From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Logan Gunthorpe <logang@deltatee.com>,
Intel SCU Linux support <intel-linux-scu@intel.com>,
Artur Paszkiewicz <artur.paszkiewicz@intel.com>,
"James E.J. Bottomley" <jejb@linux.ibm.com>,
"Martin K. Petersen" <martin.petersen@oracle.com>,
Christoph Hellwig <hch@lst.de>, Jens Axboe <axboe@kernel.dk>,
Jeff Moyer <jmoyer@redhat.com>, Sasha Levin <sashal@kernel.org>,
linux-scsi@vger.kernel.org
Subject: [PATCH AUTOSEL 4.20 040/105] scsi: isci: initialize shost fully before calling scsi_add_host()
Date: Tue, 12 Feb 2019 21:32:31 -0500 [thread overview]
Message-ID: <20190213023336.19019-40-sashal@kernel.org> (raw)
In-Reply-To: <20190213023336.19019-1-sashal@kernel.org>
From: Logan Gunthorpe <logang@deltatee.com>
[ Upstream commit cc29a1b0a3f2597ce887d339222fa85b9307706d ]
scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates the
command size to allocate based on the prot_capabilities. In the isci
driver, scsi_host_set_prot() is called after scsi_add_host() so the command
size gets calculated to be smaller than it needs to be. Eventually,
scsi_mq_init_request() locates the 'prot_sdb' after the command assuming it
was sized correctly and a buffer overrun may occur.
However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line
size, the mistake can go unnoticed.
The bug was noticed after the struct request size was reduced by commit
9d037ad707ed ("block: remove req->timeout_list")
Which likely reduced the allocated space for the request by an entire cache
line, enough that the overflow could be hit and it caused a panic, on boot,
at:
RIP: 0010:t10_pi_complete+0x77/0x1c0
Call Trace:
<IRQ>
sd_done+0xf5/0x340
scsi_finish_command+0xc3/0x120
blk_done_softirq+0x83/0xb0
__do_softirq+0xa1/0x2e6
irq_exit+0xbc/0xd0
call_function_single_interrupt+0xf/0x20
</IRQ>
sd_done() would call scsi_prot_sg_count() which reads the number of
entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of
the allocated space it reads a garbage number and erroneously calls
t10_pi_complete().
To prevent this, the calls to scsi_host_set_prot() are moved into
isci_host_alloc() before the call to scsi_add_host(). Out of caution, also
move the similar call to scsi_host_set_guard().
Fixes: 3d2d75254915 ("[SCSI] isci: T10 DIF support")
Link: http://lkml.kernel.org/r/da851333-eadd-163a-8c78-e1f4ec5ec857@deltatee.com
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Cc: Intel SCU Linux support <intel-linux-scu@intel.com>
Cc: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Jeff Moyer <jmoyer@redhat.com>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/isci/init.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
index 08c7b1e25fe4..dde84f744313 100644
--- a/drivers/scsi/isci/init.c
+++ b/drivers/scsi/isci/init.c
@@ -588,6 +588,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id)
shost->max_lun = ~0;
shost->max_cmd_len = MAX_COMMAND_SIZE;
+ /* turn on DIF support */
+ scsi_host_set_prot(shost,
+ SHOST_DIF_TYPE1_PROTECTION |
+ SHOST_DIF_TYPE2_PROTECTION |
+ SHOST_DIF_TYPE3_PROTECTION);
+ scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC);
+
err = scsi_add_host(shost, &pdev->dev);
if (err)
goto err_shost;
@@ -675,13 +682,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
goto err_host_alloc;
}
pci_info->hosts[i] = h;
-
- /* turn on DIF support */
- scsi_host_set_prot(to_shost(h),
- SHOST_DIF_TYPE1_PROTECTION |
- SHOST_DIF_TYPE2_PROTECTION |
- SHOST_DIF_TYPE3_PROTECTION);
- scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC);
}
err = isci_setup_interrupts(pdev);
--
2.19.1
next prev parent reply other threads:[~2019-02-13 3:03 UTC|newest]
Thread overview: 105+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-13 2:31 [PATCH AUTOSEL 4.20 001/105] backlight: pwm_bl: Fix devicetree parsing with auto-generated brightness tables Sasha Levin
2019-02-13 2:31 ` [PATCH AUTOSEL 4.20 002/105] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
2019-02-13 2:31 ` [PATCH AUTOSEL 4.20 003/105] pvcalls-front: read all data before closing the connection Sasha Levin
2019-02-13 2:31 ` [PATCH AUTOSEL 4.20 004/105] pvcalls-front: don't try to free unallocated rings Sasha Levin
2019-02-13 2:31 ` [PATCH AUTOSEL 4.20 005/105] pvcalls-front: properly allocate sk Sasha Levin
2019-02-13 2:31 ` [PATCH AUTOSEL 4.20 006/105] pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read Sasha Levin
2019-02-13 2:31 ` [PATCH AUTOSEL 4.20 007/105] mfd: twl-core: Fix section annotations on {,un}protect_pm_master Sasha Levin
2019-02-13 2:31 ` [PATCH AUTOSEL 4.20 008/105] mfd: db8500-prcmu: Fix some section annotations Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 009/105] mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 010/105] mfd: ab8500-core: Return zero in get_register_interruptible() Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 011/105] mfd: bd9571mwv: Add volatile register to make DVFS work Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 012/105] mfd: at91-usart: Add platform dependency Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 013/105] mfd: qcom_rpm: write fw_version to CTRL_REG Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 014/105] mfd: wm5110: Add missing ASRC rate register Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 015/105] mfd: axp20x: Add AC power supply cell for AXP813 Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 016/105] mfd: axp20x: Re-align MFD cell entries Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 017/105] mfd: axp20x: Add supported cells for AXP803 Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 018/105] mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 019/105] mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path in probe() Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 020/105] mfd: mc13xxx: Fix a missing check of a register-read failure Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 021/105] xen/pvcalls: remove set but not used variable 'intf' Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 022/105] soc/fsl/qe: fix err handling of ucc_of_parse_tdm Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 023/105] qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page count Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 024/105] qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 025/105] net: hns: Fix use after free identified by SLUB debug Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 026/105] selftests: net: fix/improve ip_defrag selftest Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 027/105] bpf: Fix [::] -> [::1] rewrite in sys_sendmsg Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 028/105] selftests/bpf: Test [::] -> [::1] rewrite in sys_sendmsg in test_sock_addr Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 029/105] hwmon: (nct6775) Fix chip ID for NCT6798D Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 030/105] hwmon: (nct6775) Enable IO mapping for NCT6797D and NCT6798D Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 031/105] watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 032/105] net/mlx4: Get rid of page operation after dma_alloc_coherent Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 033/105] MIPS: ath79: Enable OF serial ports in the default config Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 034/105] xprtrdma: Double free in rpcrdma_sendctxs_create() Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 035/105] mlxsw: spectrum_acl: Add cleanup after C-TCAM update error condition Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 036/105] mlxsw: spectrum: Add VXLAN dependency for spectrum Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 037/105] selftests: forwarding: Add a test for VLAN deletion Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 038/105] netfilter: nf_tables: fix leaking object reference count Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 039/105] scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param Sasha Levin
2019-02-13 2:32 ` Sasha Levin [this message]
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 041/105] include/linux/compiler*.h: fix OPTIMIZER_HIDE_VAR Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 042/105] MIPS: jazz: fix 64bit build Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 043/105] netfilter: nft_flow_offload: Fix reverse route lookup Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 044/105] bpf: correctly set initial window on active Fast Open sender Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 045/105] pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 046/105] selftests: bpf: install files tcp_(server|client)*.py Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 047/105] bpf: fix panic in stack_map_get_build_id() on i386 and arm32 Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 048/105] afs: Set correct lock type for the yfs CreateFile Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 049/105] netfilter: nft_flow_offload: fix interaction with vrf slave device Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 050/105] RDMA/mthca: Clear QP objects during their allocation Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 051/105] powerpc/8xx: fix setting of pagetable for Abatron BDI debug tool Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 052/105] acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 053/105] net: stmmac: Fix PCI module removal leak Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 054/105] net: stmmac: dwxgmac2: Only clear interrupts that are active Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 055/105] net: stmmac: Check if CBS is supported before configuring Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 056/105] net: stmmac: Fix the logic of checking if RX Watchdog must be enabled Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 057/105] net: stmmac: Prevent RX starvation in stmmac_napi_poll() Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 058/105] isdn: i4l: isdn_tty: Fix some concurrency double-free bugs Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 059/105] scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 060/105] scsi: ufs: Fix system suspend status Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 061/105] scsi: qedi: Add ep_state for login completion on un-reachable targets Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 062/105] scsi: ufs: Fix geometry descriptor size Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 063/105] scsi: qla1280: set 64bit coherent mask Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 064/105] scsi: cxgb4i: add wait_for_completion() Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 065/105] netfilter: nft_flow_offload: fix checking method of conntrack helper Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 066/105] always clear the X2APIC_ENABLE bit for PV guest Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 067/105] drm/meson: add missing of_node_put Sasha Levin
2019-02-13 2:32 ` [PATCH AUTOSEL 4.20 068/105] drm/amdkfd: Don't assign dGPUs to APU topology devices Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 069/105] drm/amd/display: fix PME notification not working in RV desktop Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 070/105] vhost: return EINVAL if iovecs size does not match the message size Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 071/105] vhost/scsi: Use copy_to_iter() to send control queue response Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 072/105] xsk: Check if a queue exists during umem setup Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 073/105] selftests/bpf: install with_tunnels.sh for test_flow_dissector.sh Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 074/105] samples/bpf: workaround clang asm goto compilation errors Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 075/105] SUNRPC: Ensure rq_bytes_sent is reset before request transmission Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 076/105] SUNRPC: Ensure we respect the RPCSEC_GSS sequence number limit Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 077/105] drm/sun4i: backend: add missing of_node_puts Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 078/105] pvcalls-front: fix potential null dereference Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 079/105] ACPI: EC: Look for ECDT EC after calling acpi_load_tables() Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 080/105] net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ9031 Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 081/105] selftests: tc-testing: drop test on missing tunnel key id Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 082/105] selftests: tc-testing: fix tunnel_key failure if dst_port is unspecified Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 083/105] selftests: tc-testing: fix parsing of ife type Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 084/105] PCI: Fix __initdata issue with "pci=disable_acs_redir" parameter Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 085/105] afs: Don't set vnode->cb_s_break in afs_validate() Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 086/105] afs: Fix key refcounting in file locking code Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 087/105] afs: Provide a function to get a ref on a call Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 088/105] afs: Fix race in async call refcounting Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 089/105] bpf: don't assume build-id length is always 20 bytes Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 090/105] bpf: zero out build_id for BPF_STACK_BUILD_ID_IP Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 091/105] selftests/bpf: retry tests that expect build-id Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 092/105] atm: he: fix sign-extension overflow on large shift Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 093/105] hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 094/105] leds: lp5523: fix a missing check of return value of lp55xx_read Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 095/105] bpf: bpf_setsockopt: reset sock dst on SO_MARK changes Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 096/105] bpf: fix SO_MAX_PACING_RATE to support TCP internal pacing Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 097/105] dpaa_eth: NETIF_F_LLTX requires to do our own update of trans_start Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 098/105] mlxsw: pci: Return error on PCI reset timeout Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 099/105] net: bridge: Mark FDB entries that were added by user as such Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 100/105] mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 101/105] selftests: forwarding: Add a test case for externally learned FDB entries Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 102/105] bpf: pull in pkt_sched.h header for tooling to fix bpftool build Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 103/105] net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 104/105] net/mlx5e: Fix wrong (zero) TX drop counter indication for representor Sasha Levin
2019-02-13 2:33 ` [PATCH AUTOSEL 4.20 105/105] isdn: avm: Fix string plus integer warning from Clang Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190213023336.19019-40-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=artur.paszkiewicz@intel.com \
--cc=axboe@kernel.dk \
--cc=hch@lst.de \
--cc=intel-linux-scu@intel.com \
--cc=jejb@linux.ibm.com \
--cc=jmoyer@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=logang@deltatee.com \
--cc=martin.petersen@oracle.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox