stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] mpt3sas: Fix kernel panic observed on soft HBA unplug
@ 2020-03-11 10:36 Sreekanth Reddy
  2020-03-11 11:04 ` Amit Shah
  2020-03-14  2:25 ` Elliott, Robert (Servers)
  0 siblings, 2 replies; 10+ messages in thread
From: Sreekanth Reddy @ 2020-03-11 10:36 UTC (permalink / raw)
  To: martin.petersen
  Cc: linux-scsi, sathya.prakash, suganath-prabu.subramani, stable,
	amit, Sreekanth Reddy

Generic protection fault type kernel panic is observed when user
performs soft(ordered) HBA unplug operation while IOs are running
on drives connected to HBA.

When user performs ordered HBA removal operation then kernel calls
PCI device's .remove() call back function where driver is flushing out
all the outstanding SCSI IO commands with DID_NO_CONNECT host byte and
also un-maps sg buffers allocated for these IO commands.
But in the ordered HBA removal case (unlike of real HBA hot unplug)
HBA device is still alive and hence HBA hardware is performing the
DMA operations to those buffers on the system memory which are already
unmapped while flushing out the outstanding SCSI IO commands
and this leads to Kernel panic.

Fix:
Don't flush out the outstanding IOs from .remove() path in case of
ordered HBA removal since HBA will be still alive in this case and
it can complete the outstanding IOs. Flush out the outstanding IOs
only in case physical HBA hot unplug where their won't be any
communication with the HBA.

Cc: stable@vger.kernel.org
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
---
 drivers/scsi/mpt3sas/mpt3sas_scsih.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 778d5e6..04a40af 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -9908,8 +9908,8 @@ static void scsih_remove(struct pci_dev *pdev)
 
 	ioc->remove_host = 1;
 
-	mpt3sas_wait_for_commands_to_complete(ioc);
-	_scsih_flush_running_cmds(ioc);
+	if (!pci_device_is_present(pdev))
+		_scsih_flush_running_cmds(ioc);
 
 	_scsih_fw_event_cleanup_queue(ioc);
 
@@ -9992,8 +9992,8 @@ static void scsih_remove(struct pci_dev *pdev)
 
 	ioc->remove_host = 1;
 
-	mpt3sas_wait_for_commands_to_complete(ioc);
-	_scsih_flush_running_cmds(ioc);
+	if (!pci_device_is_present(pdev))
+		_scsih_flush_running_cmds(ioc);
 
 	_scsih_fw_event_cleanup_queue(ioc);
 
-- 
1.8.3.1


^ permalink raw reply related	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2020-03-27 10:36 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-11 10:36 [PATCH] mpt3sas: Fix kernel panic observed on soft HBA unplug Sreekanth Reddy
2020-03-11 11:04 ` Amit Shah
2020-03-11 11:25   ` Sreekanth Reddy
2020-03-11 11:49     ` Sreekanth Reddy
2020-03-11 14:48       ` Amit Shah
2020-03-14  2:25       ` Elliott, Robert (Servers)
2020-03-14  2:25 ` Elliott, Robert (Servers)
2020-03-16  6:15   ` Sreekanth Reddy
2020-03-27  1:50     ` Martin K. Petersen
2020-03-27 10:35       ` Sreekanth Reddy

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).