[SCSI] qla2xxx: Correct use-after-free issue in terminate_rport_io callback.

Browse source

The explicit logout (LOGO) issued at the end of the callback will
flush (via normal scsi_cmnd->done()) any outstanding commands
(FCP2) the firmware is holding.  While iterating through the
outstanding_cmnd array in qla2x00_abort_fcport_cmds(), locking
and unlocking of the hardware spinlock, opens-up the driver to
cases where the processed SRB (sp) could be used after the
command completed from interrupt context.

Cc: stable@kernel.org
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>

...

This commit is contained in:

Andrew Vasquez 2010-02-18 10:07:26 -08:00 • committed by James Bottomley

parent 55e5ed273d

commit 715848ca6f

3 changed files with 0 additions and 41 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

drivers/scsi/qla2xxx/qla_attr.c

View file

1

drivers/scsi/qla2xxx/qla_gbl.h

View file

38

drivers/scsi/qla2xxx/qla_os.c

View file