diff options
| author | Steffen Maier <maier@linux.vnet.ibm.com> | 2011-11-18 20:00:40 +0100 |
|---|---|---|
| committer | Rohan Somvanshi <rsomvanshi@nvidia.com> | 2012-01-11 09:23:54 -0800 |
| commit | 54d95d962fe127d3460ff1d6610331b7626c7523 (patch) | |
| tree | e5119bf6fceaf0972be6ee71314d43c2f63a4580 /drivers/s390 | |
| parent | 2be95e9bbff7680659d9a17f5d04d2c2c638edb9 (diff) | |
SCSI: zfcp: return early from slave_destroy if slave_alloc returned early
commit 44f747fff6e9f027a4866c1a6864e26ae7c510c8 upstream.
zfcp_scsi_slave_destroy erroneously always tried to finish its task
even if the corresponding previous zfcp_scsi_slave_alloc returned
early. This can lead to kernel page faults on accessing uninitialized
fields of struct zfcp_scsi_dev in zfcp_erp_lun_shutdown_wait. Take the
port field of the struct to determine if slave_alloc returned early.
This zfcp bug is exposed by 4e6c82b (in turn fixing f7c9c6b to be
compatible with 21208ae) which can call slave_destroy for a
corresponding previous slave_alloc that did not finish.
This patch is based on James Bottomley's fix suggestion in
http://www.spinics.net/lists/linux-scsi/msg55449.html.
Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Change-Id: I4e8a616faeb24d919c5249039394fcfa78365986
Reviewed-on: http://git-master/r/74163
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>
Tested-by: Varun Wadekar <vwadekar@nvidia.com>
Diffstat (limited to 'drivers/s390')
| -rw-r--r-- | drivers/s390/scsi/zfcp_scsi.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c index 7cac873c7383..169ba7b75042 100644 --- a/drivers/s390/scsi/zfcp_scsi.c +++ b/drivers/s390/scsi/zfcp_scsi.c @@ -57,6 +57,10 @@ static void zfcp_scsi_slave_destroy(struct scsi_device *sdev) { struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(sdev); + /* if previous slave_alloc returned early, there is nothing to do */ + if (!zfcp_sdev->port) + return; + zfcp_erp_lun_shutdown_wait(sdev, "scssd_1"); put_device(&zfcp_sdev->port->dev); } |