ahci panics when detaching...

[John-Mark Gurney]

John Baldwin wrote this message on Mon, Jun 23, 2014 at 10:49 -0400:
> On Monday, June 23, 2014 9:44:08 am John-Mark Gurney wrote:
> > So, when I try to eject a ESATA card, the machine panics...  I am able
> > to successfully eject other cards, an ethernet (re) and a serial card
> > (uart), and both handle the removal of their device w/o issue and with
> > out crashes...
> > 
> > When I try w/ ahci, I get a panic...  The panic backtrace is:
> > #8  0xffffffff80ced4e2 in calltrap () at 
> ../../../amd64/amd64/exception.S:231
> > #9  0xffffffff8093d037 in rman_get_rid (r=0xfffff800064c9380)
> >     at ../../../kern/subr_rman.c:979
> > #10 0xffffffff8092b888 in resource_list_release_active 
> (rl=0xfffff80006d39c08,
> >     bus=0xfffff80002cd9000, child=0xfffff80006b6d700, type=3)
> >     at ../../../kern/subr_bus.c:3419
> > #11 0xffffffff8065d7a1 in pci_child_detached (dev=0xfffff80002cd9000,
> >     child=0xfffff80006b6d700) at ../../../dev/pci/pci.c:4133
> > ---Type <return> to continue, or q <return> to quit---
> > #12 0xffffffff80929708 in device_detach (dev=0xfffff80006b6d700)
> >     at bus_if.h:181
> > #13 0xffffffff8065f9f7 in pci_delete_child (dev=0xfffff80002cd9000,
> >     child=0xfffff80006b6d700) at ../../../dev/pci/pci.c:4710
> > 
> > In frame 9:
> > (kgdb) fr 9
> > #9  0xffffffff8093d037 in rman_get_rid (r=0xfffff800064c9380)
> >     at ../../../kern/subr_rman.c:979
> > 979             return (r->__r_i->r_rid);
> > (kgdb) print r
> > $1 = (struct resource *) 0xfffff800064c9380
> > (kgdb) print/x *r
> > $4 = {__r_i = 0xdeadc0dedeadc0de, r_bustag = 0xdeadc0dedeadc0de, 
> >   r_bushandle = 0xdeadc0dedeadc0de}
> > 
> > So, looks like something is corrupted the resource data...
> 
> This is the malloc junking on free.  However, I wonder if the
> problem is that the resource was freed without being properly
> cleared from the resource_list in the PCI ivars.  Is this with local
> patches that you have?

Yes, but I didn't patch any of the pci code, or the resource code, so
this bug is in the original code...  My patches only effect the attach
case, don't touch the detach case...

I was hoping someone who knows the code was like, yeh, I do remeber
that place in the code where we free something, but don't properly
NULL out the pointer, etc...

-- 
  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."