linux-stable.git/drivers/scsi/libfc, branch v4.9.166

scsi: libfc: free skb when receiving invalid flogi resp

2019-03-13T21:04:57+00:00

[ Upstream commit 5d8fc4a9f0eec20b6c07895022a6bea3fb6dfb38 ]

The issue to be fixed in this commit is when libfc found it received a
invalid FLOGI response from FC switch, it would return without freeing the
fc frame, which is just the skb data. This would cause memory leak if FC
switch keeps sending invalid FLOGI responses.

This fix is just to make it execute `fc_frame_free(fp)` before returning
from function `fc_lport_flogi_resp`.

Signed-off-by: Ming Lu 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: fcoe: clear FC_RP_STARTED flags when receiving a LOGO

2018-09-05T07:20:04+00:00

[ Upstream commit 1550ec458e0cf1a40a170ab1f4c46e3f52860f65 ]

When receiving a LOGO request we forget to clear the FC_RP_STARTED flag
before starting the rport delete routine.

As the started flag was not cleared, we're not deleting the rport but
waiting for a restart and thus are keeping the reference count of the rdata
object at 1.

This leads to the following kmemleak report:
unreferenced object 0xffff88006542aa00 (size 512):
  comm "kworker/0:2", pid 24, jiffies 4294899222 (age 226.880s)
  hex dump (first 32 bytes):
    68 96 fe 65 00 88 ff ff 00 00 00 00 00 00 00 00  h..e............
    01 00 00 00 08 00 00 00 02 c5 45 24 ac b8 00 10  ..........E$....
  backtrace:
    [<(____ptrval____)>] fcoe_ctlr_vn_add.isra.5+0x7f/0x770 [libfcoe]
    [<(____ptrval____)>] fcoe_ctlr_vn_recv+0x12af/0x27f0 [libfcoe]
    [<(____ptrval____)>] fcoe_ctlr_recv_work+0xd01/0x32f0 [libfcoe]
    [<(____ptrval____)>] process_one_work+0x7ff/0x1420
    [<(____ptrval____)>] worker_thread+0x87/0xef0
    [<(____ptrval____)>] kthread+0x2db/0x390
    [<(____ptrval____)>] ret_from_fork+0x35/0x40
    [<(____ptrval____)>] 0xffffffffffffffff

Signed-off-by: Johannes Thumshirn 
Reported-by: ard 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

scsi: libfc: fix seconds_since_last_reset miscalculation

2016-11-18T01:44:51+00:00

Commit 540eb1eef0ab ("scsi: libfc: fix seconds_since_last_reset calculation")
removed the use of 'struct timespec' from fc_get_host_stats(). This broke the
output of 'fcoeadm -s' after kernel 4.8-rc1.

Signed-off-by: Johannes Thumshirn 
Cc:  # v4.8+
Fixes: 540eb1eef0ab ("scsi: libfc: fix seconds_since_last_reset calculation")
Acked-by: Arnd Bergmann 
Reviewed-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: libfc: do not send ABTS when resetting exchanges

2016-08-19T02:35:17+00:00

When all exchanges are reset the upper layers have already logged out of
the remote port, so the exchanges can be reset without sending any ABTS.

Signed-off-by: Hannes Reinecke 
Reviewed-by: Chad Dupuis 
Tested-by: Chad Dupuis 
Signed-off-by: Martin K. Petersen

scsi: libfc: reset exchange manager during LOGO handling

2016-08-19T02:34:40+00:00

FC-LS mandates that we should invalidate all sequences before sending a
LOGO. And we should set the event to RPORT_EV_STOP when a LOGO request
has been received to signal that all exchanges are terminated.

Signed-off-by: Hannes Reinecke 
Reviewed-by: Chad Dupuis 
Tested-by: Chad Dupuis 
Signed-off-by: Martin K. Petersen

scsi: libfc: send LOGO for PLOGI failure

2016-08-19T02:34:05+00:00

When running in point-to-multipoint mode PLOGI is done after FLOGI
completed. So when the PLOGI fails we should be sending a LOGO to the
remote port.

[mkp: Applied by hand]

Signed-off-by: Hannes Reinecke 
Reviewed-by: Chad Dupuis 
Tested-by: Chad Dupuis 
Signed-off-by: Martin K. Petersen

scsi: libfc: Issue PRLI after a PRLO has been received

2016-08-19T02:27:26+00:00

When receiving a PRLO it just means that the operating parameters have
changed, it does _not_ mean that the port doesn't want to communicate
with us.  So instead of implicitly logging out we should be issueing a
PRLI to figure out the new operating parameters.  We can always recover
once PRLI fails.

Signed-off-by: Hannes Reinecke 
Reviewed-by: Chad Dupuis 
Tested-by: Chad Dupuis 
Signed-off-by: Martin K. Petersen

libfc: sanity check cpu number extracted from xid

2016-07-14T01:49:57+00:00

In the receive path libfc extracts a cpu number from the ox_id in the
fiber channel header and uses that to do a per_cpu_ptr conversion.  If,
for some reason, a frame is received with an invalid ox_id, per_cpu_ptr
will return an invalid pointer and the libfc receive path will panic the
system trying to use it.

I'm currently looking at such a case, and I don't yet know why a cpu
number > nr_cpu_ids is appearing in an exchange id.  But adding a sanity
check in libfc prevents a system panic, and seems like good idea when
dealing with frames coming in from the network.

Signed-off-by: Chris Leech 
Acked-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen

scsi: libfc: fix seconds_since_last_reset calculation

2016-07-13T03:16:31+00:00

The fc_get_host_stats() function contains a complex conversion from
jiffies to timespec to seconds. As we try to get rid of uses of struct
timespec, we can clean this up and replace it with a simpler
computation.

Simply dividing the difference in jiffies by HZ is not only much more
efficient, it also avoids a problem that causes the
seconds_since_last_reset value to be incorrect if jiffies has overrun
since the 'boot_time' value was recorded.

Signed-off-by: Arnd Bergmann 
Reviewed-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

libfc: Update rport reference counting

2016-07-13T03:16:31+00:00

Originally libfc would just be initializing the refcount to '1', and
using the disc_mutex to synchronize if and when the final put should be
happening.  This has a race condition as the mutex might be delayed,
causing other threads to access an invalid structure.  This patch
updates the rport reference counting to increase the reference every
time 'rport_lookup' is called, and decreases the reference
correspondingly.  This removes the need to hold 'disc_mutex' when
removing the structure, and avoids the above race condition.

Signed-off-by: Hannes Reinecke 
Acked-by: Vasu Dev 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen