Re: possible use-after-free in 2.5.44 scsi changes

[James Bottomley <James.Bottomley@steeleye.com>]

[-- Attachment #1: Type: text/plain, Size: 597 bytes --]


James.Bottomley@steeleye.com said:
> This has all the hallmarks of the Qlogic double done bug:  Under
> certain high  stress/bad bus situations, the Qla driver will call done
> twice on a SCSI  command structure.  I take it this is the 6.1.0 qla
> driver, which qlogic has  assured me "really really" has this bug
> fixed?

> Is there any way to switch adapters to see if we can confirm this
> hypothesis? 

Actually, rather than switching adapters, could you try the attached patch.  
As long as the command isn't reused too fast after the scsi_done, it should 
pick up this problem.

James





[-- Attachment #2: tmp.diff --]
[-- Type: text/plain , Size: 818 bytes --]

===== drivers/scsi/scsi.c 1.50 vs edited =====
--- 1.50/drivers/scsi/scsi.c	Tue Oct 22 12:43:29 2002
+++ edited/drivers/scsi/scsi.c	Fri Oct 25 13:23:32 2002
@@ -1224,6 +1224,12 @@
 	SCSI_LOG_MLQUEUE(3, printk("Leaving scsi_do_cmd()\n"));
 }
 
+static void scsi_null_done_method(Scsi_Cmnd *SCp)
+{
+	printk(KERN_EMERG "Done called on already done command\n");
+        dump_stack();
+}
+
 /**
  * scsi_done - Mark this command as done
  * @SCpnt: The SCSI Command which we think we've completed.
@@ -1247,6 +1253,10 @@
 	unsigned long flags;
 	int cpu, tstatus;
 	struct softscsi_data *queue;
+
+        /* clear out the done method to produce an error for done on the
+         * same command */
+        SCpnt->scsi_done = scsi_null_done_method;
 
 	/*
 	 * We don't have to worry about this one timing out any more.