From owner-freebsd-bugs@freebsd.org Tue Mar 30 23:13:14 2021 Return-Path: Delivered-To: freebsd-bugs@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 0126B5B1FC6 for ; Tue, 30 Mar 2021 23:13:14 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mailman.nyi.freebsd.org (mailman.nyi.freebsd.org [IPv6:2610:1c1:1:606c::50:13]) by mx1.freebsd.org (Postfix) with ESMTP id 4F94xP6Qm8z3lQW for ; Tue, 30 Mar 2021 23:13:13 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: by mailman.nyi.freebsd.org (Postfix) id DADB75B1FC5; Tue, 30 Mar 2021 23:13:13 +0000 (UTC) Delivered-To: bugs@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id DAAAD5B2341 for ; Tue, 30 Mar 2021 23:13:13 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4F94xP5nclz3lYf for ; Tue, 30 Mar 2021 23:13:13 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id B7FF66D76 for ; Tue, 30 Mar 2021 23:13:13 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 12UNDDWB009476 for ; Tue, 30 Mar 2021 23:13:13 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 12UNDDbQ009475 for bugs@FreeBSD.org; Tue, 30 Mar 2021 23:13:13 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 252575] panic: camq_remove: Attempt to remove out-of-bounds index -2 from queue Date: Tue, 30 Mar 2021 23:13:13 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 12.2-RELEASE X-Bugzilla-Keywords: panic X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: asomers@FreeBSD.org X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: scsi@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: assigned_to version cc Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Mar 2021 23:13:14 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D252575 Alan Somers changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|bugs@FreeBSD.org |scsi@FreeBSD.org Version|12.1-STABLE |12.2-RELEASE CC| |asomers@FreeBSD.org --- Comment #3 from Alan Somers --- I can trigger this panic pretty reliably on 12.2 by doing a firmware update= of an mps card. Updating a Broadcom 9207-8e card from firmware 19.00.00.00 to 20.00.07.00 succeeds, but when resetting the card it hits this panic. I haven't yet tried to do the update on 13.0, nor have I tried updating from 20.00.07.00 to the same version, 20.00.07.00. The stack trace is a little = bit different: panic: camq_remove: Attempt to remove out-of-bounds index -2 from queue 0xfffff80104dc0038 of size 1 cpuid =3D 14 time =3D 1617145521 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01b8b08= 860 vpanic() at vpanic+0x17b/frame 0xfffffe01b8b088b0 panic() at panic+0x43/frame 0xfffffe01b8b08910 camq_remove() at camq_remove+0xf6/frame 0xfffffe01b8b08930 xpt_run_devq() at xpt_run_devq+0x158/frame 0xfffffe01b8b08990 xpt_action_default() at xpt_action_default+0x7fd/frame 0xfffffe01b8b089e0 cam_periph_runccb() at cam_periph_runccb+0xe2/frame 0xfffffe01b8b08b30 enc_daemon() at enc_daemon+0x2d6/frame 0xfffffe01b8b08bb0 fork_exit() at fork_exit+0x7e/frame 0xfffffe01b8b08bf0 fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe01b8b08bf0 and the last entries in dmesg are the anodyne mps2: Reinitializing controller mps2: Firmware: 20.00.07.00, Driver: 21.02.00.00-fbsd mps2: IOCCapabilities: 5a85c mps2: Calling Reinit from mps_wait_command, timeout=3D60, elapsed=3D60 mps2: Reinitializing controller mps2: Firmware: 20.00.07.00, Driver: 21.02.00.00-fbsd mps2: IOCCapabilities: 5a85c --=20 You are receiving this mail because: You are the assignee for the bug.=