Commit 47aeee55 authored by Arun Easi's avatar Arun Easi Committed by Martin K. Petersen

scsi: qedf: Fix crash during sg_reset

Driver was attempting to print cdb[0], which is not set for resets coming
from SCSI ioctls. Check for cmd_len before accessing cmnd.

Crash info:
[84790.864747] BUG: unable to handle kernel NULL pointer dereference at (null)
[84790.864783] IP: qedf_initiate_tmf+0x7a/0x6e0 [qedf]
[84790.865204] Call Trace:
[84790.865246]  scsi_try_target_reset+0x2b/0x90 [scsi_mod]
[84790.865266]  scsi_ioctl_reset+0x20f/0x2a0 [scsi_mod]
[84790.865284]  scsi_ioctl+0x131/0x3a0 [scsi_mod]
Signed-off-by: default avatarArun Easi <aeasi@marvell.com>
Signed-off-by: default avatarSaurav Kashyap <skashyap@marvell.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 4909e153
...@@ -2403,8 +2403,8 @@ int qedf_initiate_tmf(struct scsi_cmnd *sc_cmd, u8 tm_flags) ...@@ -2403,8 +2403,8 @@ int qedf_initiate_tmf(struct scsi_cmnd *sc_cmd, u8 tm_flags)
QEDF_ERR(NULL, QEDF_ERR(NULL,
"tm_flags 0x%x sc_cmd %p op = 0x%02x target_id = 0x%x lun=%d\n", "tm_flags 0x%x sc_cmd %p op = 0x%02x target_id = 0x%x lun=%d\n",
tm_flags, sc_cmd, sc_cmd->cmnd[0], rport->scsi_target_id, tm_flags, sc_cmd, sc_cmd->cmd_len ? sc_cmd->cmnd[0] : 0xff,
(int)sc_cmd->device->lun); rport->scsi_target_id, (int)sc_cmd->device->lun);
if (!rdata || !kref_get_unless_zero(&rdata->kref)) { if (!rdata || !kref_get_unless_zero(&rdata->kref)) {
QEDF_ERR(NULL, "stale rport\n"); QEDF_ERR(NULL, "stale rport\n");
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment