diff options
| author | James Smart <jsmart2021@gmail.com> | 2019-05-22 02:49:00 +0200 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2019-06-19 01:46:21 +0200 |
| commit | 6594d31bab02e4a1d02355ff2f16a87dfc11b34f (patch) | |
| tree | 16adc2ca6e3d669e718658b91858f40e6d237067 /drivers/scsi/lpfc | |
| parent | scsi: lpfc: Prevent 'use after free' memory overwrite in nvmet LS handling (diff) | |
| download | linux-6594d31bab02e4a1d02355ff2f16a87dfc11b34f.tar.xz linux-6594d31bab02e4a1d02355ff2f16a87dfc11b34f.zip | |
scsi: lpfc: Cancel queued work for an IO when processing a received ABTS
When queued work is executed posting a new command to the transport
the driver is reporting a null buffer.
The driver had received an ABTS which matched a command that had
been scheduled for delivery to the transport. The driver proceeded
to cancel the command, but the work item was never cancelled.
Fix by cancelling the queued work item. Also turns out the ABTS
response was not properly sending a BA_ACC, so set the flag to
send the ACC.
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/lpfc')
| -rw-r--r-- | drivers/scsi/lpfc/lpfc_nvmet.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c index 08c2c4e3515b..36e8d842d973 100644 --- a/drivers/scsi/lpfc/lpfc_nvmet.c +++ b/drivers/scsi/lpfc/lpfc_nvmet.c @@ -1766,6 +1766,7 @@ lpfc_nvmet_rcv_unsol_abort(struct lpfc_vport *vport, nvmet_fc_rcv_fcp_abort(phba->targetport, &ctxp->ctx.fcp_req); } else { + cancel_work_sync(&ctxp->ctxbuf->defer_work); spin_lock_irqsave(&ctxp->ctxlock, iflag); lpfc_nvmet_defer_release(phba, ctxp); spin_unlock_irqrestore(&ctxp->ctxlock, iflag); @@ -1777,7 +1778,7 @@ lpfc_nvmet_rcv_unsol_abort(struct lpfc_vport *vport, lpfc_nvmet_sol_fcp_issue_abort(phba, ctxp, ctxp->sid, ctxp->oxid); - lpfc_sli4_seq_abort_rsp(vport, fc_hdr, 0); + lpfc_sli4_seq_abort_rsp(vport, fc_hdr, 1); return 0; } |