Re: [PATCH 2.6.30.4] Fix for NULL pointer dereference by SRP initiator triggered by a SCSI reset after the SRP connection has been closed

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, Aug 5, 2009 at 7:44 PM, Roland Dreier<rdreier@xxxxxxxxx> wrote:
>
>  > The NULL pointer dereference happens when srp_reset_device() calls
>  > srp_send_tsk_mgmt(target, req, SRP_TSK_LUN_RESET) with
>  > req->scmnd->device == NULL. When the sg_reset command issues an
>  > SG_SCSI_RESET ioctl, scsi_reset_provider() is invoked and allocates an
>  > scmnd structure and sets scmnd->device to NULL. It is this scmnd
>  > structure that is passed to srp_reset_device(). What I'm not sure
>  > about is whether scsi_reset_provider() should set req->scmnd->device
>  > to a non-NULL value or whether srp_send_tsk_mgmt() should be able to
>  > handle the condition req->scmnd->device == NULL.
>
> Well, I don't see how the reset ioctl can do anything useful unless it
> passes a device in with the scsi command -- otherwise for example
> srp_reset_device() has no idea what LUN to try and reset.

(added linux-scsi in CC)

I hope one of the SCSI people can tell us why scsi_reset_provider()
passes the value NULL in req->scmnd->device to
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]
  Powered by Linux