[SCSI] zfcp: return early from slave_destroy if slave_alloc returned early
zfcp_scsi_slave_destroy erroneously always tried to finish its task even if the corresponding previous zfcp_scsi_slave_alloc returned early. This can lead to kernel page faults on accessing uninitialized fields of struct zfcp_scsi_dev in zfcp_erp_lun_shutdown_wait. Take the port field of the struct to determine if slave_alloc returned early. This zfcp bug is exposed by4e6c82b
(in turn fixingf7c9c6b
to be compatible with21208ae
) which can call slave_destroy for a corresponding previous slave_alloc that did not finish. This patch is based on James Bottomley's fix suggestion in http://www.spinics.net/lists/linux-scsi/msg55449.html. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Cc: <stable@kernel.org> #2.6.38+ Signed-off-by: James Bottomley <JBottomley@Parallels.com>
This commit is contained in:
Родитель
7e1e7ead88
Коммит
44f747fff6
|
@ -55,6 +55,10 @@ static void zfcp_scsi_slave_destroy(struct scsi_device *sdev)
|
|||
{
|
||||
struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(sdev);
|
||||
|
||||
/* if previous slave_alloc returned early, there is nothing to do */
|
||||
if (!zfcp_sdev->port)
|
||||
return;
|
||||
|
||||
zfcp_erp_lun_shutdown_wait(sdev, "scssd_1");
|
||||
put_device(&zfcp_sdev->port->dev);
|
||||
}
|
||||
|
|
Загрузка…
Ссылка в новой задаче