提交 e4b9794e 编写于 作者: J James Smart 提交者: Martin K. Petersen

scsi: lpfc: Fix crash after bad bar setup on driver attachment

In test cases where an instance of the driver is detached and
reattached, the driver will crash on reattachment. There is a compound
if statement that will skip over the bar setup if the pci_resource_start
call is not successful. The driver erroneously returns success to its
bar setup in this scenario even though the bars aren't properly
configured.

Rework the offending code segment for proper initialization steps.  If
the pci_resource_start call fails, -ENOMEM is now returned.

Sample stack:

rport-5:0-10: blocked FC remote port time out: removing rport
BUG: unable to handle kernel NULL pointer dereference at           (null)
... lpfc_sli4_wait_bmbx_ready+0x32/0x70 [lpfc]
...
...  RIP: 0010:...  ... lpfc_sli4_wait_bmbx_ready+0x32/0x70 [lpfc]
 Call Trace:
  ... lpfc_sli4_post_sync_mbox+0x106/0x4d0 [lpfc]
  ... ? __alloc_pages_nodemask+0x176/0x420
  ... ? __kmalloc+0x2e/0x230
  ... lpfc_sli_issue_mbox_s4+0x533/0x720 [lpfc]
  ... ? mempool_alloc+0x69/0x170
  ... ? dma_generic_alloc_coherent+0x8f/0x140
  ... lpfc_sli_issue_mbox+0xf/0x20 [lpfc]
  ... lpfc_sli4_driver_resource_setup+0xa6f/0x1130 [lpfc]
  ... ? lpfc_pci_probe_one+0x23e/0x16f0 [lpfc]
  ... lpfc_pci_probe_one+0x445/0x16f0 [lpfc]
  ... local_pci_probe+0x45/0xa0
  ... work_for_cpu_fn+0x14/0x20
  ... process_one_work+0x17a/0x440

Cc: <stable@vger.kernel.org> # 4.12+
Signed-off-by: NDick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: NJames Smart <james.smart@broadcom.com>
Reviewed-by: NHannes Reinecke <hare@suse.com>
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
上级 8a5ca109
...@@ -9431,44 +9431,62 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba) ...@@ -9431,44 +9431,62 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
lpfc_sli4_bar0_register_memmap(phba, if_type); lpfc_sli4_bar0_register_memmap(phba, if_type);
} }
if ((if_type == LPFC_SLI_INTF_IF_TYPE_0) && if (if_type == LPFC_SLI_INTF_IF_TYPE_0) {
(pci_resource_start(pdev, PCI_64BIT_BAR2))) { if (pci_resource_start(pdev, PCI_64BIT_BAR2)) {
/* /*
* Map SLI4 if type 0 HBA Control Register base to a kernel * Map SLI4 if type 0 HBA Control Register base to a
* virtual address and setup the registers. * kernel virtual address and setup the registers.
*/ */
phba->pci_bar1_map = pci_resource_start(pdev, PCI_64BIT_BAR2); phba->pci_bar1_map = pci_resource_start(pdev,
bar1map_len = pci_resource_len(pdev, PCI_64BIT_BAR2); PCI_64BIT_BAR2);
phba->sli4_hba.ctrl_regs_memmap_p = bar1map_len = pci_resource_len(pdev, PCI_64BIT_BAR2);
ioremap(phba->pci_bar1_map, bar1map_len); phba->sli4_hba.ctrl_regs_memmap_p =
if (!phba->sli4_hba.ctrl_regs_memmap_p) { ioremap(phba->pci_bar1_map,
dev_printk(KERN_ERR, &pdev->dev, bar1map_len);
"ioremap failed for SLI4 HBA control registers.\n"); if (!phba->sli4_hba.ctrl_regs_memmap_p) {
dev_err(&pdev->dev,
"ioremap failed for SLI4 HBA "
"control registers.\n");
error = -ENOMEM;
goto out_iounmap_conf;
}
phba->pci_bar2_memmap_p =
phba->sli4_hba.ctrl_regs_memmap_p;
lpfc_sli4_bar1_register_memmap(phba);
} else {
error = -ENOMEM;
goto out_iounmap_conf; goto out_iounmap_conf;
} }
phba->pci_bar2_memmap_p = phba->sli4_hba.ctrl_regs_memmap_p;
lpfc_sli4_bar1_register_memmap(phba);
} }
if ((if_type == LPFC_SLI_INTF_IF_TYPE_0) && if (if_type == LPFC_SLI_INTF_IF_TYPE_0) {
(pci_resource_start(pdev, PCI_64BIT_BAR4))) { if (pci_resource_start(pdev, PCI_64BIT_BAR4)) {
/* /*
* Map SLI4 if type 0 HBA Doorbell Register base to a kernel * Map SLI4 if type 0 HBA Doorbell Register base to
* virtual address and setup the registers. * a kernel virtual address and setup the registers.
*/ */
phba->pci_bar2_map = pci_resource_start(pdev, PCI_64BIT_BAR4); phba->pci_bar2_map = pci_resource_start(pdev,
bar2map_len = pci_resource_len(pdev, PCI_64BIT_BAR4); PCI_64BIT_BAR4);
phba->sli4_hba.drbl_regs_memmap_p = bar2map_len = pci_resource_len(pdev, PCI_64BIT_BAR4);
ioremap(phba->pci_bar2_map, bar2map_len); phba->sli4_hba.drbl_regs_memmap_p =
if (!phba->sli4_hba.drbl_regs_memmap_p) { ioremap(phba->pci_bar2_map,
dev_printk(KERN_ERR, &pdev->dev, bar2map_len);
"ioremap failed for SLI4 HBA doorbell registers.\n"); if (!phba->sli4_hba.drbl_regs_memmap_p) {
goto out_iounmap_ctrl; dev_err(&pdev->dev,
} "ioremap failed for SLI4 HBA"
phba->pci_bar4_memmap_p = phba->sli4_hba.drbl_regs_memmap_p; " doorbell registers.\n");
error = lpfc_sli4_bar2_register_memmap(phba, LPFC_VF0); error = -ENOMEM;
if (error) goto out_iounmap_ctrl;
}
phba->pci_bar4_memmap_p =
phba->sli4_hba.drbl_regs_memmap_p;
error = lpfc_sli4_bar2_register_memmap(phba, LPFC_VF0);
if (error)
goto out_iounmap_all;
} else {
error = -ENOMEM;
goto out_iounmap_all; goto out_iounmap_all;
}
} }
return 0; return 0;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册