kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/scsi/aacraid
History
Brian King f39d255966 scsi: aacraid: Fix command send race condition 
commit 1ae948fa4f upstream.

This fixes a potential race condition observed on Power systems.

Several places throughout the aacraid driver call aac_fib_send or
similar to send a command to the aacraid adapter, then check the return
code to determine if the command was actually sent to the adapter, then
update the phase field in the scsi command scratch pad area to track
that the firmware now owns this command.  However, there is nothing that
ensures that by the time the aac_fib_send function returns and we go to
write to the scsi command, that the command hasn't already completed and
the scsi command has been freed.  This was causing random crashes in the
TCP stack which was tracked down to be caused by memory that had been a
struct request + scsi_cmnd being now used for an skbuff. Memory
poisoning was enabled in the kernel to debug this which showed that the
last owner of the memory that had been freed was aacraid and that it was
a struct request.  The memory that was corrupted was the exact data
pattern of AAC_OWNER_FIRMWARE and it was at the same offset that aacraid
writes, which is scsicmd->SCp.phase. The patch below resolves this
issue.

Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Tested-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Dave Carroll <david.carroll@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
[bwh: Backported to 3.16:
 - Drop changes to aac_send_hba_fib()
 - Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2017-11-26 13:50:26 +00:00
..
aachba.c scsi: aacraid: Fix command send race condition 2017-11-26 13:50:26 +00:00
aacraid.h [SCSI] aacraid: kdump fix 2014-03-15 10:19:00 -07:00
commctrl.c aacraid: Check size values after double-fetch from user 2016-11-20 01:17:07 +00:00
comminit.c [SCSI] aacraid: Dual firmware image support 2013-04-10 11:55:52 -07:00
commsup.c scsi: aacraid: Fix memory leak in fib init path 2017-06-05 21:17:14 +01:00
dpcsup.c [SCSI] aacraid: Series 7 Async. (performance) mode support 2012-07-20 08:59:04 +01:00
linit.c [SCSI] Disable WRITE SAME for RAID and virtual host adapter drivers 2013-11-29 08:48:39 +04:00
Makefile [SCSI] aacraid: Add new code for PMC-Sierra's SRC based controller family 2011-03-23 11:36:58 -05:00
nark.c [SCSI] aacraid: Use resource_size_t for IO mem pointers and offsets 2012-07-20 08:58:43 +01:00
rkt.c [SCSI] aacraid: Use resource_size_t for IO mem pointers and offsets 2012-07-20 08:58:43 +01:00
rx.c [SCSI] remove deprecated IRQF_DISABLED from SCSI 2014-03-19 15:04:44 -07:00
sa.c [SCSI] remove deprecated IRQF_DISABLED from SCSI 2014-03-19 15:04:44 -07:00
src.c scsi: aacraid: Fix typo in blink status 2017-07-18 18:40:07 +01:00
TODO [SCSI] aacraid: Newer adapter communication iterface support 2005-10-28 11:41:53 -05:00