scsi: qla2xxx: Do not corrupt vha->plogi_ack_list

Delete the PLOGIN ACK data structure from the vha->plogi_ack_list before
freeing that data structure to avoid that that list gets corrupted.

Cc: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Tested-by: Himanshu Madhani <hmadhani@marvell.com>
Reviewed-by: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index a5acd5e..37e2498 100644 (file)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -5083,8 +5083,10 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
                                   "%s %8phC mem alloc fail.\n",
                                   __func__, e->u.new_sess.port_name);
 
-                       if (pla)
+                       if (pla) {
+                               list_del(&pla->list);
                                kmem_cache_free(qla_tgt_plogi_cachep, pla);
+                       }
                        return;
                }
 
@@ -5195,8 +5197,10 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
 
        if (free_fcport) {
                qla2x00_free_fcport(fcport);
-               if (pla)
+               if (pla) {
+                       list_del(&pla->list);
                        kmem_cache_free(qla_tgt_plogi_cachep, pla);
+               }
        }
 }
 

diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index ea22e62..9cd5e2f 100644 (file)
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -4796,8 +4796,10 @@ static int qlt_handle_login(struct scsi_qla_host *vha,
                            __func__, sess->port_name, sec);
                }
 
-               if (!conflict_sess)
+               if (!conflict_sess) {
+                       list_del(&pla->list);
                        kmem_cache_free(qla_tgt_plogi_cachep, pla);
+               }
 
                qlt_send_term_imm_notif(vha, iocb, 1);
                goto out;