Home » Mailing list archives » linux-kernel » 2007 » September » 21

Re: [PATCH 2.6.23-rc6-mm1] - Panic in blk_rq_map_sg() from CCISS driver

Previous thread: [PATCH 1/1] x86: Convert cpuinfo_x86 array to a per_cpu array v2 by travis on Thursday, September 20, 2007 - 5:30 pm. (3 messages)

Next thread: by Newsletter on Thursday, September 20, 2007 - 4:35 pm. (1 message)
[view original message]
From: Lee Schermerhorn <Lee.Schermerhorn@...>
To: linux-kernel <linux-kernel@...>
Cc: Andrew Morton <akpm@...>, Miller, Mike (OS Dev) <Mike.Miller@...>, Jens Axboe <jens.axboe@...>, Eric Whitney <eric.whitney@...>
Subject: [PATCH 2.6.23-rc6-mm1] - Panic in blk_rq_map_sg() from CCISS driver
Date: Thursday, September 20, 2007 - 5:37 pm

PATCH 2.6.23-rc6-mm1 - Panic in blk_rq_map_sg() from CCISS driver


New scatter/gather list chaining [sg_next()] treats 'page' member of

struct scatterlist with low bit set [0x01] as a chain pointer to

another struct scatterlist [array].  The CCISS driver request function

passes an uninitialized, temporary, on-stack scatterlist array to

blk_rq_map_sq().  sg_next() interprets random data on the stack as a

chain pointer and eventually tries to de-reference an invalid pointer,

resulting in:


[<ffffffff8031dd70>] blk_rq_map_sg+0x70/0x170

PGD 6090c3067 PUD 0

Oops: 0000 [1] SMP

last sysfs file: /block/cciss!c0d0/cciss!c0d0p1/dev

CPU 6

Modules linked in: ehci_hcd ohci_hcd uhci_hcd

Pid: 1, comm: init Not tainted 2.6.23-rc6-mm1 #3

RIP: 0010:[<ffffffff8031dd70>] [<ffffffff8031dd70>] blk_rq_map_sg+0x70/0x170

RSP: 0018:ffff81060901f768 EFLAGS: 00010206

RAX: 000000040b161000 RBX: ffff81060901f7d8 RCX: 000000040b162c00

RDX: 0000000000000000 RSI: ffff81060b13a260 RDI: ffff81060b139600

RBP: 0000000000001400 R08: 00000000fffffffe R09: 0000000000000400

R10: 0000000000000000 R11: 000000040b163000 R12: ffff810102fe0000

R13: 0000000000000001 R14: 0000000000000001 R15: 00001e0000000000

FS: 00000000026108f0(0063) GS:ffff810409000b80(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b

CR2: 000000010000001e CR3: 00000006090c6000 CR4: 00000000000006e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000

DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400

Process init (pid: 1, threadinfo ffff81060901e000, task ffff810409020800)

last branch before last exception/interrupt

from [<ffffffff8031de0a>] blk_rq_map_sg+0x10a/0x170

to [<ffffffff8031dd70>] blk_rq_map_sg+0x70/0x170

Stack: 000000018068ea00 ffff810102fe0000 0000000000000000 ffff810011400000

0000000000000002 0000000000000000 ffff81040b172000 ffffffff803acd3d

0000000000003ec1 ffff8106090d5000 ffff8106090d5000 ffff810102fe0000

Call Trace:

[<ffffffff803acd3d>] do_cci...
[ message continues ]
[view original message]
From: Jens Axboe <jens.axboe@...>
To: Lee Schermerhorn <Lee.Schermerhorn@...>
Cc: linux-kernel <linux-kernel@...>, Andrew Morton <akpm@...>, Miller, Mike (OS Dev) <Mike.Miller@...>, Eric Whitney <eric.whitney@...>
Subject: Re: [PATCH 2.6.23-rc6-mm1] - Panic in blk_rq_map_sg() from CCISS driver
Date: Friday, September 21, 2007 - 1:20 am

Thanks Lee, applied.


--

Jens Axboe


-
Previous thread: [PATCH 1/1] x86: Convert cpuinfo_x86 array to a per_cpu array v2 by travis on Thursday, September 20, 2007 - 5:30 pm. (3 messages)

Next thread: by Newsletter on Thursday, September 20, 2007 - 4:35 pm. (1 message)