Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2c68bb33 authored by Arun Easi's avatar Arun Easi Committed by Greg Kroah-Hartman
Browse files

scsi: qla2xxx: Fix crash during driver load on big endian machines 

commit 8de309e7299a00b3045fb274f82b326f356404f0 upstream

Crash stack:
	[576544.715489] Unable to handle kernel paging request for data at address 0xd00000000f970000
	[576544.715497] Faulting instruction address: 0xd00000000f880f64
	[576544.715503] Oops: Kernel access of bad area, sig: 11 [#1]
	[576544.715506] SMP NR_CPUS=2048 NUMA pSeries
	:
	[576544.715703] NIP [d00000000f880f64] .qla27xx_fwdt_template_valid+0x94/0x100 [qla2xxx]
	[576544.715722] LR [d00000000f7952dc] .qla24xx_load_risc_flash+0x2fc/0x590 [qla2xxx]
	[576544.715726] Call Trace:
	[576544.715731] [c0000004d0ffb000] [c0000006fe02c350] 0xc0000006fe02c350 (unreliable)
	[576544.715750] [c0000004d0ffb080] [d00000000f7952dc] .qla24xx_load_risc_flash+0x2fc/0x590 [qla2xxx]
	[576544.715770] [c0000004d0ffb170] [d00000000f7aa034] .qla81xx_load_risc+0x84/0x1a0 [qla2xxx]
	[576544.715789] [c0000004d0ffb210] [d00000000f79f7c8] .qla2x00_setup_chip+0xc8/0x910 [qla2xxx]
	[576544.715808] [c0000004d0ffb300] [d00000000f7a631c] .qla2x00_initialize_adapter+0x4dc/0xb00 [qla2xxx]
	[576544.715826] [c0000004d0ffb3e0] [d00000000f78ce28] .qla2x00_probe_one+0xf08/0x2200 [qla2xxx]

Link: https://lore.kernel.org/r/20201202132312.19966-8-njavali@marvell.com


Fixes: f73cb695 ("[SCSI] qla2xxx: Add support for ISP2071.")
Cc: stable@vger.kernel.org
Reviewed-by: default avatarHimanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: default avatarArun Easi <aeasi@marvell.com>
Signed-off-by: default avatarNilesh Javali <njavali@marvell.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
[sudip: adjust context]
Signed-off-by: default avatarSudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 98f16e17

drivers/scsi/qla2xxx/qla_tmpl.c

+5 −4
Original line number Original line Diff line number Diff line
@@ -940,7 +940,8 @@ qla27xx_template_checksum(void *p, ulong size) 
static inline int

static inline int

qla27xx_verify_template_checksum(struct qla27xx_fwdt_template *tmp)

qla27xx_verify_template_checksum(struct qla27xx_fwdt_template *tmp)

{

{

	return qla27xx_template_checksum(tmp, tmp->template_size) == 0;

	return qla27xx_template_checksum(tmp,

		le32_to_cpu(tmp->template_size)) == 0;

}

}





static inline int

static inline int
@@ -956,7 +957,7 @@ qla27xx_execute_fwdt_template(struct scsi_qla_host *vha) 
	ulong len;

	ulong len;





	if (qla27xx_fwdt_template_valid(tmp)) {

	if (qla27xx_fwdt_template_valid(tmp)) {

		len = tmp->template_size;

		len = le32_to_cpu(tmp->template_size);

		tmp = memcpy(vha->hw->fw_dump, tmp, len);

		tmp = memcpy(vha->hw->fw_dump, tmp, len);

		ql27xx_edit_template(vha, tmp);

		ql27xx_edit_template(vha, tmp);

		qla27xx_walk_template(vha, tmp, tmp, &len);

		qla27xx_walk_template(vha, tmp, tmp, &len);
@@ -972,7 +973,7 @@ qla27xx_fwdt_calculate_dump_size(struct scsi_qla_host *vha) 
	ulong len = 0;

	ulong len = 0;





	if (qla27xx_fwdt_template_valid(tmp)) {

	if (qla27xx_fwdt_template_valid(tmp)) {

		len = tmp->template_size;

		len = le32_to_cpu(tmp->template_size);

		qla27xx_walk_template(vha, tmp, NULL, &len);

		qla27xx_walk_template(vha, tmp, NULL, &len);

	}

	}
@@ -984,7 +985,7 @@ qla27xx_fwdt_template_size(void *p) 
{

{

	struct qla27xx_fwdt_template *tmp = p;

	struct qla27xx_fwdt_template *tmp = p;





	return tmp->template_size;

	return le32_to_cpu(tmp->template_size);

}

}





ulong

ulong

drivers/scsi/qla2xxx/qla_tmpl.h

+1 −1
Original line number Original line Diff line number Diff line
@@ -13,7 +13,7 @@ 
struct __packed qla27xx_fwdt_template {

struct __packed qla27xx_fwdt_template {

	uint32_t template_type;

	uint32_t template_type;

	uint32_t entry_offset;

	uint32_t entry_offset;

	uint32_t template_size;

	__le32 template_size;

	uint32_t reserved_1;

	uint32_t reserved_1;





	uint32_t entry_count;

	uint32_t entry_count;