Bug 43085

Summary: BUG: unable to handle kernel NULL pointer dereference (in scsi_send_eh_cmnd)
Product: Drivers Reporter: rocko (rockorequin)
Component: USBAssignee: Greg Kroah-Hartman (greg)
Status: CLOSED CODE_FIX    
Severity: high CC: alan
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: 3.4-rc2 Subsystem:
Regression: Yes Bisected commit-id:
Attachments: BUG - unable to handle kernel NULL pointer dereference (scsi_send_eh_cmnd)

Description rocko 2012-04-10 09:53:43 UTC
Created attachment 72868 [details]
BUG - unable to handle kernel NULL pointer dereference (scsi_send_eh_cmnd)

Whenever I plug my USB3 hub into the PC, I encounter this bug (log attached). It stops the PC from booting if the hub is inserted at the time, and crashes USB if I encounter it once the desktop is running.

The line where it crashes is in scsi_error.c at line 782:

struct scsi_driver *sdrv = scsi_cmd_to_driver(scmd);

which expands to:

struct scsi_driver *sdrv *(struct scsi_driver **)scmd->request->rq_disk->private_data

The issue is that rq_disk is NULL (possibly because it's a USB hub and there isn't necessarily an underlying hard drive?).

If I make it check for rq_disk being null before trying to assign sdrv and set sdrv to null accordingly, and then later in the function I check for sdrv being null before looking at sdrv->eh_action, the error goes away and drives on the hub seem to mount and function OK (mostly anyway).
Comment 1 rocko 2012-05-12 03:31:31 UTC
I believe this was fixed by commit 919f797a4c9c22ff5ec059744dba364dc600ece2.
Comment 2 Alan 2012-05-12 12:53:11 UTC
Thanks