summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* scsi: handle more device handler setup/teardown in common codeChristoph Hellwig2014-11-126-167/+88
| | | | | | | | Move all code to set up and tear down sdev->scsi_dh_data to common code. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> Reviewed-by: Hannes Reinecke <hare@suse.de>
* scsi: device handlers must have attach and detach methodsChristoph Hellwig2014-11-121-12/+13
| | | | | | Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> Reviewed-by: Hannes Reinecke <hare@suse.de>
* scsi: remove struct scsi_dh_devlistChristoph Hellwig2014-11-124-12/+12
| | | | | | | | | All drivers now do their own matching, so there is no more need to expose a device list as part of the interface. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> Reviewed-by: Hannes Reinecke <hare@suse.de>
* scsi: use container_of to get at device handler private dataChristoph Hellwig2014-11-125-61/+37
| | | | | | Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> Reviewed-by: Hannes Reinecke <hare@suse.de>
* scsi_dh: get module reference outside of device handlerChristoph Hellwig2014-11-125-25/+22
| | | | | | | | | | We need to grab a reference to the module before calling the attach routines to avoid a small race vs module removal. It also cleans up the code significantly as a side effect. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> Reviewed-by: Hannes Reinecke <hare@suse.de>
* scsi_dh_hp_sw: fix return value on failed allocationChristoph Hellwig2014-11-121-1/+1
| | | | | | Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> Reviewed-by: Hannes Reinecke <hare@suse.de>
* sd: disable discard_zeroes_data for UNMAPMartin K. Petersen2014-11-121-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | The T10 SBC UNMAP command does not provide any hard guarantees that blocks will return zeroes on a subsequent READ. This is due to the fact that the device server is free to silently ignore all or parts of the request. The only way to ensure that a block consistently returns zeroes after being unmapped is to use WRITE SAME with the UNMAP bit set. Should the device be unable to unmap one or more blocks described by the command it is required to manually write zeroes to them. Until now we have preferred UNMAP over the WRITE SAME variants to accommodate thinly provisioned devices that predated the final SBC-3 spec. This patch changes the heuristic so that we favor WRITE SAME(16) or (10) over UNMAP if these commands are marked as supported in the Logical Block Provisioning VPD page. The patch also disables discard_zeroes_data for devices operating in UNMAP mode. Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: return EAGAIN when resetting a device under EHChristoph Hellwig2014-11-121-1/+1
| | | | | | Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@suse.de>
* osst: call scsi_set_medium_removal directlyChristoph Hellwig2014-11-121-7/+6
| | | | | | Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@suse.de>
* st: call scsi_set_medium_removal directlyChristoph Hellwig2014-11-121-7/+6
| | | | | | Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@suse.de>
* sd: fix up ->compat_ioctlChristoph Hellwig2014-11-121-20/+8
| | | | | | | | | | No need to verify the passthrough ioctls, the real handler will take care of that. Also make sure not to block for resets on O_NONBLOCK fds. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@suse.de>
* scsi: split scsi_nonblockable_ioctlChristoph Hellwig2014-11-128-74/+49
| | | | | | | | | | | | | | | | | The calling conventions for this function are bad as it could return -ENODEV both for a device not currently online and a not recognized ioctl. Add a new scsi_ioctl_block_when_processing_errors function that wraps scsi_block_when_processing_errors with the a special case for the SG_SCSI_RESET ioctl command, and handle the SG_SCSI_RESET case itself in scsi_ioctl. All callers of scsi_ioctl now must call the above helper to check for the EH state, so that the ioctl handler itself doesn't have to. Reported-by: Robert Elliott <Elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@suse.de>
* scsi: refactor scsi_reset_provider handlingChristoph Hellwig2014-11-124-117/+41
| | | | | | | | | Pull the common code from the two callers into the function, and rename it to scsi_ioctl_reset. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@suse.de>
* scsi: add support for multiple hardware queues in scsi_(host_)find_tagBart Van Assche2014-11-121-8/+11
| | | | | | | | | Modify scsi_find_tag() and scsi_host_find_tag() such that these functions can translate a tag generated by blk_mq_unique_tag(). Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: add support for multiple hardware queuesBart Van Assche2014-11-122-1/+9
| | | | | | | | | | Allow a SCSI LLD to declare how many hardware queues it supports by setting Scsi_Host.nr_hw_queues before calling scsi_add_host(). Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Sagi Grimberg <sagig@mellanox.com> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* blk-mq: add blk_mq_unique_tag()Bart Van Assche2014-11-123-0/+47
| | | | | | | | | | | | | | | | The queuecommand() callback functions in SCSI low-level drivers need to know which hardware context has been selected by the block layer. Since this information is not available in the request structure, and since passing the hctx pointer directly to the queuecommand callback function would require modification of all SCSI LLDs, add a function to the block layer that allows to query the hardware context index. Signed-off-by: Bart Van Assche <bvanassche@acm.org> Acked-by: Jens Axboe <axboe@kernel.dk> Reviewed-by: Sagi Grimberg <sagig@mellanox.com> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: ratelimit I/O error messagesHannes Reinecke2014-11-121-12/+20
| | | | | | | | | | There can be quite a lot of I/O error messages, even on smaller machines. So we need to ratelimit them to not overwhelm logging. Signed-off-by: Hannes Reinecke <hare@suse.de> Tested-by: Robert Elliott <elliott@hp.com> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: correct return values for .eh_abort_handler implementationsHannes Reinecke2014-11-126-18/+18
| | | | | | | | | | The .eh_abort_handler needs to return SUCCESS, FAILED, or FAST_IO_FAIL. So fixup all callers to adhere to this requirement. Reviewed-by: Robert Elliott <elliott@hp.com> Cc: <stable@vger.kernel.org> Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: document scsi_try_to_abort_cmdHannes Reinecke2014-11-121-3/+21
| | | | | | | | | | | scsi_try_to_abort_cmd() should only return SUCCESS, FAILED, or FAST_IO_FAIL. So document that in the function description and simplify the logging message. Signed-off-by: Hannes Reinecke <hare@suse.de> Suggested-by: Christoph Hellwig <hch@infradead.org> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: use shost argument in scsi_eh_prt_fail_statsHannes Reinecke2014-11-121-1/+1
| | | | | | | | | | The EH statistics are per host, so we should be using shost_printk() here. Signed-off-by: Hannes Reinecke <hare@suse.de> Suggested-by: Robert Elliott <elliott@hp.com> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: fixup logging messages in scsi_error.cHannes Reinecke2014-11-122-42/+39
| | | | | | | | | | Use the matching scope for logging messages to allow for better command tracing. Signed-off-by: Hannes Reinecke <hare@suse.de> Suggested-by: Robert Elliott <elliott@hp.com> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: simplify scsi_log_(send|completion)Hannes Reinecke2014-11-125-44/+57
| | | | | | | | | Simplify scsi_log_(send|completion) by externalizing scsi_mlreturn_string() and always print the command address. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: remove scsi_show_result()Hannes Reinecke2014-11-124-43/+28
| | | | | | | | | | | | | Open-code scsi_print_result in sd.c, and cleanup logging to not print duplicate informations. Also remove the call to scsi_show_result() in ufshcd.c to be consistent with other callers of scsi_execute(). With that we can remove scsi_show_result in constants.c Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: separate out scsi_(host|driver)byte_string()Hannes Reinecke2014-11-122-14/+46
| | | | | | | | Export functions for later use. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: Remove scsi_print_command when calling abortHannes Reinecke2014-11-127-27/+11
| | | | | | | | | Calling scsi_print_command should not be necessary during abort; if the information is required one should enable scsi logging. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: repurpose the last argument from print_opcode_name()Hannes Reinecke2014-11-125-30/+27
| | | | | | | | | | | | | print_opcode_name() was only ever called with a '0' argument from LLDDs and ULDs which were _not_ supporting variable length CDBs, so the 'if' clause was never triggered. Instead we should be using the last argument to specify the cdb length to avoid accidental overflow when reading the cdb buffer. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: consolidate opcode lookup in scsi_opcode_sa_name()Hannes Reinecke2014-11-121-16/+23
| | | | | | | | | | Consolidate the CDB opcode lookup in scsi_opcode_sa_name(), so that we don't have to call several functions to figure out the CDB opcode string. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: merge print_opcode_name()Hannes Reinecke2014-11-121-60/+38
| | | | | | | | | Instead of having two versions of print_opcode_name() we should be consolidating them into one version. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: implement scsi_opcode_sa_nameHannes Reinecke2014-11-121-78/+53
| | | | | | | | | Implement a lookup array for SERVICE ACTION commands instead of hardcoding it in a large switch statement. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: remove scsi_print_status()Hannes Reinecke2014-11-122-36/+0
| | | | | | | | Last caller is gone, so we can remove it. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: use 'bool' as return value for scsi_normalize_sense()Hannes Reinecke2014-11-123-16/+16
| | | | | | | | | | Convert scsi_normalize_sense() and friends to return 'bool' instead of an integer. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Reviewed-by: Yoshihiro Yunomae <yoshihiro.yunomae.ez@hitachi.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: do not decode sense extrasHannes Reinecke2014-11-121-62/+0
| | | | | | | | | | | | Currently we're only decoding sense extras for tape devices. And even there only for fixed format sense formats. As this is of rather limited use in the general case we should be stop trying to decode sense extras; the tape driver does its own decoding anyway. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: stop decoding if scsi_normalize_sense() failsHannes Reinecke2014-11-121-18/+16
| | | | | | | | | | | If scsi_normalize_sense() fails we couldn't decode the sense buffer, and the scsi_sense_hdr fields are invalid. For those cases we should rather dump the sense buffer and not try to decode invalid fields. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* 53c700: remove scsi_print_sense() usageHannes Reinecke2014-11-121-7/+2
| | | | | | | | | | The 53c700 driver would be using scsi_print_sense() in a debug statement, which was never compiled in. Plus the same information can get retrieved with logging. So remove it. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* fas216: update logging messagesHannes Reinecke2014-11-121-15/+11
| | | | | | | | | Update logging messages to use dev_printk() variants for correct device annotations. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* fas216: return DID_ERROR for incomplete data transferHannes Reinecke2014-11-121-2/+1
| | | | | | | | | | | fas216 returns DID_BAD_TARGET for an incomplete data transfer. The midlayer uses DID_BAD_TARGET to signal a non-existing or not reachable target. So we should rather be using DID_ERROR here. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* acornscsi: use scsi_print_command()Hannes Reinecke2014-11-121-6/+6
| | | | | | | | | | | | Update acornscsi to use scsi_print_command() instead of the underscore version and use scmd_printk() in acornscsi_done(). This will add correct device annotations in the resulting message. And we should be using set_host_byte() for setting the final result. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: use sdev as argument for sense code printingHannes Reinecke2014-11-1218-98/+107
| | | | | | | | | | | We should be using the standard dev_printk() variants for sense code printing. [hch: remove __scsi_print_sense call in xen-scsiback, Acked by Juergen] [hch: folded bracing fix from Dan Carpenter] Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: introduce sdev_prefix_printk()Hannes Reinecke2014-11-126-11/+17
| | | | | | | | | | Like scmd_printk(), but the device name is passed in as a string. Can be used by eg ULDs which do not have access to the scsi_cmnd structure. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* aha152x: debug output update and whitespace cleanupHannes Reinecke2014-11-121-770/+224
| | | | | | | | | | | Remove all uncommented debugging code and move all printk() statements over to dev_printk(). And while we're at it we should be doing a whitespace cleanup, too. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* sd: remove scsi_print_sense() in sd_done()Hannes Reinecke2014-11-121-1/+0
| | | | | | | | | sd_done() was calling scsi_print_sense() for a sense code of 'NO_SENSE'. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: remove scsi_cmd_print_sense_hdr()Hannes Reinecke2014-11-122-16/+0
| | | | | | | | Unused. Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Robert Elliott <elliott@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* enclosure: handle non-unique element descriptorsMarkus Stockhausen2014-11-121-4/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some SES devices give non-unique Element Descriptors as part of the Element Descriptor diag page. Since we use these for creating sysfs entries, they need to be unique. The specification doesn't require these to be unique. Eg: $ sg_ses -p 7 /dev/sg0 FTS CORP TXS6_SAS20BPX12 0500 enclosure services device Element descriptor In diagnostic page: generation code: 0x0 element descriptor by type list Element type: Array device, subenclosure id: 0 Overall descriptor: ArrayDevicesInSubEnclsr0 Element 1 descriptor: ArrayDevice00 Element 2 descriptor: ArrayDevice01 Element 3 descriptor: ArrayDevice02 Element 4 descriptor: ArrayDevice03 Element 5 descriptor: ArrayDevice03 Element 6 descriptor: ArrayDevice03 Element 7 descriptor: ArrayDevice03 Element 8 descriptor: ArrayDevice03 Element 9 descriptor: ArrayDevice03 Element 10 descriptor: ArrayDevice03 Element 11 descriptor: ArrayDevice03 Element 12 descriptor: ArrayDevice03 Based on http://thread.gmane.org/gmane.linux.scsi/69289. This version implements James' ideas about the naming convention Signed-off-by: Markus Stockhausen <stockhausen@collogia.de> Acked-by: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* st: add a debug_flag module parameter requestLaurence Oberman2014-11-122-4/+20
| | | | | | | | | | | This patch adds a debug_flag parameter that can be set on module load, and allows the DEBUG facility without a module recompile. Note that now DEBUG 1 is the default with this patch. Usage: modprobe st debug_flag=1 Signed-off-by: Laurence Oberman <loberman@redhat.com> Acked-by: Kai M??kisara <kai.makisara@kolumbus.fi> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: add SG_SCSI_RESET_NO_ESCALATE flag to SG_SCSI_RESET ioctlDouglas Gilbert2014-11-125-14/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | Further to a January 2013 thread titled: "[PATCH] SG_SCSI_RESET ioctl should only perform requested operation" by Jeremy Linton a patch (v3) is presented that expands the existing ioctl to include "no_escalate" versions to the existing resets. This requires no changes to SCSI low level drivers (LLDs); it adds several more finely tuned reset options to the user space. For example: /* This call remains the same, with the same escalating semantics * if the device (LU) reset fail. That is: on failure to try a * target reset and if that fails, try a bus reset, and if that fails * try a host (i.e. LLD) reset. */ val = SG_SCSI_RESET_DEVICE; res = ioctl(<sg_or_block_fd>, SG_SCSI_RESET, &val); /* What follows is a new option introduced by this patch series. Only * a device reset is attempted. If that fails then an appropriate * error code is provided. N.B. There is no reset escalation. */ val = SG_SCSI_RESET_DEVICE | SG_SCSI_RESET_NO_ESCALATE; res = ioctl(<sg_or_block_fd>, SG_SCSI_RESET, &val); Signed-off-by: Douglas Gilbert <dgilbert@interlog.com> Reviewed-by: Jeremy Linton <jlinton@tributary.com> Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: PC partition tables are little endianChristoph Hellwig2014-11-121-2/+2
| | | | | | | | | | | | | As sparse correctly pointed out, scsi_partsize should use get_unaligned_le32 to read PC partition tables from disk, as they are little endian. The result of this bug is that we returned incorrect geometries on big endian systems when using the scsicam variant. Which probably doesn't matter as only old x86 systems every cared about the geometry. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@suse.de>
* scsi: resolve some missing-field-initializers warningsMark Rustad2014-11-121-1/+1
| | | | | | | | | | | | Resolve some missing-field-initializers warnings by using designated initialization. [hch: W=2 with modern gcc warns about this. Pretty pointless to me, but I'd prefer to keep us warning free] Signed-off-by: Mark Rustad <mark.d.rustad@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: fix off-by-one LUN check in scsi_scan_host_selected()Mark Knibbs2014-11-121-1/+1
| | | | | | | | | The Scsi_Host structure max_lun field is the maximum allowed LUN plus 1. So a LUN value is invalid if >= max_lun. Signed-off-by: Mark Knibbs <markk@clara.co.uk> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* scsi: fix trivial typos in scsi_scan.c commentMark Knibbs2014-11-121-2/+2
| | | | | | Signed-off-by: Mark Knibbs <markk@clara.co.uk> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
* bnx2fc: fix tgt spinlock lockingMaurizio Lombardi2014-11-102-11/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | bnx2fc_queuecommand(): when allocating a new io_req, the tgt_lock spinlock must be locked before calling bnx2fc_cmd_alloc(). The spinlock should also be kept locked until bnx2fc_post_io_req() has been completed. If not, a kernel thread may call bnx2fc_process_cq_compl() that extracts the newly allocated io_req from hba->cmd_mgr->cmds and destroys it while it is still being used by bnx2fc_post_io_req(). BUG: unable to handle kernel NULL pointer dereference at 000000000000004c IP: [<ffffffffa03130da>] bnx2fc_init_task+0x6a/0x230 [bnx2fc] PGD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/pci0000:00/0000:00:02.0/0000:04:00.3/net/eth3/type CPU 33 Modules linked in: autofs4 target_core_iblock target_core_file target_core_pscsi target_core_mod configfs bnx2fc cnic uio fcoe libfcoe libfc scsi_transport_fc 8021q garp scsi_tgt stp llc cpufreq_ondemand freq_table pcc_cpufreq ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 power_meter microcode iTCO_wdt iTCO_vendor_support hpilo hpwdt sg bnx2x libcrc32c mdio serio_raw lpc_ich mfd_core shpchp ext4 jbd2 mbcache sd_mod crc_t10dif hpsa video output dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan] Pid: 7355, comm: bnx2fc_thread/3 Not tainted 2.6.32-431.el6.x86_64 #1 HP ProLiant BL460c Gen8 RIP: 0010:[<ffffffffa03130da>] [<ffffffffa03130da>] bnx2fc_init_task+0x6a/0x230 [bnx2fc] RSP: 0018:ffff8820b0da3b68 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff882003801080 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff882003801100 RBP: ffff8820b0da3bc8 R08: ffffffff8160d4e8 R09: 0000000000000040 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88400e600e00 R13: ffff8840108fbe40 R14: ffff88200ffe5400 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8820b0da0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 000000000000004c CR3: 0000002010b67000 CR4: 00000000001407e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process bnx2fc_thread/3 (pid: 7355, threadinfo ffff88401f940000, task ffff884012f5f540) Stack: ffff8820b0da3bc8 ffffffff81527303 ffff884000000020 ffff8820b0da3bd8 <d> ffff8820b0da3b98 000000028138931a ffff88400f506078 ffff88400e600e00 <d> ffff88200ffe5400 ffff88200ffe5590 0000000000000021 0000000000000002 Call Trace: <IRQ> [<ffffffff81527303>] ? printk+0x41/0x46 [<ffffffffa03169bc>] bnx2fc_post_io_req+0x11c/0x440 [bnx2fc] [<ffffffff812825b9>] ? cpumask_next_and+0x29/0x50 [<ffffffff8137ffd0>] ? scsi_done+0x0/0x60 [<ffffffffa0316df7>] bnx2fc_queuecommand+0x117/0x140 [bnx2fc] [<ffffffff81380245>] scsi_dispatch_cmd+0xe5/0x310 [<ffffffff81388b9e>] scsi_request_fn+0x5ee/0x7a0 [<ffffffff812658f1>] __blk_run_queue+0x31/0x40 [<ffffffff81265a40>] blk_run_queue+0x30/0x50 [<ffffffff81387da6>] scsi_run_queue+0xc6/0x270 [<ffffffff81260f92>] ? elv_requeue_request+0x52/0xa0 [<ffffffff813897a0>] scsi_requeue_command+0x90/0xb0 [<ffffffff81389b84>] scsi_io_completion+0x154/0x6c0 [<ffffffff8137ff62>] scsi_finish_command+0xc2/0x130 [<ffffffff8138a255>] scsi_softirq_done+0x145/0x170 [<ffffffff8126e865>] blk_done_softirq+0x85/0xa0 [<ffffffff8107a8e1>] __do_softirq+0xc1/0x1e0 [<ffffffff8100c30c>] ? call_softirq+0x1c/0x30 [<ffffffff8100c30c>] call_softirq+0x1c/0x30 <EOI> [<ffffffff8100fa75>] ? do_softirq+0x65/0xa0 [<ffffffff8107a40a>] local_bh_enable_ip+0x9a/0xb0 [<ffffffff8152a4eb>] _spin_unlock_bh+0x1b/0x20 [<ffffffffa0313937>] bnx2fc_process_cq_compl+0x257/0x2b0 [bnx2fc] [<ffffffffa03114ea>] bnx2fc_percpu_io_thread+0xea/0x160 [bnx2fc] [<ffffffffa0311400>] ? bnx2fc_percpu_io_thread+0x0/0x160 [bnx2fc] [<ffffffff8109aef6>] kthread+0x96/0xa0 [<ffffffff8100c20a>] child_rip+0xa/0x20 [<ffffffff8109ae60>] ? kthread+0x0/0xa0 [<ffffffff8100c200>] ? child_rip+0x0/0x20 Code: 89 df 45 8b 7e 30 0f 85 75 01 00 00 89 d1 31 c0 c1 e9 03 83 e2 04 89 c9 f3 48 ab 74 06 c7 07 00 00 00 00 49 89 9c 24 88 01 00 00 <83> 7e 4c 01 b8 01 00 00 00 0f 84 e7 00 00 00 89 c2 0a 53 38 41 RIP [<ffffffffa03130da>] bnx2fc_init_task+0x6a/0x230 [bnx2fc] RSP <ffff8820b0da3b68> CR2: 000000000000004c Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Acked-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
OpenPOWER on IntegriCloud