From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bart Van Assche Subject: [PATCH 09/11] IB/srp: Fix a NULL pointer dereference Date: Fri, 22 Apr 2016 14:15:30 -0700 Message-ID: <571A9472.5050202@sandisk.com> References: <571A936F.7040409@sandisk.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <571A936F.7040409-XdAiOPVOjttBDgjK7y7TUQ@public.gmane.org> Sender: linux-rdma-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Doug Ledford Cc: Christoph Hellwig , Sagi Grimberg , Laurence Oberman , "linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" List-Id: linux-rdma@vger.kernel.org Avoid that running xfstests on top of the SRP initiator triggers the call trace below. This patch has been tested by running the following shell command on an initiator system that has access to 3200 SRP LUNs: /etc/init.d/multipathd start while true; do /etc/init.d/srpd start sleep 400 /etc/init.d/srpd stop for p in /sys/class/srp_remote_ports/*; do echo 1 >$p/delete & done wait dmsetup remove_all done BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] srp_claim_req+0x31/0x90 [ib_srp] Call Trace: [] srp_process_rsp+0xa6/0x2a0 [ib_srp] [] srp_handle_recv+0x16c/0x340 [ib_srp] [] srp_recv_completion+0x39/0x70 [ib_srp] [] mlx4_ib_cq_comp+0x12/0x20 [mlx4_ib] [] mlx4_cq_completion+0x3d/0x80 [mlx4_core] [] mlx4_eq_int+0x53b/0xd50 [mlx4_core] [] mlx4_msi_x_interrupt+0xf/0x20 [mlx4_core] [] handle_irq_event_percpu+0x40/0x110 [] handle_irq_event+0x3f/0x70 [] handle_edge_irq+0x79/0x120 [] handle_irq+0x5d/0x130 [] do_IRQ+0x6d/0x130 [] common_interrupt+0x84/0x84 Signed-off-by: Bart Van Assche Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Laurence Oberman --- drivers/infiniband/ulp/srp/ib_srp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index caefd1a..f4003f6 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -1814,7 +1814,8 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp) scmnd = scsi_host_find_tag(target->scsi_host, rsp->tag); if (scmnd) { req = (void *)scmnd->host_scribble; - scmnd = srp_claim_req(ch, req, NULL, scmnd); + scmnd = req ? srp_claim_req(ch, req, NULL, scmnd) : + NULL; } if (!scmnd) { shost_printk(KERN_ERR, target->scsi_host, -- 2.8.1 -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html