1. 15 Dec, 2011 37 commits
  2. 14 Dec, 2011 3 commits
    • Eddie Wai's avatar
      [SCSI] bnx2i: Fixed kernel panic caused by unprotected task->sc->request deref · a878185c
      Eddie Wai authored
      During session recovery, the conn_stop call will trigger a flush
      to all outstanding SCSI cmds in the xmit queue.  This will set
      all outstanding task->sc to NULL prior to the session_teardown
      call which frees the task memory.
      
      In the bnx2i SCSI response processing path, only the task was being checked
      for NULL under the session lock before the task->sc->request dereferencing.
      If there are outstanding SCSI cmd responses pending for process, the
      following kernel panic can be exposed where task->sc was found to be NULL.
      
       Call Trace:
      [   69.720205]  [<ffffffffa040d0d0>] bnx2i_process_new_cqes+0x290/0x3c0 [bnx2i]
      [   69.804289]  [<ffffffffa040d233>] bnx2i_fastpath_notification+0x33/0xa0 [bnx2
      i]
      [   69.891490]  [<ffffffffa040d37b>] bnx2i_indicate_kcqe+0xdb/0x330 [bnx2i]
      [   69.971427]  [<ffffffffa03eac5e>] service_kcqes+0x16e/0x1d0 [cnic]
      [   70.045132]  [<ffffffffa03eacea>] cnic_service_bnx2x_kcq+0x2a/0x50 [cnic]
      [   70.126105]  [<ffffffffa03ead53>] cnic_service_bnx2x_bh+0x43/0x140 [cnic]
      [   70.207081]  [<ffffffff81060676>] tasklet_action+0x66/0x110
      [   70.273521]  [<ffffffff8106025f>] __do_softirq+0xef/0x220
      [   70.337887]  [<ffffffff81447ebc>] call_softirq+0x1c/0x30
      
      This patch adds the !task->sc check and also protects the sc dereferencing
      under the session lock.
      Signed-off-by: default avatarEddie Wai <eddie.wai@broadcom.com>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
      a878185c
    • Mike Christie's avatar
      [SCSI] qla4xxx: check for failed conn setup · ff1d0319
      Mike Christie authored
      iscsi_conn_setup can fail so we must check for NULL being
      returned.
      Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
      ff1d0319
    • Tomas Henzl's avatar
      [SCSI] qla4xxx: a small loop fix · e1cd89c5
      Tomas Henzl authored
      When the qla4xxx_get_fwddb_entry returns QLA_ERROR
      the nex_idx is not updated,
            for (idx = 0; idx < max_ddbs; idx = next_idx) {
                      ret = qla4xxx_get_fwddb_entry(ha, idx, NULL, 0, NULL,
                                                    &next_idx, &state, &conn_err,
                                                      NULL, NULL);
                      if (ret == QLA_ERROR)
                              continue;
      
      This means there is a risk that the 'idx < max_ddbs' condition will never
      met and the loop will loop forever.
      Fix this by explicitly increasing the next_idx in the error condition.
      
      Maybe a break instead of continue is more appropriate, leaving the decision
      on the qlogic maintainer.
      Signed-off-by: default avatarTomas Henzl <thenzl@redhat.com>
      Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
      e1cd89c5