lkml.org 
[lkml]   [2013]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 063/212] IB/srp: Remove target from list before freeing Scsi_Host structure
    Date
    3.12-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Vu Pham <vuhuong@mellanox.com>

    commit 65d7dd2f3479ef5aec1d9ddd1481cb7851c11af6 upstream.

    Remove an SRP target from the SRP target list before invoking the last
    scsi_host_put() call. This change is necessary because that last put
    frees the memory that holds the srp_target_port structure.

    This patch prevents the following kernel oops:

    RIP: 0010:[<ffffffff810b00d0>] __lock_acquire+0x500/0x1570
    Call Trace:
    [<ffffffff810b11e4>] lock_acquire+0xa4/0x120
    [<ffffffff81531206>] _spin_lock+0x36/0x70
    [<ffffffffa01b6d8f>] srp_remove_work+0xef/0x180 [ib_srp]
    [<ffffffff8109125c>] worker_thread+0x21c/0x3d0
    [<ffffffff81096e86>] kthread+0x96/0xa0
    [<ffffffff8100c20a>] child_rip+0xa/0x20

    Signed-off-by: Vu Pham <vuhuong@mellanox.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    [ bvanassche - Modified path description and CC'ed stable. ]

    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

    ---
    drivers/infiniband/ulp/srp/ib_srp.c | 9 +++++----
    1 file changed, 5 insertions(+), 4 deletions(-)

    --- a/drivers/infiniband/ulp/srp/ib_srp.c
    +++ b/drivers/infiniband/ulp/srp/ib_srp.c
    @@ -534,6 +534,11 @@ static void srp_remove_target(struct srp
    ib_destroy_cm_id(target->cm_id);
    srp_free_target_ib(target);
    srp_free_req_data(target);
    +
    + spin_lock(&target->srp_host->target_lock);
    + list_del(&target->list);
    + spin_unlock(&target->srp_host->target_lock);
    +
    scsi_host_put(target->scsi_host);
    }

    @@ -545,10 +550,6 @@ static void srp_remove_work(struct work_
    WARN_ON_ONCE(target->state != SRP_TARGET_REMOVED);

    srp_remove_target(target);
    -
    - spin_lock(&target->srp_host->target_lock);
    - list_del(&target->list);
    - spin_unlock(&target->srp_host->target_lock);
    }

    static void srp_rport_delete(struct srp_rport *rport)



    \
     
     \ /
      Last update: 2013-12-03 00:41    [W:2.686 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site