scsi: lpfc: Fix kernel Oops due to null pring pointers

[ Upstream commit 5a9eeff57f340238c39c95d8e7e54c96fc722de7 ]

Driver is hitting null pring pointers in lpfc_do_work().

Pointer assignment occurs based on SLI-revision. If recovering after an
error, its possible the sli revision for the port was cleared, making the
lpfc_phba_elsring() not return a ring pointer, thus the null pointer.

Add SLI revision checking to lpfc_phba_elsring() and status checking to all
callers.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index bc61cc8bc6f0227dfb37af5bb23a279c96e19e8f..03e95a3216c8ca43677139fc9159c6174ec74184 100644 (file)
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -1239,6 +1239,12 @@ lpfc_sli_read_hs(struct lpfc_hba *phba)
 static inline struct lpfc_sli_ring *
 lpfc_phba_elsring(struct lpfc_hba *phba)
 {
+       /* Return NULL if sli_rev has become invalid due to bad fw */
+       if (phba->sli_rev != LPFC_SLI_REV4  &&
+           phba->sli_rev != LPFC_SLI_REV3  &&
+           phba->sli_rev != LPFC_SLI_REV2)
+               return NULL;
+
        if (phba->sli_rev == LPFC_SLI_REV4) {
                if (phba->sli4_hba.els_wq)
                        return phba->sli4_hba.els_wq->pring;

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index e5db20e8979d59415da939300fc0e87bf9bd5075..a31f87eb1e62187af973f2973b092f6964f776ac 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -1337,6 +1337,8 @@ lpfc_els_abort_flogi(struct lpfc_hba *phba)
                        Fabric_DID);
 
        pring = lpfc_phba_elsring(phba);
+       if (unlikely(!pring))
+               return -EIO;
 
        /*
         * Check the txcmplq for an iocb that matches the nport the driver is

diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 15bcd00dd7a23b906ae6995cc92b74b92b058042..c69c2a2b2eadf65aacba36f1e2c7c532720d8a4d 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -1773,7 +1773,12 @@ lpfc_sli4_port_sta_fn_reset(struct lpfc_hba *phba, int mbx_action,
        lpfc_offline(phba);
        /* release interrupt for possible resource change */
        lpfc_sli4_disable_intr(phba);
-       lpfc_sli_brdrestart(phba);
+       rc = lpfc_sli_brdrestart(phba);
+       if (rc) {
+               lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                               "6309 Failed to restart board\n");
+               return rc;
+       }
        /* request and enable interrupt */
        intr_mode = lpfc_sli4_enable_intr(phba, phba->intr_mode);
        if (intr_mode == LPFC_INTR_ERROR) {

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index ebf7d3cda36772f3e67d0ab19652fa79c6ededf4..62bea4ffdc25a1456e137612864cdbd370eb8e21 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -4421,6 +4421,8 @@ lpfc_sli_brdrestart_s4(struct lpfc_hba *phba)
        hba_aer_enabled = phba->hba_flag & HBA_AER_ENABLED;
 
        rc = lpfc_sli4_brdreset(phba);
+       if (rc)
+               return rc;
 
        spin_lock_irq(&phba->hbalock);
        phba->pport->stopped = 0;