scsi: lpfc: Fix crash in the function lpfc_sli4_queue_free when reboot

scsi: lpfc: Fix crash in the function lpfc_sli4_queue_free when reboot

[Zhangguanghui]

Hi everyone
There is a crash in the function lpfc_sli4_queue_free while rebooting the host.
potential crash arising from ' wq_list list_delete' ordering problems.
I thinks it’s the correct order.
can you help me review and commit this patch, Best regards

diff --git a/drivers/scsi/lpfc /lpfc_sli.c b/drivers/scsi/lpfc /lpfc_sli.c
index 50f13ab..0cd5a96 100644
--- a/drivers/scsi/lpfc /lpfc_sli.c
+++ b/drivers/scsi/lpfc /lpfc_sli.c
@@ -14438,9 +14438,6 @@ lpfc_sli4_queue_free(struct lpfc_queue *queue)
        if (!queue)
                return;

-       if (!list_empty(&queue->wq_list))
-               list_del(&queue->wq_list);
-
        while (!list_empty(&queue->page_list)) {
                list_remove_head(&queue->page_list, dmabuf, struct lpfc_dmabuf,
                                 list);
@@ -14453,6 +14450,9 @@ lpfc_sli4_queue_free(struct lpfc_queue *queue)
                kfree(queue->rqbp);
        }

+       if (!list_empty(&queue->wq_list))
+               list_del(&queue->wq_list);
+
        if (!list_empty(&queue->cpu_list))
                list_del(&queue->cpu_list);
-------------------------------------------------------------------------------------------------------------------------------------
本邮件及其附件含有新华三集团的保密信息，仅限于发送给上面地址中列出
的个人或群组。禁止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制、
或散发）本邮件中的信息。如果您错收了本邮件，请您立即电话或邮件通知发件人并删除本
邮件！
This e-mail and its attachments contain confidential information from New H3C, which is
intended only for the person or entity whose address is listed above. Any use of the
information contained herein in any way (including, but not limited to, total or partial
disclosure, reproduction, or dissemination) by persons other than the intended
recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender
by phone or email immediately and delete it!

Re: scsi: lpfc: Fix crash in the function lpfc_sli4_queue_free when reboot

[James Smart]

On 11/1/2019 2:20 AM, Zhangguanghui wrote:
> Hi everyone
> There is a crash in the function lpfc_sli4_queue_free while rebooting the host.
> potential crash arising from ' wq_list list_delete' ordering problems.
> I thinks it’s the correct order.
> can you help me review and commit this patch, Best regards
>
> diff --git a/drivers/scsi/lpfc /lpfc_sli.c b/drivers/scsi/lpfc /lpfc_sli.c
> index 50f13ab..0cd5a96 100644
> --- a/drivers/scsi/lpfc /lpfc_sli.c
> +++ b/drivers/scsi/lpfc /lpfc_sli.c
> @@ -14438,9 +14438,6 @@ lpfc_sli4_queue_free(struct lpfc_queue *queue)
>          if (!queue)
>                  return;
>
> -       if (!list_empty(&queue->wq_list))
> -               list_del(&queue->wq_list);
> -
>          while (!list_empty(&queue->page_list)) {
>                  list_remove_head(&queue->page_list, dmabuf, struct lpfc_dmabuf,
>                                   list);
> @@ -14453,6 +14450,9 @@ lpfc_sli4_queue_free(struct lpfc_queue *queue)
>                  kfree(queue->rqbp);
>          }
>
> +       if (!list_empty(&queue->wq_list))
> +               list_del(&queue->wq_list);
> +
>          if (!list_empty(&queue->cpu_list))
>                  list_del(&queue->cpu_list);
>

Hi,

Thank you for the patch. It's not clear what the patch is actually 
fixing.  The change in order simply puts a longer delay in before the 
list freeing is done.

Can you send a stack trace or more information about the problem ?
What driver rev (see lpfc_version.h, also printed in dmesg at driver 
load/1st attach) was your crash ?

-- james