Crash on WRITE SAME

Crash on WRITE SAME

[Mikulas Patocka]

Hi Sagi

Your commit d77e65350f2d82dfa0557707d505711f5a43c8fd causes crash on SCSI 
WRITE SAME command (it can be triggered by issuing the BLKZEROOUT ioctl). 
The crash happens in iscsi_tcp_segment_done because sg_next returns NULL.

Before that commit, there was this code in iscsi_prep_scsi_cmd_pdu:
	unsigned out_len = scsi_out(sc)->length;
after the commit, there is this:
	transfer_length = scsi_transfer_length(sc);
	... scsi_transfer_length(struct scsi_cmnd *scmd) returns 
	    blk_rq_bytes(scmd->request);

The problem is this: suppose that we have WRITE_SAME command that writes 
two 512-byte sectors. blk_rq_bytes(scmd->request) returns 1024 (because 
1024 bytes are written to the disk), but scsi_out(sc)->length contains the 
value 512 (because only 512 bytes are transferred as data for the SCSI 
command).

Your patch changes that from 512 to 1024 and it causes the crash in 
iscsi_tcp_segment_done due to mismatching size.



I'm not exactly sure how to fix this bug in order to not break something 
else.

I'd like to know what was your intention for the function 
scsi_transfer_length? Is it supposed to return the size of data 
transferred on the SCSI bus? What should it return for bidirectional 
commands?

scsi_transfer_length tries to add 8 for each transferred sector depending 
on prot_op. What should it do with commands that transfer only part of a 
sector? (for example the UNMAP command only transfers 24 bytes of data). 
Should it add 8 for a partial sector tranferred or not?

Mikulas

Re: Crash on WRITE SAME

[Christoph Hellwig]

On Wed, Jul 02, 2014 at 02:05:14PM -0400, Mikulas Patocka wrote:
> Hi Sagi
> 
> Your commit d77e65350f2d82dfa0557707d505711f5a43c8fd causes crash on SCSI 
> WRITE SAME command (it can be triggered by issuing the BLKZEROOUT ioctl). 
> The crash happens in iscsi_tcp_segment_done because sg_next returns NULL.

Martin already fixes this over a week ago, we're just waiting for James
to send a pull request to Linus.

Get this fix from the core-for-3.16 branch of
git.infradead.org/users/hch/scsi-queue.git for now.

Re: Crash on WRITE SAME

[Mikulas Patocka]

On Wed, 2 Jul 2014, Christoph Hellwig wrote:

> On Wed, Jul 02, 2014 at 02:05:14PM -0400, Mikulas Patocka wrote:
> > Hi Sagi
> > 
> > Your commit d77e65350f2d82dfa0557707d505711f5a43c8fd causes crash on SCSI 
> > WRITE SAME command (it can be triggered by issuing the BLKZEROOUT ioctl). 
> > The crash happens in iscsi_tcp_segment_done because sg_next returns NULL.
> 
> Martin already fixes this over a week ago, we're just waiting for James
> to send a pull request to Linus.
> 
> Get this fix from the core-for-3.16 branch of
> git.infradead.org/users/hch/scsi-queue.git for now.

I see.

And what about protection information for commands that transfer partial 
sectors? (for example, UMAP transfers 24 bytes). Should 
scsi_transfer_length return 24 or 32 in this case?

Mikulas

Re: Crash on WRITE SAME

[Christoph Hellwig]

On Wed, Jul 02, 2014 at 02:29:05PM -0400, Mikulas Patocka wrote:
> And what about protection information for commands that transfer partial 
> sectors? (for example, UMAP transfers 24 bytes). Should 
> scsi_transfer_length return 24 or 32 in this case?

As far as I understand so far PI is only defined for READ/WRITE
commands.  But I'll defer to Martin who is a much better source for
information on this topic.

Re: Crash on WRITE SAME

[Sagi Grimberg]

On 7/2/2014 9:36 PM, Christoph Hellwig wrote:
> On Wed, Jul 02, 2014 at 02:29:05PM -0400, Mikulas Patocka wrote:
>> And what about protection information for commands that transfer partial
>> sectors? (for example, UMAP transfers 24 bytes). Should
>> scsi_transfer_length return 24 or 32 in this case?
> As far as I understand so far PI is only defined for READ/WRITE
> commands.  But I'll defer to Martin who is a much better source for
> information on this topic.

hch is correct, PI supported operations are (stated in SBC)

a) COMPARE AND WRITE;
b) ORWRITE (16);
c) ORWRITE (32);
d) READ (10);
e) READ (12);
f) READ (16);
g) READ (32);
h) VERIFY (10);
i) VERIFY (12);
j) VERIFY (16);
k) VERIFY (32);
l) WRITE (10);
m) WRITE (12);
n) WRITE (16);
o) WRITE (32);
p) WRITE AND VERIFY (10);
q) WRITE AND VERIFY (12);
r) WRITE AND VERIFY (16);
s) WRITE AND VERIFY (32);
t) WRITE SAME (10);
u) WRITE SAME (16);
v) WRITE SAME (32);
y) XDWRITEREAD (10);
z) XDWRITEREAD (32);
aa) XPWRITE (10); and
ab) XPWRITE (32).

Sagi.