[ofa-general] Re: [PATCH 2.6.30.4] Fix for NULL pointer dereference by SRP initiator triggered by a SCSI reset after the SRP connection has been closed

[Roland Dreier]

 > The NULL pointer dereference happens when srp_reset_device() calls
 > srp_send_tsk_mgmt(target, req, SRP_TSK_LUN_RESET) with
 > req->scmnd->device == NULL. When the sg_reset command issues an
 > SG_SCSI_RESET ioctl, scsi_reset_provider() is invoked and allocates an
 > scmnd structure and sets scmnd->device to NULL. It is this scmnd
 > structure that is passed to srp_reset_device(). What I'm not sure
 > about is whether scsi_reset_provider() should set req->scmnd->device
 > to a non-NULL value or whether srp_send_tsk_mgmt() should be able to
 > handle the condition req->scmnd->device == NULL.

Well, I don't see how the reset ioctl can do anything useful unless it
passes a device in with the scsi command -- otherwise for example
srp_reset_device() has no idea what LUN to try and reset.

 - R.