Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932355AbcJ3R50 (ORCPT ); Sun, 30 Oct 2016 13:57:26 -0400 Received: from mx2.suse.de ([195.135.220.15]:48611 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753391AbcJ3R5V (ORCPT ); Sun, 30 Oct 2016 13:57:21 -0400 Date: Sun, 30 Oct 2016 11:56:52 -0600 From: Johannes Thumshirn To: Steffen Maier Cc: "Martin K . Petersen" , Christoph Hellwig , Hannes Reinecke , Linux Kernel Mailinglist , Linux SCSI Mailinglist , Martin Schwidefsky , Heiko Carstens , Anil Gurumurthy , Sudarsana Kalluru , "James E.J. Bottomley" , Tyrel Datwyler , Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , Johannes Thumshirn , James Smart , Dick Kennedy , "supporter:QLOGIC QLA2XXX FC-SCSI DRIVER" , "open list:S390 ZFCP DRIVER" , "open list:LINUX FOR POWERPC (32-BIT AND 64-BIT)" , "open list:FCOE SUBSYSTEM (libfc, libfcoe, fcoe)" Subject: Re: [PATCH v2 02/16] scsi: don't use fc_bsg_job::request and fc_bsg_job::reply directly Message-ID: <20161030175652.al6viedhd3i67jq5@linux-x5ow.site> References: <2ea07f3f-88eb-b795-fa37-a223bf80e581@linux.vnet.ibm.com> <20161013162405.aoxy3bdkc4bqtwsk@linux-x5ow.site> <4b411836-e76f-b67a-3d49-ad3d51b8f216@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <4b411836-e76f-b67a-3d49-ad3d51b8f216@linux.vnet.ibm.com> User-Agent: Mutt/1.6.2 (2016-07-01) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1887 Lines: 45 On Fri, Oct 28, 2016 at 11:53:46AM +0200, Steffen Maier wrote: [...] > > > > > > > @@ -3937,6 +3944,7 @@ fc_bsg_request_handler(struct request_queue *q, struct Scsi_Host *shost, > > > > struct request *req; > > > > struct fc_bsg_job *job; > > > > enum fc_dispatch_result ret; > > > > + struct fc_bsg_reply *bsg_reply; > > > > > > > > if (!get_device(dev)) > > > > return; > > > > @@ -3973,8 +3981,9 @@ fc_bsg_request_handler(struct request_queue *q, struct Scsi_Host *shost, > > > > /* check if we have the msgcode value at least */ > > > > if (job->request_len < sizeof(uint32_t)) { > > > > BUG_ON(job->reply_len < sizeof(uint32_t)); > > > > - job->reply->reply_payload_rcv_len = 0; > > > > - job->reply->result = -ENOMSG; > > > > + bsg_reply = job->reply; > > > > + bsg_reply->reply_payload_rcv_len = 0; > > > > + bsg_reply->result = -ENOMSG; > > Compiler optimization re-ordered above two lines and the first pointer > derefence is bsg_reply->result [field offset 0] where bsg_reply is NULL. > The assignment tries to write to memory at address NULL causing the kernel > page fault. > > Does your suggested change for [PATCH v3 02/16], shuffling the > job->request_len checks, address above kernel page fault? This is what I hope at least. I'm sorry but I don't have any experience with s390 and zfcp at all. I still need to get a test environment set up, but all the people knowing how to do are rather busy at the moment. All my tests on x86_64 with FCoE and lpfc haven't had a problem so far. Thanks, Johannes -- Johannes Thumshirn Storage jthumshirn@suse.de +49 911 74053 689 SUSE LINUX GmbH, Maxfeldstr. 5, 90409 N?rnberg GF: Felix Imend?rffer, Jane Smithard, Graham Norton HRB 21284 (AG N?rnberg) Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850