From frank@exit.com  Sat Dec 24 18:14:04 2005
Return-Path: <frank@exit.com>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 136BF16A41F
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 24 Dec 2005 18:14:04 +0000 (GMT)
	(envelope-from frank@exit.com)
Received: from tinker.exit.com (tinker.exit.com [206.223.0.1])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B3B9B43D5D
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 24 Dec 2005 18:14:03 +0000 (GMT)
	(envelope-from frank@exit.com)
Received: from jill.exit.com (jill.exit.com [206.223.0.4])
	by tinker.exit.com (8.13.4/8.13.4) with ESMTP id jBOIE3iH093106
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 24 Dec 2005 10:14:03 -0800 (PST)
	(envelope-from frank@exit.com)
Message-Id: <1135448043.0@jill.exit.com>
Date: Sat, 24 Dec 2005 10:14:03 -0800
From: "Frank Mayhar" <frank@exit.com>
To: "FreeBSD gnats submit" <FreeBSD-gnats-submit@freebsd.org>
Subject: [patch] Missing TAILQ_INIT() calls in dev/aac/aac.c
X-Send-Pr-Version: gtk-send-pr 0.4.6 
X-GNATS-Notify:

>Number:         90882
>Category:       kern
>Synopsis:       [aac] [patch] Missing TAILQ_INIT() calls in dev/aac/aac.c
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    scottl
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Dec 24 18:20:03 GMT 2005
>Closed-Date:    Wed Dec 28 21:21:47 GMT 2005
>Last-Modified:  Wed Dec 28 21:21:47 GMT 2005
>Originator:     Frank Mayhar
>Release:        FreeBSD 6.0-STABLE i386
>Organization:
Exit Consulting 
>Environment:


System: FreeBSD 6.0-STABLE #19: Fri Dec 23 22:12:21 PST 2005
    frank@jill.exit.com:/usr/obj/usr/src/sys/JILL



>Description:


In banging on a Dell Perc 320/DC RAID card, I ran into what appears to be a firmware crash that wedges the card.  The wedge opened a race condition that exposed the fact that the aac_ev_cmfree queue wasn't properly initialized, leading to a NULL pointer dereference in aac_add_event().  After code inspection, I also noticed that the aac_busy queue was also uninitialized.  Adding a TAILQ_INIT() fixed the panic (although not the firmware crash, sigh).	


>How-To-Repeat:


Get a Perc 320/DC and beat on it.  When it wedges, try to look at the card with aaccli.  Bang, panic.


>Fix:


--- aac-patch begins here ---
Index: sys/dev/aac/aac.c
===================================================================
RCS file: /cvs/repos/src/sys/dev/aac/aac.c,v
retrieving revision 1.109.2.4
diff -u -r1.109.2.4 aac.c
--- sys/dev/aac/aac.c	8 Nov 2005 16:28:19 -0000	1.109.2.4
+++ sys/dev/aac/aac.c	24 Dec 2005 06:07:18 -0000
@@ -282,6 +282,8 @@
 	mtx_init(&sc->aac_io_lock, "AAC I/O lock", NULL, MTX_DEF);
 	mtx_init(&sc->aac_container_lock, "AAC container lock", NULL, MTX_DEF);
 	TAILQ_INIT(&sc->aac_container_tqh);
+	TAILQ_INIT(&sc->aac_ev_cmfree);
+	TAILQ_INIT(&sc->aac_busy);
 
 	/* Initialize the local AIF queue pointers */
 	sc->aac_aifq_head = sc->aac_aifq_tail = AAC_AIFQ_LENGTH;
--- aac-patch ends here ---



>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->scottl 
Responsible-Changed-By: glebius 
Responsible-Changed-When: Tue Dec 27 08:50:45 UTC 2005 
Responsible-Changed-Why:  
To owner of the code. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=90882 
State-Changed-From-To: open->closed 
State-Changed-By: scottl 
State-Changed-When: Wed Dec 28 21:21:13 UTC 2005 
State-Changed-Why:  
Patch committed to CVS. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=90882 
>Unformatted:
