From 8f9ee9ac13b1d46631654ead1f38dd0e8a41cd44 Mon Sep 17 00:00:00 2001 From: Gleb Chesnokov Date: Mon, 17 Oct 2022 14:45:45 +0300 Subject: [PATCH] qla2x00t-32gbit: Fix response queue handler reading stale packets On some platforms, the current logic of relying on finding new packet solely based on signature pattern can lead to driver reading stale packets. Though this is a bug in those platforms, reduce such exposures by limiting reading packets until the IN pointer. Link: https://lore.kernel.org/r/20220826102559.17474-3-njavali@marvell.com Cc: stable@vger.kernel.org Reviewed-by: Himanshu Madhani Signed-off-by: Arun Easi Signed-off-by: Nilesh Javali Signed-off-by: Martin K. Petersen [ commit e4f8a29deb3b upstream ] --- qla2x00t-32gbit/qla_isr.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/qla2x00t-32gbit/qla_isr.c b/qla2x00t-32gbit/qla_isr.c index 2da976dde..36a3d995a 100644 --- a/qla2x00t-32gbit/qla_isr.c +++ b/qla2x00t-32gbit/qla_isr.c @@ -3786,7 +3786,8 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha, struct qla_hw_data *ha = vha->hw; struct purex_entry_24xx *purex_entry; struct purex_item *pure_item; - u16 cur_ring_index; + u16 rsp_in = 0, cur_ring_index; + int is_shadow_hba; if (!ha->flags.fw_started) return; @@ -3797,7 +3798,18 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha, qla_cpu_update(rsp->qpair, raw_smp_processor_id()); } - while (rsp->ring_ptr->signature != RESPONSE_PROCESSED) { +#define __update_rsp_in(_is_shadow_hba, _rsp, _rsp_in) \ + do { \ + _rsp_in = _is_shadow_hba ? *(_rsp)->in_ptr : \ + rd_reg_dword_relaxed((_rsp)->rsp_q_in); \ + } while (0) + + is_shadow_hba = IS_SHADOW_REG_CAPABLE(ha); + + __update_rsp_in(is_shadow_hba, rsp, rsp_in); + + while (rsp->ring_index != rsp_in && + rsp->ring_ptr->signature != RESPONSE_PROCESSED) { pkt = (struct sts_entry_24xx *)rsp->ring_ptr; cur_ring_index = rsp->ring_index; @@ -3911,6 +3923,7 @@ process_err: } pure_item = qla27xx_copy_fpin_pkt(vha, (void **)&pkt, &rsp); + __update_rsp_in(is_shadow_hba, rsp, rsp_in); if (!pure_item) break; qla24xx_queue_purex_item(vha, pure_item,