Commit 2cc5bfaf authored by Tomas Henzl's avatar Tomas Henzl Committed by James Bottomley

[SCSI] hpsa: fix a race in cmd_free/scsi_done

When the driver calls scsi_done and after that frees it's internal
preallocated memory it can happen that a new job is enqueud before
the memory is freed. The allocation fails and the message
"cmd_alloc returned NULL" is shown.
Patch below fixes it by moving cmd->scsi_done after cmd_free.
Signed-off-by: default avatarTomas Henzl <thenzl@redhat.com>
Acked-by: default avatarStephen M. Cameron <scameron@beardog.cce.hp.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
parent 80aebef7
...@@ -1205,8 +1205,8 @@ static void complete_scsi_command(struct CommandList *cp) ...@@ -1205,8 +1205,8 @@ static void complete_scsi_command(struct CommandList *cp)
scsi_set_resid(cmd, ei->ResidualCnt); scsi_set_resid(cmd, ei->ResidualCnt);
if (ei->CommandStatus == 0) { if (ei->CommandStatus == 0) {
cmd->scsi_done(cmd);
cmd_free(h, cp); cmd_free(h, cp);
cmd->scsi_done(cmd);
return; return;
} }
...@@ -1379,8 +1379,8 @@ static void complete_scsi_command(struct CommandList *cp) ...@@ -1379,8 +1379,8 @@ static void complete_scsi_command(struct CommandList *cp)
dev_warn(&h->pdev->dev, "cp %p returned unknown status %x\n", dev_warn(&h->pdev->dev, "cp %p returned unknown status %x\n",
cp, ei->CommandStatus); cp, ei->CommandStatus);
} }
cmd->scsi_done(cmd);
cmd_free(h, cp); cmd_free(h, cp);
cmd->scsi_done(cmd);
} }
static void hpsa_pci_unmap(struct pci_dev *pdev, static void hpsa_pci_unmap(struct pci_dev *pdev,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment