Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6d697650 authored by Dick Kennedy's avatar Dick Kennedy Committed by Greg Kroah-Hartman
Browse files

scsi: lpfc: fix pci hot plug crash in list_add call 



commit 401bb4169da655f3e5d28d0b208182e1ab60bf2a upstream.

During pci hot plug, the kernel crashes in a list_add_call

The lookup by tag function will return null if the IOCB is out of range
or does not have the on txcmplq flag set.

Fix: Check for null return from lookup by tag.

Signed-off-by: default avatarDick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: default avatarJames Smart <james.smart@broadcom.com>
Reviewed-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 890d9fcd

drivers/scsi/lpfc/lpfc_sli.c

+10 −7
Original line number Diff line number Diff line
@@ -12507,19 +12507,21 @@ lpfc_sli4_els_wcqe_to_rspiocbq(struct lpfc_hba *phba, 
	/* Look up the ELS command IOCB and create pseudo response IOCB */

	cmdiocbq = lpfc_sli_iocbq_lookup_by_tag(phba, pring,

				bf_get(lpfc_wcqe_c_request_tag, wcqe));

	/* Put the iocb back on the txcmplq */

	lpfc_sli_ringtxcmpl_put(phba, pring, cmdiocbq);

	spin_unlock_irqrestore(&pring->ring_lock, iflags);















	if (unlikely(!cmdiocbq)) {













		spin_unlock_irqrestore(&pring->ring_lock, iflags);















		lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,















				"0386 ELS complete with no corresponding "













				"cmdiocb: iotag (%d)\n",













				bf_get(lpfc_wcqe_c_request_tag, wcqe));













				"cmdiocb: 0x%x 0x%x 0x%x 0x%x\n",













				wcqe->word0, wcqe->total_data_placed,













				wcqe->parameter, wcqe->word3);















		lpfc_sli_release_iocbq(phba, irspiocbq);















		return NULL;















	}



























	/* Put the iocb back on the txcmplq */













	lpfc_sli_ringtxcmpl_put(phba, pring, cmdiocbq);













	spin_unlock_irqrestore(&pring->ring_lock, iflags);



























	/* Fake the irspiocbq and copy necessary response information */















	lpfc_sli4_iocb_param_transfer(phba, irspiocbq, cmdiocbq, wcqe);
























@@ -17137,6 +17139,7 @@ lpfc_sli4_handle_mds_loopback(struct lpfc_vport *vport,













	if (pcmd && pcmd->virt)















		dma_pool_free(phba->lpfc_drb_pool, pcmd->virt, pcmd->phys);















	kfree(pcmd);













	if (iocbq)















		lpfc_sli_release_iocbq(phba, iocbq);















	lpfc_in_buf_free(phba, &dmabuf->dbuf);















}