[patch 17/47] SCSI: esp: Fix OOPS in esp_reset_cleanup().

Greg KH
2008-07-22T23:23:53Z

[-- Attachment #1: scsi-esp-fix-oops-in-esp_reset_cleanup.patch --]
[-- Type: text/plain, Size: 1961 bytes --]

2.6.25-stable review patch. If anyone has any objections, please let us
know.

------------------
From: David S. Miller <davem@davemloft.net>

commit eadc49b1a8d09480f14caea292142f103a89c77a upstream

OOPS reported by Friedrich Oslage <bluebird@porno-bullen.de>

The problem here is that tp->starget is set every time a lun
is allocated for a particular target so we can catch the
sdev_target parent value.

The reset handler uses the NULL'ness of this value to determine
which targets are active.

But esp_slave_destroy() does not NULL out this value when appropriate.

So for every target that doesn't respond, the SCSI bus scan causes
a stale pointer to be left here, with ensuing crashes like you're
seeing.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
drivers/scsi/esp_scsi.c | 8 ++++++++
drivers/scsi/esp_scsi.h | 1 +
2 files changed, 9 insertions(+)

--- a/drivers/scsi/esp_scsi.c
+++ b/drivers/scsi/esp_scsi.c
@@ -2364,6 +2364,7 @@ static int esp_slave_alloc(struct scsi_d
dev->hostdata = lp;

tp->starget = dev->sdev_target;
+ tp->starget_ref++;

spi_min_period(tp->starget) = esp->min_period;
spi_max_offset(tp->starget) = 15;
@@ -2412,10 +2413,17 @@ static int esp_slave_configure(struct sc

static void esp_slave_destroy(struct scsi_device *dev)
{
+ struct esp *esp = shost_priv(dev->host);
+ struct esp_target_data *tp = &esp->target[dev->id];
struct esp_lun_data *lp = dev->hostdata;

kfree(lp);
dev->hostdata = NULL;
+
+ BUG_ON(tp->starget_ref <= 0);
+
+ if (!--tp->starget_ref)
+ tp->starget = NULL;
}

static int esp_eh_abort_handler(struct scsi_cmnd *cmd)
--- a/drivers/scsi/esp_scsi.h
+++ b/drivers/scsi/esp_scsi.h
@@ -322,6 +322,7 @@ struct esp_target_data {
u8 nego_goal_tags;

struct scsi_target *starget;
+ int starget_ref;
};

struct esp_event_ent {

--