https://github.com/torvalds/linux
Revision 69ad4ef868c1fc7609daa235dfa46d28ba7a3ba3 authored by Matt Lupfer on 08 March 2022, 15:27:02 UTC, committed by Martin K. Petersen on 15 March 2022, 03:45:19 UTC
A page fault was encountered in mpt3sas on a LUN reset error path: [ 145.763216] mpt3sas_cm1: Task abort tm failed: handle(0x0002),timeout(30) tr_method(0x0) smid(3) msix_index(0) [ 145.778932] scsi 1:0:0:0: task abort: FAILED scmd(0x0000000024ba29a2) [ 145.817307] scsi 1:0:0:0: attempting device reset! scmd(0x0000000024ba29a2) [ 145.827253] scsi 1:0:0:0: [sg1] tag#2 CDB: Receive Diagnostic 1c 01 01 ff fc 00 [ 145.837617] scsi target1:0:0: handle(0x0002), sas_address(0x500605b0000272b9), phy(0) [ 145.848598] scsi target1:0:0: enclosure logical id(0x500605b0000272b8), slot(0) [ 149.858378] mpt3sas_cm1: Poll ReplyDescriptor queues for completion of smid(0), task_type(0x05), handle(0x0002) [ 149.875202] BUG: unable to handle page fault for address: 00000007fffc445d [ 149.885617] #PF: supervisor read access in kernel mode [ 149.894346] #PF: error_code(0x0000) - not-present page [ 149.903123] PGD 0 P4D 0 [ 149.909387] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 149.917417] CPU: 24 PID: 3512 Comm: scsi_eh_1 Kdump: loaded Tainted: G S O 5.10.89-altav-1 #1 [ 149.934327] Hardware name: DDN 200NVX2 /200NVX2-MB , BIOS ATHG2.2.02.01 09/10/2021 [ 149.951871] RIP: 0010:_base_process_reply_queue+0x4b/0x900 [mpt3sas] [ 149.961889] Code: 0f 84 22 02 00 00 8d 48 01 49 89 fd 48 8d 57 38 f0 0f b1 4f 38 0f 85 d8 01 00 00 49 8b 45 10 45 31 e4 41 8b 55 0c 48 8d 1c d0 <0f> b6 03 83 e0 0f 3c 0f 0f 85 a2 00 00 00 e9 e6 01 00 00 0f b7 ee [ 149.991952] RSP: 0018:ffffc9000f1ebcb8 EFLAGS: 00010246 [ 150.000937] RAX: 0000000000000055 RBX: 00000007fffc445d RCX: 000000002548f071 [ 150.011841] RDX: 00000000ffff8881 RSI: 0000000000000001 RDI: ffff888125ed50d8 [ 150.022670] RBP: 0000000000000000 R08: 0000000000000000 R09: c0000000ffff7fff [ 150.033445] R10: ffffc9000f1ebb68 R11: ffffc9000f1ebb60 R12: 0000000000000000 [ 150.044204] R13: ffff888125ed50d8 R14: 0000000000000080 R15: 34cdc00034cdea80 [ 150.054963] FS: 0000000000000000(0000) GS:ffff88dfaf200000(0000) knlGS:0000000000000000 [ 150.066715] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 150.076078] CR2: 00000007fffc445d CR3: 000000012448a006 CR4: 0000000000770ee0 [ 150.086887] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 150.097670] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 150.108323] PKRU: 55555554 [ 150.114690] Call Trace: [ 150.120497] ? printk+0x48/0x4a [ 150.127049] mpt3sas_scsih_issue_tm.cold.114+0x2e/0x2b3 [mpt3sas] [ 150.136453] mpt3sas_scsih_issue_locked_tm+0x86/0xb0 [mpt3sas] [ 150.145759] scsih_dev_reset+0xea/0x300 [mpt3sas] [ 150.153891] scsi_eh_ready_devs+0x541/0x9e0 [scsi_mod] [ 150.162206] ? __scsi_host_match+0x20/0x20 [scsi_mod] [ 150.170406] ? scsi_try_target_reset+0x90/0x90 [scsi_mod] [ 150.178925] ? blk_mq_tagset_busy_iter+0x45/0x60 [ 150.186638] ? scsi_try_target_reset+0x90/0x90 [scsi_mod] [ 150.195087] scsi_error_handler+0x3a5/0x4a0 [scsi_mod] [ 150.203206] ? __schedule+0x1e9/0x610 [ 150.209783] ? scsi_eh_get_sense+0x210/0x210 [scsi_mod] [ 150.217924] kthread+0x12e/0x150 [ 150.224041] ? kthread_worker_fn+0x130/0x130 [ 150.231206] ret_from_fork+0x1f/0x30 This is caused by mpt3sas_base_sync_reply_irqs() using an invalid reply_q pointer outside of the list_for_each_entry() loop. At the end of the full list traversal the pointer is invalid. Move the _base_process_reply_queue() call inside of the loop. Link: https://lore.kernel.org/r/d625deae-a958-0ace-2ba3-0888dd0a415b@ddn.com Fixes: 711a923c14d9 ("scsi: mpt3sas: Postprocessing of target and LUN reset") Cc: stable@vger.kernel.org Acked-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com> Signed-off-by: Matt Lupfer <mlupfer@ddn.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
1 parent 10af115
Tip revision: 69ad4ef868c1fc7609daa235dfa46d28ba7a3ba3 authored by Matt Lupfer on 08 March 2022, 15:27:02 UTC
scsi: mpt3sas: Page fault in reply q processing
scsi: mpt3sas: Page fault in reply q processing
Tip revision: 69ad4ef
File | Mode | Size |
---|---|---|
bpf | ||
cgroup | ||
configs | ||
debug | ||
dma | ||
entry | ||
events | ||
futex | ||
gcov | ||
irq | ||
kcsan | ||
livepatch | ||
locking | ||
power | ||
printk | ||
rcu | ||
sched | ||
time | ||
trace | ||
.gitignore | -rw-r--r-- | 67 bytes |
Kconfig.freezer | -rw-r--r-- | 92 bytes |
Kconfig.hz | -rw-r--r-- | 1.7 KB |
Kconfig.locks | -rw-r--r-- | 4.9 KB |
Kconfig.preempt | -rw-r--r-- | 4.7 KB |
Makefile | -rw-r--r-- | 5.2 KB |
acct.c | -rw-r--r-- | 15.4 KB |
async.c | -rw-r--r-- | 9.3 KB |
audit.c | -rw-r--r-- | 64.0 KB |
audit.h | -rw-r--r-- | 10.7 KB |
audit_fsnotify.c | -rw-r--r-- | 5.2 KB |
audit_tree.c | -rw-r--r-- | 25.6 KB |
audit_watch.c | -rw-r--r-- | 13.7 KB |
auditfilter.c | -rw-r--r-- | 34.4 KB |
auditsc.c | -rw-r--r-- | 80.5 KB |
backtracetest.c | -rw-r--r-- | 1.9 KB |
bounds.c | -rw-r--r-- | 751 bytes |
capability.c | -rw-r--r-- | 14.8 KB |
cfi.c | -rw-r--r-- | 8.1 KB |
compat.c | -rw-r--r-- | 6.8 KB |
configs.c | -rw-r--r-- | 2.0 KB |
context_tracking.c | -rw-r--r-- | 6.4 KB |
cpu.c | -rw-r--r-- | 65.2 KB |
cpu_pm.c | -rw-r--r-- | 6.1 KB |
crash_core.c | -rw-r--r-- | 11.9 KB |
crash_dump.c | -rw-r--r-- | 1.1 KB |
cred.c | -rw-r--r-- | 24.4 KB |
delayacct.c | -rw-r--r-- | 5.9 KB |
dma.c | -rw-r--r-- | 3.3 KB |
exec_domain.c | -rw-r--r-- | 1.1 KB |
exit.c | -rw-r--r-- | 45.3 KB |
extable.c | -rw-r--r-- | 3.8 KB |
fail_function.c | -rw-r--r-- | 7.0 KB |
fork.c | -rw-r--r-- | 76.9 KB |
freezer.c | -rw-r--r-- | 4.4 KB |
gen_kheaders.sh | -rwxr-xr-x | 3.1 KB |
groups.c | -rw-r--r-- | 4.8 KB |
hung_task.c | -rw-r--r-- | 9.4 KB |
iomem.c | -rw-r--r-- | 4.7 KB |
irq_work.c | -rw-r--r-- | 7.4 KB |
jump_label.c | -rw-r--r-- | 21.4 KB |
kallsyms.c | -rw-r--r-- | 22.2 KB |
kcmp.c | -rw-r--r-- | 5.4 KB |
kcov.c | -rw-r--r-- | 28.2 KB |
kexec.c | -rw-r--r-- | 7.4 KB |
kexec_core.c | -rw-r--r-- | 31.2 KB |
kexec_elf.c | -rw-r--r-- | 11.4 KB |
kexec_file.c | -rw-r--r-- | 33.6 KB |
kexec_internal.h | -rw-r--r-- | 924 bytes |
kheaders.c | -rw-r--r-- | 1.6 KB |
kmod.c | -rw-r--r-- | 5.0 KB |
kprobes.c | -rw-r--r-- | 70.3 KB |
ksysfs.c | -rw-r--r-- | 6.3 KB |
kthread.c | -rw-r--r-- | 41.6 KB |
latencytop.c | -rw-r--r-- | 7.2 KB |
module-internal.h | -rw-r--r-- | 1.2 KB |
module.c | -rw-r--r-- | 121.8 KB |
module_decompress.c | -rw-r--r-- | 5.6 KB |
module_signature.c | -rw-r--r-- | 1.1 KB |
module_signing.c | -rw-r--r-- | 1.1 KB |
notifier.c | -rw-r--r-- | 15.9 KB |
nsproxy.c | -rw-r--r-- | 12.8 KB |
padata.c | -rw-r--r-- | 27.4 KB |
panic.c | -rw-r--r-- | 18.1 KB |
params.c | -rw-r--r-- | 23.1 KB |
pid.c | -rw-r--r-- | 18.2 KB |
pid_namespace.c | -rw-r--r-- | 11.3 KB |
profile.c | -rw-r--r-- | 13.3 KB |
ptrace.c | -rw-r--r-- | 37.5 KB |
range.c | -rw-r--r-- | 3.0 KB |
reboot.c | -rw-r--r-- | 21.5 KB |
regset.c | -rw-r--r-- | 1.9 KB |
relay.c | -rw-r--r-- | 30.0 KB |
resource.c | -rw-r--r-- | 48.9 KB |
resource_kunit.c | -rw-r--r-- | 4.3 KB |
rseq.c | -rw-r--r-- | 10.3 KB |
scftorture.c | -rw-r--r-- | 20.0 KB |
scs.c | -rw-r--r-- | 2.8 KB |
seccomp.c | -rw-r--r-- | 61.9 KB |
signal.c | -rw-r--r-- | 123.0 KB |
smp.c | -rw-r--r-- | 33.5 KB |
smpboot.c | -rw-r--r-- | 11.7 KB |
smpboot.h | -rw-r--r-- | 640 bytes |
softirq.c | -rw-r--r-- | 23.6 KB |
stackleak.c | -rw-r--r-- | 4.1 KB |
stacktrace.c | -rw-r--r-- | 10.4 KB |
static_call.c | -rw-r--r-- | 12.5 KB |
stop_machine.c | -rw-r--r-- | 17.8 KB |
sys.c | -rw-r--r-- | 64.4 KB |
sys_ni.c | -rw-r--r-- | 10.1 KB |
sysctl-test.c | -rw-r--r-- | 10.7 KB |
sysctl.c | -rw-r--r-- | 67.7 KB |
task_work.c | -rw-r--r-- | 4.6 KB |
taskstats.c | -rw-r--r-- | 15.2 KB |
torture.c | -rw-r--r-- | 25.3 KB |
tracepoint.c | -rw-r--r-- | 20.3 KB |
tsacct.c | -rw-r--r-- | 4.8 KB |
ucount.c | -rw-r--r-- | 9.0 KB |
uid16.c | -rw-r--r-- | 5.1 KB |
uid16.h | -rw-r--r-- | 442 bytes |
umh.c | -rw-r--r-- | 15.1 KB |
up.c | -rw-r--r-- | 1.5 KB |
user-return-notifier.c | -rw-r--r-- | 1.3 KB |
user.c | -rw-r--r-- | 5.9 KB |
user_namespace.c | -rw-r--r-- | 35.3 KB |
usermode_driver.c | -rw-r--r-- | 4.3 KB |
utsname.c | -rw-r--r-- | 3.8 KB |
utsname_sysctl.c | -rw-r--r-- | 3.2 KB |
watch_queue.c | -rw-r--r-- | 16.4 KB |
watchdog.c | -rw-r--r-- | 22.4 KB |
watchdog_hld.c | -rw-r--r-- | 7.7 KB |
workqueue.c | -rw-r--r-- | 168.4 KB |
workqueue_internal.h | -rw-r--r-- | 2.4 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...