Commit fcdd14b8 authored by James Smart's avatar James Smart Committed by Christoph Hellwig
Browse files

lpfc: Fix pointer checks and comments in LS receive refactoring 



Additional testing encountered null pointers that weren't fully qualified
in lpfc_nvmet_xmt_ls_abort_cmp() and lpfc_nvmet_unsol_issue_abort().

The same error was detected and reported by static checker reporting:
  drivers/scsi/lpfc/lpfc_sli.c:2905 lpfc_nvme_unsol_ls_handler()
  error: we previously assumed 'phba->targetport' could be null
    (see line 2837)

Fix by making phba->nvmet_support and phba->targetport validity checks
in lpfc_nvmet_xmt_ls_abort_cmp() and lpfc_nvmet_unsol_issue_abort().

Fixes: 3a8070c5 (“lpfc: Refactor NVME LS receive handling”)
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarPaul Ely <paul.ely@broadcom.com>
Signed-off-by: default avatarJames Smart <jsmart2021@gmail.com>
Reviewed-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 3b2a1ebc

drivers/scsi/lpfc/lpfc_nvmet.c

+17 −9
Original line number Diff line number Diff line
@@ -3207,8 +3207,10 @@ lpfc_nvmet_xmt_ls_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe, 
	ctxp = cmdwqe->context2;

	result = wcqe->parameter;



	if (phba->nvmet_support) {

		tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;

		atomic_inc(&tgtp->xmt_ls_abort_cmpl);

	}



	lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,

			"6083 Abort cmpl: ctx x%px WCQE:%08x %08x %08x %08x\n",
@@ -3244,7 +3246,7 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba, 
			     struct lpfc_async_xchg_ctx *ctxp,

			     uint32_t sid, uint16_t xri)

{

	struct lpfc_nvmet_tgtport *tgtp;

	struct lpfc_nvmet_tgtport *tgtp = NULL;

	struct lpfc_iocbq *abts_wqeq;

	union lpfc_wqe128 *wqe_abts;

	struct lpfc_nodelist *ndlp;
@@ -3253,12 +3255,14 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba, 
			"6067 ABTS: sid %x xri x%x/x%x\n",

			sid, xri, ctxp->wqeq->sli4_xritag);



	if (phba->nvmet_support && phba->targetport)

		tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;



	ndlp = lpfc_findnode_did(phba->pport, sid);

	if (!ndlp || !NLP_CHK_NODE_ACT(ndlp) ||

	    ((ndlp->nlp_state != NLP_STE_UNMAPPED_NODE) &&

	    (ndlp->nlp_state != NLP_STE_MAPPED_NODE))) {

		if (tgtp)

			atomic_inc(&tgtp->xmt_abort_rsp_error);

		lpfc_printf_log(phba, KERN_ERR, LOG_NVME_ABTS,

				"6134 Drop ABTS - wrong NDLP state x%x.\n",
@@ -3538,7 +3542,7 @@ lpfc_nvme_unsol_ls_issue_abort(struct lpfc_hba *phba, 
				struct lpfc_async_xchg_ctx *ctxp,

				uint32_t sid, uint16_t xri)

{

	struct lpfc_nvmet_tgtport *tgtp;

	struct lpfc_nvmet_tgtport *tgtp = NULL;

	struct lpfc_iocbq *abts_wqeq;

	unsigned long flags;

	int rc;
@@ -3555,7 +3559,9 @@ lpfc_nvme_unsol_ls_issue_abort(struct lpfc_hba *phba, 
		ctxp->state = LPFC_NVME_STE_LS_ABORT;

	}



	if (phba->nvmet_support && phba->targetport)

		tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;



	if (!ctxp->wqeq) {

		/* Issue ABTS for this WQE based on iotag */

		ctxp->wqeq = lpfc_sli_get_iocbq(phba);
@@ -3582,10 +3588,12 @@ lpfc_nvme_unsol_ls_issue_abort(struct lpfc_hba *phba, 
	rc = lpfc_sli4_issue_wqe(phba, ctxp->hdwq, abts_wqeq);

	spin_unlock_irqrestore(&phba->hbalock, flags);

	if (rc == WQE_SUCCESS) {

		if (tgtp)

			atomic_inc(&tgtp->xmt_abort_unsol);

		return 0;

	}

out:

	if (tgtp)

		atomic_inc(&tgtp->xmt_abort_rsp_error);

	abts_wqeq->context2 = NULL;

	abts_wqeq->context3 = NULL;

CRA Git | Maintained and supported by SUSTech CRA and CCSE