diff options
| author | Paul Gortmaker <paul.gortmaker@windriver.com> | 2018-07-23 10:25:12 -0400 |
|---|---|---|
| committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2018-07-23 10:25:12 -0400 |
| commit | 6355a357d36e48ca63f61ace00dd5cf9c3220ab3 (patch) | |
| tree | fcb9e4efb4a5322bb1ede77ffaf7a22f1675f2fa | |
| parent | 1ee4f322d17e712767de4f72e6f1467c7c23669d (diff) | |
| download | longterm-queue-4.12-6355a357d36e48ca63f61ace00dd5cf9c3220ab3.tar.gz | |
scsi: refresh
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
| -rw-r--r-- | queue/scsi-core-Fix-a-scsi_show_rq-NULL-pointer-dereferenc.patch | 20 |
1 files changed, 9 insertions, 11 deletions
diff --git a/queue/scsi-core-Fix-a-scsi_show_rq-NULL-pointer-dereferenc.patch b/queue/scsi-core-Fix-a-scsi_show_rq-NULL-pointer-dereferenc.patch index 97f199a..5be1c2f 100644 --- a/queue/scsi-core-Fix-a-scsi_show_rq-NULL-pointer-dereferenc.patch +++ b/queue/scsi-core-Fix-a-scsi_show_rq-NULL-pointer-dereferenc.patch @@ -1,4 +1,4 @@ -From 14e3062fb18532175af4d1c4073597999f7a2248 Mon Sep 17 00:00:00 2001 +From fec5d06dc304c006e48eaf8fa404cbf7cbce9a18 Mon Sep 17 00:00:00 2001 From: Bart Van Assche <bart.vanassche@wdc.com> Date: Tue, 5 Dec 2017 16:57:51 -0800 Subject: [PATCH] scsi: core: Fix a scsi_show_rq() NULL pointer dereference @@ -41,15 +41,16 @@ Cc: Hannes Reinecke <hare@suse.com> Cc: Johannes Thumshirn <jthumshirn@suse.de> Cc: stable@vger.kernel.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> diff --git a/drivers/scsi/scsi_debugfs.c b/drivers/scsi/scsi_debugfs.c -index 01f08c03f2c1..c3765d29fd3f 100644 +index a97c9507103d..e5f5b9d5f3dd 100644 --- a/drivers/scsi/scsi_debugfs.c +++ b/drivers/scsi/scsi_debugfs.c -@@ -8,9 +8,11 @@ void scsi_show_rq(struct seq_file *m, struct request *rq) +@@ -6,8 +6,10 @@ + void scsi_show_rq(struct seq_file *m, struct request *rq) { struct scsi_cmnd *cmd = container_of(scsi_req(rq), typeof(*cmd), req); - int msecs = jiffies_to_msecs(jiffies - cmd->jiffies_at_alloc); - char buf[80]; + const u8 *const cdb = READ_ONCE(cmd->cmnd); + char buf[80] = "(?)"; @@ -57,22 +58,19 @@ index 01f08c03f2c1..c3765d29fd3f 100644 - __scsi_format_command(buf, sizeof(buf), cmd->cmnd, cmd->cmd_len); + if (cdb) + __scsi_format_command(buf, sizeof(buf), cdb, cmd->cmd_len); - seq_printf(m, ", .cmd=%s, .retries=%d, allocated %d.%03d s ago", buf, - cmd->retries, msecs / 1000, msecs % 1000); + seq_printf(m, ", .cmd=%s", buf); } diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index 24fe68522716..a028ab3322a9 100644 +index 203bc9ea275f..9fce660c6797 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c -@@ -1312,6 +1312,7 @@ static int sd_init_command(struct scsi_cmnd *cmd) +@@ -1276,14 +1276,16 @@ static int sd_init_command(struct scsi_cmnd *cmd) static void sd_uninit_command(struct scsi_cmnd *SCpnt) { struct request *rq = SCpnt->request; + u8 *cmnd; - if (SCpnt->flags & SCMD_ZONE_WRITE_LOCK) - sd_zbc_write_unlock_zone(SCpnt); -@@ -1320,9 +1321,10 @@ static void sd_uninit_command(struct scsi_cmnd *SCpnt) + if (rq->rq_flags & RQF_SPECIAL_PAYLOAD) __free_page(rq->special_vec.bv_page); if (SCpnt->cmnd != scsi_req(rq)->cmd) { |