linux/drivers/scsi/isci
Lukasz Dorau c59053a23d [SCSI] isci: correct erroneous for_each_isci_host macro
In the first place, the loop 'for' in the macro 'for_each_isci_host'
(drivers/scsi/isci/host.h:314) is incorrect, because it accesses
the 3rd element of 2 element array. After the 2nd iteration it executes
the instruction:
        ihost = to_pci_info(pdev)->hosts[2]
(while the size of the 'hosts' array equals 2) and reads an
out of range element.

In the second place, this loop is incorrectly optimized by GCC v4.8
(see http://marc.info/?l=linux-kernel&m=138998871911336&w=2).
As a result, on platforms with two SCU controllers,
the loop is executed more times than it can be (for i=0,1 and 2).
It causes kernel panic during entering the S3 state
and the following oops after 'rmmod isci':

BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffff8131360b>] __list_add+0x1b/0xc0
Oops: 0000 [#1] SMP
RIP: 0010:[<ffffffff8131360b>]  [<ffffffff8131360b>] __list_add+0x1b/0xc0
Call Trace:
  [<ffffffff81661b84>] __mutex_lock_slowpath+0x114/0x1b0
  [<ffffffff81661c3f>] mutex_lock+0x1f/0x30
  [<ffffffffa03e97cb>] sas_disable_events+0x1b/0x50 [libsas]
  [<ffffffffa03e9818>] sas_unregister_ha+0x18/0x60 [libsas]
  [<ffffffffa040316e>] isci_unregister+0x1e/0x40 [isci]
  [<ffffffffa0403efd>] isci_pci_remove+0x5d/0x100 [isci]
  [<ffffffff813391cb>] pci_device_remove+0x3b/0xb0
  [<ffffffff813fbf7f>] __device_release_driver+0x7f/0xf0
  [<ffffffff813fc8f8>] driver_detach+0xa8/0xb0
  [<ffffffff813fbb8b>] bus_remove_driver+0x9b/0x120
  [<ffffffff813fcf2c>] driver_unregister+0x2c/0x50
  [<ffffffff813381f3>] pci_unregister_driver+0x23/0x80
  [<ffffffffa04152f8>] isci_exit+0x10/0x1e [isci]
  [<ffffffff810d199b>] SyS_delete_module+0x16b/0x2d0
  [<ffffffff81012a21>] ? do_notify_resume+0x61/0xa0
  [<ffffffff8166ce29>] system_call_fastpath+0x16/0x1b

The loop has been corrected.
This patch fixes kernel panic during entering the S3 state
and the above oops.

Signed-off-by: Lukasz Dorau <lukasz.dorau@intel.com>
Reviewed-by: Maciej Patelczyk <maciej.patelczyk@intel.com>
Tested-by: Lukasz Dorau <lukasz.dorau@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-03-10 12:49:39 +04:00
..
Makefile isci: merge sata.[ch] into request.c 2011-07-03 04:04:52 -07:00
host.c SCSI for-linus on 20121002 2012-10-02 19:01:32 -07:00
host.h [SCSI] isci: correct erroneous for_each_isci_host macro 2014-03-10 12:49:39 +04:00
init.c [SCSI] isci: add CONFIG_PM_SLEEP to suspend/resume functions 2013-04-11 16:01:53 -07:00
isci.h [SCSI] isci: oem parameter format v1.3 (cable select) 2012-01-16 11:43:04 +04:00
phy.c isci: add a couple __iomem annotations 2012-07-03 12:09:32 -07:00
phy.h isci: kill sci_phy_protocol and sci_request_protocol 2012-05-17 12:27:11 -07:00
port.c scsi: fix various printk and comment typos 2012-09-01 08:24:35 -07:00
port.h isci: Manage the link layer hang detect timer for RNC suspensions. 2012-05-17 14:33:36 -07:00
port_config.c [SCSI] isci: fix reset timeout handling 2014-03-10 12:48:16 +04:00
probe_roms.c isci: fix isci_pci_probe() generates warning on efi failure path 2012-07-03 12:09:30 -07:00
probe_roms.h isci: refactor initialization for S3/S4 2012-05-17 12:27:12 -07:00
registers.h isci: Changes in COMSAS timings enabling ISCI to detect buggy disc drives. 2012-05-17 12:27:28 -07:00
remote_device.c [SCSI] sas: unify the pointlessly separated enums sas_dev_type and sas_device_type 2013-05-10 07:47:52 -07:00
remote_device.h [SCSI] sas: unify the pointlessly separated enums sas_dev_type and sas_device_type 2013-05-10 07:47:52 -07:00
remote_node_context.c isci: End the RNC resumption wait when the RNC is destroyed. 2012-05-17 14:33:44 -07:00
remote_node_context.h isci: make function declaration match implementation 2012-07-03 12:09:31 -07:00
remote_node_table.c isci: retire scic_sds_ and scic_ prefixes 2011-07-03 04:04:52 -07:00
remote_node_table.h isci: retire scic_sds_ and scic_ prefixes 2011-07-03 04:04:52 -07:00
request.c [SCSI] isci: fix breakage caused by >16byte CDB patch 2013-07-24 14:18:12 -07:00
request.h isci: Remove obviated host callback list. 2012-05-17 14:33:44 -07:00
sas.h [SCSI] isci: fix support for large smp requests 2011-10-02 13:07:17 -05:00
scu_completion_codes.h isci: Handle all suspending TC completions 2012-05-17 14:33:37 -07:00
scu_event_codes.h isci: uplevel register hardware data structures and unsolicited frame handling 2011-07-03 04:04:47 -07:00
scu_remote_node_context.h isci: move remote_device handling out of the core 2011-07-03 04:00:38 -07:00
scu_task_context.h [SCSI] isci: T10 DIF support 2012-02-19 09:14:24 -06:00
task.c [SCSI] isci: fix reset timeout handling 2014-03-10 12:48:16 +04:00
task.h isci: Redesign device suspension, abort, cleanup. 2012-05-17 14:33:38 -07:00
unsolicited_frame_control.c isci: refactor initialization for S3/S4 2012-05-17 12:27:12 -07:00
unsolicited_frame_control.h isci: refactor initialization for S3/S4 2012-05-17 12:27:12 -07:00