zfs discuss - Apr 2009 - vdev_disk_io_start() sending NULL pointer in ldi_ioctl()

Hi All,

 I have corefile where we see NULL pointer de-reference PANIC as we have 
sent (deliberately) NULL pointer for return value.


vdev_disk_io_start()
...
...

                 error = ldi_ioctl(dvd->vd_lh, zio->io_cmd,
                            (uintptr_t)&zio->io_dk_callback,
                            FKIOCTL, kcred, NULL);


ldi_ioctl() expects last parameter as an integer pointer ( int *rvalp).  
I see that in strdoictl().  Corefile I am analysing has similar BAD trap 
while trying to    stw        %g0, [%i5]      ( clr   [%i5] )

/*
                 * Set return value.
                 */
                *rvalp = iocbp->ioc_rval;


*/

Is it a bug??  This code is all we do in vdev_disk_io_start().  I would 
appreciate any feedback on this.

regards,
--shyamali

On Thu, 9 Apr 2009, Shyamali.Chakravarty at Sun.COM wrote:
> Hi All,
>
> I have corefile where we see NULL pointer de-reference PANIC as we have
sent
> (deliberately) NULL pointer for return value.
>
>
> vdev_disk_io_start()
>                error = ldi_ioctl(dvd->vd_lh, zio->io_cmd,
>                           (uintptr_t)&zio->io_dk_callback,
>                           FKIOCTL, kcred, NULL);
Note that it''s not just in vdev_disk_io_start() that we pass NULL. 
It''s
everywhere - there are four calls in vdev_disk.c to ldi_ioctl, and they 
all pass NULL.
> ldi_ioctl() expects last parameter as an integer pointer ( int *rvalp). 
> I see that in strdoictl().
I''m curious about your configuration.  What is the setup
you''ve got that
is going through stream i/o?


Regards,
markm

Shyamali.Chakravarty at Sun.COM wrote:
> Hi All,
>
> I have corefile where we see NULL pointer de-reference PANIC as we 
> have sent (deliberately) NULL pointer for return value.
>
>
> vdev_disk_io_start()
> ...
> ...
>
>                 error = ldi_ioctl(dvd->vd_lh, zio->io_cmd,
>                            (uintptr_t)&zio->io_dk_callback,
>                            FKIOCTL, kcred, NULL);
>
>
> ldi_ioctl() expects last parameter as an integer pointer ( int 
> *rvalp).  I see that in strdoictl().  Corefile I am analysing has 
> similar BAD trap while trying to    stw        %g0, [%i5]      ( clr   
> [%i5] )
This doesn''t make since as strdoictl() should only be called on a 
stream. Normal call path should be to cdev_ioctl() and eventually to 
sdioctl(). Can you provide the stack?

- George
>
> /*
>                 * Set return value.
>                 */
>                *rvalp = iocbp->ioc_rval;
>
>
> */
>
> Is it a bug??  This code is all we do in vdev_disk_io_start().  I 
> would appreciate any feedback on this.
>
> regards,
> --shyamali
> _______________________________________________
> zfs-discuss mailing list
> zfs-discuss at opensolaris.org
> http://mail.opensolaris.org/mailman/listinfo/zfs-discuss

Hi Mark,

 Thanks for responding.  In my case cdev_ioctl() is going through 
vxdmp:dmpioctl()

pc:  0x134ccb8 vxdmp:dmpioctl+0x8:   stw        %g0, [%i5]      ( clr   
[%i5] )
npc: 0x134ccbc vxdmp:dmpioctl+0xc:   or   %g0, %i0, %o0   ( mov   %i0, 
%o0 ) 
<trap>vxdmp:dmpioctl+0x8(, 0x422, 0x3000c3b7108, 0xffffffff80200000, 
0x60032c03df0, 0x0)
genunix:ldi_ioctl(0x6004c8cce78, 0x422, 0x3000c3b7108, 
0xffffffff80000000, 0x60032c03df0, 0x0) - frame recycled
zfs:vdev_disk_io_start+0xc8()
zfs:zio_vdev_io_start(0x3000c3b6eb8) - frame recycled

As we see %i5 is NULL  from ldi_ioctl()  we panic here.

--shyamali


On 04/10/09 06:26, Mark J Musante wrote:
> On Thu, 9 Apr 2009, Shyamali.Chakravarty at Sun.COM wrote:
>
>> Hi All,
>>
>> I have corefile where we see NULL pointer de-reference PANIC as we 
>> have sent (deliberately) NULL pointer for return value.
>>
>>
>> vdev_disk_io_start()
>>                error = ldi_ioctl(dvd->vd_lh, zio->io_cmd,
>>                           (uintptr_t)&zio->io_dk_callback,
>>                           FKIOCTL, kcred, NULL);
>
> Note that it''s not just in vdev_disk_io_start() that we pass NULL.
> It''s everywhere - there are four calls in vdev_disk.c to
ldi_ioctl,
> and they all pass NULL.
>
>> ldi_ioctl() expects last parameter as an integer pointer ( int 
>> *rvalp). I see that in strdoictl().
>
> I''m curious about your configuration.  What is the setup
you''ve got
> that is going through stream i/o?
>
>
> Regards,
> markm