kernel.git/drivers/scsi/libfc/fc_exch.c, branch linux-4.4.y

scsi: libfc: Avoid invoking response handler twice if ep is already completed

2021-02-10T08:07:26Z

[ Upstream commit b2b0f16fa65e910a3ec8771206bb49ee87a54ac5 ] A race condition exists between the response handler getting called because of exchange_mgr_reset() (which clears out all the active XIDs) and the response we get via an interrupt. Sequence of events: rport ba0200: Port timeout, state PLOGI rport ba0200: Port entered PLOGI state from PLOGI state xid 1052: Exchange timer armed : 20000 msecs  xid timer armed here rport ba0200: Received LOGO request while in state PLOGI rport ba0200: Delete port rport ba0200: work event 3 rport ba0200: lld callback ev 3 bnx2fc: rport_event_hdlr: event = 3, port_id = 0xba0200 bnx2fc: ba0200 - rport not created Yet!! /* Here we reset any outstanding exchanges before freeing rport using the exch_mgr_reset() */ xid 1052: Exchange timer canceled /* Here we got two responses for one xid */ xid 1052: invoking resp(), esb 20000000 state 3 xid 1052: invoking resp(), esb 20000000 state 3 xid 1052: fc_rport_plogi_resp() : ep->resp_active 2 xid 1052: fc_rport_plogi_resp() : ep->resp_active 2 Skip the response if the exchange is already completed. Link: https://lore.kernel.org/r/20201215194731.2326-1-jhasan@marvell.com Signed-off-by: Javed Hasan Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

scsi: libfc: fix null pointer dereference on a null lport

2020-01-29T09:21:45Z

[ Upstream commit 41a6bf6529edd10a6def42e3b2c34a7474bcc2f5 ] Currently if lport is null then the null lport pointer is dereference when printing out debug via the FC_LPORT_DB macro. Fix this by using the more generic FC_LIBFC_DBG debug macro instead that does not use lport. Addresses-Coverity: ("Dereference after null check") Fixes: 7414705ea4ae ("libfc: Add runtime debugging with debug_logging module parameter") Signed-off-by: Colin Ian King Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

libfc: Fix fc_exch_recv_req() error path

2015-08-12T18:23:30Z

Due to patch "libfc: Do not invoke the response handler after fc_exch_done()" (commit ID 7030fd62) the lport_recv() call in fc_exch_recv_req() is passed a dangling pointer. Avoid this by moving the fc_frame_free() call from fc_invoke_resp() to its callers. This patch fixes the following crash: general protection fault: 0000 [#3] PREEMPT SMP RIP: fc_lport_recv_req+0x72/0x280 [libfc] Call Trace: fc_exch_recv+0x642/0xde0 [libfc] fcoe_percpu_receive_thread+0x46a/0x5ed [fcoe] kthread+0x10a/0x120 ret_from_fork+0x42/0x70 Signed-off-by: Bart Van Assche Cc: stable Signed-off-by: Vasu Dev Signed-off-by: James Bottomley

libfc: Do not invoke the response handler after fc_exch_done()

2013-09-04T20:45:22Z

While the FCoE initiator driver invokes fc_exch_done() from inside the libfc response handler, FCoE target drivers typically invoke fc_exch_done() from outside the libfc response handler. The object fc_exch.arg points at may disappear as soon as fc_exch_done() has finished. So it's important not to invoke the response handler function after fc_exch_done() has finished. Modify libfc such that this guarantee is provided if fc_exch_done() is invoked from outside a response handler. This patch fixes a sporadic crash in FCoE target implementations after a command has been aborted. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Reduce exchange lock contention in fc_exch_recv_abts()

2013-09-04T20:37:53Z

Reduce the time during which the exchange lock is held by allocating a frame before obtaining the exchange lock. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Avoid that sending after an abort triggers a kernel warning

2013-09-04T20:30:43Z

Calling fc_seq_send() after an ABTS message has been received triggers a kernel warning (WARN_ON(!(ep->esb_stat & ESB_ST_SEQ_INIT))). Avoid this by returning -ENXIO to the caller if fc_seq_send() is invoked after an ABTS message has been received. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Protect ep->esb_stat changes via ex_lock

2013-09-04T20:23:38Z

This patch avoids that the WARN_ON(!(ep->esb_stat & ESB_ST_SEQ_INIT)) statement in fc_seq_send_locked() gets triggered sporadically when running FCoE target code due to concurrent ep->esb_stat modifications. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Fix a race in fc_exch_timer_set_locked()

2013-09-04T20:16:25Z

It is allowed to pass a zero timeout value to fc_seq_exch_abort(). Avoid that this can cause the timeout function to drop the exchange reference before it has been increased by fc_exch_timer_set_locked(). This patch fixes a crash when running FCoE target code with poisoning enabled in the memory allocator. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Clarify fc_exch_find()

2013-09-04T20:09:15Z

The condition ep != NULL && ep->xid != xid can never be met. Make this explicit. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Micro-optimize fc_setup_exch_mgr()

2013-09-04T20:02:09Z

Convert a loop into an ilog2() call. Although this code is not performance sensitive this conversion makes this code easier to read. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love