summaryrefslogtreecommitdiff
path: root/drivers/scsi
diff options
context:
space:
mode:
authorChad Dupuis <chad.dupuis@cavium.com>2017-06-26 08:59:36 -0700
committerMartin K. Petersen <martin.petersen@oracle.com>2017-06-27 21:39:10 -0400
commit5c63daf67d4753f80883672d429ff7b6595ec2f4 (patch)
tree6a9654ef23b10f51a068734305b13af4ecd690df /drivers/scsi
parent59fb870f0ed4da64cbbc44f6a4dc1038be9f8904 (diff)
scsi: bnx2fc: If IO is still in cleanup then do not return to SCSI layer.
In eh_abort, driver is calling scsi->done() for a IO for which cleanup is pending. As the IO is outstanding with the firmware, it may do DMA associated with the IO. This may lead to heap corruption. Do not complete the IO for which cleanup is still pending. Return failure from eh_abort and let the SCSI-ml retry the IO. Signed-off-by: Chad Dupuis <chad.dupuis@cavium.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi')
-rw-r--r--drivers/scsi/bnx2fc/bnx2fc_io.c11
1 files changed, 3 insertions, 8 deletions
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 6e8b9bea89fc..5b6153f23f01 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -1167,16 +1167,11 @@ int bnx2fc_eh_abort(struct scsi_cmnd *sc_cmd)
printk(KERN_ERR PFX "eh_abort: io_req (xid = 0x%x) "
"not on active_q\n", io_req->xid);
/*
- * This condition can happen only due to the FW bug,
- * where we do not receive cleanup response from
- * the FW. Handle this case gracefully by erroring
- * back the IO request to SCSI-ml
+ * The IO is still with the FW.
+ * Return failure and let SCSI-ml retry eh_abort.
*/
- bnx2fc_scsi_done(io_req, DID_ABORT);
-
- kref_put(&io_req->refcount, bnx2fc_cmd_release);
spin_unlock_bh(&tgt->tgt_lock);
- return SUCCESS;
+ return FAILED;
}
/*