Bug 214721 - [geom] [panic] graid panic: g_read_data: invalid length 262144
Summary: [geom] [panic] graid panic: g_read_data: invalid length 262144
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Many People
Assignee: freebsd-geom (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-11-21 23:01 UTC by nvass
Modified: 2017-01-12 07:00 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description nvass 2016-11-21 23:01:59 UTC 
Hi,

When one creates a provider with sector size larger than 32768, geom_raid will trigger a kernel panic. g_raid_md_taste_promise() calls g_read_data() with length > MAXPHYS (4 * sectorsize).

panic: g_read_data(): invalid length 262144
cpuid = 3
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe007b6d47a0
vpanic() at vpanic+0x182/frame 0xfffffe007b6d4820
kassert_panic() at kassert_panic+0x126/frame 0xfffffe007b6d4890
g_read_data() at g_read_data+0x45/frame 0xfffffe007b6d48d0
g_raid_md_taste_promise() at g_raid_md_taste_promise+0x104/frame 0xfffffe007b6d49c0
g_raid_taste() at g_raid_taste+0x18b/frame 0xfffffe007b6d4a10
g_new_provider_event() at g_new_provider_event+0xea/frame 0xfffffe007b6d4a30
g_run_events() at g_run_events+0x187/frame 0xfffffe007b6d4a70

How to repeat:
mdconfig -at swap -S 65536 -s 20M

This is similar to bug 147851 which was related to geom_raid3.
Comment 1 commit-hook freebsd_committer freebsd_triage 2017-01-12 06:59:01 UTC 
A commit references this bug:

Author: cem
Date: Thu Jan 12 06:58:32 UTC 2017
New revision: 311964
URL: https://svnweb.freebsd.org/changeset/base/311964

Log:
  g_raid: Prevent tasters from attempting excessively large reads

  Some g_raid tasters attempt metadata reads in multiples of the provider
  sectorsize.  Reads larger than MAXPHYS are invalid, so detect and abort
  in such situations.

  Spiritually similar to r217305 / PR 147851.

  PR:		214721
  Sponsored by:	Dell EMC Isilon

Changes:
  head/sys/geom/raid/md_ddf.c
  head/sys/geom/raid/md_promise.c