aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMartin Petermann <martin@linux.vnet.ibm.com>2009-04-17 15:08:01 +0200
committerJames Bottomley <James.Bottomley@HansenPartnership.com>2009-04-27 10:07:15 -0500
commit135ea137e3c2872448c12d3a8890389fa64990c6 (patch)
tree017f0ca49ddf8a0e02d5aeaef1e6e9db924b8495
parentb4efdd586bc08cdf5977cad0a90091f44546a930 (diff)
[SCSI] zfcp: Avoid referencing freed memory in req send
Avoid referencing a fsf request after sending it in fcp_fsf_req_send, it might have already completed and deallocated. Signed-off-by: Martin Petermann <martin@linux.vnet.ibm.com> Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
-rw-r--r--drivers/s390/scsi/zfcp_fsf.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index b29f3121b66..fa896dc600b 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -766,8 +766,9 @@ static struct zfcp_fsf_req *zfcp_fsf_req_create(struct zfcp_adapter *adapter,
static int zfcp_fsf_req_send(struct zfcp_fsf_req *req)
{
struct zfcp_adapter *adapter = req->adapter;
- unsigned long flags;
- int idx;
+ unsigned long flags;
+ int idx;
+ int with_qtcb = (req->qtcb != NULL);
/* put allocated FSF request into hash table */
spin_lock_irqsave(&adapter->req_list_lock, flags);
@@ -789,7 +790,7 @@ static int zfcp_fsf_req_send(struct zfcp_fsf_req *req)
}
/* Don't increase for unsolicited status */
- if (req->qtcb)
+ if (with_qtcb)
adapter->fsf_req_seq_no++;
adapter->req_no++;