lkml.org 
[lkml]   [2014]   [Jul]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 008/125] IB/srp: Fix a sporadic crash triggered by cable pulling
    3.2.61-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Bart Van Assche <bvanassche@acm.org>

    commit 024ca90151f5e4296d30f72c13ff9a075e23c9ec upstream.

    Avoid that the loops that iterate over the request ring can encounter
    a pointer to a SCSI command in req->scmnd that is no longer associated
    with that request. If the function srp_unmap_data() is invoked twice
    for a SCSI command that is not in flight then that would cause
    ib_fmr_pool_unmap() to be invoked with an invalid pointer as argument,
    resulting in a kernel oops.

    Reported-by: Sagi Grimberg <sagig@mellanox.com>
    Reference: http://thread.gmane.org/gmane.linux.drivers.rdma/19068/focus=19069
    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/infiniband/ulp/srp/ib_srp.c | 6 ++++++
    1 file changed, 6 insertions(+)

    --- a/drivers/infiniband/ulp/srp/ib_srp.c
    +++ b/drivers/infiniband/ulp/srp/ib_srp.c
    @@ -1353,6 +1353,12 @@ err_unmap:
    err_iu:
    srp_put_tx_iu(target, iu, SRP_IU_CMD);

    + /*
    + * Avoid that the loops that iterate over the request ring can
    + * encounter a dangling SCSI command pointer.
    + */
    + req->scmnd = NULL;
    +
    spin_lock_irqsave(&target->lock, flags);
    list_add(&req->list, &target->free_reqs);



    \
     
     \ /
      Last update: 2014-07-09 03:41    [W:5.529 / U:0.220 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site