diff options
| author | Bart Van Assche <bart.vanassche@sandisk.com> | 2015-06-05 14:20:46 -0700 |
|---|---|---|
| committer | James Bottomley <JBottomley@Odin.com> | 2015-08-12 11:23:30 -0700 |
| commit | f6979adeaab578f8ca14fdd32b06ddee0d9d3314 (patch) | |
| tree | 81261d86cae0460cb67d6a085631c15c5528776d /drivers/scsi/libfc/fc_fcp.c | |
| parent | 660d0831d1494a6837b2f810d08b5be092c1f31d (diff) | |
| download | linux-stable-f6979adeaab578f8ca14fdd32b06ddee0d9d3314.tar.gz linux-stable-f6979adeaab578f8ca14fdd32b06ddee0d9d3314.tar.bz2 linux-stable-f6979adeaab578f8ca14fdd32b06ddee0d9d3314.zip | |
libfc: Fix fc_exch_recv_req() error path
Due to patch "libfc: Do not invoke the response handler after
fc_exch_done()" (commit ID 7030fd62) the lport_recv() call
in fc_exch_recv_req() is passed a dangling pointer. Avoid this
by moving the fc_frame_free() call from fc_invoke_resp() to its
callers. This patch fixes the following crash:
general protection fault: 0000 [#3] PREEMPT SMP
RIP: fc_lport_recv_req+0x72/0x280 [libfc]
Call Trace:
fc_exch_recv+0x642/0xde0 [libfc]
fcoe_percpu_receive_thread+0x46a/0x5ed [fcoe]
kthread+0x10a/0x120
ret_from_fork+0x42/0x70
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Vasu Dev <vasu.dev@intel.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Diffstat (limited to 'drivers/scsi/libfc/fc_fcp.c')
0 files changed, 0 insertions, 0 deletions