If the list search in sg_get_rq_mark() fails to find a valid request, we
return a bogus element. This then can later lead to a GPF in sg_remove_scat().
So don't return bogus Sg_requests in sg_get_rq_mark() but NULL in case the
list search doesn't find a valid request.
Signed-off-by: Johannes Thumshirn <jthumsh...@suse.de>
Reported-by: Andrey Konovalov <andreyk...@google.com>
Cc: Hannes Reinecke <h...@suse.de>
Cc: Christoph Hellwig <h...@lst.de>
Cc: Doug Gilbert <dgilb...@interlog.com>
---
drivers/scsi/sg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 0a38ba01b7b4..abfde23fa186 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -2078,7 +2078,7 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id)
}
}
write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
- return resp;
+ return (resp->done == 2) ? resp : NULL;
}
/* always adds to end of list */
--
2.12.0
