Project

General

Profile

Bug #5049

panic when removing log device

Added by Alex Reece about 5 years ago. Updated about 5 years ago.

Status:
Closed
Priority:
High
Assignee:
Category:
zfs - Zettabyte File System
Start date:
2014-07-30
Due date:
% Done:

100%

Estimated time:
1.00 h
Difficulty:
Bite-size
Tags:

Description

Steps to repro:

        ~% sudo zpool create test c1t1d0 log c1t2d0 c1t3d0
        ~% sudo zpool remove test c1t2d0 
        <PANIC!>
        > ::stack
        vdev_get_stats+0x14b(ffffff01cf836700, ffffff0007e31690)
        vdev_config_generate+0x37a(ffffff01df5bf000, ffffff01cf836700, 1, 0)
        vdev_config_generate+0x444(ffffff01df5bf000, ffffff01e09fd340, 1, 0)
        spa_config_generate+0x218(ffffff01df5bf000, 0, ffffffffffffffff, 1)
        spa_open_common+0xca(ffffff01d3be9000, ffffff0007e31b28,
fffffffff7a62ac2, 0, 
        ffffff0007e31ba8)
        spa_get_stats+0x54(ffffff01d3be9000, ffffff0007e31ba8,
ffffff01d3be9430, 800)
        zfs_ioc_pool_stats+0x2c(ffffff01d3be9000)
        zfsdev_ioctl+0x4a7(4200000000, 5a05, fe43e440, 100003,
ffffff01d2303180, 
        ffffff0007e31e68)
        cdev_ioctl+0x39(4200000000, 5a05, fe43e440, 100003, ffffff01d2303180, 
        ffffff0007e31e68)
        spec_ioctl+0x60(ffffff01d0f5e440, 5a05, fe43e440, 100003,
ffffff01d2303180, 
        ffffff0007e31e68)
        fop_ioctl+0x55(ffffff01d0f5e440, 5a05, fe43e440, 100003,
ffffff01d2303180, 
        ffffff0007e31e68)
        ioctl+0x9b(5, 5a05, fe43e440)
        _sys_sysenter_post_swapgs+0x149()

The panic seems to be a null pointer dereference in
vdev_get_stats:

        fa9e4066 2005-10-31 2601) vdev_get_stats(vdev_t *vd, vdev_stat_t *vs)
        fa9e4066 2005-10-31 2602) {
        ...<snip>...
        2e4c9986 2014-07-19 2616)    if (vd->vdev_aux == NULL && vd == vd->vdev_top)
        2e4c9986 2014-07-19 2617)            vs->vs_fragmentation = vd->vdev_mg->mg_fragmentation;

When a log device is removed, if it is not the last vdev, then it is turned
into a vdev_hole_ops vdev with a NULL vdev_mg (see excerpt from
spa_vdev_remove_from_namespace):

        if (last_vdev) {
                vdev_compact_children(rvd);
        } else {
                vd = vdev_alloc_common(spa, id, 0, &vdev_hole_ops);
                vdev_add_child(rvd, vd);
        }

It looks like the fix is fairly straightforward: in vdev_get_stats, check that
the vdev is not a hole before computing the fragmentation.

History

#1

Updated by Electric Monk about 5 years ago

  • % Done changed from 60 to 100
  • Status changed from In Progress to Closed

git commit 2986efa8094ce00f75df27fb74a184c65c38614a

commit  2986efa8094ce00f75df27fb74a184c65c38614a
Author: Alex Reece <alex@delphix.com>
Date:   2014-08-04T13:33:24.000Z

    5049 panic when removing log device
    Reviewed by: George Wilson <george.wilson@delphix.com>
    Reviewed by: Mattew Ahrens <mahrens@delphix.com>
    Reviewed by: Paul Dagnelie <paul.dagnelie@delphix.com>
    Reviewed by: Dan Kimmel <dan.kimmel@delphix.com>
    Reviewed by: Saso Kiselkov <skiselkov@gmail.com>
    Approved by: Rich Lowe <richlowe@richlowe.net>

Also available in: Atom PDF