lkml.org 
[lkml]   [2018]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.15 142/146] scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref
    Date
    4.15-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Quinn Tran <quinn.tran@cavium.com>

    commit 19759033e0d0beed70421ab9258f5ede79e070ae upstream.

    Fix system crash due to NULL pointer access.

    qlt_plogi_ack_t and fc_port structures were not properly bound before
    calling qlt_plogi_ack_unref().

    RIP: 0010:qlt_plogi_ack_unref+0xa1/0x150 [qla2xxx]
    Call Trace:
    qla24xx_create_new_sess+0xb1/0x320 [qla2xxx]
    qla2x00_do_work+0x123/0x260 [qla2xxx]
    qla2x00_iocb_work_fn+0x30/0x40 [qla2xxx]
    process_one_work+0x1f3/0x530
    worker_thread+0x4e/0x480
    kthread+0x10c/0x140

    Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
    Cc: <stable@vger.kernel.org> # 4.10+
    Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
    Signed-off-by: Giridhar Malavali <giridhar.malavali@cavium.com>
    Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
    Reviewed-by: Hannes Reinecke <hare@suse.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/scsi/qla2xxx/qla_os.c | 10 +++++-----
    1 file changed, 5 insertions(+), 5 deletions(-)

    --- a/drivers/scsi/qla2xxx/qla_os.c
    +++ b/drivers/scsi/qla2xxx/qla_os.c
    @@ -4750,11 +4750,11 @@ void qla24xx_create_new_sess(struct scsi
    } else {
    list_add_tail(&fcport->list, &vha->vp_fcports);

    - if (pla) {
    - qlt_plogi_ack_link(vha, pla, fcport,
    - QLT_PLOGI_LINK_SAME_WWN);
    - pla->ref_count--;
    - }
    + }
    + if (pla) {
    + qlt_plogi_ack_link(vha, pla, fcport,
    + QLT_PLOGI_LINK_SAME_WWN);
    + pla->ref_count--;
    }
    }
    spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);

    \
     
     \ /
      Last update: 2018-03-13 17:25    [W:4.289 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site