kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
linux-hardened/drivers/scsi/qla2xxx
History
Bruno Prémont 262e2bfd7d qla2xxx: Fix NULL pointer deref in QLA interrupt 
In qla24xx_process_response_queue() rsp->msix->cpuid may trigger NULL
pointer dereference when rsp->msix is NULL:

[    5.622457] NULL pointer dereference at 0000000000000050
[    5.622457] IP: [<ffffffff8155e614>] qla24xx_process_response_queue+0x44/0x4b0
[    5.622457] PGD 0
[    5.622457] Oops: 0000 [#1] SMP
[    5.622457] Modules linked in:
[    5.622457] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.6.3-x86_64 #1
[    5.622457] Hardware name: HP ProLiant DL360 G5, BIOS P58 05/02/2011
[    5.622457] task: ffff8801a88f3740 ti: ffff8801a8954000 task.ti: ffff8801a8954000
[    5.622457] RIP: 0010:[<ffffffff8155e614>]  [<ffffffff8155e614>] qla24xx_process_response_queue+0x44/0x4b0
[    5.622457] RSP: 0000:ffff8801afb03de8  EFLAGS: 00010002
[    5.622457] RAX: 0000000000000000 RBX: 0000000000000032 RCX: 00000000ffffffff
[    5.622457] RDX: 0000000000000002 RSI: ffff8801a79bf8c8 RDI: ffff8800c8f7e7c0
[    5.622457] RBP: ffff8801afb03e68 R08: 0000000000000000 R09: 0000000000000000
[    5.622457] R10: 00000000ffff8c47 R11: 0000000000000002 R12: ffff8801a79bf8c8
[    5.622457] R13: ffff8800c8f7e7c0 R14: ffff8800c8f60000 R15: 0000000000018013
[    5.622457] FS:  0000000000000000(0000) GS:ffff8801afb00000(0000) knlGS:0000000000000000
[    5.622457] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    5.622457] CR2: 0000000000000050 CR3: 0000000001e07000 CR4: 00000000000006e0
[    5.622457] Stack:
[    5.622457]  ffff8801afb03e30 ffffffff810c0f2d 0000000000000086 0000000000000002
[    5.622457]  ffff8801afb03e28 ffffffff816570e1 ffff8800c8994628 0000000000000002
[    5.622457]  ffff8801afb03e60 ffffffff816772d4 b47c472ad6955e68 0000000000000032
[    5.622457] Call Trace:
[    5.622457]  <IRQ>
[    5.622457]  [<ffffffff810c0f2d>] ? __wake_up_common+0x4d/0x80
[    5.622457]  [<ffffffff816570e1>] ? usb_hcd_resume_root_hub+0x51/0x60
[    5.622457]  [<ffffffff816772d4>] ? uhci_hub_status_data+0x64/0x240
[    5.622457]  [<ffffffff81560d00>] qla24xx_intr_handler+0xf0/0x2e0
[    5.622457]  [<ffffffff810d569e>] ? get_next_timer_interrupt+0xce/0x200
[    5.622457]  [<ffffffff810c89b4>] handle_irq_event_percpu+0x64/0x100
[    5.622457]  [<ffffffff810c8a77>] handle_irq_event+0x27/0x50
[    5.622457]  [<ffffffff810cb965>] handle_edge_irq+0x65/0x140
[    5.622457]  [<ffffffff8101a498>] handle_irq+0x18/0x30
[    5.622457]  [<ffffffff8101a276>] do_IRQ+0x46/0xd0
[    5.622457]  [<ffffffff817f8fff>] common_interrupt+0x7f/0x7f
[    5.622457]  <EOI>
[    5.622457]  [<ffffffff81020d38>] ? mwait_idle+0x68/0x80
[    5.622457]  [<ffffffff8102114a>] arch_cpu_idle+0xa/0x10
[    5.622457]  [<ffffffff810c1b97>] default_idle_call+0x27/0x30
[    5.622457]  [<ffffffff810c1d3b>] cpu_startup_entry+0x19b/0x230
[    5.622457]  [<ffffffff810324c6>] start_secondary+0x136/0x140
[    5.622457] Code: 00 00 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 48 8b 47 58 a8 02 0f 84 c5 00 00 00 48 8b 46 50 49 89 f4 65 8b 15 34 bb aa 7e <39> 50 50 74 11 89 50 50 48 8b 46 50 8b 40 50 41 89 86 60 8b 00
[    5.622457] RIP  [<ffffffff8155e614>] qla24xx_process_response_queue+0x44/0x4b0
[    5.622457]  RSP <ffff8801afb03de8>
[    5.622457] CR2: 0000000000000050
[    5.622457] ---[ end trace fa2b19c25106d42b ]---
[    5.622457] Kernel panic - not syncing: Fatal exception in interrupt

The affected code was introduced by commit cdb898c52d
(qla2xxx: Add irq affinity notification).

Only dereference rsp->msix when it has been set so the machine can boot
fine. Possibly rsp->msix is unset because:
[    3.479679] qla2xxx [0000:00:00.0]-0005: : QLogic Fibre Channel HBA Driver: 8.07.00.33-k.
[    3.481839] qla2xxx [0000:13:00.0]-001d: : Found an ISP2432 irq 17 iobase 0xffffc90000038000.
[    3.484081] qla2xxx [0000:13:00.0]-0035:0: MSI-X; Unsupported ISP2432 (0x2, 0x3).
[    3.485804] qla2xxx [0000:13:00.0]-0037:0: Falling back-to MSI mode -258.
[    3.890145] scsi host0: qla2xxx
[    3.891956] qla2xxx [0000:13:00.0]-00fb:0: QLogic QLE2460 - PCI-Express Single Channel 4Gb Fibre Channel HBA.
[    3.894207] qla2xxx [0000:13:00.0]-00fc:0: ISP2432: PCIe (2.5GT/s x4) @ 0000:13:00.0 hdma+ host#=0 fw=7.03.00 (9496).
[    5.714774] qla2xxx [0000:13:00.0]-500a:0: LOOP UP detected (4 Gbps).

Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
Acked-by: Quinn Tran <quinn.tran@qlogic.com>
CC: <stable@vger.kernel.org>  # 4.5+
Fixes: cdb898c52d
Signed-off-by: James Bottomley <jejb@linux.vnet.ibm.com>
2016-07-05 12:42:54 -07:00
..
Kconfig tcm_qla2xxx Add SCSI command jammer/discard capability 2016-05-10 01:27:17 -07:00
Makefile
qla_attr.c qla2xxx: Avoid side effects when using endianizer macros. 2016-02-23 21:27:02 -05:00
qla_bsg.c qla2xxx: Provide mbx info in BBCR data after mbx failure 2016-02-23 21:27:02 -05:00
qla_bsg.h qla2xxx: Provide mbx info in BBCR data after mbx failure 2016-02-23 21:27:02 -05:00
qla_dbg.c qla2xxx: Avoid side effects when using endianizer macros. 2016-02-23 21:27:02 -05:00
qla_dbg.h qla2xxx: Change copyright year to 2014 in all the source files. 2014-05-19 13:31:02 +02:00
qla_def.h Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2016-03-22 12:41:14 -07:00
qla_devtbl.h
qla_dfs.c qla2xxx: Add DebugFS node for target sess list. 2016-03-10 21:48:27 -08:00
qla_fw.h qla2xxx: Add support for buffer to buffer credit value for ISP27XX. 2016-02-23 21:27:02 -05:00
qla_gbl.h qla2xxx: Add support for online flash update for ISP27XX. 2016-02-23 21:27:02 -05:00
qla_gs.c qla2xxx: Remove __constant_ prefix 2015-08-26 10:40:32 -07:00
qla_init.c qla2xxx: Set relogin flag when we fail to queue login requests. 2016-02-23 21:27:02 -05:00
qla_inline.h qla2xxx: Avoid side effects when using endianizer macros. 2016-02-23 21:27:02 -05:00
qla_iocb.c qla2xxx: Added interface to send explicit LOGO. 2016-01-07 13:57:43 -08:00
qla_isr.c qla2xxx: Fix NULL pointer deref in QLA interrupt 2016-07-05 12:42:54 -07:00
qla_mbx.c qla2xxx: Avoid side effects when using endianizer macros. 2016-02-23 21:27:02 -05:00
qla_mid.c qla2xxx: Fix stale pointer access. 2016-02-06 19:44:30 -08:00
qla_mr.c qla2xxx: Remove use of 'struct timeval' 2016-04-15 16:53:18 -04:00
qla_mr.h qla2xxx: Adjust adapter reset routine to the changes in firmware specification for ISPFx00. 2014-05-19 13:31:03 +02:00
qla_nx.c qla2xxx: Indicate out-of-memory with -ENOMEM 2016-04-11 16:57:09 -04:00
qla_nx.h qla2xxx: Change copyright year to 2014 in all the source files. 2014-05-19 13:31:02 +02:00
qla_nx2.c qla2xxx: Replace two macros with an inline function 2015-08-26 10:35:35 -07:00
qla_nx2.h qla2xxx: Replace two macros with an inline function 2015-08-26 10:35:35 -07:00
qla_os.c qla2xxx: Enable T10-DIF for ISP27XX 2016-02-23 21:27:02 -05:00
qla_settings.h qla2xxx: Change copyright year to 2014 in all the source files. 2014-05-19 13:31:02 +02:00
qla_sup.c treewide: Fix typos in printk 2016-04-28 10:52:28 +02:00
qla_target.c tcm_qla2xxx: introduce a private sess_kref 2016-05-10 01:19:33 -07:00
qla_target.h tcm_qla2xxx: introduce a private sess_kref 2016-05-10 01:19:33 -07:00
qla_tmpl.c qla2xxx: Fix stale pointer access. 2016-02-06 19:44:30 -08:00
qla_tmpl.h qla2xxx: ISP27xx fwdump template error print simplification. 2014-09-25 14:25:02 +02:00
qla_version.h qla2xxx: Update driver version to 8.07.00.33-k 2016-02-23 21:27:02 -05:00
tcm_qla2xxx.c tcm_qla2xxx Add SCSI command jammer/discard capability 2016-05-10 01:27:17 -07:00
tcm_qla2xxx.h tcm_qla2xxx Add SCSI command jammer/discard capability 2016-05-10 01:27:17 -07:00