scsi: lpfc: devloss timeout race condition caused null pointer reference
authorJames Smart <jsmart2021@gmail.com>
Tue, 26 Jun 2018 15:24:29 +0000 (08:24 -0700)
committerMartin K. Petersen <martin.petersen@oracle.com>
Wed, 11 Jul 2018 02:15:09 +0000 (22:15 -0400)
commitb0e830125b669570d8096b8ba22eb00f659fc05e
tree4c597dd52c59cf4c0dbffea14d31f32772389303
parent6871e8144f935a1f08e7fc6269c894861ce494aa
scsi: lpfc: devloss timeout race condition caused null pointer reference

A race condition between the context of devloss timeout handler and I/O
completion caused devloss timeout handler de-referencing pointer that had
been released.

Added the check in lpfc_sli_validate_fcp_iocb() on LPFC_IO_ON_TXCMPLQ to
capture the race condition of I/O completion and devloss timeout handler
attemption for aborting the I/O. Also, added check on lpfc_cmd->rdata
pointer before de-referenceing lpfc_cmd->rdata->pnode.

Also, added protection in lpfc_sli_abort_iocb() routine on driver performed
FCP I/O FLUSHING already under way before proceeding to aborting I/Os.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/lpfc/lpfc_scsi.c
drivers/scsi/lpfc/lpfc_sli.c