Patch "scsi: lpfc: Fix crash after bad bar setup on driver attachment" has been added to the 4.15-stable tree
Subsystems (3)
This is a note to let you know that I've just added the patch titled
scsi: lpfc: Fix crash after bad bar setup on driver attachment
to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
scsi-lpfc-fix-crash-after-bad-bar-setup-on-driver-attachment.patch
and it can be found in the queue-4.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
e4b9794efdce13242f4af6682f3ed48ce3864a87Mon Sep 17 00:00:00 2001
From: James Smart <[email protected]>
Date: Mon, 20 Nov 2017 16:00:31 -0800
Subject: scsi: lpfc: Fix crash after bad bar setup on driver attachment
From: James Smart <[email protected]>
commit e4b9794efdce13242f4af6682f3ed48ce3864a87 upstream.
In test cases where an instance of the driver is detached and reattached, the driver will crash on reattachment. There is a compound if statement that will skip over the bar setup if the pci_resource_start call is not successful. The driver erroneously returns success to its bar setup in this scenario even though the bars aren't properly configured.
Rework the offending code segment for proper initialization steps. If the pci_resource_start call fails, -ENOMEM is now returned.
Sample stack:
rport-5:0-10: blocked FC remote port time out: removing rport
BUG: unable to handle kernel NULL pointer dereference at (null) ... lpfc_sli4_wait_bmbx_ready+0x32/0x70 [lpfc] ... ... RIP: 0010:... ... lpfc_sli4_wait_bmbx_ready+0x32/0x70 [lpfc] Call Trace: ... lpfc_sli4_post_sync_mbox+0x106/0x4d0 [lpfc] ... ? __alloc_pages_nodemask+0x176/0x420 ... ? __kmalloc+0x2e/0x230 ... lpfc_sli_issue_mbox_s4+0x533/0x720 [lpfc] ... ? mempool_alloc+0x69/0x170 ... ? dma_generic_alloc_coherent+0x8f/0x140 ... lpfc_sli_issue_mbox+0xf/0x20 [lpfc] ... lpfc_sli4_driver_resource_setup+0xa6f/0x1130 [lpfc] ... ? lpfc_pci_probe_one+0x23e/0x16f0 [lpfc] ... lpfc_pci_probe_one+0x445/0x16f0 [lpfc] ... local_pci_probe+0x45/0xa0 ... work_for_cpu_fn+0x14/0x20 ... process_one_work+0x17a/0x440
--- drivers/scsi/lpfc/lpfc_init.c | 84 +++++++++++++++++++++++++----------------- 1 file changed, 51 insertions(+), 33 deletions(-)
drivers/scsi/lpfc/lpfc_init.c +51 -33
@@ -9421,44 +9421,62 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hbalpfc_sli4_bar0_register_memmap (phba, if_type); } -if ((if_type ==LPFC_SLI_INTF_IF_TYPE_0 ) && - (pci_resource_start (pdev,PCI_64BIT_BAR2 ))) { -/* -* Map SLI4 if type 0 HBA Control Register base to a kernel -* virtual address and setup the registers. -*/ - phba->pci_bar1_map =pci_resource_start (pdev,PCI_64BIT_BAR2 ); - bar1map_len =pci_resource_len (pdev,PCI_64BIT_BAR2 ); - phba->sli4_hba.ctrl_regs_memmap_p = -ioremap (phba->pci_bar1_map, bar1map_len); -if (!phba->sli4_hba.ctrl_regs_memmap_p) { -dev_printk (KERN_ERR , &pdev->dev, -"ioremap failed for SLI4 HBA control registers.\n" ); +if (if_type ==LPFC_SLI_INTF_IF_TYPE_0 ) { +if (pci_resource_start (pdev,PCI_64BIT_BAR2 )) { +/* +* Map SLI4 if type 0 HBA Control Register base to a +* kernel virtual address and setup the registers. +*/ + phba->pci_bar1_map =pci_resource_start (pdev, +PCI_64BIT_BAR2 ); + bar1map_len =pci_resource_len (pdev,PCI_64BIT_BAR2 ); + phba->sli4_hba.ctrl_regs_memmap_p = +ioremap (phba->pci_bar1_map, + bar1map_len); +if (!phba->sli4_hba.ctrl_regs_memmap_p) { +dev_err (&pdev->dev, +"ioremap failed for SLI4 HBA " +"control registers.\n" ); + error = -ENOMEM ; + goto out_iounmap_conf; + } + phba->pci_bar2_memmap_p = + phba->sli4_hba.ctrl_regs_memmap_p; +lpfc_sli4_bar1_register_memmap (phba); + }else { + error = -ENOMEM ; goto out_iounmap_conf; } - phba->pci_bar2_memmap_p = phba->sli4_hba.ctrl_regs_memmap_p; -lpfc_sli4_bar1_register_memmap (phba); } -if ((if_type ==LPFC_SLI_INTF_IF_TYPE_0 ) && - (pci_resource_start (pdev,PCI_64BIT_BAR4 ))) { -/* -* Map SLI4 if type 0 HBA Doorbell Register base to a kernel -* virtual address and setup the registers. -*/ - phba->pci_bar2_map =pci_resource_start (pdev,PCI_64BIT_BAR4 ); - bar2map_len =pci_resource_len (pdev,PCI_64BIT_BAR4 ); - phba->sli4_hba.drbl_regs_memmap_p = -ioremap (phba->pci_bar2_map, bar2map_len); -if (!phba->sli4_hba.drbl_regs_memmap_p) { -dev_printk (KERN_ERR , &pdev->dev, -"ioremap failed for SLI4 HBA doorbell registers.\n" ); - goto out_iounmap_ctrl; - } - phba->pci_bar4_memmap_p = phba->sli4_hba.drbl_regs_memmap_p; - error =lpfc_sli4_bar2_register_memmap (phba,LPFC_VF0 ); -if (error) +if (if_type ==LPFC_SLI_INTF_IF_TYPE_0 ) { +if (pci_resource_start (pdev,PCI_64BIT_BAR4 )) { +/* +* Map SLI4 if type 0 HBA Doorbell Register base to +* a kernel virtual address and setup the registers. +*/ + phba->pci_bar2_map =pci_resource_start (pdev, +PCI_64BIT_BAR4 ); + bar2map_len =pci_resource_len (pdev,PCI_64BIT_BAR4 ); + phba->sli4_hba.drbl_regs_memmap_p = +ioremap (phba->pci_bar2_map, + bar2map_len); +if (!phba->sli4_hba.drbl_regs_memmap_p) { +dev_err (&pdev->dev, +"ioremap failed for SLI4 HBA" +" doorbell registers.\n" ); + error = -ENOMEM ; + goto out_iounmap_ctrl; + } + phba->pci_bar4_memmap_p = + phba->sli4_hba.drbl_regs_memmap_p; + error =lpfc_sli4_bar2_register_memmap (phba,LPFC_VF0 ); +if (error) + goto out_iounmap_all; + }else { + error = -ENOMEM ; goto out_iounmap_all; + } }return 0 ;
Patches currently in stable-queue which might be from [email protected] are
queue-4.15/scsi-lpfc-fix-crash-after-bad-bar-setup-on-driver-attachment.patch