Tyrel Datwyler aeaadcde1a scsi: ibmvfc: Store vhost pointer during subcrq allocation ... Currently the back pointer from a queue to the vhost adapter isn't set until after subcrq interrupt registration. The value is available when a queue is first allocated and can/should be also set for primary and async queues as well as subcrqs. This fixes a crash observed during kexec/kdump on Power 9 with legacy XICS interrupt controller where a pending subcrq interrupt from the previous kernel can be replayed immediately upon IRQ registration resulting in dereference of a garbage backpointer in ibmvfc_interrupt_scsi(). Kernel attempted to read user page (58) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000058 Faulting instruction address: 0xc008000003216a08 Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [c008000003216a08] ibmvfc_interrupt_scsi+0x40/0xb0 [ibmvfc] LR [c0000000082079e8] __handle_irq_event_percpu+0x98/0x270 Call Trace: [c000000047fa3d80] [c0000000123e6180] 0xc0000000123e6180 (unreliable) [c000000047fa3df0] [c0000000082079e8] __handle_irq_event_percpu+0x98/0x270 [c000000047fa3ea0] [c000000008207d18] handle_irq_event+0x98/0x188 [c000000047fa3ef0] [c00000000820f564] handle_fasteoi_irq+0xc4/0x310 [c000000047fa3f40] [c000000008205c60] generic_handle_irq+0x50/0x80 [c000000047fa3f60] [c000000008015c40] __do_irq+0x70/0x1a0 [c000000047fa3f90] [c000000008016d7c] __do_IRQ+0x9c/0x130 [c000000014622f60] [0000000020000000] 0x20000000 [c000000014622ff0] [c000000008016e50] do_IRQ+0x40/0xa0 [c000000014623020] [c000000008017044] replay_soft_interrupts+0x194/0x2f0 [c000000014623210] [c0000000080172a8] arch_local_irq_restore+0x108/0x170 [c000000014623240] [c000000008eb1008] _raw_spin_unlock_irqrestore+0x58/0xb0 [c000000014623270] [c00000000820b12c] __setup_irq+0x49c/0x9f0 [c000000014623310] [c00000000820b7c0] request_threaded_irq+0x140/0x230 [c000000014623380] [c008000003212a50] ibmvfc_register_scsi_channel+0x1e8/0x2f0 [ibmvfc] [c000000014623450] [c008000003213d1c] ibmvfc_init_sub_crqs+0xc4/0x1f0 [ibmvfc] [c0000000146234d0] [c0080000032145a8] ibmvfc_reset_crq+0x150/0x210 [ibmvfc] [c000000014623550] [c0080000032147c8] ibmvfc_init_crq+0x160/0x280 [ibmvfc] [c0000000146235f0] [c00800000321a9cc] ibmvfc_probe+0x2a4/0x530 [ibmvfc] Link: https://lore.kernel.org/r/20220616191126.1281259-2-tyreld@linux.ibm.com Fixes: 3034ebe263 ("scsi: ibmvfc: Add alloc/dealloc routines for SCSI Sub-CRQ Channels") Cc: stable@vger.kernel.org Reviewed-by: Brian King <brking@linux.vnet.ibm.com> Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>		2022-06-16 21:42:04 -04:00
..
aacraid	scsi: aacraid: Fix undefined behavior due to shift overflowing the constant	2022-04-25 23:23:05 -04:00
aic7xxx	scsi: aic7xxx: Use standard PCI subsystem, subdevice defines	2022-03-30 00:00:59 -04:00
aic94xx	scsi: libsas: Delete lldd_clear_aca callback	2022-02-19 15:59:34 -05:00
arcmsr	scsi: arcmsr: Switch to attribute groups	2021-10-16 21:45:54 -04:00
arm	scsi: arm: Move the SCSI pointer to private command data	2022-02-22 21:11:03 -05:00
be2iscsi	scsi: iscsi: Stop using the SCSI pointer	2022-02-22 21:11:04 -05:00
bfa	scsi: bfa: Remove unneeded flush_workqueue()	2022-04-25 23:38:38 -04:00
bnx2fc	scsi: bnx2fc: Avoid using get_cpu() in bnx2fc_cmd_alloc()	2022-05-16 21:26:50 -04:00
bnx2i	scsi: iscsi: Merge suspend fields	2022-04-11 22:09:35 -04:00
csiostor	scsi: csio: Stop using the SCSI pointer	2022-02-22 21:11:04 -05:00
cxgbi	scsi: iscsi: Merge suspend fields	2022-04-11 22:09:35 -04:00
cxlflash	scsi: cxlflash: Query write_zeroes limit for zeroing	2022-02-22 21:11:08 -05:00
device_handler	scsi: scsi_dh_alua: Properly handle the ALUA transitioning state	2022-05-02 19:52:13 -04:00
dpt	treewide: Replace zero-length arrays with flexible-array members	2022-02-17 07:00:39 -06:00
elx	scsi: elx: efct: Remove NULL check after calling container_of()	2022-05-19 20:16:27 -04:00
esas2r	scsi: esas2r: Fix typo in comment	2022-05-23 23:24:09 -04:00
fcoe	SCSI misc on 20220524	2022-05-25 19:09:48 -07:00
fnic	scsi: fnic: Replace DMA mask of 64 bits with 47 bits	2022-05-19 20:16:26 -04:00
hisi_sas	scsi: hisi_sas: Fix memory ordering in hisi_sas_task_deliver()	2022-05-19 20:16:26 -04:00
ibmvscsi	scsi: ibmvfc: Store vhost pointer during subcrq allocation	2022-06-16 21:42:04 -04:00
ibmvscsi_tgt	scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024	2022-03-29 23:39:24 -04:00
isci	scsi: isci: Fix typo in comment	2022-05-23 23:24:10 -04:00
libfc	scsi: libfc: Remove get_cpu() semantics in fc_exch_em_alloc()	2022-05-16 21:26:50 -04:00
libsas	scsi: libsas: Refactor sas_ata_hard_reset()	2022-05-19 20:16:25 -04:00
lpfc	scsi: lpfc: Update lpfc version to 14.2.0.4	2022-06-07 21:38:18 -04:00
megaraid	scsi: megaraid_sas: Remove redundant memset() statement	2022-05-19 20:16:26 -04:00
mpi3mr	scsi: mpi3mr: Fix kernel-doc	2022-06-01 22:43:26 -04:00
mpt3sas	scsi: mpt3sas: Fix out-of-bounds compiler warning	2022-06-07 22:01:41 -04:00
mvsas	scsi: mvsas: Add PCI ID of RocketRaid 2640	2022-04-06 22:27:08 -04:00
pcmcia	scsi: sym53c500_cs: Stop using struct scsi_pointer	2022-04-06 22:11:52 -04:00
pm8001	scsi: pm80xx: Enable upper inbound, outbound queues	2022-04-11 21:59:50 -04:00
qedf	scsi: qedf: Fix typo in comment	2022-05-23 23:24:10 -04:00
qedi	scsi: qedi: Fix failed disconnect handling	2022-04-11 22:09:35 -04:00
qla2xxx	SCSI misc on 20220604	2022-06-05 09:25:12 -07:00
qla4xxx	scsi: qla4xxx: Drop redundant memset()	2022-04-25 23:33:36 -04:00
smartpqi	scsi: smartpqi: Fix typo in comment	2022-05-23 23:24:10 -04:00
snic	scsi: snic: Don't use GFP_DMA in snic_queue_report_tgt_req()	2021-12-22 23:43:23 -05:00
sym53c8xx_2	scsi: sym53c8xx_2: Move the SCSI pointer to private command data	2022-02-22 21:11:07 -05:00
.gitignore
3w-9xxx.c	scsi: 3w-9xxx: Switch to attribute groups	2021-10-16 21:45:53 -04:00
3w-9xxx.h
3w-sas.c	scsi: 3w-sas: Remove useless DMA-32 fallback configuration	2022-01-24 23:30:28 -05:00
3w-sas.h
3w-xxxx.c	scsi: 3w-xxx: Remove redundant initialization of variable retval	2021-10-18 22:38:34 -04:00
3w-xxxx.h
53c700_d.h_shipped
53c700.c	scsi: 53c700: Stop clearing SCSI pointer fields	2022-02-22 21:11:03 -05:00
53c700.h
53c700.scr
a100u2w.c	scsi: a100u2w: Fix a kernel-doc warning	2021-11-29 23:02:13 -05:00
a100u2w.h
a2091.c	scsi: wd33c93: Move the SCSI pointer to private command data	2022-02-22 21:11:07 -05:00
a2091.h
a3000.c	scsi: wd33c93: Move the SCSI pointer to private command data	2022-02-22 21:11:07 -05:00
a3000.h
a4000t.c
advansys.c	scsi: advansys: Move the SCSI pointer to private command data	2022-02-22 21:11:03 -05:00
aha152x.c	scsi: aha152x: Stop using struct scsi_pointer	2022-03-29 23:42:18 -04:00
aha152x.h
aha1542.c	scsi: aha1542: Remove unneeded semicolon	2022-04-25 23:25:11 -04:00
aha1542.h
aha1740.c	scsi: Remove drivers/scsi/scsi.h	2022-02-22 21:11:02 -05:00
aha1740.h
am53c974.c
atari_scsi.c	scsi: NCR5380: Add SCp members to struct NCR5380_cmd	2022-02-22 21:11:03 -05:00
atp870u.c	scsi: atp870u: Fix a kernel-doc warning	2021-11-29 23:02:13 -05:00
atp870u.h
BusLogic.c	scsi: core: Remove the 'done' argument from SCSI queuecommand_lck functions	2021-10-16 21:32:16 -04:00
BusLogic.h
bvme6000_scsi.c
ch.c	SCSI misc on 20220113	2022-01-14 14:37:34 +01:00
constants.c
dc395x.c	scsi: dc395x: Fix a missing check on list iterator	2022-04-26 08:51:56 -04:00
dc395x.h
dmx3191d.c	scsi: NCR5380: Remove the NCR5380_CMD_SIZE macro	2022-02-22 21:11:03 -05:00
dpt_i2o.c	scsi: dpt_i2o: Drop redundant spinlock initialization	2022-05-19 20:16:27 -04:00
dpti.h
esp_scsi.c	scsi: esp_scsi: Stop using the SCSI pointer	2022-02-22 21:11:04 -05:00
esp_scsi.h	scsi: esp_scsi: Stop using the SCSI pointer	2022-02-22 21:11:04 -05:00
fdomain_isa.c
fdomain_pci.c
fdomain.c	scsi: fdomain: Move the SCSI pointer to private command data	2022-02-22 21:11:04 -05:00
fdomain.h
FlashPoint.c
g_NCR5380.c	scsi: NCR5380: Add SCp members to struct NCR5380_cmd	2022-02-22 21:11:03 -05:00
gvp11.c	scsi: wd33c93: Move the SCSI pointer to private command data	2022-02-22 21:11:07 -05:00
gvp11.h
hosts.c	scsi: core: Refine how we set tag_set NUMA node	2022-04-26 08:10:35 -04:00
hpsa_cmd.h
hpsa.c	scsi: hpsa: Remove an unused variable in hpsa_update_scsi_devices()	2021-12-13 23:34:01 -05:00
hpsa.h
hptiop.c	scsi: hptiop: Stop using the SCSI pointer	2022-02-22 21:11:04 -05:00
hptiop.h	scsi: hptiop: Stop using the SCSI pointer	2022-02-22 21:11:04 -05:00
imm.c	scsi: imm: Move the SCSI pointer to private command data	2022-02-22 21:11:04 -05:00
imm.h	scsi: imm: Move the SCSI pointer to private command data	2022-02-22 21:11:04 -05:00
initio.c	scsi: initio: Stop using the SCSI pointer	2022-02-22 21:11:05 -05:00
initio.h	scsi: initio: Stop using the SCSI pointer	2022-02-22 21:11:05 -05:00
ipr.c	scsi: ipr: Fix missing/incorrect resource cleanup in error case	2022-06-07 22:05:14 -04:00
ipr.h
ips.c	scsi: Remove drivers/scsi/scsi.h	2022-02-22 21:11:02 -05:00
ips.h
iscsi_boot_sysfs.c
iscsi_tcp.c	scsi: iscsi: Stop using the SCSI pointer	2022-02-22 21:11:04 -05:00
iscsi_tcp.h
jazz_esp.c
Kconfig	scsi: ufs: Split the drivers/scsi/ufs directory	2022-05-19 20:27:37 -04:00
lasi700.c	parisc: Make struct parisc_driver::remove() return void	2021-08-30 10:18:25 +02:00
libiscsi_tcp.c	scsi: iscsi: Merge suspend fields	2022-04-11 22:09:35 -04:00
libiscsi.c	scsi: iscsi: Fix NOP handling during conn recovery	2022-04-11 22:09:35 -04:00
mac53c94.c	scsi: mac53c94: Fix warning comparing pointer to 0	2022-04-25 23:23:05 -04:00
mac53c94.h	scsi: mac53c94: Stop using struct scsi_pointer	2022-02-27 21:35:30 -05:00
mac_esp.c
mac_scsi.c	scsi: NCR5380: Add SCp members to struct NCR5380_cmd	2022-02-22 21:11:03 -05:00
Makefile	scsi: ufs: Split the drivers/scsi/ufs directory	2022-05-19 20:27:37 -04:00
megaraid.c	scsi: megaraid: Fix error check return value of register_chrdev()	2022-04-26 09:02:44 -04:00
megaraid.h	scsi: megaraid: Stop using the SCSI pointer	2022-02-22 21:11:05 -05:00
mesh.c	scsi: mesh: Stop using struct scsi_pointer	2022-02-27 21:34:02 -05:00
mesh.h	scsi: mesh: Stop using struct scsi_pointer	2022-02-27 21:34:02 -05:00
mvme16x_scsi.c
mvme147.c	scsi: wd33c93: Move the SCSI pointer to private command data	2022-02-22 21:11:07 -05:00
mvme147.h
mvumi.c	scsi: mvumi: Stop using the SCSI pointer	2022-02-22 21:11:06 -05:00
mvumi.h	scsi: mvumi: Stop using the SCSI pointer	2022-02-22 21:11:06 -05:00
myrb.c	scsi: myrb: Fix up null pointer access on myrb_cleanup()	2022-05-23 23:24:10 -04:00
myrb.h
myrs.c	scsi: myrs: Fix crash in error case	2022-01-25 00:09:41 -05:00
myrs.h
ncr53c8xx.c	scsi: zalon: Stop using the SCSI pointer	2022-02-22 21:11:07 -05:00
ncr53c8xx.h	scsi: zalon: Stop using the SCSI pointer	2022-02-22 21:11:07 -05:00
NCR5380.c	scsi: NCR5380: Add SCp members to struct NCR5380_cmd	2022-02-22 21:11:03 -05:00
NCR5380.h	scsi: NCR5380: Add SCp members to struct NCR5380_cmd	2022-02-22 21:11:03 -05:00
nsp32_debug.c
nsp32_io.h
nsp32.c	scsi: nsp32: Stop using the SCSI pointer	2022-02-22 21:11:06 -05:00
nsp32.h	scsi: nsp32: Stop using the SCSI pointer	2022-02-22 21:11:06 -05:00
pmcraid.c	scsi: pmcraid: Fix missing resource cleanup in error case	2022-06-07 22:05:14 -04:00
pmcraid.h	scsi: pmcraid: Remove the PMCRAID_PASSTHROUGH_IOCTL ioctl implementation	2022-03-29 23:32:26 -04:00
ppa.c	scsi: ppa: Move the SCSI pointer to private command data	2022-02-22 21:11:06 -05:00
ppa.h
ps3rom.c	scsi: core: Remove the 'done' argument from SCSI queuecommand_lck functions	2021-10-16 21:32:16 -04:00
qla1280.c	scsi: qla1280: Remove redundant variable	2022-05-19 20:26:21 -04:00
qla1280.h	scsi: qla1280: Move the SCSI pointer to private command data	2022-02-22 21:11:06 -05:00
qlogicfas408.c	scsi: Remove drivers/scsi/scsi.h	2022-02-22 21:11:02 -05:00
qlogicfas408.h
qlogicfas.c	scsi: Remove drivers/scsi/scsi.h	2022-02-22 21:11:02 -05:00
qlogicpti.c	scsi: core: Remove the 'done' argument from SCSI queuecommand_lck functions	2021-10-16 21:32:16 -04:00
qlogicpti.h
raid_class.c
script_asm.pl
scsi_bsg.c	scsi: bsg: Drop needless assignment in scsi_bsg_sg_io_fn()	2022-03-15 14:05:02 -04:00
scsi_common.c
scsi_debug.c	scsi: scsi_debug: Fix zone transition to full condition	2022-06-10 12:50:05 -04:00
scsi_debugfs.c	scsi: core: Remove struct scsi_request	2022-03-01 22:21:50 -05:00
scsi_debugfs.h
scsi_devinfo.c
scsi_dh.c
scsi_error.c	blk-mq: remove the done argument to blk_execute_rq_nowait	2022-05-28 06:15:27 -06:00
scsi_ioctl.c	scsi: scsi_ioctl: Drop needless assignment in sg_io()	2022-03-15 14:07:11 -04:00
scsi_lib_dma.c
scsi_lib.c	scsi: core: Return BLK_STS_TRANSPORT for ALUA transitioning	2022-06-01 22:38:53 -04:00
scsi_logging.c	scsi: core: scsi_logging: Fix a BUG	2022-03-29 23:29:19 -04:00
scsi_logging.h
scsi_netlink.c
scsi_pm.c	scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume()	2021-12-22 23:38:29 -05:00
scsi_priv.h	scsi: Remove superfluous #include <linux/async.h> directives	2021-11-29 23:02:15 -05:00
scsi_proc.c	proc: remove PDE_DATA() completely	2022-01-22 08:33:37 +02:00
scsi_sas_internal.h
scsi_scan.c	scsi: core: Do not truncate INQUIRY data on modern devices	2022-05-02 16:59:11 -04:00
scsi_sysctl.c
scsi_sysfs.c	scsi: core: Unexport scsi_bus_type	2022-05-23 23:24:10 -04:00
scsi_trace.c
scsi_transport_api.h
scsi_transport_fc.c	scsi: scsi_transport_fc: Fix FPIN Link Integrity statistics counters	2022-03-01 23:56:27 -05:00
scsi_transport_iscsi.c	scsi: iscsi: Exclude zero from the endpoint ID range	2022-06-13 22:11:36 -04:00
scsi_transport_sas.c	scsi: core: Remove <scsi/scsi_request.h>	2022-03-01 22:21:50 -05:00
scsi_transport_spi.c	scsi: scsi_transport_spi: Use scsi_cmd_to_rq() instead of scsi_cmnd.request	2021-08-11 22:25:37 -04:00
scsi_transport_srp.c
scsi.c	scsi: core: Cache VPD pages b0, b1, b2	2022-05-02 16:59:11 -04:00
scsicam.c	scsicam: Fix use of page cache	2022-05-08 14:28:18 -04:00
sd_dif.c	scsi: sd: Reorganize DIF/DIX code to avoid calling revalidate twice	2022-05-02 16:59:11 -04:00
sd_zbc.c	scsi: sd_zbc: Prevent zone information memory leak	2022-06-01 22:36:44 -04:00
sd.c	scsi: sd: Fix interpretation of VPD B9h length	2022-06-07 21:26:29 -04:00
sd.h	scsi: sd_zbc: Prevent zone information memory leak	2022-06-01 22:36:44 -04:00
sense_codes.h
ses.c	scsi: ses: Fix unsigned comparison with less than zero	2021-09-28 22:42:06 -04:00
sg.c	blk-mq: remove the done argument to blk_execute_rq_nowait	2022-05-28 06:15:27 -06:00
sgiwd93.c	scsi: wd33c93: Move the SCSI pointer to private command data	2022-02-22 21:11:07 -05:00
sim710.c
sni_53c710.c
sr_ioctl.c	scsi: sr: Do not leak information in ioctl	2022-04-18 22:48:31 -04:00
sr_vendor.c	scsi: sr: Don't use GFP_DMA	2021-12-22 23:41:13 -05:00
sr.c	scsi: sr: Add memory allocation failure handling for get_capabilities()	2022-05-02 16:59:12 -04:00
sr.h	sr: implement ->free_disk to simplify refcounting	2022-03-08 19:40:01 -07:00
st_options.h
st.c	blk-mq: remove the done argument to blk_execute_rq_nowait	2022-05-28 06:15:27 -06:00
st.h	scsi: don't use disk->private_data to find the scsi_driver	2022-03-08 19:40:00 -07:00
stex.c	scsi: core: Remove the 'done' argument from SCSI queuecommand_lck functions	2021-10-16 21:32:16 -04:00
storvsc_drv.c	scsi: storvsc: Correct reporting of Hyper-V I/O size limits	2022-06-16 21:36:03 -04:00
sun3_scsi_vme.c
sun3_scsi.c	scsi: NCR5380: Add SCp members to struct NCR5380_cmd	2022-02-22 21:11:03 -05:00
sun3x_esp.c
sun_esp.c
virtio_scsi.c	scsi: virtio-scsi: Eliminate anonymous module_init & module_exit	2022-03-29 23:49:56 -04:00
vmw_pvscsi.c	scsi: vmw_pvscsi: No need to clear memory after a dma_alloc_coherent() call	2022-04-06 23:01:54 -04:00
vmw_pvscsi.h	scsi: vmw_pvscsi: Expand vcpuHint to 16 bits	2022-06-07 21:30:56 -04:00
wd33c93.c	scsi: wd33c93: Move the SCSI pointer to private command data	2022-02-22 21:11:07 -05:00
wd33c93.h	scsi: wd33c93: Move the SCSI pointer to private command data	2022-02-22 21:11:07 -05:00
wd719x.c	scsi: wd719x: Return proper error code when dma_set_mask() fails	2022-03-01 23:56:28 -05:00
wd719x.h	scsi: wd719x: Stop using the SCSI pointer	2022-02-22 21:11:07 -05:00
xen-scsifront.c	xen/scsifront: use xenbus_setup_ring() and xenbus_teardown_ring()	2022-05-19 14:22:03 +02:00
zalon.c	scsi: zalon: Stop using the SCSI pointer	2022-02-22 21:11:07 -05:00
zorro7xx.c	scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()	2022-03-30 00:05:42 -04:00
zorro_esp.c