himanshu.madhani@cavium.com 1514839b36 scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS ... This patch fixes NULL pointer crash due to active timer running for abort IOCB. From crash dump analysis it was discoverd that get_next_timer_interrupt() encountered a corrupted entry on the timer list. #9 [ffff95e1f6f0fd40] page_fault at ffffffff914fe8f8 [exception RIP: get_next_timer_interrupt+440] RIP: ffffffff90ea3088 RSP: ffff95e1f6f0fdf0 RFLAGS: 00010013 RAX: ffff95e1f6451028 RBX: 000218e2389e5f40 RCX: 00000001232ad600 RDX: 0000000000000001 RSI: ffff95e1f6f0fdf0 RDI: 0000000001232ad6 RBP: ffff95e1f6f0fe40 R8: ffff95e1f6451188 R9: 0000000000000001 R10: 0000000000000016 R11: 0000000000000016 R12: 00000001232ad5f6 R13: ffff95e1f6450000 R14: ffff95e1f6f0fdf8 R15: ffff95e1f6f0fe10 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 Looking at the assembly of get_next_timer_interrupt(), address came from %r8 (ffff95e1f6451188) which is pointing to list_head with single entry at ffff95e5ff621178. 0xffffffff90ea307a <get_next_timer_interrupt+426>: mov (%r8),%rdx 0xffffffff90ea307d <get_next_timer_interrupt+429>: cmp %r8,%rdx 0xffffffff90ea3080 <get_next_timer_interrupt+432>: je 0xffffffff90ea30a7 <get_next_timer_interrupt+471> 0xffffffff90ea3082 <get_next_timer_interrupt+434>: nopw 0x0(%rax,%rax,1) 0xffffffff90ea3088 <get_next_timer_interrupt+440>: testb $0x1,0x18(%rdx) crash> rd ffff95e1f6451188 10 ffff95e1f6451188: ffff95e5ff621178 ffff95e5ff621178 x.b.....x.b..... ffff95e1f6451198: ffff95e1f6451198 ffff95e1f6451198 ..E.......E..... ffff95e1f64511a8: ffff95e1f64511a8 ffff95e1f64511a8 ..E.......E..... ffff95e1f64511b8: ffff95e77cf509a0 ffff95e77cf509a0 ...|.......|.... ffff95e1f64511c8: ffff95e1f64511c8 ffff95e1f64511c8 ..E.......E..... crash> rd ffff95e5ff621178 10 ffff95e5ff621178: 0000000000000001 ffff95e15936aa00 ..........6Y.... ffff95e5ff621188: 0000000000000000 00000000ffffffff ................ ffff95e5ff621198: 00000000000000a0 0000000000000010 ................ ffff95e5ff6211a8: ffff95e5ff621198 000000000000000c ..b............. ffff95e5ff6211b8: 00000f5800000000 ffff95e751f8d720 ....X... ..Q.... ffff95e5ff621178 belongs to freed mempool object at ffff95e5ff621080. CACHE NAME OBJSIZE ALLOCATED TOTAL SLABS SSIZE ffff95dc7fd74d00 mnt_cache 384 19785 24948 594 16k SLAB MEMORY NODE TOTAL ALLOCATED FREE ffffdc5dabfd8800 ffff95e5ff620000 1 42 29 13 FREE / [ALLOCATED] ffff95e5ff621080 (cpu 6 cache) Examining the contents of that memory reveals a pointer to a constant string in the driver, "abort\0", which is set by qla24xx_async_abort_cmd(). crash> rd ffffffffc059277c 20 ffffffffc059277c: 6e490074726f6261 0074707572726574 abort.Interrupt. ffffffffc059278c: 00676e696c6c6f50 6920726576697244 Polling.Driver i ffffffffc059279c: 646f6d207325206e 6974736554000a65 n %s mode..Testi ffffffffc05927ac: 636976656420676e 786c252074612065 ng device at %lx ffffffffc05927bc: 6b63656843000a2e 646f727020676e69 ...Checking prod ffffffffc05927cc: 6f20444920746375 0a2e706968632066 uct ID of chip.. ffffffffc05927dc: 5120646e756f4600 204130303232414c .Found QLA2200A ffffffffc05927ec: 43000a2e70696843 20676e696b636568 Chip...Checking ffffffffc05927fc: 65786f626c69616d 6c636e69000a2e73 mailboxes...incl ffffffffc059280c: 756e696c2f656475 616d2d616d642f78 ude/linux/dma-ma crash> struct -ox srb_iocb struct srb_iocb { union { struct {...} logio; struct {...} els_logo; struct {...} tmf; struct {...} fxiocb; struct {...} abt; struct ct_arg ctarg; struct {...} mbx; struct {...} nack; [0x0 ] } u; [0xb8] struct timer_list timer; [0x108] void (*timeout)(void *); } SIZE: 0x110 crash> ! bc ibase=16 obase=10 B8+40 F8 The object is a srb_t, and at offset 0xf8 within that structure (i.e. ffff95e5ff621080 + f8 -> ffff95e5ff621178) is a struct timer_list. Cc: <stable@vger.kernel.org> #4.4+ Fixes: 4440e46d5d ("[SCSI] qla2xxx: Add IOCB Abort command asynchronous handling.") Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com> Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>		2018-03-01 20:16:33 -05:00
..
accessibility
acpi	ACPI fix for v4.15-rc1	2017-11-17 14:51:24 -08:00
amba	A couple of dma-mapping updates:	2017-11-14 16:54:12 -08:00
android	Char/Misc patches for 4.15-rc1	2017-11-16 09:10:59 -08:00
ata	Merge branch 'for-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata	2017-11-15 14:11:41 -08:00
atm	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
auxdisplay	Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-13 17:56:58 -08:00
base	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
bcma	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
block	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
bluetooth
bus	ARM: SoC driver updates for v4.15	2017-11-16 16:05:01 -08:00
cdrom	Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block	2017-11-14 15:32:19 -08:00
char	Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-26 14:11:54 -08:00
clk	We have two changes to the core framework this time around. The first being a	2017-11-17 20:04:24 -08:00
clocksource	- final batch of "non trivial" timer conversions (multi-tree dependencies,	2017-11-23 16:29:05 +01:00
connector
cpufreq	Power management updates for v4.15-rc1	2017-11-13 19:43:50 -08:00
cpuidle	powerpc updates for 4.15	2017-11-16 12:47:46 -08:00
crypto	powerpc updates for 4.15	2017-11-16 12:47:46 -08:00
dax	libnvdimm for 4.15	2017-11-17 09:51:57 -08:00
dca
devfreq	Merge branches 'pm-devfreq' and 'pm-tools'	2017-11-13 01:41:39 +01:00
dio
dma	dmaengine updates for 4.15-rc1	2017-11-14 16:49:31 -08:00
dma-buf	Tracing updates for 4.15:	2017-11-17 14:58:01 -08:00
edac	Modules updates for v4.15	2017-11-15 13:46:33 -08:00
eisa
extcon	USB/PHY patches for 4.15-rc1	2017-11-13 21:14:07 -08:00
firewire	Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-13 17:56:58 -08:00
firmware	drivers/firmware: psci: Convert timers to use timer_setup()	2017-11-21 15:46:44 -08:00
fmc
fpga	Char/Misc patches for 4.15-rc1	2017-11-16 09:10:59 -08:00
fsi
gpio	This is the bulk of pin control changes for the v4.15	2017-11-16 10:57:11 -08:00
gpu	Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-25 08:37:16 -10:00
hid	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
hsi	HSI changes for the v4.15 series	2017-11-15 13:35:43 -08:00
hv	Char/Misc patches for 4.15-rc1	2017-11-16 09:10:59 -08:00
hwmon	hwmon: (w83793) Remove duplicate NULL check	2017-11-16 01:03:19 -08:00
hwspinlock	hwspinlock update for v4.15	2017-11-17 20:16:20 -08:00
hwtracing	Char/Misc patches for 4.15-rc1	2017-11-16 09:10:59 -08:00
i2c	Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2017-11-17 11:54:55 -08:00
ide	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide	2017-11-19 08:04:41 -10:00
idle	Merge branch 'pm-cpuidle'	2017-11-13 01:34:14 +01:00
iio	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
infiniband	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
input	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
iommu	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
ipack
irqchip	Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-26 14:39:20 -08:00
isdn	treewide: setup_timer() -> timer_setup() (2 field)	2017-11-21 15:57:09 -08:00
leds	LED updates for 4.15rc1	2017-11-14 18:09:31 -08:00
lightnvm	lightnvm: Convert timers to use timer_setup()	2017-11-21 15:46:44 -08:00
macintosh	Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-13 17:56:58 -08:00
mailbox	Change to POLL api and fixes for FlexRM and OMAP driver	2017-11-15 13:39:18 -08:00
mcb
md	Merge branch 'for-linus' of git://git.kernel.dk/linux-block	2017-11-17 10:56:56 -08:00
media	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
memory	ARM: SoC driver updates for v4.15	2017-11-16 16:05:01 -08:00
memstick	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
message	scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()	2018-01-30 21:32:06 -05:00
mfd	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
misc	lkdtm: include WARN format string	2017-11-17 16:10:01 -08:00
mmc	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
mtd	Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-25 08:37:16 -10:00
mux
net	Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-25 08:37:16 -10:00
nfc	treewide: setup_timer() -> timer_setup() (2 field)	2017-11-21 15:57:09 -08:00
ntb	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
nubus	m68k updates for 4.15	2017-11-13 12:10:24 -08:00
nvdimm	libnvdimm for 4.15	2017-11-17 09:51:57 -08:00
nvme	nvmet_fc: fix better length checking	2017-11-16 11:27:04 -07:00
nvmem	Char/Misc patches for 4.15-rc1	2017-11-16 09:10:59 -08:00
of	DeviceTree fixes for 4.15:	2017-11-20 21:38:41 -10:00
opp
oprofile
parisc
parport	Char/Misc patches for 4.15-rc1	2017-11-16 09:10:59 -08:00
pci	Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-26 14:11:54 -08:00
pcmcia	drivers/pcmcia/sa1111_badge4.c: avoid unused function warning	2017-11-17 16:10:04 -08:00
perf	arm64 updates for 4.15	2017-11-15 10:56:56 -08:00
phy	USB/PHY patches for 4.15-rc1	2017-11-13 21:14:07 -08:00
pinctrl	This is the bulk of pin control changes for the v4.15	2017-11-16 10:57:11 -08:00
platform	Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-25 08:37:16 -10:00
pnp
power	power supply and reset changes for the v4.15 series	2017-11-15 13:37:15 -08:00
powercap
pps	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
ps3
ptp	xen: features and fixes for v4.15-rc1	2017-11-16 13:06:27 -08:00
pwm	pwm: Changes for v4.15-rc1	2017-11-22 21:09:18 -10:00
rapidio	Merge branch 'akpm' (patches from Andrew)	2017-11-17 16:56:17 -08:00
ras	Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-13 17:56:58 -08:00
regulator	- New Drivers	2017-11-16 09:15:57 -08:00
remoteproc	remoteproc updates for v4.15	2017-11-17 20:14:10 -08:00
reset	ARM: SoC driver updates for v4.15	2017-11-16 16:05:01 -08:00
rpmsg	rpmsg updates for v4.15	2017-11-17 20:12:08 -08:00
rtc	Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-25 08:37:16 -10:00
s390	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
sbus	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc	2017-11-17 20:21:44 -08:00
scsi	scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS	2018-03-01 20:16:33 -05:00
sfi
sh	A couple of dma-mapping updates:	2017-11-14 16:54:12 -08:00
sn
soc	ARM: SoC driver updates for v4.15	2017-11-16 16:05:01 -08:00
spi
spmi
ssb
staging	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
target	Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-25 08:37:16 -10:00
tc
tee
thermal	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux	2017-11-17 14:31:27 -08:00
thunderbolt	Char/Misc patches for 4.15-rc1	2017-11-16 09:10:59 -08:00
tty	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
uio
usb	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
uwb	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
vfio	VFIO Updates for Linux v4.15	2017-11-14 16:47:47 -08:00
vhost	Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2017-11-17 12:08:18 -08:00
video	fbdev changes for v4.15:	2017-11-20 21:50:24 -10:00
virt
virtio	virtio_balloon: fix deadlock on OOM	2017-11-14 23:57:38 +02:00
vlynq
vme	Char/Misc patches for 4.15-rc1	2017-11-16 09:10:59 -08:00
w1	Char/Misc patches for 4.15-rc1	2017-11-16 09:10:59 -08:00
watchdog	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
xen	treewide: Switch DEFINE_TIMER callbacks to struct timer_list *	2017-11-21 15:57:05 -08:00
zorro
Kconfig	Merge branches 'pm-cpufreq-sched' and 'pm-opp'	2017-11-13 01:40:52 +01:00
Makefile	Merge branches 'pm-cpufreq-sched' and 'pm-opp'	2017-11-13 01:40:52 +01:00