Attachment 308794 Details for Bug 450645 – slab corruption

[patch] slab corruption

qla2xxx_rhel4.7_slab_fix_patch18.txt (text/plain), 1.86 KB, created by Marcus Barrow on 2008-06-10 10:25:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Barrow

Created: 2008-06-10 10:25:34 UTC

Size: 1.86 KB

patch

obsolete

>
>BZ 450645 [9/11] several fixes: ioctl module and slab corruption
>
>Correct SRB usage-after-completion/free issues resulting in SLAB corruption.
>
>This is a simple patch which removes the offending lines of code.
>
>It was discovered upstream and back ported.
>
>The driver is incorrectly assuming that the 'sp' reference held
>in qla2[x00|4xx]_abort_command() is valid after the mailbox
>command is issued to abort the exchange.  It is *not*, as the
>command may be completed during interrupt context before control
>is returned to the mailbox caller.  This issue was seen with the
>upstream driver, where 'Slab corruptions' were being detected by
>the SLAB debug-allocator.
>---
> drivers/scsi/qla2xxx/qla_mbx.c |    2 --
> drivers/scsi/qla2xxx/qla_os.c  |    1 -
> 2 files changed, 0 insertions(+), 3 deletions(-)
>
>diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
>index 6275558..128497c 100644
>--- a/drivers/scsi/qla2xxx/qla_mbx.c
>+++ b/drivers/scsi/qla2xxx/qla_mbx.c
>@@ -927,7 +927,6 @@ qla2x00_abort_command(scsi_qla_host_t *h
> 		DEBUG2_3_11(printk("qla2x00_abort_command(%ld): failed=%x.\n",
> 		    ha->host_no, rval);)
> 	} else {
>-		sp->flags |= SRB_ABORT_PENDING;
> 		DEBUG11(printk("qla2x00_abort_command(%ld): done.\n",
> 		    ha->host_no);)
> 	}
>@@ -2197,7 +2196,6 @@ qla24xx_abort_command(scsi_qla_host_t *h
> 		rval = QLA_FUNCTION_FAILED;
> 	} else {
> 		DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no);)
>-		sp->flags |= SRB_ABORT_PENDING;
> 	}
> 
> 	dma_pool_free(ha->s_dma_pool, abt, abt_dma);
>diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
>index a5094aa..d1a5f72 100644
>--- a/drivers/scsi/qla2xxx/qla_os.c
>+++ b/drivers/scsi/qla2xxx/qla_os.c
>@@ -4534,7 +4534,6 @@ qla2x00_done(scsi_qla_host_t *old_ha)
> 
> 
> 			case DID_ABORT:
>-				sp->flags &= ~SRB_ABORT_PENDING;
> 				sp->flags |= SRB_ABORTED;
> 
> 				if (sp->flags & SRB_TIMEOUT)
>-- 
>1.4.4.1
>

Actions: View | Diff

Attachments on bug 450645: 308785 | 308786 | 308787 | 308788 | 308789 | 308790 | 308791 | 308792 | 308793 | 308794 | 308795