From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755454Ab1KBMhl (ORCPT ); Wed, 2 Nov 2011 08:37:41 -0400 Received: from TYO201.gate.nec.co.jp ([202.32.8.193]:57745 "EHLO tyo201.gate.nec.co.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753088Ab1KBMhi (ORCPT ); Wed, 2 Nov 2011 08:37:38 -0400 Message-ID: <4EB13972.30308@ce.jp.nec.com> Date: Wed, 02 Nov 2011 21:37:06 +0900 From: "Jun'ichi Nomura" User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.18) Gecko/20110621 Fedora/3.1.11-1.fc14 Thunderbird/3.1.11 MIME-Version: 1.0 To: Heiko Carstens CC: James Bottomley , Steffen Maier , "linux-scsi@vger.kernel.org" , Jens Axboe , Hannes Reinecke , Linux Kernel , Alan Stern , Thadeu Lima de Souza Cascardo , "Taraka R. Bodireddy" , "Seshagiri N. Ippili" , "Manvanthara B. Puttashankar" , Jeff Moyer , Shaohua Li , Mike Snitzer , gmuelas@de.ibm.com Subject: Re: [GIT PULL] Queue free fix (was Re: [PATCH] block: Free queue resources at blk_release_queue()) References: <4E96E2FF.6070601@linux.vnet.ibm.com> <1318608184.3018.42.camel@dabdike.int.hansenpartnership.com> <4E9BEB68.1050707@ce.jp.nec.com> <1318860403.4794.12.camel@dabdike.int.hansenpartnership.com> <4E9D7FA8.9000000@ce.jp.nec.com> <20111018154542.GB3869@osiris.boeblingen.de.ibm.com> <1318955380.5169.15.camel@dabdike.int.hansenpartnership.com> <20111031100557.GA2621@osiris.boeblingen.de.ibm.com> <1320057746.2964.1.camel@dabdike> <4EAE8A7E.8000504@ce.jp.nec.com> <20111031130004.GB4768@osiris.boeblingen.de.ibm.com> In-Reply-To: <20111031130004.GB4768@osiris.boeblingen.de.ibm.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/31/11 22:00, Heiko Carstens wrote: > On Mon, Oct 31, 2011 at 08:46:06PM +0900, Jun'ichi Nomura wrote: >> Hm, dm_softirq_done is generic completion code of original >> request in dm-multipath. >> So oops here might be another manifestation of use-after-free. >> >> Do you always hit the oops at the same address? > > I think we saw this bug the first time. But before that the scsi > logging level was higher. Gonzalo is trying to recreate it with > the same (old) scsi logging level. > Afterwards we will try with barrier=0. > > Both on v3.0.7 btw. > >> Could you find corresponding source code line for >> the crashed address, dm_softirq_done+0x72/0x140, >> and which pointer was invalid? > > It crashes in the inlined function dm_done() when trying to > dereference tio (aka clone->end_io_data): > > static void dm_done(struct request *clone, int error, bool mapped) > { > int r = error; > struct dm_rq_target_io *tio = clone->end_io_data; > dm_request_endio_fn rq_end_io = tio->ti->type->rq_end_io; Thank you. But, hmm. I have no idea about scenario. struct dm_rq_target_io is a container of clone request and clone->end_io_data points to its container. struct dm_rq_target_io { struct mapped_device *md; struct dm_target *ti; struct request *orig, clone; int error; union map_info info; }; If clone can be dereferenced, clone->end_io_data should be, too. -- Jun'ichi Nomura, NEC Corporation