scsi: lpfc: Fix SCSI io host reset causing kernel crash

Orabug: 27631736

During SCSI error handling escalation to host reset, the SCSI io
routines were moved off the txcmplq, but the individual io's ON_CMPLQ
flag wasn't cleared.  Thus, a background thread saw the io and attempted
to access it as if on the txcmplq.

Clear the flag upon removal.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit c1dd9111b7f78a90bccd2e4abb9b9bb6319a4c64)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
 Conflicts:
	drivers/scsi/lpfc/lpfc_init.c
	drivers/scsi/lpfc/lpfc_sli.c
 I had to remove the nvme changes from these patches.
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 0a23ee176636e921a721cbe03e925bb4d951056b..5e392e5c2a03047fafd029a6427622c50d26d3fd 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -950,6 +950,7 @@ lpfc_hba_clean_txcmplq(struct lpfc_hba *phba)
        struct lpfc_sli_ring *pring;
        LIST_HEAD(completions);
        int i;
+       struct lpfc_iocbq *piocb, *next_iocb;
 
        for (i = 0; i < psli->num_rings; i++) {
                pring = &psli->ring[i];
@@ -960,6 +961,9 @@ lpfc_hba_clean_txcmplq(struct lpfc_hba *phba)
                /* At this point in time the HBA is either reset or DOA. Either
                 * way, nothing should be on txcmplq as it will NEVER complete.
                 */
+               list_for_each_entry_safe(piocb, next_iocb,
+                                        &pring->txcmplq, list)
+                       piocb->iocb_flag &= ~LPFC_IO_ON_TXCMPLQ;
                list_splice_init(&pring->txcmplq, &completions);
                pring->txcmplq_cnt = 0;
 

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index f8325e0473e62126ab9e1d64f1b4359ae8594ce1..c0d6fe09fa4a03d34c1db887aea0c50e40ce2ed0 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -3633,6 +3633,7 @@ lpfc_sli_flush_fcp_rings(struct lpfc_hba *phba)
        struct lpfc_sli *psli = &phba->sli;
        struct lpfc_sli_ring  *pring;
        uint32_t i;
+       struct lpfc_iocbq *piocb, *next_iocb;
 
        spin_lock_irq(&phba->hbalock);
        /* Indicate the I/O queues are flushed */
@@ -3647,6 +3648,9 @@ lpfc_sli_flush_fcp_rings(struct lpfc_hba *phba)
                        spin_lock_irq(&pring->ring_lock);
                        /* Retrieve everything on txq */
                        list_splice_init(&pring->txq, &txq);
+                       list_for_each_entry_safe(piocb, next_iocb,
+                                                &pring->txcmplq, list)
+                               piocb->iocb_flag &= ~LPFC_IO_ON_TXCMPLQ;
                        /* Retrieve everything on the txcmplq */
                        list_splice_init(&pring->txcmplq, &txcmplq);
                        pring->txq_cnt = 0;
@@ -3668,6 +3672,9 @@ lpfc_sli_flush_fcp_rings(struct lpfc_hba *phba)
                spin_lock_irq(&phba->hbalock);
                /* Retrieve everything on txq */
                list_splice_init(&pring->txq, &txq);
+               list_for_each_entry_safe(piocb, next_iocb,
+                                        &pring->txcmplq, list)
+                       piocb->iocb_flag &= ~LPFC_IO_ON_TXCMPLQ;
                /* Retrieve everything on the txcmplq */
                list_splice_init(&pring->txcmplq, &txcmplq);
                pring->txq_cnt = 0;