Patch "scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref" has been added to the 4.14-stable tree

Patch "scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref" has been added to the 4.14-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref

to the 4.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     scsi-qla2xxx-fix-system-crash-in-qlt_plogi_ack_unref.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 19759033e0d0beed70421ab9258f5ede79e070ae Mon Sep 17 00:00:00 2001
From: Quinn Tran <quinn.tran@cavium.com>
Date: Mon, 4 Dec 2017 14:45:15 -0800
Subject: scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref

From: Quinn Tran <quinn.tran@cavium.com>

commit 19759033e0d0beed70421ab9258f5ede79e070ae upstream.

Fix system crash due to NULL pointer access.

qlt_plogi_ack_t and fc_port structures were not properly bound before
calling qlt_plogi_ack_unref().

RIP: 0010:qlt_plogi_ack_unref+0xa1/0x150 [qla2xxx]
Call Trace:
qla24xx_create_new_sess+0xb1/0x320 [qla2xxx]
qla2x00_do_work+0x123/0x260 [qla2xxx]
qla2x00_iocb_work_fn+0x30/0x40 [qla2xxx]
process_one_work+0x1f3/0x530
worker_thread+0x4e/0x480
kthread+0x10c/0x140

Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/qla2xxx/qla_os.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -4734,11 +4734,11 @@ void qla24xx_create_new_sess(struct scsi
 		} else {
 			list_add_tail(&fcport->list, &vha->vp_fcports);
 
-			if (pla) {
-				qlt_plogi_ack_link(vha, pla, fcport,
-				    QLT_PLOGI_LINK_SAME_WWN);
-				pla->ref_count--;
-			}
+		}
+		if (pla) {
+			qlt_plogi_ack_link(vha, pla, fcport,
+			    QLT_PLOGI_LINK_SAME_WWN);
+			pla->ref_count--;
 		}
 	}
 	spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);


Patches currently in stable-queue which might be from quinn.tran@cavium.com are

queue-4.14/scsi-qla2xxx-retry-switch-command-on-time-out.patch
queue-4.14/scsi-qla2xxx-fix-abort-command-deadlock-due-to-spinlock.patch
queue-4.14/scsi-qla2xxx-fix-re-login-for-nport-handle-in-use.patch
queue-4.14/scsi-qla2xxx-fix-login-state-machine-stuck-at-gpdb.patch
queue-4.14/scsi-qla2xxx-fix-system-crash-for-notify-ack-timeout-handling.patch
queue-4.14/scsi-qla2xxx-replace-fcport-alloc-with-qla2x00_alloc_fcport.patch
queue-4.14/scsi-qla2xxx-clear-loop-id-after-delete.patch
queue-4.14/scsi-qla2xxx-fix-relogin-being-triggered-too-fast.patch
queue-4.14/scsi-qla2xxx-skip-irq-affinity-for-target-qpairs.patch
queue-4.14/scsi-qla2xxx-fix-scan-state-field-for-fcport.patch
queue-4.14/scsi-qla2xxx-fix-prli-state-check.patch
queue-4.14/scsi-qla2xxx-fix-system-crash-in-qlt_plogi_ack_unref.patch
queue-4.14/scsi-qla2xxx-serialize-gpnid-for-multiple-rscn.patch
queue-4.14/scsi-qla2xxx-fix-gpnid-error-processing.patch
queue-4.14/scsi-qla2xxx-move-session-delete-to-driver-work-queue.patch