That could explain it: if the SG allocation is simply too small, the
scatter-gather code will run off the end of the SG list, and encounter
random uninitialized entries, and if any of those have the low bit set,
they will be considered to be "link" entries, and the SG list goes wild.
That SG code is really pretty fragile. I don't see it *ever* checking that
the SG allocation is large enough when it fills it in. And these things
take the sizes from different places (ie "cmd->use_sg" bs
"req->nr_phys_segments" vs God knows what else..)
Linus
-