From patchwork Tue Mar 26 07:38:49 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Saurav Kashyap X-Patchwork-Id: 10870533 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3756615AC for ; Tue, 26 Mar 2019 07:40:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 21F7C28FEC for ; Tue, 26 Mar 2019 07:40:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 161F52907D; Tue, 26 Mar 2019 07:40:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7E0AB28FEC for ; Tue, 26 Mar 2019 07:40:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731155AbfCZHkD (ORCPT ); Tue, 26 Mar 2019 03:40:03 -0400 Received: from mail-eopbgr800059.outbound.protection.outlook.com ([40.107.80.59]:5495 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1731136AbfCZHkC (ORCPT ); Tue, 26 Mar 2019 03:40:02 -0400 Received: from DM5PR07CA0109.namprd07.prod.outlook.com (52.132.138.38) by SN6PR07MB5373.namprd07.prod.outlook.com (52.135.105.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1730.16; Tue, 26 Mar 2019 07:40:01 +0000 Received: from DM3NAM05FT017.eop-nam05.prod.protection.outlook.com (2a01:111:f400:7e51::200) by DM5PR07CA0109.outlook.office365.com (2603:10b6:4:ae::38) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1730.19 via Frontend Transport; Tue, 26 Mar 2019 07:40:01 +0000 Authentication-Results: spf=fail (sender IP is 199.233.58.38) smtp.mailfrom=marvell.com; vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=fail action=none header.from=marvell.com; Received-SPF: Fail (protection.outlook.com: domain of marvell.com does not designate 199.233.58.38 as permitted sender) receiver=protection.outlook.com; client-ip=199.233.58.38; helo=CAEXCH02.caveonetworks.com; Received: from CAEXCH02.caveonetworks.com (199.233.58.38) by DM3NAM05FT017.mail.protection.outlook.com (10.152.98.126) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) id 15.20.1750.4 via Frontend Transport; Tue, 26 Mar 2019 07:40:00 +0000 Received: from dut1171.mv.qlogic.com (10.112.88.18) by CAEXCH02.caveonetworks.com (10.67.98.110) with Microsoft SMTP Server (TLS) id 14.2.347.0; Tue, 26 Mar 2019 00:39:50 -0700 Received: from dut1171.mv.qlogic.com (localhost [127.0.0.1]) by dut1171.mv.qlogic.com (8.14.7/8.14.7) with ESMTP id x2Q7do4M026903; Tue, 26 Mar 2019 00:39:50 -0700 Received: (from root@localhost) by dut1171.mv.qlogic.com (8.14.7/8.14.7/Submit) id x2Q7dnnu026902; Tue, 26 Mar 2019 00:39:49 -0700 From: Saurav Kashyap To: CC: , Subject: [PATCH v2 17/26] qedf: fc_rport_priv reference counting fixes Date: Tue, 26 Mar 2019 00:38:49 -0700 Message-ID: <20190326073858.26792-18-skashyap@marvell.com> X-Mailer: git-send-email 2.12.0 In-Reply-To: <20190326073858.26792-1-skashyap@marvell.com> References: <20190326073858.26792-1-skashyap@marvell.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-Matching-Connectors: 131980596010653481;(abac79dc-c90b-41ba-8033-08d666125e47);(abac79dc-c90b-41ba-8033-08d666125e47) X-Forefront-Antispam-Report: CIP:199.233.58.38;IPV:CAL;CTRY:US;EFV:NLI;SFV:NSPM;SFS:(10009020)(376002)(346002)(39860400002)(136003)(396003)(2980300002)(1110001)(1109001)(339900001)(189003)(199004)(305945005)(50466002)(48376002)(356004)(69596002)(80596001)(53936002)(81156014)(81166006)(8676002)(105606002)(6862004)(2351001)(85426001)(4326008)(36756003)(106466001)(47776003)(14444005)(498600001)(86362001)(1076003)(446003)(486006)(476003)(8936002)(11346002)(2616005)(126002)(5660300002)(97736004)(2906002)(42186006)(316002)(36906005)(54906003)(26826003)(87636003)(336012)(68736007)(16586007)(50226002)(26005)(76176011)(51416003);DIR:OUT;SFP:1101;SCL:1;SRVR:SN6PR07MB5373;H:CAEXCH02.caveonetworks.com;FPR:;SPF:Fail;LANG:en;PTR:InfoDomainNonexistent;MX:1;A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 3dda155f-1e94-4d9c-21c0-08d6b1be40ec X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(5600127)(711020)(4605104)(2017052603328);SRVR:SN6PR07MB5373; X-MS-TrafficTypeDiagnostic: SN6PR07MB5373: X-Microsoft-Antispam-PRVS: X-Forefront-PRVS: 09888BC01D X-Microsoft-Antispam-Message-Info: VB5V6UBTh1YnyOqlWGzSeNgL1+UcE4SzHXLnlzPVYH+uEl3AdGvGrSPlz6Rlp9vRAID3Xs2aC/Gds7gq9WexpTID2prdxl0gW2x7XzwqBiSYwWd8VJ/85UdfxFbu40CaWZPg8yXeQSUgY8bHfB1RsxWlJLC++VeXD+OZUpVM3LFzB4lxsf/pKAz8vPTyxl1pw+BpVkd4ugctTVlVvxsnm9PLKKQQYKYpY1TFS+I4pjEhjAC68yPY29e+TR/KLx3wboAb4H2zq1qlvjp5NXL8JWFL/OXzkmIEGbUy5pOg2rG0bdgk3kNEQxid6fBQaNmNHBHUwcyLid41llvppHvWVh1sGELv04WbY/u8aX3EsOzBJSDgfUFjGdLBvxjYFgYzSFMEI2YwPbwMxAJMvKUIe8iti6E3fAwhaXAklFibI2Y= X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Mar 2019 07:40:00.7260 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 3dda155f-1e94-4d9c-21c0-08d6b1be40ec X-MS-Exchange-CrossTenant-Id: 5afe0b00-7697-4969-b663-5eab37d5f47e X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5afe0b00-7697-4969-b663-5eab37d5f47e;Ip=[199.233.58.38];Helo=[CAEXCH02.caveonetworks.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR07MB5373 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Hannes Reinecke The fc_rport_priv structure is reference counted, so we need to ensure that the reference is increased before accessing the structure. Signed-off-by: Hannes Reinecke Signed-off-by: Saurav Kashyap --- drivers/scsi/qedf/qedf_els.c | 9 ++++++++- drivers/scsi/qedf/qedf_io.c | 25 +++++++++++++++++-------- drivers/scsi/qedf/qedf_main.c | 5 +++++ 3 files changed, 30 insertions(+), 9 deletions(-) diff --git a/drivers/scsi/qedf/qedf_els.c b/drivers/scsi/qedf/qedf_els.c index f1f57637..1781e73 100644 --- a/drivers/scsi/qedf/qedf_els.c +++ b/drivers/scsi/qedf/qedf_els.c @@ -378,12 +378,18 @@ void qedf_restart_rport(struct qedf_rport *fcport) spin_unlock_irqrestore(&fcport->rport_lock, flags); rdata = fcport->rdata; - if (rdata) { + if (rdata && !kref_get_unless_zero(&rdata->kref)) { + fcport->rdata = NULL; + rdata = NULL; + } + + if (rdata && rdata->rp_state == RPORT_ST_READY) { lport = fcport->qedf->lport; port_id = rdata->ids.port_id; QEDF_ERR(&(fcport->qedf->dbg_ctx), "LOGO port_id=%x.\n", port_id); fc_rport_logoff(rdata); + kref_put(&rdata->kref, fc_rport_destroy); mutex_lock(&lport->disc.disc_mutex); /* Recreate the rport and log back in */ rdata = fc_rport_create(lport, port_id); @@ -393,6 +399,7 @@ void qedf_restart_rport(struct qedf_rport *fcport) fcport->rdata = rdata; } else { mutex_unlock(&lport->disc.disc_mutex); + fcport->rdata = NULL; } } clear_bit(QEDF_RPORT_IN_RESET, &fcport->flags); diff --git a/drivers/scsi/qedf/qedf_io.c b/drivers/scsi/qedf/qedf_io.c index 57c3aa4..56d2116 100644 --- a/drivers/scsi/qedf/qedf_io.c +++ b/drivers/scsi/qedf/qedf_io.c @@ -1799,6 +1799,7 @@ int qedf_initiate_abts(struct qedf_ioreq *io_req, bool return_scsi_cmd_on_abts) goto out; } + qedf = fcport->qedf; rdata = fcport->rdata; if (!rdata || !kref_get_unless_zero(&rdata->kref)) { @@ -1808,32 +1809,31 @@ int qedf_initiate_abts(struct qedf_ioreq *io_req, bool return_scsi_cmd_on_abts) } r_a_tov = rdata->r_a_tov; - qedf = fcport->qedf; lport = qedf->lport; if (lport->state != LPORT_ST_READY || !(lport->link_up)) { QEDF_ERR(&(qedf->dbg_ctx), "link is not ready\n"); rc = 1; - goto out; + goto drop_rdata_kref; } if (atomic_read(&qedf->link_down_tmo_valid) > 0) { QEDF_ERR(&(qedf->dbg_ctx), "link_down_tmo active.\n"); rc = 1; - goto out; + goto drop_rdata_kref; } /* Ensure room on SQ */ if (!atomic_read(&fcport->free_sqes)) { QEDF_ERR(&(qedf->dbg_ctx), "No SQ entries available\n"); rc = 1; - goto out; + goto drop_rdata_kref; } if (test_bit(QEDF_RPORT_UPLOADING_CONNECTION, &fcport->flags)) { QEDF_ERR(&qedf->dbg_ctx, "fcport is uploading.\n"); rc = 1; - goto out; + goto drop_rdata_kref; } if (!test_bit(QEDF_CMD_OUTSTANDING, &io_req->flags) || @@ -1843,7 +1843,7 @@ int qedf_initiate_abts(struct qedf_ioreq *io_req, bool return_scsi_cmd_on_abts) "cleanup or abort processing or already " "completed.\n", io_req->xid); rc = 1; - goto out; + goto drop_rdata_kref; } kref_get(&io_req->refcount); @@ -1876,6 +1876,8 @@ int qedf_initiate_abts(struct qedf_ioreq *io_req, bool return_scsi_cmd_on_abts) spin_unlock_irqrestore(&fcport->rport_lock, flags); +drop_rdata_kref: + kref_put(&rdata->kref, fc_rport_destroy); out: return rc; } @@ -2217,6 +2219,7 @@ static int qedf_execute_tmf(struct qedf_rport *fcport, struct scsi_cmnd *sc_cmd, unsigned long flags; struct fcoe_wqe *sqe; u16 sqe_idx; + struct fc_rport_priv *rdata = fcport->rdata; if (!sc_cmd) { QEDF_ERR(&(qedf->dbg_ctx), "invalid arg\n"); @@ -2230,8 +2233,13 @@ static int qedf_execute_tmf(struct qedf_rport *fcport, struct scsi_cmnd *sc_cmd, return FAILED; } - QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_SCSI_TM, "portid = 0x%x " - "tm_flags = %d\n", fcport->rdata->ids.port_id, tm_flags); + if (!rdata || !kref_get_unless_zero(&rdata->kref)) { + QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_SCSI_TM, "stale rport\n"); + return FAILED; + } + QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_SCSI_TM, + "portid = 0x%x tm_flags = %d\n", + rdata->ids.port_id, tm_flags); io_req = qedf_alloc_cmd(fcport, QEDF_TASK_MGMT_CMD); if (!io_req) { @@ -2327,6 +2335,7 @@ static int qedf_execute_tmf(struct qedf_rport *fcport, struct scsi_cmnd *sc_cmd, rc = SUCCESS; } reset_tmf_err: + kref_put(&rdata->kref, fc_rport_destroy); return rc; } diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c index f82b0b5..3f42684 100644 --- a/drivers/scsi/qedf/qedf_main.c +++ b/drivers/scsi/qedf/qedf_main.c @@ -1333,6 +1333,8 @@ static void qedf_upload_connection(struct qedf_ctx *qedf, static void qedf_cleanup_fcport(struct qedf_ctx *qedf, struct qedf_rport *fcport) { + struct fc_rport_priv *rdata = fcport->rdata; + QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_CONN, "Cleaning up portid=%06x.\n", fcport->rdata->ids.port_id); @@ -1344,6 +1346,7 @@ static void qedf_cleanup_fcport(struct qedf_ctx *qedf, qedf_free_sq(qedf, fcport); fcport->rdata = NULL; fcport->qedf = NULL; + kref_put(&rdata->kref, fc_rport_destroy); } /** @@ -1419,6 +1422,8 @@ static void qedf_rport_event_handler(struct fc_lport *lport, break; } + /* Initial reference held on entry, so this can't fail */ + kref_get(&rdata->kref); fcport->rdata = rdata; fcport->rport = rport;