kern/90882: [patch] Missing TAILQ_INIT() calls in dev/aac/aac.c

Frank Mayhar frank at
Sat Dec 24 10:20:07 PST 2005

>Number:         90882
>Category:       kern
>Synopsis:       [patch] Missing TAILQ_INIT() calls in dev/aac/aac.c
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Dec 24 18:20:03 GMT 2005
>Originator:     Frank Mayhar
>Release:        FreeBSD 6.0-STABLE i386
Exit Consulting 

System: FreeBSD 6.0-STABLE #19: Fri Dec 23 22:12:21 PST 2005
    frank at


In banging on a Dell Perc 320/DC RAID card, I ran into what appears to be a firmware crash that wedges the card.  The wedge opened a race condition that exposed the fact that the aac_ev_cmfree queue wasn't properly initialized, leading to a NULL pointer dereference in aac_add_event().  After code inspection, I also noticed that the aac_busy queue was also uninitialized.  Adding a TAILQ_INIT() fixed the panic (although not the firmware crash, sigh).	


Get a Perc 320/DC and beat on it.  When it wedges, try to look at the card with aaccli.  Bang, panic.


--- aac-patch begins here ---
Index: sys/dev/aac/aac.c
RCS file: /cvs/repos/src/sys/dev/aac/aac.c,v
retrieving revision
diff -u -r1.109.2.4 aac.c
--- sys/dev/aac/aac.c	8 Nov 2005 16:28:19 -0000
+++ sys/dev/aac/aac.c	24 Dec 2005 06:07:18 -0000
@@ -282,6 +282,8 @@
 	mtx_init(&sc->aac_io_lock, "AAC I/O lock", NULL, MTX_DEF);
 	mtx_init(&sc->aac_container_lock, "AAC container lock", NULL, MTX_DEF);
+	TAILQ_INIT(&sc->aac_ev_cmfree);
+	TAILQ_INIT(&sc->aac_busy);
 	/* Initialize the local AIF queue pointers */
 	sc->aac_aifq_head = sc->aac_aifq_tail = AAC_AIFQ_LENGTH;
--- aac-patch ends here ---


More information about the freebsd-bugs mailing list