• James Smart's avatar
    scsi: lpfc: Fix crash in target side cable pulls hitting WAIT_FOR_UNREG · 807e7353
    James Smart authored
    Kernel is crashing with the following stacktrace:
    
      BUG: unable to handle kernel NULL pointer dereference at
        00000000000005bc
      IP: lpfc_nvme_register_port+0x1a8/0x3a0 [lpfc]
      ...
      Call Trace:
      lpfc_nlp_state_cleanup+0x2b2/0x500 [lpfc]
      lpfc_nlp_set_state+0xd7/0x1a0 [lpfc]
      lpfc_cmpl_prli_prli_issue+0x1f7/0x450 [lpfc]
      lpfc_disc_state_machine+0x7a/0x1e0 [lpfc]
      lpfc_cmpl_els_prli+0x16f/0x1e0 [lpfc]
      lpfc_sli_sp_handle_rspiocb+0x5b2/0x690 [lpfc]
      lpfc_sli_handle_slow_ring_event_s4+0x182/0x230 [lpfc]
      lpfc_do_work+0x87f/0x1570 [lpfc]
      kthread+0x10d/0x130
      ret_from_fork+0x35/0x40
    
    During target side fault injections, it is possible to hit the
    NLP_WAIT_FOR_UNREG case in lpfc_nvme_remoteport_delete. A prior commit
    fixed a rebind and delete race condition, but called lpfc_nlp_put
    unconditionally. This triggered a deletion and the crash.
    
    Fix by movng nlp_put to inside the NLP_WAIT_FOR_UNREG case, where the nlp
    will be being unregistered/removed. Leave the reference if the flag isn't
    set.
    
    Link: https://lore.kernel.org/r/20200322181304.37655-8-jsmart2021@gmail.com
    Fixes: b15bd3e6 ("scsi: lpfc: Fix nvme remoteport registration race conditions")
    Signed-off-by: default avatarJames Smart <jsmart2021@gmail.com>
    Signed-off-by: default avatarDick Kennedy <dick.kennedy@broadcom.com>
    Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
    807e7353
lpfc_nvme.c 81.8 KB