Panic: drm-next-kmod - Memory modified after free

[kwm81]

When loading the kmod from ports with HEAD it panics hard on my Kaby Lake Nuc. FreeBSD 12.0-CURRENT #0 r323595M: Thu Sep 14 22:34:46 CEST 2017 drm-next-kmod-g20170912

I tried drm-next branch also as a comparison and it works fine apart that GL performance is beyond crap. But so far it stable, and currently that the only think I care about. FreeBSD 12.0-CURRENT #0 aed5752f46d(drm-next): Sat Sep 16 14:54:52 CEST 2017 (even if GL performance is beyond crap, it works)

I only have pictures of the panic, the core dump was not usefull.

% pciconf -lvb hostb0@pci0:0:0:0: class=0x060000 card=0x20688086 chip=0x59048086 rev=0x03 hdr=0x00 vendor = 'Intel Corporation' device = 'Xeon E3-1200 v6/7th Gen Core Processor Host Bridge/DRAM Registers' class = bridge subclass = HOST-PCI vgapci0@pci0:0:2:0: class=0x030000 card=0x20688086 chip=0x59268086 rev=0x06 hdr=0x00 vendor = 'Intel Corporation' class = display subclass = VGA bar [10] = type Memory, range 64, base 0xdb000000, size 16777216, enabled bar [18] = type Prefetchable Memory, range 64, base 0x90000000, size 268435456, enabled bar [20] = type I/O Port, range 32, base 0xf000, size 64, enabled none0@pci0:0:8:0: class=0x088000 card=0x20688086 chip=0x19118086 rev=0x00 hdr=0x00 vendor = 'Intel Corporation' device = 'Xeon E3-1200 v5/v6 / E3-1500 v5 / 6th/7th Gen Core Processor Gaussian Mixture Model' class = base peripheral bar [10] = type Memory, range 64, base 0xdc34f000, size 4096, enabled xhci0@pci0:0:20:0: class=0x0c0330 card=0x20688086 chip=0x9d2f8086 rev=0x21 hdr=0x00 vendor = 'Intel Corporation' device = 'Sunrise Point-LP USB 3.0 xHCI Controller' class = serial bus subclass = USB bar [10] = type Memory, range 64, base 0xdc330000, size 65536, enabled none1@pci0:0:20:2: class=0x118000 card=0x20688086 chip=0x9d318086 rev=0x21 hdr=0x00 vendor = 'Intel Corporation' device = 'Sunrise Point-LP Thermal subsystem' class = dasp bar [10] = type Memory, range 64, base 0xdc34e000, size 4096, enabled none2@pci0:0:22:0: class=0x078000 card=0x20688086 chip=0x9d3a8086 rev=0x21 hdr=0x00 vendor = 'Intel Corporation' device = 'Sunrise Point-LP CSME HECI' class = simple comms bar [10] = type Memory, range 64, base 0xdc34d000, size 4096, enabled ahci0@pci0:0:23:0: class=0x010601 card=0x20688086 chip=0x9d038086 rev=0x21 hdr=0x00 vendor = 'Intel Corporation' device = 'Sunrise Point-LP SATA Controller [AHCI mode]' class = mass storage subclass = SATA bar [10] = type Memory, range 32, base 0xdc348000, size 8192, enabled bar [14] = type Memory, range 32, base 0xdc34c000, size 256, enabled bar [18] = type I/O Port, range 32, base 0xf090, size 8, enabled bar [1c] = type I/O Port, range 32, base 0xf080, size 4, enabled bar [20] = type I/O Port, range 32, base 0xf060, size 32, enabled bar [24] = type Memory, range 32, base 0xdc34b000, size 2048, enabled pcib1@pci0:0:28:0: class=0x060400 card=0x20688086 chip=0x9d108086 rev=0xf1 hdr=0x01 vendor = 'Intel Corporation' device = 'Sunrise Point-LP PCI Express Root Port' class = bridge subclass = PCI-PCI pcib2@pci0:0:28:5: class=0x060400 card=0x20688086 chip=0x9d158086 rev=0xf1 hdr=0x01 vendor = 'Intel Corporation' device = 'Sunrise Point-LP PCI Express Root Port' class = bridge subclass = PCI-PCI pcib3@pci0:0:28:7: class=0x060400 card=0x20688086 chip=0x9d178086 rev=0xf1 hdr=0x01 vendor = 'Intel Corporation' device = 'Sunrise Point-LP PCI Express Root Port' class = bridge subclass = PCI-PCI pcib4@pci0:0:29:0: class=0x060400 card=0x20688086 chip=0x9d188086 rev=0xf1 hdr=0x01 vendor = 'Intel Corporation' device = 'Sunrise Point-LP PCI Express Root Port' class = bridge subclass = PCI-PCI isab0@pci0:0:31:0: class=0x060100 card=0x20688086 chip=0x9d4e8086 rev=0x21 hdr=0x00 vendor = 'Intel Corporation' class = bridge subclass = PCI-ISA none3@pci0:0:31:2: class=0x058000 card=0x20688086 chip=0x9d218086 rev=0x21 hdr=0x00 vendor = 'Intel Corporation' device = 'Sunrise Point-LP PMC' class = memory bar [10] = type Memory, range 32, base 0xdc344000, size 16384, enabled hdac0@pci0:0:31:3: class=0x040100 card=0x20688086 chip=0x9d718086 rev=0x21 hdr=0x00 vendor = 'Intel Corporation' device = 'Sunrise Point-LP HD Audio' class = multimedia subclass = audio bar [10] = type Memory, range 64, base 0xdc340000, size 16384, enabled bar [20] = type Memory, range 64, base 0xdc320000, size 65536, enabled none4@pci0:0:31:4: class=0x0c0500 card=0x20688086 chip=0x9d238086 rev=0x21 hdr=0x00 vendor = 'Intel Corporation' device = 'Sunrise Point-LP SMBus' class = serial bus subclass = SMBus bar [10] = type Memory, range 64, base 0xdc34a000, size 256, enabled bar [20] = type I/O Port, range 32, base 0xf040, size 32, enabled em0@pci0:0:31:6: class=0x020000 card=0x20688086 chip=0x15d88086 rev=0x21 hdr=0x00 vendor = 'Intel Corporation' device = 'Ethernet Connection (4) I219-V' class = network subclass = ethernet bar [10] = type Memory, range 32, base 0xdc300000, size 131072, enabled none5@pci0:58:0:0: class=0x028000 card=0x90108086 chip=0x24fd8086 rev=0x78 hdr=0x00 vendor = 'Intel Corporation' device = 'Wireless 8265 / 8275' class = network bar [10] = type Memory, range 64, base 0xdc200000, size 8192, enabled none6@pci0:59:0:0: class=0xff0000 card=0x20688086 chip=0x522910ec rev=0x01 hdr=0x00 vendor = 'Realtek Semiconductor Co., Ltd.' device = 'RTS5229 PCI Express Card Reader' bar [10] = type Memory, range 32, base 0xdc100000, size 4096, enabled nvme0@pci0:60:0:0: class=0x010802 card=0x390a8086 chip=0xf1a58086 rev=0x03 hdr=0x00 vendor = 'Intel Corporation' class = mass storage subclass = NVM bar [10] = type Memory, range 64, base 0xdc000000, size 16384, enabled

[hselasky]

Are the kernel options for debugging memory issues turned on in GENERIC?

[hselasky]

Might be GEOM related like the debug print says.

[kwm81]

The problem went away after updating HEAD to r323923M and drm-next-kmod ports to g20170918.

[markjdb]

This was a bug in lindebugfs: we were passing a wrong size to malloc().