On Tue, 2017-11-07 at 23:21 +0800, Ming Lei wrote: > cmd->cmnd can be allocated/freed dynamically in case of T10_PI_TYPE2_PROTECTION, > so we can't access it in scsi_show_rq() if 'SCpnt->cmnd != scsi_req(rq)->cmd', > because this request can be freed any time. That description is inaccurate. It is not allowed to free SCpnt->cmnd while a command is being executed. > diff --git a/drivers/scsi/scsi_debugfs.c b/drivers/scsi/scsi_debugfs.c > index 5e9755008aed..7a50878446b4 100644 > --- a/drivers/scsi/scsi_debugfs.c > +++ b/drivers/scsi/scsi_debugfs.c > @@ -9,7 +9,10 @@ void scsi_show_rq(struct seq_file *m, struct request *rq) > int msecs = jiffies_to_msecs(jiffies - cmd->jiffies_at_alloc); > char buf[80]; > > - __scsi_format_command(buf, sizeof(buf), cmd->cmnd, cmd->cmd_len); > + if (cmd->cmnd == scsi_req(rq)->cmd) > + __scsi_format_command(buf, sizeof(buf), cmd->cmnd, cmd->cmd_len); > + else > + strcpy(buf, "unknown"); > seq_printf(m, ", .cmd=%s, .retries=%d, allocated %d.%03d s ago", buf, > cmd->retries, msecs / 1000, msecs % 1000); > } This change introduces a new bug, namely that "unknown" will appear in the debugfs output if (cmd->cmnd != scsi_req(rq)->cmd). Have you considered to use the test (cmd->cmnd != NULL) instead? Additionally, if you really want to avoid that this code crashes if NULL is assigned to cmd->cmnd you will have to use READ_ONCE(cmd->cmnd). Bart.
