On Thu, 2018-02-08 at 09:00 -0800, t...@kernel.org wrote:
> On Thu, Feb 08, 2018 at 04:31:43PM +0000, Bart Van Assche wrote:
> > The crash is reported at address scsi_times_out+0x17 == scsi_times_out+23.
> > The
> > instruction at that address tries to dereference scsi_cmnd.device (%rax).
> > The
> > register dump shows that that pointer has the value NULL. The only function
> > I
> > know of that clears the scsi_cmnd.device pointer is scsi_req_init(). The
> > only
> > caller of that function in the SCSI core is scsi_initialize_rq(). That
> > function
> > has two callers, namely scsi_init_command() and blk_get_request(). However,
> > the scsi_cmnd.device pointer is not cleared when a request finishes. This is
> > why I think that the above crash report indicates that scsi_times_out() was
> > called for a request that was being reinitialized and not by device
> > hotplugging.
> I could be misreading it but scsi_cmnd->device dereference should be
> the following.
> 0x0000000000005bdd <+13>: mov 0x1b0(%rdi),%rax
> %rdi is @req, 0x1b0(%rdi) seems to be the combined arithmetic of
> blk_mq_rq_to_pdu() and ->device dereference - 0x178 + 0x38. The
> faulting access is (%rax), which is deref'ing host from device.
I think "dereferencing a pointer" means reading the memory location that
at? Anyway, I think we both interpret the crash report in the same way, namely
means that scmd->device == NULL.