[Xen-devel] double free

[Adam Sulmicki <adam@xxxxxxxxxxxx>]

has anyone seens something like this?
this is with xen 2.0.1
this happens in dom0 when domU terminates unexpectedly.

sh-2.05b# device vif1.0 entered promiscuous mode
xen-br0: port 2(vif1.0) entering learning state
xen-br0: topology change detected, propagating
xen-br0: port 2(vif1.0) entering forwarding state
device vif1.0 left promiscuous mode
xen-br0: port 2(vif1.0) entering disabled state
xen-br0: port 2(vif1.0) entering disabled state
slab error in cache_free_debugcheck(): cache `size-1024': double free, or memory
 outside object was overwritten
 [<c01417b1>] cache_free_debugcheck+0x171/0x250
 [<c0142532>] kfree+0x52/0xa0
 [<c0252ea2>] netif_destroy+0x82/0x90
 [<c0252ea2>] netif_destroy+0x82/0x90
 [<c0252a5f>] netif_ctrlif_rx+0x3f/0xb0
 [<c0108e0a>] __ctrl_if_rxmsg_deferred+0x4a/0x60
 [<c012e135>] worker_thread+0x1c5/0x2e0
 [<c0108dc0>] __ctrl_if_rxmsg_deferred+0x0/0x60
 [<c011a4e0>] default_wake_function+0x0/0x20
 [<c02fd865>] schedule+0x2e5/0x570
 [<c011a4e0>] default_wake_function+0x0/0x20
 [<c012df70>] worker_thread+0x0/0x2e0
 [<c0132303>] kthread+0x83/0xc0
 [<c0132280>] kthread+0x0/0xc0
 [<c010f875>] kernel_thread_helper+0x5/0x10

c235d008: redzone 1: 0x0, redzone 2: 0x3fe3d8f3.
------------[ cut here ]------------
kernel BUG at mm/slab.c:1890!
invalid operand: 0000 [#1]
PREEMPT DEBUG_PAGEALLOC
Modules linked in:
CPU:    0
EIP:    0061:[<c0141840>]    Not tainted VLI
EFLAGS: 00011202   (2.6.9-xen0)
EIP is at cache_free_debugcheck+0x200/0x250
eax: c235d000   ebx: 80052c00   ecx: 00001000   edx: 00000008
esi: c235d000   edi: c235d008   ebp: c109fac0   esp: c111bef4
ds: 0069   es: 0069   ss: 0069
Process events/0 (pid: 3, threadinfo=c111a000 task=c1314a90)
Stack: 0235d008 c109fac0 c10aff78 c235dc00 00000000 c0142532 c109fac0 c235dc00
       c0252ea2 c235de20 c235dc00 c03b40c4 00000000 c0252ea2 c235dc00 c235dc00
       c03b40c0 c0347780 c111a000 c0252a5f c03b40c4 00000004 c0108e0a c03b40c0
Call Trace:
 [<c0142532>] kfree+0x52/0xa0
 [<c0252ea2>] netif_destroy+0x82/0x90
 [<c0252ea2>] netif_destroy+0x82/0x90
 [<c0252a5f>] netif_ctrlif_rx+0x3f/0xb0
 [<c0108e0a>] __ctrl_if_rxmsg_deferred+0x4a/0x60
 [<c012e135>] worker_thread+0x1c5/0x2e0
 [<c0108dc0>] __ctrl_if_rxmsg_deferred+0x0/0x60
 [<c011a4e0>] default_wake_function+0x0/0x20
 [<c02fd865>] schedule+0x2e5/0x570
 [<c011a4e0>] default_wake_function+0x0/0x20
 [<c012df70>] worker_thread+0x0/0x2e0
 [<c0132303>] kthread+0x83/0xc0
 [<c0132280>] kthread+0x0/0xc0
 [<c010f875>] kernel_thread_helper+0x5/0x10
Code: 5d 38 e9 08 ff ff ff 57 55 e8 9d e3 ff ff 81 38 a5 c2 0f 17 59 5b 0f 85 70
 ff ff ff eb a4 0f 0b 61 07 13 f2 30 c0 e9 c1 fe ff ff <0f> 0b 62 07 13 f2 30 c0
 e9 c2 fe ff ff 8b 5c 24 20 53 57 55 e8




-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel