Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a67417ab authored by Swen Schillig's avatar Swen Schillig Committed by James Bottomley
Browse files

[SCSI] zfcp: invalid usage after free of port resources 



In certain error scenarios ports, rports are getting attached,
validated and removed from the systems environment. Depending on the
layer this occurs asynchronously. This patch fixes the few races
which existed and ensures all references and cross references are
cleared at the time they're invalid. In addition fc transports
actions are only scheduled when required.

Signed-off-by: default avatarSwen Schillig <swen@vnet.ibm.com>
Signed-off-by: default avatarChristof Schmitt <christof.schmitt@de.ibm.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@suse.de>
parent cdf69bb9

drivers/s390/scsi/zfcp_aux.c

+5 −2
Original line number Diff line number Diff line
@@ -672,12 +672,15 @@ err_out: 
 */

void zfcp_port_dequeue(struct zfcp_port *port)

{

	wait_event(port->remove_wq, atomic_read(&port->refcount) == 0);

	write_lock_irq(&zfcp_data.config_lock);

	list_del(&port->list);

	write_unlock_irq(&zfcp_data.config_lock);

	if (port->rport)

	if (port->rport) {

		port->rport->dd_data = NULL;

		port->rport = NULL;

	}

	wait_event(port->remove_wq, atomic_read(&port->refcount) == 0);

	cancel_work_sync(&port->rport_work); /* usually not necessary */

	zfcp_adapter_put(port->adapter);

	sysfs_remove_group(&port->sysfs_device.kobj, &zfcp_sysfs_port_attrs);

	device_unregister(&port->sysfs_device);

drivers/s390/scsi/zfcp_scsi.c

+4 −2
Original line number Diff line number Diff line
@@ -582,7 +582,9 @@ void zfcp_scsi_schedule_rport_block(struct zfcp_port *port) 
	zfcp_port_get(port);

	port->rport_task = RPORT_DEL;



	if (!queue_work(zfcp_data.work_queue, &port->rport_work))

	if (port->rport && queue_work(zfcp_data.work_queue, &port->rport_work))

		return;



	zfcp_port_put(port);

}