1. 15 Dec, 2011 36 commits
  2. 14 Dec, 2011 4 commits
    • Eddie Wai's avatar
      [SCSI] bnx2i: Fixed kernel panic caused by unprotected task->sc->request deref · a878185c
      Eddie Wai authored
      During session recovery, the conn_stop call will trigger a flush
      to all outstanding SCSI cmds in the xmit queue.  This will set
      all outstanding task->sc to NULL prior to the session_teardown
      call which frees the task memory.
      
      In the bnx2i SCSI response processing path, only the task was being checked
      for NULL under the session lock before the task->sc->request dereferencing.
      If there are outstanding SCSI cmd responses pending for process, the
      following kernel panic can be exposed where task->sc was found to be NULL.
      
       Call Trace:
      [   69.720205]  [<ffffffffa040d0d0>] bnx2i_process_new_cqes+0x290/0x3c0 [bnx2i]
      [   69.804289]  [<ffffffffa040d233>] bnx2i_fastpath_notification+0x33/0xa0 [bnx2
      i]
      [   69.891490]  [<ffffffffa040d37b>] bnx2i_indicate_kcqe+0xdb/0x330 [bnx2i]
      [   69.971427]  [<ffffffffa03eac5e>] service_kcqes+0x16e/0x1d0 [cnic]
      [   70.045132]  [<ffffffffa03eacea>] cnic_service_bnx2x_kcq+0x2a/0x50 [cnic]
      [   70.126105]  [<ffffffffa03ead53>] cnic_service_bnx2x_bh+0x43/0x140 [cnic]
      [   70.207081]  [<ffffffff81060676>] tasklet_action+0x66/0x110
      [   70.273521]  [<ffffffff8106025f>] __do_softirq+0xef/0x220
      [   70.337887]  [<ffffffff81447ebc>] call_softirq+0x1c/0x30
      
      This patch adds the !task->sc check and also protects the sc dereferencing
      under the session lock.
      Signed-off-by: default avatarEddie Wai <eddie.wai@broadcom.com>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
      a878185c
    • Mike Christie's avatar
      [SCSI] qla4xxx: check for failed conn setup · ff1d0319
      Mike Christie authored
      iscsi_conn_setup can fail so we must check for NULL being
      returned.
      Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
      ff1d0319
    • Tomas Henzl's avatar
      [SCSI] qla4xxx: a small loop fix · e1cd89c5
      Tomas Henzl authored
      When the qla4xxx_get_fwddb_entry returns QLA_ERROR
      the nex_idx is not updated,
            for (idx = 0; idx < max_ddbs; idx = next_idx) {
                      ret = qla4xxx_get_fwddb_entry(ha, idx, NULL, 0, NULL,
                                                    &next_idx, &state, &conn_err,
                                                      NULL, NULL);
                      if (ret == QLA_ERROR)
                              continue;
      
      This means there is a risk that the 'idx < max_ddbs' condition will never
      met and the loop will loop forever.
      Fix this by explicitly increasing the next_idx in the error condition.
      
      Maybe a break instead of continue is more appropriate, leaving the decision
      on the qlogic maintainer.
      Signed-off-by: default avatarTomas Henzl <thenzl@redhat.com>
      Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
      e1cd89c5
    • Mike Christie's avatar
      [SCSI] qla4xxx: fix flash/ddb support · 13483730
      Mike Christie authored
      With open-iscsi support, target entries persisted in the FLASH were not
      login. Added support in the qla4xxx driver to do the login on probe
      time to the target entries saved in the FLASH by user.
      With this changes upgrade to the new kernel with open-iscsi support in
      qla4xxx will ensure users original target entries login on driver load
      Signed-off-by: default avatarManish Rangankar <manish.rangankar@qlogic.com>
      Signed-off-by: default avatarRavi Anand <ravi.anand@qlogic.com>
      Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
      13483730