summaryrefslogtreecommitdiffstats
path: root/drivers/scsi
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2008-06-17 23:53:22 -0700
committerJames Bottomley <James.Bottomley@HansenPartnership.com>2008-06-24 15:48:56 -0500
commiteadc49b1a8d09480f14caea292142f103a89c77a (patch)
treeed78a3cfdd22e9754eaadcd1c73c5edd2d03cf5b /drivers/scsi
parentc95e62ce8905aab62fed224eaaa9b8558a0ef652 (diff)
[SCSI] esp: Fix OOPS in esp_reset_cleanup().
OOPS reported by Friedrich Oslage <bluebird@porno-bullen.de> The problem here is that tp->starget is set every time a lun is allocated for a particular target so we can catch the sdev_target parent value. The reset handler uses the NULL'ness of this value to determine which targets are active. But esp_slave_destroy() does not NULL out this value when appropriate. So for every target that doesn't respond, the SCSI bus scan causes a stale pointer to be left here, with ensuing crashes like you're seeing. Signed-off-by: David S. Miller <davem@davemloft.net> Cc: Stable Tree <stable@kernel.org> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Diffstat (limited to 'drivers/scsi')
-rw-r--r--drivers/scsi/esp_scsi.c8
-rw-r--r--drivers/scsi/esp_scsi.h1
2 files changed, 9 insertions, 0 deletions
diff --git a/drivers/scsi/esp_scsi.c b/drivers/scsi/esp_scsi.c
index a0b6d414953..305eddef5ca 100644
--- a/drivers/scsi/esp_scsi.c
+++ b/drivers/scsi/esp_scsi.c
@@ -2371,6 +2371,7 @@ static int esp_slave_alloc(struct scsi_device *dev)
dev->hostdata = lp;
tp->starget = dev->sdev_target;
+ tp->starget_ref++;
spi_min_period(tp->starget) = esp->min_period;
spi_max_offset(tp->starget) = 15;
@@ -2425,10 +2426,17 @@ static int esp_slave_configure(struct scsi_device *dev)
static void esp_slave_destroy(struct scsi_device *dev)
{
+ struct esp *esp = shost_priv(dev->host);
+ struct esp_target_data *tp = &esp->target[dev->id];
struct esp_lun_data *lp = dev->hostdata;
kfree(lp);
dev->hostdata = NULL;
+
+ BUG_ON(tp->starget_ref <= 0);
+
+ if (!--tp->starget_ref)
+ tp->starget = NULL;
}
static int esp_eh_abort_handler(struct scsi_cmnd *cmd)
diff --git a/drivers/scsi/esp_scsi.h b/drivers/scsi/esp_scsi.h
index bb43a138818..655e0b2240b 100644
--- a/drivers/scsi/esp_scsi.h
+++ b/drivers/scsi/esp_scsi.h
@@ -322,6 +322,7 @@ struct esp_target_data {
u8 nego_goal_tags;
struct scsi_target *starget;
+ int starget_ref;
};
struct esp_event_ent {