Commit 785141c6 authored by Chad Dupuis's avatar Chad Dupuis Committed by Martin K. Petersen

scsi: libfc: Do not take rdata->rp_mutex when processing a -FC_EX_CLOSED ELS response.

When an ELS response handler receives a -FC_EX_CLOSED, the rdata->rp_mutex is
already held which can lead to a deadlock condition like the following stack trace:

[<ffffffffa04d8f18>] fc_rport_plogi_resp+0x28/0x200 [libfc]
[<ffffffffa04cfa1a>] fc_invoke_resp+0x6a/0xe0 [libfc]
[<ffffffffa04d0c08>] fc_exch_mgr_reset+0x1b8/0x280 [libfc]
[<ffffffffa04d87b3>] fc_rport_logoff+0x43/0xd0 [libfc]
[<ffffffffa04ce73d>] fc_disc_stop+0x6d/0xf0 [libfc]
[<ffffffffa04ce7ce>] fc_disc_stop_final+0xe/0x20 [libfc]
[<ffffffffa04d55f7>] fc_fabric_logoff+0x17/0x70 [libfc]

The other ELS handlers need to follow the FLOGI response handler and simply do
a kref_put against the fc_rport_priv struct and exit when receving a
-FC_EX_CLOSED response.
Signed-off-by: default avatarChad Dupuis <chad.dupuis@cavium.com>
Reviewed-by: default avatarHannes Reinecke <hare@suse.com>
Acked-by: default avatarJohannes Thumshirn <jth@kernel.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent a407c593
......@@ -952,10 +952,13 @@ static void fc_rport_plogi_resp(struct fc_seq *sp, struct fc_frame *fp,
u16 cssp_seq;
u8 op;
mutex_lock(&rdata->rp_mutex);
FC_RPORT_DBG(rdata, "Received a PLOGI %s\n", fc_els_resp_type(fp));
if (fp == ERR_PTR(-FC_EX_CLOSED))
goto put;
mutex_lock(&rdata->rp_mutex);
if (rdata->rp_state != RPORT_ST_PLOGI) {
FC_RPORT_DBG(rdata, "Received a PLOGI response, but in state "
"%s\n", fc_rport_state(rdata));
......@@ -994,6 +997,7 @@ static void fc_rport_plogi_resp(struct fc_seq *sp, struct fc_frame *fp,
fc_frame_free(fp);
err:
mutex_unlock(&rdata->rp_mutex);
put:
kref_put(&rdata->kref, lport->tt.rport_destroy);
}
......@@ -1079,10 +1083,13 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp,
u8 op;
u8 resp_code = 0;
mutex_lock(&rdata->rp_mutex);
FC_RPORT_DBG(rdata, "Received a PRLI %s\n", fc_els_resp_type(fp));
if (fp == ERR_PTR(-FC_EX_CLOSED))
goto put;
mutex_lock(&rdata->rp_mutex);
if (rdata->rp_state != RPORT_ST_PRLI) {
FC_RPORT_DBG(rdata, "Received a PRLI response, but in state "
"%s\n", fc_rport_state(rdata));
......@@ -1150,6 +1157,7 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp,
fc_frame_free(fp);
err:
mutex_unlock(&rdata->rp_mutex);
put:
kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);
}
......@@ -1230,10 +1238,13 @@ static void fc_rport_rtv_resp(struct fc_seq *sp, struct fc_frame *fp,
struct fc_rport_priv *rdata = rdata_arg;
u8 op;
mutex_lock(&rdata->rp_mutex);
FC_RPORT_DBG(rdata, "Received a RTV %s\n", fc_els_resp_type(fp));
if (fp == ERR_PTR(-FC_EX_CLOSED))
goto put;
mutex_lock(&rdata->rp_mutex);
if (rdata->rp_state != RPORT_ST_RTV) {
FC_RPORT_DBG(rdata, "Received a RTV response, but in state "
"%s\n", fc_rport_state(rdata));
......@@ -1275,6 +1286,7 @@ static void fc_rport_rtv_resp(struct fc_seq *sp, struct fc_frame *fp,
fc_frame_free(fp);
err:
mutex_unlock(&rdata->rp_mutex);
put:
kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);
}
......@@ -1374,10 +1386,13 @@ static void fc_rport_adisc_resp(struct fc_seq *sp, struct fc_frame *fp,
struct fc_els_adisc *adisc;
u8 op;
mutex_lock(&rdata->rp_mutex);
FC_RPORT_DBG(rdata, "Received a ADISC response\n");
if (fp == ERR_PTR(-FC_EX_CLOSED))
goto put;
mutex_lock(&rdata->rp_mutex);
if (rdata->rp_state != RPORT_ST_ADISC) {
FC_RPORT_DBG(rdata, "Received a ADISC resp but in state %s\n",
fc_rport_state(rdata));
......@@ -1412,6 +1427,7 @@ static void fc_rport_adisc_resp(struct fc_seq *sp, struct fc_frame *fp,
fc_frame_free(fp);
err:
mutex_unlock(&rdata->rp_mutex);
put:
kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment