Date: Mon, 24 Jun 2013 18:27:06 +0400 From: Daniil Cherednik <dcherednik@roshianokatachi.com> To: <freebsd-hackers@freebsd.org> Subject: panic in =?UTF-8?Q?g=5Fio=5Fschedule=5Fdown?= Message-ID: <cf2e58dacfe7d1baaff894f3a2965e20@roshianokatachi.com>
next in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
Hello. I have got panic, see attached file
We are using FreeBSD 8.3-amd64 but this part of code wasn`t modified in
HEAD
part of disassembled code:
ffffffff803d88b8: 4c 8b 43 18 mov 0x18(%rbx),%r8
ffffffff803d88bc: 89 c6 mov %eax,%esi
ffffffff803d88be: 4c 89 c2 mov %r8,%rdx
ffffffff803d88c1: 4c 89 c0 mov %r8,%rax
ffffffff803d88c4: 48 c1 fa 3f sar $0x3f,%rdx
ffffffff803d88c8: 48 f7 fe idiv %rsi
ffffffff803d88cb: 48 85 d2 test %rdx,%rdx
ffffffff803d88ce: 0f 85 29 01 00 00 jne ffffffff803d89fd
<g_io_schedule_down+0x21d>
ffffffff803d88d4: 48 8b 93 90 00 00 00 mov 0x90(%rbx),%rdx
ffffffff803d88db: 48 89 d0 mov %rdx,%rax
ffffffff803d88de: 48 c1 fa 3f sar $0x3f,%rdx
ffffffff803d88e2: 48 f7 fe idiv %rsi
ffffffff803d88e5: 48 85 d2 test %rdx,%rdx
ffffffff803d88e8: 0f 85 0f 01 00 00 jne ffffffff803d89fd
<g_io_schedule_down+0x21d>
ffffffff803d88ee: 4d 85 c0 test %r8,%r8
ffffffff803d88f1: 78 05 js ffffffff803d88f8
<g_io_schedule_down+0x118>
ffffffff803d88f3: 4d 39 c1 cmp %r8,%r9
ffffffff803d88f6: 7d 60 jge ffffffff803d8958
<g_io_schedule_down+0x178>
ffffffff803d88f8: be 05 00 00 00 mov $0x5,%esi
ffffffff803d88fd: 66 data16
ffffffff803d88fe: 66 data16
ffffffff803d88ff: 90 nop
ffffffff803d8900: 48 89 df mov %rbx,%rdi
ffffffff803d8903: e8 68 f7 ff ff callq ffffffff803d8070
<g_io_deliver>
ffffffff803d8908: e9 e3 fe ff ff jmpq ffffffff803d87f0
<g_io_schedule_down+0x10>
ffffffff803d890d: 66 data16
ffffffff803d890e: 66 data16
ffffffff803d890f: 90 nop
ffffffff803d8910: 44 8b 5a 34 mov 0x34(%rdx),%r11d
ffffffff803d8914: 45 85 db test %r11d,%r11d
g_io_check function was inlined and quite good optimized. But it look
like we have possibility to get access to wrong address in
g_io_check(struct bio *bp) function here:
if (cp->acr == 0)
return (EPERM);
break;
case BIO_WRITE:
case BIO_DELETE:
case BIO_FLUSH:
if (cp->acw == 0)
return (EPERM);
break;
default:
return (EPERM);
for example in g_io_deliver we have additional checking:
cp = bp->bio_from;
if (cp == NULL) {
bp->bio_error = error;
bp->bio_done(bp);
return;
}
also in this function we have KASSERTed bp and pp. So the question is
in which case bio_from can be equal to null? Do we have to do some
additional checks in g_io_check?
[-- Attachment #2 --]
GIF89aM
!!!"""###$$$%%%&&&'''((()))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}~~~!Created with GIMP , M H*\ȰCPRʐ3j܈@CIɆ%²s˗AI͛eɳgM;JѣHӧPJJ5$ӓWfMח]v,ѲfLx$ZoK]qK%߿
V#`V;L壑z{9̝CM :D ti R?06mafnnh`W8G^;Kw/s'?~8wޱDe,lk9B OCmx~)|D 2~Xxdp )5h> =F@K.\"%R"DQBc
$"O~CFI':&gX wc]d ()laVyQgrIYwyᣣh9'uVӜZ [ Ui^joȟwFb{
\G>
iF'Ϭو,⁚u
&ܯhUފ.xhbohJdGҙ
ވT* Zm~P&NQR
h1E`(j쀏I-n/8R9`~XǣO1*s<1> m~'v`m
iʾp}Nt/|b 4C` <&r~|t
==A*1CSpwWҨ.}Y
fGFX>f4=[~"~Lp}co/>-*_#mZ+.&/>&sR*$&q7Ʊ-oGb?C.B->:-s
AzuρG8
iQx$҅
*=\1Aa;Ȁcc.Z`D19i."R6TnLA2}oC"4װD! u0h,lЊVw'c@Y
ްLƺET ߈-n֯>v#tX<;VqGSEED[GM,f>Cf%Q{TrS 8\+0~Ns =5{lwd$JmA"Ea2pKL)Ĩ618KG<̈L%3o2 دv> 7CN5Q5v)v<Xе
t\w3\E Gtūm`OIq4rW3A%/BK"(Ļ
^vD%Ac X."P(2T +O%vr-hfkZ*T֧©(?LUJlQm6;V~*J^lp}DS άMؒd 浬IZ& Vluko{(`XCݪ)Ɯz2d9R?X[$TWM뵪
3W|P6{1v[.YFT@K ZQanpthQWiNzp]=?} J9v'&NzEz5H x[cM7a*bx*j~!CBFkGW0;ԐưɁa?R a|mnU)P}tߔc@N)U4:d*U<nٛPϲ|ȟ:dRy*iƜJm:\A}-vEJ٬,*p^v̐2Y*hL:2Xz64
lp[)1FiTv>yX$-8Ji_r8cjw,1j6ђW1f%0'nZjEtG
c-aL6Z82JdFcfƷPc{۴_@8ł+#`}}Dhpx,e,/ۿT&kJ0ff;wPC"9I8
eX##4ΕXdxIHj>:-eՊGA
NiLS J%u5 g X
nwwosd<kڐ/ܰNt"'t
-G+ὑi0'xAd9 FO`DBKg8ۡjY|>.2nAT+?u#<Ϋ芪7tqM.YO&qR{L7zn$r믎[_YJҮAc~ ~|}Elm-_uQ$}`pee'LQ.mE2H$ݱ):@7dıQ(([8ngTUV.<SwUVUEjb%PeEV`uX#5lZ'a74Q>.MǠ< YSIsXU&mu1[*Ue]EnTBMyV
C8~5t~Z?(nf#ȕh\:7BH[B_VTHX"R5# (Cv{8e)0_G_^fEW`Qy]m7o42b SB(vH"z=sO8!z<fٕd9yQViccGg#)I-4T<agc}''ȍ~6^͒Hz4ō?6BVb[)3%Dn4n2lcG^~G"Bp++FD,D>$y$Rm!gc2@s%fLĐG0:!K >0v@7b:9<Lh2.C
z}<؇Ruj4'x|J)!<(v$R?{AdZkwQq#$C7h9t8Q}}s!S";\Y@oNdQQrtPydYxÆ
7)h|rrRM8cy-nZ')CC%#}rsGa ƃ:h}y RmT}Y[(TqAQw÷)4(~*-I66m IOd /B~LT@vVL EPo'EsׅyƞR 7ukgAYU:B}
k_!ZsttDt5ohQpYE1VUHu4amZ#Svms>e2qVhVzC@Z*RuyXؘإ"a:tdc\TR
`ZY)a(qolJ[!szYjx*}|^J*1!ʦBOAj4zAZX1ڪJx!zazi*úźڧeaɺ:Jz:!ڭ*
:zڦкzʪ1A]Uq2e!ӥeIe[]+rLvE27f7e ҥqj}b +q&1.iZYQB/@d=և'EYEqHLaBKh^Vxnu* ۰g566Mo+0{^Bdz꧅Y @D46#I!@-k~c^RBk]PPsRhH`?(TkR y˗F?{6G"`W&1aٹxc<1 R;@2AO
(0(6Ѩp!:oWmRy۠'yQu*T;;s)S$*'3zq 玳<rt<M')ԕ`DypItwo$oFک6{oKᮑ3ZB o]afJ
OPt-,skj5n(P+Ft32%F)769w ?JJqѫaʱ R4ɠ|K~>ElUliE5$O%)°S֚y4h7N6} htCk 4Pl*V ~E!sj5AG,5Jue/1Y7d:l M[T6~s~C˰}LYpjw{A~ %#+dᲟψeE&\nzJ,Z|1M*ƌӌa9U!xKL<