geom_uzip, panic: bio_length in mdstart_vnode()

[Paolo Pinto]

Hi Konstantin,

Thanks for the workaround, it works for me; the assertion doesn't
trigger anymore.

On 12/04/2013 05:20 PM, Konstantin Belousov wrote:
> On Wed, Dec 04, 2013 at 01:59:52PM +0100, Paolo Pinto wrote:
>> Hi list!
>>
>> My kernel is compiled with option INVARIANTS and I get a reproducible
>> kernel panic when trying to read data from a GEOM based compressed
>> memory disk:
>>
>> Unread portion of the kernel message buffer:
>> panic: bio_length 140288
>> cpuid = 3
>> KDB: stack backtrace:
>> #0 0xffffffff80909726 at kdb_backtrace+0x66
>> #1 0xffffffff808d0fa8 at panic+0x1d8
>> #2 0xffffffff80595949 at mdstart_vnode+0x619
> 
> The issue is that geom_uzip creates bios which are larger than MAXPHYS.
> 
> As a workaround, the following patch should be enough.  It only fires
> assert when md really uses pbuf, and since geom_uzip knows nothing
> about unmapped bio, the assertion must not trigger.
> 
> diff --git a/sys/dev/md/md.c b/sys/dev/md/md.c
> index 8ae51d1..639677e 100644
> --- a/sys/dev/md/md.c
> +++ b/sys/dev/md/md.c
> @@ -746,12 +746,12 @@ mdstart_vnode(struct md_s *sc, struct bio *bp)
>  		return (error);
>  	}
>  
> -	KASSERT(bp->bio_length <= MAXPHYS, ("bio_length %jd",
> -	    (uintmax_t)bp->bio_length));
>  	if ((bp->bio_flags & BIO_UNMAPPED) == 0) {
>  		pb = NULL;
>  		aiov.iov_base = bp->bio_data;
>  	} else {
> +		KASSERT(bp->bio_length <= MAXPHYS, ("bio_length %jd",
> +		    (uintmax_t)bp->bio_length));
>  		pb = getpbuf(&md_vnode_pbuf_freecnt);
>  		pmap_qenter((vm_offset_t)pb->b_data, bp->bio_ma, bp->bio_ma_n);
>  		aiov.iov_base = (void *)((vm_offset_t)pb->b_data +
> 

-- 
Paolo Pinto
R&D System Engineer

NETASQ - We secure IT

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2268 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.freebsd.org/pipermail/freebsd-geom/attachments/20131209/2c1512a2/attachment.bin>