From 715848ca6fffeb6362a50887d9c26245bd5dfba9 Mon Sep 17 00:00:00 2001 From: Andrew Vasquez Date: Thu, 18 Feb 2010 10:07:26 -0800 Subject: [SCSI] qla2xxx: Correct use-after-free issue in terminate_rport_io callback. The explicit logout (LOGO) issued at the end of the callback will flush (via normal scsi_cmnd->done()) any outstanding commands (FCP2) the firmware is holding. While iterating through the outstanding_cmnd array in qla2x00_abort_fcport_cmds(), locking and unlocking of the hardware spinlock, opens-up the driver to cases where the processed SRB (sp) could be used after the command completed from interrupt context. Cc: stable@kernel.org Signed-off-by: Andrew Vasquez Signed-off-by: Giridhar Malavali Signed-off-by: James Bottomley --- drivers/scsi/qla2xxx/qla_attr.c | 2 -- 1 file changed, 2 deletions(-) (limited to 'drivers/scsi/qla2xxx/qla_attr.c') diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c index 25596feea162..90d1e062ec4f 100644 --- a/drivers/scsi/qla2xxx/qla_attr.c +++ b/drivers/scsi/qla2xxx/qla_attr.c @@ -1531,8 +1531,6 @@ qla2x00_terminate_rport_io(struct fc_rport *rport) fcport->vha->hw->isp_ops->fabric_logout(fcport->vha, fcport->loop_id, fcport->d_id.b.domain, fcport->d_id.b.area, fcport->d_id.b.al_pa); - - qla2x00_abort_fcport_cmds(fcport); } static int -- cgit v1.2.3