leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
a683d652d3
linux/drivers
History
Lee Schermerhorn a683d652d3 Panic in blk_rq_map_sg() from CCISS driver 
New scatter/gather list chaining [sg_next()] treats 'page' member of
struct scatterlist with low bit set [0x01] as a chain pointer to
another struct scatterlist [array].  The CCISS driver request function
passes an uninitialized, temporary, on-stack scatterlist array to
blk_rq_map_sq().  sg_next() interprets random data on the stack as a
chain pointer and eventually tries to de-reference an invalid pointer,
resulting in:

[<ffffffff8031dd70>] blk_rq_map_sg+0x70/0x170
PGD 6090c3067 PUD 0
Oops: 0000 [1] SMP
last sysfs file: /block/cciss!c0d0/cciss!c0d0p1/dev
CPU 6
Modules linked in: ehci_hcd ohci_hcd uhci_hcd
Pid: 1, comm: init Not tainted 2.6.23-rc6-mm1 #3
RIP: 0010:[<ffffffff8031dd70>] [<ffffffff8031dd70>] blk_rq_map_sg+0x70/0x170
RSP: 0018:ffff81060901f768 EFLAGS: 00010206
RAX: 000000040b161000 RBX: ffff81060901f7d8 RCX: 000000040b162c00
RDX: 0000000000000000 RSI: ffff81060b13a260 RDI: ffff81060b139600
RBP: 0000000000001400 R08: 00000000fffffffe R09: 0000000000000400
R10: 0000000000000000 R11: 000000040b163000 R12: ffff810102fe0000
R13: 0000000000000001 R14: 0000000000000001 R15: 00001e0000000000
FS: 00000000026108f0(0063) GS:ffff810409000b80(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 000000010000001e CR3: 00000006090c6000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process init (pid: 1, threadinfo ffff81060901e000, task ffff810409020800)
last branch before last exception/interrupt
from [<ffffffff8031de0a>] blk_rq_map_sg+0x10a/0x170
to [<ffffffff8031dd70>] blk_rq_map_sg+0x70/0x170
Stack: 000000018068ea00 ffff810102fe0000 0000000000000000 ffff810011400000
0000000000000002 0000000000000000 ffff81040b172000 ffffffff803acd3d
0000000000003ec1 ffff8106090d5000 ffff8106090d5000 ffff810102fe0000
Call Trace:
[<ffffffff803acd3d>] do_cciss_request+0x15d/0x4c0
[<ffffffff80298968>] new_slab+0x1c8/0x270
[<ffffffff80298ffd>] __slab_alloc+0x22d/0x470
[<ffffffff8027327b>] mempool_alloc+0x4b/0x130
[<ffffffff8032b21e>] cfq_set_request+0xee/0x380
[<ffffffff8027327b>] mempool_alloc+0x4b/0x130
[<ffffffff8031ff98>] get_request+0x168/0x360
[<ffffffff80331b0d>] rb_insert_color+0x8d/0x110
[<ffffffff8031cfd8>] elv_rb_add+0x58/0x60
[<ffffffff8032a329>] cfq_add_rq_rb+0x69/0xa0
[<ffffffff8031c1ab>] elv_merged_request+0x5b/0x60
[<ffffffff803224fd>] __make_request+0x23d/0x650
[<ffffffff80298ffd>] __slab_alloc+0x22d/0x470
[<ffffffff80270000>] generic_write_checks+0x140/0x190
[<ffffffff8031f012>] generic_make_request+0x1c2/0x3a0
<etc>
Kernel panic - not syncing: Attempted to kill init!

This patch initializes the tmp_sg array to zeroes.  Perhaps not the ultimate
fix, but an effective work-around.  I can now boot 23-rc6-mm1 on an HP
Proliant x86_64 with CCISS boot disk.

Signed-off-by:  Lee Schermerhorn <lee.schermerhorn@hp.com>

 drivers/block/cciss.c |    1 +
 1 file changed, 1 insertion(+)
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-10-16 11:24:44 +02:00
..
acorn/char
acpi more trivial signedness fixes in drivers 2007-10-14 12:41:52 -07:00
amba Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
ata remove blk_queue_max_phys_segments in libata 2007-10-16 11:24:44 +02:00
atm more trivial signedness fixes in drivers 2007-10-14 12:41:52 -07:00
auxdisplay
base more uevent fallout (drivers/base/memory.c) 2007-10-14 08:53:33 -07:00
block Panic in blk_rq_map_sg() from CCISS driver 2007-10-16 11:24:44 +02:00
bluetooth
cdrom [POWERPC] iSeries: Move detection of virtual cdroms 2007-10-11 20:40:47 +10:00
char Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2007-10-15 13:41:39 -07:00
clocksource
connector [NET]: make netlink user -> kernel interface synchronious 2007-10-10 21:15:29 -07:00
cpufreq Merge master.kernel.org:/pub/scm/linux/kernel/git/gregkh/driver-2.6 2007-10-12 15:49:37 -07:00
crypto [CRYPTO] sha: Add header file for SHA definitions 2007-10-10 16:55:50 -07:00
dio
dma
edac Drivers: clean up direct setting of the name of a kset 2007-10-12 14:51:02 -07:00
eisa signedness: module_param_array nump argument 2007-10-14 12:41:52 -07:00
fc4 Merge master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2007-10-15 08:19:33 -07:00
firewire fw-cdev __user annotations 2007-10-14 12:41:51 -07:00
firmware Driver core: rename ktype_edd and ktype_efivar 2007-10-12 14:51:12 -07:00
hid HID: fix HIDIOCGRDESC memory access in hidraw 2007-10-15 08:12:00 -07:00
hwmon Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2007-10-15 13:41:39 -07:00
i2c Merge branch 'devel' of master.kernel.org:/home/rmk/linux-2.6-arm 2007-10-15 16:08:50 -07:00
ide IDE: sg chaining support 2007-10-16 11:21:00 +02:00
ieee1394 Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
infiniband infiniband: sg chaining support 2007-10-16 11:20:59 +02:00
input Merge branch 'devel' of master.kernel.org:/home/rmk/linux-2.6-arm 2007-10-15 16:08:50 -07:00
isdn [ISDN]: Fix compile with CONFIG_ISDN_X25 disabled. 2007-10-15 12:52:20 -07:00
kvm sched: guest CPU accounting: maintain guest state in KVM 2007-10-15 17:00:19 +02:00
leds [ARM] 4576/1: CM-X270 machine support 2007-10-15 18:53:57 +01:00
lguest
macintosh Merge master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6 2007-10-12 21:27:47 -04:00
mca
md block: convert blkdev_issue_flush() to use empty barriers 2007-10-16 11:05:02 +02:00
media signedness: module_param_array nump argument 2007-10-14 12:41:52 -07:00
message Fusion: sg chaining support 2007-10-16 11:20:59 +02:00
mfd
misc Map volume and brightness events on thinkpads 2007-10-15 13:54:40 -07:00
mmc Merge branch 'devel' of master.kernel.org:/home/rmk/linux-2.6-arm 2007-10-15 16:08:50 -07:00
mtd Reinstate lost flush_ioremap_region() fix to pxa2xx-flash driver 2007-10-15 12:55:20 -07:00
net Merge branch 'devel' of master.kernel.org:/home/rmk/linux-2.6-arm 2007-10-15 16:08:50 -07:00
nubus
of
oprofile
parisc
parport
pci Get rid of unused variable warning in drivers/pci/hotplug/pci_hotplug_core.c 2007-10-15 09:07:58 -07:00
pcmcia Merge branch 'devel' of master.kernel.org:/home/rmk/linux-2.6-arm 2007-10-15 16:08:50 -07:00
pnp
power Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
ps3
rapidio
rtc
s390 zfcp: sg chaining support 2007-10-16 11:21:00 +02:00
sbus
scsi remove sglist_len 2007-10-16 11:24:44 +02:00
serial Merge branch 'devel' of master.kernel.org:/home/rmk/linux-2.6-arm 2007-10-15 16:08:50 -07:00
sh
sn
spi Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
ssb missing include in ssb 2007-10-14 08:53:33 -07:00
tc
telephony
uio
usb USB storage: sg chaining support 2007-10-16 11:20:59 +02:00
video Merge branch 'devel' of master.kernel.org:/home/rmk/linux-2.6-arm 2007-10-15 16:08:50 -07:00
w1 Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
xen
zorro
Kconfig [SSB]: add Sonics Silicon Backplane bus support 2007-10-10 16:51:36 -07:00
Makefile [SSB]: add Sonics Silicon Backplane bus support 2007-10-10 16:51:36 -07:00