Re: sata_nv frees DMA memory with different size (possibly a generic libata bug)

[Robert Hancock <hancockrwd@gmail.com>]

Chuck Ebbert wrote:
> On Thu, 12 Feb 2009 21:03:38 -0600
> Robert Hancock <hancockrwd@gmail.com> wrote:
> 
>> Chuck Ebbert wrote:
>>> Fedora rawhide has the DMA API debug patch applied and it has found this...
>>>
>>> From https://bugzilla.redhat.com/show_bug.cgi?id=485172
>>>
>>> WARNING: at lib/dma-debug.c:439 check_unmap+0x16a/0x3dd() (Tainted: G        W
>>> )
>>> Hardware name: System Product Name
>>> sata_nv 0000:00:0d.0: DMA-API: device driver frees DMA memory with different
>>> size [device address=0x00000000da031000] [map size=4096 bytes] [unmap
>>> size=8192bytes]
>>> Modules linked in: bridge stp llc bnep sco l2cap bluetooth sunrpc ip6t_REJECT
>>> nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 cpufreq_ondemand
>>> powernow_k8freq_table dm_multipath uinput snd_hda_codec_analog snd_hda_intel
>>> snd_hda_codec snd_hwdep snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq
>>> snd_seq_device snd_pcm_oss ppdev snd_mixer_oss snd_pcm snd_timer firewire_ohci
>>> snd firewire_core soundcore aic7xxx snd_page_alloc jedec_probe crc_itu_t
>>> forcedeth scsi_transport_spi pcspkr cfi_probe gen_probe sata_sil24 parport_pc
>>> cfi_util parport mtd chipreg i2c_nforce2 map_funcs asus_atk0110 pata_amd
>>> i2c_core hwmon ata_generic pata_acpi sata_nv raid456 async_xor async_memcpy
>>> async_tx xor raid1 sha256_generic cbc aes_x86_64 aes_generic dm_crypt ext4 jbd2
>>> crc16 [last unloaded: scsi_wait_scan]
>>> Pid: 0, comm: swapper Tainted: G        W  2.6.29-0.99.rc4.git1.fc11.x86_64 #1
>>> Call Trace:
>>> <IRQ>  [<ffffffff81048822>] warn_slowpath+0xb7/0xe7
>>> [<ffffffff8137bc4f>] ? _spin_lock_irqsave+0x78/0x86
>>> [<ffffffff8119851b>] ? get_hash_bucket+0x28/0x34
>>> [<ffffffff8106a5ae>] ? trace_hardirqs_off_caller+0x1f/0xac
>>> [<ffffffff81198a15>] check_unmap+0x16a/0x3dd
>>> [<ffffffff810388a7>] ? resched_task+0x2e/0x74
>>> [<ffffffff81198d66>] debug_dma_unmap_sg+0x7c/0x9b
>>> [<ffffffff8106a648>] ? trace_hardirqs_off+0xd/0xf
>>> [<ffffffff8124fef9>] ata_sg_clean+0x96/0xd0
>>> [<ffffffff8124ff89>] __ata_qc_complete+0x56/0xc9
>>> [<ffffffff8125018b>] ata_qc_complete+0x18f/0x198
>>> [<ffffffffa00cb249>] nv_swncq_interrupt+0x358/0x688 [sata_nv]
>> That's rather curious. It seems to be saying that the sg length is 
>> different between the map and unmap, but it doesn't look like sata_nv 
>> mucks with that anywhere, and neither does libata core..
> 
> Could the SCSI code have merged two requests?

I wouldn't think so.. and if it did it seems like it would have to have 
changed the list after libata got the request somehow..