From: Quinn Tran Date: Fri, 11 Apr 2014 20:54:44 +0000 (-0400) Subject: qla2xxx: ABTS cause double free of qla_tgt_cmd +. X-Git-Tag: omap-for-v3.16/fixes-against-rc1~13^2~119 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7b898542f6507fb4a352e1b70e1bc9fd1108e289;p=pandora-kernel.git qla2xxx: ABTS cause double free of qla_tgt_cmd +. Fix double free problem within qla2xxx driver where current code prematurely free qla_tgt_cmd while firmware still has the command. When firmware release the command after abort, the code attempt a second free as part of command completion processing. When TCM start the free process, NULL pointer was hit. ------ WARNING: CPU: 8 PID: 43613 at lib/list_debug.c:62 __list_del_entry+0x82/0xd0() list_del corruption. next->prev should be ffff88082b5cfb08, but was 6b6b6b6b6b6b6b6b CPU: 8 PID: 43613 Comm: kworker/8:0 Tainted: GF W O 3.13.0-rc3-nab_t10dif+ #6 Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012 Workqueue: events cache_reap 000000000000003e ffff88081b2e3c78 ffffffff815a051f 000000000000003e ffff88081b2e3cc8 ffff88081b2e3cb8 ffffffff8104fc2c 0000000000000000 ffff88082b5cfb00 ffff88081c788d00 ffff88082b5d7200 ffff88082b5d3080 Call Trace: [] dump_stack+0x49/0x62 [] warn_slowpath_common+0x8c/0xc0 [] warn_slowpath_fmt+0x46/0x50 [] __list_del_entry+0x82/0xd0 [] process_one_work+0x12c/0x510 [] ? process_one_work+0x173/0x510 [] worker_thread+0x11f/0x3a0 [] ? manage_workers+0x170/0x170 [] kthread+0xf6/0x120 [] ? __lock_release+0x133/0x1b0 [] ? __init_kthread_worker+0x70/0x70 [] ret_from_fork+0x7c/0xb0 [] ? __init_kthread_worker+0x70/0x70 ---[ end trace dfc05c3f7caf8ebe ]--- BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: [] process_one_work+0x31/0x510 ------- Signed-off-by: Quinn Tran Signed-off-by: Giridhar Malavali Signed-off-by: Saurav Kashyap Signed-off-by: Christoph Hellwig --- Reading git-diff-tree failed