Imported linux-2.6.27.39 suse/xen patches.

[ipfire-2.x.git] / src / patches / suse-2.6.27.39 / patches.arch / s390-03-08-zfcp-abort-race.patch

diff --git a/src/patches/suse-2.6.27.39/patches.arch/s390-03-08-zfcp-abort-race.patch b/src/patches/suse-2.6.27.39/patches.arch/s390-03-08-zfcp-abort-race.patch
new file mode 100644 (file)
index 0000000..e75b5ab
--- /dev/null
+++ b/src/patches/suse-2.6.27.39/patches.arch/s390-03-08-zfcp-abort-race.patch
@@ -0,0 +1,53 @@
+From: Gerald Schaefer <geraldsc@de.ibm.com>
+Subject: zfcp: eliminate race between validation and locking.
+References: bnc#440610
+
+Symptom:     machine stalls
+Problem:     ptr is verified before processing is secured by lock.
+Solution:    assign, verify ptr after secured by lock
+
+Acked-by: John Jolly <jjolly@suse.de>
+---
+ drivers/s390/scsi/zfcp_fsf.c |   14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+Index: linux-sles11/drivers/s390/scsi/zfcp_fsf.c
+===================================================================
+--- linux-sles11.orig/drivers/s390/scsi/zfcp_fsf.c
++++ linux-sles11/drivers/s390/scsi/zfcp_fsf.c
+@@ -2115,18 +2115,21 @@ static inline void zfcp_fsf_trace_latenc
+ 
+ static void zfcp_fsf_send_fcp_command_task_handler(struct zfcp_fsf_req *req)
+ {
+-      struct scsi_cmnd *scpnt = req->data;
++      struct scsi_cmnd *scpnt;
+       struct fcp_rsp_iu *fcp_rsp_iu = (struct fcp_rsp_iu *)
+           &(req->qtcb->bottom.io.fcp_rsp);
+       u32 sns_len;
+       char *fcp_rsp_info = (unsigned char *) &fcp_rsp_iu[1];
+       unsigned long flags;
+ 
+-      if (unlikely(!scpnt))
+-              return;
+-
+       read_lock_irqsave(&req->adapter->abort_lock, flags);
+ 
++      scpnt = req->data;
++      if (unlikely(!scpnt)) {
++              read_unlock_irqrestore(&req->adapter->abort_lock, flags);
++              return;
++      }
++
+       if (unlikely(req->status & ZFCP_STATUS_FSFREQ_ABORTED)) {
+               set_host_byte(scpnt, DID_SOFT_ERROR);
+               set_driver_byte(scpnt, SUGGEST_RETRY);
+@@ -2181,7 +2184,8 @@ skip_fsfstatus:
+               zfcp_scsi_dbf_event_result("norm", 6, req->adapter, scpnt, req);
+ 
+       scpnt->host_scribble = NULL;
+-      (scpnt->scsi_done) (scpnt);
++      if (scpnt->scsi_done)
++              (scpnt->scsi_done) (scpnt);
+       /*
+        * We must hold this lock until scsi_done has been called.
+        * Otherwise we may call scsi_done after abort regarding this