/proc/scsi/scsi access causes segfault

Dick Streefland (Dick.Streefland@inter.NL.net)
Sat, 24 Oct 1998 12:34:48 +0200


When I want to use my external SCSI tape drive, I normally use the
following command after switching it on:

echo "scsi add-single-device 0 0 6 0" > /proc/scsi/scsi

This used to work with 2.0 kernels, but when I do this with a 2.1.117
or 2.1.125 kernel, the shell dies with a Segmentation fault:

# sh
# echo "scsi add-single-device 0 0 6 0" > /proc/scsi/scsi
scsi singledevice 0 0 6 0
Vendor: WANGTEK Model: 5525ES SCSI Rev: 70S3
Type: Sequential-Access ANSI SCSI revision: 02
Detected scsi tape st1 at scsi0, channel 0, id 6, lun 0
Unable to handle kernel paging request at virtual address 00008000
current->tss.cr3 = 01bed000, %cr3 = 01bed000
*pde = 00000000
Oops: 0000
CPU: 0
EIP: 0010:[<c0247080>]
EFLAGS: 00010282
eax: c000f1d0 ebx: 00000000 ecx: c02f8000 edx: c0247050
esi: c02f8000 edi: c02f8000 ebp: 00000006 esp: c1beff1c
ds: 0018 es: 0018 ss: 0018
Process sh (pid: 344, process nr: 23, stackpage=c1bef000)
Stack: c000f1d0 c1bd0000 c1bd0000 0000001f 00000000 c02f8000 00000000 00000000
c1bd001e c1bee000 c01d126a c1bd0000 00000000 00000000 0000001f 00000000
00000001 c1bd0000 0000001f c1f15430 400d2000 c014cd1e 00000100 c1bd0000
Call Trace: [<c01d126a>] [<c014cd1e>] [<c01240f8>] [<c0107cc8>]
Code: 67 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Segmentation fault

This is the ksymoops output for this dump:

>>EIP: c0247080 <BusLogic_SelectQueueDepths+30/1a0>
Trace: c01d126a <dispatch_scsi_info+3a/d0>
Trace: c014cd1e <proc_writescsi+7e/b0>
Trace: c01240f8 <sys_write+b8/120>
Trace: c0107cc8 <system_call+34/38>
Code: c0247080 <BusLogic_SelectQueueDepths+30/1a0>
Code: c0247080 <BusLogic_SelectQueueDepths+30/1a0> 67 00 24 addr16 addb %ah,(si)
Code: c0247093 <BusLogic_SelectQueueDepths+43/1a0> 00 00 addb %al,(%eax)
Code: c0247095 <BusLogic_SelectQueueDepths+45/1a0> 90 nop
Code: c0247096 <BusLogic_SelectQueueDepths+46/1a0> 90 nop
Code: c0247097 <BusLogic_SelectQueueDepths+47/1a0> 90 nop

After that, other processes accessing /proc/scsi/scsi crash as well:

# cat /proc/scsi/scsi
Unable to handle kernel paging request at virtual address 4c891841
current->tss.cr3 = 01bed000, %cr3 = 01bed000
*pde = 00000000
Oops: 0000
CPU: 0
EIP: 0010:[<c01d1698>]
EFLAGS: 00010206
eax: c1beff20 ebx: 00000150 ecx: 4c891824 edx: 00000150
esi: 4c891824 edi: c1896000 ebp: 4c891824 esp: c1befee4
ds: 0018 es: 0018 ss: 0018
Process cat (pid: 352, process nr: 23, stackpage=c1bef000)
Stack: c1896000 00000000 c01cb635 4c891824 c1896000 c1beff20 00000150 c1fa28d0
c1896000 00000c00 00000000 c02f8000 4c891824 00000001 00000001 0000009f
c01d126a c1896000 c1beff90 00000000 00000c00 00000000 00000000 c1fa28d0
Call Trace: [<c01cb635>] [<c01d126a>] [<c014cc06>] [<c0123fe6>] [<c0107cc8>]
Code: 0f b6 45 1d 50 0f b6 45 1c 50 0f b6 45 1e 50 8b 45 0c 0f b7
Segmentation fault

The ksymoops output:

>>EIP: c01d1698 <proc_print_scsidevice+8/1f0>
Trace: c01cb635 <scsi_proc_info+a5/890>
Trace: c01d126a <dispatch_scsi_info+3a/d0>
Trace: c014cc06 <proc_readscsi+c6/160>
Trace: c0123fe6 <sys_read+b6/110>
Trace: c0107cc8 <system_call+34/38>
Code: c01d1698 <proc_print_scsidevice+8/1f0>
Code: c01d1698 <proc_print_scsidevice+8/1f0> 0f b6 45 1d movzbl 0x1d(%ebp),%eax
Code: c01d169c <proc_print_scsidevice+c/1f0> 50 pushl %eax
Code: c01d169d <proc_print_scsidevice+d/1f0> 0f b6 45 1c movzbl 0x1c(%ebp),%eax
Code: c01d16a1 <proc_print_scsidevice+11/1f0> 50 pushl %eax
Code: c01d16a2 <proc_print_scsidevice+12/1f0> 0f b6 45 1e movzbl 0x1e(%ebp),%eax
Code: c01d16a6 <proc_print_scsidevice+16/1f0> 50 pushl %eax
Code: c01d16a7 <proc_print_scsidevice+17/1f0> 8b 45 0c movl 0xc(%ebp),%eax
Code: c01d16aa <proc_print_scsidevice+1a/1f0> 0f b7 00 movzwl (%eax),%eax
Code: c01d16ad <proc_print_scsidevice+1d/1f0> 90 nop
Code: c01d16ae <proc_print_scsidevice+1e/1f0> 90 nop
Code: c01d16af <proc_print_scsidevice+1f/1f0> 90 nop

Here are the relevant config options that I have enabled:
CONFIG_SCSI=y
CONFIG_BLK_DEV_SD=y
CONFIG_CHR_DEV_ST=y
CONFIG_BLK_DEV_SR=y
CONFIG_BLK_DEV_SR_VENDOR=y
CONFIG_CHR_DEV_SG=y
CONFIG_SCSI_MULTI_LUN=y
CONFIG_SCSI_CONSTANTS=y
CONFIG_SCSI_LOGGING=y
CONFIG_SCSI_BUSLOGIC=y
CONFIG_SCSI_OMIT_FLASHPOINT=y
CONFIG_SCSI_PAS16=y
The tape drive is attached to a Buslogic BT-445S controller, the pas16
controller is not used.

-- 
Dick Streefland                    ////               De Bilt
dick.streefland@inter.nl.net      (@ @)       The Netherlands
------------------------------oOO--(_)--OOo------------------

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/