Commit 2780f3c8 authored by Mauricio Faria de Oliveira's avatar Mauricio Faria de Oliveira Committed by Martin K. Petersen

scsi: qla2xxx: Avoid that issuing a LIP triggers a kernel crash

Avoid that issuing a LIP as follows:

  find /sys -name 'issue_lip'|while read f; do echo 1 > $f; done

triggers the following:

BUG: unable to handle kernel NULL pointer dereference at (null)
Call Trace:
 qla2x00_abort_all_cmds+0xed/0x140 [qla2xxx]
 qla2x00_abort_isp_cleanup+0x1e3/0x280 [qla2xxx]
 qla2x00_abort_isp+0xef/0x690 [qla2xxx]
 qla2x00_do_dpc+0x36c/0x880 [qla2xxx]
 kthread+0x10c/0x140

[mkp: consolidated Mauricio's and Bart's fixes]
Signed-off-by: default avatarMauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
Reported-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
Fixes: 1535aa75 ("qla2xxx: fix invalid DMA access after command aborts in PCI device remove")
Cc: Himanshu Madhani <himanshu.madhani@cavium.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 27873de9
...@@ -1616,7 +1616,7 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res) ...@@ -1616,7 +1616,7 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
/* Don't abort commands in adapter during EEH /* Don't abort commands in adapter during EEH
* recovery as it's not accessible/responding. * recovery as it's not accessible/responding.
*/ */
if (!ha->flags.eeh_busy) { if (GET_CMD_SP(sp) && !ha->flags.eeh_busy) {
/* Get a reference to the sp and drop the lock. /* Get a reference to the sp and drop the lock.
* The reference ensures this sp->done() call * The reference ensures this sp->done() call
* - and not the call in qla2xxx_eh_abort() - * - and not the call in qla2xxx_eh_abort() -
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment