summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authoradam radford <aradford@gmail.com>2011-10-13 16:01:12 -0700
committerJames Bottomley <JBottomley@Parallels.com>2011-10-20 10:18:17 -0500
commitf575c5d3ebdca3b0482847d8fcba971767754a9e (patch)
tree8f238a30ea2a4d0a9300466e60a8bae85280fd6d
parentfba63097b8614a4a158226c02eec0318f41cd24f (diff)
[SCSI] megaraid_sas: Fix instance access in megasas_reset_timer
The following patch for megaraid_sas will fix a potential bad pointer access in megasas_reset_timer(), when a MegaRAID 9265/9285 or 9360/9380 gets a timeout. megasas_build_io_fusion() sets SCp.ptr to be a struct megasas_cmd_fusion *, but then megasas_reset_timer() was casting SCp.ptr to be a struct megasas_cmd *, then trying to access cmd->instance, which is invalid. Just loading instance from scmd->device->host->hostdata in megasas_reset_timer() fixes the issue. Signed-off-by: Adam Radford <aradford@gmail.com> Cc: stable@kernel.org Signed-off-by: James Bottomley <JBottomley@Parallels.com>
-rw-r--r--drivers/scsi/megaraid/megaraid_sas_base.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 8d587cb73cb7..29a994f9c4f1 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -1914,7 +1914,6 @@ static int megasas_generic_reset(struct scsi_cmnd *scmd)
static enum
blk_eh_timer_return megasas_reset_timer(struct scsi_cmnd *scmd)
{
- struct megasas_cmd *cmd = (struct megasas_cmd *)scmd->SCp.ptr;
struct megasas_instance *instance;
unsigned long flags;
@@ -1923,7 +1922,7 @@ blk_eh_timer_return megasas_reset_timer(struct scsi_cmnd *scmd)
return BLK_EH_NOT_HANDLED;
}
- instance = cmd->instance;
+ instance = (struct megasas_instance *)scmd->device->host->hostdata;
if (!(instance->flag & MEGASAS_FW_BUSY)) {
/* FW is busy, throttle IO */
spin_lock_irqsave(instance->host->host_lock, flags);