Print this page 
6742 Freed and reused idm_conn_t buffer leads to system panic.
Reviewed by: Rob Gittins <rob.gittins@nexenta.com>
Reviewed by: Steve Ping <steve.ping@nexenta.com>
Reviewed by: Dan McDonald <danmcd@omniti.com>
Reviewed by: Yuri Pankov <yuri.pankov@nexenta.com>
Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/sys/idm/idm_conn_sm.h
          +++ new/usr/src/uts/common/sys/idm/idm_conn_sm.h
↓ open down ↓ 14 lines elided ↑ open up ↑ 
  15   15   * If applicable, add the following below this CDDL HEADER, with the
  16   16   * fields enclosed by brackets "[]" replaced with your own identifying
  17   17   * information: Portions Copyright [yyyy] [name of copyright owner]
  18   18   *
  19   19   * CDDL HEADER END
  20   20   */
  21   21  
  22   22  /*
  23   23   * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  24   24   * Use is subject to license terms.
       25 + * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  25   26   */
  26   27  #ifndef _IDM_CONN_SM_H_
  27   28  #define _IDM_CONN_SM_H_
  28   29  
  29   30  #ifdef  __cplusplus
  30   31  extern "C" {
  31   32  #endif
  32   33  
  33   34  
  34   35  /*
↓ open down ↓ 177 lines elided ↑ open up ↑ 
 212  213          "CS_S9_INIT_ERROR",
 213  214          "CS_S10_IN_CLEANUP",
 214  215          "CS_S11_COMPLETE",
 215  216          "CS_S12_ENABLE_DM",
 216  217          "CS_S9A_REJECTED",
 217  218          "CS_S9B_WAIT_SND_DONE",
 218  219          "CS_MAX_STATE"
 219  220  };
 220  221  #endif
 221  222  
      223 +/*
      224 + * Currently the state machine has a condition where idm_login_timeout() is
      225 + * left active after the connection has been closed. This causes the system
      226 + * to panic when idm_login_timeout() modifies the freed memory. In an attempt
      227 + * to isolate and find this issue special attention is being placed on
      228 + * the ic_state_timeout value. After each untimeout call the value will now
      229 + * be cleared. Just before the value is set the code will check for 0 and
      230 + * display an error. One final change is being done in idm_conn_sm_fini() which
      231 + * if ic_state_machine is not 0, an error message will be displayed and
      232 + * untimeout() called. That should prevent customer sites from seeing the
      233 + * panic. The code also calls ASSERT(0) which should cause a panic during
      234 + * system test.
      235 + */
      236 +#define IDM_SM_TIMER_CHECK(ic) \
      237 +        if (ic->ic_state_timeout) { \
      238 +                cmn_err(CE_WARN, "%s: existing timeout still set. " \
      239 +                    "state: %s, last: %s\n", __func__, \
      240 +                    idm_cs_name[ic->ic_state], \
      241 +                    idm_cs_name[ic->ic_last_state]); \
      242 +                ASSERT(0); \
      243 +        }
      244 +
      245 +#define IDM_SM_TIMER_CLEAR(ic) \
      246 +        (void) untimeout(ic->ic_state_timeout); \
      247 +        ic->ic_state_timeout = 0;
      248 +
 222  249  typedef enum {
 223  250          CT_NONE = 0,
 224  251          CT_RX_PDU,
 225  252          CT_TX_PDU
 226  253  } idm_pdu_event_type_t;
 227  254  
 228  255  typedef enum {
 229  256          CA_TX_PROTOCOL_ERROR,   /* Send "protocol error" to state machine */
 230  257          CA_RX_PROTOCOL_ERROR,   /* Send "protocol error" to state machine */
 231  258          CA_FORWARD,             /* State machine event and forward to client */
↓ open down ↓ 50 lines elided ↑ open up ↑ 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX