kern/87191: aac(4) panics immediately with INVARIANTS

[Brian Fundakowski Feldman]

>Number:         87191
>Category:       kern
>Synopsis:       aac(4) panics immediately with INVARIANTS
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Oct 10 06:10:14 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Brian Fundakowski Feldman
>Release:        FreeBSD 6.0-RC1 i386
>Organization:
>Environment:
System: FreeBSD rex.vetinsite.net 6.0-RC1 FreeBSD 6.0-RC1 #2: Sun Oct 9 21:16:52 EDT 2005 root@:/usr/obj/usr/src/sys/REX i386
aac0: <Adaptec SCSI RAID 2410SA> mem 0xf8000000-0xfbffffff irq 25 at device 3.0 on pci2
aac0: [FAST]
aac0: Adaptec Raid Controller 2.0.0-1
>Description:
	When the kernel is compiled with INVARIANTS, lack of synchronization
	around the aac_describe_controller() contents results in a
	mutex assertion failure panic.
>How-To-Repeat:
	Recompile a kernel with INVARIANTS and INVARIANT_SUPPORT.
>Fix:
cvs diff: Diffing .
Index: aac.c
===================================================================
RCS file: /export/ncvs/src/sys/dev/aac/aac.c,v
retrieving revision 1.109.2.1
diff -u -5 -r1.109.2.1 aac.c
--- aac.c	9 Oct 2005 06:39:21 -0000	1.109.2.1
+++ aac.c	10 Oct 2005 01:15:50 -0000
@@ -2713,10 +2713,11 @@
 	struct aac_fib *fib;
 	struct aac_adapter_info	*info;
 
 	debug_called(2);
 
+	mtx_lock(&sc->aac_io_lock);
 	aac_alloc_sync_fib(sc, &fib);
 
 	fib->data[0] = 0;
 	if (aac_sync_fib(sc, RequestAdapterInfo, 0, fib, 1)) {
 		device_printf(sc->aac_dev, "RequestAdapterInfo failed\n");
@@ -2774,10 +2775,11 @@
 			      "\22NEWCOMM"
 			      "\23ARRAY64BIT"
 			      "\24HEATSENSOR");
 	}
 	aac_release_sync_fib(sc);
+	mtx_unlock(&sc->aac_io_lock);
 }
 
 /*
  * Look up a text description of a numeric error code and return a pointer to
  * same.
>Release-Note:
>Audit-Trail:
>Unformatted: