[Bug 252575] panic: camq_remove: Attempt to remove out-of-bounds index -2 from queue

b***@freebsd.org

2022-04-13 20:07:24 UTC

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=252575

Andrey V. Elsukov <***@FreeBSD.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@FreeBSD.org

--- Comment #4 from Andrey V. Elsukov <***@FreeBSD.org> ---
We have panic with similar trace on 13.0.
It seems it can happen when some CAM device disappears.

Unread portion of the kernel message buffer:
(cd0:umass-sim0:0:0:0): READ(10). CDB: 28 00 00 00 00 00 00 00 01 00
(cd0:umass-sim0:0:0:0): CAM status: CCB request completed with an error
(cd0:umass-sim0:0:0:0): Retrying command, 3 more tries remain
(cd0:umass-sim0:0:0:0): READ(10). CDB: 28 00 00 00 00 00 00 00 01 00
(cd0:umass-sim0:0:0:0): CAM status: CCB request completed with an error
(cd0:umass-sim0:0:0:0): Retrying command, 2 more tries remain
(cd0:umass-sim0:0:0:0): READ(10). CDB: 28 00 00 00 00 00 00 00 01 00
(cd0:umass-sim0:0:0:0): CAM status: CCB request completed with an error
(cd0:umass-sim0:0:0:0): Retrying command, 1 more tries remain
(cd0:umass-sim0:0:0:0): READ(10). CDB: 28 00 00 00 00 00 00 00 01 00
(cd0:umass-sim0:0:0:0): CAM status: CCB request completed with an error
(cd0:umass-sim0:0:0:0): Retrying command, 0 more tries remain
(cd0:umass-sim0:0:0:0): READ(10). CDB: 28 00 00 00 00 00 00 00 01 00
(cd0:umass-sim0:0:0:0): CAM status: CCB request completed with an error
(cd0:umass-sim0:0:0:0): Error 5, Retries exhausted
(cd0:umass-sim0:0:0:0): cddone: got error 0x5 back
cd0 at umass-sim0 bus 0 scbus3 target 0 lun 0
cd0: <MP EMS Virtual Media 0326> detached
da0 at umass-sim0 bus 0 scbus3 target 0 lun 1
da0: <MP EMS Virtual Media 0326> detached
da1 at umass-sim0 bus 0 scbus3 target 0 lun 2
da1: <MP EMS Virtual Media 0326> detached
(cd0:umass-sim0:0:0:0): Periph destroyed

Fatal trap 12: page fault while in kernel mode
cpuid = 2; apic id = 04
fault virtual address = 0x100000070
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff8034e3f0
stack pointer = 0x28:0xfffffe0037796990
(da1:umass-sim0:0:0:2): Periph destroyed
frame pointer = 0x28:0xfffffe00377969e0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 7 (doneq0)
trap number = 12
panic: page fault
cpuid = 2
time = 1645903760
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0037796650
vpanic() at vpanic+0x182/frame 0xfffffe00377966a0
panic() at panic+0x43/frame 0xfffffe0037796700
trap_fatal() at trap_fatal+0x387/frame 0xfffffe0037796760
trap_pfault() at trap_pfault+0x4f/frame 0xfffffe00377967b0
trap() at trap+0x271/frame 0xfffffe00377968c0
calltrap() at calltrap+0x8/frame 0xfffffe00377968c0
--- trap 0xc, rip = 0xffffffff8034e3f0, rsp = 0xfffffe0037796990, rbp =
0xfffffe00377969e0 ---
xpt_run_devq() at xpt_run_devq+0x90/frame 0xfffffe00377969e0
xpt_release_simq() at xpt_release_simq+0x6d/frame 0xfffffe0037796a10
xpt_async_process() at xpt_async_process+0x37a/frame 0xfffffe0037796b20
xpt_done_process() at xpt_done_process+0x3da/frame 0xfffffe0037796b60
xpt_done_td() at xpt_done_td+0xf5/frame 0xfffffe0037796bb0
fork_exit() at fork_exit+0x7e/frame 0xfffffe0037796bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0037796bf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
Uptime: 81d8h53m59s
Dumping 9884 out of 32621 MB:..1%..11%..21%..31%..41%..51%..61%..71%..81%..91%

__curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
55 /usr/src/sys/amd64/include/pcpu_aux.h: No such file or directory.
(kgdb) macro define offsetof(t, f) &((t *) 0)->f
(kgdb) bt
#0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
#1 doadump (textdump=1) at /usr/src/sys/kern/kern_shutdown.c:394
#2 0xffffffff80b377eb in kern_reboot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:481
#3 0xffffffff80b37c6a in vpanic (fmt=<optimized out>, ap=<optimized out>) at
/usr/src/sys/kern/kern_shutdown.c:913
#4 0xffffffff80b37a83 in panic (fmt=<unavailable>) at
/usr/src/sys/kern/kern_shutdown.c:839
#5 0xffffffff80efab67 in trap_fatal (frame=0xfffffe00377968d0, eva=4294967408)
at /usr/src/sys/amd64/amd64/trap.c:915
#6 0xffffffff80efabbf in trap_pfault (frame=0xfffffe00377968d0,
usermode=<optimized out>, signo=<optimized out>, ucode=<optimized out>)
at /usr/src/sys/amd64/amd64/trap.c:732
#7 0xffffffff80efa221 in trap (frame=0xfffffe00377968d0) at
/usr/src/sys/amd64/amd64/trap.c:398
#8 <signal handler called>
#9 xpt_run_devq (devq=0xfffff806f74a1180) at /usr/src/sys/cam/cam_xpt.c:3448
#10 0xffffffff80351a2d in xpt_release_simq (sim=0xfffff80724a6d700,
run_queue=1) at /usr/src/sys/cam/cam_xpt.c:4617
#11 0xffffffff8035182a in xpt_async_process (periph=<optimized out>,
ccb=0xfffff8045f5c9800) at /usr/src/sys/cam/cam_xpt.c:4363
#12 0xffffffff80351eaa in xpt_done_process (ccb_h=0xfffff8045f5c9800) at
/usr/src/sys/cam/cam_xpt.c:5490
#13 0xffffffff803540c5 in xpt_done_td (arg=0xffffffff81586a80 <cam_doneqs>) at
/usr/src/sys/cam/cam_xpt.c:5517
#14 0xffffffff80af5a3e in fork_exit (callout=0xffffffff80353fd0 <xpt_done_td>,
arg=0xffffffff81586a80 <cam_doneqs>, frame=0xfffffe0037796c00)
at /usr/src/sys/kern/kern_fork.c:1052
#15 <signal handler called>
(kgdb) f 9
#9 xpt_run_devq (devq=0xfffff806f74a1180) at /usr/src/sys/cam/cam_xpt.c:3448
3448 /usr/src/sys/cam/cam_xpt.c: No such file or directory.
(kgdb) p work_ccb
$1 = (union ccb *) 0xffffffff
(kgdb) p offsetof(union ccb, ccb_h.flags)
$2 = (u_int32_t *) 0x70
(kgdb) l
0xffffffff8034f5e0 is in xpt_run_devq (/usr/src/sys/cam/cam_xpt.c:3448).
3443 if (work_ccb == NULL) {
3444 printf("device on run queue with no
ccbs???\n");
3445 continue;
3446 }
3447
3448 if ((work_ccb->ccb_h.flags & CAM_HIGH_POWER) != 0) {
3449
3450 mtx_lock(&xsoftc.xpt_highpower_lock);
3451 if (xsoftc.num_highpower <= 0) {
3452 /*

--
You are receiving this mail because:
You are the assignee for the bug.

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de