Subject: bad free() in uhub_detach()?
To: None <firstname.lastname@example.org>
From: Jeff Rizzo <email@example.com>
Date: 10/25/2004 12:49:49
I just updated the kernel on my desktop machine from 2.0G to 2.99.10,
and simultaneously switched on "options DIAGNOSTIC" and "options DEBUG"
in preparation for doing a little (unrelated) development. What I found
was that when the kernel is compiled with DIAGNOSTIC+DEBUG, I get the
free: addr 0xdeadbeef not within kmem_map
... whenever I detach my keyboard and mouse using my USB KVM switch.
Looking at the trace shows that the culprit free() occurs in
uhub_detach(), but I don't have a serial console on this machine, so
it's hard to get the actual trace. (I'll hand-copy the list of
functions at the end of this message)
It seems to require _both_ DEBUG and DIAGNOSTIC to trigger the panic;
possibly KMEMSTATS as well. GENERIC_DIAGNOSTIC doesn't crash like this,
but with a config file that looks like this:
...it crashes every single time. I have been unable to get a crash
dump; when I try to force one with 'reboot 0x104' from the db> prompt,
it writes a few pages, then gives up with "wddump: DMA error" and "i/o
Has anyone else seen this? Is there anything else I should do to
Here's more or less what the console looks like after the crash. This
is handcopied, so there may be transcription errors.
uhub2 : at uhub0 port 1 (addr 2) disconnected
uhub4: at uhub2 port 1 (addr 3) disconnected
uhidev0: at uhub4 port 1 (addr 4) disconnected
wskbd1: disconnecting from wsdisplay0
uhidev1: at uhub4 port 1 (addr 4) disconnected
panic: free: addr 0xdeadbeef not within kmem_map
Stopped in pid 5.1 (usb0) at netbsd:breakpoint+0x4: leave
Oh, since I appear to have neglected to mention this; this is on
netbsd/i386 2.99.10, updated about 30 minutes ago. (Haven't seen any
new CVS commits since this compile)