From patchwork Fri Feb 10 23:56:04 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 9567611 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id BFF33602B6 for ; Fri, 10 Feb 2017 23:56:24 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AC504285D2 for ; Fri, 10 Feb 2017 23:56:24 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A0156285EA; Fri, 10 Feb 2017 23:56:24 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1D6F9285D2 for ; Fri, 10 Feb 2017 23:56:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751356AbdBJX4V (ORCPT ); Fri, 10 Feb 2017 18:56:21 -0500 Received: from esa1.hgst.iphmx.com ([68.232.141.245]:53437 "EHLO esa1.hgst.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751326AbdBJX4T (ORCPT ); Fri, 10 Feb 2017 18:56:19 -0500 X-IronPort-AV: E=Sophos;i="5.33,348,1477929600"; d="scan'208";a="83251589" Received: from unknown (HELO milsmgep14.sandisk.com) ([63.163.107.225]) by ob1.hgst.iphmx.com with ESMTP; 11 Feb 2017 07:56:18 +0800 Received: from MILHUBIP04.sdcorp.global.sandisk.com (Unknown_Domain [10.201.67.162]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 0D.D5.18895.F135E985; Fri, 10 Feb 2017 15:56:18 -0800 (PST) Received: from milsmgip11.sandisk.com (10.177.9.6) by MILHUBIP04.sdcorp.global.sandisk.com (10.177.9.97) with Microsoft SMTP Server id 14.3.319.2; Fri, 10 Feb 2017 15:56:14 -0800 X-AuditID: 0ac94371-d73ff700000049cf-39-589e531fa19a Received: from exp-402881.sdcorp.global.sandisk.com ( [10.177.8.100]) by (Symantec Messaging Gateway) with SMTP id 2D.A4.11415.E135E985; Fri, 10 Feb 2017 15:56:14 -0800 (PST) From: Bart Van Assche To: Doug Ledford CC: , Bart Van Assche , Israel Rukshin , Max Gurtovoy , Laurence Oberman , Steve Feeley , Subject: [PATCH 1/8] IB/srp: Avoid that duplicate responses trigger a kernel bug Date: Fri, 10 Feb 2017 15:56:04 -0800 Message-ID: <20170210235611.3243-2-bart.vanassche@sandisk.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170210235611.3243-1-bart.vanassche@sandisk.com> References: <20170210235611.3243-1-bart.vanassche@sandisk.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrFLMWRmVeSWpSXmKPExsXCddJ5ka5S8LwIg2lbWSxenv/AanFj8VoW i2eHelkszn94xWRx+tEBdosFGx8xOrB5PJt+mMnj/b6rbB6fN8kFMEdx2aSk5mSWpRbp2yVw Zaxc84ql4KVAxYTzX1gaGBv5uhg5OSQETCSabrxm62Lk4hASWMokcfTjeyYIZxujxP81Sxhh qmZ9/8ECYgsJbGaUmN0rD2KzCRhJfHs/EywuIqAmsenVInaQZmaBDiaJ/2ePsoIkhAUCJK78 3gQ2iEVAVeLHi7dA6zg4eAXsJL4+UISYLy+xq+0iWDmngL3E92XTWCF22Um8+fqJFaJmGqvE r4dRIDavgKDEyZlPwPYyC0hIHHzxghmiXl3i5JL5TBMYhWYhKZuFpGwBI9MqRrHczJzi3PTU AkMTveLEvJTM4my95PzcTYyQEC/cwfj6tvchRgEORiUeXo6jcyOEWBPLiitzDzFKcDArifAm uc6LEOJNSaysSi3Kjy8qzUktPsQozcGiJM6bJTs1QkggPbEkNTs1tSC1CCbLxMEp1cCYZPim 5pz8AtGbKsLRfdVpcw18bl58sTpsy7Hre5vV7H5HTjWY+mXm2rUfX93LeDV16dZvVU+9rqTJ cyk0zznePvnFxQVM3758VHd9z+Pv3bhK0ffw6xq2ra/N5yh3MZcEhbCwbn4hfDS05aa55vY7 Vas0l18z8hVpq710p/h13+qUL5FnN5+OVmIpzkg01GIuKk4EAD1d/vRtAgAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrIJMWRmVeSWpSXmKPExsXCtZEjRVcueF6EwaqrFhYHf7YxWrw8/4HV 4sbitSwWzw71slic//CKyeL0owPsFgs2PmK0+PryBbMDh8ez6YeZPN7vu8rmMW3NeSaPz5vk AliiuGxSUnMyy1KL9O0SuDJWrnnFUvBSoGLC+S8sDYyNfF2MnBwSAiYSs77/YOli5OIQEtjI KDGjYTUTSIJNwEji2/uZLCC2iICaxKZXi9hBipgFupgkzrf9ZQRJCAsESFz5vQnMZhFQlfjx 4i0biM0rYCdx+uMGZogN8hK72i6ygticAvYS35dNA7OFgGrefP3EOoGRewEjwypGsdzMnOLc 9MwCQ0O94sS8lMzibL3k/NxNjOBA4Yzcwfh0ovkhRiYOTqkGxp1HzE6nTXGJqQ3u2v5TZ/11 643Kwgmu1rvMWcwUmxV+XuYtmcvt9Ma6af2TKTPCgooCzHZ3ama8i3owe8rhLE3ZyfHmTzYG blgibVC9m7Wi0sEonZth+R/lCf1WPxoimBe6L9jgzJH+98+3g2tN+k3FK2ZmfN2tzRi71NTU 64qHwDNZb9WlSizFGYmGWsxFxYkAclsAvMQBAAA= MIME-Version: 1.0 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP After srp_process_rsp() returns there is a short time during which the scsi_host_find_tag() call will return a pointer to the SCSI command that is being completed. If during that time a duplicate response is received, avoid that the following call stack appears: BUG: unable to handle kernel NULL pointer dereference at (null) IP: srp_recv_done+0x450/0x6b0 [ib_srp] Oops: 0000 [#1] SMP CPU: 10 PID: 0 Comm: swapper/10 Not tainted 4.10.0-rc7-dbg+ #1 Call Trace: __ib_process_cq+0x4b/0xd0 [ib_core] ib_poll_handler+0x1d/0x70 [ib_core] irq_poll_softirq+0xba/0x120 __do_softirq+0xba/0x4c0 irq_exit+0xbe/0xd0 smp_apic_timer_interrupt+0x38/0x50 apic_timer_interrupt+0x90/0xa0 cpuidle_enter_state+0xf2/0x370 cpuidle_enter+0x12/0x20 call_cpuidle+0x1e/0x40 do_idle+0xe3/0x1c0 cpu_startup_entry+0x18/0x20 start_secondary+0x103/0x130 start_cpu+0x14/0x14 RIP: srp_recv_done+0x450/0x6b0 [ib_srp] RSP: ffff88046f483e20 Signed-off-by: Bart Van Assche Cc: Israel Rukshin Cc: Max Gurtovoy Cc: Laurence Oberman Cc: Steve Feeley Cc: --- drivers/infiniband/ulp/srp/ib_srp.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 79bf48477ddb..4068d34f5427 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -1899,7 +1899,14 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp) scmnd = scsi_host_find_tag(target->scsi_host, rsp->tag); if (scmnd) { req = (void *)scmnd->host_scribble; - scmnd = srp_claim_req(ch, req, NULL, scmnd); + if (req) { + scmnd = srp_claim_req(ch, req, NULL, scmnd); + } else { + shost_printk(KERN_ERR, target->scsi_host, + "NULL host_scribble for response with tag %#llx\n", + rsp->tag); + scmnd = NULL; + } } if (!scmnd) { shost_printk(KERN_ERR, target->scsi_host,