Kernel oops in sym_int_sir

[Stefan Bader <stefan.bader@canonical.com>]

[-- Attachment #1: Type: text/plain, Size: 1494 bytes --]

While looking at a bug report [1] I found that the immediate cause of the crash
was in that specific case the reference cp->cmd for a printk:

/*
  * The device didn't switch to MSG IN phase after
  * having reselected the initiator.
  */
 case SIR_RESEL_NO_MSG_IN:
         scmd_printk(KERN_WARNING, cp->cmd,
                         "No MSG IN phase after reselection\n");
         goto out_stuck;

Unfortunately cp (that is returned by sym_ccb_from_dsa()) is NULL. This probably
is as old as 2.6.24 when this patch added the scmd_printk:

commit 3fb364e089e05c35ead55a08d56d3004193681f6
Author: Matthew Wilcox <matthew@wil.cx>
Date: Fri Oct 5 15:55:10 2007 -0400

    [SCSI] sym53c8xx: Use scmd_printk where appropriate

A quick research looks like it might be other cases where this happened[2].
Maybe more often (or solely?) when running in a VM (KVM). I even found some post
that looks like it tries to fix just this problem[3].

However without more knowledge about that driver it could also be a problem in
the hardware emulation so that normally cp == NULL should never happen. Or it
might be that the emulation is just running sufficiently "different" to cause
races to happen which never would be observed on real hardware.

Would [3] still make sense?

Thanks,
Stefan


[1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/992328
[2] http://www.mail-archive.com/kvm@vger.kernel.org/msg08927.html
[3] https://lkml.org/lkml/2010/11/18/495


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 900 bytes --]