kern/56417: Panic in ccb/iscsi

[joel.bertrand%systella.fr@localhost]

>Number:         56417
>Category:       kern
>Synopsis:       Panic in ccb/iscsi
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 24 07:25:00 +0000 2021
>Originator:     BERTRAND Joël
>Release:        netbsd-9
>Organization:
>Environment:
NetBSD legendre.systella.fr 9.2_STABLE NetBSD 9.2_STABLE (CUSTOM) #4: Sat Aug 28 14:27:27 CEST 2021  root%legendre.systella.fr@localhost:/usr/src/netbsd-9/obj/sys/arch/amd64/compile/CUSTOM amd64

>Description:
Hello,

On a server running NetBSD-9 (with a custom kernel that contains GENERIC options, ALTQ and iscsi patch to increase throughput), system randomly freezes or panics on iSCSI transactions.

This server acts as iSCSI targets (diskless workstations uses a ccd volume for swap and NFS for filesystems) and initiator (for a NAS connection).

When panic occurs, dmesg contains:

[ 308324,087343] S-1C-1: ccb_timeout: num=1 total=1 disp=0
[ 308324,087343] uvm_fault(0xffffffff81585e20, 0x0, 2) -> e
[ 308324,087343] fatal page fault in supervisor mode
[ 308324,087343] trap type 6 code 0x2 rip 0xffffffff802280cc cs 0x8
rflags 0x10246 cr2 0x10 ilevel 0 rsp 0xffff97813fa16f48
[ 308324,087343] curlwp 0xffffc947d4f304c0 pid 0.201 lowest kstack
0xffff97813fa142c0
[ 308324,087343] panic: trap
[ 308324,087343] cpu1: Begin traceback...
[ 308324,087343] vpanic() at netbsd:vpanic+0x160
[ 308324,087343] snprintf() at netbsd:snprintf
[ 308324,087343] startlwp() at netbsd:startlwp
[ 308324,087343] alltraps() at netbsd:alltraps+0xbb
[ 308324,087343] ccb_timeout() at iscsi:ccb_timeout+0xf0
[ 308324,087343] iscsi_cleanup_thread() at iscsi:iscsi_cleanup_thread+0x2b6
[ 308324,087343] cpu1: End traceback...
[ 308324,087343] uvm_fault(0xffffc947e69898d0, 0x0, 2) -> e
[ 308324,087343] fatal page fault in supervisor mode
[ 308324,087343] dumping to dev 18,1 (offset=251919, size=4162814):
[ 308324,087343] trap type 6 code 0x2 rip 0xffffffff80979c08 cs 0x8
rflags 0x10202 cr2 0x84 ilevel 0x8d urmspp  0xffff97813e116f00
[ 308324,087343] curlwp 0xffffc947e4110b40 pid 111.14 lowest kstack
0xffff97813e1142c0
[ 308324,697557] devi000030] cpu6: package 0, core 2, smt 1

Kernel doesn't enter in ddb and I don't have crash dump (why ?). But I
have a gdb kernel even if I don't know how to obtain usable information
on this kind of panic. ctrl+alt+esc does nothing.

Of course, I have a debug kernel, but addr2line -e doesn't return usable information:

legendre:[/] > addr2line -e netbsd.gdb 0xffffffff802280cc
??:?
legendre:[/] >

In this case, I think that panic comes from initiator:
[   150,675914] iscsi: attached.  major = 203
[   150,755943] scsibus0 at iscsi0: 1 target, 16 luns per target
[   150,755943] sd0 at scsibus0 target 0 lun 0: <QNAP, iSCSI Storage,
4.0> disk fixed
[   150,785954] sd0: fabricating a geometry
[   150,785954] sd0: 10980 GB, 11244416 cyl, 64 head, 32 sec, 512
bytes/sect x 23028563968 sectors
[   150,805960] sd0: fabricating a geometry
[   150,835972] sd0: GPT GUID: a5d27c7c-8eda-40e8-a29b-e85a539a5bc7
[   150,835972] dk6 at sd0: "bacula", 23028563901 blocks at 34, type: ffs
[   150,845976] sd0: async, 8-bit transfers, tagged queueing

Best regards,

JB

>How-To-Repeat:

>Fix: