Re: BUG: unable to handle kernel NULL pointer dereference in transport_allocate_data_tasks+0x1af/0x2cc [target_core_mod]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, 2011-08-12 at 15:40 -0700, Kiran Patil wrote:
> Hi Chris, Nick,
> 
> Please see my suggested solution and I also have patch (I can send
> that patch later) for that Bogus SGL issue. 
> 
> But after fixing that issue, ran into another issue (not NULL pointer
> deference). Please read my response.
> 

Hi Kiran & Co,

> On 8/12/2011 2:11 PM, Chris Boot wrote: 
> > On 09/08/2011 09:15, Chris Boot wrote: 

<SNIP>

> > Well, I tried applying the patchset nab posted to the list yesterday
> > ([PATCH 0/3] target: various CDB processing fixes for -rc2) to my
> > kernel and giving it another whirl. The bug I had is still there,
> > but doesn't make the target hang - and I see some new messages too.
> > The logging is _extremely_ verbose so sifting through the log has
> > been fun... I should add that I did this last test on Windows
> > instead of Linux (sorry for all the swapping around). 
> > 
> > Aug 12 22:02:17 tarquin kernel: [  630.413521] Setup task->task_sg:
> > ffff880423cee800 task->task_sg_nents: 62 
> > Aug 12 22:02:17 tarquin kernel: [  630.413522] sg[0] Remaining
> > task_size: 122880 cmd_sg: ffff880423da2400 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413523] sg[1] Remaining
> > task_size: 118784 cmd_sg: ffff880423da2420 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413525] sg[2] Remaining
> > task_size: 114688 cmd_sg: ffff880423da2440 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413526] sg[3] Remaining
> > task_size: 110592 cmd_sg: ffff880423da2460 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413528] sg[4] Remaining
> > task_size: 106496 cmd_sg: ffff880423da2480 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413529] sg[5] Remaining
> > task_size: 102400 cmd_sg: ffff880423da24a0 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413530] sg[6] Remaining
> > task_size: 98304 cmd_sg: ffff880423da24c0 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413532] sg[7] Remaining
> > task_size: 94208 cmd_sg: ffff880423da24e0 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413533] sg[8] Remaining
> > task_size: 90112 cmd_sg: ffff880423da2500 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413535] sg[9] Remaining
> > task_size: 86016 cmd_sg: ffff880423da2520 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413536] sg[10] Remaining
> > task_size: 81920 cmd_sg: ffff880423da2540 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413537] sg[11] Remaining
> > task_size: 77824 cmd_sg: ffff880423da2560 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413539] sg[12] Remaining
> > task_size: 73728 cmd_sg: ffff880423da2580 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413540] sg[13] Remaining
> > task_size: 69632 cmd_sg: ffff880423da25a0 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413541] sg[14] Remaining
> > task_size: 65536 cmd_sg: ffff880423da25c0 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413543] sg[15] Remaining
> > task_size: 61440 cmd_sg: ffff880423da25e0 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413544] sg[16] Remaining
> > task_size: 57344 cmd_sg: ffff880423da2600 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413546] sg[17] Remaining
> > task_size: 53248 cmd_sg: ffff880423da2620 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413547] sg[18] Remaining
> > task_size: 49152 cmd_sg: ffff880423da2640 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413548] sg[19] Remaining
> > task_size: 45056 cmd_sg: ffff880423da2660 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413550] sg[20] Remaining
> > task_size: 40960 cmd_sg: ffff880423da2680 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413551] sg[21] Remaining
> > task_size: 36864 cmd_sg: ffff880423da26a0 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413552] sg[22] Remaining
> > task_size: 32768 cmd_sg: ffff880423da26c0 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413554] sg[23] Remaining
> > task_size: 28672 cmd_sg: ffff880423da26e0 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413555] sg[24] Remaining
> > task_size: 24576 cmd_sg: ffff880423da2700 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413557] sg[25] Remaining
> > task_size: 20480 cmd_sg: ffff880423da2720 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413558] sg[26] Remaining
> > task_size: 16384 cmd_sg: ffff880423da2740 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413559] sg[27] Remaining
> > task_size: 12288 cmd_sg: ffff880423da2760 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413561] sg[28] Remaining
> > task_size: 8192 cmd_sg: ffff880423da2780 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413562] sg[29] Remaining
> > task_size: 4096 cmd_sg: ffff880423da27a0 cmd_sg->length: 4096 
> > Aug 12 22:02:17 tarquin kernel: [  630.413563] Bogus SGL at
> > (null) 
> 
> 
> Solution to this problem is, 
> 
> In function transport_allocate_data_tasks:
> 
> Changed following line from:
> 
>     if(cmd->se_tfo->task_sg_chaining) {
> 
> to:
> 
>     if(cmd->se_tfo->task_sg_chaining && (i < (task_count -1))) {
> 
> 
> After this fix, I haven;t seen any more Bogus SGL or NULL pointer
> deference but then unable to discover the LUN properly. 
> 
> Please let me know if you want to see log and wireshark trace.
> 

Ok, so this turned out to be two seperate issues wrt to the new code in
transport_allocate_data_tasks().  The first patch should address the
problems that Chris ran into recently with iscsi-target that are related
to multi-task handling being broken in transport_allocate_data_tasks()
for -rc1:

   target: Fix task count > 1 handling breakage and use max_sector page alignment

The second patch should address the seperate breakage you have been
hitting with tcm_fc wrt to task SGL chaining logic that managed to get
broken in target core for -rc1 as well..  (Andy and Christoph, please
have a look)

   target: Fix task SGL chaining breakage with transport_allocate_data_tasks

I've done some light testing this morning with tcm_qla2xxx using
transport_do_task_sg_chain(), and things appear to be functioning as
expected again with the two changes.  Please verify with tcm_fc and let
me know if anything else needs attention.

Thank you,

--nab



--
To unsubscribe from this list: send the line "unsubscribe target-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux SCSI]     [Kernel Newbies]     [Linux SCSI Target Infrastructure]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Device Mapper]

  Powered by Linux