Bug 276039

Summary: Crash on sysctl -a with FreeBSD-15.0-CURRENT-amd64-20231228-fb03f7f8e30d-267242-memstick.img.xz
Product: Base System Reporter: Kurt Jaeger <pi>
Component: kernAssignee: Mark Johnston <markj>
Status: Closed FIXED    
Severity: Affects Some People CC: cy, markj, pi
Priority: --- Keywords: crash, regression
Version: 15.0-CURRENT   
Hardware: amd64   
OS: Any   
Attachments:
Description Flags
openzfs patch none

Description Kurt Jaeger freebsd_committer freebsd_triage 2023-12-31 16:33:19 UTC 
Running sysctl -a on a recent version of 15 causes a crash with:

sbuf_clear makes no sense on sbuf 0xfffff80231421e80 with drain

https://people.freebsd.org/~pi/crash-sysctl/

has two textdumps from a fresh install of

FreeBSD-15.0-CURRENT-amd64-20231228-fb03f7f8e30d-267242-memstick.img.xz

These are the last few lines of the msgbuf:

cpuid = 17
time = 1704039903
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe02dfa77960
vpanic() at vpanic+0x131/frame 0xfffffe02dfa77a90
panic() at panic+0x43/frame 0xfffffe02dfa77af0
sbuf_clear() at sbuf_clear+0xa8/frame 0xfffffe02dfa77b00
sbuf_cpy() at sbuf_cpy+0x56/frame 0xfffffe02dfa77b20
spa_taskq_write_param() at spa_taskq_write_param+0x85/frame 0xfffffe02dfa77bd0
sysctl_root_handler_locked() at sysctl_root_handler_locked+0x9c/frame 0xfffffe02dfa77c20
sysctl_root() at sysctl_root+0x21e/frame 0xfffffe02dfa77ca0
userland_sysctl() at userland_sysctl+0x184/frame 0xfffffe02dfa77d50
sys___sysctl() at sys___sysctl+0x60/frame 0xfffffe02dfa77e00
amd64_syscall() at amd64_syscall+0x153/frame 0xfffffe02dfa77f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe02dfa77f30
--- syscall (202, FreeBSD ELF64, __sysctl), rip = 0x39afc210319a, rsp = 0x39afbf80c098, rbp = 0x39afbf80c0d0 ---
KDB: enter: panic
Uptime: 18s
Comment 1 Mark Johnston freebsd_committer freebsd_triage 2023-12-31 17:00:46 UTC 
This will be fixed by https://github.com/openzfs/zfs/pull/15719
Comment 2 Kurt Jaeger freebsd_committer freebsd_triage 2023-12-31 19:44:48 UTC 
(In reply to Mark Johnston from comment #1)
Thanks -- is there a rough estimate on how long it will take to end up
in the repo ? I know, public holidays and such, but this currently stops
me from ports work 8-( (mail/exim update)
Comment 3 Mark Johnston freebsd_committer freebsd_triage 2024-01-01 01:09:48 UTC 
Created attachment 247382 [details]
openzfs patch

(In reply to Kurt Jaeger from comment #2)
I'd expect it to land within the next few days, but I'm not sure, folks are on holiday.  I'll commit directly to src if I don't get a follow-up tomorrow.  The patch against the src tree is attached, so you can apply that and rebuild your kernel in the meantime.
Comment 4 Kurt Jaeger freebsd_committer freebsd_triage 2024-01-01 08:12:24 UTC 
(In reply to Mark Johnston from comment #3)
Thanks, applied and rebooted, and sysctl -a works again.

There was another crash at a different place 3min after I started:

  poudriere jail -c -j 150 -a amd64 -b -m src=/usr/src -S /usr/src

I'll put it into another PR.
Comment 5 commit-hook freebsd_committer freebsd_triage 2024-01-01 19:01:05 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=09af4bf2c987f6f57804162cef8aeee05575ad1d

commit 09af4bf2c987f6f57804162cef8aeee05575ad1d
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2024-01-01 18:54:15 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2024-01-01 18:59:03 +0000

    zfs: Fix SPA sysctl handlers

    sbuf_cpy() resets the sbuf state, which is wrong for sbufs allocated by
    sbuf_new_for_sysctl().  In particular, this code triggers an assertion
    failure in sbuf_clear().

    Simplify by just using sysctl_handle_string() for both reading and
    setting the tunable.

    Apply to FreeBSD directly since this bug causes "sysctl -a" to crash the
    kernel.

    PR:             276039
    Reported by:    pho
    Reviewed by:    mav
    Pull Request:   https://github.com/openzfs/zfs/pull/15719

 sys/contrib/openzfs/module/zfs/spa.c | 30 ++++++------------------------
 1 file changed, 6 insertions(+), 24 deletions(-)