NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

kern/60896: RAIDframe: inconsistent handling of queue length



>Number:         60896
>Category:       kern
>Synopsis:       multiple bugs interact so users' queue length settings are ignored or harmful
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Oct 18 02:20:01 +0000 2026
>Originator:     Thor Lancelot Simon
>Release:        NetBSD 11.0
>Organization:
>Environment:
System: NetBSD panix5.panix.com 11.0 NetBSD 11.0 (PANIX-WEBUSER) #0: Mon Oct 5 15:33:08 EDT 2026 root%juggler.panix.com@localhost:/misc/obj64/misc/devel/netbsd/11.0/src/sys/arch/amd64/compile/PANIX-WEBUSER amd64
Architecture: x86_64
Machine: amd64
>Description:
	The maxOutStandingDiskReqs parameter to RAIDFRAME_CONFIGURE is defined in raidframevar.h
	as a "char".  This of course means the range varies from platform to platform, which is
	"mitigated" in raidctl by the endearing idiom:

    		cfgPtr->maxOutstandingDiskReqs = val;
    		if (cfgPtr->maxOutstandingDiskReqs != val) {
    			warnx("Queue length for %s out of range"
    			    " [%d interp as %d], assuming 1",
    			    buf1, val, cfgPtr->maxOutstandingDiskReqs);
    			cfgPtr->maxOutstandingDiskReqs = 1;
    		}

	So, on different platforms, the range of possible values differs and clamping to 1 may
	or may not occur.  It's also nice that negative values are sometimes accepted.

	The newer "simple" mode (raidctl create) always uses queue length 1 but is
	documented as using 100.  Hooray.

	Finally, if a labelled RAID set is configured via raidframe -c to have a new queue
	length, the new queue length value is used, but not written back to the label, *except*
	in the special case of reconstruction.  Not actually harmless, because (though they
	really shouldn't), mismatched queue length values cause label mismatches and this will
	drop the reconstructed component out of the set at next autoconfigure.  Spooky.

>How-To-Repeat:
	Try to configure a RAID set with queue length 128.
>Fix:
	The "char" can be treated backwards-compatibly as an 8 bit integer ranging from 1 to
	256 (0 is already an illegal and impossible value).  The other two bugs have simple
	fixes as well.




Home | Main Index | Thread Index | Old Index