From: Steffen Maier Date: Fri, 18 Nov 2011 19:00:40 +0000 (+0100) Subject: [SCSI] zfcp: return early from slave_destroy if slave_alloc returned early X-Git-Tag: upstream/snapshot3+hdmi~8392^2~71 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=44f747fff6e9f027a4866c1a6864e26ae7c510c8;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git [SCSI] zfcp: return early from slave_destroy if slave_alloc returned early zfcp_scsi_slave_destroy erroneously always tried to finish its task even if the corresponding previous zfcp_scsi_slave_alloc returned early. This can lead to kernel page faults on accessing uninitialized fields of struct zfcp_scsi_dev in zfcp_erp_lun_shutdown_wait. Take the port field of the struct to determine if slave_alloc returned early. This zfcp bug is exposed by 4e6c82b (in turn fixing f7c9c6b to be compatible with 21208ae) which can call slave_destroy for a corresponding previous slave_alloc that did not finish. This patch is based on James Bottomley's fix suggestion in http://www.spinics.net/lists/linux-scsi/msg55449.html. Signed-off-by: Steffen Maier Cc: #2.6.38+ Signed-off-by: James Bottomley --- diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c index 11f07f8..b79576b 100644 --- a/drivers/s390/scsi/zfcp_scsi.c +++ b/drivers/s390/scsi/zfcp_scsi.c @@ -55,6 +55,10 @@ static void zfcp_scsi_slave_destroy(struct scsi_device *sdev) { struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(sdev); + /* if previous slave_alloc returned early, there is nothing to do */ + if (!zfcp_sdev->port) + return; + zfcp_erp_lun_shutdown_wait(sdev, "scssd_1"); put_device(&zfcp_sdev->port->dev); }