linux-kernel - Re: [EXT] [PATCH v3 0/4] qla2xxx: A couple crash fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LRH.2.21.9999.2009091537040.28578@irv1user01.caveonetworks.com>
Date:   Wed, 9 Sep 2020 15:38:05 -0700
From:   Arun Easi <aeasi@...vell.com>
To:     Daniel Wagner <dwagner@...e.de>
CC:     <linux-scsi@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        "Nilesh Javali" <njavali@...vell.com>,
        Martin Wilck <mwilck@...e.com>
Subject: Re: [EXT] [PATCH v3 0/4] qla2xxx: A couple crash fixes

Looks good. Thanks Daniel.

For the series:
  Reviewed-by: Arun Easi <aeasi@...vell.com>

Regards,
-Arun

On Tue, 8 Sep 2020, 1:15am, Daniel Wagner wrote:

> External Email
> 
> ----------------------------------------------------------------------
> The first crash we observed is due memory corruption in the srb memory
> pool. Unforuntatly, I couldn't find the source of the problem but the
> workaround by resetting the cleanup callbacks 'fixes' this problem
> (patch #1). I think as intermeditate step this should be merged until
> the real cause can be identified.
> 
> The second crash is due a race condition(?) in the firmware. The sts
> entries are not updated in time which leads to this crash pattern
> which several customers have reported:
> 
>  #0 [c00000ffffd1bb80] scsi_dma_unmap at d00000001e4904d4 [scsi_mod]
>  #1 [c00000ffffd1bbe0] qla2x00_sp_compl at d0000000204803cc [qla2xxx]
>  #2 [c00000ffffd1bc20] qla24xx_process_response_queue at d0000000204c5810 [qla2xxx]
>  #3 [c00000ffffd1bd50] qla24xx_msix_rsp_q at d0000000204c8fd8 [qla2xxx]
>  #4 [c00000ffffd1bde0] __handle_irq_event_percpu at c000000000189510
>  #5 [c00000ffffd1bea0] handle_irq_event_percpu at c00000000018978c
>  #6 [c00000ffffd1bee0] handle_irq_event at c00000000018984c
>  #7 [c00000ffffd1bf10] handle_fasteoi_irq at c00000000018efc0
>  #8 [c00000ffffd1bf40] generic_handle_irq at c000000000187f10
>  #9 [c00000ffffd1bf60] __do_irq at c000000000018784
>  #10 [c00000ffffd1bf90] call_do_irq at c00000000002caa4
>  #11 [c00000ecca417a00] do_IRQ at c000000000018970
>  #12 [c00000ecca417a50] restore_check_irq_replay at c00000000000de98
> 
> From analyzing the crash dump it was clear that
> qla24xx_mbx_iocb_entry() calls sp->done (qla2x00_sp_compl) which
> crashes because the response is not a mailbox entry, it is a status
> entry. Patch #4 changes the process logic for mailbox commands so that
> the sp is parsed before calling the correct proccess function.
> 
> 
> changes since v1:
>  - addressed review comments by Martin
>    - patch#1: added dummy warn function
>    - patch#4: added log entry
> 
> changes since v2:
>  - added reviewed tags by Martin
>  - addressed review comments by Arun
>    - patch#1: add srb pointer to log message
>    - patch#3: print calling func name in qla2x00_get_sp_from_handle()
>    - patch#4: dropped comment, reset HBA
> 
> 
> Daniel Wagner (4):
>   qla2xxx: Warn if done() or free() are called on an already freed srb
>   qla2xxx: Simplify return value logic in qla2x00_get_sp_from_handle()
>   qla2xxx: Log calling function name in qla2x00_get_sp_from_handle()
>   qla2xxx: Handle incorrect entry_type entries
> 
>  drivers/scsi/qla2xxx/qla_init.c   | 10 +++++++++
>  drivers/scsi/qla2xxx/qla_inline.h |  5 +++++
>  drivers/scsi/qla2xxx/qla_isr.c    | 47 ++++++++++++++++++++++++++++++---------
>  3 files changed, 51 insertions(+), 11 deletions(-)
> 
>