[SCSI] esp: Fix OOPS in esp_reset_cleanup().
OOPS reported by Friedrich Oslage <bluebird@porno-bullen.de> The problem here is that tp->starget is set every time a lun is allocated for a particular target so we can catch the sdev_target parent value. The reset handler uses the NULL'ness of this value to determine which targets are active. But esp_slave_destroy() does not NULL out this value when appropriate. So for every target that doesn't respond, the SCSI bus scan causes a stale pointer to be left here, with ensuing crashes like you're seeing. Signed-off-by: David S. Miller <davem@davemloft.net> Cc: Stable Tree <stable@kernel.org> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>hifive-unleashed-5.1
parent
c95e62ce89
commit
eadc49b1a8
|
@ -2371,6 +2371,7 @@ static int esp_slave_alloc(struct scsi_device *dev)
|
||||||
dev->hostdata = lp;
|
dev->hostdata = lp;
|
||||||
|
|
||||||
tp->starget = dev->sdev_target;
|
tp->starget = dev->sdev_target;
|
||||||
|
tp->starget_ref++;
|
||||||
|
|
||||||
spi_min_period(tp->starget) = esp->min_period;
|
spi_min_period(tp->starget) = esp->min_period;
|
||||||
spi_max_offset(tp->starget) = 15;
|
spi_max_offset(tp->starget) = 15;
|
||||||
|
@ -2425,10 +2426,17 @@ static int esp_slave_configure(struct scsi_device *dev)
|
||||||
|
|
||||||
static void esp_slave_destroy(struct scsi_device *dev)
|
static void esp_slave_destroy(struct scsi_device *dev)
|
||||||
{
|
{
|
||||||
|
struct esp *esp = shost_priv(dev->host);
|
||||||
|
struct esp_target_data *tp = &esp->target[dev->id];
|
||||||
struct esp_lun_data *lp = dev->hostdata;
|
struct esp_lun_data *lp = dev->hostdata;
|
||||||
|
|
||||||
kfree(lp);
|
kfree(lp);
|
||||||
dev->hostdata = NULL;
|
dev->hostdata = NULL;
|
||||||
|
|
||||||
|
BUG_ON(tp->starget_ref <= 0);
|
||||||
|
|
||||||
|
if (!--tp->starget_ref)
|
||||||
|
tp->starget = NULL;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int esp_eh_abort_handler(struct scsi_cmnd *cmd)
|
static int esp_eh_abort_handler(struct scsi_cmnd *cmd)
|
||||||
|
|
|
@ -322,6 +322,7 @@ struct esp_target_data {
|
||||||
u8 nego_goal_tags;
|
u8 nego_goal_tags;
|
||||||
|
|
||||||
struct scsi_target *starget;
|
struct scsi_target *starget;
|
||||||
|
int starget_ref;
|
||||||
};
|
};
|
||||||
|
|
||||||
struct esp_event_ent {
|
struct esp_event_ent {
|
||||||
|
|
Loading…
Reference in New Issue