forked from luck/tmp_suning_uos_patched
8e6882545d
Dereferencing shost from scsi_exit_rq() is not safe because the SCSI
host may already have been freed when scsi_exit_rq() is called.
Increasing the shost reference count in scsi_init_rq() and dropping that
reference in scsi_exit_rq() is nontrivial since scsi_host_dev_release()
may sleep and since scsi_exit_rq() may be called from interrupt
context. Since scsi_exit_rq() only needs a single bit from shost, copy
that bit into struct scsi_cmnd.
Reported-by: Scott Bauer <scott.bauer@intel.com>
Fixes:
|
||
|---|---|---|
| .. | ||
| fc | ||
| fc_encode.h | ||
| fc_frame.h | ||
| fcoe_sysfs.h | ||
| iscsi_if.h | ||
| iscsi_proto.h | ||
| iser.h | ||
| libfc.h | ||
| libfcoe.h | ||
| libiscsi_tcp.h | ||
| libiscsi.h | ||
| libsas.h | ||
| osd_attributes.h | ||
| osd_initiator.h | ||
| osd_ore.h | ||
| osd_protocol.h | ||
| osd_sec.h | ||
| osd_sense.h | ||
| osd_types.h | ||
| sas_ata.h | ||
| sas.h | ||
| scsi_bsg_iscsi.h | ||
| scsi_cmnd.h | ||
| scsi_common.h | ||
| scsi_dbg.h | ||
| scsi_device.h | ||
| scsi_devinfo.h | ||
| scsi_dh.h | ||
| scsi_driver.h | ||
| scsi_eh.h | ||
| scsi_host.h | ||
| scsi_ioctl.h | ||
| scsi_proto.h | ||
| scsi_request.h | ||
| scsi_tcq.h | ||
| scsi_transport_fc.h | ||
| scsi_transport_iscsi.h | ||
| scsi_transport_sas.h | ||
| scsi_transport_spi.h | ||
| scsi_transport_srp.h | ||
| scsi_transport.h | ||
| scsi.h | ||
| scsicam.h | ||
| sg.h | ||
| srp.h | ||
| viosrp.h | ||