 214.61)
Sep 15 16:15 OSF1 V3.2 (Rev. 214.61)
DECnet/OSI for Digital UNIX V3.2A-0 (Rev. 23.19); Fri Sep 15 13:21:53 EDT 1995
DECnet/OSI for Digital UNIX V3.2A-0 (Rev. 23.19); Fri Sep 15 13:21:53 EDT 1995
Digital UNIX V3.2D-1 (Rev. 41); Thu Oct 24 23:25:31 CDT 1996


_config:  struct {
    sysname = "OSF1"
    nodename = "mtymsfoeh01"
    release = "V3.2"
    version = "41"
    machine = "alpha"
}
_cpu:  41
_system_string:  0xffffffffff801080 = "AlphaServer 2100 5/250"
_ncpus:  2
_avail_cpus:  2
_partial_dump:  1
_physmem(MBytes):  1535
_panic_string:  0xfffffc000066ead0 = "freeing free mblk"
_paniccpu:  1
_panic_thread:  0xfffffc005e81b000
_preserved_message_buffer_begin:
struct {
    msg_magic = 0x63061
    msg_bufx = 0xc9b
    msg_bufr = 0xb6f
    msg_bufc = "Alpha boot: available memory from 0x2352000 to 0x5fffe000
Digital UNIX V3.2D-1 (Rev. 41); Thu Oct 24 23:25:31 CDT 1996
physical memory = 1536.00 megabytes.
available memory = 1500.67 megabytes.
using 5890 buffers containing 46.01 megabytes of memory
Master cpu at slot 0.
Firmware revision: 4.4
PALcode: OSF version 1.21
ibus0 at nexus
AlphaServer 2100 5/250
cpu 0 EV-5 4mb b-cache
cpu 1 EV-5 4mb b-cache
gpc0 at ibus0
pci0 at ibus0 slot 0
tu0: DECchip 21040-AA: Revision: 2.4
tu0 at pci0 slot 0
tu0: DEC TULIP Ethernet Interface, hardware address: 00-00-F8-20-67-B3
tu0: console mode: selecting UTP (10BaseT) port
psiop0 at pci0 slot 1
Loading SIOP: script 10cc000, reg 81333000, data 10d9f48
scsi0 at psiop0 slot 0
rz0 at scsi0 bus 0 target 0 lun 0 (DEC     RZ28D    (C) DEC 0008)
rz1 at scsi0 bus 0 target 1 lun 0 (DEC     RZ28D    (C) DEC 0008)
rz2 at scsi0 bus 0 target 2 lun 0 (DEC     RZ28M    (C) DEC 0568)
rz3 at scsi0 bus 0 target 3 lun 0 (DEC     RZ28M    (C) DEC 0568)
rz4 at scsi0 bus 0 target 4 lun 0 (DEC     RZ28M    (C) DEC 0568)
rz5 at scsi0 bus 0 target 5 lun 0 (DEC     RZ28M    (C) DEC 0568)
rz6 at scsi0 bus 0 target 6 lun 0 (DEC     RRD45   (C) DEC  1645)
eisa0 at pci0
ace0 at eisa0
ace1 at eisa0
lp0 at eisa0
fdi0 at eisa0
fd0 at fdi0 unit 0
fta0 DEC CRE DEFEA FDDI Module, Hardware Revision 2
fta0 at eisa0
fta0: DMA Available.
fta0: DEC CRE DEFEA (PDQ) FDDI Interface, Hardware address: 00-00-F8-41-11-4C
fta0: Firmware rev: 2.46
tu1: DECchip 21040-AA: Revision: 2.4
tu1 at eisa0
tu1: DEC TULIP Ethernet Interface, hardware address: 08-00-2B-9E-0D-9E
tu1: auto sensing: selected UTP (10BaseT) port
tra0 at eisa0
tra0: DEC DW300 Token Ring Interface, Hardware address: 00-00-93-58-CD-01
tra0: TMS380 Microcode Type: CAF, Silicon Rev: 2.0, Microcode Level: 2.28
vga0 at eisa0
 1024x768 (ATI64   )
vga0: ATI Mach64-GX Rev. 3
Attempt to disable non-existant interrupt -1
pza2 at pci0 slot 6
pza2 firmware version: DEC  P01  A10
scsi3 at pza2 slot 0
tz29 at scsi3 bus 3 target 5 lun 0 (DEC     TZ887    (C) DEC CC33)
mc29 at scsi3 unit 233 (DEC     TZ Media Changer CC33)
pza0 at pci0 slot 7
pza0 firmware version: DEC  P01  A10
scsi1 at pza0 slot 0
pza1 at pci0 slot 8
pza1 firmware version: DEC  P01  A10
scsi2 at pza1 slot 0
lvm0: configured.
lvm1: configured.
dli: configured
SuperLAT. Copyright 1993 Meridian Technology Corp. All rights reserved.
wandd_base: configured
wandd_llc2: configured
wan_utilities: configured
ctf_base: configured
Node ID is 00-00-93-58-cd-01 (from device tra0)
dna_netman: configured
dna_dli: configured
ADVFS: using 14025 buffers containing 109.57 megabytes of memory
Starting secondary cpu 1
AM found a host at bus 1 target 5, lun 7
AM found a host at bus 2 target 5, lun 7
fta0: Link Unavailable.
fta0: Link Available.
tra0: Opening adapter into the ring at 16Mb/s
Node UID is e3b5b720-3a55-11d0-8012-00009358cd01
tra0: Opening adapter into the ring at 16Mb/s
panic (cpu 1): freeing free mblk
syncing disks...
LSM attempting to dump to SCSI device unit number rz0

device string for dump = SCSI 0 1 0 0 0 0 0 .
DUMP.prom: dev SCSI 0 1 0 0 0 0 0 , block 307728
machine_slot[paniccpu]: struct {
    is_cpu = 0x1
    cpu_type = 0xf
    cpu_subtype = 0x9
    running = 0x1
    cpu_ticks = {
        [0] 0x567a
        [1] 0x0
        [2] 0x5b24
        [3] 0xe7ee
        [4] 0x4dac8
    }
    clock_freq = 0x400
    error_restart = 0x0
    cpu_panicstr = 0xfffffc000066ead0 = "freeing free mblk"
    cpu_panic_thread = 0xfffffc005e81b000
}
tset machine_slot[paniccpu].cpu_panic_thread:
Begin Trace for machine_slot[paniccpu].cpu_panic_thread:

warning: Files compiled -g3: parameter values probably wrong
>  0 stop_secondary_cpu() ["../../../../src/kernel/arch/alpha/cpu.c":375,
0xfffffc00004df128]
   1 panic(s = 0xfffffc0000696e08 = "event_timeout: panic request")
["../../../../src/kernel/bsd/subr_prf.c":669, 0xfffffc000044278
   2 event_timeout(func = 0xfffffc00004429e0, arg = 0xfffffc0000760048, timeout
= 0xffffffffb10df210) ["../../../../src/kernel/arch
   3 xcpu_puts(s = 0xffffffffaf52f238, prfbufp = 0xfffffc0000760048)
["../../../../src/kernel/bsd/subr_prf.c":810, 0xfffffc0000442a
   4 printf(va_alist = 0xfffffc0000686e60)
["../../../../src/kernel/bsd/subr_prf.c":355, 0xfffffc0000441d94]
   5 panic(s = 0xfffffc000066ead0 = "freeing free mblk")
["../../../../src/kernel/bsd/subr_prf.c":719, 0xfffffc00004428fc]
   6 freeb(mp = 0xfffffc000cf4d100)
["../../../../src/kernel/streams/str_memory.c":588, 0xfffffc000034f40c]
   7 freemsg(0xffffffffaf52f708, 0x0, 0xffffffffb114a178, 0x262c, 0x0)
["../../../../src/kernel/streams/str_util.c":570, 0xfffffc00
   8 t21__dlcm_build_unplumb_dlc(env = 0xfffffc000cf4c050, dlc_ls = '^@')
["/usr/users/snagwy/sna6/boris_x024/aosf/t21spd/src/t21dl
   9 proc_disconnect(env = 0xfffffc000cf4c050)
["/usr/users/snagwy/sna6/boris_x024/aosf/t21spd/src/t21dlcm_cp.c":718,
0xffffffffb11
  10 t21_dlcm_proc_cpsig(env = 0xfffffc000cf4c050)
["/usr/users/snagwy/sna6/boris_x024/aosf/t21spd/src/t21dlcm_cp.c":169, 0xfffffff
  11 t21__dispatcher(initial_sig = 0x0, initial_rt = 0xffffffffb11433b0,
initial_name = 0xffffffffb116eee0 = "t21_dlcm_proc_dlcmsg"
  12 t21_cp_muxrdsvc(q = 0xfffffc0009646c00)
["/usr/users/snagwy/sna6/boris_x024/aosf/t21spd/src/t21cp_streams.c":1896,
0xffffffffb
  13 sq_wrapper(q = 0xfffffc000035efb8)
["../../../../src/kernel/streams/str_runq.c":137, 0xfffffc0000357eb0]
  14 csq_run(sq = 0xfffffc000cf53800)
["../../../../src/kernel/streams/str_synch.c":693, 0xfffffc000035efb4]
  15 csq_lateral(sqh = 0xfffffc0009646c88, sq = 0xfffffc000cf53800)
["../../../../src/kernel/streams/str_synch.c":977, 0xfffffc0000
  16 runq_run() ["../../../../src/kernel/streams/str_runq.c":108,
0xfffffc0000357de4]
  17 netisr_thread() ["../../../../src/kernel/net/netisr.c":802,
0xfffffc000047ba00]
End Trace for machine_slot[paniccpu].cpu_panic_thread:

"cpu_data" is not an array
_stack_trace[0]_begin:
>  0 boot(0x0, 0x4, 0x1, 0xfffffc0010a33f80, 0xfffffc00004297d8)
["../../../../src/kernel/arch/alpha/machdep.c":1730, 0xfffffc00004
   1 panic(s = 0xfffffc000068a4d0 = "thread_block: interrupt level call")
["../../../../src/kernel/bsd/subr_prf.c":673, 0xfffffc000
   2 thread_block() ["../../../../src/kernel/kern/sched_prim.c":1769,
0xfffffc0000474cd8]
   3 thread_preempt(thread = 0xfffffc000ba35b80, processor = 0xfffffc0000200200)
["../../../../src/kernel/kern/sched_prim.c":3501, 
   4 boot(0x0, 0x0, 0x0, 0x0, 0x1)
["../../../../src/kernel/arch/alpha/machdep.c":1674, 0xfffffc00004e5874]
   5 panic(s = 0xfffffc0000696f68 = "cpu_ip_intr: panic request")
["../../../../src/kernel/bsd/subr_prf.c":757, 0xfffffc0000442954]
   6 cpu_ip_intr() ["../../../../src/kernel/arch/alpha/cpu.c":485,
0xfffffc00004df438]
   7 _XentInt(0x8, 0x3ff80004bc0, 0x3ffc0008570, 0x1200054cf, 0x6d9f4)
["../../../../src/kernel/arch/alpha/locore.s":961, 0xfffffc0
_stack_trace[0]_end:

Upgrade to DECnet/OSI V3.2B

>> Upgrade to DECnet/OSI V3.2B

The crash is from a Upgrade to DECnet/OSI V3.2D system.  Is 3.2B a later version
than 3.2D ??



Regards,

Jim Kelly

    Jim,
    
DECnet/OSI for Digital UNIX V3.2A-0 (Rev. 23.19); Fri Sep 15 13:21:53 EDT 1995
			    ^^^^^^ your DECnet/OSI version
Digital UNIX V3.2D-1 (Rev. 41); Thu Oct 24 23:25:31 CDT 1996
	     ^^^^^^^your UNIX version

    I believe .1 suggests to update to DECnet/OSI for Digital UNIX V3.2B,
not downgrade to Digital UNIX V3.2B ;-)

    Volker.

Your right.  I thought it was Digital Unix instead of DECnet/OSI.  I will get
the upgrade.

Thanks,

Jim Kelly

I do not understand what upgrading to decnet/osi v3.2b has to do with
the stream utility "freemsg().  Was there a bug in decnet/osi v3.2a ??

Regards,

Jim Kelly

I do not understand what upgrading to decnet/osi v3.2b has to do with
the stream utility "freemsg().  Was there a bug in decnet/osi v3.2a 
that would cause a call to freemsg() to panic the system for an
already freed message block ??

Regards,

Jim Kelly

DECnet/OSI V3.2A has a number of potential memory corruptors that are fixed
in V3.2B.

The customer upgraded to DUNIX 3.2d-1 and is not
encountering the problem anymore.  I assume this
has DECnet/OSI V3.2b.

Thanks for your help.

Jim Kelly

Digital UNIX and DECnet/OSI for Digital UNIX are separate
products.