aboutsummaryrefslogtreecommitdiff
path: root/drivers/scsi/libfc
diff options
context:
space:
mode:
authorBhanu Prakash Gollapudi <bprakash@broadcom.com>2012-02-10 17:18:51 -0800
committerJames Bottomley <JBottomley@Parallels.com>2012-02-19 09:26:07 -0600
commitd4042e9c84864a5666dc8ec14b3c1a5597b6a73f (patch)
treeb13dd159f049a54208d7e6a17735f4e859fa6952 /drivers/scsi/libfc
parent1a8ef414d97bf3f293e286f02002f8db768f9867 (diff)
[SCSI] libfc: Fix panic in fc_exch_recv
Adding and removing the host into the zone causes this panic. BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0 IP: [<ffffffffa0491707>] fc_exch_recv+0xc57/0xe70 [libfc] Call Trace: [<ffffffffa050e04b>] bnx2fc_l2_rcv_thread+0x37b/0x430 [bnx2fc] [<ffffffffa050dcd0>] ? bnx2fc_l2_rcv_thread+0x0/0x430 [bnx2fc] [<ffffffff81090886>] kthread+0x96/0xa0 [<ffffffff8100c14a>] child_rip+0xa/0x20 [<ffffffff810907f0>] ? kthread+0x0/0xa0 [<ffffffff8100c140>] ? child_rip+0x0/0x20 During fc_exch_reset, the active exchanges are aborted and the exch is deleted. As part of processing ABTS response, due to 'ep' being NULL, any access to ep in fc_exch_recv_bls() causes this panic. Fixed to access 'ep' only if non-NULL. Reviewed-by: Neerav Parikh <neerav.parikh@intel.com> Signed-off-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com> Signed-off-by: Robert Love <robert.w.love@intel.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'drivers/scsi/libfc')
-rw-r--r--drivers/scsi/libfc/fc_exch.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index 4d70d96fa5d..630291f0182 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -1642,9 +1642,10 @@ static void fc_exch_recv_bls(struct fc_exch_mgr *mp, struct fc_frame *fp)
case FC_RCTL_ACK_0:
break;
default:
- FC_EXCH_DBG(ep, "BLS rctl %x - %s received",
- fh->fh_r_ctl,
- fc_exch_rctl_name(fh->fh_r_ctl));
+ if (ep)
+ FC_EXCH_DBG(ep, "BLS rctl %x - %s received",
+ fh->fh_r_ctl,
+ fc_exch_rctl_name(fh->fh_r_ctl));
break;
}
fc_frame_free(fp);