Bug 111431
| Summary: | Possible null pointer dereference in mptspi/mptscsih | ||
|---|---|---|---|
| Product: | Drivers | Reporter: | Mark (mark_k) |
| Component: | Other | Assignee: | drivers_other |
| Status: | NEW --- | ||
| Severity: | normal | ||
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 4.3.0-7 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
I have an LSI Logic LSI22320-HP dual-channel U320 SCSI PCI-X card. The card is in a 32-bit PCI slot, in a Dell docking station connected to a Latitude D830 laptop. The same problem happens in an old desktop PC (in a 32-bit PCI slot there too). There are no SCSI devices connected. Note that the card may well be faulty/damaged/flaky in some way. But perhaps the null pointer dereference is a kernel problem nevertheless. On booting I see this text from the card's option ROM (on the desktop PC; the D830 hides boot-time messages): LSI Logic Corp. MPT BIOS Copyright 1995-2003 LSI Logic Corp. MPTBIOS-5.05.10 HP Build Adapter(s) disabled by user LSI Logic Corp. MPT boot ROM, no supported devices found! The (Lubuntu 15.10 or 16.04) boot process hangs at several points. Presumably the mptbase/mptscsi/mptspi code waits for something that never happens and the code times out? Eventually the system does finish booting. A workaround for the greatly-delayed boot process is to blacklist the mpt* modules. Anyway, see the dmesg output below. That was using an Ubuntu 4.3.0-7 kernel, but the same issue happens with vanilla kernels and older kernels. [ 1.768092] ioc0: LSI53C1030 B2: Capabilities={Initiator} ... note the delay... [ 17.240228] mptbase: ioc0: WARNING - Issuing Reset from mpt_config!!, doorbell=0x24000000 [ 18.000252] mptbase: ioc0: Attempting Retry Config request type 0x3, page 0x0, action 0 ... note the delay here... [ 33.000118] mptbase: ioc0: WARNING - Issuing Reset from mpt_config!!, doorbell=0x24000000 [ 33.000208] mptbase: ioc0: Initiating recovery [ 36.196195] mptbase: ioc0: ERROR - Enable Diagnostic mode FAILED! (120h) [ 36.196273] mptbase: ioc0: WARNING - NOT READY WARNING! [ 36.196353] mptbase: WARNING - (-1) Cannot recover ioc0, doorbell=0x10000000 [ 36.196424] mptbase: ioc0: Attempting Retry Config request type 0x3, page 0x0, action 0 [ 36.196512] mptspi: ioc0: WARNING - Skipping because it's not operational! [ 36.196589] BUG: unable to handle kernel NULL pointer dereference at 0000000000000060 [ 36.196774] IP: [<ffffffff817fa432>] mutex_lock+0x12/0x30 [ 36.196898] PGD 0 [ 36.197015] Oops: 0002 [#1] SMP [ 36.197185] Modules linked in: psmouse ahci libahci firewire_ohci mptspi(+) mptscsih firewire_core mptbase scsi_transport_spi crc_itu_t pata_acpi video [ 36.197944] CPU: 1 PID: 134 Comm: systemd-udevd Not tainted 4.3.0-7-generic #18-Ubuntu [ 36.198027] Hardware name: Dell Inc. Latitude D830 /0HN338, BIOS A17 06/19/2013 [ 36.198112] task: ffff880035dd3fc0 ti: ffff880035e9c000 task.ti: ffff880035e9c000 [ 36.198195] RIP: 0010:[<ffffffff817fa432>] [<ffffffff817fa432>] mutex_lock+0x12/0x30 [ 36.198330] RSP: 0018:ffff880035e9fa50 EFLAGS: 00010246 [ 36.198398] RAX: 0000000000000000 RBX: 0000000000000060 RCX: 00000000ffffffff [ 36.198470] RDX: 0000000080000000 RSI: 0000000000000246 RDI: 0000000000000060 [ 36.198541] RBP: ffff880035e9fa58 R08: 0000000000000000 R09: 000000000000039d [ 36.198612] R10: ffffea0004665c00 R11: 000000000000039d R12: 0000000000000060 [ 36.198683] R13: ffff88011a652000 R14: 00000000ffffffed R15: ffff8800d6d9aea0 [ 36.198754] FS: 00007f978129b8c0(0000) GS:ffff88011fd00000(0000) knlGS:0000000000000000 [ 36.198837] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 36.198907] CR2: 0000000000000060 CR3: 0000000035e5b000 CR4: 00000000000006e0 [ 36.198978] Stack: [ 36.199043] 0000000000000000 ffff880035e9fa80 ffffffff815869ad ffff880035e31000 [ 36.199330] 0000000000000000 ffff88011a652000 ffff880035e9fab0 ffffffffc008f279 [ 36.199617] ffff880035e31000 0000000000000000 ffff88011a652000 00000000ffffffed [ 36.199907] Call Trace: [ 36.199977] [<ffffffff815869ad>] scsi_remove_host+0x1d/0x110 [ 36.200049] [<ffffffffc008f279>] mptscsih_remove+0x29/0xb0 [mptscsih] [ 36.200122] [<ffffffffc005c948>] mptspi_probe+0x1f8/0x430 [mptspi] [ 36.200178] [<ffffffff81421a55>] local_pci_probe+0x45/0xa0 [ 36.200178] [<ffffffff81422e93>] pci_device_probe+0x103/0x150 [ 36.200178] [<ffffffff8152cbb2>] driver_probe_device+0x222/0x490 [ 36.200178] [<ffffffff8152cea4>] __driver_attach+0x84/0x90 [ 36.200178] [<ffffffff8152ce20>] ? driver_probe_device+0x490/0x490 [ 36.200178] [<ffffffff8152a7dc>] bus_for_each_dev+0x6c/0xc0 [ 36.200178] [<ffffffff8152c36e>] driver_attach+0x1e/0x20 [ 36.200178] [<ffffffff8152beab>] bus_add_driver+0x1eb/0x280 [ 36.200178] [<ffffffffc0063000>] ? 0xffffffffc0063000 [ 36.200178] [<ffffffff8152d740>] driver_register+0x60/0xe0 [ 36.200178] [<ffffffff8142141c>] __pci_register_driver+0x4c/0x50 [ 36.200178] [<ffffffffc00630da>] mptspi_init+0xda/0x1000 [mptspi] [ 36.200178] [<ffffffff81002123>] do_one_initcall+0xb3/0x200 [ 36.200178] [<ffffffff811c5621>] ? __vunmap+0x91/0xe0 [ 36.200178] [<ffffffff811e1fc7>] ? kmem_cache_alloc_trace+0x187/0x1f0 [ 36.200178] [<ffffffff81183d74>] ? do_init_module+0x27/0x1e5 [ 36.200178] [<ffffffff81183dac>] do_init_module+0x5f/0x1e5 [ 36.200178] [<ffffffff81104553>] load_module+0x1603/0x1b70 [ 36.200178] [<ffffffff81100750>] ? __symbol_put+0x60/0x60 [ 36.200178] [<ffffffff81208700>] ? kernel_read+0x50/0x80 [ 36.200178] [<ffffffff81104d09>] SyS_finit_module+0xb9/0xf0 [ 36.200178] [<ffffffff817fc572>] entry_SYSCALL_64_fastpath+0x16/0x71 [ 36.200178] Code: 01 0f 85 5f ff ff ff eb d5 e8 ab 30 88 ff 90 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 53 48 89 fb e8 fe e2 ff ff <f0> ff 0b 79 08 48 89 df e8 b1 fe ff ff 65 48 8b 04 25 c0 bd 00 [ 36.200178] RIP [<ffffffff817fa432>] mutex_lock+0x12/0x30 [ 36.200178] RSP <ffff880035e9fa50> [ 36.200178] CR2: 0000000000000060 [ 36.205438] ---[ end trace 854756c2c5c7201c ]--- ... a delay ... [ 42.057197] random: nonblocking pool is initialized ... another long delay... [ 121.458302] EXT4-fs (sda5): mounted filesystem with ordered data mode. Opts: (null) ... another delay... [ 151.531991] systemd[1]: RTC configured in localtime, applying delta of 0 minutes to system time.