[Barrelfish-users] [New release] free() error

[Kornilios Kourtis]

Hi Georgios,

On Wed, Mar 27, 2013 at 08:10:22PM +0000, Georgios Varisteas wrote:
> Hi,
> 
> Using code that run before updating, I now get a page fault while
> freeing memory. The same code runs correctly on linux and I get no
> messages from valgrind neither. Thus it should be something internal.
> kernel 20: user page fault in 'pond20': addr 0 IP 4d3c8d SP a80062b1120 error 0x6
> 
> Although I attached the disassembled portion below, I assume the error
> is at ./lib/barrelfish/slot_alloc/single_slot_alloc.c:117. 
> 
> Actually this is the last of a series of 3 calls to free() and since
> allocations were also done consecutively the addresses are consecutive.
> 
> I can spend time to fix this myself but I'd like some pointers.
> 
> cheers,
> Georgios
> 
> 
> 00000000004d3b10 <sfree>:
[snip]
>   4d3c84:       e8 27 64 f9 ff          callq  46a0b0 <slab_alloc>
>   4d3c89:       49 89 46 08             mov    %rax,0x8(%r14)
> 
> ->4d3c8d:       44 89 28                mov    %r13d,(%rax)

Not sure how much this will help, but the problem seems to be that
slab_alloc() returns NULL, which is not checked in sfree(), causing a
segfault when trying to dereference the returned pointer.

slab_alloc() returns NULL if:
 a) no refill function (->refill_func) exists, or
 b) calling ->refill_func did not result in new free blocks.

A first suggestion would be to try and see if we are dealing with a) or
b).

cheers,
Kornilios.

-- 
Kornilios Kourtis