5698 panic in mpt_sas: vmem_hash_delete(ffffff1aa3456000, 1, 8): bad free

Review Request #340 — Created Jan. 30, 2017 and submitted

marcel
illumos-gate
master
5698
ca5a84a...
general
webrev: http://cr.illumos.org/~webrev/marcel/il-5698-mpt_sas_bad_free_panic/

The panic happens when there is mptsas_restart_ioc() -> mptsas_init_chip() -> mptsas_alloc_sense_bufs() codepath executed, while there is some outstanding command waiting for a reply. In mptsas_alloc_sense_bufs() we rmfreemap/rmallocmap the resource map, including the space used by the pending command (here the "leaked 8 bytes" warning comes from). Once the pending command receives its reply the space used by the command is freed and we hit the panic with the "bad free" string.

More details at: https://www.illumos.org/issues/5698#note-14
I ran the following two scripts concurrently for several days on debug build:

# while true ; do sg_raw -r 1k /dev/rdsk/c4t5000CCA222CD61A1d0 12 00 00 00 60 00 > /dev/null 2>&1 ; echo -n "$?: "; date ; done
# while true ; do time ./mptreset /devices/pci@0,0/pci8086,d138@3/pci1000,3010@0:devctl ; date ; sleep 1 ; done

The similar test was ran by Dan Fields too.  Dan reproduced bug #7813 during
his testing.  I confirmed that bug #7813 is reproducible with vanilla illumos 
too, so it is not introduced by this fix.
  • 0
  • 0
  • 1
  • 0
  • 1
Description From Last Updated
marcel
andy_js
  1. I don't know the code well, but this looks reasonable.

  2. "or we didn't allocated" should be "or we didn't allocate".

  3. 
      
marcel
kojack
  1. Ship It!
  2. 
      
andy_js
  1. Ship It!
  2. 
      
marcel
Review request changed

Status: Closed (submitted)

Change Summary:

commit 2482ae1b96a558eec551575934d5f06c87b807af
Author:     Marcel Telka <marcel@telka.sk>
AuthorDate: Mon Jan 30 12:51:33 2017 +0100
Commit:     Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
CommitDate: Thu Feb 2 13:31:12 2017 +0100

    5698 panic in mpt_sas: vmem_hash_delete(ffffff1aa3456000, 1, 8): bad free
    Reviewed by: Dan Fields <danfields@fastmail.us>
    Reviewed by: Andrew Stormont <andyjstormont@gmail.com>
    Approved by: Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>

:100644 100644 72c8800... 00f3543... M  usr/src/uts/common/io/scsi/adapters/mpt_sas/mptsas.c
:100644 100644 3983188... 2465883... M  usr/src/uts/common/sys/scsi/adapters/mpt_sas/mptsas_var.h
Loading...