lkml.org 
[lkml]   [2008]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 17/47] SCSI: esp: Fix OOPS in esp_reset_cleanup().
    2.6.25-stable review patch.  If anyone has any objections, please let us
    know.

    ------------------
    From: David S. Miller <davem@davemloft.net>

    commit eadc49b1a8d09480f14caea292142f103a89c77a upstream

    OOPS reported by Friedrich Oslage <bluebird@porno-bullen.de>

    The problem here is that tp->starget is set every time a lun
    is allocated for a particular target so we can catch the
    sdev_target parent value.

    The reset handler uses the NULL'ness of this value to determine
    which targets are active.

    But esp_slave_destroy() does not NULL out this value when appropriate.

    So for every target that doesn't respond, the SCSI bus scan causes
    a stale pointer to be left here, with ensuing crashes like you're
    seeing.

    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/scsi/esp_scsi.c | 8 ++++++++
    drivers/scsi/esp_scsi.h | 1 +
    2 files changed, 9 insertions(+)

    --- a/drivers/scsi/esp_scsi.c
    +++ b/drivers/scsi/esp_scsi.c
    @@ -2364,6 +2364,7 @@ static int esp_slave_alloc(struct scsi_d
    dev->hostdata = lp;

    tp->starget = dev->sdev_target;
    + tp->starget_ref++;

    spi_min_period(tp->starget) = esp->min_period;
    spi_max_offset(tp->starget) = 15;
    @@ -2412,10 +2413,17 @@ static int esp_slave_configure(struct sc

    static void esp_slave_destroy(struct scsi_device *dev)
    {
    + struct esp *esp = shost_priv(dev->host);
    + struct esp_target_data *tp = &esp->target[dev->id];
    struct esp_lun_data *lp = dev->hostdata;

    kfree(lp);
    dev->hostdata = NULL;
    +
    + BUG_ON(tp->starget_ref <= 0);
    +
    + if (!--tp->starget_ref)
    + tp->starget = NULL;
    }

    static int esp_eh_abort_handler(struct scsi_cmnd *cmd)
    --- a/drivers/scsi/esp_scsi.h
    +++ b/drivers/scsi/esp_scsi.h
    @@ -322,6 +322,7 @@ struct esp_target_data {
    u8 nego_goal_tags;

    struct scsi_target *starget;
    + int starget_ref;
    };

    struct esp_event_ent {
    --


    \
     
     \ /
      Last update: 2008-07-23 01:27    [W:0.025 / U:31.108 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site