diff options
| author | Bhanu Prakash Gollapudi <bprakash@broadcom.com> | 2012-02-11 02:18:51 +0100 |
|---|---|---|
| committer | James Bottomley <JBottomley@Parallels.com> | 2012-02-19 16:26:07 +0100 |
| commit | d4042e9c84864a5666dc8ec14b3c1a5597b6a73f (patch) | |
| tree | b13dd159f049a54208d7e6a17735f4e859fa6952 | |
| parent | [SCSI] fcoe: Remove reference counting on 'stuct fcoe_interface' (diff) | |
| download | linux-d4042e9c84864a5666dc8ec14b3c1a5597b6a73f.tar.xz linux-d4042e9c84864a5666dc8ec14b3c1a5597b6a73f.zip | |
[SCSI] libfc: Fix panic in fc_exch_recv
Adding and removing the host into the zone causes this panic.
BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0
IP: [<ffffffffa0491707>] fc_exch_recv+0xc57/0xe70 [libfc]
Call Trace:
[<ffffffffa050e04b>] bnx2fc_l2_rcv_thread+0x37b/0x430 [bnx2fc]
[<ffffffffa050dcd0>] ? bnx2fc_l2_rcv_thread+0x0/0x430 [bnx2fc]
[<ffffffff81090886>] kthread+0x96/0xa0
[<ffffffff8100c14a>] child_rip+0xa/0x20
[<ffffffff810907f0>] ? kthread+0x0/0xa0
[<ffffffff8100c140>] ? child_rip+0x0/0x20
During fc_exch_reset, the active exchanges are aborted and the exch is deleted.
As part of processing ABTS response, due to 'ep' being NULL, any access to ep in
fc_exch_recv_bls() causes this panic. Fixed to access 'ep' only if non-NULL.
Reviewed-by: Neerav Parikh <neerav.parikh@intel.com>
Signed-off-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com>
Signed-off-by: Robert Love <robert.w.love@intel.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
| -rw-r--r-- | drivers/scsi/libfc/fc_exch.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c index 4d70d96fa5dc..630291f01826 100644 --- a/drivers/scsi/libfc/fc_exch.c +++ b/drivers/scsi/libfc/fc_exch.c @@ -1642,9 +1642,10 @@ static void fc_exch_recv_bls(struct fc_exch_mgr *mp, struct fc_frame *fp) case FC_RCTL_ACK_0: break; default: - FC_EXCH_DBG(ep, "BLS rctl %x - %s received", - fh->fh_r_ctl, - fc_exch_rctl_name(fh->fh_r_ctl)); + if (ep) + FC_EXCH_DBG(ep, "BLS rctl %x - %s received", + fh->fh_r_ctl, + fc_exch_rctl_name(fh->fh_r_ctl)); break; } fc_frame_free(fp); |