Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5943d36 authored by James Bottomley's avatar James Bottomley Committed by James Bottomley
Browse files

[SCSI] scsi_transport_sas: fix panic in sas_free_rphy 



This is a hold over from the end device/expander conversion.  Apparently
the rphy list pointer is never initialised, so list_del() on the
uninitialised pointer can panic the system

Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
parent 8d7feac3

drivers/scsi/scsi_transport_sas.c

+14 −0
Original line number Diff line number Diff line
@@ -747,6 +747,18 @@ static void sas_end_device_release(struct device *dev) 
	kfree(edev);

}



/**

 * sas_rphy_initialize - common rphy intialization

 * @rphy:	rphy to initialise

 *

 * Used by both sas_end_device_alloc() and sas_expander_alloc() to

 * initialise the common rphy component of each.

 */

static void sas_rphy_initialize(struct sas_rphy *rphy)

{

	INIT_LIST_HEAD(&rphy->list);

}



/**

 * sas_end_device_alloc - allocate an rphy for an end device

 *
@@ -771,6 +783,7 @@ struct sas_rphy *sas_end_device_alloc(struct sas_phy *parent) 
	sprintf(rdev->rphy.dev.bus_id, "end_device-%d:%d-%d",

		shost->host_no, parent->port_identifier, parent->number);

	rdev->rphy.identify.device_type = SAS_END_DEVICE;

	sas_rphy_initialize(&rdev->rphy);

	transport_setup_device(&rdev->rphy.dev);



	return &rdev->rphy;
@@ -809,6 +822,7 @@ struct sas_rphy *sas_expander_alloc(struct sas_phy *parent, 
	sprintf(rdev->rphy.dev.bus_id, "expander-%d:%d",

		shost->host_no, rdev->rphy.scsi_target_id);

	rdev->rphy.identify.device_type = type;

	sas_rphy_initialize(&rdev->rphy);

	transport_setup_device(&rdev->rphy.dev);



	return &rdev->rphy;