lwn.git/drivers/scsi/libfc/fc_exch.c, branch doc/4.9

libfc: sanity check cpu number extracted from xid

2016-07-14T01:49:57+00:00

In the receive path libfc extracts a cpu number from the ox_id in the fiber channel header and uses that to do a per_cpu_ptr conversion. If, for some reason, a frame is received with an invalid ox_id, per_cpu_ptr will return an invalid pointer and the libfc receive path will panic the system trying to use it. I'm currently looking at such a case, and I don't yet know why a cpu number > nr_cpu_ids is appearing in an exchange id. But adding a sanity check in libfc prevents a system panic, and seems like good idea when dealing with frames coming in from the network. Signed-off-by: Chris Leech Acked-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen

libfc: Fix fc_exch_recv_req() error path

2015-08-12T18:23:30+00:00

Due to patch "libfc: Do not invoke the response handler after fc_exch_done()" (commit ID 7030fd62) the lport_recv() call in fc_exch_recv_req() is passed a dangling pointer. Avoid this by moving the fc_frame_free() call from fc_invoke_resp() to its callers. This patch fixes the following crash: general protection fault: 0000 [#3] PREEMPT SMP RIP: fc_lport_recv_req+0x72/0x280 [libfc] Call Trace: fc_exch_recv+0x642/0xde0 [libfc] fcoe_percpu_receive_thread+0x46a/0x5ed [fcoe] kthread+0x10a/0x120 ret_from_fork+0x42/0x70 Signed-off-by: Bart Van Assche Cc: stable Signed-off-by: Vasu Dev Signed-off-by: James Bottomley

libfc: Do not invoke the response handler after fc_exch_done()

2013-09-04T20:45:22+00:00

While the FCoE initiator driver invokes fc_exch_done() from inside the libfc response handler, FCoE target drivers typically invoke fc_exch_done() from outside the libfc response handler. The object fc_exch.arg points at may disappear as soon as fc_exch_done() has finished. So it's important not to invoke the response handler function after fc_exch_done() has finished. Modify libfc such that this guarantee is provided if fc_exch_done() is invoked from outside a response handler. This patch fixes a sporadic crash in FCoE target implementations after a command has been aborted. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Reduce exchange lock contention in fc_exch_recv_abts()

2013-09-04T20:37:53+00:00

Reduce the time during which the exchange lock is held by allocating a frame before obtaining the exchange lock. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Avoid that sending after an abort triggers a kernel warning

2013-09-04T20:30:43+00:00

Calling fc_seq_send() after an ABTS message has been received triggers a kernel warning (WARN_ON(!(ep->esb_stat & ESB_ST_SEQ_INIT))). Avoid this by returning -ENXIO to the caller if fc_seq_send() is invoked after an ABTS message has been received. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Protect ep->esb_stat changes via ex_lock

2013-09-04T20:23:38+00:00

This patch avoids that the WARN_ON(!(ep->esb_stat & ESB_ST_SEQ_INIT)) statement in fc_seq_send_locked() gets triggered sporadically when running FCoE target code due to concurrent ep->esb_stat modifications. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Fix a race in fc_exch_timer_set_locked()

2013-09-04T20:16:25+00:00

It is allowed to pass a zero timeout value to fc_seq_exch_abort(). Avoid that this can cause the timeout function to drop the exchange reference before it has been increased by fc_exch_timer_set_locked(). This patch fixes a crash when running FCoE target code with poisoning enabled in the memory allocator. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Clarify fc_exch_find()

2013-09-04T20:09:15+00:00

The condition ep != NULL && ep->xid != xid can never be met. Make this explicit. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Micro-optimize fc_setup_exch_mgr()

2013-09-04T20:02:09+00:00

Convert a loop into an ilog2() call. Although this code is not performance sensitive this conversion makes this code easier to read. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love

libfc: Debug code fixes

2013-09-04T19:55:02+00:00

The second argument of fc_lport_error() may be a valid frame pointer. Hence only print it as an error code if it really is an error code. Debug statements must end in a newline. Add one where it is missing. Signed-off-by: Bart Van Assche Cc: Neil Horman Signed-off-by: Robert Love