Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 085b513f authored by Ewan D. Milne's avatar Ewan D. Milne Committed by James Bottomley
Browse files

[SCSI] sd: fix crash when UA received on DIF enabled device 



sd_prep_fn will allocate a larger CDB for the command via mempool_alloc
for devices using DIF type 2 protection.  This CDB was being freed
in sd_done, which results in a kernel crash if the command is retried
due to a UNIT ATTENTION.  This change moves the code to free the larger
CDB into sd_unprep_fn instead, which is invoked after the request is
complete.

It is no longer necessary to call scsi_print_command separately for
this case as the ->cmnd will no longer be NULL in the normal code path.

Also removed conditional test for DIF type 2 when freeing the larger
CDB because the protection_type could have been changed via sysfs while
the command was executing.

Signed-off-by: default avatarEwan D. Milne <emilne@redhat.com>
Acked-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
parent c3ccb1d7

drivers/scsi/sd.c

+7 −15
Original line number Diff line number Diff line
@@ -838,10 +838,17 @@ static int scsi_setup_flush_cmnd(struct scsi_device *sdp, struct request *rq) 


static void sd_unprep_fn(struct request_queue *q, struct request *rq)

{

	struct scsi_cmnd *SCpnt = rq->special;



	if (rq->cmd_flags & REQ_DISCARD) {

		free_page((unsigned long)rq->buffer);

		rq->buffer = NULL;

	}

	if (SCpnt->cmnd != rq->cmd) {

		mempool_free(SCpnt->cmnd, sd_cdb_pool);

		SCpnt->cmnd = NULL;

		SCpnt->cmd_len = 0;

	}

}



/**
@@ -1720,21 +1727,6 @@ static int sd_done(struct scsi_cmnd *SCpnt) 
	if (rq_data_dir(SCpnt->request) == READ && scsi_prot_sg_count(SCpnt))

		sd_dif_complete(SCpnt, good_bytes);



	if (scsi_host_dif_capable(sdkp->device->host, sdkp->protection_type)

	    == SD_DIF_TYPE2_PROTECTION && SCpnt->cmnd != SCpnt->request->cmd) {



		/* We have to print a failed command here as the

		 * extended CDB gets freed before scsi_io_completion()

		 * is called.

		 */

		if (result)

			scsi_print_command(SCpnt);



		mempool_free(SCpnt->cmnd, sd_cdb_pool);

		SCpnt->cmnd = NULL;

		SCpnt->cmd_len = 0;

	}



	return good_bytes;

}