Re: possible use-after-free in 2.5.44 scsi changes

[James Bottomley <James.Bottomley@steeleye.com>]

[-- Attachment #1: Type: text/plain, Size: 645 bytes --]

pbadari@us.ibm.com said:
> I Just tried the patch. No Luck. I get same panic as before... I am
> using qla2x00src-v6.03.00b6 driver on qla2200 fc controllers. 

Well, yours may be a qla bug.

However, I've tracked down my hang problem:  If a command is pushed back into 
the block queue as a REQ_SPECIAL using the blk_insert_request() API, it never 
has REQ_CMD cleared.  Eventually it comes back into scsi_request_fn() with 
both REQ_CMD and REQ_SPECIAL set.  This causes the I/O to be initialised again.

The fix is to clear REQ_CMD in blk_insert_request().

This may also be the cause of Patrick's Incorrect number of segments error.

James


[-- Attachment #2: tmp.diff --]
[-- Type: text/plain , Size: 374 bytes --]

===== drivers/block/ll_rw_blk.c 1.123 vs edited =====
--- 1.123/drivers/block/ll_rw_blk.c	Fri Oct 18 12:41:37 2002
+++ edited/drivers/block/ll_rw_blk.c	Fri Oct 25 18:48:12 2002
@@ -1374,6 +1374,7 @@
 	 * must not attempt merges on this) and that it acts as a soft
 	 * barrier
 	 */
+	rq->flags &= ~REQ_CMD;
 	rq->flags |= REQ_SPECIAL | REQ_BARRIER;
 
 	rq->special = data;