From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: Oops in scsi_send_eh_cmnd 2.6.21-rc5-git6,7,10,13 Date: Thu, 05 Apr 2007 17:15:06 -0700 (PDT) Message-ID: <20070405.171506.125894469.davem@davemloft.net> References: <200704052213.l35MDRRR015981@cichlid.com> <20070405.153649.104035809.davem@davemloft.net> <1175817739.3714.43.camel@mulgrave.il.steeleye.com> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Return-path: Received: from 74-93-104-97-Washington.hfc.comcastbusiness.net ([74.93.104.97]:57823 "EHLO sunset.davemloft.net" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1752266AbXDFAPJ (ORCPT ); Thu, 5 Apr 2007 20:15:09 -0400 In-Reply-To: <1175817739.3714.43.camel@mulgrave.il.steeleye.com> Sender: linux-scsi-owner@vger.kernel.org List-Id: linux-scsi@vger.kernel.org To: James.Bottomley@SteelEye.com Cc: aab@cichlid.com, linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org From: James Bottomley Date: Thu, 05 Apr 2007 19:02:19 -0500 > On Thu, 2007-04-05 at 15:36 -0700, David Miller wrote: > > From: Andrew Burgess > > Date: Thu, 5 Apr 2007 15:13:27 -0700 > > > > > David, do you see any other problems with scsi_send_eh_cmnd? > > > > > > I've switched back to 2.6.18 which seems to not oops > > > and am happy to try patches. > > > > Does 2.6.20 with my patch OOPS too? Does reverting my patch > > make the oops go away? > > > > If reverting my patch makes the OOPS go away, we need to > > verify if page_address() is returning crap for some reason > > or the length is wrong. > > Assuming this does turn out to be the problem, we should just junk the > page allocation ... it's completely unnecessary; when the slab allocated > commands were done, we made sure the actual sense_buffer is at the > correct location, so this should be the final fix: This won't work I believe. There are cases that use smaller sense buffers than the minimum specified by the SCSI layer. One example is that do_sr_ioctl() stuff when the cgc passed in has a sense buffer. That will only be as large as a "struct request_sense". I'm pretty sure that's one of the reasons why we cons up a local sense buffer in this EH code. So we could walk past the end of that and corrupt memory with your patch.