Commit 0c23b856 authored Apr 24, 2008 by Andrew Vasquez Committed by James Bottomley Apr 27, 2008

[SCSI] qla2xxx: Correct SRB usage-after-completion/free issues.



The driver is incorrectly assuming that the 'sp' reference held
in qla2[x00|4xx]_abort_command() is valid after the mailbox
command is issued to abort the exchange.  It is *not*, as the
command may be completed during interrupt context before control
is returned to the mailbox caller.

Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

parent c1ec1f1b

drivers/scsi/qla2xxx/qla_mbx.c

+0 −2

Original line number	Diff line number	Diff line
		@@ -784,7 +784,6 @@ qla2x00_abort_command(scsi_qla_host_t ha, srb_t sp)
		DEBUG2_3_11(printk("qla2x00_abort_command(%ld): failed=%x.\n",
		ha->host_no, rval));
		} else {
		sp->flags \|= SRB_ABORT_PENDING;
		DEBUG11(printk("qla2x00_abort_command(%ld): done.\n",
		ha->host_no));
		}
		@@ -2210,7 +2209,6 @@ qla24xx_abort_command(scsi_qla_host_t ha, srb_t sp)
		rval = QLA_FUNCTION_FAILED;
		} else {
		DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no));
		sp->flags \|= SRB_ABORT_PENDING;
		}

		dma_pool_free(ha->s_dma_pool, abt, abt_dma);