kern/57669: [iscsi] Panic in ccb_timeout

[joel.bertrand%systella.fr@localhost]

>Number:         57669
>Category:       kern
>Synopsis:       [iscsi] Panic in ccb_timeout
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 19 12:00:01 +0000 2023
>Originator:     BERTRAND Joël
>Release:        -10 beta
>Organization:
>Environment:
NetBSD legendre.systella.fr 10.0_BETA NetBSD 10.0_BETA (CUSTOM) #4: Sun Sep 24 21:59:27 CEST 2023  root%legendre.systella.fr@localhost:/usr/src/netbsd-10/obj/sys/arch/amd64/compile/CUSTOM amd64
CUSTOM=GENERIC+ALTQ support

>Description:
Hello,

I was pretty sure I have sent a PR with this issue but I unable to find it in database.

For a long time (since -9.1), iscsi initiator crashes and kernel panics with :

[ 3604460.041870] S-1C-1: ccb_timeout: num=1 total=1 disp=0
[ 3604460.041870] uvm_fault(0xffffffff819755e0, 0x0, 2) -> e
[ 3604460.041870] fatal page fault in supervisor mode
[ 3604460.041870] trap type 6 code 0x2 rip 0xffffffff8023fa4c cs 0x8 rflags 0x10246 cr2 0x10 ilevel 0 rsp 0xffffc70448066f68
[ 3604460.041870] curlwp 0xfffffe51a2c8a940 pid 0.325 lowest kstack 0xffffc704480622c0
[ 3604460.041870] panic: trap
[ 3604460.041870] cpu2: Begin traceback...
[ 3604460.041870] vpanic() at netbsd:vpanic+0x183
[ 3604460.041870] panic() at netbsd:panic+0x3c
[ 3604460.051870] trap() at netbsd:trap+0xbaf
[ 3604460.051870] --- trap (number 6) ---
[ 3604460.051870] mutex_enter() at netbsd:mutex_enter+0xc
[ 3604460.051870] ccb_timeout() at netbsd:ccb_timeout+0xa6
[ 3604460.061869] iscsi_cleanup_thread() at netbsd:iscsi_cleanup_thread+0x333
[ 3604460.061869] cpu2: End traceback...
[ 3604460.061869] dumping to dev 18,1 (offset=251919, size=4162814):

Unfortunately, I have upgraded my tree juste before panic and I don't have netbsd.gdb. Kernel notices that it dumps memory but after reboot /var/crash is empty.

>How-To-Repeat:
Two NAS (qNAP) using iSCSI. Each NAS is connected to an ethernet controler (only one IP addresse as wm0 and wm1 as grouped in bridge0).

bridge0: flags=0x41<UP,RUNNING> mtu 9000
   capabilities=0x3ff00<IP4CSUM_Rx,IP4CSUM_Tx,TCP4CSUM_Rx,TCP4CSUM_Tx>
   capabilities=0x3ff00<UDP4CSUM_Rx,UDP4CSUM_Tx,TCP6CSUM_Rx,TCP6CSUM_Tx>
   capabilities=0x3ff00<UDP6CSUM_Rx,UDP6CSUM_Tx>
   enabled=0x3ff00<IP4CSUM_Rx,IP4CSUM_Tx,TCP4CSUM_Rx,TCP4CSUM_Tx>
   enabled=0x3ff00<UDP4CSUM_Rx,UDP4CSUM_Tx,TCP6CSUM_Rx,TCP6CSUM_Tx>
   enabled=0x3ff00<UDP6CSUM_Rx,UDP6CSUM_Tx>
   status: active

iSCSI is configured without special feature:
name="iscsictl"
rcvar=$name
command="/sbin/${name}"
pidfile="/var/run/${name}.pid"

case $1 in
start)
    sleep 5
    ${command} add_send_target -a 192.168.12.2
    ${command} add_send_target -a 192.168.12.3
    ${command} refresh_targets
    ${command} list_targets
    ${command} login -P `iscsictl list_targets | \
        awk '/192.168.12.2/ { print $1; }' | tr -d ":"`
    ${command} login -P `iscsictl list_targets | \
        awk '/192.168.12.3/ { print $1; }' | tr -d ":"`
    sleep 1
    mount -o rw,log NAME=bacula /opt/bacula
    mount -o rw,log NAME=video /opt/video
    /etc/rc.d/mountd reload
    ;;

Wait now for panic (last panic occurs after 40 days).

>Fix: