On Thu, 2018-02-08 at 09:00 -0800, tj@xxxxxxxxxx wrote: > On Thu, Feb 08, 2018 at 04:31:43PM +0000, Bart Van Assche wrote: > > The crash is reported at address scsi_times_out+0x17 == scsi_times_out+23. The > > instruction at that address tries to dereference scsi_cmnd.device (%rax). The > > register dump shows that that pointer has the value NULL. The only function I > > know of that clears the scsi_cmnd.device pointer is scsi_req_init(). The only > > caller of that function in the SCSI core is scsi_initialize_rq(). That function > > has two callers, namely scsi_init_command() and blk_get_request(). However, > > the scsi_cmnd.device pointer is not cleared when a request finishes. This is > > why I think that the above crash report indicates that scsi_times_out() was > > called for a request that was being reinitialized and not by device hotplugging. > > I could be misreading it but scsi_cmnd->device dereference should be > the following. > > 0x0000000000005bdd <+13>: mov 0x1b0(%rdi),%rax > > %rdi is @req, 0x1b0(%rdi) seems to be the combined arithmetic of > blk_mq_rq_to_pdu() and ->device dereference - 0x178 + 0x38. The > faulting access is (%rax), which is deref'ing host from device. Hello Tejun, I think "dereferencing a pointer" means reading the memory location that pointer points at? Anyway, I think we both interpret the crash report in the same way, namely that it means that scmd->device == NULL. Thanks, Bart.
