NetBSD Problem Report #59458

From dogcow@flippy.babymeat.com  Wed Jun  4 16:29:20 2025
Return-Path: <dogcow@flippy.babymeat.com>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 4D28C1A923A
	for <gnats-bugs@gnats.NetBSD.org>; Wed,  4 Jun 2025 16:29:20 +0000 (UTC)
Message-Id: <20250604162401.83E751D5EDA@flippy.babymeat.com>
Date: Wed, 04 Jun 2025 11:24:01 -0500 (CDT)
From: dogcow@babymeat.com
Reply-To: dogcow@babymeat.com
To: gnats-bugs@NetBSD.org
Subject: crash when removing raidframe component
X-Send-Pr-Version: 3.95

>Number:         59458
>Category:       kern
>Synopsis:       crash when removing raidframe component
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    oster
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jun 04 16:30:00 +0000 2025
>Last-Modified:  Wed Jun 04 16:52:15 +0000 2025
>Originator:     dogcow@babymeat.com
>Release:        NetBSD 10.99.14
>Organization:

>Environment:


System: NetBSD flippy.babymeat.com 10.99.14 NetBSD 10.99.14 (FLIPPY) #9: Tue Jun 3 18:32:21 CDT 2025 dogcow@flippy.babymeat.com:/crap/obj/hgcurobj/src/hg/src/sys/arch/amd64/compile/FLIPPY amd64
Architecture: x86_64
Machine: amd64
pts/0 dogcow@flippy: /src/hg/src 3064 % hg identify --num
519571+

>Description:
When removing a disk-exists-but-failed component from a configured raid
array, netbsd panics with
Jun  4 11:14:08 flippy savecore: reboot after panic: [ 250.8969354] panic: kernel diagnostic assertion "vp->v_writecount > 0" failed: file "/src/hg/src/sys/kern/vfs_vnops.c", line 487

and the gdb backtrace
#7  0xffffffff80486eca in rf_remove_component (
    raidPtr=raidPtr@entry=0xffffbd0020920208,
    component=component@entry=0xffffbd04b6664c2c)
    at /src/hg/src/sys/dev/raidframe/rf_disks.c:1244
1244                    return rf_delete_component(raidPtr, component);
(gdb) up
#8  0xffffffff8048fa22 in raidioctl (dev=<optimized out>, cmd=2151445015,
    data=0xffffbd04b6664ee0, flag=3, l=0xffff87c28837cc00)
    at /src/hg/src/sys/dev/raidframe/rf_netbsdkintf.c:1689
1689                    return rf_remove_component(raidPtr, &component);
(gdb) up
#9  0xffffffff805f3c7d in cdev_ioctl (dev=15907, cmd=2151445015,
    data=0xffffbd04b6664ee0, flag=3, l=<optimized out>)
    at /src/hg/src/sys/kern/subr_devsw.c:1535
1535            rv = (*d->d_ioctl)(dev, cmd, data, flag, l);


>How-To-Repeat:

[     6.548707] Configuring raid2:
[     6.548707] raid2: allocating 20 buffers of 65536 bytes.
[     6.548707] raid2: RAID Level 1
[     6.548707] raid2: Components: /dev/dk5 /dev/dk9[**FAILED**]
[     6.548707] raid2: Total Sectors: 9767540608 (4769306 MB)
[     6.558708] raid2: GPT GUID: 3d997aaa-31a6-4cf1-a005-2b2aca5f169e
[     6.558708] dk18 at raid2: "bk5tb", 9767540500 blocks at 64, type: ffs

pts/0 dogcow@flippy: ~ 3057 % sudo raidctl -r /dev/dk9 raid2
[crashes]

>Fix:

unknown, but I do have the kernel.gdb and core (-current is at hg rev 519571)

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: kern-bug-people->oster
Responsible-Changed-By: oster@NetBSD.org
Responsible-Changed-When: Wed, 04 Jun 2025 16:52:15 +0000
Responsible-Changed-Why:
RF PRs end up in my basket.


>Unformatted:

Home	PR Database Search