iSCSI initiator panic on abrupt reconnect during in-flight write (kern/297019)

Loic Quillot <[email protected]> Fri, 24 Jul 2026 09:52:27 +0200
Newsgroups gmane.os.freebsd.devel.scsi,gmane.os.freebsd.devel.net
Message-ID <[email protected]> 
This is a multi-part message in MIME format.
--------------0XsMh2AsRl0R0viiI7xod1D6
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Dear Sirs,

   I just filed kern/297019 with a panic + backtrace + source-level 
analysis suggesting the iSCSI initiator can dereference stale write-data 
pages after an abrupt (ping-timeout-triggered) reconnect, if a 
retransmit of that write is still queued or in flight at the moment 
scsi_session_terminate_task() completes the CCB. CTL's target-side 
session-termination path (cfiscsi_session_terminate_tasks()) already 
waits for the analogous condition before proceeding 
(cs_outstanding_ctl_pdus); the initiator side doesn't have an 
equivalent, as far as I can find.

Confirmed the same code paths are present, unchanged, on releng/15.1 as 
well as the 14.4 branch the original panic occurred on -- details
and full backtrace in the PR.

I tried a simple code to add a per-task reference count, but can't 
confirm yet if the bug (the panic) is solved, as i cannot try it on real 
production servers.

Happy to provide any more data, or answer questions about the production 
context this was found in.

Thank you and best regards

Loic
--------------0XsMh2AsRl0R0viiI7xod1D6
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    Dear Sirs,<br>
    <br>
      I just filed kern/<span id="title">297019</span> with a panic +
    backtrace + source-level analysis suggesting the iSCSI initiator can
    dereference stale write-data pages after an abrupt
    (ping-timeout-triggered) reconnect, if a retransmit of that write is
    still queued or in flight at the moment 
    scsi_session_terminate_task() completes the CCB. CTL's target-side
    session-termination path (cfiscsi_session_terminate_tasks()) already
    waits for the analogous condition before proceeding
    (cs_outstanding_ctl_pdus); the initiator side doesn't have an
    equivalent, as far as I can find.<br>
    <br>
    Confirmed the same code paths are present, unchanged, on releng/15.1
    as well as the 14.4 branch the original panic occurred on -- details<br>
    and full backtrace in the PR.<br>
    <br>
    I tried a simple code to add a per-task reference count, but can't
    confirm yet if the bug (the panic) is solved, as i cannot try it on
    real production servers.<br>
    <br>
    Happy to provide any more data, or answer questions about the
    production context this was found in.<br>
    <br>
    Thank you and best regards<br>
    <br>
    Loic
  </body>
</html>

--------------0XsMh2AsRl0R0viiI7xod1D6--