Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichal Suchanek <msuchanek@suse.de>2019-03-21 07:05:10 +0100
committerMichal Suchanek <msuchanek@suse.de>2019-03-21 07:08:33 +0100
commitcc2e069c0212b785596416176a758b73bb89b89d (patch)
tree4663793633e6c7f6e14fa52ab5e9d90c3b5be72f
parenta1f6570f1acfa86054386c0339819123d44d834d (diff)
- scsi: ibmvscsi: Fix empty event pool access during host removal
(bsc#1119019). - scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton (bsc#1119019).
-rw-r--r--patches.drivers/ibmvscsi-Fix-empty-event-pool-access-during-host-rem.patch60
-rw-r--r--patches.drivers/ibmvscsi-Protect-ibmvscsi_head-from-concurrent-modif.patch27
-rw-r--r--series.conf7
3 files changed, 52 insertions, 42 deletions
diff --git a/patches.drivers/ibmvscsi-Fix-empty-event-pool-access-during-host-rem.patch b/patches.drivers/ibmvscsi-Fix-empty-event-pool-access-during-host-rem.patch
index 4591a9c8ad..885cbde6e7 100644
--- a/patches.drivers/ibmvscsi-Fix-empty-event-pool-access-during-host-rem.patch
+++ b/patches.drivers/ibmvscsi-Fix-empty-event-pool-access-during-host-rem.patch
@@ -1,16 +1,19 @@
-From 034461d3d1cb96abdb9dd247518d20c3ccf60083 Mon Sep 17 00:00:00 2001
+From 7f5203c13ba8a7b7f9f6ecfe5a4d5567188d7835 Mon Sep 17 00:00:00 2001
From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
-Date: Fri, 15 Feb 2019 11:51:27 -0600
-Subject: [PATCH] ibmvscsi: Fix empty event pool access during host removal
+Date: Wed, 20 Mar 2019 13:41:51 -0500
+Subject: [PATCH] scsi: ibmvscsi: Fix empty event pool access during host
+ removal
References: bsc#1119019
-Patch-mainline: no, testing
+Patch-mainline: queued
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
+Git-commit: 7f5203c13ba8a7b7f9f6ecfe5a4d5567188d7835
-The event pool used for queueing commands is destroyed fairly early in
-the ibmvscsi_remove() code path. Since, this happens prior to the call
-so scsi_remove_host() it is possible for further calls to queuecommand
-to be processed which manifest as a panic due to a NULL pointer
-dereference as seen here:
+The event pool used for queueing commands is destroyed fairly early in the
+ibmvscsi_remove() code path. Since, this happens prior to the call so
+scsi_remove_host() it is possible for further calls to queuecommand to be
+processed which manifest as a panic due to a NULL pointer dereference as
+seen here:
PANIC: "Unable to handle kernel paging request for data at address
0x00000000"
@@ -35,34 +38,37 @@ The kernel buffer log is overfilled with this log:
[11261.952732] ibmvscsi: found no event struct in pool!
-This patch reorders the operations during host teardown. Start by
-calling the SRP transport and Scsi_Host remove functions to flush any
-outstanding work and set the host offline. LLDD teardown follows
-including destruction of the event pool, freeing the Command Response
-Queue (CRQ), and unmapping any persistent buffers. The event pool
-destruction is protected by the scsi_host lock, and the pool is purged
-prior of any requests for which we never received a response.
+This patch reorders the operations during host teardown. Start by calling
+the SRP transport and Scsi_Host remove functions to flush any outstanding
+work and set the host offline. LLDD teardown follows including destruction
+of the event pool, freeing the Command Response Queue (CRQ), and unmapping
+any persistent buffers. The event pool destruction is protected by the
+scsi_host lock, and the pool is purged prior of any requests for which we
+never received a response. Finally, move the removal of the scsi host from
+our global list to the end so that the host is easily locatable for
+debugging purposes during teardown.
+Cc: <stable@vger.kernel.org> # v2.6.12+
Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
- drivers/scsi/ibmvscsi/ibmvscsi.c | 16 +++++++++++++---
- 1 file changed, 13 insertions(+), 3 deletions(-)
+ drivers/scsi/ibmvscsi/ibmvscsi.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
-index 16b3f23c7ef5..a220ed2bd68b 100644
+index 2b22969f3f63..8cec5230fe31 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
-@@ -2299,17 +2299,27 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+@@ -2295,17 +2295,27 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
static int ibmvscsi_remove(struct vio_dev *vdev)
{
struct ibmvscsi_host_data *hostdata = dev_get_drvdata(&vdev->dev);
-+ unsigned long flags;
-+
- spin_lock(&ibmvscsi_driver_lock);
- list_del(&hostdata->host_list);
- spin_unlock(&ibmvscsi_driver_lock);
+- spin_lock(&ibmvscsi_driver_lock);
+- list_del(&hostdata->host_list);
+- spin_unlock(&ibmvscsi_driver_lock);
- unmap_persist_bufs(hostdata);
++ unsigned long flags;
+
+ srp_remove_host(hostdata->host);
+ scsi_remove_host(hostdata->host);
@@ -81,6 +87,10 @@ index 16b3f23c7ef5..a220ed2bd68b 100644
- scsi_remove_host(hostdata->host);
+ unmap_persist_bufs(hostdata);
+
++ spin_lock(&ibmvscsi_driver_lock);
++ list_del(&hostdata->host_list);
++ spin_unlock(&ibmvscsi_driver_lock);
++
scsi_host_put(hostdata->host);
return 0;
diff --git a/patches.drivers/ibmvscsi-Protect-ibmvscsi_head-from-concurrent-modif.patch b/patches.drivers/ibmvscsi-Protect-ibmvscsi_head-from-concurrent-modif.patch
index 757904740e..8ca57e73cd 100644
--- a/patches.drivers/ibmvscsi-Protect-ibmvscsi_head-from-concurrent-modif.patch
+++ b/patches.drivers/ibmvscsi-Protect-ibmvscsi_head-from-concurrent-modif.patch
@@ -1,13 +1,16 @@
-From f8b79e65484f1718126936de7f9154b3b5eeda73 Mon Sep 17 00:00:00 2001
+From 7205981e045e752ccf96cf6ddd703a98c59d4339 Mon Sep 17 00:00:00 2001
From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
-Date: Wed, 19 Dec 2018 22:33:12 -0800
-Subject: [PATCH] ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton
+Date: Wed, 20 Mar 2019 13:41:50 -0500
+Subject: [PATCH] scsi: ibmvscsi: Protect ibmvscsi_head from concurrent
+ modificaiton
References: bsc#1119019
-Patch-mainline: no, testing
+Patch-mainline: queued
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
+Git-commit: 7205981e045e752ccf96cf6ddd703a98c59d4339
-For each ibmvscsi host created during a probe or destroyed during a
-remove we either add or remove that host to/from the global ibmvscsi_head
+For each ibmvscsi host created during a probe or destroyed during a remove
+we either add or remove that host to/from the global ibmvscsi_head
list. This runs the risk of concurrent modification.
This patch adds a simple spinlock around the list modification calls to
@@ -15,15 +18,14 @@ prevent concurrent updates as is done similarly in the ibmvfc driver and
ipr driver.
Fixes: 32d6e4b6e4ea ("scsi: ibmvscsi: add vscsi hosts to global list_head")
-Cc: stable@vger.kernel.org # v4.10+
+Cc: <stable@vger.kernel.org> # v4.10+
Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
drivers/scsi/ibmvscsi/ibmvscsi.c | 5 +++++
1 file changed, 5 insertions(+)
-diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
-index 1deb0a9f14a6..16b3f23c7ef5 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -96,6 +96,7 @@ static int client_reserve = 1;
@@ -34,7 +36,7 @@ index 1deb0a9f14a6..16b3f23c7ef5 100644
static struct scsi_transport_template *ibmvscsi_transport_template;
-@@ -2274,7 +2275,9 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+@@ -2274,7 +2275,9 @@ static int ibmvscsi_probe(struct vio_dev
}
dev_set_drvdata(&vdev->dev, hostdata);
@@ -44,7 +46,7 @@ index 1deb0a9f14a6..16b3f23c7ef5 100644
return 0;
add_srp_port_failed:
-@@ -2296,7 +2299,9 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+@@ -2296,7 +2299,9 @@ static int ibmvscsi_probe(struct vio_dev
static int ibmvscsi_remove(struct vio_dev *vdev)
{
struct ibmvscsi_host_data *hostdata = dev_get_drvdata(&vdev->dev);
@@ -54,6 +56,3 @@ index 1deb0a9f14a6..16b3f23c7ef5 100644
unmap_persist_bufs(hostdata);
release_event_pool(&hostdata->pool, hostdata);
ibmvscsi_release_crq_queue(&hostdata->queue, hostdata,
---
-2.20.1
-
diff --git a/series.conf b/series.conf
index 8f2d7aab3f..9d8b738f52 100644
--- a/series.conf
+++ b/series.conf
@@ -20963,6 +20963,10 @@
patches.suse/0005-MODSIGN-Allow-the-db-UEFI-variable-to-be-suppressed.patch
patches.suse/0006-modsign-Use-secondary-trust-keyring-for-module-signi.patch
+ # mkp/scsi fixes
+ patches.drivers/ibmvscsi-Protect-ibmvscsi_head-from-concurrent-modif.patch
+ patches.drivers/ibmvscsi-Fix-empty-event-pool-access-during-host-rem.patch
+
# out-of-tree patches
patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
@@ -21175,9 +21179,6 @@
patches.arch/selftests-powerpc-Fix-core-pkey-for-default-execute-.patch
patches.arch/selftests-powerpc-Fix-ptrace-pkey-for-default-execut.patch
- patches.drivers/ibmvscsi-Protect-ibmvscsi_head-from-concurrent-modif.patch
- patches.drivers/ibmvscsi-Fix-empty-event-pool-access-during-host-rem.patch
-
########################################################
# cephfs
########################################################