diff options
| author | Quinn Tran <qutran@marvell.com> | 2019-11-05 07:06:54 -0800 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2019-11-08 21:15:42 -0500 |
| commit | f45bca8c5052e8c59bab64ee90c44441678b9a52 (patch) | |
| tree | 4bf3e5389eddd240e91a9625cd17f1f8e1478532 /drivers/scsi/qla2xxx/qla_isr.c | |
| parent | dd322b7f3efc8cda085bb60eadc4aee6324eadd8 (diff) | |
| download | linux-f45bca8c5052e8c59bab64ee90c44441678b9a52.tar.gz linux-f45bca8c5052e8c59bab64ee90c44441678b9a52.tar.bz2 linux-f45bca8c5052e8c59bab64ee90c44441678b9a52.zip | |
scsi: qla2xxx: Fix double scsi_done for abort path
Current code assumes abort will remove the original command from the active
list where scsi_done will not be called. Instead, the eh_abort thread will
do the scsi_done. That is not the case. Instead, we have a double
scsi_done calls triggering use after free.
Abort will tell FW to release the command from FW possesion. The original
command will return to ULP with error in its normal fashion via scsi_done.
eh_abort path would wait for the original command completion before
returning. eh_abort path will not perform the scsi_done call.
Fixes: 219d27d7147e0 ("scsi: qla2xxx: Fix race conditions in the code for aborting SCSI commands")
Cc: stable@vger.kernel.org # 5.2
Link: https://lore.kernel.org/r/20191105150657.8092-6-hmadhani@marvell.com
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Arun Easi <aeasi@marvell.com>
Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/qla2xxx/qla_isr.c')
| -rw-r--r-- | drivers/scsi/qla2xxx/qla_isr.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c index acef3d73983c..1b8f297449cf 100644 --- a/drivers/scsi/qla2xxx/qla_isr.c +++ b/drivers/scsi/qla2xxx/qla_isr.c @@ -2487,6 +2487,11 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt) return; } + if (sp->abort) + sp->aborted = 1; + else + sp->completed = 1; + if (sp->cmd_type != TYPE_SRB) { req->outstanding_cmds[handle] = NULL; ql_dbg(ql_dbg_io, vha, 0x3015, |