From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D82CC352FC2; Tue, 26 Aug 2025 14:24:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756218255; cv=none; b=jJm7O89BMuIW86T8a1IqcJWwdsKgqiMh9iAjNCTDl1qWGSvXJtxK5RlPjndImsFYIByqnSsqjKhQrHgq/GL23Ch55t/wsrHkvmGmkAfdJX/ytYDxmEJrloW3HgB4gNuxe/HbnHe1c21E8y7GWyLGbPpTqtIN8jiKlu+8lc9RIls= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756218255; c=relaxed/simple; bh=eUaGdm16dVLe/lqCQIzREU7S3tng9BrUVgp/w++G0ZQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gTCd+EaamJ5ORWfpEha75OEC4aJ3a+NY9E+D7wdN2rdjyWKaf9q5+gT8eCnYV9hgKltT2t5picgDH4cJGxGvZbaEcIyKngCVVfggJ7RoyWgV0IMfxkhR1GeaiNK6mnsV6Cw7QjxLaP5RpqOYDKw9DJ5qiR2aCROng6/OuBmDFxs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gXvC8YZH; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="gXvC8YZH" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23D2BC113CF; Tue, 26 Aug 2025 14:24:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1756218255; bh=eUaGdm16dVLe/lqCQIzREU7S3tng9BrUVgp/w++G0ZQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gXvC8YZHeTqw1Z4RJIU1uExle0/39yYau8TFoxaZvhFfLJSVju31x4btXyTfBQQQE pnkd39/uDHbCYUECN19wR+eeCfhrhVqL/WytNUbJoYHJoOSKPXPutpkLwNvKOBjlKn 6KTxjz7jpV7pDApY389gLOlYP8dLNaOmDYBkK3Sg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Justin Tee , James Smart , "Martin K. Petersen" , Sasha Levin , Shivani Agarwal Subject: [PATCH 5.10 453/523] scsi: lpfc: Fix link down processing to address NULL pointer dereference Date: Tue, 26 Aug 2025 13:11:03 +0200 Message-ID: <20250826110935.623944590@linuxfoundation.org> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250826110924.562212281@linuxfoundation.org> References: <20250826110924.562212281@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: James Smart [ Upstream commit 1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6 ] If an FC link down transition while PLOGIs are outstanding to fabric well known addresses, outstanding ABTS requests may result in a NULL pointer dereference. Driver unload requests may hang with repeated "2878" log messages. The Link down processing results in ABTS requests for outstanding ELS requests. The Abort WQEs are sent for the ELSs before the driver had set the link state to down. Thus the driver is sending the Abort with the expectation that an ABTS will be sent on the wire. The Abort request is stalled waiting for the link to come up. In some conditions the driver may auto-complete the ELSs thus if the link does come up, the Abort completions may reference an invalid structure. Fix by ensuring that Abort set the flag to avoid link traffic if issued due to conditions where the link failed. Link: https://lore.kernel.org/r/20211020211417.88754-7-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin [Shivani: Modified to apply on 5.10.y] Signed-off-by: Shivani Agarwal Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/lpfc/lpfc_sli.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/drivers/scsi/lpfc/lpfc_sli.c +++ b/drivers/scsi/lpfc/lpfc_sli.c @@ -11432,10 +11432,12 @@ lpfc_sli_abort_iotag_issue(struct lpfc_h if (cmdiocb->iocb_flag & LPFC_IO_FOF) abtsiocbp->iocb_flag |= LPFC_IO_FOF; - if (phba->link_state >= LPFC_LINK_UP) - iabt->ulpCommand = CMD_ABORT_XRI_CN; - else + if (phba->link_state < LPFC_LINK_UP || + (phba->sli_rev == LPFC_SLI_REV4 && + phba->sli4_hba.link_state.status == LPFC_FC_LA_TYPE_LINK_DOWN)) iabt->ulpCommand = CMD_CLOSE_XRI_CN; + else + iabt->ulpCommand = CMD_ABORT_XRI_CN; abtsiocbp->iocb_cmpl = lpfc_sli_abort_els_cmpl; abtsiocbp->vport = vport;