Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorHannes Reinecke <hare@suse.de>2017-10-20 15:32:55 +0200
committerTakashi Iwai <tiwai@suse.de>2017-10-20 20:58:40 +0200
commit1f6d3538646f5a9172cf83261b0e70b887961373 (patch)
treeccf74e6dbfd4b28c697160f041e86d9d56a574cd
parent5478653a168efac43bc58023b1b077190ee170b6 (diff)
scsi: sg: don't return bogus Sg_requests (bsc#1064206).
-rw-r--r--patches.fixes/scsi-sg-don-t-return-bogus-Sg_requests.patch48
-rw-r--r--series.conf1
2 files changed, 49 insertions, 0 deletions
diff --git a/patches.fixes/scsi-sg-don-t-return-bogus-Sg_requests.patch b/patches.fixes/scsi-sg-don-t-return-bogus-Sg_requests.patch
new file mode 100644
index 0000000000..bf001f2a60
--- /dev/null
+++ b/patches.fixes/scsi-sg-don-t-return-bogus-Sg_requests.patch
@@ -0,0 +1,48 @@
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Date: Wed, 10 May 2017 09:53:40 +0200
+Subject: [PATCH] scsi: sg: don't return bogus Sg_requests
+Git-commit: 48ae8484e9fc324b4968d33c585e54bc98e44d61
+Patch-Mainline: v4.12
+References: bsc#1064206
+
+If the list search in sg_get_rq_mark() fails to find a valid request, we
+return a bogus element. This then can later lead to a GPF in
+sg_remove_scat().
+
+So don't return bogus Sg_requests in sg_get_rq_mark() but NULL in case
+the list search doesn't find a valid request.
+
+Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Doug Gilbert <dgilbert@interlog.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Acked-by: Doug Gilbert <dgilbert@interlog.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+---
+ drivers/scsi/sg.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index f5b5090..a7c26be 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -2075,11 +2075,12 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id)
+ if ((1 == resp->done) && (!resp->sg_io_owned) &&
+ ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
+ resp->done = 2; /* guard against other readers */
+- break;
++ write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
++ return resp;
+ }
+ }
+ write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
+- return resp;
++ return NULL;
+ }
+
+ /* always adds to end of list */
+--
+1.8.5.6
+
diff --git a/series.conf b/series.conf
index 48c3644fc4..c4d6f28e21 100644
--- a/series.conf
+++ b/series.conf
@@ -5938,6 +5938,7 @@
patches.fixes/scsi_transport_fc-set-scsi_target_id-upon-rescan.patch
patches.fixes/scsi-fixup-kernel-warning-during-rmmod.patch
patches.fixes/scsi-sg-close-race-condition-in-sg_remove_sfp_userco.patch
+ patches.fixes/scsi-sg-don-t-return-bogus-Sg_requests.patch
# ATA update
patches.drivers/ata-0001-ahci-per-port-msix-support.patch