Martin Peschke d436de8ce2 [SCSI] zfcp: only access zfcp_scsi_dev for valid scsi_device ... __scsi_remove_device (e.g. due to dev_loss_tmo) calls zfcp_scsi_slave_destroy which in turn sends a close LUN FSF request to the adapter. After 30 seconds without response, zfcp_erp_timeout_handler kicks the ERP thread failing the close LUN ERP action. zfcp_erp_wait in zfcp_erp_lun_shutdown_wait and thus zfcp_scsi_slave_destroy returns and then scsi_device is no longer valid. Sometime later the response to the close LUN FSF request may finally come in. However, commit b62a8d9b45 "[SCSI] zfcp: Use SCSI device data zfcp_scsi_dev instead of zfcp_unit" introduced a number of attempts to unconditionally access struct zfcp_scsi_dev through struct scsi_device causing a use-after-free. This leads to an Oops due to kernel page fault in one of: zfcp_fsf_abort_fcp_command_handler, zfcp_fsf_open_lun_handler, zfcp_fsf_close_lun_handler, zfcp_fsf_req_trace, zfcp_fsf_fcp_handler_common. Move dereferencing of zfcp private data zfcp_scsi_dev allocated in scsi_device via scsi_transport_reserve_device after the check for potentially aborted FSF request and thus no longer valid scsi_device. Only then assign sdev_to_zfcp(sdev) to the local auto variable struct zfcp_scsi_dev *zfcp_sdev. Signed-off-by: Martin Peschke <mpeschke@linux.vnet.ibm.com> Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Cc: <stable@vger.kernel.org> #2.6.37+ Signed-off-by: James Bottomley <JBottomley@Parallels.com>		2012-09-24 12:11:02 +04:00
..
block	s390/comments: unify copyright messages and remove file names	2012-07-20 11:15:04 +02:00
char	s390/sclp_sdias: Add missing break and "fall through"	2012-08-08 07:32:55 -07:00
cio	s390/comments: unify copyright messages and remove file names	2012-07-20 11:15:04 +02:00
crypto	s390/comments: unify copyright messages and remove file names	2012-07-20 11:15:04 +02:00
kvm	KVM updates for the 3.6 merge window	2012-07-24 12:01:20 -07:00
net	qeth: repair crash in qeth_l3_vlan_rx_kill_vid()	2012-07-25 15:24:13 -07:00
scsi	[SCSI] zfcp: only access zfcp_scsi_dev for valid scsi_device	2012-09-24 12:11:02 +04:00
Makefile	[S390] split/move machine check handler code	2009-03-26 15:24:10 +01:00