[lkml]   [2012]   [Jan]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[10/75] SCSI: zfcp: return early from slave_destroy if slave_alloc returned early
3.1-stable review patch.  If anyone has any objections, please let me know.


From: Steffen Maier <>

commit 44f747fff6e9f027a4866c1a6864e26ae7c510c8 upstream.

zfcp_scsi_slave_destroy erroneously always tried to finish its task
even if the corresponding previous zfcp_scsi_slave_alloc returned
early. This can lead to kernel page faults on accessing uninitialized
fields of struct zfcp_scsi_dev in zfcp_erp_lun_shutdown_wait. Take the
port field of the struct to determine if slave_alloc returned early.

This zfcp bug is exposed by 4e6c82b (in turn fixing f7c9c6b to be
compatible with 21208ae) which can call slave_destroy for a
corresponding previous slave_alloc that did not finish.

This patch is based on James Bottomley's fix suggestion in

Signed-off-by: Steffen Maier <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>

drivers/s390/scsi/zfcp_scsi.c | 4 ++++
1 file changed, 4 insertions(+)

--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -57,6 +57,10 @@ static void zfcp_scsi_slave_destroy(stru
struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(sdev);

+ /* if previous slave_alloc returned early, there is nothing to do */
+ if (!zfcp_sdev->port)
+ return;
zfcp_erp_lun_shutdown_wait(sdev, "scssd_1");

 \ /
  Last update: 2012-01-04 00:07    [W:0.215 / U:0.296 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site