Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1738451
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.13 059/109] scsi: aacraid: Fix command send race condition |
| Date | 2017-09-24 23:00 +0200 |
| Message-ID | <utman-50G-53@gated-at.bofh.it> (permalink) |
| References | <utm0F-4Xd-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit 1ae948fa4f00f3a2823e7cb19a3049ef27dd6947 upstream.
This fixes a potential race condition observed on Power systems.
Several places throughout the aacraid driver call aac_fib_send or
similar to send a command to the aacraid adapter, then check the return
code to determine if the command was actually sent to the adapter, then
update the phase field in the scsi command scratch pad area to track
that the firmware now owns this command. However, there is nothing that
ensures that by the time the aac_fib_send function returns and we go to
write to the scsi command, that the command hasn't already completed and
the scsi command has been freed. This was causing random crashes in the
TCP stack which was tracked down to be caused by memory that had been a
struct request + scsi_cmnd being now used for an skbuff. Memory
poisoning was enabled in the kernel to debug this which showed that the
last owner of the memory that had been freed was aacraid and that it was
a struct request. The memory that was corrupted was the exact data
pattern of AAC_OWNER_FIRMWARE and it was at the same offset that aacraid
writes, which is scsicmd->SCp.phase. The patch below resolves this
issue.
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Tested-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Dave Carroll <david.carroll@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/aacraid/aachba.c | 54 ++++++++++++++++--------------------------
1 file changed, 21 insertions(+), 33 deletions(-)
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -594,6 +594,7 @@ static int aac_get_container_name(struct
aac_fib_init(cmd_fibcontext);
dinfo = (struct aac_get_name *) fib_data(cmd_fibcontext);
+ scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
dinfo->command = cpu_to_le32(VM_ContainerConfig);
dinfo->type = cpu_to_le32(CT_READ_NAME);
@@ -611,10 +612,8 @@ static int aac_get_container_name(struct
/*
* Check that the command queued to the controller
*/
- if (status == -EINPROGRESS) {
- scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+ if (status == -EINPROGRESS)
return 0;
- }
printk(KERN_WARNING "aac_get_container_name: aac_fib_send failed with status: %d.\n", status);
aac_fib_complete(cmd_fibcontext);
@@ -725,6 +724,7 @@ static void _aac_probe_container1(void *
dinfo->count = cpu_to_le32(scmd_id(scsicmd));
dinfo->type = cpu_to_le32(FT_FILESYS);
+ scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
status = aac_fib_send(ContainerCommand,
fibptr,
@@ -736,9 +736,7 @@ static void _aac_probe_container1(void *
/*
* Check that the command queued to the controller
*/
- if (status == -EINPROGRESS)
- scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
- else if (status < 0) {
+ if (status < 0 && status != -EINPROGRESS) {
/* Inherit results from VM_NameServe, if any */
dresp->status = cpu_to_le32(ST_OK);
_aac_probe_container2(context, fibptr);
@@ -766,6 +764,7 @@ static int _aac_probe_container(struct s
dinfo->count = cpu_to_le32(scmd_id(scsicmd));
dinfo->type = cpu_to_le32(FT_FILESYS);
scsicmd->SCp.ptr = (char *)callback;
+ scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
status = aac_fib_send(ContainerCommand,
fibptr,
@@ -777,10 +776,9 @@ static int _aac_probe_container(struct s
/*
* Check that the command queued to the controller
*/
- if (status == -EINPROGRESS) {
- scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+ if (status == -EINPROGRESS)
return 0;
- }
+
if (status < 0) {
scsicmd->SCp.ptr = NULL;
aac_fib_complete(fibptr);
@@ -1126,6 +1124,7 @@ static int aac_get_container_serial(stru
dinfo->command = cpu_to_le32(VM_ContainerConfig);
dinfo->type = cpu_to_le32(CT_CID_TO_32BITS_UID);
dinfo->cid = cpu_to_le32(scmd_id(scsicmd));
+ scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
status = aac_fib_send(ContainerCommand,
cmd_fibcontext,
@@ -1138,10 +1137,8 @@ static int aac_get_container_serial(stru
/*
* Check that the command queued to the controller
*/
- if (status == -EINPROGRESS) {
- scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+ if (status == -EINPROGRESS)
return 0;
- }
printk(KERN_WARNING "aac_get_container_serial: aac_fib_send failed with status: %d.\n", status);
aac_fib_complete(cmd_fibcontext);
@@ -2335,16 +2332,14 @@ static int aac_read(struct scsi_cmnd * s
* Alocate and initialize a Fib
*/
cmd_fibcontext = aac_fib_alloc_tag(dev, scsicmd);
-
+ scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
status = aac_adapter_read(cmd_fibcontext, scsicmd, lba, count);
/*
* Check that the command queued to the controller
*/
- if (status == -EINPROGRESS) {
- scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+ if (status == -EINPROGRESS)
return 0;
- }
printk(KERN_WARNING "aac_read: aac_fib_send failed with status: %d.\n", status);
/*
@@ -2429,16 +2424,14 @@ static int aac_write(struct scsi_cmnd *
* Allocate and initialize a Fib then setup a BlockWrite command
*/
cmd_fibcontext = aac_fib_alloc_tag(dev, scsicmd);
-
+ scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
status = aac_adapter_write(cmd_fibcontext, scsicmd, lba, count, fua);
/*
* Check that the command queued to the controller
*/
- if (status == -EINPROGRESS) {
- scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+ if (status == -EINPROGRESS)
return 0;
- }
printk(KERN_WARNING "aac_write: aac_fib_send failed with status: %d\n", status);
/*
@@ -2588,6 +2581,7 @@ static int aac_synchronize(struct scsi_c
synchronizecmd->cid = cpu_to_le32(scmd_id(scsicmd));
synchronizecmd->count =
cpu_to_le32(sizeof(((struct aac_synchronize_reply *)NULL)->data));
+ scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
/*
* Now send the Fib to the adapter
@@ -2603,10 +2597,8 @@ static int aac_synchronize(struct scsi_c
/*
* Check that the command queued to the controller
*/
- if (status == -EINPROGRESS) {
- scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+ if (status == -EINPROGRESS)
return 0;
- }
printk(KERN_WARNING
"aac_synchronize: aac_fib_send failed with status: %d.\n", status);
@@ -2666,6 +2658,7 @@ static int aac_start_stop(struct scsi_cm
pmcmd->cid = cpu_to_le32(sdev_id(sdev));
pmcmd->parm = (scsicmd->cmnd[1] & 1) ?
cpu_to_le32(CT_PM_UNIT_IMMEDIATE) : 0;
+ scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
/*
* Now send the Fib to the adapter
@@ -2681,10 +2674,8 @@ static int aac_start_stop(struct scsi_cm
/*
* Check that the command queued to the controller
*/
- if (status == -EINPROGRESS) {
- scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+ if (status == -EINPROGRESS)
return 0;
- }
aac_fib_complete(cmd_fibcontext);
aac_fib_free(cmd_fibcontext);
@@ -3692,16 +3683,14 @@ static int aac_send_srb_fib(struct scsi_
* Allocate and initialize a Fib then setup a BlockWrite command
*/
cmd_fibcontext = aac_fib_alloc_tag(dev, scsicmd);
-
+ scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
status = aac_adapter_scsi(cmd_fibcontext, scsicmd);
/*
* Check that the command queued to the controller
*/
- if (status == -EINPROGRESS) {
- scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+ if (status == -EINPROGRESS)
return 0;
- }
printk(KERN_WARNING "aac_srb: aac_fib_send failed with status: %d\n", status);
aac_fib_complete(cmd_fibcontext);
@@ -3739,15 +3728,14 @@ static int aac_send_hba_fib(struct scsi_
if (!cmd_fibcontext)
return -1;
+ scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
status = aac_adapter_hba(cmd_fibcontext, scsicmd);
/*
* Check that the command queued to the controller
*/
- if (status == -EINPROGRESS) {
- scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+ if (status == -EINPROGRESS)
return 0;
- }
pr_warn("aac_hba_cmd_req: aac_fib_send failed with status: %d\n",
status);
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.13 000/109] 4.13.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 058/109] scsi: qedi: off by one in qedi_get_cmd_from_tid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 041/109] powerpc/powernv/npu: Move tlb flush before launching ATSD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 088/109] media: venus: fix copy/paste error in return_buf_error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 066/109] scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 031/109] crypto: scompress - dont sleep with preemption disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 060/109] scsi: megaraid_sas: mismatch of allocated MFI frame size and length exposed in MFI MPT pass through command Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 039/109] ext4: fix quota inconsistency during orphan cleanup for read-only mounts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 067/109] scsi: qla2xxx: Update fw_started flags at qpair creation. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 054/109] scsi: zfcp: fix missing trace records for early returns in TMF eh handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 083/109] net/netfilter/nf_conntrack_core: Fix net_conntrack_lock() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 028/109] MIPS: math-emu: <MADDF|MSUBF>.D: Fix accuracy (64-bit case) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 049/109] skd: Submit requests to firmware before triggering the doorbell Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 085/109] s390/mm: fix race on mm->context.flush_mm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 062/109] scsi: megaraid_sas: Check valid aen class range to avoid kernel panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 036/109] wcn36xx: Introduce mutual exclusion of fw configuration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 037/109] ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 078/109] tracing: Fix clear of RECORDED_TGID flag when disabling trace event Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 051/109] scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 059/109] scsi: aacraid: Fix command send race condition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 027/109] MIPS: math-emu: <MADDF|MSUBF>.S: Fix accuracy (32-bit case) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 052/109] scsi: zfcp: fix capping of unsuccessful GPN_FT SAN response trace records Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 079/109] tracing: Apply trace_clock changes to instance max buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 055/109] scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 026/109] MIPS: math-emu: <MADDF|MSUBF>.<D|S>: Clean up "maddf_flags" enumeration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 029/109] docs: disable KASLR when debugging kernel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 043/109] powerpc: Fix DAR reporting when alignment handler faults Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 046/109] md/bitmap: copy correct data for bitmap super Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 075/109] ftrace: Fix selftest goto location on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 081/109] PCI: shpchp: Enable bridge bus mastering if MSI is enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:00 +0200
[PATCH 4.13 018/109] MIPS: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix cases of both inputs zero Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 024/109] MIPS: math-emu: <MADDF|MSUBF>.<D|S>: Fix some cases of infinite inputs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 016/109] Input: i8042 - add Gigabyte P57 to the keyboard reset table Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 008/109] Input: xpad - validate USB endpoint type during probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 020/109] MIPS: math-emu: <MAXA|MINA>.<D|S>: Fix cases of input values with opposite signs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 023/109] MIPS: math-emu: <MADDF|MSUBF>.<D|S>: Fix NaN propagation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 009/109] drm/amdgpu: read reg in each iterator of psp_wait_for loop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 010/109] tty: improve tty_insert_flip_char() fast path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 014/109] pinctrl: samsung: Fix NULL pointer exception on external interrupts on S3C24xx Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 022/109] MIPS: math-emu: MINA.<D|S>: Fix some cases of infinity and zero inputs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 011/109] tty: improve tty_insert_flip_char() slow path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 019/109] MIPS: math-emu: <MAX|MIN>.<D|S>: Fix cases of both inputs negative Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 001/109] orangefs: Dont clear SGID when inheriting ACLs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
Re: [PATCH 4.13 001/109] orangefs: Dont clear SGID when inheriting ACLs Mike Marshall <hubcap@omnibond.com> - 2017-09-26 02:10 +0200
[PATCH 4.13 004/109] IB/{qib, hfi1}: Avoid flow control testing for RDMA write operation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 006/109] srcu: Provide ordering for CPU not involved in grace period Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
[PATCH 4.13 017/109] MIPS: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix quiet NaN propagation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
Re: [PATCH 4.13 000/109] 4.13.4-stable review Guenter Roeck <linux@roeck-us.net> - 2017-09-25 03:10 +0200
Re: [PATCH 4.13 000/109] 4.13.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-25 08:40 +0200
Re: [PATCH 4.13 000/109] 4.13.4-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-09-26 01:20 +0200
Re: [PATCH 4.13 000/109] 4.13.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-26 09:40 +0200
csiph-web