Re: kern/58776: RAIDframe panic on I/O error during reconstruction

["Michael van Elst via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/58776; it has been noted by GNATS.

From: mlelstv%serpens.de@localhost (Michael van Elst)
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/58776: RAIDframe panic on I/O error during reconstruction
Date: Wed, 30 Oct 2024 20:13:49 -0000 (UTC)

 gnats-admin%NetBSD.org@localhost ("oster%netbsd.org@localhost via gnats") writes:
 
 > So this "Recon write failed" is showing up *after* raid1 thinks that=20
 > the=20reconstruction has failed and is already done...  The code in=20
 > rf_reconstruct.c:ProcessReconEvent()=20in the RF_REVENT_WRITE_FAILED=20
 > case=20may not be sufficient.  More likely, it's the code in=20
 > rf_reconstruct.c:rf_ContinueReconstructFailedDisk()=20in the
 > 'if (recon_error) { /* we've encountered an error in reconstructing. */` =
 > case,=20
 > where=20perhaps we're not waiting for enough writes to complete?=20=20
 > (I=20need to look at how the IOs are scheduled again to figure out=20
 > if/how=20those 'extra writes' are getting generated, and then exactly=20
 > how=20to account for them..)
 
 
 It's a use-after free of the rctrl->eq_mutex. No idea how that happens.