Re: BUG: Null deref with pscsi backstore, iscsi fabric, and Windows XP initiator

["Nicholas A. Bellinger" <nab@xxxxxxxxxxxxxxx>]

On Mon, 2012-08-06 at 11:57 -0700, Alex Elsayed wrote:
> Nicholas A. Bellinger wrote:
> > 
> > Based upon your trace, I'm pretty certain this is related to the two old
> > pSCSI specific hacks in target_core_pscsi.c:pscsi_complete_cmd() that
> > manually set MODE_SENSE write_protect bit in the data payload, or
> > sd->blocksize w/ MODE_SELECT for with TYPE_TAPE export.   The OOPsen
> > here appears to be related to the former..
> > 
> > The following (untested) patch to stub out both of these cases should
> > get you up and running with TYPE_ROM, and I think for modern pSCSI code
> > we should be able to now just drop this section all together..
> > 
> > Please give it a shot and let us know if your able to get pSCSI +
> > TYPE_ROM export up and running on your setup.
> > 
> > Thanks for reporting!
> 
> Sadly, that patch does not fix the problem. Backtrace attached.

So looking at this again, the OOPs is actually to be happening with an
REPORT_LUNs CDB that for pSCSI backstores is a special case, and is
getting emulated directly by TCM..

This afternoon I've been able to reproduce+fix this pSCSI bug, and below
is the patch that should get you up and running..

Here is the patch in action with loopback fabrics ports + sg_luns:

root@romley:/usr/src/target-pending.git# lsscsi | grep dvd
[2:0:0:0]    cd/dvd  ATAPI    iHAS124   B      AL0L    /dev/sr0       
[138:0:1:0]  cd/dvd  ATAPI    iHAS124   B      AL0L    /dev/sr1

root@romley:/usr/src/target-pending.git# sg_luns -v /dev/sr0
    report luns cdb: a0 00 00 00 00 00 00 00 20 00 00 00 
report luns:  Fixed format, current;  Sense key: Not Ready
 Additional sense: Medium not present - tray closed
Report Luns command failed
root@romley:/usr/src/target-pending.git# sg_luns -v /dev/sr1
    report luns cdb: a0 00 00 00 00 00 00 00 20 00 00 00 
Lun list length = 8 which imples 1 lun entry
Report luns [select_report=0]:
    0000000000000000

Please give it a shot to verify on your side with WinXP iSCSI clients.

Thanks Alex!

--nab

diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 6e32ff6..9c7da54 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -673,8 +673,14 @@ static int pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg)
        struct scsi_device *sd = pdv->pdv_sd;
        int result;
        struct pscsi_plugin_task *pt = cmd->priv;
-       unsigned char *cdb = &pt->pscsi_cdb[0];
+       unsigned char *cdb;
+       /*
+        * Special case for REPORT_LUNs handling..
+        */
+       if (!pt)
+               return 0;
 
+       cdb = &pt->pscsi_cdb[0];
        result = pt->pscsi_result;
        /*
         * Hack to make sure that Write-Protect modepage is set if R/O mode is

--
To unsubscribe from this list: send the line "unsubscribe target-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html