On Sun, May 16, 2021 at 07:03:24PM +0100, Edward Tomasz Napierala wrote: > On 0516T1227, Warner Losh wrote: > > On Sun, May 16, 2021, 11:55 AM Mark Johnston <ma...@freebsd.org> wrote: > > > > > On Sun, May 16, 2021 at 10:45:35AM +0000, Edward Tomasz Napierala wrote: > > > > The branch main has been updated by trasz: > > > > > > > > URL: > > > https://cgit.FreeBSD.org/src/commit/?id=0f206cc91279e630ad9e733eb6e330b7dbe6c70e > > > > > > > > commit 0f206cc91279e630ad9e733eb6e330b7dbe6c70e > > > > Author: Edward Tomasz Napierala <tr...@freebsd.org> > > > > AuthorDate: 2021-05-16 09:28:04 +0000 > > > > Commit: Edward Tomasz Napierala <tr...@freebsd.org> > > > > CommitDate: 2021-05-16 10:38:26 +0000 > > > > > > > > cam: add missing zeroing of a stack-allocated CCB. > > > > > > > > This could cause a panic at boot. > > > > > > There are other instances of this, for example syzbot is currently > > > hitting an assertion, seemingly because the alloc_flags field of a > > > stack-allocated CCB was not zeroed: > > > https://syzkaller.appspot.com/bug?extid=2e9ce63919709feb3d1c > > > > > > I think the patch below will fix it, but I did not audit other callers. > > > It feels a bit strange to require all callers of xpt_setup_ccb() to > > > manually zero the structure first, can we provide a single routine to > > > initialize stack-allocated CCBs? > > We definitely could, although in some cases it's a bit more > complicated than that - a function that gets passed a CCB and then > calls xpt_setup_ccb() to fill it shouldn't zero it, as that would > be making assumption on how the CCB passed to it was allocated. > > Now that I look at the code, I can definitely see that I've missed > a couple of places. Perhaps I should replace those two KASSERTs with > diagnostic printfs for now, until I get that sorted out? > > > If we did, we could set a flag we could assert on, and/or do static > > analysis to find any others... > > That sounds promising, except I've never done anything like that; > I don't even know where to start.
Are stack-allocated ccbs passed around? In particular, can the thread that allocated the ccb, put to sleep while ccb is processed elsewere? This should break under swapping. _______________________________________________ dev-commits-src-main@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/dev-commits-src-main To unsubscribe, send any mail to "dev-commits-src-main-unsubscr...@freebsd.org"
