linux.git/drivers/scsi/lpfc, branch v6.6

scsi: lpfc: Prevent use-after-free during rmmod with mapped NVMe rports

2023-09-14T00:51:16+00:00

During rmmod, when dev_loss_tmo callback is called, an ndlp kref count is
decremented twice.  Once for SCSI transport registration and second to
remove the initial node allocation kref.  If there is also an NVMe
transport registration, another reference count decrement is expected in
lpfc_nvme_unregister_port().

Race conditions between the NVMe transport remoteport_delete and
dev_loss_tmo callbacks sometimes results in premature ndlp object release
resulting in use-after-free issues.

Fix by not dropping the ndlp object in dev_loss_tmo callback with an
outstanding NVMe transport registration.  Inversely, mark the final
NLP_DROPPED flag in lpfc_nvme_unregister_port when rmmod flag is set.

Signed-off-by: Justin Tee 
Link: https://lore.kernel.org/r/20230908211923.37603-1-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen

scsi: lpfc: Early return after marking final NLP_DROPPED flag in dev_loss_tmo

2023-09-14T00:49:34+00:00

When a dev_loss_tmo event occurs, an ndlp lock is taken before checking
nlp_flag for NLP_DROPPED.  There is an attempt to restore the ndlp lock
when exiting the if statement, but the nlp_put kref could be the final
decrement causing a use-after-free memory access on a released ndlp object.

Instead of trying to reacquire the ndlp lock after checking nlp_flag, just
return after calling nlp_put.

Signed-off-by: Justin Tee 
Link: https://lore.kernel.org/r/20230908211852.37576-1-justintee8345@gmail.com
Reviewed-by: "Ewan D. Milne" 
Signed-off-by: Martin K. Petersen

scsi: lpfc: Fix the NULL vs IS_ERR() bug for debugfs_create_file()

2023-09-14T00:48:36+00:00

Since debugfs_create_file() returns ERR_PTR and never NULL, use IS_ERR() to
check the return value.

Fixes: 2fcbc569b9f5 ("scsi: lpfc: Make debugfs ktime stats generic for NVME and SCSI")
Fixes: 4c47efc140fa ("scsi: lpfc: Move SCSI and NVME Stats to hardware queue structures")
Fixes: 6a828b0f6192 ("scsi: lpfc: Support non-uniform allocation of MSIX vectors to hardware queues")
Fixes: 95bfc6d8ad86 ("scsi: lpfc: Make FW logging dynamically configurable")
Fixes: 9f77870870d8 ("scsi: lpfc: Add debugfs support for cm framework buffers")
Fixes: c490850a0947 ("scsi: lpfc: Adapt partitioned XRI lists to efficient sharing")
Signed-off-by: Jinjie Ruan 
Link: https://lore.kernel.org/r/20230906030809.2847970-1-ruanjinjie@huawei.com
Reviewed-by: Justin Tee 
Signed-off-by: Martin K. Petersen

Merge branch 'fixes' into misc

2023-09-02T07:25:19+00:00

scsi: lpfc: Do not abuse UUID APIs and LPFC_COMPRESS_VMID_SIZE

2023-08-21T21:13:57+00:00

The lpfc_vmid_host_uuid is not defined as uuid_t and its usage is not the
same as for uuid_t operations (like exporting or importing).  Hence replace
call to uuid_is_null() by respective memchr_inv() without abusing casting.

With that, replace LPFC_COMPRESS_VMID_SIZE with plain number and respective
sizeof() to make code robust to changes in the future, if any.

Signed-off-by: Andy Shevchenko 
Link: https://lore.kernel.org/r/20230818155452.875781-1-andriy.shevchenko@linux.intel.com
Reviewed-by: Justin Tee 
Signed-off-by: Martin K. Petersen

scsi: lpfc: Remove reftag check in DIF paths

2023-08-08T01:34:08+00:00

When preparing protection DIF I/O for DMA, the driver obtains reference
tags from scsi_prot_ref_tag().  Previously, there was a wrong assumption
that an all 0xffffffff value meant error and thus the driver failed the
I/O.  This patch removes the evaluation code and accepts whatever the upper
layer returns.

Signed-off-by: Justin Tee 
Link: https://lore.kernel.org/r/20230803211932.155745-1-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen

scsi: lpfc: Modify when a node should be put in device recovery mode during RSCN

2023-08-08T01:25:47+00:00

Only nodes whose state is at least past a PLOGI issue and strictly less
than a PRLI issue should be put into device recovery mode upon RSCN
receipt.  Previously, the allowance of LOGO and PRLI completion states did
not make sense because those nodes should be allowed to flow through and
marked as NPort dissappeared as is normally done.  A follow up RSCN GID_FT
would recover those nodes in such cases.

Signed-off-by: Justin Tee 
Link: https://lore.kernel.org/r/20230804195546.157839-1-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen

scsi: lpfc: Copyright updates for 14.2.0.14 patches

2023-07-23T20:17:08+00:00

Update copyrights to 2023 for files modified in the 14.2.0.14 patch set.

Signed-off-by: Justin Tee 
Link: https://lore.kernel.org/r/20230712180522.112722-13-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen

scsi: lpfc: Update lpfc version to 14.2.0.14

2023-07-23T20:17:08+00:00

Update lpfc version to 14.2.0.14

Signed-off-by: Justin Tee 
Link: https://lore.kernel.org/r/20230712180522.112722-12-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen

scsi: lpfc: Clean up SLI-4 sysfs resource reporting

2023-07-23T20:17:08+00:00

Currently, we have dated logic to work around the differences between SLI-4
and SLI-3 resource reporting through sysfs.

Leave the SLI-3 path untouched, but for SLI4 path, retrieve resource values
from the phba->sli4_hba->max_cfg_param structure.  Max values are populated
during ACQE events right after READ_CONFIG mbox cmd is sent.  Instead of
the dated subtraction logic, used resource calculation is directly fed into
sysfs for display.

Signed-off-by: Justin Tee 
Link: https://lore.kernel.org/r/20230712180522.112722-11-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen