[stgt] 0.9.11 released

[FUJITA Tomonori]

On Wed, 25 Nov 2009 16:34:41 +0100
Albert Pauw <albert.pauw at gmail.com> wrote:

> 
> > Please send a log file including tgt's debug message (as you did in
> > 2009/10/28).
> >    
> Here's the last bit of tgtd -f -d8:
> 
> tgtd: spc_inquiry(164) 0 0
> tgtd: target_cmd_queue(873) 28 12 (nil) 0x84a1000 0 0 56 0 0
> tgtd: iscsi_scsi_cmd_done(1185) shrunk too big device read len 66 > 56
> tgtd: iscsi_task_tx_start(1858) found a task 28 56 0 0
> tgtd: iscsi_data_rsp_build(1050) 56 56 56 819228
> tgtd: __cmd_done(934) 0 (nil) 0x84a1000 0 56 0
> tgtd: iscsi_task_tx_start(1883) no more data
> tgtd: iscsi_scsi_cmd_rx_start(1567) 1 1a 0 0 136 1 29
> tgtd: iscsi_task_queue(1512) 24 24 1
> tgtd: target_cmd_queue(843) 0x84a07e0 1a 4
> tgtd: target_cmd_queue(862) 0x84a07e0 1a 4 1
> tgtd: target_cmd_queue(873) 29 1a (nil) 0x84a1000 0 0 136 0 0
> tgtd: iscsi_task_tx_start(1858) found a task 29 136 0 0
> tgtd: iscsi_data_rsp_build(1050) 24 136 24 819229
> tgtd: __cmd_done(934) 0 (nil) 0x84a1000 0 136 0
> tgtd: iscsi_task_tx_start(1883) no more data
> tgtd: iscsi_scsi_cmd_rx_start(1567) 1 b8 0 0 40 1 2a
> tgtd: iscsi_task_queue(1512) 25 25 1
> tgtd: target_cmd_queue(843) 0x84a07e0 b8 4
> tgtd: target_cmd_queue(862) 0x84a07e0 b8 4 1
> tgtd: smc_read_element_status(372) 40 1256 24
> *** glibc detected *** tgtd: double free or corruption (!prev): 
> 0x084a0978 ***
> *** glibc detected *** tgtd: malloc(): memory corruption: 0x084a0c00 ***

Try this instead of the previous:

diff --git a/usr/smc.c b/usr/smc.c
index 6430882..0e0d4d2 100644
--- a/usr/smc.c
+++ b/usr/smc.c
@@ -304,7 +304,7 @@ static int smc_read_element_status(int host_no, struct scsi_cmd *cmd)
 		}
 	}
 
-	data = zalloc(alloc_len);
+	data = zalloc(8192);
 	if (!data) {
 		dprintf("Can't allocate enough memory for cmd\n");
 		key = HARDWARE_ERROR;
@@ -369,6 +369,7 @@ static int smc_read_element_status(int host_no, struct scsi_cmd *cmd)
 
 	/* Lastly, fill in data header */
 	len = element_status_data_hdr(data, dvcid, voltag, first, count);
+	eprintf("%d %d %d\n", alloc_len, len, count);
 	memcpy(scsi_get_in_buffer(cmd), data, min(len, alloc_len));
 	scsi_set_in_resid_by_actual(cmd, len);
 	free(data);
--
To unsubscribe from this list: send the line "unsubscribe stgt" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html