kernel-fxtec-pro1x/drivers/scsi
Javed Hasan 4575845e9c scsi: libfc: Skip additional kref updating work event
[ Upstream commit 823a65409c8990f64c5693af98ce0e7819975cba ]

When an rport event (RPORT_EV_READY) is updated without work being queued,
avoid taking an additional reference.

This issue was leading to memory leak. Trace from KMEMLEAK tool:

  unreferenced object 0xffff8888259e8780 (size 512):
  comm "kworker/2:1", jiffies 4433237386 (age 113021.971s)
    hex dump (first 32 bytes):
	58 0a ec cf 83 88 ff ff 00 00 00 00 00 00 00 00
	01 00 00 00 08 00 00 00 13 7d f0 1e 0e 00 00 10
  backtrace:
  [<000000006b25760f>] fc_rport_recv_req+0x3c6/0x18f0 [libfc]
  [<00000000f208d994>] fc_lport_recv_els_req+0x120/0x8a0 [libfc]
  [<00000000a9c437b8>] fc_lport_recv+0xb9/0x130 [libfc]
  [<00000000a9c437b8>] fc_lport_recv+0xb9/0x130 [libfc]
  [<00000000ad5be37b>] qedf_ll2_process_skb+0x73d/0xad0 [qedf]
  [<00000000e0eb6893>] process_one_work+0x382/0x6c0
  [<000000002dfd9e21>] worker_thread+0x57/0x5c0
  [<00000000b648204f>] kthread+0x1a0/0x1c0
  [<0000000072f5ab20>] ret_from_fork+0x35/0x40
  [<000000001d5c05d8>] 0xffffffffffffffff

Below is the log sequence which leads to memory leak.  Here we get the
RPORT_EV_READY and RPORT_EV_STOP back to back, which lead to overwrite the
event RPORT_EV_READY by event RPORT_EV_STOP.  Because of this, kref_count
gets incremented by 1.

  kernel: host0: rport fffce5: Received PLOGI request
  kernel: host0: rport fffce5: Received PLOGI in INIT state
  kernel: host0: rport fffce5: Port is Ready
  kernel: host0: rport fffce5: Received PRLI request while in state Ready
  kernel: host0: rport fffce5: PRLI rspp type 8 active 1 passive 0
  kernel: host0: rport fffce5: Received LOGO request while in state Ready
  kernel: host0: rport fffce5: Delete port
  kernel: host0: rport fffce5: Received PLOGI request
  kernel: host0: rport fffce5: Received PLOGI in state Delete - send busy
  kernel: host0: rport fffce5: work event 3
  kernel: host0: rport fffce5: lld callback ev 3
  kernel: host0: rport fffce5: work delete

Link: https://lore.kernel.org/r/20200626094959.32151-1-jhasan@marvell.com
Reviewed-by: Girish Basrur <gbasrur@marvell.com>
Reviewed-by: Saurav Kashyap <skashyap@marvell.com>
Reviewed-by: Shyam Sundar <ssundar@marvell.com>
Signed-off-by: Javed Hasan <jhasan@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01 13:14:48 +02:00
..
aacraid scsi: aacraid: Fix error handling paths in aac_probe_one() 2020-10-01 13:14:42 +02:00
aic7xxx scsi: aic7xxx: Adjust indentation in ahc_find_syncrate 2020-02-24 08:34:43 +01:00
aic94xx
arcmsr
arm scsi: eesox: Fix different dev_id between request_irq() and free_irq() 2020-08-19 08:14:55 +02:00
be2iscsi
bfa scsi: bfa: release allocated memory in case of error 2020-01-14 20:07:06 +01:00
bnx2fc
bnx2i scsi: bnx2i: fix potential use after free 2020-01-23 08:21:38 +01:00
csiostor scsi: csiostor: Adjust indentation in csio_device_reset 2020-02-11 04:34:12 -08:00
cxgbi scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy() 2020-01-17 19:47:14 +01:00
cxlflash scsi: cxlflash: Fix error return code in cxlflash_probe() 2020-10-01 13:14:45 +02:00
device_handler
dpt
esas2r scsi: esas2r: unlock on error in esas2r_nvram_read_direct() 2020-01-23 08:21:38 +01:00
fcoe scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() 2020-09-03 11:24:22 +02:00
fnic scsi: fnic: fix use after free 2020-10-01 13:14:26 +02:00
hisi_sas scsi: hisi_sas: Check sas_port before using it 2020-06-07 13:17:55 +02:00
ibmvscsi scsi: ibmvscsi: Don't send host info in adapter info MAD after LPM 2020-06-25 15:32:52 +02:00
ibmvscsi_tgt
isci scsi: isci: Change sci_controller_start_task's return type to sci_status 2019-12-01 09:16:28 +01:00
libfc scsi: libfc: Skip additional kref updating work event 2020-10-01 13:14:48 +02:00
libsas scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA 2020-09-17 13:45:23 +02:00
lpfc scsi: lpfc: Fix coverity errors in fmdi attribute handling 2020-10-01 13:14:33 +02:00
megaraid scsi: megaraid_sas: TM command refire leads to controller firmware crash 2020-06-22 09:05:07 +02:00
mpt3sas scsi: mpt3sas: Fix double free warnings 2020-06-25 15:32:55 +02:00
mvsas
osd
pcmcia
pm8001 scsi: pm80xx: Cleanup command when a reset times out 2020-10-01 13:14:28 +02:00
qedf scsi: qedf: Fix crash when MFW calls for protocol stats while function is still probing 2020-06-25 15:32:53 +02:00
qedi scsi: qedi: Fix termination timeouts in session logout 2020-10-01 13:14:42 +02:00
qla2xxx scsi: qla2xxx: Reduce holding sess_lock to prevent CPU lock-up 2020-09-23 12:10:56 +02:00
qla4xxx scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free 2020-02-11 04:34:12 -08:00
smartpqi scsi: smartpqi: fix call trace in device discovery 2020-04-29 16:31:16 +02:00
snic
sym53c8xx_2
ufs scsi: ufs: Fix a race condition in the tracing code 2020-10-01 13:14:30 +02:00
.gitignore
3w-9xxx.c
3w-9xxx.h
3w-sas.c
3w-sas.h
3w-xxxx.c
3w-xxxx.h
53c700.c
53c700.h
53c700.scr
53c700_d.h_shipped
a100u2w.c
a100u2w.h
a2091.c
a2091.h
a3000.c
a3000.h
a4000t.c
advansys.c
aha152x.c
aha152x.h
aha1542.c
aha1542.h
aha1740.c
aha1740.h
am53c974.c
atari_scsi.c scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE 2020-01-04 19:12:56 +01:00
atp870u.c
atp870u.h
BusLogic.c
BusLogic.h
bvme6000_scsi.c
ch.c
constants.c
dc395x.c scsi: dc395x: fix DMA API usage in sg_update_list 2019-12-01 09:16:32 +01:00
dc395x.h
dmx3191d.c
dpt_i2o.c
dpti.h
esp_scsi.c
esp_scsi.h
FlashPoint.c
g_NCR5380.c
gdth.c
gdth.h
gdth_ioctl.h
gdth_proc.c
gdth_proc.h
gvp11.c
gvp11.h
hosts.c
hpsa.c scsi: hpsa: correct race condition in offload enabled 2020-10-01 13:14:40 +02:00
hpsa.h
hpsa_cmd.h
hptiop.c
hptiop.h
imm.c
imm.h
initio.c
initio.h
ipr.c scsi: ipr: Fix softlockup when rescanning devices in petitboot 2020-04-02 15:28:15 +02:00
ipr.h scsi: ipr: Fix softlockup when rescanning devices in petitboot 2020-04-02 15:28:15 +02:00
ips.c scsi: ips: fix missing break in switch 2019-12-01 09:16:26 +01:00
ips.h
iscsi_boot_sysfs.c scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj 2020-06-25 15:33:01 +02:00
iscsi_tcp.c scsi: iscsi: Don't destroy session if there are outstanding connections 2020-02-24 08:34:48 +01:00
iscsi_tcp.h
jazz_esp.c
Kconfig scsi: sr: remove references to BLK_DEV_SR_VENDOR, leave it enabled 2020-07-22 09:32:04 +02:00
lasi700.c
libiscsi.c scsi: iscsi: Fix a potential deadlock in the timeout handler 2019-12-21 10:57:41 +01:00
libiscsi_tcp.c
mac53c94.c
mac53c94.h
mac_esp.c
mac_scsi.c scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE 2020-01-04 19:12:56 +01:00
Makefile
megaraid.c
megaraid.h
mesh.c scsi: mesh: Fix panic after host or bus reset 2020-08-19 08:14:59 +02:00
mesh.h
mvme16x_scsi.c
mvme147.c
mvme147.h
mvumi.c
mvumi.h
ncr53c8xx.c
ncr53c8xx.h
NCR5380.c scsi: NCR5380: Add disconnect_mask module parameter 2020-01-04 19:13:04 +01:00
NCR5380.h
nsp32.c
nsp32.h
nsp32_debug.c
nsp32_io.h
osst.c
osst.h
osst_detect.h
osst_options.h
pmcraid.c
pmcraid.h
ppa.c
ppa.h
ps3rom.c
qla1280.c
qla1280.h
qlogicfas.c
qlogicfas408.c
qlogicfas408.h
qlogicpti.c
qlogicpti.h
raid_class.c
script_asm.pl
scsi.c
scsi.h
scsi_common.c
scsi_debug.c scsi: scsi_debug: Add check for sdebug_max_queue during module init 2020-08-19 08:14:57 +02:00
scsi_debugfs.c
scsi_debugfs.h
scsi_devinfo.c
scsi_dh.c
scsi_error.c
scsi_ioctl.c
scsi_lib.c
scsi_lib_dma.c
scsi_logging.c
scsi_logging.h
scsi_netlink.c
scsi_pm.c
scsi_priv.h
scsi_proc.c
scsi_sas_internal.h
scsi_scan.c
scsi_sysctl.c
scsi_sysfs.c
scsi_trace.c scsi: core: scsi_trace: Use get_unaligned_be*() 2020-01-23 08:21:38 +01:00
scsi_transport_api.h
scsi_transport_fc.c
scsi_transport_iscsi.c scsi: iscsi: Do not put host in iscsi_set_flashnode_param() 2020-09-03 11:24:22 +02:00
scsi_transport_sas.c
scsi_transport_spi.c scsi: scsi_transport_spi: Fix function pointer check 2020-07-29 10:16:45 +02:00
scsi_transport_srp.c
scsicam.c
sd.c scsi: sd: Fix optimal I/O size for devices that change reported values 2020-04-02 15:28:17 +02:00
sd.h
sd_dif.c
sd_zbc.c
sense_codes.h
ses.c
sg.c scsi: sg: add sg_remove_request in sg_write 2020-05-20 08:18:34 +02:00
sgiwd93.c
sim710.c
sni_53c710.c
sr.c scsi: sr: Fix sr_probe() missing deallocate of device minor 2020-06-25 15:32:52 +02:00
sr.h
sr_ioctl.c
sr_vendor.c scsi: sr: remove references to BLK_DEV_SR_VENDOR, leave it enabled 2020-07-22 09:32:04 +02:00
st.c
st.h
st_options.h
stex.c
storvsc_drv.c
sun3_scsi.c scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE 2020-01-04 19:12:56 +01:00
sun3_scsi_vme.c
sun3x_esp.c
sun_esp.c
virtio_scsi.c
vmw_pvscsi.c
vmw_pvscsi.h
wd33c93.c
wd33c93.h
wd719x.c
wd719x.h
xen-scsifront.c
zalon.c
zorro7xx.c
zorro_esp.c scsi: zorro_esp: Limit DMA transfers to 65536 bytes (except on Fastlane) 2019-12-17 20:36:03 +01:00