FAILED: patch "[PATCH] scsi: qla2xxx: Free sp in error path to fix system crash" failed to apply to 6.1-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 7adbd2b7809066c75f0433e5e2a8e114b429f30f
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026021304-avid-upside-f50a@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 7adbd2b7809066c75f0433e5e2a8e114b429f30f Mon Sep 17 00:00:00 2001
From: Anil Gurumurthy <[email protected]>
Date: Wed, 10 Dec 2025 15:46:00 +0530
Subject: [PATCH] scsi: qla2xxx: Free sp in error path to fix system crash
System crash seen during load/unload test in a loop,
[61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X. [61110.467494] ============================================================================= [61110.467498] BUG qla2xxx_srbs (Tainted: G OE -------- --- ): Objects remaining in qla2xxx_srbs on __kmem_cache_shutdown() [61110.467501] -----------------------------------------------------------------------------
[61110.467502] Slab 0x000000000ffc8162 objects=51 used=1 fp=0x00000000e25d3d85 flags=0x57ffffc0010200(slab|head|node=1|zone=2|lastcpupid=0x1fffff) [61110.467509] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 [61110.467513] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 [61110.467515] Call Trace: [61110.467516] <TASK> [61110.467519] dump_stack_lvl+0x34/0x48 [61110.467526] slab_err.cold+0x53/0x67 [61110.467534] __kmem_cache_shutdown+0x16e/0x320 [61110.467540] kmem_cache_destroy+0x51/0x160 [61110.467544] qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467607] ? __do_sys_delete_module.constprop.0+0x178/0x280 [61110.467613] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [61110.467616] ? do_syscall_64+0x5c/0x90 [61110.467619] ? exc_page_fault+0x62/0x150 [61110.467622] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [61110.467626] </TASK> [61110.467627] Disabling lock debugging due to kernel taint [61110.467635] Object 0x0000000026f7e6e6 @offset=16000 [61110.467639] ------------[ cut here ]------------ [61110.467639] kmem_cache_destroy qla2xxx_srbs: Slab cache still has objects when called from qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467659] WARNING: CPU: 53 PID: 455206 at mm/slab_common.c:520 kmem_cache_destroy+0x14d/0x160 [61110.467718] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G B OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 [61110.467720] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 [61110.467721] RIP: 0010:kmem_cache_destroy+0x14d/0x160 [61110.467724] Code: 99 7d 07 00 48 89 ef e8 e1 6a 07 00 eb b3 48 8b 55 60 48 8b 4c 24 20 48 c7 c6 70 fc 66 90 48 c7 c7 f8 ef a1 90 e8 e1 ed 7c 00 <0f> 0b eb 93 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 [61110.467725] RSP: 0018:ffffa304e489fe80 EFLAGS: 00010282 [61110.467727] RAX: 0000000000000000 RBX: ffffffffc0d9a860 RCX: 0000000000000027 [61110.467729] RDX: ffff8fd5ff9598a8 RSI: 0000000000000001 RDI: ffff8fd5ff9598a0 [61110.467730] RBP: ffff8fb6aaf78700 R08: 0000000000000000 R09: 0000000100d863b7 [61110.467731] R10: ffffa304e489fd20 R11: ffffffff913bef48 R12: 0000000040002000 [61110.467731] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [61110.467733] FS: 00007f64c89fb740(0000) GS:ffff8fd5ff940000(0000) knlGS:0000000000000000 [61110.467734] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [61110.467735] CR2: 00007f0f02bfe000 CR3: 00000020ad6dc005 CR4: 0000000000770ee0 [61110.467736] PKRU: 55555554 [61110.467737] Call Trace: [61110.467738] <TASK> [61110.467739] qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467755] ? __do_sys_delete_module.constprop.0+0x178/0x280
Free sp in the error path to fix the crash.
drivers/scsi/qla2xxx/qla_gs.c +2 -2
@@ -3532,8 +3532,8 @@ int qla_fab_async_scan(scsi_qla_host_t *vha, srb_t *sp)if (vha->scan.scan_flags &SF_SCANNING ) {spin_unlock_irqrestore (&vha->work_lock, flags);ql_dbg (ql_dbg_disc + ql_dbg_verbose, vha,0x2012 , -"%s: scan active\n" , __func__); -return rval; +"%s: scan active for sp:%p\n" , __func__, sp); + goto done_free_sp; } vha->scan.scan_flags |=SF_SCANNING ;if (!sp)
Sasha Levin
maintainerPATCH 1/3 scsi: qla2xxx: Remove dead code (GNN ID)
From: Quinn Tran <[email protected]>
[ Upstream commit 87f6dafd50fb6d7214c32596a11b983138b09123 ]
Remove stale/unused code (GNN ID).
Stable-dep-of: 7adbd2b78090 ("scsi: qla2xxx: Free sp in error path to fix system crash")
--- drivers/scsi/qla2xxx/qla_def.h | 3 - drivers/scsi/qla2xxx/qla_gbl.h | 3 - drivers/scsi/qla2xxx/qla_gs.c | 110 -------------------------------- drivers/scsi/qla2xxx/qla_init.c | 7 +- drivers/scsi/qla2xxx/qla_os.c | 3 - 5 files changed, 1 insertion(+), 125 deletions(-)
drivers/scsi/qla2xxx/qla_def.h +0 -3
@@ -2499,7 +2499,6 @@ struct ct_sns_desc {enum discovery_state {DSC_DELETED , -DSC_GNN_ID ,DSC_GNL ,DSC_LOGIN_PEND ,DSC_LOGIN_FAILED ,
@@ -2712,7 +2711,6 @@ extern const char *const port_state_str[5];static const char *const port_dstate_str[] = { [DSC_DELETED ] ="DELETED" , - [DSC_GNN_ID ] ="GNN_ID" , [DSC_GNL ] ="GNL" , [DSC_LOGIN_PEND ] ="LOGIN_PEND" , [DSC_LOGIN_FAILED ] ="LOGIN_FAILED" ,
@@ -3508,7 +3506,6 @@ enum qla_work_type {QLA_EVT_GPNFT ,QLA_EVT_GPNFT_DONE ,QLA_EVT_GNNFT_DONE , -QLA_EVT_GNNID ,QLA_EVT_GFPNID ,QLA_EVT_SP_RETRY , QLA_EVT_IIDMA,
drivers/scsi/qla2xxx/qla_gbl.h +0 -3
@@ -739,9 +739,6 @@ int qla24xx_async_gffid(scsi_qla_host_t *vha, fc_port_t *fcport, bool);int qla24xx_async_gpnft (scsi_qla_host_t *,u8 ,srb_t *);void qla24xx_async_gpnft_done (scsi_qla_host_t *,srb_t *);void qla24xx_async_gnnft_done (scsi_qla_host_t *,srb_t *); -int qla24xx_async_gnnid (scsi_qla_host_t *,fc_port_t *); -void qla24xx_handle_gnnid_event (scsi_qla_host_t *,struct event_arg *); -int qla24xx_post_gnnid_work (struct scsi_qla_host *,fc_port_t *);int qla24xx_post_gfpnid_work (struct scsi_qla_host *,fc_port_t *);int qla24xx_async_gfpnid (scsi_qla_host_t *,fc_port_t *);void qla24xx_handle_gfpnid_event (scsi_qla_host_t *,struct event_arg *);
drivers/scsi/qla2xxx/qla_gs.c +0 -110
116 lines not on this page · raw message
drivers/scsi/qla2xxx/qla_init.c +1 -6
@@ -1723,12 +1723,7 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport) }break ;default : -if (wwn ==0 ) { -ql_dbg (ql_dbg_disc, vha,0xffff , -"%s %d %8phC post GNNID\n" , - __func__, __LINE__, fcport->port_name); -qla24xx_post_gnnid_work (vha, fcport); - }else if (fcport->loop_id ==FC_NO_LOOP_ID ) { +if (fcport->loop_id ==FC_NO_LOOP_ID ) {ql_dbg (ql_dbg_disc, vha,0x20bd ,"%s %d %8phC post gnl\n" , __func__, __LINE__, fcport->port_name);
drivers/scsi/qla2xxx/qla_os.c +0 -3
@@ -5531,9 +5531,6 @@ qla2x00_do_work(struct scsi_qla_host *vha)case QLA_EVT_GNNFT_DONE :qla24xx_async_gnnft_done (vha, e->u.iosb.sp);break ; -case QLA_EVT_GNNID : -qla24xx_async_gnnid (vha, e->u.fcport.fcport); -break ;case QLA_EVT_GFPNID :qla24xx_async_gfpnid (vha, e->u.fcport.fcport);break ;
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 2/3 scsi: qla2xxx: Reduce fabric scan duplicate code
From: Quinn Tran <[email protected]>
[ Upstream commit beafd692461443e0fb1d61aa56886bf85ef6f5e4 ]
For fabric scan, current code uses switch scan opcode and flags as the method to iterate through different commands to carry out the process. This makes it hard to read. This patch convert those opcode and flags into steps. In addition, this help reduce some duplicate code.
Consolidate routines that handle GPNFT & GNNFT.
Stable-dep-of: 7adbd2b78090 ("scsi: qla2xxx: Free sp in error path to fix system crash")
--- drivers/scsi/qla2xxx/qla_def.h | 14 +- drivers/scsi/qla2xxx/qla_gbl.h | 6 +- drivers/scsi/qla2xxx/qla_gs.c | 430 +++++++++++++------------------- drivers/scsi/qla2xxx/qla_init.c | 5 +- drivers/scsi/qla2xxx/qla_os.c | 12 +- 5 files changed, 199 insertions(+), 268 deletions(-)
drivers/scsi/qla2xxx/qla_def.h +11 -3
@@ -3273,11 +3273,20 @@ struct fab_scan_rp {u8 node_name[8 ]; }; +enum scan_step { +FAB_SCAN_START , +FAB_SCAN_GPNFT_FCP , +FAB_SCAN_GNNFT_FCP , +FAB_SCAN_GPNFT_NVME , +FAB_SCAN_GNNFT_NVME , +}; +struct fab_scan {struct fab_scan_rp *l;u32 size;u32 rscn_gen_start;u32 rscn_gen_end; +enum scan_step step;u16 scan_retry;#define MAX_SCAN_RETRIES 5enum scan_flags_t scan_flags;
@@ -3503,9 +3512,8 @@ enum qla_work_type {QLA_EVT_RELOGIN ,QLA_EVT_ASYNC_PRLO ,QLA_EVT_ASYNC_PRLO_DONE , -QLA_EVT_GPNFT , -QLA_EVT_GPNFT_DONE , -QLA_EVT_GNNFT_DONE , +QLA_EVT_SCAN_CMD , +QLA_EVT_SCAN_FINISH ,QLA_EVT_GFPNID ,QLA_EVT_SP_RETRY , QLA_EVT_IIDMA,
drivers/scsi/qla2xxx/qla_gbl.h +3 -3
@@ -736,9 +736,9 @@ void qla24xx_handle_gpsc_event(scsi_qla_host_t *, struct event_arg *);int qla2x00_mgmt_svr_login (scsi_qla_host_t *);void qla24xx_handle_gffid_event (scsi_qla_host_t *vha,struct event_arg *ea);int qla24xx_async_gffid (scsi_qla_host_t *vha,fc_port_t *fcport,bool ); -int qla24xx_async_gpnft (scsi_qla_host_t *,u8 ,srb_t *); -void qla24xx_async_gpnft_done (scsi_qla_host_t *,srb_t *); -void qla24xx_async_gnnft_done (scsi_qla_host_t *,srb_t *); +int qla_fab_async_scan (scsi_qla_host_t *,srb_t *); +void qla_fab_scan_start (struct scsi_qla_host *); +void qla_fab_scan_finish (scsi_qla_host_t *,srb_t *);int qla24xx_post_gfpnid_work (struct scsi_qla_host *,fc_port_t *);int qla24xx_async_gfpnid (scsi_qla_host_t *,fc_port_t *);void qla24xx_handle_gfpnid_event (scsi_qla_host_t *,struct event_arg *);
drivers/scsi/qla2xxx/qla_gs.c +180 -250
577 lines not on this page · raw message
drivers/scsi/qla2xxx/qla_init.c +1 -4
@@ -6438,10 +6438,7 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)if (USE_ASYNC_SCAN (ha)) {/* start of scan begins here */ vha->scan.rscn_gen_end =atomic_read (&vha->rscn_gen); - rval =qla24xx_async_gpnft (vha,FC4_TYPE_FCP_SCSI , -NULL ); -if (rval) -set_bit (LOOP_RESYNC_NEEDED , &vha->dpc_flags); +qla_fab_scan_start (vha); }else {list_for_each_entry (fcport, &vha->vp_fcports, list) fcport->scan_state =QLA_FCPORT_SCAN ;
drivers/scsi/qla2xxx/qla_os.c +4 -8
@@ -5521,15 +5521,11 @@ qla2x00_do_work(struct scsi_qla_host *vha)qla2x00_async_prlo_done (vha, e->u.logio.fcport, e->u.logio.data);break ; -case QLA_EVT_GPNFT : -qla24xx_async_gpnft (vha, e->u.gpnft.fc4_type, - e->u.gpnft.sp); +case QLA_EVT_SCAN_CMD : +qla_fab_async_scan (vha, e->u.iosb.sp);break ; -case QLA_EVT_GPNFT_DONE : -qla24xx_async_gpnft_done (vha, e->u.iosb.sp); -break ; -case QLA_EVT_GNNFT_DONE : -qla24xx_async_gnnft_done (vha, e->u.iosb.sp); +case QLA_EVT_SCAN_FINISH : +qla_fab_scan_finish (vha, e->u.iosb.sp);break ;case QLA_EVT_GFPNID :qla24xx_async_gfpnid (vha, e->u.fcport.fcport);
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 3/3 scsi: qla2xxx: Free sp in error path to fix system crash
In reply to Sasha LevinFrom: Anil Gurumurthy <[email protected]>
[ Upstream commit 7adbd2b7809066c75f0433e5e2a8e114b429f30f ]
System crash seen during load/unload test in a loop,
[61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X. [61110.467494] ============================================================================= [61110.467498] BUG qla2xxx_srbs (Tainted: G OE -------- --- ): Objects remaining in qla2xxx_srbs on __kmem_cache_shutdown() [61110.467501] -----------------------------------------------------------------------------
[61110.467502] Slab 0x000000000ffc8162 objects=51 used=1 fp=0x00000000e25d3d85 flags=0x57ffffc0010200(slab|head|node=1|zone=2|lastcpupid=0x1fffff) [61110.467509] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 [61110.467513] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 [61110.467515] Call Trace: [61110.467516] <TASK> [61110.467519] dump_stack_lvl+0x34/0x48 [61110.467526] slab_err.cold+0x53/0x67 [61110.467534] __kmem_cache_shutdown+0x16e/0x320 [61110.467540] kmem_cache_destroy+0x51/0x160 [61110.467544] qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467607] ? __do_sys_delete_module.constprop.0+0x178/0x280 [61110.467613] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [61110.467616] ? do_syscall_64+0x5c/0x90 [61110.467619] ? exc_page_fault+0x62/0x150 [61110.467622] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [61110.467626] </TASK> [61110.467627] Disabling lock debugging due to kernel taint [61110.467635] Object 0x0000000026f7e6e6 @offset=16000 [61110.467639] ------------[ cut here ]------------ [61110.467639] kmem_cache_destroy qla2xxx_srbs: Slab cache still has objects when called from qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467659] WARNING: CPU: 53 PID: 455206 at mm/slab_common.c:520 kmem_cache_destroy+0x14d/0x160 [61110.467718] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G B OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 [61110.467720] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 [61110.467721] RIP: 0010:kmem_cache_destroy+0x14d/0x160 [61110.467724] Code: 99 7d 07 00 48 89 ef e8 e1 6a 07 00 eb b3 48 8b 55 60 48 8b 4c 24 20 48 c7 c6 70 fc 66 90 48 c7 c7 f8 ef a1 90 e8 e1 ed 7c 00 <0f> 0b eb 93 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 [61110.467725] RSP: 0018:ffffa304e489fe80 EFLAGS: 00010282 [61110.467727] RAX: 0000000000000000 RBX: ffffffffc0d9a860 RCX: 0000000000000027 [61110.467729] RDX: ffff8fd5ff9598a8 RSI: 0000000000000001 RDI: ffff8fd5ff9598a0 [61110.467730] RBP: ffff8fb6aaf78700 R08: 0000000000000000 R09: 0000000100d863b7 [61110.467731] R10: ffffa304e489fd20 R11: ffffffff913bef48 R12: 0000000040002000 [61110.467731] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [61110.467733] FS: 00007f64c89fb740(0000) GS:ffff8fd5ff940000(0000) knlGS:0000000000000000 [61110.467734] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [61110.467735] CR2: 00007f0f02bfe000 CR3: 00000020ad6dc005 CR4: 0000000000770ee0 [61110.467736] PKRU: 55555554 [61110.467737] Call Trace: [61110.467738] <TASK> [61110.467739] qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467755] ? __do_sys_delete_module.constprop.0+0x178/0x280
Free sp in the error path to fix the crash.
--- drivers/scsi/qla2xxx/qla_gs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/qla2xxx/qla_gs.c +2 -2
@@ -3922,8 +3922,8 @@ int qla_fab_async_scan(scsi_qla_host_t *vha, srb_t *sp)if (vha->scan.scan_flags &SF_SCANNING ) {spin_unlock_irqrestore (&vha->work_lock, flags);ql_dbg (ql_dbg_disc + ql_dbg_verbose, vha,0x2012 , -"%s: scan active\n" , __func__); -return rval; +"%s: scan active for sp:%p\n" , __func__, sp); + goto done_free_sp; } vha->scan.scan_flags |=SF_SCANNING ;if (!sp)
Signature · 1 line
2.51.0