From: Joern Engel Date: Wed, 26 Oct 2011 05:08:43 +0000 (-0700) Subject: target: Fix incorrect se_cmd assignment in core_tmr_drain_tmr_list X-Git-Tag: v3.1.1~33 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a1dc5b0de6f3083000c3b990dc319dd842ad7420;p=thirdparty%2Fkernel%2Fstable.git target: Fix incorrect se_cmd assignment in core_tmr_drain_tmr_list commit 80ccbc8e00f7001d79dd503c2781487906b98611 upstream. This patch fixes a bug in core_tmr_drain_tmr_list() where drain_tmr_list was using the wrong se_tmr_req for cmd assignment due to a typo during the LUN_RESET re-org. This was resulting in general protection faults while using the leftover bogus *tmr_p pointer from list_for_each_entry_safe(). Signed-off-by: Joern Engel Cc: Joern Engel Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c index df3e4669c80b3..c0deee33037ca 100644 --- a/drivers/target/target_core_tmr.c +++ b/drivers/target/target_core_tmr.c @@ -155,7 +155,7 @@ static void core_tmr_drain_tmr_list( while (!list_empty(&drain_tmr_list)) { tmr = list_entry(drain_tmr_list.next, struct se_tmr_req, tmr_list); list_del(&tmr->tmr_list); - cmd = tmr_p->task_cmd; + cmd = tmr->task_cmd; pr_debug("LUN_RESET: %s releasing TMR %p Function: 0x%02x," " Response: 0x%02x, t_state: %d\n",