geom_uzip, panic: bio_length in mdstart_vnode()

[Konstantin Belousov]

On Wed, Dec 04, 2013 at 01:59:52PM +0100, Paolo Pinto wrote:
> Hi list!
> 
> My kernel is compiled with option INVARIANTS and I get a reproducible
> kernel panic when trying to read data from a GEOM based compressed
> memory disk:
> 
> Unread portion of the kernel message buffer:
> panic: bio_length 140288
> cpuid = 3
> KDB: stack backtrace:
> #0 0xffffffff80909726 at kdb_backtrace+0x66
> #1 0xffffffff808d0fa8 at panic+0x1d8
> #2 0xffffffff80595949 at mdstart_vnode+0x619

The issue is that geom_uzip creates bios which are larger than MAXPHYS.

As a workaround, the following patch should be enough.  It only fires
assert when md really uses pbuf, and since geom_uzip knows nothing
about unmapped bio, the assertion must not trigger.

diff --git a/sys/dev/md/md.c b/sys/dev/md/md.c
index 8ae51d1..639677e 100644
--- a/sys/dev/md/md.c
+++ b/sys/dev/md/md.c
@@ -746,12 +746,12 @@ mdstart_vnode(struct md_s *sc, struct bio *bp)
 		return (error);
 	}
 
-	KASSERT(bp->bio_length <= MAXPHYS, ("bio_length %jd",
-	    (uintmax_t)bp->bio_length));
 	if ((bp->bio_flags & BIO_UNMAPPED) == 0) {
 		pb = NULL;
 		aiov.iov_base = bp->bio_data;
 	} else {
+		KASSERT(bp->bio_length <= MAXPHYS, ("bio_length %jd",
+		    (uintmax_t)bp->bio_length));
 		pb = getpbuf(&md_vnode_pbuf_freecnt);
 		pmap_qenter((vm_offset_t)pb->b_data, bp->bio_ma, bp->bio_ma_n);
 		aiov.iov_base = (void *)((vm_offset_t)pb->b_data +
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 834 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-geom/attachments/20131204/3313a396/attachment.sig>