Date: Sat, 17 Feb 2018 07:47:14 -0700 From: Warner Losh <imp@bsdimp.com> To: Hans Petter Selasky <hps@selasky.org> Cc: Warner Losh <imp@freebsd.org>, FreeBSD Current <freebsd-current@freebsd.org> Subject: Re: panic in daprobedone: Unholding 4 with cnt = 0 Message-ID: <CANCZdfq7w%2BsTQQwRRya0kKfEwZTpmApB4jNCEZhP=93gcvzckg@mail.gmail.com> In-Reply-To: <fc0dc6c5-2ef4-db6b-cfa8-7868144ba6ab@selasky.org> References: <fc0dc6c5-2ef4-db6b-cfa8-7868144ba6ab@selasky.org>
next in thread | previous in thread | raw e-mail | index | archive | help
That's interesting. What did you do to get there? There's some code path
that's unholding the periph without first holding it. I've been trying to
find a scenario.
Warner
On Sat, Feb 17, 2018 at 5:01 AM, Hans Petter Selasky <hps@selasky.org>
wrote:
> I've started to hit this panic with USB mass storage, before even the
> device has become in-use:
>
> panic: Unholding 4 with cnt = 0
>
> Backtrace:
>
> vpanic()
> panic()
> daprobedone()
> dadone()
> xpt_done_process()
> xpt_done_td()
> fork_exit()
> fork_trampoline()
>
> db>
>
>
> static inline void
>> da_periph_unhold(struct cam_periph *periph, da_ref_token token)
>> {
>> int cnt;
>> struct da_softc *softc = periph->softc;
>>
>> token_sanity(token);
>> DA_PERIPH_PRINT(periph, "Unholding device %s (%d)\n",
>> da_ref_text[token], token);
>> cnt = atomic_fetchadd_int(&softc->ref_flags[token], -1);
>> if (cnt != 1)
>> panic("Unholding %d with cnt = %d", token, cnt);
>> cam_periph_unhold(periph);
>> }
>>
>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CANCZdfq7w%2BsTQQwRRya0kKfEwZTpmApB4jNCEZhP=93gcvzckg>