[Pkg-iscsi-maintainers] Bug#685422: iscsitarget-dkms: ata smart commands denial of service

[bug subscriber]

Package: iscsitarget-dkms
Version: 1.4.20.2-10
Severity: important

Dear Maintainer,

ata smart commands generates kernel call trace and kernel process istd1 hangs running at 100% cpu. iscsi target becomes unuseable unless reboot
for example, I ran smartctl -i sdl on my windows xp initiator.
this is how kernel has responded:

[21974.560657] iscsi_trgt: BUG at /var/lib/dkms/iscsitarget/1.4.20.2/build/kernel/iscsi.c:392 assert(req->tio)
[21974.560667] Pid: 3288, comm: istiod1 Tainted: G           O 3.2.0-3-amd64 #1
[21974.560671] Call Trace:
[21974.560683]  [<ffffffffa04c53f1>] ? send_data_rsp+0x45/0x1f4 [iscsi_trgt]
[21974.560691]  [<ffffffffa04ce093>] ? ua_pending+0x19/0xa5 [iscsi_trgt]
[21974.560698]  [<ffffffffa04ccda8>] ? disk_execute_cmnd+0x1cf/0x22d [iscsi_trgt]
[21974.560705]  [<ffffffffa04c8a3d>] ? worker_thread+0xfd/0x255 [iscsi_trgt]
[21974.560711]  [<ffffffff8103f48f>] ? try_to_wake_up+0x197/0x197
[21974.560717]  [<ffffffffa04c8940>] ? nthread_stop+0x35/0x35 [iscsi_trgt]
[21974.560724]  [<ffffffff8105efad>] ? kthread+0x76/0x7e
[21974.560730]  [<ffffffff81351df4>] ? kernel_thread_helper+0x4/0x10
[21974.560735]  [<ffffffff8105ef37>] ? kthread_worker_fn+0x139/0x139
[21974.560740]  [<ffffffff81351df0>] ? gs_change+0x13/0x13
[21974.560767] ------------[ cut here ]------------
[21974.560770] kernel BUG at /var/lib/dkms/iscsitarget/1.4.20.2/build/kernel/iscsi.c:392!
[21974.560775] invalid opcode: 0000 [#1] SMP
[21974.560779] CPU 1
[21974.560781] Modules linked in: pppoe pppox ppp_generic slhc bluetooth drbd lru_cache cn tun ip6table_filter ip6_tables ebtable_nat ebtables iscsi_trgt(O) crc32c ipt_LOG ipt_REJECT xt_multiport xt_conntrack iptable_filter xt_TCPMSS xt_tcpmss iptable_mangle ipt_MASQUERADE xt_tcpudp iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack ip_tables x_tables kvm_intel kvm ib_iser rdma_cm ib_addr iw_cm ib_cm ib_sa ib_mad ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse bridge stp loop tpm_infineon snd_hda_codec_analog i915 asix snd_hda_intel snd_hda_codec drm_kms_helper snd_hwdep coretemp psmouse drm i2c_algo_bit mcs7830 snd_pcm i2c_core snd_page_alloc snd_timer usbnet snd evdev hp_wmi sparse_keymap serio_raw pcspkr soundcore rfkill iTCO_wdt iTCO_vendor_support acpi_cpufreq mperf processor video button tpm_tis tpm tpm_bios wmi thermal_sys ext4 crc16 jbd2 mbcache raid1 md_mod dm_mirror dm_region_hash dm_log dm_mod usb_storage uas sd_mod crc_t10dif ata_generic floppy uhci_hcd ata_piix e100 mii ehci_hcd libata scsi_mod e1000e usbcore usb_common [last unloaded: scsi_wait_scan]
[21974.560891]
[21974.560895] Pid: 3288, comm: istiod1 Tainted: G           O 3.2.0-3-amd64 #1 Hewlett-Packard HP Compaq dc5800 Microtower/2820h
[21974.560902] RIP: 0010:[<ffffffffa04c53f1>]  [<ffffffffa04c53f1>] send_data_rsp+0x45/0x1f4 [iscsi_trgt]
[21974.560911] RSP: 0018:ffff880112d55e10  EFLAGS: 00010286
[21974.560915] RAX: 0000000000000000 RBX: ffff880115445060 RCX: 000000000000b182
[21974.560920] RDX: 000000000000b182 RSI: ffff880112d55f58 RDI: ffff880112d55f58
[21974.560924] RBP: 0000000000000000 R08: 0000000000000000 R09: 0720072007200720
[21974.560928] R10: 0000000000000001 R11: 0720072007200720 R12: ffff880113be8280
[21974.560932] R13: ffff880115d76000 R14: ffff880112c5a4d8 R15: ffff880112c5a4e8
[21974.560937] FS:  0000000000000000(0000) GS:ffff88011bc80000(0000) knlGS:0000000000000000
[21974.560942] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[21974.560946] CR2: 00007f9a69f95600 CR3: 000000011350e000 CR4: 00000000000006e0
[21974.560950] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[21974.560954] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[21974.560959] Process istiod1 (pid: 3288, threadinfo ffff880112d54000, task ffff880113be8280)
[21974.560963] Stack:
[21974.560966]  000013f100000000 ffff8801136c9650 0000000000013740 ffffffffa04ce093
[21974.560973]  ffff880112d55fd8 ffff880115445060 ffff880113be8280 ffff880113be8280
[21974.560979]  ffff880115d76000 ffff880112c5a4d8 ffff880112c5a4e8 ffffffffa04ccda8
[21974.560986] Call Trace:
[21974.560992]  [<ffffffffa04ce093>] ? ua_pending+0x19/0xa5 [iscsi_trgt]
[21974.560999]  [<ffffffffa04ccda8>] ? disk_execute_cmnd+0x1cf/0x22d [iscsi_trgt]
[21974.561006]  [<ffffffffa04c8a3d>] ? worker_thread+0xfd/0x255 [iscsi_trgt]
[21974.561011]  [<ffffffff8103f48f>] ? try_to_wake_up+0x197/0x197
[21974.561018]  [<ffffffffa04c8940>] ? nthread_stop+0x35/0x35 [iscsi_trgt]
[21974.561023]  [<ffffffff8105efad>] ? kthread+0x76/0x7e
[21974.561028]  [<ffffffff81351df4>] ? kernel_thread_helper+0x4/0x10
[21974.561033]  [<ffffffff8105ef37>] ? kthread_worker_fn+0x139/0x139
[21974.561039]  [<ffffffff81351df0>] ? gs_change+0x13/0x13
[21974.561041] Code: 48 85 ed 75 28 48 c7 c1 38 fd 4c a0 ba 88 01 00 00 48 c7 c6 a7 f9 4c a0 48 c7 c7 df f9 4c a0 31 c0 e8 de f2 e7 e0 e8 19 d8 e7 e0 <0f> 0b 48 89 df e8 d0 fa ff ff 8b 55 14 39 d0 0f 46 d0 85 d2 0f
[21974.561083] RIP  [<ffffffffa04c53f1>] send_data_rsp+0x45/0x1f4 [iscsi_trgt]
[21974.561090]  RSP <ffff880112d55e10>
[21974.561094] ---[ end trace 6fe56b5bd067bee4 ]---

root at homerouter:~# /etc/init.d/iscsitarget stop
Removing iSCSI enterprise target devices: :<hangs indefinitely>

the rest of the system is running ok, but since I cannot kill the kernel process I must reboot the system in order to keep using iscsi target.
  PID USER      PR  NI  VIRT  RES  SHR S  %CPU %MEM    TIME+  COMMAND
 3262 root      20   0     0    0    0 R 100.1  0.0  36:10.98 istd1


-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-3-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages iscsitarget-dkms depends on:
ii  dkms  2.2.0.3-1.1
ii  make  3.81-8.2

Versions of packages iscsitarget-dkms recommends:
ii  linux-headers-3.2.0-1-amd64 [linux-headers]  3.2.6-1
ii  linux-headers-3.2.0-2-amd64 [linux-headers]  3.2.20-1
ii  linux-headers-3.2.0-3-amd64 [linux-headers]  3.2.23-1
ii  linux-headers-amd64 [linux-headers]          3.2+45

iscsitarget-dkms suggests no packages.

-- no debconf information