Merge git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6

* git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6:
  [SCSI] libsas: fix panic when single phy is disabled on a wide port
  [SCSI] qla2xxx: Fix crash in qla2x00_abort_all_cmds() on unload

2 files changed, 11 insertions, 8 deletions

diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index c9e3dc024bc3..16ad97df5ba6 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -1769,10 +1769,12 @@ static void sas_unregister_devs_sas_addr(struct domain_device *parent,
                 sas_disable_routing(parent, phy->attached_sas_addr);
         }
         memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
-        sas_port_delete_phy(phy->port, phy->phy);
-        if (phy->port->num_phys == 0)
-                sas_port_delete(phy->port);
-        phy->port = NULL;
+        if (phy->port) {
+                sas_port_delete_phy(phy->port, phy->phy);
+                if (phy->port->num_phys == 0)
+                        sas_port_delete(phy->port);
+                phy->port = NULL;
+        }
 }
 
 static int sas_discover_bfs_by_root_level(struct domain_device *root,
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 4cace3f20c04..1e69527f1e4e 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1328,10 +1328,9 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                         qla2x00_sp_compl(ha, sp);
                                 } else {
                                         ctx = sp->ctx;
-                                        if (ctx->type == SRB_LOGIN_CMD ||
-                                            ctx->type == SRB_LOGOUT_CMD) {
-                                                ctx->u.iocb_cmd->free(sp);
-                                        } else {
+                                        if (ctx->type == SRB_ELS_CMD_RPT ||
+                                            ctx->type == SRB_ELS_CMD_HST ||
+                                            ctx->type == SRB_CT_CMD) {
                                                 struct fc_bsg_job *bsg_job =
                                                     ctx->u.bsg_job;
                                                 if (bsg_job->request->msgcode
@@ -1343,6 +1342,8 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                                 kfree(sp->ctx);
                                                 mempool_free(sp,
                                                         ha->srb_mempool);
+                                        } else {
+                                                ctx->u.iocb_cmd->free(sp);
                                         }
                                 }
                         }