[SCSI] qla2xxx: Correct use-after-free issue in terminate_rport_io callback.
authorAndrew Vasquez <andrew.vasquez@qlogic.com>
Thu, 18 Feb 2010 18:07:26 +0000 (10:07 -0800)
committerJames Bottomley <James.Bottomley@suse.de>
Fri, 19 Feb 2010 16:46:35 +0000 (10:46 -0600)
The explicit logout (LOGO) issued at the end of the callback will
flush (via normal scsi_cmnd->done()) any outstanding commands
(FCP2) the firmware is holding.  While iterating through the
outstanding_cmnd array in qla2x00_abort_fcport_cmds(), locking
and unlocking of the hardware spinlock, opens-up the driver to
cases where the processed SRB (sp) could be used after the
command completed from interrupt context.

Cc: stable@kernel.org
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>

No differences found