From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Bodo Stroesser <bstroesser@ts.fujitsu.com>,
JiangYu <lnsyyj@hotmail.com>, Daniel Meyerholt <dxm523@gmail.com>,
Mike Christie <michael.christie@oracle.com>,
"Martin K . Petersen" <martin.petersen@oracle.com>,
Sasha Levin <sashal@kernel.org>,
linux-scsi@vger.kernel.org, target-devel@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 02/22] scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM
Date: Wed, 19 Aug 2020 20:02:09 -0400 [thread overview]
Message-ID: <20200820000229.215333-2-sashal@kernel.org> (raw)
In-Reply-To: <20200820000229.215333-1-sashal@kernel.org>
From: Bodo Stroesser <bstroesser@ts.fujitsu.com>
[ Upstream commit 3145550a7f8b08356c8ff29feaa6c56aca12901d ]
This patch fixes the following crash (see
https://bugzilla.kernel.org/show_bug.cgi?id=208045)
Process iscsi_trx (pid: 7496, stack limit = 0x0000000010dd111a)
CPU: 0 PID: 7496 Comm: iscsi_trx Not tainted 4.19.118-0419118-generic
#202004230533
Hardware name: Greatwall QingTian DF720/F601, BIOS 601FBE20 Sep 26 2019
pstate: 80400005 (Nzcv daif +PAN -UAO)
pc : flush_dcache_page+0x18/0x40
lr : is_ring_space_avail+0x68/0x2f8 [target_core_user]
sp : ffff000015123a80
x29: ffff000015123a80 x28: 0000000000000000
x27: 0000000000001000 x26: ffff000023ea5000
x25: ffffcfa25bbe08b8 x24: 0000000000000078
x23: ffff7e0000000000 x22: ffff000023ea5001
x21: ffffcfa24b79c000 x20: 0000000000000fff
x19: ffff7e00008fa940 x18: 0000000000000000
x17: 0000000000000000 x16: ffff2d047e709138
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: ffff2d047fbd0a40
x11: 0000000000000000 x10: 0000000000000030
x9 : 0000000000000000 x8 : ffffc9a254820a00
x7 : 00000000000013b0 x6 : 000000000000003f
x5 : 0000000000000040 x4 : ffffcfa25bbe08e8
x3 : 0000000000001000 x2 : 0000000000000078
x1 : ffffcfa25bbe08b8 x0 : ffff2d040bc88a18
Call trace:
flush_dcache_page+0x18/0x40
is_ring_space_avail+0x68/0x2f8 [target_core_user]
queue_cmd_ring+0x1f8/0x680 [target_core_user]
tcmu_queue_cmd+0xe4/0x158 [target_core_user]
__target_execute_cmd+0x30/0xf0 [target_core_mod]
target_execute_cmd+0x294/0x390 [target_core_mod]
transport_generic_new_cmd+0x1e8/0x358 [target_core_mod]
transport_handle_cdb_direct+0x50/0xb0 [target_core_mod]
iscsit_execute_cmd+0x2b4/0x350 [iscsi_target_mod]
iscsit_sequence_cmd+0xd8/0x1d8 [iscsi_target_mod]
iscsit_process_scsi_cmd+0xac/0xf8 [iscsi_target_mod]
iscsit_get_rx_pdu+0x404/0xd00 [iscsi_target_mod]
iscsi_target_rx_thread+0xb8/0x130 [iscsi_target_mod]
kthread+0x130/0x138
ret_from_fork+0x10/0x18
Code: f9000bf3 aa0003f3 aa1e03e0 d503201f (f9400260)
---[ end trace 1e451c73f4266776 ]---
The solution is based on patch:
"scsi: target: tcmu: Optimize use of flush_dcache_page"
which restricts the use of tcmu_flush_dcache_range() to addresses from
vmalloc'ed areas only.
This patch now replaces the virt_to_page() call in
tcmu_flush_dcache_range() - which is wrong for vmalloced addrs - by
vmalloc_to_page().
The patch was tested on ARM with kernel 4.19.118 and 5.7.2
Link: https://lore.kernel.org/r/20200618131632.32748-3-bstroesser@ts.fujitsu.com
Tested-by: JiangYu <lnsyyj@hotmail.com>
Tested-by: Daniel Meyerholt <dxm523@gmail.com>
Acked-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/target_core_user.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index a497e7c1f4fcc..d766fb14942b3 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -601,7 +601,7 @@ static inline void tcmu_flush_dcache_range(void *vaddr, size_t size)
size = round_up(size+offset, PAGE_SIZE);
while (size) {
- flush_dcache_page(virt_to_page(start));
+ flush_dcache_page(vmalloc_to_page(start));
start += PAGE_SIZE;
size -= PAGE_SIZE;
}
--
2.25.1
next prev parent reply other threads:[~2020-08-20 0:09 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-20 0:02 [PATCH AUTOSEL 5.4 01/22] scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices Sasha Levin
2020-08-20 0:02 ` Sasha Levin [this message]
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 03/22] media: budget-core: Improve exception handling in budget_register() Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 04/22] rtc: goldfish: Enable interrupt in set_alarm() when necessary Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 05/22] media: vpss: clean up resources in init Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 06/22] Input: psmouse - add a newline when printing 'proto' by sysfs Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 07/22] MIPS: Fix unable to reserve memory for Crash kernel Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 08/22] m68knommu: fix overwriting of bits in ColdFire V3 cache control Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 09/22] svcrdma: Fix another Receive buffer leak Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 10/22] xfs: fix inode quota reservation checks Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 11/22] drm/ttm: fix offset in VMAs with a pg_offs in ttm_bo_vm_access Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 12/22] jffs2: fix UAF problem Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 13/22] ceph: fix use-after-free for fsc->mdsc Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 14/22] swiotlb-xen: use vmalloc_to_page on vmalloc virt addresses Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 15/22] cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0 Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 16/22] scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 17/22] virtio_ring: Avoid loop when vq is broken in virtqueue_poll Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 18/22] media: camss: fix memory leaks on error handling paths in probe Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 19/22] tools/testing/selftests/cgroup/cgroup_util.c: cg_read_strcmp: fix null pointer dereference Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 20/22] xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 21/22] alpha: fix annotation of io{read,write}{16,32}be() Sasha Levin
2020-08-20 0:02 ` [PATCH AUTOSEL 5.4 22/22] fs/signalfd.c: fix inconsistent return codes for signalfd4 Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200820000229.215333-2-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=bstroesser@ts.fujitsu.com \
--cc=dxm523@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=lnsyyj@hotmail.com \
--cc=martin.petersen@oracle.com \
--cc=michael.christie@oracle.com \
--cc=stable@vger.kernel.org \
--cc=target-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).