Re: kern/58422: kernel crash when using the iscsi initiator

[mlelstv%serpens.de@localhost (Michael van Elst)]

The following reply was made to PR kern/58422; it has been noted by GNATS.

From: mlelstv%serpens.de@localhost (Michael van Elst)
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/58422: kernel crash when using the iscsi initiator
Date: Sat, 20 Jul 2024 07:32:25 -0000 (UTC)

 6bone%6bone.informatik.uni-leipzig.de@localhost writes:
 
 >(gdb) target kvm netbsd.48.core
 >0xffffffff80237015 in cpu_reboot ()
 >(gdb) bt
 >#0  0xffffffff80237015 in cpu_reboot ()
 >#1  0xffffffff80d9da24 in kern_reboot ()
 >#2  0xffffffff80de7d8d in vpanic ()
 >#3  0xffffffff80fbd20f in kern_assert ()
 >#4  0xffffffff80f1d3d5 in wake_ccb ()
 >#5  0xffffffff80f0e2d7 in iscsi_cleanup_thread ()
 >#6  0xffffffff8020e787 in lwp_trampoline ()
 >#7  0x0000000000000000 in ?? ()
 
 
 Can you try this patch ?
 
 
 Index: sys/dev/iscsi/iscsi_ioctl.c
 ===================================================================
 RCS file: /cvsroot/src/sys/dev/iscsi/iscsi_ioctl.c,v
 retrieving revision 1.34
 diff -p -u -r1.34 iscsi_ioctl.c
 --- sys/dev/iscsi/iscsi_ioctl.c	25 Nov 2023 10:08:27 -0000	1.34
 +++ sys/dev/iscsi/iscsi_ioctl.c	20 Jul 2024 07:29:07 -0000
 @@ -1694,8 +1694,8 @@ ccb_timeout_start(ccb_t *ccb, int ticks)
  void
  ccb_timeout_stop(ccb_t *ccb)
  {
 -	callout_stop(&ccb->ccb_timeout);
  	mutex_enter(&iscsi_cleanup_mtx);
 +	callout_halt(&ccb->ccb_timeout, &iscsi_cleanup_mtx);
  	if (ccb->ccb_timedout == TOUT_QUEUED) {
  		TAILQ_REMOVE(&iscsi_timeout_ccb_list, ccb, ccb_tchain);
  		ccb->ccb_timedout = TOUT_NONE;
 Index: sys/dev/iscsi/iscsi_send.c
 ===================================================================
 RCS file: /cvsroot/src/sys/dev/iscsi/iscsi_send.c,v
 retrieving revision 1.40
 diff -p -u -r1.40 iscsi_send.c
 --- sys/dev/iscsi/iscsi_send.c	25 Nov 2023 10:08:27 -0000	1.40
 +++ sys/dev/iscsi/iscsi_send.c	20 Jul 2024 07:29:07 -0000
 @@ -1723,19 +1723,19 @@ ccb_timeout(ccb_t *ccb)
  {
  	connection_t *conn = ccb->ccb_connection;
  
 +	if (conn == NULL) {
 +		/* XXX Should never happen */
 +		printf("ccb_timeout: num=%d total=%d disp=%d invalid ccb=%p\n",
 +			ccb->ccb_num_timeouts+1, ccb->ccb_total_tries,
 +			ccb->ccb_disp, ccb);
 +		return;
 +	}
 +
  	ccb->ccb_total_tries++;
  
  	DEBC(conn, 0, ("ccb_timeout: num=%d total=%d disp=%d\n",
  		ccb->ccb_num_timeouts+1, ccb->ccb_total_tries, ccb->ccb_disp));
  
 -	/*
 -	 * XXX can we time out after connection is closed ?
 -	 */
 -	if (conn == NULL) {
 -		wake_ccb(ccb, ISCSI_STATUS_TIMEOUT);
 -		return;
 -	}
 -
  	if (++ccb->ccb_num_timeouts > MAX_CCB_TIMEOUTS ||
  		ccb->ccb_total_tries > MAX_CCB_TRIES ||
  		ccb->ccb_disp <= CCBDISP_FREE ||