Re: Kernel stack corruption with SCSI

David S. Miller (davem@jenolan.rutgers.edu)
Sun, 5 Jan 1997 03:31:56 -0500


Date: Sat, 4 Jan 1997 13:37:50 +0100 (MET)
From: Ingo Molnar <mingo@pc5829.hil.siemens.at>

is this problem present (and solved :) in the Sun4c trap logic? Or
is this an SCSI driver problem. (are drivers allowed to use stack
memory as DMA buffers?).

I solve this problem on the sun4c using "smoke and mirrors".

The sun4c is the only sparc platform that needs these special stacks.
And guess what, to make a page DMA'able you just need to lock it into
the TLB (the sun4c TLB does virt-->phys translations for the DVMA).
So when the scsi driver asks me to make some buffer DMA'able on sun4c,
and I see it's in the special task/kernel-stack mapping area, I just
nop and return. (see sun4c_get_scsi_one/sun4c_release_scsi_one in
arch/sparc/mm/sun4c.c)

On the sun4m I just use normal gfp() pages since no locking is
necessary on those machines.

For a longer term fix, since I imagine some others will run into this
too, change the code at the top of scsi_scsis() to always use
scsi_init_malloc() to get the scsi_result buffer and not use the
stack.

---------------------------------------------////
Yow! 11.26 MB/s remote host TCP bandwidth & ////
199 usec remote TCP latency over 100Mb/s ////
ethernet. Beat that! ////
-----------------------------------------////__________ o
David S. Miller, davem@caip.rutgers.edu /_____________/ / // /_/ ><