• Bart Van Assche's avatar
    IB/srp: Avoid that duplicate responses trigger a kernel bug · 6cb72bc1
    Bart Van Assche authored
    After srp_process_rsp() returns there is a short time during which
    the scsi_host_find_tag() call will return a pointer to the SCSI
    command that is being completed. If during that time a duplicate
    response is received, avoid that the following call stack appears:
    
    BUG: unable to handle kernel NULL pointer dereference at           (null)
    IP: srp_recv_done+0x450/0x6b0 [ib_srp]
    Oops: 0000 [#1] SMP
    CPU: 10 PID: 0 Comm: swapper/10 Not tainted 4.10.0-rc7-dbg+ #1
    Call Trace:
     <IRQ>
     __ib_process_cq+0x4b/0xd0 [ib_core]
     ib_poll_handler+0x1d/0x70 [ib_core]
     irq_poll_softirq+0xba/0x120
     __do_softirq+0xba/0x4c0
     irq_exit+0xbe/0xd0
     smp_apic_timer_interrupt+0x38/0x50
     apic_timer_interrupt+0x90/0xa0
     </IRQ>
    RIP: srp_recv_done+0x450/0x6b0 [ib_srp] RSP: ffff88046f483e20
    Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
    Cc: Israel Rukshin <israelr@mellanox.com>
    Cc: Max Gurtovoy <maxg@mellanox.com>
    Cc: Laurence Oberman <loberman@redhat.com>
    Cc: Steve Feeley <Steve.Feeley@sandisk.com>
    Cc: <stable@vger.kernel.org>
    Reviewed-by: default avatarLeon Romanovsky <leonro@mellanox.com>
    Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
    6cb72bc1
ib_srp.c 98.1 KB