diff options
author | David S. Miller <davem@davemloft.net> | 2013-08-01 18:08:34 -0700 |
---|---|---|
committer | Ben Hutchings <ben@decadent.org.uk> | 2013-10-26 21:06:09 +0100 |
commit | 49e3d709efa929fc179531a0bff55df92520b432 (patch) | |
tree | 2829e7aafc1a68b9e11d0c492c20c9413819acc8 /arch/sparc | |
parent | a82dc4e1e4c628f23c14fc48ce72ae0b56a68db8 (diff) |
esp_scsi: Fix tag state corruption when autosensing.
[ Upstream commit 21af8107f27878813d0364733c0b08813c2c192a ]
Meelis Roos reports a crash in esp_free_lun_tag() in the presense
of a disk which has died.
The issue is that when we issue an autosense command, we do so by
hijacking the original command that caused the check-condition.
When we do so we clear out the ent->tag[] array when we issue it via
find_and_prep_issuable_command(). This is so that the autosense
command is forced to be issued non-tagged.
That is problematic, because it is the value of ent->tag[] which
determines whether we issued the original scsi command as tagged
vs. non-tagged (see esp_alloc_lun_tag()).
And that, in turn, is what trips up the sanity checks in
esp_free_lun_tag(). That function needs the original ->tag[] values
in order to free up the tag slot properly.
Fix this by remembering the original command's tag values, and
having esp_alloc_lun_tag() and esp_free_lun_tag() use them.
Reported-by: Meelis Roos <mroos@linux.ee>
Tested-by: Meelis Roos <mroos@linux.ee>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'arch/sparc')
0 files changed, 0 insertions, 0 deletions