Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754097AbdGXKzU (ORCPT ); Mon, 24 Jul 2017 06:55:20 -0400 Received: from Galois.linutronix.de ([146.0.238.70]:35086 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753208AbdGXKzN (ORCPT ); Mon, 24 Jul 2017 06:55:13 -0400 Message-Id: <20170724105255.715647116@linutronix.de> User-Agent: quilt/0.63-1 Date: Mon, 24 Jul 2017 12:52:55 +0200 From: Thomas Gleixner To: LKML Cc: QLogic-Storage-Upstream@qlogic.com, martin.petersen@oracle.com, James Bottomley , linux-scsi , Christoph Hellwig , Sebastian Andrzej Siewior Subject: [patch 0/5] scsi/bnx2*: Plug hotplug race, correct locking and simplify hotplug code Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 916 Lines: 25 The conversion of the cpu hotplug locking to a percpu rwsem does not longer allow recursive locking of the hotplug lock. The BNX2I and BNX2FC drivers install/remove hotplug states with the hotplug lock held. The install/removal code acquired the hotplug lock as well. While looking into this, I noticed an interesting hotplug race in the BNX2FC driver, which could result in dereferencing a NULL pointer or freed and potentially reused memory. The following series addresses these problems and as a final step on top it simplifies the hotplug code in both drivers. Thanks, tglx ---- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 68 ++++++++------------------------------ drivers/scsi/bnx2fc/bnx2fc_hwi.c | 45 ++++++++++++------------- drivers/scsi/bnx2i/bnx2i_init.c | 64 ++++++++--------------------------- include/linux/cpuhotplug.h | 2 - 4 files changed, 53 insertions(+), 126 deletions(-)