iscsi: avoid oops when destroying unbound connection
PATCH 1/1 iscsi: avoid oops when destroying unbound connection
Initialize the conn->item list head in a connection, used for associating it with a session, to avoid an oops if list_del happens before the connection is bound. The oops is easy enough to reproduce by calling CREATE_SESSION, CREATE_CONN, then DESTROY_CONN (but no BIND_CONN) from userspace.
--- drivers/scsi/libiscsi.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
drivers/scsi/libiscsi.c +1 -0
@@ -1477,6 +1477,7 @@ iscsi_conn_setup(struct iscsi_cls_sessioINIT_LIST_HEAD (&conn->run_list);INIT_LIST_HEAD (&conn->mgmt_run_list);INIT_LIST_HEAD (&conn->xmitqueue); +INIT_LIST_HEAD (&conn->item);/* initialize general immediate & non-immediate PDU commands queue */ conn->immqueue = kfifo_alloc(session->mgmtpool_max * sizeof(void*),
Quoted 16 lines · Pete Wyckoff
Initialize the
conn->itemlist head in a connection, used for associating it with a session, to avoid an oops iflist_delhappens before the connection is bound. The oops is easy enough to reproduce by callingCREATE_SESSION,CREATE_CONN, thenDESTROY_CONN(but noBIND_CONN) from userspace.Signed-off-by Pete Wyckoff <[email protected]>--- drivers/scsi/libiscsi.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)drivers/scsi/libiscsi.c +0
-0
drivers/scsi/libiscsi.c iscsi_conn_setup(struct iscsi_cls_sessio · line 1483
Quoted 7 lines
drivers/scsi/libiscsi.c +1
-0@@ -1477,6 +1477,7 @@ iscsi_conn_setup(struct iscsi_cls_sessioINIT_LIST_HEAD (&conn->run_list);INIT_LIST_HEAD (&conn->mgmt_run_list);INIT_LIST_HEAD (&conn->xmitqueue); +INIT_LIST_HEAD (&conn->item);/* initialize general immediate & non-immediate PDU commands queue */ conn->immqueue = kfifo_alloc(session->mgmtpool_max * sizeof(void*),
Thanks for the patch. We actually already fixed this by just removing that list. It was not being used for what it was originally intended and was getting in the way.
The fix should be in 2.6.19-rc4 when it comes out.
[email protected] wrote on Mon, 30 Oct 2006 12:02 -0600:
Quoted 5 lines
Thanks for the patch. We actually already fixed this by just removing that list. It was not being used for what it was originally intended and was getting in the way.
The fix should be in 2.6.19-rc4 when it comes out.
That's even better. For future reference, where is the SCSI or iSCSI development tree? I had guessed it might be jejb's scsi-misc-2.6 git, but that still has conn->item, as does your linux-2.6-iscsi git. If I can check for fixes before sending off a patch, it will save us all some time.
-- Pete
Quoted 11 lines · Pete Wyckoff
[email protected] wrote on Mon, 30 Oct 2006 12:02 -0600:
Quoted 5 lines
Thanks for the patch. We actually already fixed this by just removing that list. It was not being used for what it was originally intended and was getting in the way.
The fix should be in 2.6.19-rc4 when it comes out.
That's even better. For future reference, where is the SCSI or iSCSI development tree? I had guessed it might be jejb's scsi-misc-2.6 git, but that still has
conn->item, as does your linux-2.6-iscsi git. If I can check for fixes before sending off a
You have to checkout the iscsi branch (git checkout iscsi) after you have downloaded the linux-2.6-iscsi.git tree.
Quoted 2 lines
patch, it will save us all some time.
James switches from scsi-misc to scsi-rc fixes depending on the timing (rc4 vs not even rc1) and patch type (fix vs feature). This patch was put in scsi-rc-fixes here
and sent to upwards with his last patchset.