From patchwork Tue Dec 10 12:46:47 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Jansen X-Patchwork-Id: 11282393 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 300FE15AB for ; Tue, 10 Dec 2019 12:47:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0EA862077B for ; Tue, 10 Dec 2019 12:47:00 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=gmx.net header.i=@gmx.net header.b="hhBlP788" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727412AbfLJMq4 (ORCPT ); Tue, 10 Dec 2019 07:46:56 -0500 Received: from mout.gmx.net ([212.227.15.15]:54749 "EHLO mout.gmx.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727131AbfLJMqz (ORCPT ); Tue, 10 Dec 2019 07:46:55 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1575982008; bh=qd6qYQjvAd9VTFlGBK9Mkz5yHOz8UjRTgv5aTL5Cw3Y=; h=X-UI-Sender-Class:To:Cc:From:Subject:Date; b=hhBlP7887M824IbKa7I7yDYEPHAQfH3TMeebNPBLjGWljwdBv2FV/Fm6zl7Of3lBH Ollw67OrhmET+Irwo8BLaoU2YYWW5dDQk+jyLfYqQYqH0GKZgQSpFfloOpzKTfFmZU QGez7W/yJxwtOfYS+Ylc75lQurXYYAoh1I/8oppI= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from [172.17.64.14] ([192.166.200.216]) by mail.gmx.com (mrgmx004 [212.227.17.190]) with ESMTPSA (Nemesis) id 1MOA3P-1iP2nZ039V-00OXRx; Tue, 10 Dec 2019 13:46:48 +0100 To: linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Cc: jejb@linux.ibm.com, martin.petersen@oracle.com From: Arne Jansen Subject: [PATCH] bnx2fc: protect kref_put by tgt_lock Message-ID: Date: Tue, 10 Dec 2019 13:46:47 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 Content-Language: en-US X-Provags-ID: V03:K1:fzDZQzJWHugSdDAjPOMOchWakvhnamcnXmO126KB0Lus9WTmmDv wU/CcPvk4oobHEO7+ENQSuMQImQrWl6OnMTpApcbQgfnSTX5jbD4Eh1P9VK8qDComfZR/L0 r3cu8P5OnOZJm0QyjWCp6qilcFs9Hu4hjjhp4YYrw+/iPRJtfVAYgbE5k/qFnLKkhKzpIcr txc0TMofgOf8U9Y7ZpZDg== X-Spam-Flag: NO X-UI-Out-Filterresults: notjunk:1;V03:K0:QJOTFJrty3g=:oQzq05IhX8fJue3oJP8hQ9 oYJD/7GfrHZXZDqlYM0GhG5MMKBVKaRkblmk2sF+fu+z1pNJqM1QtagW3pcmsvQmZ42nxV+KP n+NKAtqpEb2uJ0sQIzQCFM+/h/cUYRKkESwbRi4J3G8BDteyiBS8+lnMRDuGLVav6+kKp0lO6 7IDoY+ffkETL4FB2aM9rr/hGY4r4KsBtp5C1BuVw7MWRDLOa43WF+SV+klYoo3rq5N5HITzEH diBLNwuu2VM2qWwVK7BO8lqZtYktj/puOJ1gkBWi4yzsC/iY8E5+mQKPx192OWGFRAIHgsf3X A1IUCYcGXw2S8/V0Mk67En8/x3nLJo5fZm8mV+8FBiqCNLXHIm47rM+6ZK0bOSqZXm572JTKG GgSK3SR8NKs9b2n9fySrE0pzXEVMIvFJcxTimSDTq20UTlJsgnkNwZgVvCyv7WyNKKHiLWuia IOB+gtNGamMoWcF/u5s+WEfF1ijYcAjU1CvINIoAJRiAuk66V4csYJ0ZxSDe2ZLvruMM3R9VG nfzkRSobJMREula6WVJq8VLrEN3NiQG/mP39dJ3gjMJr8t4NMbu82wqK3WW8utzfoeVpu1V4h VD1Z9v+UE1Z/NN1+JmZnMQT2DWxI+V5nbNi7Q/FQ0MaWF+Gutw003yvOKmNsw4AXA1SyIvvbb t5KV6jQYNKFUVdyMANrU9T6vt/Tp06wsOke/TybKzj5YVP2EwlsU1iYsHDoshHLJbbmPADkE5 kSA7vv/P9+NEIlCvgqap3oQYPTiFweCLZ7xpMg3jswsYkLYsRc+gKlCeXNw31YdHepu4/O7DZ Y/ceqNrS0l8747AzKgT20K50CarGi0BiZ5kdlzTpuqNvUh1oU1Uo3BgWGKtT2qo+CyfYuUp8Q RpENnbNnDGnAZbd9IR3IKusnkcIRsJloEZY/i8WK70TA1zMgxoBMQKzFM1QqfK6Uf0qUbt3w6 eN+TiPZDuwd9fqcuZLHJ+3c2hfZI93jgQagDjI9GPzF5b8rhOgxb0Gio9FiI6zwKKJp0I0Jni /arQAAGz+6J7OAkMpACFCEBJHuG2bbz06rJKL77A5bF/uWk5lLng5u+iVpQfiuYkginq8dKB0 KBMBEEOuq6mgCOXAGhqsN1cgH6yLsHuDX8DvfSO1X4+Qs272wiUKhaOTBNV26avaYLZpBOtQD DRXgfx4KMJ1lOtYSc0R+dIuClTCGHD9fVimjtSpD9shomTmFJrPR3tJdX+zWcCLzFHU3jgBYs WwUoUWFalykYf/Tm2HNNNLLA5LYST/oaHgOwsMw8oxgBT7jSHBNa7o5JjEDI= Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org We have seen several kernel warning about list corruptions involving bnx2fc_cmd.link. Reviewing the locking of this element showed that in one instance a kref_put on io_req->refcount has been called without tgt_lock. As the io_req might still be enqueued on a list protected by this lock, this patch adds it. This was the only call site without it. Signed-off-by: Arne Jansen --- drivers/scsi/bnx2fc/bnx2fc_io.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) out.\n", __func__); @@ -1107,8 +1110,6 @@ static int bnx2fc_abts_cleanup(struct bnx2fc_cmd *io_req) */ kref_put(&io_req->refcount, bnx2fc_cmd_release); } - - spin_lock_bh(&tgt->tgt_lock); io_req->wait_for_cleanup_comp = 0; return SUCCESS; } -- 2.11.0 diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c index 4c8122a82322..d0d465271e5c 100644 --- a/drivers/scsi/bnx2fc/bnx2fc_io.c +++ b/drivers/scsi/bnx2fc/bnx2fc_io.c @@ -1097,6 +1097,9 @@ static int bnx2fc_abts_cleanup(struct bnx2fc_cmd *io_req) */ time_left = wait_for_completion_timeout(&io_req->cleanup_done, BNX2FC_FW_TIMEOUT); + + spin_lock_bh(&tgt->tgt_lock); + if (!time_left) { BNX2FC_IO_DBG(io_req, "%s(): Wait for cleanup timed