diff mbox series

[REPOST] lpfc: Fix illegal memory access on Abort IOCBs

Message ID 20210421234433.102079-1-jsmart2021@gmail.com
State New
Headers show
Series [REPOST] lpfc: Fix illegal memory access on Abort IOCBs | expand

Commit Message

James Smart April 21, 2021, 11:44 p.m. UTC 
In devloss timer handler and in backend calls to terminate remote port
io, there is logic to walk through all active IOCBs and validate them
to potentially trigger an abort request. This logic is causing illegal
memory accesses which leads to a crash. Abort IOCBs, which may be on
the list, do not have an associated lpfc_io_buf struct. The driver is
trying to map an lpfc_io_buf struct on the iocb and which results in a
bogus address thus the issue.

Fix by skipping over ABORT IOCBs (CLOSE IOCBs are ABORTS that don't send
ABTS) in the IOCB scan logic.

Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>

---
 drivers/scsi/lpfc/lpfc_sli.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

Comments

Martin K. Petersen April 27, 2021, 3:07 a.m. UTC | #1 
On Wed, 21 Apr 2021 16:44:33 -0700, James Smart wrote:

> In devloss timer handler and in backend calls to terminate remote port

> io, there is logic to walk through all active IOCBs and validate them

> to potentially trigger an abort request. This logic is causing illegal

> memory accesses which leads to a crash. Abort IOCBs, which may be on

> the list, do not have an associated lpfc_io_buf struct. The driver is

> trying to map an lpfc_io_buf struct on the iocb and which results in a

> bogus address thus the issue.

> 

> [...]


Applied to 5.13/scsi-fixes, thanks!

[1/1] lpfc: Fix illegal memory access on Abort IOCBs
      https://git.kernel.org/mkp/scsi/c/e1364711359f

-- 
Martin K. Petersen	Oracle Linux Engineering
diff mbox series

Patch

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 06ccc0157bd8..579ac75dfe79 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -11804,13 +11804,20 @@  lpfc_sli_validate_fcp_iocb(struct lpfc_iocbq *iocbq, struct lpfc_vport *vport,
 			   lpfc_ctx_cmd ctx_cmd)
 {
 	struct lpfc_io_buf *lpfc_cmd;
+	IOCB_t *icmd = NULL;
 	int rc = 1;
 
 	if (!iocbq || iocbq->vport != vport)
 		return rc;
 
-	if (!(iocbq->iocb_flag &  LPFC_IO_FCP) ||
-	    !(iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ))
+	if (!(iocbq->iocb_flag & LPFC_IO_FCP) ||
+	    !(iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ) ||
+	      iocbq->iocb_flag & LPFC_DRIVER_ABORTED)
+		return rc;
+
+	icmd = &iocbq->iocb;
+	if (icmd->ulpCommand == CMD_ABORT_XRI_CN ||
+	    icmd->ulpCommand == CMD_CLOSE_XRI_CN)
 		return rc;
 
 	lpfc_cmd = container_of(iocbq, struct lpfc_io_buf, cur_iocbq);