From: John Garry <john.garry@huawei.com> To: <jejb@linux.vnet.ibm.com>, <martin.petersen@oracle.com> Cc: <john.garry2@mail.dcu.ie>, <linuxarm@huawei.com>, <linux-scsi@vger.kernel.org>, <linux-kernel@vger.kernel.org>, <zhangfei.gao@linaro.org>, John Garry <john.garry@huawei.com> Subject: [PATCH 5/6] scsi: hisi_sas: fix NULL deference when TMF timeouts Date: Mon, 10 Apr 2017 21:22:00 +0800 [thread overview] Message-ID: <1491830521-21437-6-git-send-email-john.garry@huawei.com> (raw) In-Reply-To: <1491830521-21437-1-git-send-email-john.garry@huawei.com> If a TMF timeouts (maybe due to unlikely scenario of an expander being unplugged when TMF for remote device is active), when we eventually try to free the slot, we crash as we dereference the slot's task, which has already been released. As a fix, add checks in the slot release code for a NULL task. Signed-off-by: John Garry <john.garry@huawei.com> --- drivers/scsi/hisi_sas/hisi_sas_main.c | 60 +++++++++++++++++++---------------- 1 file changed, 33 insertions(+), 27 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index a5c6d06..7e6e882 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -77,17 +77,22 @@ static void hisi_sas_slot_index_init(struct hisi_hba *hisi_hba) void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, struct hisi_sas_slot *slot) { - struct device *dev = &hisi_hba->pdev->dev; - struct domain_device *device = task->dev; - struct hisi_sas_device *sas_dev = device->lldd_dev; - if (!slot->task) - return; + if (task) { + struct device *dev = &hisi_hba->pdev->dev; + struct domain_device *device = task->dev; + struct hisi_sas_device *sas_dev = device->lldd_dev; - if (!sas_protocol_ata(task->task_proto)) - if (slot->n_elem) - dma_unmap_sg(dev, task->scatter, slot->n_elem, - task->data_dir); + if (!sas_protocol_ata(task->task_proto)) + if (slot->n_elem) + dma_unmap_sg(dev, task->scatter, slot->n_elem, + task->data_dir); + + task->lldd_task = NULL; + + if (sas_dev) + atomic64_dec(&sas_dev->running_req); + } if (slot->command_table) dma_pool_free(hisi_hba->command_table_pool, @@ -102,12 +107,10 @@ void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, slot->sge_page_dma); list_del_init(&slot->entry); - task->lldd_task = NULL; slot->task = NULL; slot->port = NULL; hisi_sas_slot_index_free(hisi_hba, slot->idx); - if (sas_dev) - atomic64_dec(&sas_dev->running_req); + /* slot memory is fully zeroed when it is reused */ } EXPORT_SYMBOL_GPL(hisi_sas_slot_task_free); @@ -569,25 +572,23 @@ static void hisi_sas_port_notify_formed(struct asd_sas_phy *sas_phy) spin_unlock_irqrestore(&hisi_hba->lock, flags); } -static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, - struct sas_task *task, +static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, struct sas_task *task, struct hisi_sas_slot *slot) { - struct task_status_struct *ts; - unsigned long flags; - - if (!task) - return; + if (task) { + unsigned long flags; + struct task_status_struct *ts; - ts = &task->task_status; + ts = &task->task_status; - ts->resp = SAS_TASK_COMPLETE; - ts->stat = SAS_ABORTED_TASK; - spin_lock_irqsave(&task->task_state_lock, flags); - task->task_state_flags &= - ~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR); - task->task_state_flags |= SAS_TASK_STATE_DONE; - spin_unlock_irqrestore(&task->task_state_lock, flags); + ts->resp = SAS_TASK_COMPLETE; + ts->stat = SAS_ABORTED_TASK; + spin_lock_irqsave(&task->task_state_lock, flags); + task->task_state_flags &= + ~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR); + task->task_state_flags |= SAS_TASK_STATE_DONE; + spin_unlock_irqrestore(&task->task_state_lock, flags); + } hisi_sas_slot_task_free(hisi_hba, task, slot); } @@ -742,7 +743,12 @@ static int hisi_sas_exec_internal_tmf_task(struct domain_device *device, /* Even TMF timed out, return direct. */ if ((task->task_state_flags & SAS_TASK_STATE_ABORTED)) { if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) { + struct hisi_sas_slot *slot = task->lldd_task; + dev_err(dev, "abort tmf: TMF task timeout\n"); + if (slot) + slot->task = NULL; + goto ex_err; } } -- 1.9.1
WARNING: multiple messages have this Message-ID (diff)
From: John Garry <john.garry@huawei.com> To: jejb@linux.vnet.ibm.com, martin.petersen@oracle.com Cc: john.garry2@mail.dcu.ie, linuxarm@huawei.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, zhangfei.gao@linaro.org, John Garry <john.garry@huawei.com> Subject: [PATCH 5/6] scsi: hisi_sas: fix NULL deference when TMF timeouts Date: Mon, 10 Apr 2017 21:22:00 +0800 [thread overview] Message-ID: <1491830521-21437-6-git-send-email-john.garry@huawei.com> (raw) In-Reply-To: <1491830521-21437-1-git-send-email-john.garry@huawei.com> If a TMF timeouts (maybe due to unlikely scenario of an expander being unplugged when TMF for remote device is active), when we eventually try to free the slot, we crash as we dereference the slot's task, which has already been released. As a fix, add checks in the slot release code for a NULL task. Signed-off-by: John Garry <john.garry@huawei.com> --- drivers/scsi/hisi_sas/hisi_sas_main.c | 60 +++++++++++++++++++---------------- 1 file changed, 33 insertions(+), 27 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index a5c6d06..7e6e882 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -77,17 +77,22 @@ static void hisi_sas_slot_index_init(struct hisi_hba *hisi_hba) void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, struct hisi_sas_slot *slot) { - struct device *dev = &hisi_hba->pdev->dev; - struct domain_device *device = task->dev; - struct hisi_sas_device *sas_dev = device->lldd_dev; - if (!slot->task) - return; + if (task) { + struct device *dev = &hisi_hba->pdev->dev; + struct domain_device *device = task->dev; + struct hisi_sas_device *sas_dev = device->lldd_dev; - if (!sas_protocol_ata(task->task_proto)) - if (slot->n_elem) - dma_unmap_sg(dev, task->scatter, slot->n_elem, - task->data_dir); + if (!sas_protocol_ata(task->task_proto)) + if (slot->n_elem) + dma_unmap_sg(dev, task->scatter, slot->n_elem, + task->data_dir); + + task->lldd_task = NULL; + + if (sas_dev) + atomic64_dec(&sas_dev->running_req); + } if (slot->command_table) dma_pool_free(hisi_hba->command_table_pool, @@ -102,12 +107,10 @@ void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, slot->sge_page_dma); list_del_init(&slot->entry); - task->lldd_task = NULL; slot->task = NULL; slot->port = NULL; hisi_sas_slot_index_free(hisi_hba, slot->idx); - if (sas_dev) - atomic64_dec(&sas_dev->running_req); + /* slot memory is fully zeroed when it is reused */ } EXPORT_SYMBOL_GPL(hisi_sas_slot_task_free); @@ -569,25 +572,23 @@ static void hisi_sas_port_notify_formed(struct asd_sas_phy *sas_phy) spin_unlock_irqrestore(&hisi_hba->lock, flags); } -static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, - struct sas_task *task, +static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, struct sas_task *task, struct hisi_sas_slot *slot) { - struct task_status_struct *ts; - unsigned long flags; - - if (!task) - return; + if (task) { + unsigned long flags; + struct task_status_struct *ts; - ts = &task->task_status; + ts = &task->task_status; - ts->resp = SAS_TASK_COMPLETE; - ts->stat = SAS_ABORTED_TASK; - spin_lock_irqsave(&task->task_state_lock, flags); - task->task_state_flags &= - ~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR); - task->task_state_flags |= SAS_TASK_STATE_DONE; - spin_unlock_irqrestore(&task->task_state_lock, flags); + ts->resp = SAS_TASK_COMPLETE; + ts->stat = SAS_ABORTED_TASK; + spin_lock_irqsave(&task->task_state_lock, flags); + task->task_state_flags &= + ~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR); + task->task_state_flags |= SAS_TASK_STATE_DONE; + spin_unlock_irqrestore(&task->task_state_lock, flags); + } hisi_sas_slot_task_free(hisi_hba, task, slot); } @@ -742,7 +743,12 @@ static int hisi_sas_exec_internal_tmf_task(struct domain_device *device, /* Even TMF timed out, return direct. */ if ((task->task_state_flags & SAS_TASK_STATE_ABORTED)) { if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) { + struct hisi_sas_slot *slot = task->lldd_task; + dev_err(dev, "abort tmf: TMF task timeout\n"); + if (slot) + slot->task = NULL; + goto ex_err; } } -- 1.9.1
next prev parent reply other threads:[~2017-04-10 12:52 UTC|newest] Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-04-10 13:21 [PATCH 0/6] hisi_sas: v2 hw SoC bug workarounds John Garry 2017-04-10 13:21 ` John Garry 2017-04-10 13:21 ` [PATCH 1/6] scsi: hisi_sas: workaround STP link SoC bug John Garry 2017-04-10 13:21 ` John Garry 2017-04-10 13:16 ` Johannes Thumshirn 2017-04-10 13:21 ` [PATCH 2/6] scsi: hisi_sas: workaround a SoC SATA IO processing bug John Garry 2017-04-10 13:21 ` John Garry 2017-04-10 14:07 ` Johannes Thumshirn 2017-04-10 13:21 ` [PATCH 3/6] scsi: hisi_sas: workaround SoC about abort timeout bug John Garry 2017-04-10 13:21 ` John Garry 2017-04-10 13:21 ` [PATCH 4/6] scsi: hisi_sas: add v2 hw internal abort timeout workaround John Garry 2017-04-10 13:21 ` John Garry 2017-04-10 13:22 ` John Garry [this message] 2017-04-10 13:22 ` [PATCH 5/6] scsi: hisi_sas: fix NULL deference when TMF timeouts John Garry 2017-04-10 13:22 ` [PATCH 6/6] scsi: hisi_sas: controller reset for multi-bits ECC and AXI fatal errors John Garry 2017-04-10 13:22 ` John Garry 2017-04-12 2:02 ` [PATCH 0/6] hisi_sas: v2 hw SoC bug workarounds Martin K. Petersen 2017-04-12 2:02 ` Martin K. Petersen
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1491830521-21437-6-git-send-email-john.garry@huawei.com \ --to=john.garry@huawei.com \ --cc=jejb@linux.vnet.ibm.com \ --cc=john.garry2@mail.dcu.ie \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-scsi@vger.kernel.org \ --cc=linuxarm@huawei.com \ --cc=martin.petersen@oracle.com \ --cc=zhangfei.gao@linaro.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.