Add two KASSERTS which trigger if free(9) would drag the "memuse" statistic

for a malloc bucket under zero.  This typically happens if you malloc(9)
from one bucket and free to another.

1 files changed, 6 insertions, 0 deletions

diff --git a/sys/kern/kern_malloc.c b/sys/kern/kern_malloc.c
index 97537d0..7dd4726 100644
--- a/sys/kern/kern_malloc.c
+++ b/sys/kern/kern_malloc.c
@@ -283,6 +283,9 @@ free(addr, type)
 	if (addr == NULL)
 		return;
 
+	KASSERT(ksp->ks_memuse > 0,
+		("malloc(9)/free(9) confusion.\n%s",
+		 "Probably freeing with wrong type, but maybe not here."));
 	size = 0;
 
 	slab = vtoslab((vm_offset_t)addr & (~UMA_SLAB_MASK));
@@ -318,6 +321,9 @@ free(addr, type)
 		uma_large_free(slab);
 	}
 	mtx_lock(&ksp->ks_mtx);
+	KASSERT(size <= ksp->ks_memuse,
+		("malloc(9)/free(9) confusion.\n%s",
+		 "Probably freeing with wrong type, but maybe not here."));
 	ksp->ks_memuse -= size;
 	ksp->ks_inuse--;
 	mtx_unlock(&ksp->ks_mtx);