On Wed, 2009-08-05 at 19:54 +0200, Bart Van Assche wrote: > On Wed, Aug 5, 2009 at 7:44 PM, Roland Dreier<rdreier@xxxxxxxxx> wrote: > > > > > The NULL pointer dereference happens when srp_reset_device() calls > > > srp_send_tsk_mgmt(target, req, SRP_TSK_LUN_RESET) with > > > req->scmnd->device == NULL. When the sg_reset command issues an > > > SG_SCSI_RESET ioctl, scsi_reset_provider() is invoked and allocates an > > > scmnd structure and sets scmnd->device to NULL. It is this scmnd > > > structure that is passed to srp_reset_device(). What I'm not sure > > > about is whether scsi_reset_provider() should set req->scmnd->device > > > to a non-NULL value or whether srp_send_tsk_mgmt() should be able to > > > handle the condition req->scmnd->device == NULL. > > > > Well, I don't see how the reset ioctl can do anything useful unless it > > passes a device in with the scsi command -- otherwise for example > > srp_reset_device() has no idea what LUN to try and reset. > > (added linux-scsi in CC) > > I hope one of the SCSI people can tell us whether the behavior that > scsi_reset_provider() > passes the value NULL in req->scmnd->device to > scsi_try_bus_device_reset() is correct ? Need more information. cmd->device is supposed to be initialised in scsi_get_command(), which scsi_reset_provider() calls ... why do you think it got set to null? James -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
