[PATCH] s390: tape operation abortion leads to panic

When a request is aborted because of a signal, we currently stop the request
via csh, but we do not wait for the interrupt of csh in any case.  We free the
request structure and therefore when the interrupt for the csh operation is
presented, the request object is no longer valid and an invalid callback
pointer is used.

To fix this wait until the interrupt for csh arrives and until
wait_event_interruptible() does not return -ERESTARTSYS.

Signed-off-by: Michael Holzheu <holzheu@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
index c42f5e25024efab3535094f593004b3180deea17..5d17149a65299c4fd26aa985b4f3a3f0b3e152e5 100644 (file)
--- a/drivers/s390/char/tape_core.c
+++ b/drivers/s390/char/tape_core.c
@@ -1015,7 +1015,7 @@ tape_do_io_interruptible(struct tape_device *device,
                                wq,
                                (request->callback == NULL)
                        );
-               } while (rc != -ERESTARTSYS);
+               } while (rc == -ERESTARTSYS);
 
                DBF_EVENT(3, "IO stopped on %08x\n", device->cdev_id);
                rc = -ERESTARTSYS;