Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 008549f6 authored by Calvin Owens's avatar Calvin Owens Committed by James Bottomley
Browse files

mpt2sas: Refcount fw_events and fix unsafe list usage 



The fw_event_work struct is concurrently referenced at shutdown, so
add a refcount to protect it, and refactor the code to use it.

Additionally, refactor _scsih_fw_event_cleanup_queue() such that it
no longer iterates over the list without holding the lock, since
_firmware_event_work() concurrently deletes items from the list.

Signed-off-by: default avatarCalvin Owens <calvinowens@fb.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
Tested-by: default avatarChaitra Basappa <chaitra.basappa@avagotech.com>
Acked-by: default avatarSreekanth Reddy <sreekanth.reddy@avagotech.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Odin.com>
parent d224fe0d

drivers/scsi/mpt2sas/mpt2sas_scsih.c

+91 −21
Original line number Diff line number Diff line
@@ -176,9 +176,37 @@ struct fw_event_work { 
	u8			VP_ID;

	u8			ignore;

	u16			event;

	struct kref		refcount;

	char			event_data[0] __aligned(4);

};



static void fw_event_work_free(struct kref *r)

{

	kfree(container_of(r, struct fw_event_work, refcount));

}



static void fw_event_work_get(struct fw_event_work *fw_work)

{

	kref_get(&fw_work->refcount);

}



static void fw_event_work_put(struct fw_event_work *fw_work)

{

	kref_put(&fw_work->refcount, fw_event_work_free);

}



static struct fw_event_work *alloc_fw_event_work(int len)

{

	struct fw_event_work *fw_event;



	fw_event = kzalloc(sizeof(*fw_event) + len, GFP_ATOMIC);

	if (!fw_event)

		return NULL;



	kref_init(&fw_event->refcount);

	return fw_event;

}



/* raid transport support */

static struct raid_template *mpt2sas_raid_template;
@@ -2872,36 +2900,39 @@ _scsih_fw_event_add(struct MPT2SAS_ADAPTER *ioc, struct fw_event_work *fw_event) 
		return;



	spin_lock_irqsave(&ioc->fw_event_lock, flags);

	fw_event_work_get(fw_event);

	list_add_tail(&fw_event->list, &ioc->fw_event_list);

	INIT_DELAYED_WORK(&fw_event->delayed_work, _firmware_event_work);

	fw_event_work_get(fw_event);

	queue_delayed_work(ioc->firmware_event_thread,

	    &fw_event->delayed_work, 0);

	spin_unlock_irqrestore(&ioc->fw_event_lock, flags);

}



/**

 * _scsih_fw_event_free - delete fw_event

 * _scsih_fw_event_del_from_list - delete fw_event from the list

 * @ioc: per adapter object

 * @fw_event: object describing the event

 * Context: This function will acquire ioc->fw_event_lock.

 *

 * This removes firmware event object from link list, frees associated memory.

 * If the fw_event is on the fw_event_list, remove it and do a put.

 *

 * Return nothing.

 */

static void

_scsih_fw_event_free(struct MPT2SAS_ADAPTER *ioc, struct fw_event_work

_scsih_fw_event_del_from_list(struct MPT2SAS_ADAPTER *ioc, struct fw_event_work

    *fw_event)

{

	unsigned long flags;



	spin_lock_irqsave(&ioc->fw_event_lock, flags);

	list_del(&fw_event->list);

	kfree(fw_event);

	if (!list_empty(&fw_event->list)) {

		list_del_init(&fw_event->list);

		fw_event_work_put(fw_event);

	}

	spin_unlock_irqrestore(&ioc->fw_event_lock, flags);

}





/**

 * _scsih_error_recovery_delete_devices - remove devices not responding

 * @ioc: per adapter object
@@ -2916,13 +2947,14 @@ _scsih_error_recovery_delete_devices(struct MPT2SAS_ADAPTER *ioc) 
	if (ioc->is_driver_loading)

		return;



	fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC);

	fw_event = alloc_fw_event_work(0);

	if (!fw_event)

		return;



	fw_event->event = MPT2SAS_REMOVE_UNRESPONDING_DEVICES;

	fw_event->ioc = ioc;

	_scsih_fw_event_add(ioc, fw_event);

	fw_event_work_put(fw_event);

}



/**
@@ -2936,12 +2968,29 @@ mpt2sas_port_enable_complete(struct MPT2SAS_ADAPTER *ioc) 
{

	struct fw_event_work *fw_event;



	fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC);

	fw_event = alloc_fw_event_work(0);

	if (!fw_event)

		return;

	fw_event->event = MPT2SAS_PORT_ENABLE_COMPLETE;

	fw_event->ioc = ioc;

	_scsih_fw_event_add(ioc, fw_event);

	fw_event_work_put(fw_event);

}



static struct fw_event_work *dequeue_next_fw_event(struct MPT2SAS_ADAPTER *ioc)

{

	unsigned long flags;

	struct fw_event_work *fw_event = NULL;



	spin_lock_irqsave(&ioc->fw_event_lock, flags);

	if (!list_empty(&ioc->fw_event_list)) {

		fw_event = list_first_entry(&ioc->fw_event_list,

				struct fw_event_work, list);

		list_del_init(&fw_event->list);

	}

	spin_unlock_irqrestore(&ioc->fw_event_lock, flags);



	return fw_event;

}



/**
@@ -2956,17 +3005,25 @@ mpt2sas_port_enable_complete(struct MPT2SAS_ADAPTER *ioc) 
static void

_scsih_fw_event_cleanup_queue(struct MPT2SAS_ADAPTER *ioc)

{

	struct fw_event_work *fw_event, *next;

	struct fw_event_work *fw_event;



	if (list_empty(&ioc->fw_event_list) ||

	     !ioc->firmware_event_thread || in_interrupt())

		return;



	list_for_each_entry_safe(fw_event, next, &ioc->fw_event_list, list) {

		if (cancel_delayed_work_sync(&fw_event->delayed_work)) {

			_scsih_fw_event_free(ioc, fw_event);

			continue;

		}

	while ((fw_event = dequeue_next_fw_event(ioc))) {

		/*

		 * Wait on the fw_event to complete. If this returns 1, then

		 * the event was never executed, and we need a put for the

		 * reference the delayed_work had on the fw_event.

		 *

		 * If it did execute, we wait for it to finish, and the put will

		 * happen from _firmware_event_work()

		 */

		if (cancel_delayed_work_sync(&fw_event->delayed_work))

			fw_event_work_put(fw_event);



		fw_event_work_put(fw_event);

	}

}
@@ -4447,13 +4504,14 @@ _scsih_send_event_to_turn_on_pfa_led(struct MPT2SAS_ADAPTER *ioc, u16 handle) 
{

	struct fw_event_work *fw_event;



	fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC);

	fw_event = alloc_fw_event_work(0);

	if (!fw_event)

		return;

	fw_event->event = MPT2SAS_TURN_ON_PFA_LED;

	fw_event->device_handle = handle;

	fw_event->ioc = ioc;

	_scsih_fw_event_add(ioc, fw_event);

	fw_event_work_put(fw_event);

}



/**
@@ -7554,17 +7612,27 @@ _firmware_event_work(struct work_struct *work) 
	    struct fw_event_work, delayed_work.work);

	struct MPT2SAS_ADAPTER *ioc = fw_event->ioc;



	_scsih_fw_event_del_from_list(ioc, fw_event);



	/* the queue is being flushed so ignore this event */

	if (ioc->remove_host ||

	    ioc->pci_error_recovery) {

		_scsih_fw_event_free(ioc, fw_event);

	if (ioc->remove_host || ioc->pci_error_recovery) {

		fw_event_work_put(fw_event);

		return;

	}



	switch (fw_event->event) {

	case MPT2SAS_REMOVE_UNRESPONDING_DEVICES:

		while (scsi_host_in_recovery(ioc->shost) || ioc->shost_recovery)

		while (scsi_host_in_recovery(ioc->shost) ||

				ioc->shost_recovery) {

			/*

			 * If we're unloading, bail. Otherwise, this can become

			 * an infinite loop.

			 */

			if (ioc->remove_host)

				goto out;



			ssleep(1);

		}

		_scsih_remove_unresponding_sas_devices(ioc);

		_scsih_scan_for_devices_after_reset(ioc);

		break;
@@ -7613,7 +7681,8 @@ _firmware_event_work(struct work_struct *work) 
		_scsih_sas_ir_operation_status_event(ioc, fw_event);

		break;

	}

	_scsih_fw_event_free(ioc, fw_event);

out:

	fw_event_work_put(fw_event);

}



/**
@@ -7751,7 +7820,7 @@ mpt2sas_scsih_event_callback(struct MPT2SAS_ADAPTER *ioc, u8 msix_index, 
	}



	sz = le16_to_cpu(mpi_reply->EventDataLength) * 4;

	fw_event = kzalloc(sizeof(*fw_event) + sz, GFP_ATOMIC);

	fw_event = alloc_fw_event_work(sz);

	if (!fw_event) {

		printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",

		    ioc->name, __FILE__, __LINE__, __func__);
@@ -7764,6 +7833,7 @@ mpt2sas_scsih_event_callback(struct MPT2SAS_ADAPTER *ioc, u8 msix_index, 
	fw_event->VP_ID = mpi_reply->VP_ID;

	fw_event->event = event;

	_scsih_fw_event_add(ioc, fw_event);

	fw_event_work_put(fw_event);

	return;

}