esp_scsi: Fix tag state corruption when autosensing.
authorDavid S. Miller <davem@davemloft.net>
Fri, 2 Aug 2013 01:08:34 +0000 (18:08 -0700)
committerDavid S. Miller <davem@davemloft.net>
Fri, 2 Aug 2013 01:08:34 +0000 (18:08 -0700)
commit21af8107f27878813d0364733c0b08813c2c192a
tree5a5f4867228e9e394ef9dc75f59878eba268eaf7
parentab2abda6377723e0d5fbbfe5f5aa16a5523344d1
esp_scsi: Fix tag state corruption when autosensing.

Meelis Roos reports a crash in esp_free_lun_tag() in the presense
of a disk which has died.

The issue is that when we issue an autosense command, we do so by
hijacking the original command that caused the check-condition.

When we do so we clear out the ent->tag[] array when we issue it via
find_and_prep_issuable_command().  This is so that the autosense
command is forced to be issued non-tagged.

That is problematic, because it is the value of ent->tag[] which
determines whether we issued the original scsi command as tagged
vs. non-tagged (see esp_alloc_lun_tag()).

And that, in turn, is what trips up the sanity checks in
esp_free_lun_tag().  That function needs the original ->tag[] values
in order to free up the tag slot properly.

Fix this by remembering the original command's tag values, and
having esp_alloc_lun_tag() and esp_free_lun_tag() use them.

Reported-by: Meelis Roos <mroos@linux.ee>
Tested-by: Meelis Roos <mroos@linux.ee>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/scsi/esp_scsi.c
drivers/scsi/esp_scsi.h
This page took 0.02884 seconds and 5 git commands to generate.