Re: [bug] ata subsystem related crash with latest -git

David Miller
2007-10-18T01:19:19Z

From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Wed, 17 Oct 2007 18:07:19 -0700 (PDT)

> sg_next() - as it stands now - never actually looks at the SG that its
> argument points to: it explicitly *only* looks at the next one.
>
> That's the bug. If sg_next() looked at the actual *current* sg entry, we
> wouldn't have any issues to begin with, and that's what I'm arguing we
> should do in the longer run (where "longer run" is defined as "when Jens
> does it asap").

What the thing really wants is some kind of indication of state,
without having to bloat up the scatterlist structure.

I believe that we have enough of a limited set of accessors to
sg->page that we can more aggressively encode things in the lower
bits.

I'm thinking of encoding the low two bits of sg->page as
follows:

1) bits == 0

then the SG list is linear and sg_next() is sg++

2) bits == 1

the nest SG is an indirect chunk, sg_next() is
therefore something like:

next = *((struct scatterlist **)(sg + 1));

3) bits == 2

this is the last entry in the scatterlist, sg_next() is NULL

So for the cases of ARCH_HAS_SG_CHAIN not being set (ie. back
compatible), we can do no bit encoding in page->flags and just do
sg_next() == sg++, as is done now.

When doing SG chaining, in each non-linear chunk we have to allocate
one more pointer past the end of the scatterlist array (instead of a
full extra scatterlist entry for the indirect pointer encode). Next,
all sg->page accesses have to be guarded to clear the state bits
out first.

I don't know, maybe it would work, and would make the loop termination
issues easier to handle properly.