From: Bart Van Assche <Bart.VanAssche@wdc.com>
To: "chaitra.basappa@broadcom.com" <chaitra.basappa@broadcom.com>,
        "linux-scsi@vger.kernel.org" <linux-scsi@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
CC: "sathya.prakash@broadcom.com" <sathya.prakash@broadcom.com>,
        "sreekanth.reddy@broadcom.com" <sreekanth.reddy@broadcom.com>,
        "suganath-prabu.subramani@broadcom.com" 
        <suganath-prabu.subramani@broadcom.com>,
        "kashyap.desai@broadcom.com" <kashyap.desai@broadcom.com>
Subject: Re: smp-induced oops/NULL pointer dereference in mpt3sas, from kernel
 >= 4.11
Thread-Topic: smp-induced oops/NULL pointer dereference in mpt3sas, from
 kernel >= 4.11
Thread-Index: AdMXPgSwCDHxRl7xTOKzxtB4eznNuwANCIyA
Date: Thu, 17 Aug 2017 16:02:00 +0000
Message-ID: <1502985717.2615.11.camel@wdc.com>
References: <155d5b2c7af4ae0cc6162baf6a52ef5b@mail.gmail.com>
In-Reply-To: <155d5b2c7af4ae0cc6162baf6a52ef5b@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
wdcipoutbound: EOP-TRUE
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-ID: <2D8D73D94E07FB46AC2D085188B39288@namprd04.prod.outlook.com>
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Aug 2017 16:02:00.1392
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: b61c8803-16f3-4c35-9b17-6f65f441df86
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0401MB1178
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by nfs id v7HG2rsK018852
Content-Length: 1062
Lines: 31

On Thu, 2017-08-17 at 15:18 +0530, Chaitra Basappa wrote:
> We analyzed this issue and could figure out it is not because of driver,
> its because the "sense" field of the 'struct scsi_request' is not being
> populated properly from the upper layer.
> And this "sense" member is being referenced in our driver code for kernel
> versions >= 4.11 as shown below in the snippet:
> Whereas as for < 4.11 kernel version this "sense" member was referenced
> via 'struct request'
> 
> 
> static int
> _transport_smp_handler (.....) {
> .....
> .....
> > > memcpy(scsi_req(req)->sense, mpi_reply, sizeof(*mpi_reply));
> 
> .....
> .....
> }
> 
> And hence the NULL pointer dereference call trace is seen for the above
> chunk of mpt3sas. This needs to be addressed from upper layer, so please
> help us in getting this resolved.

Hello Chaitra,

Have you noticed the following e-mail thread: "[RFC PATCH 0/6] bsg: fix
regression resulting in panics when sending commands via BSG and some
sanity cleanups" (http://www.spinics.net/lists/linux-scsi/msg111724.html)?

Bart.