Commit d54820b2 authored by Gleb Chesnokov's avatar Gleb Chesnokov Committed by Martin K. Petersen
Browse files

scsi: qla2xxx: Fix NULL pointer dereference in target mode 



When target mode is enabled, the pci_irq_get_affinity() function may return
a NULL value in qla_mapq_init_qp_cpu_map() due to the qla24xx_enable_msix()
code that handles IRQ settings for target mode. This leads to a crash due
to a NULL pointer dereference.

This patch fixes the issue by adding a check for the NULL value returned by
pci_irq_get_affinity() and introducing a 'cpu_mapped' boolean flag to the
qla_qpair structure, ensuring that the qpair's CPU affinity is updated when
it has not been mapped to a CPU.

Fixes: 1d201c81 ("scsi: qla2xxx: Select qpair depending on which CPU post_cmd() gets called")
Signed-off-by: default avatarGleb Chesnokov <gleb.chesnokov@scst.dev>
Link: https://lore.kernel.org/r/56b416f2-4e0f-b6cf-d6d5-b7c372e3c6a2@scst.dev


Reviewed-by: default avatarHimanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 2a737d3b

drivers/scsi/qla2xxx/qla_def.h

+1 −0
Original line number Diff line number Diff line
@@ -3796,6 +3796,7 @@ struct qla_qpair { 
	uint64_t retry_term_jiff;

	struct qla_tgt_counters tgt_counters;

	uint16_t cpuid;

	bool cpu_mapped;

	struct qla_fw_resources fwres ____cacheline_aligned;

	struct  qla_buf_pool buf_pool;

	u32	cmd_cnt;

drivers/scsi/qla2xxx/qla_init.c

+3 −0
Original line number Diff line number Diff line
@@ -9426,6 +9426,9 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos, 
		qpair->rsp->req = qpair->req;

		qpair->rsp->qpair = qpair;



		if (!qpair->cpu_mapped)

			qla_cpu_update(qpair, raw_smp_processor_id());



		if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) {

			if (ha->fw_attributes & BIT_4)

				qpair->difdix_supported = 1;

drivers/scsi/qla2xxx/qla_inline.h

+3 −0
Original line number Diff line number Diff line
@@ -539,11 +539,14 @@ qla_mapq_init_qp_cpu_map(struct qla_hw_data *ha, 
	if (!ha->qp_cpu_map)

		return;

	mask = pci_irq_get_affinity(ha->pdev, msix->vector_base0);

	if (!mask)

		return;

	qpair->cpuid = cpumask_first(mask);

	for_each_cpu(cpu, mask) {

		ha->qp_cpu_map[cpu] = qpair;

	}

	msix->cpuid = qpair->cpuid;

	qpair->cpu_mapped = true;

}



static inline void

drivers/scsi/qla2xxx/qla_isr.c

+3 −0
Original line number Diff line number Diff line
@@ -3770,6 +3770,9 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha, 


	if (rsp->qpair->cpuid != smp_processor_id() || !rsp->qpair->rcv_intr) {

		rsp->qpair->rcv_intr = 1;



		if (!rsp->qpair->cpu_mapped)

			qla_cpu_update(rsp->qpair, raw_smp_processor_id());

	}



#define __update_rsp_in(_is_shadow_hba, _rsp, _rsp_in)			\