05a05872c8
The lpfc_sli4_scmd_to_wqidx_distr() function expects the scsi_cmnd
'lpfc_cmd->pCmd' not to be null, and point to the midlayer command.
That's not true in the .eh_(device|target|bus)_reset_handler path,
because lpfc_send_taskmgmt() sends commands not from the midlayer, so
does not set 'lpfc_cmd->pCmd'.
That is true in the .queuecommand path because lpfc_queuecommand()
stores the scsi_cmnd from midlayer in lpfc_cmd->pCmd; and lpfc_cmd is
stored by lpfc_scsi_prep_cmnd() in piocbq->context1 -- which is passed
to lpfc_sli4_scmd_to_wqidx_distr() as lpfc_cmd parameter.
This problem can be hit on SCSI EH, and immediately with sg_reset.
These 2 test-cases demonstrate the problem/fix with next-20160601.
Test-case 1) sg_reset
# strace sg_reset --device /dev/sdm
<...>
open("/dev/sdm", O_RDWR|O_NONBLOCK) = 3
ioctl(3, SG_SCSI_RESET, 0x3fffde6d0994 <unfinished ...>
+++ killed by SIGSEGV +++
Segmentation fault
# dmesg
Unable to handle kernel paging request for data at address 0x00000000
Faulting instruction address: 0xd00000001c88442c
Oops: Kernel access of bad area, sig: 11 [#1]
<...>
CPU: 104 PID: 16333 Comm: sg_reset Tainted: G W 4.7.0-rc1-next-20160601-00004-g95b89dc #6
<...>
NIP [d00000001c88442c] lpfc_sli4_scmd_to_wqidx_distr+0xc/0xd0 [lpfc]
LR [d00000001c826fe8] lpfc_sli_calc_ring.part.27+0x98/0xd0 [lpfc]
Call Trace:
[c000003c9ec876f0] [c000003c9ec87770] 0xc000003c9ec87770 (unreliable)
[c000003c9ec87720] [d00000001c82e004] lpfc_sli_issue_iocb+0xd4/0x260 [lpfc]
[c000003c9ec87780] [d00000001c831a3c] lpfc_sli_issue_iocb_wait+0x15c/0x5b0 [lpfc]
[c000003c9ec87880] [d00000001c87f27c] lpfc_send_taskmgmt+0x24c/0x650 [lpfc]
[c000003c9ec87950] [d00000001c87fd7c] lpfc_device_reset_handler+0x10c/0x200 [lpfc]
[c000003c9ec87a10] [c000000000610694] scsi_try_bus_device_reset+0x44/0xc0
[c000003c9ec87a40] [c0000000006113e8] scsi_ioctl_reset+0x198/0x2c0
[c000003c9ec87bf0] [c00000000060fe5c] scsi_ioctl+0x13c/0x4b0
[c000003c9ec87c80] [c0000000006629b0] sd_ioctl+0xf0/0x120
[c000003c9ec87cd0] [c00000000046e4f8] blkdev_ioctl+0x248/0xb70
[c000003c9ec87d30] [c0000000002a1f60] block_ioctl+0x70/0x90
[c000003c9ec87d50] [c00000000026d334] do_vfs_ioctl+0xc4/0x890
[c000003c9ec87de0] [c00000000026db60] SyS_ioctl+0x60/0xc0
[c000003c9ec87e30] [c000000000009120] system_call+0x38/0x108
Instruction dump:
<...>
With fix:
# strace sg_reset --device /dev/sdm
<...>
open("/dev/sdm", O_RDWR|O_NONBLOCK) = 3
ioctl(3, SG_SCSI_RESET, 0x3fffe103c554) = 0
close(3) = 0
exit_group(0) = ?
+++ exited with 0 +++
# dmesg
[ 424.658649] lpfc 0006:01:00.4: 4:(0):0713 SCSI layer issued Device Reset (1, 0) return x2002
Test-case 2) SCSI EH
Using this debug patch to wire an SCSI EH trigger, for lpfc_scsi_cmd_iocb_cmpl():
- cmd->scsi_done(cmd);
+ if ((phba->pport ? phba->pport->cfg_log_verbose : phba->cfg_log_verbose) == 0x32100000)
+ printk(KERN_ALERT "lpfc: skip scsi_done()\n");
+ else
+ cmd->scsi_done(cmd);
# echo 0x32100000 > /sys/class/scsi_host/host11/lpfc_log_verbose
# dd if=/dev/sdm of=/dev/null iflag=direct &
<...>
After a while:
# dmesg
lpfc 0006:01:00.4: 4:(0):3053 lpfc_log_verbose changed from 0 (x0) to 839909376 (x32100000)
lpfc: skip scsi_done()
<...>
Unable to handle kernel paging request for data at address 0x00000000
Faulting instruction address: 0xd0000000199e448c
Oops: Kernel access of bad area, sig: 11 [#1]
<...>
CPU: 96 PID: 28556 Comm: scsi_eh_11 Tainted: G W 4.7.0-rc1-next-20160601-00004-g95b89dc #6
<...>
NIP [d0000000199e448c] lpfc_sli4_scmd_to_wqidx_distr+0xc/0xd0 [lpfc]
LR [d000000019986fe8] lpfc_sli_calc_ring.part.27+0x98/0xd0 [lpfc]
Call Trace:
[c000000ff0d0b890] [c000000ff0d0b900] 0xc000000ff0d0b900 (unreliable)
[c000000ff0d0b8c0] [d00000001998e004] lpfc_sli_issue_iocb+0xd4/0x260 [lpfc]
[c000000ff0d0b920] [d000000019991a3c] lpfc_sli_issue_iocb_wait+0x15c/0x5b0 [lpfc]
[c000000ff0d0ba20] [d0000000199df27c] lpfc_send_taskmgmt+0x24c/0x650 [lpfc]
[c000000ff0d0baf0] [d0000000199dfd7c] lpfc_device_reset_handler+0x10c/0x200 [lpfc]
[c000000ff0d0bbb0] [c000000000610694] scsi_try_bus_device_reset+0x44/0xc0
[c000000ff0d0bbe0] [c0000000006126cc] scsi_eh_ready_devs+0x49c/0x9c0
[c000000ff0d0bcb0] [c000000000614160] scsi_error_handler+0x580/0x680
[c000000ff0d0bd80] [c0000000000ae848] kthread+0x108/0x130
[c000000ff0d0be30] [c0000000000094a8] ret_from_kernel_thread+0x5c/0xb4
Instruction dump:
<...>
With fix:
# dmesg
lpfc 0006:01:00.4: 4:(0):3053 lpfc_log_verbose changed from 0 (x0) to 839909376 (x32100000)
lpfc: skip scsi_done()
<...>
lpfc 0006:01:00.4: 4:(0):0713 SCSI layer issued Device Reset (0, 0) return x2002
<...>
lpfc 0006:01:00.4: 4:(0):0723 SCSI layer issued Target Reset (1, 0) return x2002
<...>
lpfc 0006:01:00.4: 4:(0):0714 SCSI layer issued Bus Reset Data: x2002
<...>
lpfc 0006:01:00.4: 4:(0):3172 SCSI layer issued Host Reset Data:
<...>
Fixes:
|
||
---|---|---|
.. | ||
aacraid | ||
aic7xxx | ||
aic94xx | ||
arcmsr | ||
arm | ||
be2iscsi | ||
bfa | ||
bnx2fc | ||
bnx2i | ||
csiostor | ||
cxgbi | ||
cxlflash | ||
device_handler | ||
dpt | ||
esas2r | ||
fcoe | ||
fnic | ||
hisi_sas | ||
ibmvscsi | ||
isci | ||
libfc | ||
libsas | ||
lpfc | ||
megaraid | ||
mpt3sas | ||
mvsas | ||
osd | ||
pcmcia | ||
pm8001 | ||
qla2xxx | ||
qla4xxx | ||
snic | ||
sym53c8xx_2 | ||
ufs | ||
.gitignore | ||
3w-9xxx.c | ||
3w-9xxx.h | ||
3w-sas.c | ||
3w-sas.h | ||
3w-xxxx.c | ||
3w-xxxx.h | ||
53c700_d.h_shipped | ||
53c700.c | ||
53c700.h | ||
53c700.scr | ||
a100u2w.c | ||
a100u2w.h | ||
a2091.c | ||
a2091.h | ||
a3000.c | ||
a3000.h | ||
a4000t.c | ||
advansys.c | ||
aha152x.c | ||
aha152x.h | ||
aha1542.c | ||
aha1542.h | ||
aha1740.c | ||
aha1740.h | ||
am53c974.c | ||
atari_scsi.c | ||
atp870u.c | ||
atp870u.h | ||
BusLogic.c | ||
BusLogic.h | ||
bvme6000_scsi.c | ||
ch.c | ||
constants.c | ||
dc395x.c | ||
dc395x.h | ||
dmx3191d.c | ||
dpt_i2o.c | ||
dpti.h | ||
dtc.c | ||
dtc.h | ||
eata_generic.h | ||
eata_pio.c | ||
eata_pio.h | ||
eata.c | ||
esp_scsi.c | ||
esp_scsi.h | ||
fdomain.c | ||
fdomain.h | ||
FlashPoint.c | ||
g_NCR5380_mmio.c | ||
g_NCR5380.c | ||
g_NCR5380.h | ||
gdth_ioctl.h | ||
gdth_proc.c | ||
gdth_proc.h | ||
gdth.c | ||
gdth.h | ||
gvp11.c | ||
gvp11.h | ||
hosts.c | ||
hpsa_cmd.h | ||
hpsa.c | ||
hpsa.h | ||
hptiop.c | ||
hptiop.h | ||
imm.c | ||
imm.h | ||
in2000.c | ||
in2000.h | ||
initio.c | ||
initio.h | ||
ipr.c | ||
ipr.h | ||
ips.c | ||
ips.h | ||
iscsi_boot_sysfs.c | ||
iscsi_tcp.c | ||
iscsi_tcp.h | ||
jazz_esp.c | ||
Kconfig | ||
lasi700.c | ||
libiscsi_tcp.c | ||
libiscsi.c | ||
mac53c94.c | ||
mac53c94.h | ||
mac_esp.c | ||
mac_scsi.c | ||
Makefile | ||
megaraid.c | ||
megaraid.h | ||
mesh.c | ||
mesh.h | ||
mvme16x_scsi.c | ||
mvme147.c | ||
mvme147.h | ||
mvumi.c | ||
mvumi.h | ||
ncr53c8xx.c | ||
ncr53c8xx.h | ||
NCR53c406a.c | ||
NCR5380.c | ||
NCR5380.h | ||
NCR_D700.c | ||
NCR_D700.h | ||
NCR_Q720.c | ||
NCR_Q720.h | ||
nsp32_debug.c | ||
nsp32_io.h | ||
nsp32.c | ||
nsp32.h | ||
osst_detect.h | ||
osst_options.h | ||
osst.c | ||
osst.h | ||
pas16.c | ||
pas16.h | ||
pmcraid.c | ||
pmcraid.h | ||
ppa.c | ||
ppa.h | ||
ps3rom.c | ||
qla1280.c | ||
qla1280.h | ||
qlogicfas408.c | ||
qlogicfas408.h | ||
qlogicfas.c | ||
qlogicpti.c | ||
qlogicpti.h | ||
raid_class.c | ||
script_asm.pl | ||
scsi_common.c | ||
scsi_debug.c | ||
scsi_devinfo.c | ||
scsi_dh.c | ||
scsi_error.c | ||
scsi_ioctl.c | ||
scsi_lib_dma.c | ||
scsi_lib.c | ||
scsi_logging.c | ||
scsi_logging.h | ||
scsi_module.c | ||
scsi_netlink.c | ||
scsi_pm.c | ||
scsi_priv.h | ||
scsi_proc.c | ||
scsi_sas_internal.h | ||
scsi_scan.c | ||
scsi_sysctl.c | ||
scsi_sysfs.c | ||
scsi_trace.c | ||
scsi_transport_api.h | ||
scsi_transport_fc.c | ||
scsi_transport_iscsi.c | ||
scsi_transport_sas.c | ||
scsi_transport_spi.c | ||
scsi_transport_srp.c | ||
scsi_typedefs.h | ||
scsi.c | ||
scsi.h | ||
scsicam.c | ||
sd_dif.c | ||
sd.c | ||
sd.h | ||
sense_codes.h | ||
ses.c | ||
sg.c | ||
sgiwd93.c | ||
sim710.c | ||
sni_53c710.c | ||
sr_ioctl.c | ||
sr_vendor.c | ||
sr.c | ||
sr.h | ||
st_options.h | ||
st.c | ||
st.h | ||
stex.c | ||
storvsc_drv.c | ||
sun3_scsi_vme.c | ||
sun3_scsi.c | ||
sun3_scsi.h | ||
sun3x_esp.c | ||
sun_esp.c | ||
sym53c416.c | ||
sym53c416.h | ||
t128.c | ||
t128.h | ||
u14-34f.c | ||
ultrastor.c | ||
ultrastor.h | ||
virtio_scsi.c | ||
vmw_pvscsi.c | ||
vmw_pvscsi.h | ||
wd33c93.c | ||
wd33c93.h | ||
wd719x.c | ||
wd719x.h | ||
wd7000.c | ||
xen-scsifront.c | ||
zalon.c | ||
zorro7xx.c |