niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

scsi: lpfc: Fix illegal memory access on Abort IOCBs

Browse source 
In devloss timer handler and in backend calls to terminate remote port I/O,
there is logic to walk through all active IOCBs and validate them to
potentially trigger an abort request. This logic is causing illegal memory
accesses which leads to a crash. Abort IOCBs, which may be on the list, do
not have an associated lpfc_io_buf struct. The driver is trying to map an
lpfc_io_buf struct on the IOCB and which results in a bogus address thus
the issue.

Fix by skipping over ABORT IOCBs (CLOSE IOCBs are ABORTS that don't send
ABTS) in the IOCB scan logic.

Link: https://lore.kernel.org/r/20210421234433.102079-1-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
James Smart 2021-04-21 16:44:33 -07:00 • committed by Martin K. Petersen
parent 8536704051
commit e136471135
1 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
drivers/scsi/lpfc/lpfc_sli.c
View file

@ -11804,13 +11804,20 @@ lpfc_sli_validate_fcp_iocb(struct lpfc_iocbq *iocbq, struct lpfc_vport *vport,
lpfc_ctx_cmd ctx_cmd) lpfc_ctx_cmd ctx_cmd)
{ {
struct lpfc_io_buf *lpfc_cmd; struct lpfc_io_buf *lpfc_cmd;
IOCB_t *icmd = NULL;
int rc = 1; int rc = 1;
if (!iocbq || iocbq->vport != vport) if (!iocbq || iocbq->vport != vport)
return rc; return rc;
if (!(iocbq->iocb_flag & LPFC_IO_FCP) || if (!(iocbq->iocb_flag & LPFC_IO_FCP) ||
!(iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ)) !(iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ) ||
iocbq->iocb_flag & LPFC_DRIVER_ABORTED)
return rc;
icmd = &iocbq->iocb;
if (icmd->ulpCommand == CMD_ABORT_XRI_CN ||
icmd->ulpCommand == CMD_CLOSE_XRI_CN)
return rc; return rc;
lpfc_cmd = container_of(iocbq, struct lpfc_io_buf, cur_iocbq); lpfc_cmd = container_of(iocbq, struct lpfc_io_buf, cur_iocbq);