Re: CDROM troubles

[Jens Axboe]

--gatW/ieO32f1wygP
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Sun, May 06 2001, Phil Stracchino wrote:
> On Sun, May 06, 2001 at 03:05:00AM -0700, Phil Stracchino wrote:
> > Hey folks,
> > I'm seeing a problem with mounting CDs using a Toshiba XM-6401TA CDROM
> > drive attached to an Adaptec AHA1542CF controller (scsi1) on kernel 2.4.3
> > and 2.4.4.  The behavior seems to be fairly consistent as follows:
> > 
> > first mount and unmount works normally, no unusual events logged
> > second mount and unmount works normally, no unusual events logged
> > third mount locks up the machine.  looks like a kernel panic.
> > 
> > Any ideas?
> 
> 
> Panic is confirmed.  This time, it lived long enough to log:
>  
> May  6 14:05:05 babylon5 kernel: Kernel panic: scsi_free:Bad offset
> 
> Since it involves the CDROM, the aha1542 driver is implicated.  Why it's
> getting a bad offset, I don't understand enough about the SCSI drivers to
> know; all the scsi_free calls in aha1542.c look identical to me.
>  
> Would any Linux SCSI gurus care to let me know any diagnostic procedures
> recommended for nailing this one?

The panic should be fixed with attached patch.

-- 
Jens Axboe

--gatW/ieO32f1wygP
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=sr-scatter-1

diff -urN --exclude-from /home/axboe/cdrom/exclude /opt/kernel/linux-2.4.4-pre2/drivers/scsi/sr.c linux/drivers/scsi/sr.c
--- /opt/kernel/linux-2.4.4-pre2/drivers/scsi/sr.c	Mon Feb 19 19:25:17 2001
+++ linux/drivers/scsi/sr.c	Mon Apr  9 09:18:46 2001
@@ -262,7 +262,7 @@
 static int sr_scatter_pad(Scsi_Cmnd *SCpnt, int s_size)
 {
 	struct scatterlist *sg, *old_sg = NULL;
-	int i, fsize, bsize, sg_ent;
+	int i, fsize, bsize, sg_ent, sg_count;
 	char *front, *back;
 
 	back = front = NULL;
@@ -290,17 +290,24 @@
 	/*
 	 * extend or allocate new scatter-gather table
 	 */
-	if (SCpnt->use_sg)
+	sg_count = SCpnt->use_sg;
+	if (sg_count)
 		old_sg = (struct scatterlist *) SCpnt->request_buffer;
 	else {
-		SCpnt->use_sg = 1;
+		sg_count = 1;
 		sg_ent++;
 	}
 
-	SCpnt->sglist_len = ((sg_ent * sizeof(struct scatterlist)) + 511) & ~511;
-	if ((sg = scsi_malloc(SCpnt->sglist_len)) == NULL)
+	i = ((sg_ent * sizeof(struct scatterlist)) + 511) & ~511;
+	if ((sg = scsi_malloc(i)) == NULL)
 		goto no_mem;
 
+	/*
+	 * no more failing memory allocs possible, we can safely assign
+	 * SCpnt values now
+	 */
+	SCpnt->sglist_len = i;
+	SCpnt->use_sg = sg_count;
 	memset(sg, 0, SCpnt->sglist_len);
 
 	i = 0;

--gatW/ieO32f1wygP--