Bug 174684 - [tws] [patch] 3dm2 (or smartctl) triggers a kernel panic
Summary: [tws] [patch] 3dm2 (or smartctl) triggers a kernel panic
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 9.1-PRERELEASE
Hardware: Any Any
: Normal Affects Only Me
Assignee: Xin LI
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-12-24 15:40 UTC by Shunsuke Suganuma
Modified: 2014-03-14 01:10 UTC (History)
0 users

See Also:


Attachments
tws.patch (1.48 KB, patch)
2013-11-04 03:51 UTC, John-Mark Gurney
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Shunsuke Suganuma 2012-12-24 15:40:00 UTC
3dm2 or smartmontools(smartctl) with 3ware 9750 (tws driver) triggers
a kernel panic, when INVARIANTS/INVARIANT_SUPPORT are set as the kernel
option. 

[3dm2]
installed from ports

[smartmontools]
installed from ports
(For supporting tws, I've modified some of the code based on the info
obtained here: http://sourceforge.net/apps/trac/smartmontools/ticket/236)


Panic example:
<118>root{/}% smartctl -a --device=3ware,0 /dev/tws0
<118>smartctl 6.0 2012-10-10 r3643 [FreeBSD 9.1-PRERELEASE amd64] (local build)
<118>Copyright (C) 2002-12, Bruce Allen, Christian Franke, www.smartmontools.org
<118>
panic: sleepq_signal: invalid NULL wait channel
cpuid = 6
KDB: stack backtrace:
#0 0xffffffff80830bf6 at kdb_backtrace+0x66
#1 0xffffffff807fa558 at panic+0x1d8
#2 0xffffffff8083b1a8 at sleepq_signal+0xf8
#3 0xffffffff80803267 at wakeup_one+0x27
#4 0xffffffff806a907c at tws_ioctl+0x54c
#5 0xffffffff8074f00a at devfs_ioctl_f+0x7a
#6 0xffffffff80844e0f at kern_ioctl+0xcf
#7 0xffffffff8084509d at sys_ioctl+0xfd
#8 0xffffffff80a9e211 at amd64_syscall+0x2d1
#9 0xffffffff80a88d27 at Xfast_syscall+0xf7
Uptime: 5m20s
Dumping 722 out of 16338 MB:..3%..12%..23%..31%..43%..51%..62%..71%..82%..91%

Fix: 

The following change seems to prevent the panic.
(but I don't know if it's the correct fix for the problem.)


src/sys/dev/tws/tws_user.c:

@L208 in tws_passthru()

[before]
    wakeup_one(sc->chan);

[after]
    if ( sc->chan != NULL ) wakeup_one(sc->chan);
How-To-Repeat: 1.
build and install the kernel with:
options         INVARIANTS
options         INVARIANT_SUPPORT

2.
install ports/sysutils/3dm 2.11.00.019

3.
run 3dm2 with some appropriate config, then panic.
Comment 1 Shawn Wallbridge 2013-11-01 20:38:10 UTC
This is also effecting me with a 9.2-RELEASE machine.

shawn


________________________________

This e-mail is intended only for the named person or entity to which it is =
addressed and contains valuable business information that is proprietary, p=
rivileged, confidential and/or otherwise protected from disclosure. If you =
received this e-mail in error, any review, use, dissemination, distribution=
 or copying of this e-mail is strictly prohibited. Please notify us immedia=
tely of the error via e-mail to <ifpostmaster> postmaster@imaginaryforces.c=
om and please delete the e-mail from your system, retaining no copies in an=
y media. We appreciate your cooperation.

...imaginaryforces.com...=0D
Comment 2 John-Mark Gurney 2013-11-04 03:51:53 UTC
I have a better patch that eliminates the unnecessary chan, and just
uses sc as the wait channel...  The panic appears due to the fact that
chan might not be initalized, and running an extra wakeup is not a big
issue...

If someone could test the patch, I'll commit it..

Thanks.

-- 
  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."
Comment 3 Shawn Wallbridge 2013-11-04 22:50:04 UTC
I can confirm that this patch fixes the problem.

Thank you!

shawn


________________________________

This e-mail is intended only for the named person or entity to which it is =
addressed and contains valuable business information that is proprietary, p=
rivileged, confidential and/or otherwise protected from disclosure. If you =
received this e-mail in error, any review, use, dissemination, distribution=
 or copying of this e-mail is strictly prohibited. Please notify us immedia=
tely of the error via e-mail to <ifpostmaster> postmaster@imaginaryforces.c=
om and please delete the e-mail from your system, retaining no copies in an=
y media. We appreciate your cooperation.

...imaginaryforces.com...=0D
Comment 4 dfilter service freebsd_committer freebsd_triage 2014-02-27 21:42:06 UTC
Author: delphij
Date: Thu Feb 27 21:41:52 2014
New Revision: 262572
URL: http://svnweb.freebsd.org/changeset/base/262572

Log:
  Get rid of the 'chan' from softc structure and use the latter
  directly as sleep channel.
  
  PR:		kern/174684
  Submitted by:	jmg
  MFC after:	2 weeks

Modified:
  head/sys/dev/tws/tws.h
  head/sys/dev/tws/tws_cam.c
  head/sys/dev/tws/tws_user.c

Modified: head/sys/dev/tws/tws.h
==============================================================================
--- head/sys/dev/tws/tws.h	Thu Feb 27 21:01:10 2014	(r262571)
+++ head/sys/dev/tws/tws.h	Thu Feb 27 21:41:52 2014	(r262572)
@@ -248,7 +248,6 @@ struct tws_softc {
     struct mtx io_lock;                   /* IO  lock */
     struct tws_ioctl_lock ioctl_lock;     /* ioctl lock */ 
     u_int32_t seq_id;                     /* Sequence id */
-    void *chan;                           /* IOCTL req wait channel */
     struct tws_circular_q aen_q;          /* aen q */
     struct tws_circular_q trace_q;        /* trace q */
     struct tws_stats stats;               /* I/O stats */

Modified: head/sys/dev/tws/tws_cam.c
==============================================================================
--- head/sys/dev/tws/tws_cam.c	Thu Feb 27 21:01:10 2014	(r262571)
+++ head/sys/dev/tws/tws_cam.c	Thu Feb 27 21:41:52 2014	(r262572)
@@ -1297,7 +1297,7 @@ tws_reinit(void *arg)
 
     tws_turn_on_interrupts(sc);
 
-    wakeup_one(sc->chan);
+    wakeup_one(sc);
 }
 
 

Modified: head/sys/dev/tws/tws_user.c
==============================================================================
--- head/sys/dev/tws/tws_user.c	Thu Feb 27 21:01:10 2014	(r262571)
+++ head/sys/dev/tws/tws_user.c	Thu Feb 27 21:41:52 2014	(r262572)
@@ -103,8 +103,7 @@ tws_passthru(struct tws_softc *sc, void 
     do {
         req = tws_get_request(sc, TWS_REQ_TYPE_PASSTHRU);
         if ( !req ) {
-            sc->chan = (void *)sc;
-            error = tsleep(sc->chan,  0, "tws_sleep", TWS_IOCTL_TIMEOUT*hz);
+            error = tsleep(sc,  0, "tws_sleep", TWS_IOCTL_TIMEOUT*hz);
             if ( error == EWOULDBLOCK ) {
                 return(ETIMEDOUT);
             }
@@ -203,7 +202,7 @@ out_data:
     //
     req->state = TWS_REQ_STATE_FREE;
 
-    wakeup_one(sc->chan);
+    wakeup_one(sc);
 
     return(error);
 }
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
Comment 5 Xin LI freebsd_committer freebsd_triage 2014-02-27 22:56:27 UTC
State Changed
From-To: open->patched

Committed jmg@'s fix. 


Comment 6 Xin LI freebsd_committer freebsd_triage 2014-02-27 22:56:27 UTC
Responsible Changed
From-To: freebsd-bugs->delphij

Take.
Comment 7 dfilter service freebsd_committer freebsd_triage 2014-03-14 00:57:40 UTC
Author: delphij
Date: Fri Mar 14 00:57:32 2014
New Revision: 263125
URL: http://svnweb.freebsd.org/changeset/base/263125

Log:
  MFC r262572:
  
  Get rid of the 'chan' from softc structure and use the latter
  directly as sleep channel.
  
  PR:		kern/174684
  Submitted by:	jmg

Modified:
  stable/10/sys/dev/tws/tws.h
  stable/10/sys/dev/tws/tws_cam.c
  stable/10/sys/dev/tws/tws_user.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/dev/tws/tws.h
==============================================================================
--- stable/10/sys/dev/tws/tws.h	Fri Mar 14 00:49:02 2014	(r263124)
+++ stable/10/sys/dev/tws/tws.h	Fri Mar 14 00:57:32 2014	(r263125)
@@ -248,7 +248,6 @@ struct tws_softc {
     struct mtx io_lock;                   /* IO  lock */
     struct tws_ioctl_lock ioctl_lock;     /* ioctl lock */ 
     u_int32_t seq_id;                     /* Sequence id */
-    void *chan;                           /* IOCTL req wait channel */
     struct tws_circular_q aen_q;          /* aen q */
     struct tws_circular_q trace_q;        /* trace q */
     struct tws_stats stats;               /* I/O stats */

Modified: stable/10/sys/dev/tws/tws_cam.c
==============================================================================
--- stable/10/sys/dev/tws/tws_cam.c	Fri Mar 14 00:49:02 2014	(r263124)
+++ stable/10/sys/dev/tws/tws_cam.c	Fri Mar 14 00:57:32 2014	(r263125)
@@ -1297,7 +1297,7 @@ tws_reinit(void *arg)
 
     tws_turn_on_interrupts(sc);
 
-    wakeup_one(sc->chan);
+    wakeup_one(sc);
 }
 
 

Modified: stable/10/sys/dev/tws/tws_user.c
==============================================================================
--- stable/10/sys/dev/tws/tws_user.c	Fri Mar 14 00:49:02 2014	(r263124)
+++ stable/10/sys/dev/tws/tws_user.c	Fri Mar 14 00:57:32 2014	(r263125)
@@ -103,8 +103,7 @@ tws_passthru(struct tws_softc *sc, void 
     do {
         req = tws_get_request(sc, TWS_REQ_TYPE_PASSTHRU);
         if ( !req ) {
-            sc->chan = (void *)sc;
-            error = tsleep(sc->chan,  0, "tws_sleep", TWS_IOCTL_TIMEOUT*hz);
+            error = tsleep(sc,  0, "tws_sleep", TWS_IOCTL_TIMEOUT*hz);
             if ( error == EWOULDBLOCK ) {
                 return(ETIMEDOUT);
             }
@@ -203,7 +202,7 @@ out_data:
     //
     req->state = TWS_REQ_STATE_FREE;
 
-    wakeup_one(sc->chan);
+    wakeup_one(sc);
 
     return(error);
 }
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
Comment 8 dfilter service freebsd_committer freebsd_triage 2014-03-14 01:05:40 UTC
Author: delphij
Date: Fri Mar 14 01:05:32 2014
New Revision: 263126
URL: http://svnweb.freebsd.org/changeset/base/263126

Log:
  MFC r262572:
  
  Get rid of the 'chan' from softc structure and use the latter
  directly as sleep channel.
  
  PR:		kern/174684
  Submitted by:	jmg

Modified:
  stable/9/sys/dev/tws/tws.h
  stable/9/sys/dev/tws/tws_cam.c
  stable/9/sys/dev/tws/tws_user.c
Directory Properties:
  stable/9/sys/   (props changed)
  stable/9/sys/dev/   (props changed)

Changes in other areas also in this revision:
Modified:
  stable/8/sys/dev/tws/tws.h
  stable/8/sys/dev/tws/tws_cam.c
  stable/8/sys/dev/tws/tws_user.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/dev/   (props changed)
  stable/8/sys/dev/tws/   (props changed)

Modified: stable/9/sys/dev/tws/tws.h
==============================================================================
--- stable/9/sys/dev/tws/tws.h	Fri Mar 14 00:57:32 2014	(r263125)
+++ stable/9/sys/dev/tws/tws.h	Fri Mar 14 01:05:32 2014	(r263126)
@@ -248,7 +248,6 @@ struct tws_softc {
     struct mtx io_lock;                   /* IO  lock */
     struct tws_ioctl_lock ioctl_lock;     /* ioctl lock */ 
     u_int32_t seq_id;                     /* Sequence id */
-    void *chan;                           /* IOCTL req wait channel */
     struct tws_circular_q aen_q;          /* aen q */
     struct tws_circular_q trace_q;        /* trace q */
     struct tws_stats stats;               /* I/O stats */

Modified: stable/9/sys/dev/tws/tws_cam.c
==============================================================================
--- stable/9/sys/dev/tws/tws_cam.c	Fri Mar 14 00:57:32 2014	(r263125)
+++ stable/9/sys/dev/tws/tws_cam.c	Fri Mar 14 01:05:32 2014	(r263126)
@@ -1298,7 +1298,7 @@ tws_reinit(void *arg)
 
     tws_turn_on_interrupts(sc);
 
-    wakeup_one(sc->chan);
+    wakeup_one(sc);
 }
 
 

Modified: stable/9/sys/dev/tws/tws_user.c
==============================================================================
--- stable/9/sys/dev/tws/tws_user.c	Fri Mar 14 00:57:32 2014	(r263125)
+++ stable/9/sys/dev/tws/tws_user.c	Fri Mar 14 01:05:32 2014	(r263126)
@@ -105,8 +105,7 @@ tws_passthru(struct tws_softc *sc, void 
     do {
         req = tws_get_request(sc, TWS_REQ_TYPE_PASSTHRU);
         if ( !req ) {
-            sc->chan = (void *)sc;
-            error = tsleep(sc->chan,  0, "tws_sleep", TWS_IOCTL_TIMEOUT*hz);
+            error = tsleep(sc,  0, "tws_sleep", TWS_IOCTL_TIMEOUT*hz);
             if ( error == EWOULDBLOCK ) {
                 return(ETIMEDOUT);
             }
@@ -205,7 +204,7 @@ out_data:
     //
     req->state = TWS_REQ_STATE_FREE;
 
-    wakeup_one(sc->chan);
+    wakeup_one(sc);
 
     return(error);
 }
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
Comment 9 dfilter service freebsd_committer freebsd_triage 2014-03-14 01:05:47 UTC
Author: delphij
Date: Fri Mar 14 01:05:32 2014
New Revision: 263126
URL: http://svnweb.freebsd.org/changeset/base/263126

Log:
  MFC r262572:
  
  Get rid of the 'chan' from softc structure and use the latter
  directly as sleep channel.
  
  PR:		kern/174684
  Submitted by:	jmg

Modified:
  stable/8/sys/dev/tws/tws.h
  stable/8/sys/dev/tws/tws_cam.c
  stable/8/sys/dev/tws/tws_user.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/dev/   (props changed)
  stable/8/sys/dev/tws/   (props changed)

Changes in other areas also in this revision:
Modified:
  stable/9/sys/dev/tws/tws.h
  stable/9/sys/dev/tws/tws_cam.c
  stable/9/sys/dev/tws/tws_user.c
Directory Properties:
  stable/9/sys/   (props changed)
  stable/9/sys/dev/   (props changed)

Modified: stable/8/sys/dev/tws/tws.h
==============================================================================
--- stable/8/sys/dev/tws/tws.h	Fri Mar 14 00:57:32 2014	(r263125)
+++ stable/8/sys/dev/tws/tws.h	Fri Mar 14 01:05:32 2014	(r263126)
@@ -247,7 +247,6 @@ struct tws_softc {
     struct mtx io_lock;                   /* IO  lock */
     struct tws_ioctl_lock ioctl_lock;     /* ioctl lock */ 
     u_int32_t seq_id;                     /* Sequence id */
-    void *chan;                           /* IOCTL req wait channel */
     struct tws_circular_q aen_q;          /* aen q */
     struct tws_circular_q trace_q;        /* trace q */
     struct tws_stats stats;               /* I/O stats */

Modified: stable/8/sys/dev/tws/tws_cam.c
==============================================================================
--- stable/8/sys/dev/tws/tws_cam.c	Fri Mar 14 00:57:32 2014	(r263125)
+++ stable/8/sys/dev/tws/tws_cam.c	Fri Mar 14 01:05:32 2014	(r263126)
@@ -1323,7 +1323,7 @@ tws_reinit(void *arg)
 
     tws_turn_on_interrupts(sc);
 
-    wakeup_one(sc->chan);
+    wakeup_one(sc);
 }
 
 

Modified: stable/8/sys/dev/tws/tws_user.c
==============================================================================
--- stable/8/sys/dev/tws/tws_user.c	Fri Mar 14 00:57:32 2014	(r263125)
+++ stable/8/sys/dev/tws/tws_user.c	Fri Mar 14 01:05:32 2014	(r263126)
@@ -105,8 +105,7 @@ tws_passthru(struct tws_softc *sc, void 
     do {
         req = tws_get_request(sc, TWS_REQ_TYPE_PASSTHRU);
         if ( !req ) {
-            sc->chan = (void *)sc;
-            error = tsleep(sc->chan,  0, "tws_sleep", TWS_IOCTL_TIMEOUT*hz);
+            error = tsleep(sc,  0, "tws_sleep", TWS_IOCTL_TIMEOUT*hz);
             if ( error == EWOULDBLOCK ) {
                 return(ETIMEDOUT);
             }
@@ -205,7 +204,7 @@ out_data:
     //
     req->state = TWS_REQ_STATE_FREE;
 
-    wakeup_one(sc->chan);
+    wakeup_one(sc);
 
     return(error);
 }
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
Comment 10 Xin LI freebsd_committer freebsd_triage 2014-03-14 01:06:36 UTC
State Changed
From-To: patched->closed

Patch from jmg@ committed, thanks!