From: Dan Carpenter <dan.carpenter@linaro.org>
To: oe-kbuild@lists.linux.dev, Tony Battersby <tonyb@cybernetics.com>,
Nilesh Javali <njavali@marvell.com>,
GR-QLogic-Storage-Upstream@marvell.com,
"James E.J. Bottomley" <James.Bottomley@hansenpartnership.com>,
"Martin K. Petersen" <martin.petersen@oracle.com>
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
linux-scsi <linux-scsi@vger.kernel.org>,
target-devel@vger.kernel.org, scst-devel@lists.sourceforge.net,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Dmitry Bogdanov <d.bogdanov@yadro.com>,
Xose Vazquez Perez <xose.vazquez@gmail.com>
Subject: Re: [PATCH v2 11/16] scsi: qla2xxx: fix TMR failure handling
Date: Fri, 3 Oct 2025 11:40:33 +0300 [thread overview]
Message-ID: <202510031227.18psESZQ-lkp@intel.com> (raw)
In-Reply-To: <f52cda16-4952-4b28-bbf7-d44f4e054490@cybernetics.com>
Hi Tony,
kernel test robot noticed the following build warnings:
url: https://github.com/intel-lab-lkp/linux/commits/Tony-Battersby/Revert-scsi-qla2xxx-Perform-lockless-command-completion-in-abort-path/20250930-024814
base: e5f0a698b34ed76002dc5cff3804a61c80233a7a
patch link: https://lore.kernel.org/r/f52cda16-4952-4b28-bbf7-d44f4e054490%40cybernetics.com
patch subject: [PATCH v2 11/16] scsi: qla2xxx: fix TMR failure handling
config: i386-randconfig-141-20251002 (https://download.01.org/0day-ci/archive/20251003/202510031227.18psESZQ-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202510031227.18psESZQ-lkp@intel.com/
New smatch warnings:
drivers/scsi/qla2xxx/qla_target.c:5735 qlt_handle_abts_completion() error: we previously assumed 'mcmd' could be null (see line 5723)
Old smatch warnings:
drivers/scsi/qla2xxx/qla_target.c:671 qla24xx_delete_sess_fn() warn: can 'fcport' even be NULL?
vim +/mcmd +5735 drivers/scsi/qla2xxx/qla_target.c
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5706 static void qlt_handle_abts_completion(struct scsi_qla_host *vha,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5707 struct rsp_que *rsp, response_t *pkt)
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5708 {
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5709 struct abts_resp_from_24xx_fw *entry =
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5710 (struct abts_resp_from_24xx_fw *)pkt;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5711 u32 h = pkt->handle & ~QLA_TGT_HANDLE_MASK;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5712 struct qla_tgt_mgmt_cmd *mcmd;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5713 struct qla_hw_data *ha = vha->hw;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5714
81bcf1c5cf0ee87 Bart Van Assche 2019-04-11 5715 mcmd = qlt_ctio_to_cmd(vha, rsp, pkt->handle, pkt);
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5716 if (mcmd == NULL && h != QLA_TGT_SKIP_HANDLE) {
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5717 ql_dbg(ql_dbg_async, vha, 0xe064,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5718 "qla_target(%d): ABTS Comp without mcmd\n",
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5719 vha->vp_idx);
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5720 return;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5721 }
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5722
6b0431d6fa20bd1 Quinn Tran 2018-09-04 @5723 if (mcmd)
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5724 vha = mcmd->vha;
mcmd can be NULL
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5725 vha->vha_tgt.qla_tgt->abts_resp_expected--;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5726
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5727 ql_dbg(ql_dbg_tgt, vha, 0xe038,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5728 "ABTS_RESP_24XX: compl_status %x\n",
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5729 entry->compl_status);
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5730
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5731 if (le16_to_cpu(entry->compl_status) != ABTS_RESP_COMPL_SUCCESS) {
7ffa5b939751b66 Bart Van Assche 2020-05-18 5732 if (le32_to_cpu(entry->error_subcode1) == 0x1E &&
7ffa5b939751b66 Bart Van Assche 2020-05-18 5733 le32_to_cpu(entry->error_subcode2) == 0) {
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5734 if (qlt_chk_unresolv_exchg(vha, rsp->qpair, entry)) {
74dabbbd8bb833e Tony Battersby 2025-09-29 @5735 qlt_free_ul_mcmd(ha, mcmd);
^^^^
But here it is dereferenced without checking. Previously it called
tcm_qla2xxx_free_mcmd() which checks for NULL.
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5736 return;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5737 }
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5738 qlt_24xx_retry_term_exchange(vha, rsp->qpair,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5739 pkt, mcmd);
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5740 } else {
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5741 ql_dbg(ql_dbg_tgt, vha, 0xe063,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5742 "qla_target(%d): ABTS_RESP_24XX failed %x (subcode %x:%x)",
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5743 vha->vp_idx, entry->compl_status,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5744 entry->error_subcode1,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5745 entry->error_subcode2);
74dabbbd8bb833e Tony Battersby 2025-09-29 5746 qlt_free_ul_mcmd(ha, mcmd);
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5747 }
e752a04e1bd14cc Bart Van Assche 2019-08-08 5748 } else if (mcmd) {
74dabbbd8bb833e Tony Battersby 2025-09-29 5749 qlt_free_ul_mcmd(ha, mcmd);
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5750 }
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5751 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next prev parent reply other threads:[~2025-10-03 8:40 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-29 14:28 [PATCH v2 00/16] qla2xxx target mode improvements Tony Battersby
2025-09-29 14:30 ` [PATCH v2 01/16] Revert "scsi: qla2xxx: Perform lockless command completion in abort path" Tony Battersby
2025-09-29 14:32 ` [PATCH v2 02/16] scsi: qla2xxx: fix initiator mode with qlini_mode=exclusive Tony Battersby
2025-09-29 14:33 ` [PATCH v2 03/16] scsi: qla2xxx: fix lost interrupts with qlini_mode=disabled Tony Battersby
2025-09-29 14:34 ` [PATCH v2 04/16] scsi: qla2xxx: use reinit_completion on mbx_intr_comp Tony Battersby
2025-09-29 14:35 ` [PATCH v2 05/16] scsi: qla2xxx: remove code for unsupported hardware Tony Battersby
2025-09-29 14:36 ` [PATCH v2 06/16] scsi: qla2xxx: improve debug output for term exchange Tony Battersby
2025-09-29 14:37 ` [PATCH v2 07/16] scsi: qla2xxx: fix term exchange when cmd_sent_to_fw == 1 Tony Battersby
2025-09-29 14:38 ` [PATCH v2 08/16] scsi: qla2xxx: clear cmds after chip reset Tony Battersby
2025-09-29 14:39 ` [PATCH v2 09/16] scsi: qla2xxx: fix races with aborting commands Tony Battersby
2025-09-29 14:41 ` [SCST PATCH " Tony Battersby
2025-09-29 14:42 ` [PATCH v2 10/16] scsi: qla2xxx: improve checks in qlt_xmit_response / qlt_rdy_to_xfer Tony Battersby
2025-09-29 14:43 ` [PATCH v2 11/16] scsi: qla2xxx: fix TMR failure handling Tony Battersby
2025-10-03 8:40 ` Dan Carpenter [this message]
2025-10-03 14:38 ` [PATCH v3 " Tony Battersby
2025-09-29 14:44 ` [PATCH v2 12/16] scsi: qla2xxx: fix invalid memory access with big CDBs Tony Battersby
2025-09-29 14:45 ` [SCST PATCH " Tony Battersby
2025-09-29 14:47 ` [PATCH v2 13/16] scsi: qla2xxx: add cmd->rsp_sent Tony Battersby
2025-09-29 14:48 ` [SCST PATCH " Tony Battersby
2025-09-29 14:49 ` [PATCH v2 14/16] scsi: qla2xxx: improve cmd logging Tony Battersby
2025-09-29 14:50 ` [PATCH v2 15/16] scsi: qla2xxx: add back SRR support Tony Battersby
2025-09-29 14:51 ` [SCST PATCH " Tony Battersby
2025-09-29 14:53 ` [PATCH v2 16/16] scsi: qla2xxx: improve safety of cmd lookup by handle Tony Battersby
2025-09-29 14:54 ` [SCST PATCH v2] qla2x00t-32gbit: add on_abort_cmd callback Tony Battersby
2025-11-03 15:44 ` [PATCH v2 00/16] qla2xxx target mode improvements Tony Battersby
2025-11-08 17:03 ` Martin K. Petersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202510031227.18psESZQ-lkp@intel.com \
--to=dan.carpenter@linaro.org \
--cc=GR-QLogic-Storage-Upstream@marvell.com \
--cc=James.Bottomley@hansenpartnership.com \
--cc=d.bogdanov@yadro.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=lkp@intel.com \
--cc=martin.petersen@oracle.com \
--cc=njavali@marvell.com \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=oe-kbuild@lists.linux.dev \
--cc=scst-devel@lists.sourceforge.net \
--cc=target-devel@vger.kernel.org \
--cc=tonyb@cybernetics.com \
--cc=xose.vazquez@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox