[Stgt-devel] [Patch] Segmentation fault in conn_close

[FUJITA Tomonori]

From: Tomas Henzl <thenzl at redhat.com>
Subject: [Stgt-devel] [Patch] Segmentation fault in conn_close
Date: Fri, 25 Jul 2008 14:56:22 +0200

> Hi,
> 
> I noticed a segfault which is probably caused by the patch 
> "iscsi: needs to call iscsi_free_cmd_task for commands in tx_clist"
> b723430058dcbe3b201a2a2c38ce114217dc5273
> 
> it looks like that for some reason iscsi_free_cmd_task(task); gets called  with
> appropriate scmd zeroed out (not initialized ?) and then it causes a segfault
> in list_del.
> 
> I don't know how could it happen that this structure (scmd) is empty. The patch 
> below solves my problem - it restores the old behaviour if the scmd is empty
> as it was before the patch mentioned above.

I think that this bug was fixed by:


commit 73c6fab9f7f9e34aa14c359413b467be5e0ce0dc
Author: FUJITA Tomonori <fujita.tomonori at lab.ntt.co.jp>
Date:   Sat Jul 12 15:47:38 2008 +0900

    iscsi: fix conn_close() segfaults

    The problem is that conn_close() calls iscsi_free_cmd_task against
    tasks in conn->tx_clist. But we could have non SCSI command tasks in
    conn->tx_clist (such as NOOP). We can't call cmd_hlist_remove for such
    tasks.

    Signed-off-by: FUJITA Tomonori <fujita.tomonori at lab.ntt.co.jp>


As the commit log says, non SCSI command tasks don't initialize scmd.