[Bug 252575] panic: camq_remove: Attempt to remove out-of-bounds index -2 from queue

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=252575

Alan Somers <asomers at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|bugs at FreeBSD.org            |scsi at FreeBSD.org
            Version|12.1-STABLE                 |12.2-RELEASE
                 CC|                            |asomers at FreeBSD.org

--- Comment #3 from Alan Somers <asomers at FreeBSD.org> ---
I can trigger this panic pretty reliably on 12.2 by doing a firmware update of
an mps card.  Updating a Broadcom 9207-8e card from firmware 19.00.00.00 to
20.00.07.00 succeeds, but when resetting the card it hits this panic.  I
haven't yet tried to do the update on 13.0, nor have I tried updating from
20.00.07.00 to the same version, 20.00.07.00.  The stack trace is a little bit
different:

panic: camq_remove: Attempt to remove out-of-bounds index -2 from queue
0xfffff80104dc0038 of size 1
cpuid = 14
time = 1617145521
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01b8b08860
vpanic() at vpanic+0x17b/frame 0xfffffe01b8b088b0
panic() at panic+0x43/frame 0xfffffe01b8b08910
camq_remove() at camq_remove+0xf6/frame 0xfffffe01b8b08930
xpt_run_devq() at xpt_run_devq+0x158/frame 0xfffffe01b8b08990
xpt_action_default() at xpt_action_default+0x7fd/frame 0xfffffe01b8b089e0
cam_periph_runccb() at cam_periph_runccb+0xe2/frame 0xfffffe01b8b08b30
enc_daemon() at enc_daemon+0x2d6/frame 0xfffffe01b8b08bb0
fork_exit() at fork_exit+0x7e/frame 0xfffffe01b8b08bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe01b8b08bf0

and the last entries in dmesg are the anodyne
mps2: Reinitializing controller
mps2: Firmware: 20.00.07.00, Driver: 21.02.00.00-fbsd
mps2: IOCCapabilities:
5a85c<ScsiTaskFull,DiagTrace,SnapBuf,EEDP,TransRetry,EventReplay,MSIXIndex,HostDisc>
mps2: Calling Reinit from mps_wait_command, timeout=60, elapsed=60
mps2: Reinitializing controller
mps2: Firmware: 20.00.07.00, Driver: 21.02.00.00-fbsd
mps2: IOCCapabilities:
5a85c<ScsiTaskFull,DiagTrace,SnapBuf,EEDP,TransRetry,EventReplay,MSIXIndex,HostDisc>

-- 
You are receiving this mail because:
You are the assignee for the bug.