Re: BUG: unable to handle kernel NULL pointer dereference in transport_allocate_data_tasks+0x1af/0x2cc [target_core_mod]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 13/08/2011 14:08, Nicholas A. Bellinger wrote:
On Fri, 2011-08-12 at 15:40 -0700, Kiran Patil wrote:
Hi Chris, Nick,

Please see my suggested solution and I also have patch (I can send
that patch later) for that Bogus SGL issue.

But after fixing that issue, ran into another issue (not NULL pointer
deference). Please read my response.

Hi Kiran&  Co,

On 8/12/2011 2:11 PM, Chris Boot wrote:
On 09/08/2011 09:15, Chris Boot wrote:
<SNIP>

Well, I tried applying the patchset nab posted to the list yesterday
([PATCH 0/3] target: various CDB processing fixes for -rc2) to my
kernel and giving it another whirl. The bug I had is still there,
but doesn't make the target hang - and I see some new messages too.
The logging is _extremely_ verbose so sifting through the log has
been fun... I should add that I did this last test on Windows
instead of Linux (sorry for all the swapping around).

Aug 12 22:02:17 tarquin kernel: [  630.413521] Setup task->task_sg:
ffff880423cee800 task->task_sg_nents: 62
Aug 12 22:02:17 tarquin kernel: [  630.413522] sg[0] Remaining
task_size: 122880 cmd_sg: ffff880423da2400 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413523] sg[1] Remaining
task_size: 118784 cmd_sg: ffff880423da2420 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413525] sg[2] Remaining
task_size: 114688 cmd_sg: ffff880423da2440 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413526] sg[3] Remaining
task_size: 110592 cmd_sg: ffff880423da2460 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413528] sg[4] Remaining
task_size: 106496 cmd_sg: ffff880423da2480 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413529] sg[5] Remaining
task_size: 102400 cmd_sg: ffff880423da24a0 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413530] sg[6] Remaining
task_size: 98304 cmd_sg: ffff880423da24c0 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413532] sg[7] Remaining
task_size: 94208 cmd_sg: ffff880423da24e0 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413533] sg[8] Remaining
task_size: 90112 cmd_sg: ffff880423da2500 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413535] sg[9] Remaining
task_size: 86016 cmd_sg: ffff880423da2520 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413536] sg[10] Remaining
task_size: 81920 cmd_sg: ffff880423da2540 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413537] sg[11] Remaining
task_size: 77824 cmd_sg: ffff880423da2560 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413539] sg[12] Remaining
task_size: 73728 cmd_sg: ffff880423da2580 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413540] sg[13] Remaining
task_size: 69632 cmd_sg: ffff880423da25a0 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413541] sg[14] Remaining
task_size: 65536 cmd_sg: ffff880423da25c0 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413543] sg[15] Remaining
task_size: 61440 cmd_sg: ffff880423da25e0 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413544] sg[16] Remaining
task_size: 57344 cmd_sg: ffff880423da2600 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413546] sg[17] Remaining
task_size: 53248 cmd_sg: ffff880423da2620 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413547] sg[18] Remaining
task_size: 49152 cmd_sg: ffff880423da2640 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413548] sg[19] Remaining
task_size: 45056 cmd_sg: ffff880423da2660 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413550] sg[20] Remaining
task_size: 40960 cmd_sg: ffff880423da2680 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413551] sg[21] Remaining
task_size: 36864 cmd_sg: ffff880423da26a0 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413552] sg[22] Remaining
task_size: 32768 cmd_sg: ffff880423da26c0 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413554] sg[23] Remaining
task_size: 28672 cmd_sg: ffff880423da26e0 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413555] sg[24] Remaining
task_size: 24576 cmd_sg: ffff880423da2700 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413557] sg[25] Remaining
task_size: 20480 cmd_sg: ffff880423da2720 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413558] sg[26] Remaining
task_size: 16384 cmd_sg: ffff880423da2740 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413559] sg[27] Remaining
task_size: 12288 cmd_sg: ffff880423da2760 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413561] sg[28] Remaining
task_size: 8192 cmd_sg: ffff880423da2780 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413562] sg[29] Remaining
task_size: 4096 cmd_sg: ffff880423da27a0 cmd_sg->length: 4096
Aug 12 22:02:17 tarquin kernel: [  630.413563] Bogus SGL at
(null)

Solution to this problem is,

In function transport_allocate_data_tasks:

Changed following line from:

     if(cmd->se_tfo->task_sg_chaining) {

to:

     if(cmd->se_tfo->task_sg_chaining&&  (i<  (task_count -1))) {


After this fix, I haven;t seen any more Bogus SGL or NULL pointer
deference but then unable to discover the LUN properly.

Please let me know if you want to see log and wireshark trace.

Ok, so this turned out to be two seperate issues wrt to the new code in
transport_allocate_data_tasks().  The first patch should address the
problems that Chris ran into recently with iscsi-target that are related
to multi-task handling being broken in transport_allocate_data_tasks()
for -rc1:

    target: Fix task count>  1 handling breakage and use max_sector page alignment

The second patch should address the seperate breakage you have been
hitting with tcm_fc wrt to task SGL chaining logic that managed to get
broken in target core for -rc1 as well..  (Andy and Christoph, please
have a look)

    target: Fix task SGL chaining breakage with transport_allocate_data_tasks

I've done some light testing this morning with tcm_qla2xxx using
transport_do_task_sg_chain(), and things appear to be functioning as
expected again with the two changes.  Please verify with tcm_fc and let
me know if anything else needs attention.
Nick,

After much testing this afternoon and evening I can definitely confirm the first patch fixes my issue. My iSCSI target has been running very well indeed with 3.1-rc1 and that patch applied on top.

Thanks again Nick.

Chris

--
To unsubscribe from this list: send the line "unsubscribe target-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux SCSI]     [Kernel Newbies]     [Linux SCSI Target Infrastructure]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Device Mapper]

  Powered by Linux