lkml.org 
[lkml]   [2017]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 16/36] IB/srp: Avoid that duplicate responses trigger a kernel bug
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Bart Van Assche <bart.vanassche@sandisk.com>

    commit 6cb72bc1b40bb2c1750ee7a5ebade93bed49a5fb upstream.

    After srp_process_rsp() returns there is a short time during which
    the scsi_host_find_tag() call will return a pointer to the SCSI
    command that is being completed. If during that time a duplicate
    response is received, avoid that the following call stack appears:

    BUG: unable to handle kernel NULL pointer dereference at (null)
    IP: srp_recv_done+0x450/0x6b0 [ib_srp]
    Oops: 0000 [#1] SMP
    CPU: 10 PID: 0 Comm: swapper/10 Not tainted 4.10.0-rc7-dbg+ #1
    Call Trace:
    <IRQ>
    __ib_process_cq+0x4b/0xd0 [ib_core]
    ib_poll_handler+0x1d/0x70 [ib_core]
    irq_poll_softirq+0xba/0x120
    __do_softirq+0xba/0x4c0
    irq_exit+0xbe/0xd0
    smp_apic_timer_interrupt+0x38/0x50
    apic_timer_interrupt+0x90/0xa0
    </IRQ>
    RIP: srp_recv_done+0x450/0x6b0 [ib_srp] RSP: ffff88046f483e20

    Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
    Cc: Israel Rukshin <israelr@mellanox.com>
    Cc: Max Gurtovoy <maxg@mellanox.com>
    Cc: Laurence Oberman <loberman@redhat.com>
    Cc: Steve Feeley <Steve.Feeley@sandisk.com>
    Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
    Signed-off-by: Doug Ledford <dledford@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/infiniband/ulp/srp/ib_srp.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/drivers/infiniband/ulp/srp/ib_srp.c
    +++ b/drivers/infiniband/ulp/srp/ib_srp.c
    @@ -1795,9 +1795,11 @@ static void srp_process_rsp(struct srp_r
    complete(&ch->tsk_mgmt_done);
    } else {
    scmnd = scsi_host_find_tag(target->scsi_host, rsp->tag);
    - if (scmnd) {
    + if (scmnd && scmnd->host_scribble) {
    req = (void *)scmnd->host_scribble;
    scmnd = srp_claim_req(ch, req, NULL, scmnd);
    + } else {
    + scmnd = NULL;
    }
    if (!scmnd) {
    shost_printk(KERN_ERR, target->scsi_host,

    \
     
     \ /
      Last update: 2017-03-13 09:41    [W:5.676 / U:0.904 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site