From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"Bart Van Assche" <bart.vanassche@wdc.com>,
"Sagi Grimberg" <sagi@grimberg.me>,
"Doug Ledford" <dledford@redhat.com>
Subject: [PATCH 3.2 10/79] IB/srp: Avoid that a cable pull can trigger a kernel crash
Date: Sun, 11 Feb 2018 04:20:06 +0000 [thread overview]
Message-ID: <lsq.1518322806.325817887@decadent.org.uk> (raw)
In-Reply-To: <lsq.1518322802.943358572@decadent.org.uk>
3.2.99-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@wdc.com>
commit 8a0d18c62121d3c554a83eb96e2752861d84d937 upstream.
This patch fixes the following kernel crash:
general protection fault: 0000 [#1] PREEMPT SMP
Workqueue: ib_mad2 timeout_sends [ib_core]
Call Trace:
ib_sa_path_rec_callback+0x1c4/0x1d0 [ib_core]
send_handler+0xb2/0xd0 [ib_core]
timeout_sends+0x14d/0x220 [ib_core]
process_one_work+0x200/0x630
worker_thread+0x4e/0x3b0
kthread+0x113/0x150
Fixes: commit aef9ec39c47f ("IB: Add SCSI RDMA Protocol (SRP) initiator")
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -310,10 +310,19 @@ static void srp_path_rec_completion(int
static int srp_lookup_path(struct srp_target_port *target)
{
+ int ret = -ENODEV;
+
target->path.numb_path = 1;
init_completion(&target->done);
+ /*
+ * Avoid that the SCSI host can be removed by srp_remove_target()
+ * before srp_path_rec_completion() is called.
+ */
+ if (!scsi_host_get(target->scsi_host))
+ goto out;
+
target->path_query_id = ib_sa_path_rec_get(&srp_sa_client,
target->srp_host->srp_dev->dev,
target->srp_host->port,
@@ -327,16 +336,22 @@ static int srp_lookup_path(struct srp_ta
GFP_KERNEL,
srp_path_rec_completion,
target, &target->path_query);
- if (target->path_query_id < 0)
- return target->path_query_id;
+ ret = target->path_query_id;
+ if (ret < 0)
+ goto put;
wait_for_completion(&target->done);
- if (target->status < 0)
+ ret = target->status;
+ if (ret < 0)
shost_printk(KERN_WARNING, target->scsi_host,
PFX "Path record query failed\n");
- return target->status;
+put:
+ scsi_host_put(target->scsi_host);
+
+out:
+ return ret;
}
static int srp_send_req(struct srp_target_port *target)
next prev parent reply other threads:[~2018-02-11 4:33 UTC|newest]
Thread overview: 85+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-11 4:20 [PATCH 3.2 00/79] 3.2.99-rc1 review Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 48/79] nfs: Fix ugly referral attributes Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 31/79] USB: usbfs: compute urb->actual_length for isochronous Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 09/79] scsi: bfa: integer overflow in debugfs Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 59/79] ALSA: hda: Add Raven PCI ID Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 22/79] media: omap_vout: Fix a possible null pointer dereference in omap_vout_open() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 52/79] autofs: fix careless error in recent commit Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 29/79] x86/smp: Don't ever patch back to UP if we unplug cpus Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 50/79] autofs4: catatonic_mode vs. notify_daemon race Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 38/79] ocfs2: fix issue that ocfs2_setattr() does not deal with new_i_size==i_size Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 44/79] dm: discard support requires all targets in a table support discards Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 33/79] rt2x00usb: mark device removed when get ENOENT usb error Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 39/79] ocfs2: should wait dio before inode lock in ocfs2_setattr() Ben Hutchings
2018-02-11 7:39 ` alex chen
2018-02-11 18:01 ` Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 23/79] mtd: nand: Fix writing mtdoops to nand flash Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 27/79] eCryptfs: use after free in ecryptfs_release_messaging() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 02/79] rtc: interface: ignore expired timers when enqueuing new timers Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 05/79] USB: serial: garmin_gps: fix I/O after failed probe and remove Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 19/79] l2tp: initialise l2tp_eth sessions before registering them Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 46/79] KVM: vmx: Inject #GP on invalid PAT CR Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 12/79] fs/9p: Compare qid.path in v9fs_test_inode Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 16/79] l2tp: push all ppp pseudowire shutdown through .release handler Ben Hutchings
2018-02-11 4:20 ` Ben Hutchings [this message]
2018-02-11 4:20 ` [PATCH 3.2 54/79] ALSA: timer: Remove kernel warning at compat ioctl error paths Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 76/79] usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 41/79] sctp: Fixup v4mapped behaviour to comply with Sock API Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 07/79] media: rc: check for integer overflow Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 26/79] coda: fix 'kernel memory exposure attempt' in fsync Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 01/79] Input: adxl34x - do not treat FIFO_MODE() as boolean Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 28/79] media: Don't do DMA on stack for firmware upload in the AS102 driver Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 32/79] video: udlfb: Fix read EDID timeout Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 13/79] net/9p: Switch to wait_event_killable() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 71/79] usbip: Fix sscanf handling Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 74/79] usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 17/79] l2tp: ensure sessions are freed after their PPPOL2TP socket Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 25/79] USB: Add delay-init quirk for Corsair K70 LUX keyboards Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 49/79] autofs4: autofs4_wait() vs. autofs4_catatonic_mode() race Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 35/79] blktrace: Fix potential deadlock between delete & sysfs ops Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 47/79] KVM: SVM: obey guest PAT Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 42/79] sctp: fully initialize the IPv6 address in sctp_v6_to_addr() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 55/79] ALSA: usb-audio: Add sanity checks to FE parser Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 73/79] usbip: fix stub_rx: get_pipe() to validate endpoint number Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 78/79] kaiser: Set _PAGE_NX only if supported Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 65/79] netfilter: xt_TCPMSS: correct return value in tcpmss_mangle_packet Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 72/79] usb: add helper to extract bits 12:11 of wMaxPacketSize Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 11/79] tpm-dev-common: Reject too short writes Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 34/79] dm: fix race between dm_get_from_kobject() and __dm_destroy() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 64/79] netfilter: xt_TCPMSS: fix handling of malformed TCP header and options Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 77/79] [media] cx231xx: Fix the max number of interfaces Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 51/79] autofs: don't fail mount for transient error Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 06/79] USB: serial: garmin_gps: fix memory leak on probe errors Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 20/79] l2tp: protect sock pointer of struct pppol2tp_session with RCU Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 60/79] x86/decoder: Add new TEST instruction pattern Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 62/79] netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 14/79] l2tp: add session reorder queue purge function to core Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 69/79] ALSA: seq: Make ioctls race-free Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 04/79] PCI/AER: Report non-fatal errors only to the affected endpoint Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 43/79] net/sctp: Always set scope_id in sctp_inet6_skb_msgname Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 45/79] dm bufio: fix integer overflow when limiting maximum cache size Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 21/79] l2tp: initialise PPP sessions before registering them Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 61/79] netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 56/79] ALSA: usb-audio: Fix potential out-of-bound access at parsing SU Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 58/79] ALSA: usb-audio: Add sanity checks in v2 clock parsers Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 53/79] nilfs2: fix race condition that causes file system corruption Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 37/79] IB/mlx4: Increase maximal message size under UD QP Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 24/79] isofs: fix timestamps beyond 2027 Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 40/79] s390/disassembler: increase show_code buffer size Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 30/79] kprobes, x86/alternatives: Use text_mutex to protect smp_alt_modules Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 75/79] usbip: prevent vhci_hcd driver from leaking a socket pointer address Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 03/79] rtc: set the alarm to the next expiring timer Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 18/79] l2tp: don't register sessions in l2tp_session_create() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 79/79] kaiser: Set _PAGE_NX only if supported Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 63/79] netfilter: xt_TCPMSS: Fix missing fragmentation handling Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 67/79] RDS: Heap OOB write in rds_message_alloc_sgs() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 57/79] ALSA: usb-audio: Fix potential zero-division at parsing FU Ben Hutchings
2018-02-12 6:59 ` Takashi Iwai
2018-02-13 18:28 ` Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 66/79] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 68/79] RDS: null pointer dereference in rds_atomic_free_op Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 15/79] l2tp: purge session reorder queue on delete Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 36/79] blktrace: fix unlocked access to init/start-stop/teardown Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 08/79] KVM: nVMX: set IDTR and GDTR limits when loading L1 host state Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 70/79] staging: usbip: removed #if 0'd out code Ben Hutchings
2018-02-11 11:18 ` [PATCH 3.2 00/79] 3.2.99-rc1 review Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1518322806.325817887@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=bart.vanassche@wdc.com \
--cc=dledford@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sagi@grimberg.me \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox