redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

[SCSI] esp: Fix OOPS in esp_reset_cleanup(). 

OOPS reported by Friedrich Oslage <bluebird@porno-bullen.de>

The problem here is that tp->starget is set every time a lun
is allocated for a particular target so we can catch the
sdev_target parent value.

The reset handler uses the NULL'ness of this value to determine
which targets are active.

But esp_slave_destroy() does not NULL out this value when appropriate.

So for every target that doesn't respond, the SCSI bus scan causes
a stale pointer to be left here, with ensuing crashes like you're
seeing.

Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
hifive-unleashed-5.1
David S. Miller 2008-06-17 23:53:22 -07:00 committed by James Bottomley
parent c95e62ce89
commit eadc49b1a8
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/scsi/esp_scsi.c
View File

@ -2371,6 +2371,7 @@ static int esp_slave_alloc(struct scsi_device *dev)
dev->hostdata = lp;
tp->starget = dev->sdev_target;
tp->starget_ref++;
spi_min_period(tp->starget) = esp->min_period;
spi_max_offset(tp->starget) = 15;
@ -2425,10 +2426,17 @@ static int esp_slave_configure(struct scsi_device *dev)
static void esp_slave_destroy(struct scsi_device *dev)
{
struct esp *esp = shost_priv(dev->host);
struct esp_target_data *tp = &esp->target[dev->id];
struct esp_lun_data *lp = dev->hostdata;
kfree(lp);
dev->hostdata = NULL;
BUG_ON(tp->starget_ref <= 0);
if (!--tp->starget_ref)
tp->starget = NULL;
}
static int esp_eh_abort_handler(struct scsi_cmnd *cmd)

1
drivers/scsi/esp_scsi.h
View File

@ -322,6 +322,7 @@ struct esp_target_data {
u8 nego_goal_tags;
struct scsi_target *starget;
int starget_ref;
};
struct esp_event_ent {