Hi all, I keep on stumbling across this in scsi_eh_abort_cmds(): rtn = scsi_try_to_abort_cmd(scmd); if (rtn == SUCCESS) { scmd->eh_eflags &= ~SCSI_EH_CANCEL_CMD; if (!scsi_device_online(scmd->device) || !scsi_eh_tur(scmd)) { scsi_eh_finish_cmd(scmd, done_q); } Now scsi_device_online() translates to: static inline int scsi_device_online(struct scsi_device *sdev) { return sdev->sdev_state != SDEV_OFFLINE; } Assume that the device has already vanished at this point (ie sdev_state would be SDEV_DEL) we would be happily sending a TUR command to a deleted device, right? And as scsi_eh_tur command is using the ->queuecommand callback directly, any normal checks for the sdev_state do not apply here. Isn't something like this in order here? diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c index f394649..6e2305d 100644 --- a/drivers/scsi/scsi_error.c +++ b/drivers/scsi/scsi_error.c @@ -778,6 +778,9 @@ static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, unsigne d char *cmnd, struct scsi_eh_save ses; int rtn; + if (sdev->sdev_state == SDEV_CANCEL || sdev->sdev_state == SDEV_DEL) + return FAILED; + scsi_eh_prep_cmnd(scmd, &ses, cmnd, cmnd_size, sense_bytes); shost->eh_action = &done; Thanks for any feedback. Cheers, Hannes -- Dr. Hannes Reinecke zSeries & Storage hare@xxxxxxx +49 911 74053 688 SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg GF: Markus Rex, HRB 16746 (AG Nürnberg) -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html