mirror of
https://github.com/torvalds/linux.git
synced 2024-12-17 16:43:08 +00:00
7b898542f6
Fix double free problem within qla2xxx driver where current code prematurely free qla_tgt_cmd while firmware still has the command. When firmware release the command after abort, the code attempt a second free as part of command completion processing. When TCM start the free process, NULL pointer was hit. ------ WARNING: CPU: 8 PID: 43613 at lib/list_debug.c:62 __list_del_entry+0x82/0xd0() list_del corruption. next->prev should be ffff88082b5cfb08, but was 6b6b6b6b6b6b6b6b CPU: 8 PID: 43613 Comm: kworker/8:0 Tainted: GF W O 3.13.0-rc3-nab_t10dif+ #6 Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012 Workqueue: events cache_reap 000000000000003e ffff88081b2e3c78 ffffffff815a051f 000000000000003e ffff88081b2e3cc8 ffff88081b2e3cb8 ffffffff8104fc2c 0000000000000000 ffff88082b5cfb00 ffff88081c788d00 ffff88082b5d7200 ffff88082b5d3080 Call Trace: [<ffffffff815a051f>] dump_stack+0x49/0x62 [<ffffffff8104fc2c>] warn_slowpath_common+0x8c/0xc0 [<ffffffff8104fd16>] warn_slowpath_fmt+0x46/0x50 [<ffffffff812b6592>] __list_del_entry+0x82/0xd0 [<ffffffff8106d48c>] process_one_work+0x12c/0x510 [<ffffffff8106d4d3>] ? process_one_work+0x173/0x510 [<ffffffff8106ebdf>] worker_thread+0x11f/0x3a0 [<ffffffff8106eac0>] ? manage_workers+0x170/0x170 [<ffffffff81074f26>] kthread+0xf6/0x120 [<ffffffff8109f103>] ? __lock_release+0x133/0x1b0 [<ffffffff81074e30>] ? __init_kthread_worker+0x70/0x70 [<ffffffff815aec2c>] ret_from_fork+0x7c/0xb0 [<ffffffff81074e30>] ? __init_kthread_worker+0x70/0x70 ---[ end trace dfc05c3f7caf8ebe ]--- BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: [<ffffffff8106d391>] process_one_work+0x31/0x510 ------- Signed-off-by: Quinn Tran <quinn.tran@qlogic.com> Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com> Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com> Signed-off-by: Christoph Hellwig <hch@lst.de> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| qla_attr.c | ||
| qla_bsg.c | ||
| qla_bsg.h | ||
| qla_dbg.c | ||
| qla_dbg.h | ||
| qla_def.h | ||
| qla_devtbl.h | ||
| qla_dfs.c | ||
| qla_fw.h | ||
| qla_gbl.h | ||
| qla_gs.c | ||
| qla_init.c | ||
| qla_inline.h | ||
| qla_iocb.c | ||
| qla_isr.c | ||
| qla_mbx.c | ||
| qla_mid.c | ||
| qla_mr.c | ||
| qla_mr.h | ||
| qla_nx2.c | ||
| qla_nx2.h | ||
| qla_nx.c | ||
| qla_nx.h | ||
| qla_os.c | ||
| qla_settings.h | ||
| qla_sup.c | ||
| qla_target.c | ||
| qla_target.h | ||
| qla_tmpl.c | ||
| qla_tmpl.h | ||
| qla_version.h | ||
| tcm_qla2xxx.c | ||
| tcm_qla2xxx.h | ||