Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c7a841f3 authored by James Smart's avatar James Smart Committed by James Bottomley
Browse files

[SCSI] bsg: correct fault if queue object removed while dev_t open 



This patch corrects an issue in bsg that results in a general protection
fault if an LLD is removed while an application is using an open file
handle to a bsg device, and the application issues an ioctl. The fault
occurs because the class_dev is NULL, having been cleared in
bsg_unregister_queue() when the driver was removed.  With this
patch, a check is made for the class_dev, and the application
will receive ENXIO if the related object is gone.

Signed-off-by: default avatarCarl Lajeunesse <carl.lajeunesse@emulex.com>
Signed-off-by: default avatarJames Smart <james.smart@emulex.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@suse.de>
parent 057f02a3

block/bsg.c

+8 −0
Original line number Diff line number Diff line
@@ -250,6 +250,14 @@ bsg_map_hdr(struct bsg_device *bd, struct sg_io_v4 *hdr, fmode_t has_write_perm, 
	int ret, rw;

	unsigned int dxfer_len;

	void *dxferp = NULL;

	struct bsg_class_device *bcd = &q->bsg_dev;



	/* if the LLD has been removed then the bsg_unregister_queue will

	 * eventually be called and the class_dev was freed, so we can no

	 * longer use this request_queue. Return no such address.

	 */

	if (!bcd->class_dev)

		return ERR_PTR(-ENXIO);



	dprintk("map hdr %llx/%u %llx/%u\n", (unsigned long long) hdr->dout_xferp,

		hdr->dout_xfer_len, (unsigned long long) hdr->din_xferp,