From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-eopbgr730136.outbound.protection.outlook.com ([40.107.73.136]:54496 "EHLO NAM05-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1728861AbeIOGsq (ORCPT ); Sat, 15 Sep 2018 02:48:46 -0400 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: James Smart , Dick Kennedy , James Smart , "Martin K . Petersen" , Sasha Levin Subject: [PATCH AUTOSEL 4.18 73/92] scsi: lpfc: Fix panic if driver unloaded when port is offline Date: Sat, 15 Sep 2018 01:30:40 +0000 Message-ID: <20180915012944.179481-72-alexander.levin@microsoft.com> References: <20180915012944.179481-1-alexander.levin@microsoft.com> In-Reply-To: <20180915012944.179481-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: James Smart [ Upstream commit d580c6137476ab307a66e278cf7dbc666230f714 ] System crashes when the lpfc module is unloaded after making the port offline The nvme queue pointers were freed during port offline, but were later accessed in pci remove path. Validate the pointers in pci remove path before accessing them. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/lpfc/lpfc_nvme.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c index 76a5a99605aa..ada5a2aaee82 100644 --- a/drivers/scsi/lpfc/lpfc_nvme.c +++ b/drivers/scsi/lpfc/lpfc_nvme.c @@ -2970,7 +2970,7 @@ lpfc_nvme_wait_for_io_drain(struct lpfc_hba *phba) struct lpfc_sli_ring *pring; u32 i, wait_cnt =3D 0; =20 - if (phba->sli_rev < LPFC_SLI_REV4) + if (phba->sli_rev < LPFC_SLI_REV4 || !phba->sli4_hba.nvme_wq) return; =20 /* Cycle through all NVME rings and make sure all outstanding @@ -2979,6 +2979,9 @@ lpfc_nvme_wait_for_io_drain(struct lpfc_hba *phba) for (i =3D 0; i < phba->cfg_nvme_io_channel; i++) { pring =3D phba->sli4_hba.nvme_wq[i]->pring; =20 + if (!pring) + continue; + /* Retrieve everything on the txcmplq */ while (!list_empty(&pring->txcmplq)) { msleep(LPFC_XRI_EXCH_BUSY_WAIT_T1); --=20 2.17.1