kern/58422: kernel crash when using the iscsi initiator

[6bone%6bone.informatik.uni-leipzig.de@localhost]

>Number:         58422
>Category:       kern
>Synopsis:       kernel crash when using the iscsi initiator
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jul 12 09:05:00 +0000 2024
>Originator:     Uwe Toenjes
>Release:        NetBSD 10.0_STABLE
>Organization:
University of Leipzig
>Environment:
NetBSD 6bone.informatik.uni-leipzig.de 10.0_STABLE NetBSD 10.0_STABLE (MYCONF10.gdb) #1: Mon Jul  8 15:34:51 CEST 2024  root%6bone.informatik.uni-leipzig.de@localhost:/usr/obj/sys/arch/amd64/compile/MYCONF10.gdb amd64
>Description:
If you use the iscsi initiator, the kernel crashes after a few days. The behavior is reproducible.

output from: dmesg -M netbsd.47.core -N /netbsd

....
[ 44363.227068] S3C1: freeing UNUSED pdu
[ 44389.708635] S3C1: freeing UNUSED pdu
[ 44396.580012] S3C1: freeing UNUSED pdu
[ 44415.335063] S3C1: freeing UNUSED pdu
[ 44431.093458] S3C1: freeing UNUSED pdu
[ 44463.477924] S3C1: freeing UNUSED pdu
[ 44464.509811] S3C1: freeing UNUSED pdu
[ 44520.645690] S3C1: freeing UNUSED pdu
[ 44531.724707] S3C1: freeing UNUSED pdu
[ 85126.220101] S-1C-1: ccb_timeout: num=1 total=1 disp=0
[ 85126.220101] uvm_fault(0xffffffff8195d9a0, 0x0, 1) -> e
[ 85126.220101] fatal page fault in supervisor mode
[ 85126.220101] trap type 6 code 0 rip 0xffffffff80d8fc5d cs 0x8 rflags 0x10202 cr2 0x10 ilevel 0 rsp 0xffff940c9666ff10
[ 85126.220101] curlwp 0xffff82c9d7b87b00 pid 0.607 lowest kstack 0xffff940c9666b2c0
[ 85126.220101] panic: trap
[ 85126.220101] cpu2: Begin traceback...
[ 85126.220101] vpanic() at netbsd:vpanic+0x183
[ 85126.220101] panic() at netbsd:panic+0x3c
[ 85126.220101] trap() at netbsd:trap+0xb24
[ 85126.220101] --- trap (number 6) ---
[ 85126.230191] mutex_enter() at netbsd:mutex_enter+0x3e
[ 85126.230191] wake_ccb() at iscsi:wake_ccb+0x8e
[ 85126.230191] iscsi_cleanup_thread() at iscsi:iscsi_cleanup_thread+0x351
[ 85126.230191] cpu2: End traceback...

[ 85126.230191] dumping to dev 4,1 (offset=22227071, size=12581616):
[ 85126.230191] dump <4>ipmi0: workqueue busy: updates stopped
[ 85171.151680] mfi0: workqueue busy: updates stopped
[ 85171.151680] coretemp0: workqueue busy: updates stopped
[ 85171.151680] coretemp1: workqueue busy: updates stopped
[ 85171.151680] coretemp2: workqueue busy: updates stopped
[ 85171.151680] coretemp3: workqueue busy: updates stopped

gdb output:

Reading symbols from /netbsd...
(gdb) target kvm netbsd.47.core
0xffffffff80237015 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:717
717                     dumpsys();
(gdb) bt
#0  0xffffffff80237015 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:717
#1  0xffffffff80d9da24 in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/kern/kern_reboot.c:73
#2  0xffffffff80de7d8d in vpanic (fmt=fmt@entry=0xffffffff8139b6c8 "trap", ap=ap@entry=0xffff940c9666fcd8) at /usr/src/sys/kern/subr_prf.c:291
#3  0xffffffff80de7e62 in panic (fmt=fmt@entry=0xffffffff8139b6c8 "trap") at /usr/src/sys/kern/subr_prf.c:208
#4  0xffffffff80239e17 in trap (frame=0xffff940c9666fe20) at /usr/src/sys/arch/amd64/amd64/trap.c:326
#5  0xffffffff80231ef4 in alltraps ()
#6  0x0000000000000010 in ?? ()
#7  0xffff9400677341c8 in ?? ()
#8  0x0000000000000006 in ?? ()
#9  0x0000000000000000 in ?? ()


>How-To-Repeat:
See description. If you need additional information or the complete dump file, please let me know.
>Fix: