Re: [PATCH 06/12] qla4xxx: fixed NULL pointer dereference in eh_device_reset

Mike Christie
2010-04-07T03:50:19Z

On 04/06/2010 05:14 AM, Ravi Anand wrote:
> From: Vikas Chaudhary<vikas.chaudhary@qlogic.com>
>
> Created variables to reference h, b, t, l, because if
> scsi passthru command completes within eh_device_reset,
> the cmd structure may no longer be valid.

> @@ -1587,16 +1587,34 @@ static int qla4xxx_eh_wait_for_commands(struct scsi_qla_host *ha,
> **/
> static int qla4xxx_eh_device_reset(struct scsi_cmnd *cmd)
> {
> - struct scsi_qla_host *ha = to_qla_host(cmd->device->host);
> - struct ddb_entry *ddb_entry = cmd->device->hostdata;
> + struct scsi_qla_host *ha;
> + struct ddb_entry *ddb_entry;
> int ret = FAILED, stat;
> + struct Scsi_Host *h;
> + unsigned int b, t, l;
> +
> + if (cmd == NULL) {
> + DEBUG2(printk(KERN_INFO "%s: **** SCSI mid-layer passing in"
> + " NULL cmd DEVICE RESET - cmd already"
> + " completed.\n", __func__));
> + return SUCCESS;
> + }
>
> - if (!ddb_entry)
> - return ret;
> + h = cmd->device->host;
> + b = cmd->device->channel;
> + t = cmd->device->id;
> + l = cmd->device->lun;
> + ha = to_qla_host(h);
> + ddb_entry = cmd->device->hostdata;

Could it complete normally while you are accessing the cmd above still?