]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
scsi: lpfc: Fix FCP I/O flush functionality for TMF routines
authorJames Smart <jsmart2021@gmail.com>
Fri, 10 Sep 2021 23:31:53 +0000 (16:31 -0700)
committerAndrea Righi <andrea.righi@canonical.com>
Tue, 7 Dec 2021 06:32:27 +0000 (07:32 +0100)
commitf1de9ac7685388ac1dd484e05952ce8f8fb50e7d
tree3d8dd546b80dc403fd144c28c5d56cb07d1963b1
parentac979fab364cd2faeacd7668a0400329f658c87a
scsi: lpfc: Fix FCP I/O flush functionality for TMF routines

BugLink: https://bugs.launchpad.net/bugs/1951822
commit cd8a36a90babf958082b87bc6b4df5dd70901eba upstream.

A prior patch inadvertently caused lpfc_sli_sum_iocb() to exclude counting
of outstanding aborted I/Os and ABORT IOCBs.  Thus,
lpfc_reset_flush_io_context() called from any TMF routine does not properly
wait to flush all outstanding FCP IOCBs leading to a block layer crash on
an invalid scsi_cmnd->request pointer.

  kernel BUG at ../block/blk-core.c:1489!
  RIP: 0010:blk_requeue_request+0xaf/0xc0
  ...
  Call Trace:
  <IRQ>
  __scsi_queue_insert+0x90/0xe0 [scsi_mod]
  blk_done_softirq+0x7e/0x90
  __do_softirq+0xd2/0x280
  irq_exit+0xd5/0xe0
  do_IRQ+0x4c/0xd0
  common_interrupt+0x87/0x87
  </IRQ>

Fix by separating out the LPFC_IO_FCP, LPFC_IO_ON_TXCMPLQ,
LPFC_DRIVER_ABORTED, and CMD_ABORT_XRI_CN || CMD_CLOSE_XRI_CN checks into a
new lpfc_sli_validate_fcp_iocb_for_abort() routine when determining to
build an ABORT iocb.

Restore lpfc_reset_flush_io_context() functionality by including counting
of outstanding aborted IOCBs and ABORT IOCBs in lpfc_sli_sum_iocb().

Link: https://lore.kernel.org/r/20210910233159.115896-9-jsmart2021@gmail.com
Fixes: e1364711359f ("scsi: lpfc: Fix illegal memory access on Abort IOCBs")
Cc: <stable@vger.kernel.org> # v5.12+
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
drivers/scsi/lpfc/lpfc_sli.c