luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[SCSI] libfc: fix race in SRR response

Browse Source 
In this case fsp was freed before error handler was invoked,
this is fixed by having SRR fsp reference freed by exch
destructor so that fsp will be always held until it exch
is freed.

Also don't reset fsp->recov_seq since this is needed by
SRR error handler to do exch done.

Signed-off-by: Vasu Dev <vasu.dev@intel.com>
Tested-by: Ross Brattain <ross.b.brattain@intel.com>
Signed-off-by: Robert Love <robert.w.love@intel.com>
Signed-off-by: James Bottomley <jbottomley@parallels.com>
This commit is contained in:
Vasu Dev 2011-05-16 16:45:51 -07:00 committed by James Bottomley
parent 8d23f4ba38
commit 0a219edb26
1 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/scsi/libfc/fc_fcp.c
View File

@ -1673,7 +1673,8 @@ static void fc_fcp_srr(struct fc_fcp_pkt *fsp, enum fc_rctl r_ctl, u32 offset)
FC_FCTL_REQ, 0); FC_FCTL_REQ, 0);
rec_tov = get_fsp_rec_tov(fsp); rec_tov = get_fsp_rec_tov(fsp);
seq = lport->tt.exch_seq_send(lport, fp, fc_fcp_srr_resp, NULL, seq = lport->tt.exch_seq_send(lport, fp, fc_fcp_srr_resp,
fc_fcp_pkt_destroy,
fsp, jiffies_to_msecs(rec_tov)); fsp, jiffies_to_msecs(rec_tov));
if (!seq) if (!seq)
goto retry; goto retry;
@ -1720,7 +1721,6 @@ static void fc_fcp_srr_resp(struct fc_seq *seq, struct fc_frame *fp, void *arg)
return; return;
} }
fsp->recov_seq = NULL;
switch (fc_frame_payload_op(fp)) { switch (fc_frame_payload_op(fp)) {
case ELS_LS_ACC: case ELS_LS_ACC:
fsp->recov_retry = 0; fsp->recov_retry = 0;
@ -1732,10 +1732,9 @@ static void fc_fcp_srr_resp(struct fc_seq *seq, struct fc_frame *fp, void *arg)
break; break;
} }
fc_fcp_unlock_pkt(fsp); fc_fcp_unlock_pkt(fsp);
fsp->lp->tt.exch_done(seq);
out: out:
fsp->lp->tt.exch_done(seq);
fc_frame_free(fp); fc_frame_free(fp);
fc_fcp_pkt_release(fsp); /* drop hold for outstanding SRR */
} }
/** /**
@ -1747,8 +1746,6 @@ static void fc_fcp_srr_error(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
{ {
if (fc_fcp_lock_pkt(fsp)) if (fc_fcp_lock_pkt(fsp))
goto out; goto out;
fsp->lp->tt.exch_done(fsp->recov_seq);
fsp->recov_seq = NULL;
switch (PTR_ERR(fp)) { switch (PTR_ERR(fp)) {
case -FC_EX_TIMEOUT: case -FC_EX_TIMEOUT:
if (fsp->recov_retry++ < FC_MAX_RECOV_RETRY) if (fsp->recov_retry++ < FC_MAX_RECOV_RETRY)
@ -1764,7 +1761,7 @@ static void fc_fcp_srr_error(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
} }
fc_fcp_unlock_pkt(fsp); fc_fcp_unlock_pkt(fsp);
out: out:
fc_fcp_pkt_release(fsp); /* drop hold for outstanding SRR */ fsp->lp->tt.exch_done(fsp->recov_seq);
} }
/** /**