Linux Virtualization - Aug 2010 - [PATCH 2/5] staging: hv: Fixed lockup problem with bounce_buffer scatter list

From: Hank Janssen <hjanssen at microsoft.com>

Fixed lockup problem with bounce_buffer scatter list which caused
crashes in heavy loads. Under heavy loads with many clients we this
problem appear, it causes a kernel Panic.

Signed-off-by:Hank Janssen <hjanssen at microsoft.com>
Signed-off-by:Haiyang Zhang <haiyangz at microsoft.com>
Cc: stable <stable at kernel.org>
---
 drivers/staging/hv/storvsc_drv.c |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c
index 3b9ccb0..169d701 100644
--- a/drivers/staging/hv/storvsc_drv.c
+++ b/drivers/staging/hv/storvsc_drv.c
@@ -615,6 +615,7 @@ static int storvsc_queuecommand(struct scsi_cmnd *scmnd,
 	unsigned int request_size = 0;
 	int i;
 	struct scatterlist *sgl;
+	unsigned int sg_count = 0;
 
 	DPRINT_DBG(STORVSC_DRV, "scmnd %p dir %d, use_sg %d buf %p len %d "
 		   "queue depth %d tagged %d", scmnd, scmnd->sc_data_direction,
@@ -697,6 +698,7 @@ static int storvsc_queuecommand(struct scsi_cmnd *scmnd,
 	request->DataBuffer.Length = scsi_bufflen(scmnd);
 	if (scsi_sg_count(scmnd)) {
 		sgl = (struct scatterlist *)scsi_sglist(scmnd);
+		sg_count = scsi_sg_count(scmnd);
 
 		/* check if we need to bounce the sgl */
 		if (do_bounce_buffer(sgl, scsi_sg_count(scmnd)) != -1) { @@ -731,15 +733,16
@@ static int storvsc_queuecommand(struct scsi_cmnd *scmnd,
 					      scsi_sg_count(scmnd));
 
 			sgl = cmd_request->bounce_sgl;
+			sg_count = cmd_request->bounce_sgl_count;
 		}
 
 		request->DataBuffer.Offset = sgl[0].offset;
 
-		for (i = 0; i < scsi_sg_count(scmnd); i++) {
+		for (i = 0; i < sg_count; i++) {
 			DPRINT_DBG(STORVSC_DRV, "sgl[%d] len %d offset %d\n",
 				   i, sgl[i].length, sgl[i].offset);
-			request->DataBuffer.PfnArray[i] -				
page_to_pfn(sg_page((&sgl[i])));
+			request->DataBuffer.PfnArray[i] +				page_to_pfn(sg_page((&sgl[i])));
 		}
 	} else if (scsi_sglist(scmnd)) {
 		/* ASSERT(scsi_bufflen(scmnd) <= PAGE_SIZE); */
--
1.6.0.2

On Thu, Aug 05, 2010 at 07:29:53PM +0000, Hank Janssen
wrote:
> From: Hank Janssen <hjanssen at microsoft.com>
> 
> Fixed lockup problem with bounce_buffer scatter list which caused
> crashes in heavy loads. Under heavy loads with many clients we this
> problem appear, it causes a kernel Panic.
> 
> Signed-off-by:Hank Janssen <hjanssen at microsoft.com>
> Signed-off-by:Haiyang Zhang <haiyangz at microsoft.com>
> Cc: stable <stable at kernel.org>
> ---
>  drivers/staging/hv/storvsc_drv.c |    9 ++++++---
>  1 files changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/staging/hv/storvsc_drv.c
b/drivers/staging/hv/storvsc_drv.c
> index 3b9ccb0..169d701 100644
> --- a/drivers/staging/hv/storvsc_drv.c
> +++ b/drivers/staging/hv/storvsc_drv.c
> @@ -615,6 +615,7 @@ static int storvsc_queuecommand(struct scsi_cmnd
*scmnd,
>  	unsigned int request_size = 0;
>  	int i;
>  	struct scatterlist *sgl;
> +	unsigned int sg_count = 0;
>  
>  	DPRINT_DBG(STORVSC_DRV, "scmnd %p dir %d, use_sg %d buf %p len %d
"
>  		   "queue depth %d tagged %d", scmnd,
scmnd->sc_data_direction, @@ -697,6 +698,7 @@ static int
storvsc_queuecommand(struct scsi_cmnd *scmnd,
>  	request->DataBuffer.Length = scsi_bufflen(scmnd);

This patch is corrupted.  It applies, but doesn't do what you want it to
do :(

Care to resend?

thanks,

greg k-h