tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
"This is three essential bug fixes for various SCSI parts.

The only affected users are SCSI multi-path via device handler
(basically all the enterprise) and mvsas users. The dh bugs are an
async entanglement in boot resulting in a serious WARN_ON trip and a
use after free on remove leading to a crash with strict memory
accounting. The mvsas bug manifests as a null deref oops but only on
abort sequences; however, these can commonly occur with SATA attached
devices, hence the fix"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi_dh: don't try to load a device handler during async probing
scsi_dh: fix use-after-free when removing scsi device
mvsas: Fix NULL pointer dereference in mvs_slot_task_free

Linus Torvalds 060b85b0 af7eba01

+12 -2
+2
drivers/scsi/mvsas/mv_sas.c
··· 887 887 static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task, 888 888 struct mvs_slot_info *slot, u32 slot_idx) 889 889 { 890 + if (!slot) 891 + return; 890 892 if (!slot->task) 891 893 return; 892 894 if (!sas_protocol_ata(task->task_proto))
+6 -2
drivers/scsi/scsi_dh.c
··· 226 226 227 227 drv = scsi_dh_find_driver(sdev); 228 228 if (drv) 229 - devinfo = scsi_dh_lookup(drv); 229 + devinfo = __scsi_dh_lookup(drv); 230 230 if (devinfo) 231 231 err = scsi_dh_handler_attach(sdev, devinfo); 232 232 return err; 233 233 } 234 234 235 - void scsi_dh_remove_device(struct scsi_device *sdev) 235 + void scsi_dh_release_device(struct scsi_device *sdev) 236 236 { 237 237 if (sdev->handler) 238 238 scsi_dh_handler_detach(sdev); 239 + } 240 + 241 + void scsi_dh_remove_device(struct scsi_device *sdev) 242 + { 239 243 device_remove_file(&sdev->sdev_gendev, &scsi_dh_state_attr); 240 244 } 241 245
+2
drivers/scsi/scsi_priv.h
··· 173 173 /* scsi_dh.c */ 174 174 #ifdef CONFIG_SCSI_DH 175 175 int scsi_dh_add_device(struct scsi_device *sdev); 176 + void scsi_dh_release_device(struct scsi_device *sdev); 176 177 void scsi_dh_remove_device(struct scsi_device *sdev); 177 178 #else 178 179 static inline int scsi_dh_add_device(struct scsi_device *sdev) { return 0; } 180 + static inline void scsi_dh_release_device(struct scsi_device *sdev) { } 179 181 static inline void scsi_dh_remove_device(struct scsi_device *sdev) { } 180 182 #endif 181 183
+2
drivers/scsi/scsi_sysfs.c
··· 399 399 400 400 sdev = container_of(work, struct scsi_device, ew.work); 401 401 402 + scsi_dh_release_device(sdev); 403 + 402 404 parent = sdev->sdev_gendev.parent; 403 405 404 406 spin_lock_irqsave(sdev->host->host_lock, flags);