* [PATCH 1/8] qla2xxx: Fix NULL pointer crash due to probe failure
2018-01-16 4:46 [PATCH 0/8] qla2xxx: Minor fixes for the driver Himanshu Madhani
@ 2018-01-16 4:46 ` Himanshu Madhani
2018-01-16 4:46 ` [PATCH 2/8] qla2xxx: Fix recursion while sending terminate exchange Himanshu Madhani
` (7 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: Himanshu Madhani @ 2018-01-16 4:46 UTC (permalink / raw)
To: James.Bottomley, martin.petersen; +Cc: himanshu.madhani, linux-scsi
This patch fixes regression added by commit d74595278f4ab
("scsi: qla2xxx: Add multiple queue pair functionality.").
When driver is not able to get reqeusted IRQs from the system, driver
will attempt tp clean up memory before failing hardware probe. During
this cleanup, driver assigns NULL value to the pointer which has not
been allocated by driver yet. This results in a NULL pointer access.
Log file will show following message and stack trace
qla2xxx [0000:a3:00.1]-00c7:21: MSI-X: Failed to enable support, giving up -- 32/-1.
qla2xxx [0000:a3:00.1]-0037:21: Falling back-to MSI mode --1.
qla2xxx [0000:a3:00.1]-003a:21: Failed to reserve interrupt 821 already in use.
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffffc010c4b6>] qla2x00_probe_one+0x18b6/0x2730 [qla2xxx]
PGD 0
Oops: 0002 [#1] SMP
Fixes: d74595278f4ab ("scsi: qla2xxx: Add multiple queue pair functionality.").
Cc: <stable@vger.kernel.org> # 4.10
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
---
drivers/scsi/qla2xxx/qla_os.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index b21878a70f6e..12ee6e02d146 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3035,9 +3035,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
base_vha = qla2x00_create_host(sht, ha);
if (!base_vha) {
ret = -ENOMEM;
- qla2x00_mem_free(ha);
- qla2x00_free_req_que(ha, req);
- qla2x00_free_rsp_que(ha, rsp);
goto probe_hw_failed;
}
@@ -3098,7 +3095,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
/* Set up the irqs */
ret = qla2x00_request_irqs(ha, rsp);
if (ret)
- goto probe_init_failed;
+ goto probe_hw_failed;
/* Alloc arrays of request and response ring ptrs */
if (!qla2x00_alloc_queues(ha, req, rsp)) {
@@ -3415,6 +3412,9 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
scsi_host_put(base_vha->host);
probe_hw_failed:
+ qla2x00_mem_free(ha);
+ qla2x00_free_req_que(ha, req);
+ qla2x00_free_rsp_que(ha, rsp);
qla2x00_clear_drv_active(ha);
iospace_config_failed:
--
2.12.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH 2/8] qla2xxx: Fix recursion while sending terminate exchange
2018-01-16 4:46 [PATCH 0/8] qla2xxx: Minor fixes for the driver Himanshu Madhani
2018-01-16 4:46 ` [PATCH 1/8] qla2xxx: Fix NULL pointer crash due to probe failure Himanshu Madhani
@ 2018-01-16 4:46 ` Himanshu Madhani
2018-01-16 4:46 ` [PATCH 3/8] qla2xxx: Fix warning in qla2x00_async_iocb_timeout() Himanshu Madhani
` (6 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: Himanshu Madhani @ 2018-01-16 4:46 UTC (permalink / raw)
To: James.Bottomley, martin.petersen; +Cc: himanshu.madhani, linux-scsi
During error test case where switch port status is toggled
from enable to disable, following stack trace is seen which
indicates recursion trying to send terminate exchange.
This regression was introduced by commit 82de802ad46e
("scsi: qla2xxx: Preparation for Target MQ.")
BUG: stack guard page was hit at ffffb96488383ff8 (stack is ffffb96488384000..ffffb96488387fff)
BUG: stack guard page was hit at ffffb964886c3ff8 (stack is ffffb964886c4000..ffffb964886c7fff)
kernel stack overflow (double-fault): 0000 [#1] SMP
qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
Fixes: 82de802ad46e ("scsi: qla2xxx: Preparation for Target MQ.")
Cc: <stable@vger.kernel.org> #4.10
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
---
drivers/scsi/qla2xxx/qla_target.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 0d3c3f647f91..cc80e57675e4 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3756,7 +3756,7 @@ static int qlt_term_ctio_exchange(struct qla_qpair *qpair, void *ctio,
term = 1;
if (term)
- qlt_term_ctio_exchange(qpair, ctio, cmd, status);
+ qlt_send_term_exchange(qpair, cmd, &cmd->atio, 1, 0);
return term;
}
--
2.12.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH 3/8] qla2xxx: Fix warning in qla2x00_async_iocb_timeout()
2018-01-16 4:46 [PATCH 0/8] qla2xxx: Minor fixes for the driver Himanshu Madhani
2018-01-16 4:46 ` [PATCH 1/8] qla2xxx: Fix NULL pointer crash due to probe failure Himanshu Madhani
2018-01-16 4:46 ` [PATCH 2/8] qla2xxx: Fix recursion while sending terminate exchange Himanshu Madhani
@ 2018-01-16 4:46 ` Himanshu Madhani
2018-01-16 4:46 ` [PATCH 4/8] qla2xxx: Fix warning during port_name debug print Himanshu Madhani
` (5 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: Himanshu Madhani @ 2018-01-16 4:46 UTC (permalink / raw)
To: James.Bottomley, martin.petersen; +Cc: himanshu.madhani, linux-scsi
This patch fixes following Smatch warning
drivers/scsi/qla2xxx/qla_init.c:130 qla2x00_async_iocb_timeout() error: we previously assumed 'fcport' could be null (see line 107)
Fixes: 5c25d451163c ("scsi: qla2xxx: Fix NULL pointer access for fcport structure")
Reported by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
---
drivers/scsi/qla2xxx/qla_init.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 9c08222e4c8b..08ad1a60cb0d 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -117,6 +117,8 @@ qla2x00_async_iocb_timeout(void *data)
switch (sp->type) {
case SRB_LOGIN_CMD:
+ if (!fcport)
+ break;
/* Retry as needed. */
lio->u.logio.data[0] = MBS_COMMAND_ERROR;
lio->u.logio.data[1] = lio->u.logio.flags & SRB_LOGIN_RETRIED ?
@@ -130,6 +132,8 @@ qla2x00_async_iocb_timeout(void *data)
qla24xx_handle_plogi_done_event(fcport->vha, &ea);
break;
case SRB_LOGOUT_CMD:
+ if (!fcport)
+ break;
qlt_logo_completion_handler(fcport, QLA_FUNCTION_TIMEOUT);
break;
case SRB_CT_PTHRU_CMD:
--
2.12.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH 4/8] qla2xxx: Fix warning during port_name debug print
2018-01-16 4:46 [PATCH 0/8] qla2xxx: Minor fixes for the driver Himanshu Madhani
` (2 preceding siblings ...)
2018-01-16 4:46 ` [PATCH 3/8] qla2xxx: Fix warning in qla2x00_async_iocb_timeout() Himanshu Madhani
@ 2018-01-16 4:46 ` Himanshu Madhani
2018-01-16 4:46 ` [PATCH 5/8] qla2xxx: Fix warning for code intentation in __qla24xx_handle_gpdb_event() Himanshu Madhani
` (4 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: Himanshu Madhani @ 2018-01-16 4:46 UTC (permalink / raw)
To: James.Bottomley, martin.petersen; +Cc: himanshu.madhani, linux-scsi
This patch fixes following smatch warning
drivers/scsi/qla2xxx/qla_iocb.c:2622 qla2x00_els_dcmd2_sp_done() error: '%pC' expects argument of type 'struct clk*', argument 8 has type 'uchar[]'
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
---
drivers/scsi/qla2xxx/qla_iocb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 14a3f6932c9c..2c6a236dff96 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -2620,7 +2620,7 @@ qla2x00_els_dcmd2_sp_done(void *ptr, int res)
struct scsi_qla_host *vha = sp->vha;
ql_dbg(ql_dbg_io + ql_dbg_disc, vha, 0x3072,
- "%s ELS hdl=%x, portid=%06x done %8pC\n",
+ "%s ELS hdl=%x, portid=%06x done %8phC\n",
sp->name, sp->handle, fcport->d_id.b24, fcport->port_name);
complete(&lio->u.els_plogi.comp);
--
2.12.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH 5/8] qla2xxx: Fix warning for code intentation in __qla24xx_handle_gpdb_event()
2018-01-16 4:46 [PATCH 0/8] qla2xxx: Minor fixes for the driver Himanshu Madhani
` (3 preceding siblings ...)
2018-01-16 4:46 ` [PATCH 4/8] qla2xxx: Fix warning during port_name debug print Himanshu Madhani
@ 2018-01-16 4:46 ` Himanshu Madhani
2018-01-16 4:46 ` [PATCH 6/8] qla2xxx: Fix queue ID for async abort with Multiqueue Himanshu Madhani
` (3 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: Himanshu Madhani @ 2018-01-16 4:46 UTC (permalink / raw)
To: James.Bottomley, martin.petersen; +Cc: himanshu.madhani, linux-scsi
This patch fixes following smatch warning
drivers/scsi/qla2xxx/qla_init.c:1054 __qla24xx_handle_gpdb_event() warn: inconsistent indenting
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
---
drivers/scsi/qla2xxx/qla_init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 08ad1a60cb0d..e030ee38fa6f 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1055,7 +1055,7 @@ void __qla24xx_handle_gpdb_event(scsi_qla_host_t *vha, struct event_arg *ea)
ql_dbg(ql_dbg_disc, vha, 0x20d6,
"%s %d %8phC session revalidate success\n",
__func__, __LINE__, ea->fcport->port_name);
- ea->fcport->disc_state = DSC_LOGIN_COMPLETE;
+ ea->fcport->disc_state = DSC_LOGIN_COMPLETE;
}
spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
}
--
2.12.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH 6/8] qla2xxx: Fix queue ID for async abort with Multiqueue
2018-01-16 4:46 [PATCH 0/8] qla2xxx: Minor fixes for the driver Himanshu Madhani
` (4 preceding siblings ...)
2018-01-16 4:46 ` [PATCH 5/8] qla2xxx: Fix warning for code intentation in __qla24xx_handle_gpdb_event() Himanshu Madhani
@ 2018-01-16 4:46 ` Himanshu Madhani
2018-01-16 4:46 ` [PATCH 7/8] qla2xxx: Add XCB counters to debugfs Himanshu Madhani
` (2 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: Himanshu Madhani @ 2018-01-16 4:46 UTC (permalink / raw)
To: James.Bottomley, martin.petersen; +Cc: himanshu.madhani, linux-scsi
From: Darren Trapp <darren.trapp@cavium.com>
Signed-off-by: Darren Trapp <darren.trapp@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
---
drivers/scsi/qla2xxx/qla_def.h | 1 +
drivers/scsi/qla2xxx/qla_init.c | 9 +++++++++
drivers/scsi/qla2xxx/qla_iocb.c | 6 ++++--
3 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index f7396a2e28ba..be7d6824581a 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -442,6 +442,7 @@ struct srb_iocb {
struct {
uint32_t cmd_hndl;
__le16 comp_status;
+ __le16 req_que_no;
struct completion comp;
} abt;
struct ct_arg ctarg;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index e030ee38fa6f..bf1ad9161d11 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1565,6 +1565,12 @@ qla24xx_async_abort_cmd(srb_t *cmd_sp)
sp->name = "abort";
qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha));
abt_iocb->u.abt.cmd_hndl = cmd_sp->handle;
+
+ if (vha->flags.qpairs_available && cmd_sp->qpair)
+ abt_iocb->u.abt.req_que_no = cmd_sp->qpair->req->id;
+ else
+ abt_iocb->u.abt.req_que_no = vha->req->id;
+
sp->done = qla24xx_abort_sp_done;
abt_iocb->timeout = qla24xx_abort_iocb_timeout;
init_completion(&abt_iocb->u.abt.comp);
@@ -1599,6 +1605,9 @@ qla24xx_async_abort_command(srb_t *sp)
struct qla_hw_data *ha = vha->hw;
struct req_que *req = vha->req;
+ if (vha->flags.qpairs_available && sp->qpair)
+ req = sp->qpair->req;
+
spin_lock_irqsave(&ha->hardware_lock, flags);
for (handle = 1; handle < req->num_outstanding_cmds; handle++) {
if (req->outstanding_cmds[handle] == sp)
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 2c6a236dff96..1b62e943ec49 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -3275,7 +3275,9 @@ qla24xx_abort_iocb(srb_t *sp, struct abort_entry_24xx *abt_iocb)
memset(abt_iocb, 0, sizeof(struct abort_entry_24xx));
abt_iocb->entry_type = ABORT_IOCB_TYPE;
abt_iocb->entry_count = 1;
- abt_iocb->handle = cpu_to_le32(MAKE_HANDLE(req->id, sp->handle));
+ abt_iocb->handle =
+ cpu_to_le32(MAKE_HANDLE(aio->u.abt.req_que_no,
+ aio->u.abt.cmd_hndl));
abt_iocb->nport_handle = cpu_to_le16(sp->fcport->loop_id);
abt_iocb->handle_to_abort =
cpu_to_le32(MAKE_HANDLE(req->id, aio->u.abt.cmd_hndl));
@@ -3283,7 +3285,7 @@ qla24xx_abort_iocb(srb_t *sp, struct abort_entry_24xx *abt_iocb)
abt_iocb->port_id[1] = sp->fcport->d_id.b.area;
abt_iocb->port_id[2] = sp->fcport->d_id.b.domain;
abt_iocb->vp_index = vha->vp_idx;
- abt_iocb->req_que_no = cpu_to_le16(req->id);
+ abt_iocb->req_que_no = cpu_to_le16(aio->u.abt.req_que_no);
/* Send the command to the firmware */
wmb();
}
--
2.12.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH 7/8] qla2xxx: Add XCB counters to debugfs
2018-01-16 4:46 [PATCH 0/8] qla2xxx: Minor fixes for the driver Himanshu Madhani
` (5 preceding siblings ...)
2018-01-16 4:46 ` [PATCH 6/8] qla2xxx: Fix queue ID for async abort with Multiqueue Himanshu Madhani
@ 2018-01-16 4:46 ` Himanshu Madhani
2018-01-16 4:46 ` [PATCH 8/8] qla2xxx: Update driver version to 10.00.00.05-k Himanshu Madhani
2018-01-17 6:34 ` [PATCH 0/8] qla2xxx: Minor fixes for the driver Martin K. Petersen
8 siblings, 0 replies; 10+ messages in thread
From: Himanshu Madhani @ 2018-01-16 4:46 UTC (permalink / raw)
To: James.Bottomley, martin.petersen; +Cc: himanshu.madhani, linux-scsi
From: Anil Gurumurthy <anil.gurumurthy@cavium.com>
Signed-off-by: Anil Gurumurthy <anil.gurumurthy@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
---
drivers/scsi/qla2xxx/qla_dfs.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c
index ddb53db61fd2..0b190082aa8d 100644
--- a/drivers/scsi/qla2xxx/qla_dfs.c
+++ b/drivers/scsi/qla2xxx/qla_dfs.c
@@ -143,6 +143,15 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused)
seq_printf(s, "Current IOCB count[%d]\n", mb[10]);
seq_printf(s, "MAX VP count[%d]\n", mb[11]);
seq_printf(s, "MAX FCF count[%d]\n", mb[12]);
+ seq_printf(s, "Current free pageable XCB buffer cnt[%d]\n",
+ mb[20]);
+ seq_printf(s, "Original Initiator fast XCB buffer cnt[%d]\n",
+ mb[21]);
+ seq_printf(s, "Current free Initiator fast XCB buffer cnt[%d]\n",
+ mb[22]);
+ seq_printf(s, "Original Target fast XCB buffer cnt[%d]\n",
+ mb[23]);
+
}
return 0;
--
2.12.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH 8/8] qla2xxx: Update driver version to 10.00.00.05-k
2018-01-16 4:46 [PATCH 0/8] qla2xxx: Minor fixes for the driver Himanshu Madhani
` (6 preceding siblings ...)
2018-01-16 4:46 ` [PATCH 7/8] qla2xxx: Add XCB counters to debugfs Himanshu Madhani
@ 2018-01-16 4:46 ` Himanshu Madhani
2018-01-17 6:34 ` [PATCH 0/8] qla2xxx: Minor fixes for the driver Martin K. Petersen
8 siblings, 0 replies; 10+ messages in thread
From: Himanshu Madhani @ 2018-01-16 4:46 UTC (permalink / raw)
To: James.Bottomley, martin.petersen; +Cc: himanshu.madhani, linux-scsi
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
---
drivers/scsi/qla2xxx/qla_version.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 0843def08356..549bef9afddd 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
/*
* Driver version
*/
-#define QLA2XXX_VERSION "10.00.00.04-k"
+#define QLA2XXX_VERSION "10.00.00.05-k"
#define QLA_DRIVER_MAJOR_VER 10
#define QLA_DRIVER_MINOR_VER 0
--
2.12.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH 0/8] qla2xxx: Minor fixes for the driver
2018-01-16 4:46 [PATCH 0/8] qla2xxx: Minor fixes for the driver Himanshu Madhani
` (7 preceding siblings ...)
2018-01-16 4:46 ` [PATCH 8/8] qla2xxx: Update driver version to 10.00.00.05-k Himanshu Madhani
@ 2018-01-17 6:34 ` Martin K. Petersen
8 siblings, 0 replies; 10+ messages in thread
From: Martin K. Petersen @ 2018-01-17 6:34 UTC (permalink / raw)
To: Himanshu Madhani; +Cc: James.Bottomley, martin.petersen, linux-scsi
Himanshu,
> This series has fixes for smatch warnings. Patch 3 addresses smatch
> warning reported by Dan Carpenter. We've also added a patch for async
> abort handling for initiator multiqueue in the driver along with a
> patch for NULL pointer access during probe failure.
Applied to 4.16/scsi-queue, thank you!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 10+ messages in thread