NetBSD Problem Report #60919

From tls@panix.com  Sat Oct 24 01:17:48 2026
Return-Path: <tls@panix.com>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id A86A41A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 24 Oct 2026 01:17:48 +0000 (UTC)
Message-Id: <4jBMSn6sKCzfYm@panix5.panix.com>
Date: Fri, 23 Oct 2026 21:17:45 -0400 (EDT)
From: tls@panix.com
Reply-To: tls@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: RAIDframe: failed and spared component autoconfigures as a
X-Send-Pr-Version: 3.95
X-From4GNATS: "tls@panix.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60919
>Category:       kern
>Synopsis:       RAIDframe: failed and spared component autoconfigures as a
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Oct 24 01:20:00 +0000 2026
>Last-Modified:  Wed Oct 28 21:35:01 +0000 2026
>Originator:     Thor Lancelot Simon
>Release:        NetBSD 11.0
>Organization:
>Environment:
System: NetBSD panix5.panix.com 11.0 NetBSD 11.0 (PANIX-WEBUSER) #0: Mon Oct 5 15:33:08 EDT 2026 root@juggler.panix.com:/misc/obj64/misc/devel/netbsd/11.0/src/sys/arch/amd64/compile/PANIX-WEBUSER amd64
Architecture: x86_64
Machine: amd64
>Description:
	When a component of an autoconfigurable RAID set is spared out
	and reconstructed onto a spare (or the set is left degraded),
	if that component is present and responsive when the system is
	rebooted, it may autoconfigure as a new, degraded RAID set of
	its own (e.g. half a new mirror) and can even hijack root
	autoconfiguration if the set was root-eligible.

>How-To-Repeat:
	1) Create an autoconfigurable RAID 1 mirror.  Add a hot spare.
	2) Fail one of the drives in the mirror and reconstruct onto the
	   spare.
	3) Reboot the system after reconstruction completes; both the
	   original RAID set, now composed of one original drive plus
	   the spare, will autoconfigure, but so will the drive that
	   was failed out.

	It appears that this happens because when rf_buildroothack()
	loops attempting to configure stacked RAID sets, at the second
	iteration the non-failed drives from the original RAID set are
	held busy, so they are skipped; the spared-out component appears
	to be a lonely remnant of "some other" RAID set and is configured
	as its own new thing.
>Fix:


>Audit-Trail:
From: "Thor Lancelot Simon" <tls@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60919 CVS commit: src
Date: Wed, 28 Oct 2026 21:33:13 +0000

 Module Name:	src
 Committed By:	tls
 Date:		Wed Oct 28 21:33:13 UTC 2026

 Modified Files:
 	src/sbin/raidctl: raidctl.c
 	src/sys/dev/raidframe: rf_disks.c rf_netbsdkintf.c rf_reconstruct.c

 Log Message:
 Fix PR kern/60919 (mysterious new RAID sets after a component is spared out)

 Note that this fix will only prevent _new_ kernels with the fix from creating
 these "rogue" sets from spared out components of mirrors.  It will not ignore
 nor delete any sets that may have been created in this way by an old kernel
 without the fix; to fix that, the user should raidctl -A no the rogue set and
 then delete it.  This is left as it is now from an abundance of caution; being
 less conservative could cause a lot of trouble for any users who may have,
 unfortunately, initialized multiple RAID sets with the same serial number.

 Other related fixes:

 1. Sparing out a component at runtime could leak its vnode and also
    disappear it from raidctl -s output if another spare was subsequently
    added.

 2. Make raidctl -r, -a, -R work with components that have been spared out.
    Fixes some leaks and zeroes existing labels.

 3. Avoid a case where we could pick the wrong disk to autoconfigure into a
    set if a previously-failed column fails a second time (pick the component
    with the highest mod counter, not the first component found).

 4. Prevent mixing disks with different sector sizes when reconstructing.

 5. Don't report ineligible members of the spares[] array in raidctl -G's
    'START spare' output; do report everything sensible in raidctl -s
    (some states like used_spare may not be sensible but the kernel no
    longer creates them so they should never be reported).


 To generate a diff of this commit:
 cvs rdiff -u -r1.90 -r1.91 src/sbin/raidctl/raidctl.c
 cvs rdiff -u -r1.98 -r1.99 src/sys/dev/raidframe/rf_disks.c
 cvs rdiff -u -r1.422 -r1.423 src/sys/dev/raidframe/rf_netbsdkintf.c
 cvs rdiff -u -r1.131 -r1.132 src/sys/dev/raidframe/rf_reconstruct.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:
 separate RAD set on reboot

Home	PR Database Search