1. 25 May, 2017 6 commits
  2. 24 May, 2017 11 commits
    • Maurizio Lombardi's avatar
      scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats() · c2dd893a
      Maurizio Lombardi authored
      If multiple tasks attempt to read the stats, it may happen that the
      start_req_done completion is re-initialized while still being used by
      another task, causing a list corruption.
      
      This patch fixes the bug by adding a mutex to serialize the calls to
      bnx2fc_get_host_stats().
      
      WARNING: at lib/list_debug.c:48 list_del+0x6e/0xa0() (Not tainted)
      Hardware name: PowerEdge R820
      list_del corruption. prev->next should be ffff882035627d90, but was ffff884069541588
      
      Pid: 40267, comm: perl Not tainted 2.6.32-642.3.1.el6.x86_64 #1
      Call Trace:
       [<ffffffff8107c691>] ? warn_slowpath_common+0x91/0xe0
       [<ffffffff8107c796>] ? warn_slowpath_fmt+0x46/0x60
       [<ffffffff812ad16e>] ? list_del+0x6e/0xa0
       [<ffffffff81547eed>] ? wait_for_common+0x14d/0x180
       [<ffffffff8106c4a0>] ? default_wake_function+0x0/0x20
       [<ffffffff81547fd3>] ? wait_for_completion_timeout+0x13/0x20
       [<ffffffffa05410b1>] ? bnx2fc_get_host_stats+0xa1/0x280 [bnx2fc]
       [<ffffffffa04cf630>] ? fc_stat_show+0x90/0xc0 [scsi_transport_fc]
       [<ffffffffa04cf8b6>] ? show_fcstat_tx_frames+0x16/0x20 [scsi_transport_fc]
       [<ffffffff8137c647>] ? dev_attr_show+0x27/0x50
       [<ffffffff8113b9be>] ? __get_free_pages+0xe/0x50
       [<ffffffff812170e1>] ? sysfs_read_file+0x111/0x200
       [<ffffffff8119a305>] ? vfs_read+0xb5/0x1a0
       [<ffffffff8119b0b6>] ? fget_light_pos+0x16/0x50
       [<ffffffff8119a651>] ? sys_read+0x51/0xb0
       [<ffffffff810ee1fe>] ? __audit_syscall_exit+0x25e/0x290
       [<ffffffff8100b0d2>] ? system_call_fastpath+0x16/0x1b
      Signed-off-by: default avatarMaurizio Lombardi <mlombard@redhat.com>
      Acked-by: default avatarChad Dupuis <chad.dupuis@cavium.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      c2dd893a
    • Johannes Thumshirn's avatar
      scsi: qla2xxx: don't disable a not previously enabled PCI device · ddff7ed4
      Johannes Thumshirn authored
      When pci_enable_device() or pci_enable_device_mem() fail in
      qla2x00_probe_one() we bail out but do a call to
      pci_disable_device(). This causes the dev_WARN_ON() in
      pci_disable_device() to trigger, as the device wasn't enabled
      previously.
      
      So instead of taking the 'probe_out' error path we can directly return
      *iff* one of the pci_enable_device() calls fails.
      
      Additionally rename the 'probe_out' goto label's name to the more
      descriptive 'disable_device'.
      Signed-off-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
      Fixes: e315cd28 ("[SCSI] qla2xxx: Code changes for qla data structure refactoring")
      Cc: <stable@vger.kernel.org>
      Reviewed-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
      Reviewed-by: default avatarGiridhar Malavali <giridhar.malavali@cavium.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      ddff7ed4
    • Varun Prakash's avatar
      scsi: libcxgbi: fix skb use after free · 75b61250
      Varun Prakash authored
      skb->data is assigned to task->hdr in cxgbi_conn_alloc_pdu(),
      skb gets freed after tx but task->hdr is still dereferenced in
      iscsi_tcp_task_xmit() to avoid this call skb_get() after allocating skb
      and free the skb in cxgbi_cleanup_task() or before allocating new skb in
      cxgbi_conn_alloc_pdu().
      Signed-off-by: default avatarVarun Prakash <varun@chelsio.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      75b61250
    • manish.rangankar@cavium.com's avatar
    • Nilesh Javali's avatar
      scsi: qedi: set max_fin_rt default value · 3d61a313
      Nilesh Javali authored
      max_fin_rt is the maximum re-transmission of FIN packets
      as part of the termination flow. After reaching this value
      the FW will send a single RESET.
      Signed-off-by: default avatarNilesh Javali <nilesh.javali@cavium.com>
      Signed-off-by: default avatarManish Rangankar <manish.rangankar@cavium.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      3d61a313
    • manish.rangankar@cavium.com's avatar
    • manish.rangankar@cavium.com's avatar
      scsi: qedi: Fix endpoint NULL panic in qedi_set_path. · 0ea9314f
      manish.rangankar@cavium.com authored
      RIP: 0010:qedi_set_path+0x114/0x570 [qedi]
       Call Trace:
        [<ffffffffa0472923>] iscsi_if_recv_msg+0x623/0x14a0
        [<ffffffff81307de6>] ? rhashtable_lookup_compare+0x36/0x70
        [<ffffffffa047382e>] iscsi_if_rx+0x8e/0x1f0
        [<ffffffff8155983d>] netlink_unicast+0xed/0x1b0
        [<ffffffff81559c30>] netlink_sendmsg+0x330/0x770
        [<ffffffff81510d60>] sock_sendmsg+0xb0/0xf0
        [<ffffffff8101360b>] ? __switch_to+0x17b/0x4b0
        [<ffffffff8163a2c8>] ? __schedule+0x2d8/0x900
        [<ffffffff81511199>] ___sys_sendmsg+0x3a9/0x3c0
        [<ffffffff810e2298>] ? get_futex_key+0x1c8/0x2b0
        [<ffffffff810e25a0>] ? futex_wake+0x80/0x160
      Signed-off-by: default avatarManish Rangankar <manish.rangankar@cavium.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      0ea9314f
    • manish.rangankar@cavium.com's avatar
    • manish.rangankar@cavium.com's avatar
    • Arun Easi's avatar
      scsi: qedi: Fix bad pte call trace when iscsiuio is stopped. · 5e901d0b
      Arun Easi authored
      munmap done by iscsiuio during a stop of the service triggers a "bad
      pte" warning sometimes. munmap kernel path goes through the mmapped
      pages and has a validation check for mapcount (in struct page) to be
      zero or above. kzalloc, which we had used to allocate udev->ctrl, uses
      slab allocations, which re-uses mapcount (union) for other purposes that
      can make the mapcount look negative. Avoid all these trouble by invoking
      one of the __get_free_pages wrappers to be used instead of kzalloc for
      udev->ctrl.
      
       BUG: Bad page map in process iscsiuio  pte:80000000aa624067 pmd:3e6777067
       page:ffffea0002a98900 count:2 mapcount:-2143289280
           mapping: (null) index:0xffff8800aa624e00
       page flags: 0x10075d00000090(dirty|slab)
       page dumped because: bad pte
       addr:00007fcba70a3000 vm_flags:0c0400fb anon_vma: (null)
           mapping:ffff8803edf66e90 index:0
      
       Call Trace:
           dump_stack+0x19/0x1b
           print_bad_pte+0x1af/0x250
           unmap_page_range+0x7a7/0x8a0
           unmap_single_vma+0x81/0xf0
           unmap_vmas+0x49/0x90
           unmap_region+0xbe/0x140
           ? vma_rb_erase+0x121/0x220
           do_munmap+0x245/0x420
           vm_munmap+0x41/0x60
           SyS_munmap+0x22/0x30
           tracesys+0xdd/0xe2
      Signed-off-by: default avatarArun Easi <arun.easi@cavium.com>
      Signed-off-by: default avatarManish Rangankar <manish.rangankar@cavium.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      5e901d0b
    • Artem Savkov's avatar
      scsi: scsi_dh_rdac: Use ctlr directly in rdac_failover_get() · 0648a07c
      Artem Savkov authored
      rdac_failover_get references struct rdac_controller as
      ctlr->ms_sdev->handler_data->ctlr for no apparent reason. Besides being
      inefficient this also introduces a null-pointer dereference as
      send_mode_select() sets ctlr->ms_sdev to NULL before calling
      rdac_failover_get():
      
      [   18.432550] device-mapper: multipath service-time: version 0.3.0 loaded
      [   18.436124] BUG: unable to handle kernel NULL pointer dereference at 0000000000000790
      [   18.436129] IP: send_mode_select+0xca/0x560
      [   18.436129] PGD 0
      [   18.436130] P4D 0
      [   18.436130]
      [   18.436132] Oops: 0000 [#1] SMP
      [   18.436133] Modules linked in: dm_service_time sd_mod dm_multipath amdkfd amd_iommu_v2 radeon(+) i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm qla2xxx drm serio_raw scsi_transport_fc bnx2 i2c_core dm_mirror dm_region_hash dm_log dm_mod
      [   18.436143] CPU: 4 PID: 443 Comm: kworker/u16:2 Not tainted 4.12.0-rc1.1.el7.test.x86_64 #1
      [   18.436144] Hardware name: IBM BladeCenter LS22 -[79013SG]-/Server Blade, BIOS -[L8E164AUS-1.07]- 05/25/2011
      [   18.436145] Workqueue: kmpath_rdacd send_mode_select
      [   18.436146] task: ffff880225116a40 task.stack: ffffc90002bd8000
      [   18.436148] RIP: 0010:send_mode_select+0xca/0x560
      [   18.436148] RSP: 0018:ffffc90002bdbda8 EFLAGS: 00010246
      [   18.436149] RAX: 0000000000000000 RBX: ffffc90002bdbe08 RCX: ffff88017ef04a80
      [   18.436150] RDX: ffffc90002bdbe08 RSI: ffff88017ef04a80 RDI: ffff8802248e4388
      [   18.436151] RBP: ffffc90002bdbe48 R08: 0000000000000000 R09: ffffffff81c104c0
      [   18.436151] R10: 00000000000001ff R11: 000000000000035a R12: ffffc90002bdbdd8
      [   18.436152] R13: ffff8802248e4390 R14: ffff880225152800 R15: ffff8802248e4400
      [   18.436153] FS:  0000000000000000(0000) GS:ffff880227d00000(0000) knlGS:0000000000000000
      [   18.436154] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   18.436154] CR2: 0000000000000790 CR3: 000000042535b000 CR4: 00000000000006e0
      [   18.436155] Call Trace:
      [   18.436159]  ? rdac_activate+0x14e/0x150
      [   18.436161]  ? refcount_dec_and_test+0x11/0x20
      [   18.436162]  ? kobject_put+0x1c/0x50
      [   18.436165]  ? scsi_dh_activate+0x6f/0xd0
      [   18.436168]  process_one_work+0x149/0x360
      [   18.436170]  worker_thread+0x4d/0x3c0
      [   18.436172]  kthread+0x109/0x140
      [   18.436173]  ? rescuer_thread+0x380/0x380
      [   18.436174]  ? kthread_park+0x60/0x60
      [   18.436176]  ret_from_fork+0x2c/0x40
      [   18.436177] Code: 49 c7 46 20 00 00 00 00 4c 89 ef c6 07 00 0f 1f 40 00 45 31 ed c7 45 b0 05 00 00 00 44 89 6d b4 4d 89 f5 4c 8b 75 a8 49 8b 45 20 <48> 8b b0 90 07 00 00 48 8b 56 10 8b 42 10 48 8d 7a 28 85 c0 0f
      [   18.436192] RIP: send_mode_select+0xca/0x560 RSP: ffffc90002bdbda8
      [   18.436192] CR2: 0000000000000790
      [   18.436198] ---[ end trace 40f3e4dca1ffabdd ]---
      [   18.436199] Kernel panic - not syncing: Fatal exception
      [   18.436222] Kernel Offset: disabled
      [-- MARK -- Thu May 18 11:45:00 2017]
      
      Fixes: 32782557 scsi_dh_rdac: switch to scsi_execute_req_flags()
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarArtem Savkov <asavkov@redhat.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      0648a07c
  3. 19 May, 2017 3 commits
  4. 18 May, 2017 2 commits
  5. 17 May, 2017 17 commits
  6. 12 May, 2017 1 commit