Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp574858img; Fri, 22 Mar 2019 04:20:53 -0700 (PDT) X-Google-Smtp-Source: APXvYqzvS+g5CXSzSgqjw+7Ji1kts6zvOc7BvaKq/0GJJdjEOZdB+/vHMq37UOQtkryqrqfK7uss X-Received: by 2002:a62:45d2:: with SMTP id n79mr8549598pfi.213.1553253653735; Fri, 22 Mar 2019 04:20:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553253653; cv=none; d=google.com; s=arc-20160816; b=EukWCv9XKC/X1wlu80g2dUts27WcwAkB0MtYXf+Wa7E0gdvelFetn6XqKE/Ktgl3VN des8ns4oQcYrqZzg529XTRe1I4xetm7H0kTd51eJfcnV3p1yPReliv3bjXy3NhXtMH5A G3OlzPRyUS5WPQGcMX2Is9Pnjpp9L5Y8OzjmBAFLAYuk2Ni7zPS3GQ1fDZ+ptZQ1Xzc7 sAp/H9WEqj69SZ0DAroo3/oS6Q+kksH/q8GdJtKGG9japL0BBak6CU7ZQzhkQVrRYlWR qbwgpQXtobHcCgmXnLDPjyboslnyGs6cNJ/ukGWkDGCopquj8iZrwUx+d02LqZl1WEUR t+HQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=0mfQTbL090nAX54gawEPfANb6UvvuoCmWgy/1+Lptr0=; b=klplqo0+9K+UM5miDPO7zgwW0kb/DMZA8Kv25chhYE8YeM+Wl08mXb/QZ/20mj0+8m 3AaBYfhqD0yEZ/nCCah7pD4u1TywgmyfrHmscMkC4XqCjWmSGXtilvy6pjQyKD3R2KlU iQDOfYJBmbPiQR5vwARXHkVLvwhpQNgDF0YB0ZQy8AGzQSnhWhV9bI1XGu0bn5rK2HhQ MrHFTkZ2zta4/ysx4HONCDYP+ZCkFOScdFEGomjZqDFxRGxsxoY28TwnzcRQ39uyTEek dVBUJlF+Dvt6MihtcIvY7kI78C65IcyKvHzHpjhqd7x4WEdhLSJN1DD+jeLzf7P9W5li 2nNQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Zjahru3f; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id i8si6054253pgs.568.2019.03.22.04.20.35; Fri, 22 Mar 2019 04:20:53 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Zjahru3f; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728215AbfCVLTq (ORCPT + 99 others); Fri, 22 Mar 2019 07:19:46 -0400 Received: from mail.kernel.org ([198.145.29.99]:46160 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726667AbfCVLTm (ORCPT ); Fri, 22 Mar 2019 07:19:42 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5D98221925; Fri, 22 Mar 2019 11:19:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553253581; bh=TSBasX7Xy25vf2Kj0KiXSj8MX9/oCC01J0RryT8DDKA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Zjahru3fQB4cEqy45NZV/ybT7ckxIBgNTfvwjxzKnmlkTD2J7w2UugHuK80ngmGTz GN6Y1Pz03iBa8CWad78TlnpTqTgBE6nj9+JO/TGcQru11KYeWK1RiP6Pztab3nLsTf o0muLXvCdjZwMDyXaUVTjkeLzNDWowMzOvr7IMBs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Logan Gunthorpe , Intel SCU Linux support , Artur Paszkiewicz , "James E.J. Bottomley" , "Martin K. Petersen" , Christoph Hellwig , Jens Axboe , Jeff Moyer , Sasha Levin Subject: [PATCH 3.18 012/134] scsi: isci: initialize shost fully before calling scsi_add_host() Date: Fri, 22 Mar 2019 12:13:45 +0100 Message-Id: <20190322111211.015142899@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190322111210.465931067@linuxfoundation.org> References: <20190322111210.465931067@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit cc29a1b0a3f2597ce887d339222fa85b9307706d ] scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates the command size to allocate based on the prot_capabilities. In the isci driver, scsi_host_set_prot() is called after scsi_add_host() so the command size gets calculated to be smaller than it needs to be. Eventually, scsi_mq_init_request() locates the 'prot_sdb' after the command assuming it was sized correctly and a buffer overrun may occur. However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line size, the mistake can go unnoticed. The bug was noticed after the struct request size was reduced by commit 9d037ad707ed ("block: remove req->timeout_list") Which likely reduced the allocated space for the request by an entire cache line, enough that the overflow could be hit and it caused a panic, on boot, at: RIP: 0010:t10_pi_complete+0x77/0x1c0 Call Trace: sd_done+0xf5/0x340 scsi_finish_command+0xc3/0x120 blk_done_softirq+0x83/0xb0 __do_softirq+0xa1/0x2e6 irq_exit+0xbc/0xd0 call_function_single_interrupt+0xf/0x20 sd_done() would call scsi_prot_sg_count() which reads the number of entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of the allocated space it reads a garbage number and erroneously calls t10_pi_complete(). To prevent this, the calls to scsi_host_set_prot() are moved into isci_host_alloc() before the call to scsi_add_host(). Out of caution, also move the similar call to scsi_host_set_guard(). Fixes: 3d2d75254915 ("[SCSI] isci: T10 DIF support") Link: http://lkml.kernel.org/r/da851333-eadd-163a-8c78-e1f4ec5ec857@deltatee.com Signed-off-by: Logan Gunthorpe Cc: Intel SCU Linux support Cc: Artur Paszkiewicz Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Cc: Christoph Hellwig Cc: Jens Axboe Cc: Jeff Moyer Reviewed-by: Jeff Moyer Reviewed-by: Jens Axboe Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/isci/init.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c index 2e890b1e2526b..05b5747b7d418 100644 --- a/drivers/scsi/isci/init.c +++ b/drivers/scsi/isci/init.c @@ -598,6 +598,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id) shost->max_lun = ~0; shost->max_cmd_len = MAX_COMMAND_SIZE; + /* turn on DIF support */ + scsi_host_set_prot(shost, + SHOST_DIF_TYPE1_PROTECTION | + SHOST_DIF_TYPE2_PROTECTION | + SHOST_DIF_TYPE3_PROTECTION); + scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC); + err = scsi_add_host(shost, &pdev->dev); if (err) goto err_shost; @@ -685,13 +692,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto err_host_alloc; } pci_info->hosts[i] = h; - - /* turn on DIF support */ - scsi_host_set_prot(to_shost(h), - SHOST_DIF_TYPE1_PROTECTION | - SHOST_DIF_TYPE2_PROTECTION | - SHOST_DIF_TYPE3_PROTECTION); - scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC); } err = isci_setup_interrupts(pdev); -- 2.19.1