From owner-freebsd-current@freebsd.org Thu Mar 25 13:55:13 2021 Return-Path: Delivered-To: freebsd-current@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id F24B15BDE39 for ; Thu, 25 Mar 2021 13:55:13 +0000 (UTC) (envelope-from atliang@gmail.com) Received: from mail-pf1-x431.google.com (mail-pf1-x431.google.com [IPv6:2607:f8b0:4864:20::431]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4F5mnr6xlhz3MQK for ; Thu, 25 Mar 2021 13:55:12 +0000 (UTC) (envelope-from atliang@gmail.com) Received: by mail-pf1-x431.google.com with SMTP id 11so2134687pfn.9 for ; Thu, 25 Mar 2021 06:55:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=AA4oeklHP1xLxPBOfEiOEekQ8UfI/iGSmaL9csN2AqI=; b=Po6m3qzbxe0MUr1JYemixtQSbRXMk1ATcFYF2jRah3R5e6th8Drzw1nvw1OxCJj+T3 1AfBFKjrHmgehcc2G2SioIo/8ZCQILsRX5SuklwCmmep4IQb055yOwAx9IACLH4b9fsT 9MxWO/eBTHddkGcMQfWjG0D5AIClVnflFpmN9+7Kh//xXYv5DZLanRj4FK+M8tQ3cmZI gdlwjz3Z07BJCE0uDLMxDl1X3GZnNcWWM+Wo4CZjMl+9gMLT2exi0Vf4QCz65tuIm34+ +xOrf85yC1+eQuOg45IlyggoVS5osz0a8Q3hFn6dLA9Tzh6mCXjanqC4P0eUEcPpvk97 jvEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=AA4oeklHP1xLxPBOfEiOEekQ8UfI/iGSmaL9csN2AqI=; b=caaYVzVmp0kHCA2Exva//y75eNU+/Rmg88jb20nkYu32MNxBMIjXsCOBdh/ABblPz+ g9wZhvwWPbfe1PCNBw07znuxVav8sE4//Xk4AJu4i8YokwNKVulf0Z3uu1bpWZvm+iLc dSALqpWRLQ0X7tPVlsfy1NLrO0d2ZtJyby+9n7onxz86E+184lRXtxHqsxtpiMBDh4m6 wgq87o/nVmSECu5QIKYt5D5dqbaICzmTkP1+PjBwzw6ypY7AjVZv0WAzf/kkWFKRHciL dv41vUZ1XkzlsVP2rReXPSPg9pZh2AtZnMYx85XohS859t8Bee3Wku2BdYNGltX4FXBq AfnQ== X-Gm-Message-State: AOAM531/u+QBMU785IZ4uOfUQnWTiLh1v0nxpe2TV5tuZs/uiSCcgoy2 iO/nZae3R5QewWOohj1ioMXpbQR5SQ19uQwAndllvzZSL8lUWA== X-Google-Smtp-Source: ABdhPJz7VtPZonKK7qHlY9WbwCc9CHN624ifG/xYJT4dt0NRR1Hed9NY/4lgqZxq4eLdVfpNmcIt798ytBZGzfXJVEY= X-Received: by 2002:a63:3689:: with SMTP id d131mr4811083pga.261.1616680510917; Thu, 25 Mar 2021 06:55:10 -0700 (PDT) MIME-Version: 1.0 From: Tai-hwa Liang Date: Thu, 25 Mar 2021 21:54:59 +0800 Message-ID: Subject: GPF: xpt_done_process got invalid ccb_h->path->bus pointer To: freebsd-current@freebsd.org Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 4F5mnr6xlhz3MQK X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20161025 header.b=Po6m3qzb; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (mx1.freebsd.org: domain of atliang@gmail.com designates 2607:f8b0:4864:20::431 as permitted sender) smtp.mailfrom=atliang@gmail.com X-Spamd-Result: default: False [-2.01 / 15.00]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36:c]; FREEMAIL_FROM(0.00)[gmail.com]; TO_DN_NONE(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; RBL_DBL_DONT_QUERY_IPS(0.00)[2607:f8b0:4864:20::431:from]; FREEMAIL_ENVFROM(0.00)[gmail.com]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-0.995]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20161025]; FROM_HAS_DN(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; MIME_GOOD(-0.10)[text/plain]; PREVIOUSLY_DELIVERED(0.00)[freebsd-current@freebsd.org]; RCPT_COUNT_ONE(0.00)[1]; SPAMHAUS_ZRD(0.00)[2607:f8b0:4864:20::431:from:127.0.2.255]; NEURAL_SPAM_SHORT(0.98)[0.982]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::431:from]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[]; MAILMAN_DEST(0.00)[freebsd-current] X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Mar 2021 13:55:14 -0000 -CURRENT as of 24cd2796cf10211964be8a2cb3ea3e161adea746 This race can be triggered on a host with 1394 enclosure attached by using the following loop: while true; do kldload sbp; kldunload sbp done Fatal trap 9: general protection fault while in kernel mode cpuid = 13; apic id = 0d instruction pointer = 0x20:0xffffffff8038be3a stack pointer = 0x28:0xfffffe0269e07b30 frame pointer = 0x28:0xfffffe0269e07b60 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 41 (doneq0) trap number = 9 panic: general protection fault cpuid = 13 time = 1616639524 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0269e07840 vpanic() at vpanic+0x181/frame 0xfffffe0269e07890 panic() at panic+0x43/frame 0xfffffe0269e078f0 trap_fatal() at trap_fatal+0x387/frame 0xfffffe0269e07950 trap() at trap+0xa4/frame 0xfffffe0269e07a60 calltrap() at calltrap+0x8/frame 0xfffffe0269e07a60 --- trap 0x9, rip = 0xffffffff8038be3a, rsp = 0xfffffe0269e07b30, rbp = 0xfffffe0269e07b60 --- xpt_done_process() at xpt_done_process+0x12a/frame 0xfffffe0269e07b60 xpt_done_td() at xpt_done_td+0xf5/frame 0xfffffe0269e07bb0 fork_exit() at fork_exit+0x80/frame 0xfffffe0269e07bf0 fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0269e07bf0 --- trap 0, rip = 0, rsp = 0, rbp = 0 --- KDB: enter: panic __curthread () at /home/freebsd-current/sys/amd64/include/pcpu_aux.h:55 55 __asm("movq %%gs:%P1,%0" : "=r" (td) : "n" (offsetof(struct pcpu, (kgdb) where #0 __curthread () at /home/freebsd-current/sys/amd64/include/pcpu_aux.h:55 #1 doadump (textdump=textdump@entry=0) at /home/freebsd-current/sys/kern/kern_shutdown.c:399 #2 0xffffffff804c7d2a in db_dump (dummy=, dummy2=, dummy3=, dummy4=) at /home/freebsd-current/sys/ddb/db_command.c:575 #3 0xffffffff804c7aee in db_command (last_cmdp=, cmd_table=, dopager=dopager@entry=1) at /home/freebsd-current/sys/ddb/db_command.c:482 #4 0xffffffff804c782d in db_command_loop () at /home/freebsd-current/sys/ddb/db_command.c:535 #5 0xffffffff804cafb6 in db_trap (type=, code=) at /home/freebsd-current/sys/ddb/db_main.c:270 #6 0xffffffff80c5c754 in kdb_trap (type=type@entry=3, code=code@entry=0, tf=, tf@entry=0xfffffe0269e07770) at /home/freebsd-current/sys/kern/subr_kdb.c:727 #7 0xffffffff810bf97e in trap (frame=0xfffffe0269e07770) at /home/freebsd-current/sys/amd64/amd64/trap.c:576 #8 #9 kdb_enter (why=0xffffffff812b664a "panic", msg=) at /home/freebsd-current/sys/kern/subr_kdb.c:506 #10 0xffffffff80c0faf2 in vpanic (fmt=, ap=, ap@entry=0xfffffe0269e078d0) at /home/freebsd-current/sys/kern/kern_shutdown.c:907 #11 0xffffffff80c0f883 in panic (fmt=0xffffffff81e9a738 "\202;'\201\377\377\377\377") at /home/freebsd-current/sys/kern/kern_shutdown.c:843 #12 0xffffffff810bfdd7 in trap_fatal (frame=0xfffffe0269e07a70, eva=0) at /home/freebsd-current/sys/amd64/amd64/trap.c:915 #13 0xffffffff810bf264 in trap (frame=0xfffffe0269e07a70) at /home/freebsd-current/sys/amd64/amd64/trap.c:212 #14 #15 xpt_done_process (ccb_h=0xfffff80102f2f000) at /home/freebsd-current/sys/cam/cam_xpt.c:5419 #16 0xffffffff8038e0f5 in xpt_done_td (arg=arg@entry=0xffffffff81bc4980 ) at /home/freebsd-current/sys/cam/cam_xpt.c:5544 #17 0xffffffff80bc9a60 in fork_exit (callout=0xffffffff8038e000 , arg=0xffffffff81bc4980 , frame=0xfffffe0269e07c00) at /home/freebsd-current/sys/kern/kern_fork.c:1077 #18 (kgdb) up 15 #15 xpt_done_process (ccb_h=0xfffff80102f2f000) at /home/freebsd-current/sys/cam/cam_xpt.c:5419 5419 sim = ccb_h->path->bus->sim; (kgdb) print *ccb_h $1 = {pinfo = {priority = 1, generation = 11, index = -3}, xpt_links = {le = {le_next = 0x0, le_prev = 0x0}, sle = {sle_next = 0x0}, tqe = {tqe_next = 0x0, tqe_prev = 0x0}, stqe = { stqe_next = 0x0}}, sim_links = {le = {le_next = 0x0, le_prev = 0x0}, sle = {sle_next = 0x0}, tqe = {tqe_next = 0x0, tqe_prev = 0x0}, stqe = {stqe_next = 0x0}}, periph_links = {le = { le_next = 0xffffffffffffffff, le_prev = 0xffffffffffffffff}, sle = {sle_next = 0xffffffffffffffff}, tqe = {tqe_next = 0xffffffffffffffff, tqe_prev = 0xffffffffffffffff}, stqe = { stqe_next = 0xffffffffffffffff}}, retry_count = 0, cbfcnp = 0xffffffff826fdfe0 , func_code = XPT_SCAN_LUN, status = 1, path = 0xfffff820d9c10fa0, path_id = 6, target_id = 0, target_lun = 0, flags = 2048, xflags = 0, periph_priv = {entries = {{ptr = 0x0, field = 0, bytes = "\000\000\000\000\000\000\000"}, {ptr = 0x0, field = 0, bytes = "\000\000\000\000\000\000\000"}}, bytes = '\000' }, sim_priv = {entries = {{ptr = 0xfffff820d9d8dd80, field = 18446735418710351232, bytes = "\200\335\330\331 \370\377\377"}, {ptr = 0x0, field = 0, bytes = "\000\000\000\000\000\000\000"}}, bytes = "\200\335\330\331 \370\377\377\000\000\000\000\000\000\000"}, qos = {etime = 0x0, sim_data = 0, periph_data = 1050626691830}, timeout = 0, softtimeout = {tv_sec = 0, tv_usec = 0}} (kgdb) print *ccb_h->path $2 = {periph = 0xdeadc0dedeadc0de, bus = 0xdeadc0dedeadc0de, target = 0xdeadc0dedeadc0de, device = 0xffffffff81a49810 } (kgdb) print *ccb_h->path->bus access memory at address 0xdeadc0dedeadc0de Not sure how we ended up with device pointer appears to be valid whilst the others are 0xdeadc0dedeadc0de.