diff options
| author | Ewan D. Milne <emilne@redhat.com> | 2012-11-02 09:38:34 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-08-04 16:25:43 +0800 |
| commit | 970f226f08005c3a9b631a6b0dc5d40afd6c27a7 (patch) | |
| tree | 713df4abdc5e35dc3f9b451a24d3d02d843dc80f | |
| parent | a38de994b080d7f30faf349cdc5c88cf4ed1aa6e (diff) | |
| download | linux-3.10-970f226f08005c3a9b631a6b0dc5d40afd6c27a7.tar.gz linux-3.10-970f226f08005c3a9b631a6b0dc5d40afd6c27a7.tar.bz2 linux-3.10-970f226f08005c3a9b631a6b0dc5d40afd6c27a7.zip | |
SCSI: sd: fix crash when UA received on DIF enabled device
commit 085b513f97d8d799d28491239be4b451bcd8c2c5 upstream.
sd_prep_fn will allocate a larger CDB for the command via mempool_alloc
for devices using DIF type 2 protection. This CDB was being freed
in sd_done, which results in a kernel crash if the command is retried
due to a UNIT ATTENTION. This change moves the code to free the larger
CDB into sd_unprep_fn instead, which is invoked after the request is
complete.
It is no longer necessary to call scsi_print_command separately for
this case as the ->cmnd will no longer be NULL in the normal code path.
Also removed conditional test for DIF type 2 when freeing the larger
CDB because the protection_type could have been changed via sysfs while
the command was executing.
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/scsi/sd.c | 22 |
1 files changed, 7 insertions, 15 deletions
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 3141c1a7267..105fff2ecd5 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -672,10 +672,17 @@ static int scsi_setup_flush_cmnd(struct scsi_device *sdp, struct request *rq) static void sd_unprep_fn(struct request_queue *q, struct request *rq) { + struct scsi_cmnd *SCpnt = rq->special; + if (rq->cmd_flags & REQ_DISCARD) { free_page((unsigned long)rq->buffer); rq->buffer = NULL; } + if (SCpnt->cmnd != rq->cmd) { + mempool_free(SCpnt->cmnd, sd_cdb_pool); + SCpnt->cmnd = NULL; + SCpnt->cmd_len = 0; + } } /** @@ -1539,21 +1546,6 @@ static int sd_done(struct scsi_cmnd *SCpnt) if (rq_data_dir(SCpnt->request) == READ && scsi_prot_sg_count(SCpnt)) sd_dif_complete(SCpnt, good_bytes); - if (scsi_host_dif_capable(sdkp->device->host, sdkp->protection_type) - == SD_DIF_TYPE2_PROTECTION && SCpnt->cmnd != SCpnt->request->cmd) { - - /* We have to print a failed command here as the - * extended CDB gets freed before scsi_io_completion() - * is called. - */ - if (result) - scsi_print_command(SCpnt); - - mempool_free(SCpnt->cmnd, sd_cdb_pool); - SCpnt->cmnd = NULL; - SCpnt->cmd_len = 0; - } - return good_bytes; } |