]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
scsi: sd: Fix a race between closing an sd device and sd I/O
authorBart Van Assche <bvanassche@acm.org>
Mon, 25 Mar 2019 17:01:46 +0000 (10:01 -0700)
committerMartin K. Petersen <martin.petersen@oracle.com>
Thu, 28 Mar 2019 01:21:38 +0000 (21:21 -0400)
commitc14a57264399efd39514a2329c591a4b954246d8
tree3205f8e7c0fe838ed09fad3913b40ba6c01d417a
parent70fc085c5015c54a7b8742a45fc9ab05d6da90da
scsi: sd: Fix a race between closing an sd device and sd I/O

The scsi_end_request() function calls scsi_cmd_to_driver() indirectly and
hence needs the disk->private_data pointer. Avoid that that pointer is
cleared before all affected I/O requests have finished. This patch avoids
that the following crash occurs:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Call trace:
 scsi_mq_uninit_cmd+0x1c/0x30
 scsi_end_request+0x7c/0x1b8
 scsi_io_completion+0x464/0x668
 scsi_finish_command+0xbc/0x160
 scsi_eh_flush_done_q+0x10c/0x170
 sas_scsi_recover_host+0x84c/0xa98 [libsas]
 scsi_error_handler+0x140/0x5b0
 kthread+0x100/0x12c
 ret_from_fork+0x10/0x18

Cc: Christoph Hellwig <hch@lst.de>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Johannes Thumshirn <jthumshirn@suse.de>
Cc: Jason Yan <yanaijie@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reported-by: Jason Yan <yanaijie@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/sd.c