scsi: reintroduce scsi_driver.init_command

PATCH Christoph Hellwig 1 participant 1 message Mar 31, 2014 SCSI

Share & tools

Christoph Hellwig

author

2014-03-31 10:45 UTC #0 lore raw

Quoted 8 lines

The above call would free the cmnd->cmnd and set it to null. If then scsi_io_completion was going to do some error processing it looks like it could try to access the scsi_cmnd->cmnd field.
With the current code that would not be a problem because the blk unprep callback is not called until the block layer does its request cleanup in blk_finish_request which as you know is after scsi_io_completion/scsi_end_request is done with the cmnd.

This incremental patches fixes the issue, and makes sure the uninit calls are nicely paired like the rest of the I/O completion routines after patch 2:

drivers/scsi/scsi_lib.c +2 -2

index 48c5c77..8e79612 100644
@@ -490,8 +490,6 @@ static void scsi_requeue_command(struct request_queue *q, struct scsi_cmnd *cmd)
 	struct request *req = cmd->request;
 	unsigned long flags;
 
-	scsi_uninit_command(cmd);
-
 	spin_lock_irqsave(q->queue_lock, flags);
 	blk_unprep_request(req);
 	req->special = NULL;

@@ -941,6 +939,7 @@ requeue:
 		/* Unprep the request and put it back at the head of the queue.
 		 * A new command will be prepared and issued.
 		 */
+		scsi_uninit_command(cmd);
 		scsi_release_buffers(cmd);
 		scsi_requeue_command(q, cmd);
 		break;

@@ -956,6 +955,7 @@ requeue:
 	return;
 
 next_command:
+	scsi_uninit_command(cmd);
 	scsi_release_buffers(cmd);
 	scsi_next_command(cmd);
 }

drivers/scsi/sd.c +0 -2

index d95c4fd..d99cb3f 100644
@@ -1652,8 +1652,6 @@ static int sd_done(struct scsi_cmnd *SCpnt)
 	unsigned char op = SCpnt->cmnd[0];
 	unsigned char unmap = SCpnt->cmnd[1] & 8;
 
-	sd_uninit_command(SCpnt);
-
 	if (req->cmd_flags & REQ_DISCARD || req->cmd_flags & REQ_WRITE_SAME) {
 		if (!result) {
 			good_bytes = blk_rq_bytes(req);