2.6.19-rc3 system freezes when ripping with cdparanoia at ioctl(SG_IO)

[Gregor Jasny]

Hi,

Today I tried the new cdparanoia from Debian Sid (3.10+debian~pre0-2).
When I started ripping with "cdparanoia -d /dev/scd0 1" my system
freezes after some seconds. There is no oops and even the console
cursor stops blinking.

If I start cdparanoia with -g /dev/scd0 it starts ripping and but the
kernel prints many "program cdparanoia not setting count and/or
reply_len properly" warnings. But this seems to be a cdparanoia bug.

My CDROM:
Vendor:                    PIONEER
Product:                   DVD-ROM DVD-106
Revision level:            1.22





http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=391901
(gdb) bt full
#0  0xb7ed1600 in ioctl () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#1  0x08050dea in sgio_handle_scsi_cmd (d=0x806b0a8, cmd=0xbf974812 "\022", cmd_len=6, in_size=0, out_size=56, bytefill=255 'ÿ', bytecheck=1,
    sense=0xbf974818 "") at scsi_interface.c:352
        status = 0
        hdr = {interface_id = 83, dxfer_direction = -4, cmd_len = 6 '\006', mx_sb_len = 16 '\020', iovec_count = 0, dxfer_len = 56, dxferp = 0x806b4d8,
  cmdp = 0xbf974812 "\022", sbp = 0xbf974818 "", timeout = 50000, flags = 1, pack_id = 0, usr_ptr = 0x0, status = 0 '\0', masked_status = 0 '\0',
  msg_status = 0 '\0', sb_len_wr = 0 '\0', host_status = 0, driver_status = 0, resid = 0, duration = 0, info = 0}
#2  0x08050ef4 in handle_scsi_cmd (d=0x806b0a8, cmd=0xbf974812 "\022", cmd_len=6, in_size=0, out_size=56, bytefill=255 'ÿ', bytecheck=1, sense=0xbf974818 "")
    at scsi_interface.c:391
No locals.
#3  0x08053ff6 in scsi_inquiry (d=0x806b0a8) at scsi_interface.c:1535
        sense = "\000\000\000\000\001\000\000\000\000\000\000\001\002\000\000"
        cmd = "\022\000\000\0008"
#4  0x0804e146 in cdda_identify_scsi (generic_device=0x0, specialized_device=0x806b098 "/dev/scd0", messagedest=0, messages=0x0) at scan_devices.c:703
        d = (cdrom_drive *) 0x806b0a8
        i_st = {st_dev = 14, __pad1 = 0, st_ino = 2028, st_mode = 25008, st_nlink = 1, st_uid = 0, st_gid = 24, st_rdev = 2816, __pad2 = 0, st_size = 0,
  st_blksize = 4096, st_blocks = 0, st_atim = {tv_sec = 1162150314, tv_nsec = 324927620}, st_mtim = {tv_sec = 1162150314, tv_nsec = 324927620}, st_ctim = {
    tv_sec = 1162150314, tv_nsec = 324927620}, __unused4 = 0, __unused5 = 0}
        g_st = {st_dev = 141136301929769700, __pad1 = 0, st_ino = 48, st_mode = 3070230528, st_nlink = 0, st_uid = 0, st_gid = 9914656, st_rdev = 8589934641,
  __pad2 = 65535, st_size = -1208806156, st_blksize = -1209204882, st_blocks = -1208766476, st_atim = {tv_sec = 3, tv_nsec = -1080600960}, st_mtim = {
    tv_sec = -1080604384, tv_nsec = -1209230685}, st_ctim = {tv_sec = 3, tv_nsec = -1080604488}, __unused4 = 3214362972, __unused5 = 14}
        use_sgio = 1
        i_fd = 6
        i = -1080604360
        g_fd = 7
        version = 3
        type = 11
        p = 0xbf97495c "\016"
#5  0x0804cd4e in cdda_identify (device=0x806b008 "/dev/scd0", messagedest=0, messages=0x0) at scan_devices.c:123
        st = {st_dev = 14, __pad1 = 0, st_ino = 2028, st_mode = 25008, st_nlink = 1, st_uid = 0, st_gid = 24, st_rdev = 2816, __pad2 = 0, st_size = 0,
  st_blksize = 4096, st_blocks = 0, st_atim = {tv_sec = 1162150314, tv_nsec = 324927620}, st_mtim = {tv_sec = 1162150314, tv_nsec = 324927620}, st_ctim = {
    tv_sec = 1162150314, tv_nsec = 324927620}, __unused4 = 0, __unused5 = 0}
        d = (cdrom_drive *) 0x0
#6  0x0804a485 in main (argc=4, argv=0xbf9756f4) at main.c:794
        toc_bias = 0
        toc_offset = 0
        sample_offset = 0
        force_cdrom_endian = -1
        force_cdrom_sectors = -1
        force_cdrom_overlap = -1
        force_cdrom_device = 0x806b008 "/dev/scd0"
        force_generic_device = 0x0
        force_cdrom_speed = -1
        max_retries = 20
        span = 0x806b018 "1"
        output_type = 1
        output_endian = 0
        query_only = 0
        batch = 0
        i = 0
        paranoia_mode = 223
        info_file = 0x0
        out = 0
        search = 0
        c = -1
        long_option_index = 0
(gdb) list scsi_interface.c:1535
1530    /* request vendor brand and model */
1531    unsigned char *scsi_inquiry(cdrom_drive *d){
1532      unsigned char sense[SG_MAX_SENSE];
1533      unsigned char cmd[6]={ 0x12,0,0,0,56,0 };
1534
1535      if(handle_scsi_cmd(d,cmd,6, 0, 56,'\377',1,sense)) {
1536        cderror(d,"008: Unable to identify CDROM model\n");
1537        return(NULL);
1538      }
1539      return (d->sg_buffer);