summaryrefslogtreecommitdiff
path: root/drivers/scsi/esp_scsi.h
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2013-08-02 05:08:34 +0400
committerDavid S. Miller <davem@davemloft.net>2013-08-02 05:08:34 +0400
commit21af8107f27878813d0364733c0b08813c2c192a (patch)
tree5a5f4867228e9e394ef9dc75f59878eba268eaf7 /drivers/scsi/esp_scsi.h
parentab2abda6377723e0d5fbbfe5f5aa16a5523344d1 (diff)
downloadlinux-21af8107f27878813d0364733c0b08813c2c192a.tar.xz
esp_scsi: Fix tag state corruption when autosensing.
Meelis Roos reports a crash in esp_free_lun_tag() in the presense of a disk which has died. The issue is that when we issue an autosense command, we do so by hijacking the original command that caused the check-condition. When we do so we clear out the ent->tag[] array when we issue it via find_and_prep_issuable_command(). This is so that the autosense command is forced to be issued non-tagged. That is problematic, because it is the value of ent->tag[] which determines whether we issued the original scsi command as tagged vs. non-tagged (see esp_alloc_lun_tag()). And that, in turn, is what trips up the sanity checks in esp_free_lun_tag(). That function needs the original ->tag[] values in order to free up the tag slot properly. Fix this by remembering the original command's tag values, and having esp_alloc_lun_tag() and esp_free_lun_tag() use them. Reported-by: Meelis Roos <mroos@linux.ee> Tested-by: Meelis Roos <mroos@linux.ee> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/scsi/esp_scsi.h')
-rw-r--r--drivers/scsi/esp_scsi.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/scsi/esp_scsi.h b/drivers/scsi/esp_scsi.h
index 28e22acf87ea..cd68805e8d78 100644
--- a/drivers/scsi/esp_scsi.h
+++ b/drivers/scsi/esp_scsi.h
@@ -271,6 +271,7 @@ struct esp_cmd_entry {
#define ESP_CMD_FLAG_AUTOSENSE 0x04 /* Doing automatic REQUEST_SENSE */
u8 tag[2];
+ u8 orig_tag[2];
u8 status;
u8 message;