scst-svn — Contains SVN commit notifications

[Scst-svn] [3.7.x] scst: Fix removal of deprecated create_workqueue()

[Gleb C. <lna...@ya...>]

Commit: 7c8e5c9
GitHub URL: https://github.com/SCST-project/scst/commit/7c8e5c94aba47f7f9c6ecd5f963a8e5386ed2e48
Author: Gleb Chesnokov
Date: 2023-07-21T11:02:51+03:00
Log Message:
-----------
scst: Fix removal of deprecated create_workqueue()

create_workqueue() was replaced with alloc_workqueue() with max_active set
to 0. However, the original create_workqueue() implicitly set max_active
to 1.

This change has led to unexpected bugs because previously, work items
could only be executed one by one. With the change, they can now be
executed simultaneously.

This patch fixes the issue by restoring max_active to 1.

Fixes: f4686e9102c1 ("scst: Remove deprecated create_workqueue()")
Fixes: https://github.com/SCST-project/scst/issues/179

Modified Paths:
--------------
 iscsi-scst/kernel/isert-scst/iser_global.c | 2 +-
 qla2x00t/qla_os.c                          | 2 +-
 scst/src/scst_lib.c                        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

===================================================================
diff --git a/iscsi-scst/kernel/isert-scst/iser_global.c b/iscsi-scst/kernel/isert-scst/iser_global.c
index 5b8b92b..e6e0ec2 100644
--- a/iscsi-scst/kernel/isert-scst/iser_global.c
+++ b/iscsi-scst/kernel/isert-scst/iser_global.c
@@ -138,7 +138,7 @@ int isert_global_init(void)
 	spin_lock_init(&isert_glob.portal_lock);
 	init_waitqueue_head(&isert_glob.portal_wq);
 
-	isert_glob.conn_wq = alloc_workqueue("isert_conn_wq", WQ_MEM_RECLAIM, 0);
+	isert_glob.conn_wq = alloc_workqueue("isert_conn_wq", WQ_MEM_RECLAIM, 1);
 	if (!isert_glob.conn_wq) {
 		PRINT_ERROR("Failed to alloc iser conn work queue");
 		return -ENOMEM;
diff --git a/qla2x00t/qla_os.c b/qla2x00t/qla_os.c
index 1b49c4d..92d5b24 100644
--- a/qla2x00t/qla_os.c
+++ b/qla2x00t/qla_os.c
@@ -450,7 +450,7 @@ static int qla25xx_setup_mode(struct scsi_qla_host *vha)
 			    "Failed to create request queue.\n");
 			goto fail;
 		}
-		ha->wq = alloc_workqueue("qla2xxx_wq", WQ_MEM_RECLAIM, 0);
+		ha->wq = alloc_workqueue("qla2xxx_wq", WQ_MEM_RECLAIM, 1);
 		vha->req = ha->req_q_map[req];
 		options |= BIT_1;
 		for (ques = 1; ques < ha->max_rsp_queues; ques++) {
diff --git a/scst/src/scst_lib.c b/scst/src/scst_lib.c
index 7adc568..1559230 100644
--- a/scst/src/scst_lib.c
+++ b/scst/src/scst_lib.c
@@ -15412,7 +15412,7 @@ int __init scst_lib_init(void)
 
 	scst_scsi_op_list_init();
 
-	scst_release_acg_wq = alloc_workqueue("scst_release_acg", WQ_MEM_RECLAIM, 0);
+	scst_release_acg_wq = alloc_workqueue("scst_release_acg", WQ_MEM_RECLAIM, 1);
 	if (unlikely(!scst_release_acg_wq)) {
 		PRINT_ERROR("Failed to allocate scst_release_acg_wq");
 		res = -ENOMEM;

[Scst-svn] [master] scst_lib: Improve scst_put_acg()

[Gleb C. <lna...@ya...>]

Commit: c00af8a
GitHub URL: https://github.com/SCST-project/scst/commit/c00af8aab9d82d4b61dc466a38e373dd4132c244
Author: Gleb Chesnokov
Date: 2023-07-21T10:38:52+03:00
Log Message:
-----------
scst_lib: Improve scst_put_acg()

This patch refactors scst_put_acg() to directly call kref_put() with a
release callback that handles removal of scst_acg from the workqueue.
This replaces the previous approach of queuing a work item for each
kref_put() call, improving efficiency by reducing the number of queued
work items.

Modified Paths:
--------------
 scst/src/scst_lib.c | 45 +++++++--------
 1 file changed, 21 insertions(+), 24 deletions(-)

===================================================================
diff --git a/scst/src/scst_lib.c b/scst/src/scst_lib.c
index 208e58d..02d03ba 100644
--- a/scst/src/scst_lib.c
+++ b/scst/src/scst_lib.c
@@ -70,7 +70,6 @@
 static DEFINE_SPINLOCK(scst_global_stpg_list_lock);
 static LIST_HEAD(scst_global_stpg_list);
 
-static void scst_put_acg_work(struct work_struct *work);
 static void scst_free_acn(struct scst_acn *acn, bool reassign);
 
 struct scsi_io_context {
@@ -4826,49 +4825,47 @@ static void scst_free_acg(struct scst_acg *acg)
 	kobject_put(&tgt->tgt_kobj);
 }
 
-static void scst_release_acg(struct kref *kref)
-{
-	struct scst_acg *acg = container_of(kref, struct scst_acg, acg_kref);
-
-	scst_free_acg(acg);
-}
-
-struct scst_acg_put_work {
+struct scst_acg_release_work {
 	struct work_struct	work;
 	struct scst_acg		*acg;
 };
 
-static void scst_put_acg_work(struct work_struct *work)
+static void scst_release_acg_work(struct work_struct *work)
 {
-	struct scst_acg_put_work *put_work =
-		container_of(work, typeof(*put_work), work);
-	struct scst_acg *acg = put_work->acg;
+	struct scst_acg_release_work *release_work =
+		container_of(work, typeof(*release_work), work);
+	struct scst_acg *acg = release_work->acg;
 
-	kfree(put_work);
-	kref_put(&acg->acg_kref, scst_release_acg);
+	kfree(release_work);
+	scst_free_acg(acg);
 }
 
-void scst_put_acg(struct scst_acg *acg)
+static void scst_release_acg(struct kref *kref)
 {
-	struct scst_acg_put_work *put_work;
+	struct scst_acg *acg = container_of(kref, struct scst_acg, acg_kref);
+	struct scst_acg_release_work *release_work;
 	bool rc;
 
-	put_work = kmalloc(sizeof(*put_work), GFP_KERNEL | __GFP_NOFAIL);
-	if (WARN_ON_ONCE(!put_work)) {
-		kref_put(&acg->acg_kref, scst_release_acg);
+	release_work = kmalloc(sizeof(*release_work), GFP_KERNEL | __GFP_NOFAIL);
+	if (WARN_ON_ONCE(!release_work)) {
+		scst_free_acg(acg);
 		return;
 	}
 
-	INIT_WORK(&put_work->work, scst_put_acg_work);
-	put_work->acg = acg;
+	INIT_WORK(&release_work->work, scst_release_acg_work);
+	release_work->acg = acg;
 
 	/*
 	 * Schedule the kref_put() call instead of invoking it directly to
 	 * avoid deep recursion and a stack overflow.
 	 */
-	rc = queue_work(scst_release_acg_wq, &put_work->work);
+	rc = queue_work(scst_release_acg_wq, &release_work->work);
 	WARN_ON_ONCE(!rc);
-	return;
+}
+
+void scst_put_acg(struct scst_acg *acg)
+{
+	kref_put(&acg->acg_kref, scst_release_acg);
 }
 
 void scst_get_acg(struct scst_acg *acg)

[Scst-svn] [master] scst: Do not use WQ_MEM_RECLAIM flag for workqueues

[Gleb C. <lna...@ya...>]

Commit: 4b840ae
GitHub URL: https://github.com/SCST-project/scst/commit/4b840aeee395d554ac699ad2736553d5181ddda5
Author: Gleb Chesnokov
Date: 2023-07-21T10:38:52+03:00
Log Message:
-----------
scst: Do not use WQ_MEM_RECLAIM flag for workqueues

According to kernel documentation, this flag should be set if the
workqueue will be involved in the kernel's memory reclamation flow.
Since it is not, there is no need for the driver's WQ to have this
flag set so remove it.

Modified Paths:
--------------
 iscsi-scst/kernel/isert-scst/iser_global.c | 2 +-
 iscsi-scst/kernel/isert-scst/iser_rdma.c   | 2 +-
 scst/src/scst_event.c                      | 2 +-
 scst/src/scst_lib.c                        | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

===================================================================
diff --git a/iscsi-scst/kernel/isert-scst/iser_global.c b/iscsi-scst/kernel/isert-scst/iser_global.c
index e6e0ec2..c070a66 100644
--- a/iscsi-scst/kernel/isert-scst/iser_global.c
+++ b/iscsi-scst/kernel/isert-scst/iser_global.c
@@ -138,7 +138,7 @@ int isert_global_init(void)
 	spin_lock_init(&isert_glob.portal_lock);
 	init_waitqueue_head(&isert_glob.portal_wq);
 
-	isert_glob.conn_wq = alloc_workqueue("isert_conn_wq", WQ_MEM_RECLAIM, 1);
+	isert_glob.conn_wq = alloc_workqueue("isert_conn_wq", 0, 1);
 	if (!isert_glob.conn_wq) {
 		PRINT_ERROR("Failed to alloc iser conn work queue");
 		return -ENOMEM;
diff --git a/iscsi-scst/kernel/isert-scst/iser_rdma.c b/iscsi-scst/kernel/isert-scst/iser_rdma.c
index 439e369..c5e30b1 100644
--- a/iscsi-scst/kernel/isert-scst/iser_rdma.c
+++ b/iscsi-scst/kernel/isert-scst/iser_rdma.c
@@ -1792,7 +1792,7 @@ struct isert_portal *isert_portal_create(struct sockaddr *sa, size_t addr_len)
 		goto err_alloc;
 	}
 
-	portal->reinit_id_wq = alloc_ordered_workqueue("isert_reinit_id_wq", WQ_MEM_RECLAIM);
+	portal->reinit_id_wq = alloc_ordered_workqueue("isert_reinit_id_wq", 0);
 	if (unlikely(!portal->reinit_id_wq)) {
 		PRINT_ERROR("Unable to allocate reinit workqueue");
 		err = -ENOMEM;
diff --git a/scst/src/scst_event.c b/scst/src/scst_event.c
index 7221008..b744e17 100644
--- a/scst/src/scst_event.c
+++ b/scst/src/scst_event.c
@@ -1111,7 +1111,7 @@ int scst_event_init(void)
 
 	TRACE_ENTRY();
 
-	scst_event_wq = alloc_workqueue("scst_event_wq", WQ_MEM_RECLAIM, 0);
+	scst_event_wq = alloc_workqueue("scst_event_wq", 0, 0);
 	if (unlikely(!scst_event_wq)) {
 		PRINT_ERROR("Failed to allocate scst_event_wq");
 		res = -ENOMEM;
diff --git a/scst/src/scst_lib.c b/scst/src/scst_lib.c
index e126230..208e58d 100644
--- a/scst/src/scst_lib.c
+++ b/scst/src/scst_lib.c
@@ -15499,7 +15499,7 @@ int __init scst_lib_init(void)
 
 	scst_scsi_op_list_init();
 
-	scst_release_acg_wq = alloc_workqueue("scst_release_acg", WQ_MEM_RECLAIM, 1);
+	scst_release_acg_wq = alloc_workqueue("scst_release_acg", 0, 1);
 	if (unlikely(!scst_release_acg_wq)) {
 		PRINT_ERROR("Failed to allocate scst_release_acg_wq");
 		res = -ENOMEM;

[Scst-svn] [master] scst: Use vmalloc_array() and vcalloc()

[Gleb C. <lna...@ya...>]

Commit: 87235df
GitHub URL: https://github.com/SCST-project/scst/commit/87235dfe3a2093b12ec8239553a80eacd3a59b22
Author: Gleb Chesnokov
Date: 2023-07-21T10:38:34+03:00
Log Message:
-----------
scst: Use vmalloc_array() and vcalloc()

Use vmalloc_array() and vcalloc() to protect against multiplication
overflows.

The changes were done using the following Coccinelle
semantic patch:

// <smpl>
@initialize:ocaml@
@@

let rename alloc =
  match alloc with
    "vmalloc" -> "vmalloc_array"
  | "vzalloc" -> "vcalloc"
  | _ -> failwith "unknown"

@@
    size_t e1,e2;
    constant C1, C2;
    expression E1, E2, COUNT, x1, x2, x3;
    typedef u8;
    typedef __u8;
    type t = {u8,__u8,char,unsigned char};
    identifier alloc = {vmalloc,vzalloc};
    fresh identifier realloc = script:ocaml(alloc) { rename alloc };
@@

(
      alloc(x1*x2*x3)
|
      alloc(C1 * C2)
|
      alloc((sizeof(t)) * (COUNT), ...)
|
-     alloc((e1) * (e2))
+     realloc(e1, e2)
|
-     alloc((e1) * (COUNT))
+     realloc(COUNT, e1)
|
-     alloc((E1) * (E2))
+     realloc(E1, E2)
)
// </smpl>

Modified Paths:
--------------
 iscsi-scst/kernel/isert-scst/iser_rdma.c |  3 +-
 qla2x00t-32gbit/qla_init.c               |  4 +--
 scst/include/backport.h                  | 22 +++++++++++++++
 scst/src/scst_dlm.c                      |  7 ++---
 4 files changed, 28 insertions(+), 8 deletions(-)

===================================================================
diff --git a/iscsi-scst/kernel/isert-scst/iser_rdma.c b/iscsi-scst/kernel/isert-scst/iser_rdma.c
index bad41bf..439e369 100644
--- a/iscsi-scst/kernel/isert-scst/iser_rdma.c
+++ b/iscsi-scst/kernel/isert-scst/iser_rdma.c
@@ -938,8 +938,7 @@ static struct isert_device *isert_device_create(struct ib_device *ib_dev)
 		goto free_isert_dev;
 	}
 
-	isert_dev->cq_desc = vmalloc(sizeof(*isert_dev->cq_desc) *
-				     isert_dev->num_cqs);
+	isert_dev->cq_desc = vmalloc_array(isert_dev->num_cqs, sizeof(*isert_dev->cq_desc));
 	if (unlikely(isert_dev->cq_desc == NULL)) {
 		PRINT_ERROR("Failed to allocate %zd bytes for iser cq_desc",
 			    sizeof(*isert_dev->cq_desc) * isert_dev->num_cqs);
diff --git a/qla2x00t-32gbit/qla_init.c b/qla2x00t-32gbit/qla_init.c
index 88da7b5..980c8f7 100644
--- a/qla2x00t-32gbit/qla_init.c
+++ b/qla2x00t-32gbit/qla_init.c
@@ -8437,7 +8437,7 @@ qla24xx_load_risc_flash(scsi_qla_host_t *vha, uint32_t *srisc_addr,
 		ql_dbg(ql_dbg_init, vha, 0x0163,
 		    "-> fwdt%u template allocate template %#x words...\n",
 		    j, risc_size);
-		fwdt->template = vmalloc(risc_size * sizeof(*dcode));
+		fwdt->template = vmalloc_array(risc_size, sizeof(*dcode));
 		if (!fwdt->template) {
 			ql_log(ql_log_warn, vha, 0x0164,
 			    "-> fwdt%u failed allocate template.\n", j);
@@ -8692,7 +8692,7 @@ qla24xx_load_risc_blob(scsi_qla_host_t *vha, uint32_t *srisc_addr)
 		ql_dbg(ql_dbg_init, vha, 0x0173,
 		    "-> fwdt%u template allocate template %#x words...\n",
 		    j, risc_size);
-		fwdt->template = vmalloc(risc_size * sizeof(*dcode));
+		fwdt->template = vmalloc_array(risc_size, sizeof(*dcode));
 		if (!fwdt->template) {
 			ql_log(ql_log_warn, vha, 0x0174,
 			    "-> fwdt%u failed allocate template.\n", j);
diff --git a/scst/include/backport.h b/scst/include/backport.h
index f4fc281..a57cf53 100644
--- a/scst/include/backport.h
+++ b/scst/include/backport.h
@@ -849,6 +849,28 @@ static inline void kvfree(void *addr)
 }
 #endif
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 18, 0) &&			\
+	(LINUX_VERSION_CODE >> 8 != KERNEL_VERSION(5, 15, 0) >> 8 ||	\
+	 LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 54)) &&		\
+	(!defined(RHEL_RELEASE_CODE) ||					\
+	 RHEL_RELEASE_CODE -0 < RHEL_RELEASE_VERSION(9, 0)) &&		\
+	(!defined(UEK_KABI_RENAME) ||					\
+	 LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0))
+/*
+ * See also commit a8749a35c3990 ("mm: vmalloc: introduce array allocation functions") # v5.18,
+ * v5.15.54.
+ */
+static inline void *vmalloc_array(size_t n, size_t size)
+{
+	return vmalloc(n * size);
+}
+
+static inline void *vcalloc(size_t n, size_t size)
+{
+	return vzalloc(n * size);
+}
+#endif
+
 /* <linux/shrinker.h> */
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 0, 0) &&		\
diff --git a/scst/src/scst_dlm.c b/scst/src/scst_dlm.c
index 8afedb1..7e634af 100644
--- a/scst/src/scst_dlm.c
+++ b/scst/src/scst_dlm.c
@@ -304,11 +304,10 @@ static int scst_copy_from_dlm(struct scst_device *dev, dlm_lockspace_t *ls,
 
 	nr_registrants = be32_to_cpu(lvb->nr_registrants);
 	if (nr_registrants) {
-		reg_lksb = vzalloc((sizeof(*reg_lksb) + PR_DLM_LVB_LEN) *
-				   nr_registrants);
+		reg_lksb = vcalloc(nr_registrants, sizeof(*reg_lksb) + PR_DLM_LVB_LEN);
 		if (!reg_lksb) {
-			PRINT_ERROR("%s: failed to allocate %d * %zd bytes of"
-				    " memory", __func__, nr_registrants,
+			PRINT_ERROR("%s: failed to allocate %u * %zu bytes of memory",
+				    __func__, nr_registrants,
 				    sizeof(*reg_lksb) + PR_DLM_LVB_LEN);
 			goto out;
 		}

[Scst-svn] [master] scst: Fix removal of deprecated create_workqueue()

[Gleb C. <lna...@ya...>]

Commit: 1f0ce86
GitHub URL: https://github.com/SCST-project/scst/commit/1f0ce86f3c3f37a6f08f1a0e2a62e589ae5d3e7e
Author: Gleb Chesnokov
Date: 2023-07-21T10:38:52+03:00
Log Message:
-----------
scst: Fix removal of deprecated create_workqueue()

create_workqueue() was replaced with alloc_workqueue() with max_active set
to 0. However, the original create_workqueue() implicitly set max_active
to 1.

This change has led to unexpected bugs because previously, work items
could only be executed one by one. With the change, they can now be
executed simultaneously.

This patch fixes the issue by restoring max_active to 1.

Fixes: f4686e9102c1 ("scst: Remove deprecated create_workqueue()")
Fixes: https://github.com/SCST-project/scst/issues/179

Modified Paths:
--------------
 iscsi-scst/kernel/isert-scst/iser_global.c | 2 +-
 qla2x00t/qla_os.c                          | 2 +-
 scst/src/scst_lib.c                        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

===================================================================
diff --git a/iscsi-scst/kernel/isert-scst/iser_global.c b/iscsi-scst/kernel/isert-scst/iser_global.c
index 5b8b92b..e6e0ec2 100644
--- a/iscsi-scst/kernel/isert-scst/iser_global.c
+++ b/iscsi-scst/kernel/isert-scst/iser_global.c
@@ -138,7 +138,7 @@ int isert_global_init(void)
 	spin_lock_init(&isert_glob.portal_lock);
 	init_waitqueue_head(&isert_glob.portal_wq);
 
-	isert_glob.conn_wq = alloc_workqueue("isert_conn_wq", WQ_MEM_RECLAIM, 0);
+	isert_glob.conn_wq = alloc_workqueue("isert_conn_wq", WQ_MEM_RECLAIM, 1);
 	if (!isert_glob.conn_wq) {
 		PRINT_ERROR("Failed to alloc iser conn work queue");
 		return -ENOMEM;
diff --git a/qla2x00t/qla_os.c b/qla2x00t/qla_os.c
index 0c3c70a..5d34b93 100644
--- a/qla2x00t/qla_os.c
+++ b/qla2x00t/qla_os.c
@@ -450,7 +450,7 @@ static int qla25xx_setup_mode(struct scsi_qla_host *vha)
 			    "Failed to create request queue.\n");
 			goto fail;
 		}
-		ha->wq = alloc_workqueue("qla2xxx_wq", WQ_MEM_RECLAIM, 0);
+		ha->wq = alloc_workqueue("qla2xxx_wq", WQ_MEM_RECLAIM, 1);
 		vha->req = ha->req_q_map[req];
 		options |= BIT_1;
 		for (ques = 1; ques < ha->max_rsp_queues; ques++) {
diff --git a/scst/src/scst_lib.c b/scst/src/scst_lib.c
index 283a28b..e126230 100644
--- a/scst/src/scst_lib.c
+++ b/scst/src/scst_lib.c
@@ -15499,7 +15499,7 @@ int __init scst_lib_init(void)
 
 	scst_scsi_op_list_init();
 
-	scst_release_acg_wq = alloc_workqueue("scst_release_acg", WQ_MEM_RECLAIM, 0);
+	scst_release_acg_wq = alloc_workqueue("scst_release_acg", WQ_MEM_RECLAIM, 1);
 	if (unlikely(!scst_release_acg_wq)) {
 		PRINT_ERROR("Failed to allocate scst_release_acg_wq");
 		res = -ENOMEM;

[Scst-svn] [master] qla2x00t-32gbit: Fix error code in qla2x00_start_sp()

[Gleb C. <lna...@ya...>]

Commit: ceff753
GitHub URL: https://github.com/SCST-project/scst/commit/ceff753e131d75c9c7a12eadc625d90807943c89
Author: Gleb Chesnokov
Date: 2023-07-21T10:38:34+03:00
Log Message:
-----------
qla2x00t-32gbit: Fix error code in qla2x00_start_sp()

This should be negative -EAGAIN instead of positive.  The callers treat
non-zero error codes the same so it doesn't really impact runtime beyond
some trivial differences to debug output.

Fixes: 80676d054e5a ("scsi: qla2xxx: Fix session cleanup hang")
Signed-off-by: Dan Carpenter <dan...@li...>
Link: https://lore.kernel.org/r/498...@mo...untain
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit e579b007eff3f upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_iocb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_iocb.c b/qla2x00t-32gbit/qla_iocb.c
index 7cd7ef2..6670b37 100644
--- a/qla2x00t-32gbit/qla_iocb.c
+++ b/qla2x00t-32gbit/qla_iocb.c
@@ -3928,7 +3928,7 @@ qla2x00_start_sp(srb_t *sp)
 
 	pkt = __qla2x00_alloc_iocbs(sp->qpair, sp);
 	if (!pkt) {
-		rval = EAGAIN;
+		rval = -EAGAIN;
 		ql_log(ql_log_warn, vha, 0x700c,
 		    "qla2x00_alloc_iocbs failed.\n");
 		goto done;

[Scst-svn] [master] qla2x00t-32gbit: Silence a static checker warning

[Gleb C. <lna...@ya...>]

Commit: 1d37f63
GitHub URL: https://github.com/SCST-project/scst/commit/1d37f637e649a465eeaedbda07894b3ee11df364
Author: Gleb Chesnokov
Date: 2023-07-21T10:38:34+03:00
Log Message:
-----------
qla2x00t-32gbit: Silence a static checker warning

Smatch and Clang both complain that LOGIN_TEMPLATE_SIZE is more than
sizeof(ha->plogi_els_payld.fl_csp).

Smatch warning:
    drivers/scsi/qla2xxx/qla_iocb.c:3075 qla24xx_els_dcmd2_iocb()
    warn: '&ha->plogi_els_payld.fl_csp' sometimes too small '16' size = 112

Clang warning:
    include/linux/fortify-string.h:592:4: error: call to
    '__read_overflow2_field' declared with 'warning' attribute: detected
    read beyond size of field (2nd parameter); maybe use struct_group()?
    [-Werror,-Wattribute-warning]
                        __read_overflow2_field(q_size_field, size);

When I was reading this code I assumed the "- 4" meant that we were
skipping the last 4 bytes but actually it turned out that we are
skipping the first four bytes.

I have re-written it remove the magic numbers, be more clear and
silence the static checker warnings.

Signed-off-by: Dan Carpenter <dan...@li...>
Link: https://lore.kernel.org/r/4aa...@mo...untain
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit 134f66959cd0b upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_def.h  | 1 -
 qla2x00t-32gbit/qla_iocb.c | 3 ++-
 2 files changed, 2 insertions(+), 2 deletions(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_def.h b/qla2x00t-32gbit/qla_def.h
index 674d4bd..5a3a519 100644
--- a/qla2x00t-32gbit/qla_def.h
+++ b/qla2x00t-32gbit/qla_def.h
@@ -4514,7 +4514,6 @@ struct qla_hw_data {
 
 	/* n2n */
 	struct fc_els_flogi plogi_els_payld;
-#define LOGIN_TEMPLATE_SIZE (sizeof(struct fc_els_flogi) - 4)
 
 	void            *swl;
 
diff --git a/qla2x00t-32gbit/qla_iocb.c b/qla2x00t-32gbit/qla_iocb.c
index bdf505a..7cd7ef2 100644
--- a/qla2x00t-32gbit/qla_iocb.c
+++ b/qla2x00t-32gbit/qla_iocb.c
@@ -3089,7 +3089,8 @@ qla24xx_els_dcmd2_iocb(scsi_qla_host_t *vha, int els_opcode,
 	memset(ptr, 0, sizeof(struct els_plogi_payload));
 	memset(resp_ptr, 0, sizeof(struct els_plogi_payload));
 	memcpy(elsio->u.els_plogi.els_plogi_pyld->data,
-	    &ha->plogi_els_payld.fl_csp, LOGIN_TEMPLATE_SIZE);
+	       (void *)&ha->plogi_els_payld + offsetof(struct fc_els_flogi, fl_csp),
+	       sizeof(ha->plogi_els_payld) - offsetof(struct fc_els_flogi, fl_csp));
 
 	elsio->u.els_plogi.els_cmd = els_opcode;
 	elsio->u.els_plogi.els_plogi_pyld->opcode = els_opcode;

[Scst-svn] [master] qla2x00t-32gbit: Remove unused nvme_ls_waitq wait queue

[Gleb C. <lna...@ya...>]

Commit: 7076a91
GitHub URL: https://github.com/SCST-project/scst/commit/7076a91a3b658dc849dfcf8e1bd95b5290b723a4
Author: Gleb Chesnokov
Date: 2023-07-19T11:45:31+03:00
Log Message:
-----------
qla2x00t-32gbit: Remove unused nvme_ls_waitq wait queue

System crash when qla2x00_start_sp(sp) returns error code EGAIN and wake_up
gets called for uninitialized wait queue sp->nvme_ls_waitq.

    qla2xxx [0000:37:00.1]-2121:5: Returning existing qpair of ffff8ae2c0513400 for idx=0
    qla2xxx [0000:37:00.1]-700e:5: qla2x00_start_sp failed = 11
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
    PGD 0 P4D 0
    Oops: 0000 [#1] SMP NOPTI
    Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021
    Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc]
    RIP: 0010:__wake_up_common+0x4c/0x190
    RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086
    RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000
    RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320
    RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8
    R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20
    R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
    FS:  0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    PKRU: 55555554
    Call Trace:
     __wake_up_common_lock+0x7c/0xc0
     qla_nvme_ls_req+0x355/0x4c0 [qla2xxx]
     ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc]
     ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc]
     ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc]

Remove unused nvme_ls_waitq wait queue. nvme_ls_waitq logic was removed
previously in the commits tagged Fixed: below.

Fixes: 219d27d7147e ("scsi: qla2xxx: Fix race conditions in the code for aborting SCSI commands")
Fixes: 5621b0dd7453 ("scsi: qla2xxx: Simpify unregistration of FC-NVMe local/remote ports")
Cc: st...@vg...
Signed-off-by: Manish Rangankar <mra...@ma...>
Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit 20fce500b232 upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_def.h  | 1 -
 qla2x00t-32gbit/qla_nvme.c | 3 ---
 2 files changed, 4 deletions(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_def.h b/qla2x00t-32gbit/qla_def.h
index 4a496a6..674d4bd 100644
--- a/qla2x00t-32gbit/qla_def.h
+++ b/qla2x00t-32gbit/qla_def.h
@@ -750,7 +750,6 @@ typedef struct srb {
 	struct iocb_resource iores;
 	struct kref cmd_kref;	/* need to migrate ref_count over to this */
 	void *priv;
-	wait_queue_head_t nvme_ls_waitq;
 	struct fc_port *fcport;
 	struct scsi_qla_host *vha;
 	unsigned int start_timer:1;
diff --git a/qla2x00t-32gbit/qla_nvme.c b/qla2x00t-32gbit/qla_nvme.c
index de69486..c3ae67f 100644
--- a/qla2x00t-32gbit/qla_nvme.c
+++ b/qla2x00t-32gbit/qla_nvme.c
@@ -375,7 +375,6 @@ static int qla_nvme_ls_req(struct nvme_fc_local_port *lport,
 	if (rval != QLA_SUCCESS) {
 		ql_log(ql_log_warn, vha, 0x700e,
 		    "qla2x00_start_sp failed = %d\n", rval);
-		wake_up(&sp->nvme_ls_waitq);
 		sp->priv = NULL;
 		priv->sp = NULL;
 		qla2x00_rel_sp(sp);
@@ -667,7 +666,6 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
 	if (!sp)
 		return -EBUSY;
 
-	init_waitqueue_head(&sp->nvme_ls_waitq);
 	kref_init(&sp->cmd_kref);
 	spin_lock_init(&priv->cmd_lock);
 	sp->priv = priv;
@@ -686,7 +684,6 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
 	if (rval != QLA_SUCCESS) {
 		ql_log(ql_log_warn, vha, 0x212d,
 		    "qla2x00_start_nvme_mq failed = %d\n", rval);
-		wake_up(&sp->nvme_ls_waitq);
 		sp->priv = NULL;
 		priv->sp = NULL;
 		qla2xxx_rel_qpair_sp(sp->qpair, sp);

[Scst-svn] [master] qla2x00t-32gbit: Update version to 10.02.08.400-k

[Gleb C. <lna...@ya...>]

Commit: 29d26d6
GitHub URL: https://github.com/SCST-project/scst/commit/29d26d69db0de122e0f6d2917cd3acfd14b03f7f
Author: Gleb Chesnokov
Date: 2023-07-19T11:45:31+03:00
Log Message:
-----------
qla2x00t-32gbit: Update version to 10.02.08.400-k

Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Reviewed-by: Himanshu Madhani <him...@or...>
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit 991e7ac609ee upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_version.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_version.h b/qla2x00t-32gbit/qla_version.h
index 4d6f06f..e377192 100644
--- a/qla2x00t-32gbit/qla_version.h
+++ b/qla2x00t-32gbit/qla_version.h
@@ -6,9 +6,9 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "10.02.08.300-k"
+#define QLA2XXX_VERSION      "10.02.08.400-k"
 
 #define QLA_DRIVER_MAJOR_VER	10
 #define QLA_DRIVER_MINOR_VER	2
 #define QLA_DRIVER_PATCH_VER	8
-#define QLA_DRIVER_BETA_VER	300
+#define QLA_DRIVER_BETA_VER	400

[Scst-svn] [master] qla2x00t-32gbit: Correct the index of array

[Gleb C. <lna...@ya...>]

Commit: bb9b171
GitHub URL: https://github.com/SCST-project/scst/commit/bb9b171dc414eafa2c2cb34eb30799b7ecdafcc9
Author: Gleb Chesnokov
Date: 2023-07-19T11:45:31+03:00
Log Message:
-----------
qla2x00t-32gbit: Correct the index of array

Klocwork reported array 'port_dstate_str' of size 10 may use index value(s)
10..15.

Add a fix to correct the index of array.

Cc: st...@vg...
Signed-off-by: Bikash Hazarika <bha...@ma...>
Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Reviewed-by: Himanshu Madhani <him...@or...>
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit b1b9d3825df4 upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_inline.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_inline.h b/qla2x00t-32gbit/qla_inline.h
index b1bf22d..d635b42 100644
--- a/qla2x00t-32gbit/qla_inline.h
+++ b/qla2x00t-32gbit/qla_inline.h
@@ -117,11 +117,13 @@ qla2x00_set_fcport_disc_state(fc_port_t *fcport, int state)
 {
 	int old_val;
 	uint8_t shiftbits, mask;
+	uint8_t port_dstate_str_sz;
 
 	/* This will have to change when the max no. of states > 16 */
 	shiftbits = 4;
 	mask = (1 << shiftbits) - 1;
 
+	port_dstate_str_sz = sizeof(port_dstate_str) / sizeof(char *);
 	fcport->disc_state = state;
 	while (1) {
 		old_val = atomic_read(&fcport->shadow_disc_state);
@@ -129,7 +131,8 @@ qla2x00_set_fcport_disc_state(fc_port_t *fcport, int state)
 		    old_val, (old_val << shiftbits) | state)) {
 			ql_dbg(ql_dbg_disc, fcport->vha, 0x2134,
 			    "FCPort %8phC disc_state transition: %s to %s - portid=%06x.\n",
-			    fcport->port_name, port_dstate_str[old_val & mask],
+			    fcport->port_name, (old_val & mask) < port_dstate_str_sz ?
+				    port_dstate_str[old_val & mask] : "Unknown",
 			    port_dstate_str[state], fcport->d_id.b24);
 			return;
 		}

[Scst-svn] [master] qla2x00t-32gbit: Pointer may be dereferenced

[Gleb C. <lna...@ya...>]

Commit: 1f107c7
GitHub URL: https://github.com/SCST-project/scst/commit/1f107c7ee56f9f4792e5ed56e16872282c23199b
Author: Gleb Chesnokov
Date: 2023-07-19T11:45:31+03:00
Log Message:
-----------
qla2x00t-32gbit: Pointer may be dereferenced

Klocwork tool reported pointer 'rport' returned from call to function
fc_bsg_to_rport() may be NULL and will be dereferenced.

Add a fix to validate rport before dereferencing.

Cc: st...@vg...
Signed-off-by: Shreyas Deodhar <sde...@ma...>
Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Reviewed-by: Himanshu Madhani <him...@or...>
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit 00eca15319d9 upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_bsg.c | 2 ++
 1 file changed, 2 insertions(+)

===================================================================
diff --git a/qla2x00t-32gbit/qla_bsg.c b/qla2x00t-32gbit/qla_bsg.c
index 25de9fb..cc8c98d 100644
--- a/qla2x00t-32gbit/qla_bsg.c
+++ b/qla2x00t-32gbit/qla_bsg.c
@@ -3000,6 +3000,8 @@ qla24xx_bsg_request(BSG_JOB_TYPE *bsg_job)
 
 	if (bsg_request->msgcode == FC_BSG_RPT_ELS) {
 		rport = fc_bsg_to_rport(bsg_job);
+		if (!rport)
+			return ret;
 		host = rport_to_shost(rport);
 		vha = shost_priv(host);
 	} else {

[Scst-svn] [master] qla2x00t-32gbit: Fix buffer overrun

[Gleb C. <lna...@ya...>]

Commit: beabef8
GitHub URL: https://github.com/SCST-project/scst/commit/beabef8afc73404ec92255e7a955cd1d64ba539e
Author: Gleb Chesnokov
Date: 2023-07-19T11:45:31+03:00
Log Message:
-----------
qla2x00t-32gbit: Fix buffer overrun

Klocwork warning: Buffer Overflow - Array Index Out of Bounds

Driver uses fc_els_flogi to calculate size of buffer.  The actual buffer is
nested inside of fc_els_flogi which is smaller.

Replace structure name to allow proper size calculation.

Cc: st...@vg...
Signed-off-by: Quinn Tran <qu...@ma...>
Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Reviewed-by: Himanshu Madhani <him...@or...>
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit b68710a8094f upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_init.c b/qla2x00t-32gbit/qla_init.c
index 3a5edf3..88da7b5 100644
--- a/qla2x00t-32gbit/qla_init.c
+++ b/qla2x00t-32gbit/qla_init.c
@@ -5552,7 +5552,7 @@ static void qla_get_login_template(scsi_qla_host_t *vha)
 	__be32 *q;
 
 	memset(ha->init_cb, 0, ha->init_cb_size);
-	sz = min_t(int, sizeof(struct fc_els_flogi), ha->init_cb_size);
+	sz = min_t(int, sizeof(struct fc_els_csp), ha->init_cb_size);
 	rval = qla24xx_get_port_login_templ(vha, ha->init_cb_dma,
 					    ha->init_cb, sz);
 	if (rval != QLA_SUCCESS) {

[Scst-svn] [master] qla2x00t-32gbit: Check valid rport returned by fc_bsg_to_rport()

[Gleb C. <lna...@ya...>]

Commit: a1edff6
GitHub URL: https://github.com/SCST-project/scst/commit/a1edff66778872c41289926c064566e55310dc61
Author: Gleb Chesnokov
Date: 2023-07-19T11:45:31+03:00
Log Message:
-----------
qla2x00t-32gbit: Check valid rport returned by fc_bsg_to_rport()

Klocwork reported warning of rport maybe NULL and will be dereferenced.
rport returned by call to fc_bsg_to_rport() could be NULL and dereferenced.

Check valid rport returned by fc_bsg_to_rport().

Cc: st...@vg...
Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Reviewed-by: Himanshu Madhani <him...@or...>
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit af73f23a2720 upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_bsg.c | 4 ++++
 1 file changed, 4 insertions(+)

===================================================================
diff --git a/qla2x00t-32gbit/qla_bsg.c b/qla2x00t-32gbit/qla_bsg.c
index 8e0f44c..25de9fb 100644
--- a/qla2x00t-32gbit/qla_bsg.c
+++ b/qla2x00t-32gbit/qla_bsg.c
@@ -286,6 +286,10 @@ qla2x00_process_els(BSG_JOB_TYPE *bsg_job)
 
 	if (bsg_request->msgcode == FC_BSG_RPT_ELS) {
 		rport = fc_bsg_to_rport(bsg_job);
+		if (!rport) {
+			rval = -ENOMEM;
+			goto done;
+		}
 		fcport = *(fc_port_t **) rport->dd_data;
 		host = rport_to_shost(rport);
 		vha = shost_priv(host);

[Scst-svn] [master] qla2x00t-32gbit: Avoid fcport pointer dereference

[Gleb C. <lna...@ya...>]

Commit: bb18381
GitHub URL: https://github.com/SCST-project/scst/commit/bb18381819785f93e24d7b6f12a727579ef63148
Author: Gleb Chesnokov
Date: 2023-07-19T11:45:31+03:00
Log Message:
-----------
qla2x00t-32gbit: Avoid fcport pointer dereference

Klocwork reported warning of NULL pointer may be dereferenced.  The routine
exits when sa_ctl is NULL and fcport is allocated after the exit call thus
causing NULL fcport pointer to dereference at the time of exit.

To avoid fcport pointer dereference, exit the routine when sa_ctl is NULL.

Cc: st...@vg...
Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Reviewed-by: Himanshu Madhani <him...@or...>
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit 6b504d06976f upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_edif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_edif.c b/qla2x00t-32gbit/qla_edif.c
index 9e0fd61..96b45f6 100644
--- a/qla2x00t-32gbit/qla_edif.c
+++ b/qla2x00t-32gbit/qla_edif.c
@@ -2362,8 +2362,8 @@ qla24xx_issue_sa_replace_iocb(scsi_qla_host_t *vha, struct qla_work_evt *e)
 	if (!sa_ctl) {
 		ql_dbg(ql_dbg_edif, vha, 0x70e6,
 		    "sa_ctl allocation failed\n");
-		rval =  -ENOMEM;
-		goto done;
+		rval = -ENOMEM;
+		return rval;
 	}
 
 	fcport = sa_ctl->fcport;

[Scst-svn] [master] qla2x00t-32gbit: Fix potential NULL pointer dereference

[Gleb C. <lna...@ya...>]

Commit: 0367c33
GitHub URL: https://github.com/SCST-project/scst/commit/0367c334c36aec8561218cfbab539160be993c66
Author: Gleb Chesnokov
Date: 2023-07-19T11:35:51+03:00
Log Message:
-----------
qla2x00t-32gbit: Fix potential NULL pointer dereference

Klocwork tool reported 'cur_dsd' may be dereferenced.  Add fix to validate
pointer before dereferencing the pointer.

Cc: st...@vg...
Signed-off-by: Bikash Hazarika <bha...@ma...>
Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Reviewed-by: Himanshu Madhani <him...@or...>
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit 464ea494a40c upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_iocb.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_iocb.c b/qla2x00t-32gbit/qla_iocb.c
index 2742d37..bdf505a 100644
--- a/qla2x00t-32gbit/qla_iocb.c
+++ b/qla2x00t-32gbit/qla_iocb.c
@@ -613,7 +613,8 @@ qla24xx_build_scsi_type_6_iocbs(srb_t *sp, struct cmd_type_6 *cmd_pkt,
 	put_unaligned_le32(COMMAND_TYPE_6, &cmd_pkt->entry_type);
 
 	/* No data transfer */
-	if (!scsi_bufflen(cmd) || cmd->sc_data_direction == DMA_NONE) {
+	if (!scsi_bufflen(cmd) || cmd->sc_data_direction == DMA_NONE ||
+	    tot_dsds == 0) {
 		cmd_pkt->byte_count = cpu_to_le32(0);
 		return 0;
 	}

[Scst-svn] [master] qla2x00t-32gbit: Array index may go out of bound

[Gleb C. <lna...@ya...>]

Commit: 0b9f73b
GitHub URL: https://github.com/SCST-project/scst/commit/0b9f73b1d8dc3739dccd729329232f5ecbf8c201
Author: Gleb Chesnokov
Date: 2023-07-19T11:35:51+03:00
Log Message:
-----------
qla2x00t-32gbit: Array index may go out of bound

Klocwork reports array 'vha->host_str' of size 16 may use index value(s)
16..19.  Use snprintf() instead of sprintf().

Cc: st...@vg...
Co-developed-by: Bikash Hazarika <bha...@ma...>
Signed-off-by: Bikash Hazarika <bha...@ma...>
Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Reviewed-by: Himanshu Madhani <him...@or...>
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit d721b591b95c upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_os.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_os.c b/qla2x00t-32gbit/qla_os.c
index 7bd76e8..d83151d 100644
--- a/qla2x00t-32gbit/qla_os.c
+++ b/qla2x00t-32gbit/qla_os.c
@@ -5151,7 +5151,8 @@ struct scsi_qla_host *qla2x00_create_host(const struct scsi_host_template *sht,
 	}
 	INIT_DELAYED_WORK(&vha->scan.scan_work, qla_scan_work_fn);
 
-	sprintf(vha->host_str, "%s_%lu", QLA2XXX_DRIVER_NAME, vha->host_no);
+	snprintf(vha->host_str, sizeof(vha->host_str), "%s_%lu",
+		 QLA2XXX_DRIVER_NAME, vha->host_no);
 	ql_dbg(ql_dbg_init, vha, 0x0041,
 	    "Allocated the host=%p hw=%p vha=%p dev_name=%s",
 	    vha->host, vha->hw, vha,

[Scst-svn] [master] qla2x00t-32gbit: Drop useless LIST_HEAD

[Gleb C. <lna...@ya...>]

Commit: 6aff6bf
GitHub URL: https://github.com/SCST-project/scst/commit/6aff6bfacb0188b6627d79e0d09acab8a5552bdd
Author: Gleb Chesnokov
Date: 2023-07-19T11:35:51+03:00
Log Message:
-----------
qla2x00t-32gbit: Drop useless LIST_HEAD

'new_fcports' is unused, so drop it.

Signed-off-by: Christophe JAILLET <chr...@wa...>
Link: https://lore.kernel.org/r/49b...@wa...
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit 022000d3f586 upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_init.c | 1 -
 1 file changed, 1 deletion(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_init.c b/qla2x00t-32gbit/qla_init.c
index 69719b6..3a5edf3 100644
--- a/qla2x00t-32gbit/qla_init.c
+++ b/qla2x00t-32gbit/qla_init.c
@@ -6223,7 +6223,6 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
 	fc_port_t	*fcport;
 	uint16_t	mb[MAILBOX_REGISTER_COUNT];
 	uint16_t	loop_id;
-	LIST_HEAD(new_fcports);
 	struct qla_hw_data *ha = vha->hw;
 	int		discovery_gen;

[Scst-svn] [master] qla2x00t-32gbit: Backport to older kernel versions

[Gleb C. <lna...@ya...>]

Commit: d74330a
GitHub URL: https://github.com/SCST-project/scst/commit/d74330aed223228e2051050ae1875d3c5a78ebeb
Author: Gleb Chesnokov
Date: 2023-07-19T11:35:51+03:00
Log Message:
-----------
qla2x00t-32gbit: Backport to older kernel versions

Unbreak the build for the previous commit against kernel versions
before v5.16.

See also commit 3080ea5553cc ("stddef: Introduce DECLARE_FLEX_ARRAY()
helper") # v5.16.

Modified Paths:
--------------
 scst/include/backport.h | 8 ++++++++
 1 file changed, 8 insertions(+)

===================================================================
diff --git a/scst/include/backport.h b/scst/include/backport.h
index 4e693ae..f4fc281 100644
--- a/scst/include/backport.h
+++ b/scst/include/backport.h
@@ -1314,6 +1314,14 @@ static inline void __user *KERNEL_SOCKPTR(void *p)
 #define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER))
 #endif
 
+#ifndef DECLARE_FLEX_ARRAY
+#define DECLARE_FLEX_ARRAY(TYPE, NAME)	\
+	struct { \
+		struct { } __empty_ ## NAME; \
+		TYPE NAME[]; \
+	}
+#endif
+
 /* <linux/string.h> */
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 5, 0) &&	\

[Scst-svn] [master] qla2x00t-32gbit: Replace one-element array with DECLARE_FLEX_ARRAY() helper

[Gleb C. <lna...@ya...>]

Commit: cba2284
GitHub URL: https://github.com/SCST-project/scst/commit/cba2284cd167a62bb5d57b13af9f26573cf27a8a
Author: Gleb Chesnokov
Date: 2023-07-19T11:35:51+03:00
Log Message:
-----------
qla2x00t-32gbit: Replace one-element array with DECLARE_FLEX_ARRAY() helper

One-element arrays as fake flex arrays are deprecated and we are moving
towards adopting C99 flexible-array members, instead. So, replace
one-element array declaration in struct ct_sns_gpnft_rsp, which is
ultimately being used inside a union:

drivers/scsi/qla2xxx/qla_def.h:
3240 struct ct_sns_gpnft_pkt {
3241         union {
3242                 struct ct_sns_req req;
3243                 struct ct_sns_gpnft_rsp rsp;
3244         } p;
3245 };

Refactor the rest of the code, accordingly.

This issue was found with the help of Coccinelle.

Link: https://github.com/KSPP/linux/issues/245
Link: https://github.com/KSPP/linux/issues/193
Reviewed-by: Kees Cook <kee...@ch...>
Signed-off-by: Gustavo A. R. Silva <gus...@ke...>
Link: https://lore.kernel.org/r/ZH+/rZ1R1cBjIxjS@work
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit 512a365368c7 upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_def.h | 4 ++--
 qla2x00t-32gbit/qla_gs.c  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_def.h b/qla2x00t-32gbit/qla_def.h
index 433d9a8..4a496a6 100644
--- a/qla2x00t-32gbit/qla_def.h
+++ b/qla2x00t-32gbit/qla_def.h
@@ -3226,12 +3226,12 @@ struct ct_sns_gpnft_rsp {
 		uint8_t vendor_unique;
 	};
 	/* Assume the largest number of targets for the union */
-	struct ct_sns_gpn_ft_data {
+	DECLARE_FLEX_ARRAY(struct ct_sns_gpn_ft_data {
 		u8 control_byte;
 		u8 port_id[3];
 		u32 reserved;
 		u8 port_name[8];
-	} entries[1];
+	}, entries);
 };
 
 /* CT command response */
diff --git a/qla2x00t-32gbit/qla_gs.c b/qla2x00t-32gbit/qla_gs.c
index 4738f89..1cf9d20 100644
--- a/qla2x00t-32gbit/qla_gs.c
+++ b/qla2x00t-32gbit/qla_gs.c
@@ -3776,8 +3776,8 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
 		sp->u.iocb_cmd.u.ctarg.req_size = GPN_FT_REQ_SIZE;
 
 		rspsz = sizeof(struct ct_sns_gpnft_rsp) +
-			((vha->hw->max_fibre_devices - 1) *
-			    sizeof(struct ct_sns_gpn_ft_data));
+			vha->hw->max_fibre_devices *
+			    sizeof(struct ct_sns_gpn_ft_data);
 
 		sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
 								rspsz,

[Scst-svn] [master] qla2x00t-32gbit: Fix end of loop test

[Gleb C. <lna...@ya...>]

Commit: d26ab07
GitHub URL: https://github.com/SCST-project/scst/commit/d26ab07ae97c9a877fefb3badb5a2dba03bb15cd
Author: Gleb Chesnokov
Date: 2023-07-19T11:35:51+03:00
Log Message:
-----------
qla2x00t-32gbit: Fix end of loop test

This loop will exit successfully when "found" is false or in the failure
case it times out with "wait_iter" set to -1.  The test for timeouts is
impossible as is.

Fixes: b843adde8d49 ("scsi: qla2xxx: Fix mem access after free")
Signed-off-by: Dan Carpenter <dan...@li...>
Link: https://lore.kernel.org/r/cea...@ki...untain
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit 339020091e24 upstrema ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_os.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_os.c b/qla2x00t-32gbit/qla_os.c
index e08ddac..7bd76e8 100644
--- a/qla2x00t-32gbit/qla_os.c
+++ b/qla2x00t-32gbit/qla_os.c
@@ -1450,7 +1450,7 @@ __qla2x00_eh_wait_for_pending_commands(struct qla_qpair *qpair, unsigned int t,
 			break;
 	}
 
-	if (!wait_iter && found)
+	if (wait_iter == -1)
 		status = QLA_FUNCTION_FAILED;
 
 	return status;

[Scst-svn] [master] qla2x00t-32gbit: Update version to 10.02.08.300-k

[Gleb C. <lna...@ya...>]

Commit: ffd578e
GitHub URL: https://github.com/SCST-project/scst/commit/ffd578e720b725d6967d4087c4324a982b4fd7b3
Author: Gleb Chesnokov
Date: 2023-07-19T11:35:51+03:00
Log Message:
-----------
qla2x00t-32gbit: Update version to 10.02.08.300-k

Update version to 10.02.08.300-k.

Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Reviewed-by: Himanshu Madhani <him...@or...>
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit eb91eb809c8d upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_version.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_version.h b/qla2x00t-32gbit/qla_version.h
index 42d69d8..4d6f06f 100644
--- a/qla2x00t-32gbit/qla_version.h
+++ b/qla2x00t-32gbit/qla_version.h
@@ -6,9 +6,9 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "10.02.08.200-k"
+#define QLA2XXX_VERSION      "10.02.08.300-k"
 
 #define QLA_DRIVER_MAJOR_VER	10
 #define QLA_DRIVER_MINOR_VER	2
 #define QLA_DRIVER_PATCH_VER	8
-#define QLA_DRIVER_BETA_VER	200
+#define QLA_DRIVER_BETA_VER	300

[Scst-svn] [master] qla2x00t-32gbit: Wait for io return on terminate rport

[Gleb C. <lna...@ya...>]

Commit: e8a1a2f
GitHub URL: https://github.com/SCST-project/scst/commit/e8a1a2f15ab1f2dce00d35accb3d5cc0b44f8e48
Author: Gleb Chesnokov
Date: 2023-07-19T11:35:51+03:00
Log Message:
-----------
qla2x00t-32gbit: Wait for io return on terminate rport

System crash due to use after free.
Current code allows terminate_rport_io to exit before making
sure all IOs has returned. For FCP-2 device, IO's can hang
on in HW because driver has not tear down the session in FW at
first sign of cable pull. When dev_loss_tmo timer pops,
terminate_rport_io is called and upper layer is about to
free various resources. Terminate_rport_io trigger qla to do
the final cleanup, but the cleanup might not be fast enough where it
leave qla still holding on to the same resource.

Wait for IO's to return to upper layer before resources are freed.

Cc: st...@vg...
Signed-off-by: Quinn Tran <qu...@ma...>
Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Reviewed-by: Himanshu Madhani <him...@or...>
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit fc0cba0c7be8 upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_attr.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

===================================================================
diff --git a/qla2x00t-32gbit/qla_attr.c b/qla2x00t-32gbit/qla_attr.c
index 16b6b5c..c9fc1d7 100644
--- a/qla2x00t-32gbit/qla_attr.c
+++ b/qla2x00t-32gbit/qla_attr.c
@@ -2821,6 +2821,7 @@ static void
 qla2x00_terminate_rport_io(struct fc_rport *rport)
 {
 	fc_port_t *fcport = *(fc_port_t **)rport->dd_data;
+	scsi_qla_host_t *vha;
 
 	if (!fcport)
 		return;
@@ -2830,9 +2831,12 @@ qla2x00_terminate_rport_io(struct fc_rport *rport)
 
 	if (test_bit(ABORT_ISP_ACTIVE, &fcport->vha->dpc_flags))
 		return;
+	vha = fcport->vha;
 
 	if (unlikely(pci_channel_offline(fcport->vha->hw->pdev))) {
 		qla2x00_abort_all_cmds(fcport->vha, DID_NO_CONNECT << 16);
+		qla2x00_eh_wait_for_pending_commands(fcport->vha, fcport->d_id.b24,
+			0, WAIT_TARGET);
 		return;
 	}
 	/*
@@ -2857,6 +2861,15 @@ qla2x00_terminate_rport_io(struct fc_rport *rport)
 			qla2x00_port_logout(fcport->vha, fcport);
 		}
 	}
+
+	/* check for any straggling io left behind */
+	if (qla2x00_eh_wait_for_pending_commands(fcport->vha, fcport->d_id.b24, 0, WAIT_TARGET)) {
+		ql_log(ql_log_warn, vha, 0x300b,
+		       "IO not return.  Resetting. \n");
+		set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+		qla2xxx_wake_dpc(vha);
+		qla2x00_wait_for_chip_reset(vha);
+	}
 }
 
 static int

[Scst-svn] [master] qla2x00t-32gbit: Fix mem access after free

[Gleb C. <lna...@ya...>]

Commit: 284f444
GitHub URL: https://github.com/SCST-project/scst/commit/284f4446e18600e59dc93aefbe948b74dd85eac4
Author: Gleb Chesnokov
Date: 2023-07-19T11:35:51+03:00
Log Message:
-----------
qla2x00t-32gbit: Fix mem access after free

System crash, where driver is accessing scsi layer's
memory (scsi_cmnd->device->host) to search for a well known internal
pointer (vha). The scsi_cmnd was released back to upper layer which
could be freed, but the driver is still accessing it.

7 [ffffa8e8d2c3f8d0] page_fault at ffffffff86c010fe
  [exception RIP: __qla2x00_eh_wait_for_pending_commands+240]
  RIP: ffffffffc0642350  RSP: ffffa8e8d2c3f988  RFLAGS: 00010286
  RAX: 0000000000000165  RBX: 0000000000000002  RCX: 00000000000036d8
  RDX: 0000000000000000  RSI: ffff9c5c56535188  RDI: 0000000000000286
  RBP: ffff9c5bf7aa4a58   R8: ffff9c589aecdb70   R9: 00000000000003d1
  R10: 0000000000000001  R11: 0000000000380000 R12: ffff9c5c5392bc78
  R13: ffff9c57044ff5c0 R14: ffff9c56b5a3aa00  R15: 00000000000006db
  ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
8 [ffffa8e8d2c3f9c8] qla2x00_eh_wait_for_pending_commands at ffffffffc0646dd5 [qla2xxx]
9 [ffffa8e8d2c3fa00] __qla2x00_async_tm_cmd at ffffffffc0658094 [qla2xxx]

Remove access of freed memory. Currently the driver was checking to see if
scsi_done was called by seeing if the sp->type has changed. Instead,
check to see if the command has left the  oustanding_cmds[] array as
sign of scsi_done was called.

Cc: st...@vg...
Signed-off-by: Quinn Tran <qu...@ma...>
Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Reviewed-by: Himanshu Madhani <him...@or...>
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit b843adde8d49 upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_isr.c |  38 ++++-
 qla2x00t-32gbit/qla_os.c  | 130 +++++++--------
 2 files changed, 95 insertions(+), 73 deletions(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_isr.c b/qla2x00t-32gbit/qla_isr.c
index 70a8edd..a238f3f 100644
--- a/qla2x00t-32gbit/qla_isr.c
+++ b/qla2x00t-32gbit/qla_isr.c
@@ -1874,9 +1874,9 @@ qla2x00_process_completed_request(struct scsi_qla_host *vha,
 	}
 }
 
-srb_t *
-qla2x00_get_sp_from_handle(scsi_qla_host_t *vha, const char *func,
-    struct req_que *req, void *iocb)
+static srb_t *
+qla_get_sp_from_handle(scsi_qla_host_t *vha, const char *func,
+		       struct req_que *req, void *iocb, u16 *ret_index)
 {
 	struct qla_hw_data *ha = vha->hw;
 	sts_entry_t *pkt = iocb;
@@ -1911,12 +1911,25 @@ qla2x00_get_sp_from_handle(scsi_qla_host_t *vha, const char *func,
 		return NULL;
 	}
 
-	req->outstanding_cmds[index] = NULL;
-
+	*ret_index = index;
 	qla_put_fw_resources(sp->qpair, &sp->iores);
 	return sp;
 }
 
+srb_t *
+qla2x00_get_sp_from_handle(scsi_qla_host_t *vha, const char *func,
+			   struct req_que *req, void *iocb)
+{
+	uint16_t index;
+	srb_t *sp;
+
+	sp = qla_get_sp_from_handle(vha, func, req, iocb, &index);
+	if (sp)
+		req->outstanding_cmds[index] = NULL;
+
+	return sp;
+}
+
 static void
 qla2x00_mbx_iocb_entry(scsi_qla_host_t *vha, struct req_que *req,
     struct mbx_entry *mbx)
@@ -3260,13 +3273,13 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
 		return;
 	}
 
-	req->outstanding_cmds[handle] = NULL;
 	cp = GET_CMD_SP(sp);
 	if (cp == NULL) {
 		ql_dbg(ql_dbg_io, vha, 0x3018,
 		    "Command already returned (0x%x/%p).\n",
 		    sts->handle, sp);
 
+		req->outstanding_cmds[handle] = NULL;
 		return;
 	}
 
@@ -3537,6 +3550,9 @@ out:
 
 	if (rsp->status_srb == NULL)
 		sp->done(sp, res);
+
+	/* for io's, clearing of outstanding_cmds[handle] means scsi_done was called */
+	req->outstanding_cmds[handle] = NULL;
 }
 
 /**
@@ -3613,6 +3629,7 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
 	uint16_t que = MSW(pkt->handle);
 	struct req_que *req = NULL;
 	int res = DID_ERROR << 16;
+	u16 index;
 
 	ql_dbg(ql_dbg_async, vha, 0x502a,
 	    "iocb type %xh with error status %xh, handle %xh, rspq id %d\n",
@@ -3631,7 +3648,6 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
 
 	switch (pkt->entry_type) {
 	case NOTIFY_ACK_TYPE:
-	case STATUS_TYPE:
 	case STATUS_CONT_TYPE:
 	case LOGINOUT_PORT_IOCB_TYPE:
 	case CT_IOCB_TYPE:
@@ -3651,6 +3667,14 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
 	case CTIO_TYPE7:
 	case CTIO_CRC2:
 		return 1;
+	case STATUS_TYPE:
+		sp = qla_get_sp_from_handle(vha, func, req, pkt, &index);
+		if (sp) {
+			sp->done(sp, res);
+			req->outstanding_cmds[index] = NULL;
+			return 0;
+		}
+		break;
 	}
 fatal:
 	ql_log(ql_log_warn, vha, 0x5030,
diff --git a/qla2x00t-32gbit/qla_os.c b/qla2x00t-32gbit/qla_os.c
index 490568e..e08ddac 100644
--- a/qla2x00t-32gbit/qla_os.c
+++ b/qla2x00t-32gbit/qla_os.c
@@ -1119,43 +1119,6 @@ qc24_fail_command:
 	return 0;
 }
 
-/*
- * qla2x00_eh_wait_on_command
- *    Waits for the command to be returned by the Firmware for some
- *    max time.
- *
- * Input:
- *    cmd = Scsi Command to wait on.
- *
- * Return:
- *    Completed in time : QLA_SUCCESS
- *    Did not complete in time : QLA_FUNCTION_FAILED
- */
-static int
-qla2x00_eh_wait_on_command(struct scsi_cmnd *cmd)
-{
-#define ABORT_POLLING_PERIOD	1000
-#define ABORT_WAIT_ITER		((2 * 1000) / (ABORT_POLLING_PERIOD))
-	unsigned long wait_iter = ABORT_WAIT_ITER;
-	scsi_qla_host_t *vha = shost_priv(cmd->device->host);
-	struct qla_hw_data *ha = vha->hw;
-	srb_t *sp = scsi_cmd_priv(cmd);
-	int ret = QLA_SUCCESS;
-
-	if (unlikely(pci_channel_offline(ha->pdev)) || ha->flags.eeh_busy) {
-		ql_dbg(ql_dbg_taskm, vha, 0x8005,
-		    "Return:eh_wait.\n");
-		return ret;
-	}
-
-	while (sp->type && wait_iter--)
-		msleep(ABORT_POLLING_PERIOD);
-	if (sp->type)
-		ret = QLA_FUNCTION_FAILED;
-
-	return ret;
-}
-
 /*
  * qla2x00_wait_for_hba_online
  *    Wait till the HBA is online after going through
@@ -1406,6 +1369,9 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
 	return ret;
 }
 
+#define ABORT_POLLING_PERIOD	1000
+#define ABORT_WAIT_ITER		((2 * 1000) / (ABORT_POLLING_PERIOD))
+
 /*
  * Returns: QLA_SUCCESS or QLA_FUNCTION_FAILED.
  */
@@ -1419,41 +1385,73 @@ __qla2x00_eh_wait_for_pending_commands(struct qla_qpair *qpair, unsigned int t,
 	struct req_que *req = qpair->req;
 	srb_t *sp;
 	struct scsi_cmnd *cmd;
+	unsigned long wait_iter = ABORT_WAIT_ITER;
+	bool found;
+	struct qla_hw_data *ha = vha->hw;
 
 	status = QLA_SUCCESS;
 
-	spin_lock_irqsave(qpair->qp_lock_ptr, flags);
-	for (cnt = 1; status == QLA_SUCCESS &&
-		cnt < req->num_outstanding_cmds; cnt++) {
-		sp = req->outstanding_cmds[cnt];
-		if (!sp)
-			continue;
-		if (sp->type != SRB_SCSI_CMD)
-			continue;
-		if (vha->vp_idx != sp->vha->vp_idx)
-			continue;
-		match = 0;
-		cmd = GET_CMD_SP(sp);
-		switch (type) {
-		case WAIT_HOST:
-			match = 1;
-			break;
-		case WAIT_TARGET:
-			match = cmd->device->id == t;
-			break;
-		case WAIT_LUN:
-			match = (cmd->device->id == t &&
-				cmd->device->lun == l);
-			break;
-		}
-		if (!match)
-			continue;
+	while (wait_iter--) {
+		found = false;
 
-		spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
-		status = qla2x00_eh_wait_on_command(cmd);
 		spin_lock_irqsave(qpair->qp_lock_ptr, flags);
+		for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) {
+			sp = req->outstanding_cmds[cnt];
+			if (!sp)
+				continue;
+			if (sp->type != SRB_SCSI_CMD)
+				continue;
+			if (vha->vp_idx != sp->vha->vp_idx)
+				continue;
+			match = 0;
+			cmd = GET_CMD_SP(sp);
+			switch (type) {
+			case WAIT_HOST:
+				match = 1;
+				break;
+			case WAIT_TARGET:
+				if (sp->fcport)
+					match = sp->fcport->d_id.b24 == t;
+				else
+					match = 0;
+				break;
+			case WAIT_LUN:
+				if (sp->fcport)
+					match = (sp->fcport->d_id.b24 == t &&
+						cmd->device->lun == l);
+				else
+					match = 0;
+				break;
+			}
+			if (!match)
+				continue;
+
+			spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+
+			if (unlikely(pci_channel_offline(ha->pdev)) ||
+			    ha->flags.eeh_busy) {
+				ql_dbg(ql_dbg_taskm, vha, 0x8005,
+				    "Return:eh_wait.\n");
+				return status;
+			}
+
+			/*
+			 * SRB_SCSI_CMD is still in the outstanding_cmds array.
+			 * it means scsi_done has not called. Wait for it to
+			 * clear from outstanding_cmds.
+			 */
+			msleep(ABORT_POLLING_PERIOD);
+			spin_lock_irqsave(qpair->qp_lock_ptr, flags);
+			found = true;
+		}
+		spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+
+		if (!found)
+			break;
 	}
-	spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+
+	if (!wait_iter && found)
+		status = QLA_FUNCTION_FAILED;
 
 	return status;
 }

[Scst-svn] [master] qla2x00t-32gbit: Fix hang in task management

[Gleb C. <lna...@ya...>]

Commit: 7db9f41
GitHub URL: https://github.com/SCST-project/scst/commit/7db9f41baecd437c169cb0c81b299e1bc23146a7
Author: Gleb Chesnokov
Date: 2023-07-19T11:35:51+03:00
Log Message:
-----------
qla2x00t-32gbit: Fix hang in task management

Task management command hangs where a side
band chip reset failed to nudge the TMF
from it's current send path.

Add additional error check to block TMF
from entering during chip reset and along
the TMF path to cause it to bail out, skip
over abort of marker.

Cc: st...@vg...
Signed-off-by: Quinn Tran <qu...@ma...>
Signed-off-by: Nilesh Javali <nj...@ma...>
Link: https://lore.kernel.org/r/202...@ma...
Reviewed-by: Himanshu Madhani <him...@or...>
Signed-off-by: Martin K. Petersen <mar...@or...>
[ commit 9ae615c5bfd3 upstream ]

Modified Paths:
--------------
 qla2x00t-32gbit/qla_def.h  |  4 +
 qla2x00t-32gbit/qla_init.c | 60 ++++++++++++++-
 2 files changed, 61 insertions(+), 3 deletions(-)

===================================================================
diff --git a/qla2x00t-32gbit/qla_def.h b/qla2x00t-32gbit/qla_def.h
index 01c84e2..433d9a8 100644
--- a/qla2x00t-32gbit/qla_def.h
+++ b/qla2x00t-32gbit/qla_def.h
@@ -5568,4 +5568,8 @@ struct ql_vnd_tgt_stats_resp {
 	_fp->disc_state, _fp->scan_state, _fp->loop_id, _fp->deleted, \
 	_fp->flags
 
+#define TMF_NOT_READY(_fcport) \
+	(!_fcport || IS_SESSION_DELETED(_fcport) || atomic_read(&_fcport->state) != FCS_ONLINE || \
+	!_fcport->vha->hw->flags.fw_started)
+
 #endif
diff --git a/qla2x00t-32gbit/qla_init.c b/qla2x00t-32gbit/qla_init.c
index dc17acd..69719b6 100644
--- a/qla2x00t-32gbit/qla_init.c
+++ b/qla2x00t-32gbit/qla_init.c
@@ -1996,6 +1996,11 @@ qla2x00_tmf_iocb_timeout(void *data)
 	int rc, h;
 	unsigned long flags;
 
+	if (sp->type == SRB_MARKER) {
+		complete(&tmf->u.tmf.comp);
+		return;
+	}
+
 	rc = qla24xx_async_abort_cmd(sp, false);
 	if (rc) {
 		spin_lock_irqsave(sp->qpair->qp_lock_ptr, flags);
@@ -2023,6 +2028,7 @@ static void qla_marker_sp_done(srb_t *sp, int res)
 		    sp->handle, sp->fcport->d_id.b24, sp->u.iocb_cmd.u.tmf.flags,
 		    sp->u.iocb_cmd.u.tmf.lun, sp->qpair->id);
 
+	sp->u.iocb_cmd.u.tmf.data = res;
 	complete(&tmf->u.tmf.comp);
 }
 
@@ -2039,6 +2045,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
 	} while (cnt); \
 }
 
+/**
+ * qla26xx_marker: send marker IOCB and wait for the completion of it.
+ * @arg: pointer to argument list.
+ *    It is assume caller will provide an fcport pointer and modifier
+ */
 static int
 qla26xx_marker(struct tmf_arg *arg)
 {
@@ -2048,6 +2059,14 @@ qla26xx_marker(struct tmf_arg *arg)
 	int rval = QLA_FUNCTION_FAILED;
 	fc_port_t *fcport = arg->fcport;
 
+	if (TMF_NOT_READY(arg->fcport)) {
+		ql_dbg(ql_dbg_taskm, vha, 0x8039,
+		    "FC port not ready for marker loop-id=%x portid=%06x modifier=%x lun=%lld qp=%d.\n",
+		    fcport->loop_id, fcport->d_id.b24,
+		    arg->modifier, arg->lun, arg->qpair->id);
+		return QLA_SUSPENDED;
+	}
+
 	/* ref: INIT */
 	sp = qla2xxx_get_qpair_sp(vha, arg->qpair, fcport, GFP_KERNEL);
 	if (!sp)
@@ -2074,11 +2093,19 @@ qla26xx_marker(struct tmf_arg *arg)
 
 	if (rval != QLA_SUCCESS) {
 		ql_log(ql_log_warn, vha, 0x8031,
-		    "Marker IOCB failed (%x).\n", rval);
+		    "Marker IOCB send failure (%x).\n", rval);
 		goto done_free_sp;
 	}
 
 	wait_for_completion(&tm_iocb->u.tmf.comp);
+	rval = tm_iocb->u.tmf.data;
+
+	if (rval != QLA_SUCCESS) {
+		ql_log(ql_log_warn, vha, 0x8019,
+		    "Marker failed hdl=%x loop-id=%x portid=%06x modifier=%x lun=%lld qp=%d rval %d.\n",
+		    sp->handle, fcport->loop_id, fcport->d_id.b24,
+		    arg->modifier, arg->lun, sp->qpair->id, rval);
+	}
 
 done_free_sp:
 	/* ref: INIT */
@@ -2091,6 +2118,8 @@ static void qla2x00_tmf_sp_done(srb_t *sp, int res)
 {
 	struct srb_iocb *tmf = &sp->u.iocb_cmd;
 
+	if (res)
+		tmf->u.tmf.data = res;
 	complete(&tmf->u.tmf.comp);
 }
 
@@ -2104,6 +2133,14 @@ __qla2x00_async_tm_cmd(struct tmf_arg *arg)
 
 	fc_port_t *fcport = arg->fcport;
 
+	if (TMF_NOT_READY(arg->fcport)) {
+		ql_dbg(ql_dbg_taskm, vha, 0x8032,
+		    "FC port not ready for TM command loop-id=%x portid=%06x modifier=%x lun=%lld qp=%d.\n",
+		    fcport->loop_id, fcport->d_id.b24,
+		    arg->modifier, arg->lun, arg->qpair->id);
+		return QLA_SUSPENDED;
+	}
+
 	/* ref: INIT */
 	sp = qla2xxx_get_qpair_sp(vha, arg->qpair, fcport, GFP_KERNEL);
 	if (!sp)
@@ -2178,7 +2215,9 @@ int qla_get_tmf(fc_port_t *fcport)
 		msleep(1);
 
 		spin_lock_irqsave(&ha->tgt.sess_lock, flags);
-		if (fcport->deleted) {
+		if (TMF_NOT_READY(fcport)) {
+			ql_log(ql_log_warn, vha, 0x802c,
+			    "Unable to acquire TM resource due to disruption.\n");
 			rc = EIO;
 			break;
 		}
@@ -2204,7 +2243,10 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
 	struct scsi_qla_host *vha = fcport->vha;
 	struct qla_qpair *qpair;
 	struct tmf_arg a;
-	int i, rval;
+	int i, rval = QLA_SUCCESS;
+
+	if (TMF_NOT_READY(fcport))
+		return QLA_SUSPENDED;
 
 	a.vha = fcport->vha;
 	a.fcport = fcport;
@@ -2223,6 +2265,14 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
 			qpair = vha->hw->queue_pair_map[i];
 			if (!qpair)
 				continue;
+
+			if (TMF_NOT_READY(fcport)) {
+				ql_log(ql_log_warn, vha, 0x8026,
+				    "Unable to send TM due to disruption.\n");
+				rval = QLA_SUSPENDED;
+				break;
+			}
+
 			a.qpair = qpair;
 			a.flags = flags|TCF_NOTMCMD_TO_TARGET;
 			rval = __qla2x00_async_tm_cmd(&a);
@@ -2231,10 +2281,14 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
 		}
 	}
 
+	if (rval)
+		goto bailout;
+
 	a.qpair = vha->hw->base_qpair;
 	a.flags = flags;
 	rval = __qla2x00_async_tm_cmd(&a);
 
+bailout:
 	if (a.modifier == MK_SYNC_ID_LUN)
 		qla_put_tmf(fcport);

[Scst-svn] [master] qla2x00t-32gbit: Backport to older kernel versions

[Gleb C. <lna...@ya...>]

Commit: 7a1d0dd
GitHub URL: https://github.com/SCST-project/scst/commit/7a1d0ddaf53e3b7d709c17140302e1e139185f2c
Author: Gleb Chesnokov
Date: 2023-07-19T11:35:51+03:00
Log Message:
-----------
qla2x00t-32gbit: Backport to older kernel versions

Unbreak the build for the previous commit against kernel versions
before v5.1.

Modified Paths:
--------------
 scst/include/backport.h | 13 +++++++++++++
 1 file changed, 13 insertions(+)

===================================================================
diff --git a/scst/include/backport.h b/scst/include/backport.h
index 80683bc..4e693ae 100644
--- a/scst/include/backport.h
+++ b/scst/include/backport.h
@@ -687,6 +687,19 @@ static inline bool list_entry_in_list(const struct list_head *entry)
 	return !list_empty(entry);
 }
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 1, 0) &&		\
+	(!defined(RHEL_RELEASE_CODE) ||				\
+	 RHEL_RELEASE_CODE -0 < RHEL_RELEASE_VERSION(8, 1))
+/*
+ * See also commit 70b44595eafe ("mm, compaction: use free lists to quickly
+ * locate a migration source") # v5.1.
+ */
+static inline int list_is_first(const struct list_head *list, const struct list_head *head)
+{
+	return list->prev == head;
+}
+#endif
+
 /* <linux/lockdep.h> */
 
 /*