lkml.org 
[lkml]   [2019]   [Mar]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 014/230] scsi: isci: initialize shost fully before calling scsi_add_host()
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit cc29a1b0a3f2597ce887d339222fa85b9307706d ]

    scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates the
    command size to allocate based on the prot_capabilities. In the isci
    driver, scsi_host_set_prot() is called after scsi_add_host() so the command
    size gets calculated to be smaller than it needs to be. Eventually,
    scsi_mq_init_request() locates the 'prot_sdb' after the command assuming it
    was sized correctly and a buffer overrun may occur.

    However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line
    size, the mistake can go unnoticed.

    The bug was noticed after the struct request size was reduced by commit
    9d037ad707ed ("block: remove req->timeout_list")

    Which likely reduced the allocated space for the request by an entire cache
    line, enough that the overflow could be hit and it caused a panic, on boot,
    at:

    RIP: 0010:t10_pi_complete+0x77/0x1c0
    Call Trace:
    <IRQ>
    sd_done+0xf5/0x340
    scsi_finish_command+0xc3/0x120
    blk_done_softirq+0x83/0xb0
    __do_softirq+0xa1/0x2e6
    irq_exit+0xbc/0xd0
    call_function_single_interrupt+0xf/0x20
    </IRQ>

    sd_done() would call scsi_prot_sg_count() which reads the number of
    entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of
    the allocated space it reads a garbage number and erroneously calls
    t10_pi_complete().

    To prevent this, the calls to scsi_host_set_prot() are moved into
    isci_host_alloc() before the call to scsi_add_host(). Out of caution, also
    move the similar call to scsi_host_set_guard().

    Fixes: 3d2d75254915 ("[SCSI] isci: T10 DIF support")
    Link: http://lkml.kernel.org/r/da851333-eadd-163a-8c78-e1f4ec5ec857@deltatee.com
    Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
    Cc: Intel SCU Linux support <intel-linux-scu@intel.com>
    Cc: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
    Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
    Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Jens Axboe <axboe@kernel.dk>
    Cc: Jeff Moyer <jmoyer@redhat.com>
    Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
    Reviewed-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/isci/init.c | 14 +++++++-------
    1 file changed, 7 insertions(+), 7 deletions(-)

    diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
    index 77128d680e3bc..6f38fa1f468a7 100644
    --- a/drivers/scsi/isci/init.c
    +++ b/drivers/scsi/isci/init.c
    @@ -595,6 +595,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id)
    shost->max_lun = ~0;
    shost->max_cmd_len = MAX_COMMAND_SIZE;

    + /* turn on DIF support */
    + scsi_host_set_prot(shost,
    + SHOST_DIF_TYPE1_PROTECTION |
    + SHOST_DIF_TYPE2_PROTECTION |
    + SHOST_DIF_TYPE3_PROTECTION);
    + scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC);
    +
    err = scsi_add_host(shost, &pdev->dev);
    if (err)
    goto err_shost;
    @@ -682,13 +689,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
    goto err_host_alloc;
    }
    pci_info->hosts[i] = h;
    -
    - /* turn on DIF support */
    - scsi_host_set_prot(to_shost(h),
    - SHOST_DIF_TYPE1_PROTECTION |
    - SHOST_DIF_TYPE2_PROTECTION |
    - SHOST_DIF_TYPE3_PROTECTION);
    - scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC);
    }

    err = isci_setup_interrupts(pdev);
    --
    2.19.1


    \
     
     \ /
      Last update: 2019-03-22 14:16    [W:4.057 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site