https://jira.whamcloud.com This file is an XML representation of an issue en-us 9.4.14 940014 05-12-2023 https://jira.whamcloud.com/browse/LU-8057 Lustre <p>A bug was discovered in the upstream kernel in the handling of the scatter list, tx-&gt;tx_frag, in the o2iblnd driver. So the fix of using sg_next was introduced but it revealed a serious bug in that when all 256 pages allocated for fragments are used and the data is at an offset that an extra random page of memory is stomped on.</p> Any installation running Lustre on top of a infiniband stack. LU-8057

o2iblnd driver is causing memory corruption due to improper handling of scatter list.

Bug Blocker Resolved Fixed Doug Oucharek James A Simmons patch Fri, 22 Apr 2016 16:19:29 +0000 Tue, 19 Mar 2019 15:42:15 +0000 Wed, 15 Jun 2016 13:17:48 +0000 Lustre 2.7.0 Lustre 2.8.0 Lustre 2.9.0 Lustre 2.9.0 0 11 <p>Can you please link to the actual details of the problems here?</p> <p>I created a patch that has the back ported patch as well as a possible fix. Its at <a href="http://review.whamcloud.com/#/c/19342" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/#/c/19342</a>. The original patch was sent to Greg directly so its not in the driver-devel mailing archives. Using the upstream staging tree you can inspect this change at git commit 3d1477309806459d39e13d8c3206ba35d183c34a</p> <p>James, could you clarify if the memory corruption issue is related to the use of sg_next(), or if it also existed with the sg++ implementation but was just harder to detect? That will affect which Lustre versions this patch needs to be backported to.</p> <p>Doug</p> <p>Could you please review this patch?</p> <p>Thanks</p> <p>Peter</p> <p>The memory corruption exist with the current implementation using sg+<ins>. If the offset is not zero and if all 256 pages for the fragments are used then an extra random page gets stomped on. So what we have now made it harder to detect since it was a silent corruption. In the upstream client when sg</ins>+ was replaced by sg = sg_next() there was no extra random page you could stomp on so I was seeing failures in my testing. Let me duplicate the failures and post them here.</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/19342/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/19342/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-8057" title="o2iblnd driver is causing memory corruption due to improper handling of scatter list." class="issue-link" data-issue-key="LU-8057"><del>LU-8057</del></a> ko2iblnd: Replace sg++ with sg = sg_next(sg)<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: d226464acaacccd240da43dcc22372fbf8cb04a6</p> <p>patch has landed to master for 2.9.0</p> Related LU-4423 LU-8715 Development End date Mon, 25 Apr 2016 16:19:29 +0000 Rank 1|hzy8xr: Rank (Obsolete) 9223372036854775807 Severity Start date Fri, 22 Apr 2016 16:19:29 +0000