Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"Four fixes, three for edge conditions which don't occur very often.
The lpfc fix mitigates memory exhaustion for some high CPU systems"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: lpfc: Mitigate high memory pre-allocation by SCSI-MQ
scsi: ufs: Fix NULL pointer dereference in ufshcd_config_vreg_hpm()
scsi: target: tcmu: avoid use-after-free after command timeout
scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure
+49
-7
+1
drivers/scsi/lpfc/lpfc.h
+1
drivers/scsi/lpfc/lpfc.h
+15
drivers/scsi/lpfc/lpfc_attr.c
+15
drivers/scsi/lpfc/lpfc_attr.c
···
5709
5709
"Embed NVME Command in WQE");
5710
5710
5711
5711
/*
5712
+
* lpfc_fcp_mq_threshold: Set the maximum number of Hardware Queues
5713
+
* the driver will advertise it supports to the SCSI layer.
5714
+
*
5715
+
* 0 = Set nr_hw_queues by the number of CPUs or HW queues.
5716
+
* 1,128 = Manually specify the maximum nr_hw_queue value to be set,
5717
+
*
5718
+
* Value range is [0,128]. Default value is 8.
5719
+
*/
5720
+
LPFC_ATTR_R(fcp_mq_threshold, LPFC_FCP_MQ_THRESHOLD_DEF,
5721
+
LPFC_FCP_MQ_THRESHOLD_MIN, LPFC_FCP_MQ_THRESHOLD_MAX,
5722
+
"Set the number of SCSI Queues advertised");
5723
+
5724
+
/*
5712
5725
* lpfc_hdw_queue: Set the number of Hardware Queues the driver
5713
5726
* will advertise it supports to the NVME and SCSI layers. This also
5714
5727
* will map to the number of CQ/WQ pairs the driver will create.
···
6043
6030
&dev_attr_lpfc_cq_poll_threshold,
6044
6031
&dev_attr_lpfc_cq_max_proc_limit,
6045
6032
&dev_attr_lpfc_fcp_cpu_map,
6033
+
&dev_attr_lpfc_fcp_mq_threshold,
6046
6034
&dev_attr_lpfc_hdw_queue,
6047
6035
&dev_attr_lpfc_irq_chann,
6048
6036
&dev_attr_lpfc_suppress_rsp,
···
7126
7112
/* Initialize first burst. Target vs Initiator are different. */
7127
7113
lpfc_nvme_enable_fb_init(phba, lpfc_nvme_enable_fb);
7128
7114
lpfc_nvmet_fb_size_init(phba, lpfc_nvmet_fb_size);
7115
+
lpfc_fcp_mq_threshold_init(phba, lpfc_fcp_mq_threshold);
7129
7116
lpfc_hdw_queue_init(phba, lpfc_hdw_queue);
7130
7117
lpfc_irq_chann_init(phba, lpfc_irq_chann);
7131
7118
lpfc_enable_bbcr_init(phba, lpfc_enable_bbcr);
+6
-4
drivers/scsi/lpfc/lpfc_init.c
+6
-4
drivers/scsi/lpfc/lpfc_init.c
···
4309
4309
shost->max_cmd_len = 16;
4310
4310
4311
4311
if (phba->sli_rev == LPFC_SLI_REV4) {
4312
-
if (phba->cfg_fcp_io_sched == LPFC_FCP_SCHED_BY_HDWQ)
4313
-
shost->nr_hw_queues = phba->cfg_hdw_queue;
4314
-
else
4315
-
shost->nr_hw_queues = phba->sli4_hba.num_present_cpu;
4312
+
if (!phba->cfg_fcp_mq_threshold ||
4313
+
phba->cfg_fcp_mq_threshold > phba->cfg_hdw_queue)
4314
+
phba->cfg_fcp_mq_threshold = phba->cfg_hdw_queue;
4315
+
4316
+
shost->nr_hw_queues = min_t(int, 2 * num_possible_nodes(),
4317
+
phba->cfg_fcp_mq_threshold);
4316
4318
4317
4319
shost->dma_boundary =
4318
4320
phba->sli4_hba.pc_sli4_params.sge_supp_len-1;
+5
drivers/scsi/lpfc/lpfc_sli4.h
+5
drivers/scsi/lpfc/lpfc_sli4.h
···
44
44
#define LPFC_HBA_HDWQ_MAX 128
45
45
#define LPFC_HBA_HDWQ_DEF 0
46
46
47
+
/* FCP MQ queue count limiting */
48
+
#define LPFC_FCP_MQ_THRESHOLD_MIN 0
49
+
#define LPFC_FCP_MQ_THRESHOLD_MAX 128
50
+
#define LPFC_FCP_MQ_THRESHOLD_DEF 8
51
+
47
52
/* Common buffer size to accomidate SCSI and NVME IO buffers */
48
53
#define LPFC_COMMON_IO_BUF_SZ 768
49
54
+2
drivers/scsi/qla2xxx/qla_attr.c
+2
drivers/scsi/qla2xxx/qla_attr.c
+10
-1
drivers/scsi/qla2xxx/qla_os.c
+10
-1
drivers/scsi/qla2xxx/qla_os.c
···
3440
3440
return 0;
3441
3441
3442
3442
probe_failed:
3443
+
if (base_vha->gnl.l) {
3444
+
dma_free_coherent(&ha->pdev->dev, base_vha->gnl.size,
3445
+
base_vha->gnl.l, base_vha->gnl.ldma);
3446
+
base_vha->gnl.l = NULL;
3447
+
}
3448
+
3443
3449
if (base_vha->timer_active)
3444
3450
qla2x00_stop_timer(base_vha);
3445
3451
base_vha->flags.online = 0;
···
3679
3673
if (!atomic_read(&pdev->enable_cnt)) {
3680
3674
dma_free_coherent(&ha->pdev->dev, base_vha->gnl.size,
3681
3675
base_vha->gnl.l, base_vha->gnl.ldma);
3682
-
3676
+
base_vha->gnl.l = NULL;
3683
3677
scsi_host_put(base_vha->host);
3684
3678
kfree(ha);
3685
3679
pci_set_drvdata(pdev, NULL);
···
3718
3712
3719
3713
dma_free_coherent(&ha->pdev->dev,
3720
3714
base_vha->gnl.size, base_vha->gnl.l, base_vha->gnl.ldma);
3715
+
3716
+
base_vha->gnl.l = NULL;
3721
3717
3722
3718
vfree(base_vha->scan.l);
3723
3719
···
4824
4816
"Alloc failed for scan database.\n");
4825
4817
dma_free_coherent(&ha->pdev->dev, vha->gnl.size,
4826
4818
vha->gnl.l, vha->gnl.ldma);
4819
+
vha->gnl.l = NULL;
4827
4820
scsi_remove_host(vha->host);
4828
4821
return NULL;
4829
4822
}
+3
drivers/scsi/ufs/ufshcd.c
+3
drivers/scsi/ufs/ufshcd.c
+7
-2
drivers/target/target_core_user.c
+7
-2
drivers/target/target_core_user.c
···
1132
1132
struct se_cmd *se_cmd = cmd->se_cmd;
1133
1133
struct tcmu_dev *udev = cmd->tcmu_dev;
1134
1134
bool read_len_valid = false;
1135
-
uint32_t read_len = se_cmd->data_length;
1135
+
uint32_t read_len;
1136
1136
1137
1137
/*
1138
1138
* cmd has been completed already from timeout, just reclaim
1139
1139
* data area space and free cmd
1140
1140
*/
1141
-
if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
1141
+
if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
1142
+
WARN_ON_ONCE(se_cmd);
1142
1143
goto out;
1144
+
}
1143
1145
1144
1146
list_del_init(&cmd->queue_entry);
1145
1147
···
1154
1152
goto done;
1155
1153
}
1156
1154
1155
+
read_len = se_cmd->data_length;
1157
1156
if (se_cmd->data_direction == DMA_FROM_DEVICE &&
1158
1157
(entry->hdr.uflags & TCMU_UFLAG_READ_LEN) && entry->rsp.read_len) {
1159
1158
read_len_valid = true;
···
1310
1307
*/
1311
1308
scsi_status = SAM_STAT_CHECK_CONDITION;
1312
1309
list_del_init(&cmd->queue_entry);
1310
+
cmd->se_cmd = NULL;
1313
1311
} else {
1314
1312
list_del_init(&cmd->queue_entry);
1315
1313
idr_remove(&udev->commands, id);
···
2026
2022
2027
2023
idr_remove(&udev->commands, i);
2028
2024
if (!test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
2025
+
WARN_ON(!cmd->se_cmd);
2029
2026
list_del_init(&cmd->queue_entry);
2030
2027
if (err_level == 1) {
2031
2028
/*