On Fri, 2012-07-13 at 18:18 -0700, Mark Rustad wrote:
> This patch fixes a crash seen when large reads have their exchange
> aborted by either timing out or being reset. Because the exchange
> abort results in the seq pointer being set to NULL, because the
> sequence is no longer valid, it must not be dereferenced. This
> patch changes the function ft_get_task_tag to return ~0 if it is
> unable to get the tag for this reason. Because the get_task_tag
> interface provides no means of returning an error, this seems
> like the best way to fix this issue at the moment.
>
> Signed-off-by: Mark Rustad <mark.d.rustad@xxxxxxxxx>
> ---
>
> drivers/target/tcm_fc/tfc_cmd.c | 2 ++
> 1 files changed, 2 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
> index 164b09a..4ad58ac 100644
> --- a/drivers/target/tcm_fc/tfc_cmd.c
> +++ b/drivers/target/tcm_fc/tfc_cmd.c
> @@ -230,6 +230,8 @@ u32 ft_get_task_tag(struct se_cmd *se_cmd)
> {
> struct ft_cmd *cmd = container_of(se_cmd, struct ft_cmd, se_cmd);
>
> + if (cmd->aborted)
> + return ~0;
> return fc_seq_exch(cmd->seq)->rxid;
> }
>
Looks good. Also FYI, the return of TFO->get_task_tag() is purely
informational in nature for TCM, so no worries here wrt ~0 usage..
Committing into target-pending/master, and queuing for a 3.5-final PULL
request in the next days. Also including a CC' to stable.
Thanks MDR!
--nab
--
To unsubscribe from this list: send the line "unsubscribe target-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
