1. 14 Feb, 2018 2 commits
    • Quinn Tran's avatar
      scsi: qla2xxx: Fix double free bug after firmware timeout · eaf75d18
      Quinn Tran authored
      This patch is based on Max's original patch.
      
      When the qla2xxx firmware is unavailable, eventually
      qla2x00_sp_timeout() is reached, which calls the timeout function and
      frees the srb_t instance.
      
      The timeout function always resolves to qla2x00_async_iocb_timeout(),
      which invokes another callback function called "done".  All of these
      qla2x00_*_sp_done() callbacks also free the srb_t instance; after
      returning to qla2x00_sp_timeout(), it is freed again.
      
      The fix is to remove the "sp->free(sp)" call from qla2x00_sp_timeout()
      and add it to those code paths in qla2x00_async_iocb_timeout() which
      do not already free the object.
      
      This is how it looks like with KASAN:
      
      BUG: KASAN: use-after-free in qla2x00_sp_timeout+0x228/0x250
      Read of size 8 at addr ffff88278147a590 by task swapper/2/0
      
      Allocated by task 1502:
      save_stack+0x33/0xa0
      kasan_kmalloc+0xa0/0xd0
      kmem_cache_alloc+0xb8/0x1c0
      mempool_alloc+0xd6/0x260
      qla24xx_async_gnl+0x3c5/0x1100
      
      Freed by task 0:
      save_stack+0x33/0xa0
      kasan_slab_free+0x72/0xc0
      kmem_cache_free+0x75/0x200
      qla24xx_async_gnl_sp_done+0x556/0x9e0
      qla2x00_async_iocb_timeout+0x1c7/0x420
      qla2x00_sp_timeout+0x16d/0x250
      call_timer_fn+0x36/0x200
      
      The buggy address belongs to the object at ffff88278147a440
      which belongs to the cache qla2xxx_srbs of size 344
      The buggy address is located 336 bytes inside of
      344-byte region [ffff88278147a440, ffff88278147a598)
      Reported-by: default avatarMax Kellermann <mk@cm4all.com>
      Signed-off-by: default avatarQuinn Tran <quinn.tran@cavium.com>
      Signed-off-by: default avatarHimanshu Madhani <himanshu.madhani@cavium.com>
      Cc: Max Kellermann <mk@cm4all.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      eaf75d18
    • Michael Kelley (EOSG)'s avatar
      scsi: storvsc: Increase cmd_per_lun for higher speed devices · cabe92a5
      Michael Kelley (EOSG) authored
      Increase cmd_per_lun to allow more I/Os in progress per device,
      particularly for NVMe's.  The Hyper-V host side can handle the higher
      count with no issues.
      Signed-off-by: default avatarMichael Kelley <mikelley@microsoft.com>
      Reviewed-by: default avatarK. Y. Srinivasan <kys@microsoft.com>
      Acked-by: default avatarK. Y. Srinivasan <kys@microsoft.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      cabe92a5
  2. 06 Feb, 2018 1 commit
  3. 31 Jan, 2018 12 commits
  4. 23 Jan, 2018 17 commits
  5. 17 Jan, 2018 8 commits