4.14-stable patches

added patches:
	scsi-mpt3sas-fix-kernel-panic-observed-on-soft-hba-unplug.patch

diff --git a/queue-4.14/scsi-mpt3sas-fix-kernel-panic-observed-on-soft-hba-unplug.patch b/queue-4.14/scsi-mpt3sas-fix-kernel-panic-observed-on-soft-hba-unplug.patch
new file mode 100644 (file)
index 0000000..5057e2b
--- /dev/null
+++ b/queue-4.14/scsi-mpt3sas-fix-kernel-panic-observed-on-soft-hba-unplug.patch
@@ -0,0 +1,76 @@
+From cc41f11a21a51d6869d71e525a7264c748d7c0d7 Mon Sep 17 00:00:00 2001
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Date: Fri, 27 Mar 2020 05:52:43 -0400
+Subject: scsi: mpt3sas: Fix kernel panic observed on soft HBA unplug
+
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+
+commit cc41f11a21a51d6869d71e525a7264c748d7c0d7 upstream.
+
+Generic protection fault type kernel panic is observed when user performs
+soft (ordered) HBA unplug operation while IOs are running on drives
+connected to HBA.
+
+When user performs ordered HBA removal operation, the kernel calls PCI
+device's .remove() call back function where driver is flushing out all the
+outstanding SCSI IO commands with DID_NO_CONNECT host byte and also unmaps
+sg buffers allocated for these IO commands.
+
+However, in the ordered HBA removal case (unlike of real HBA hot removal),
+HBA device is still alive and hence HBA hardware is performing the DMA
+operations to those buffers on the system memory which are already unmapped
+while flushing out the outstanding SCSI IO commands and this leads to
+kernel panic.
+
+Don't flush out the outstanding IOs from .remove() path in case of ordered
+removal since HBA will be still alive in this case and it can complete the
+outstanding IOs. Flush out the outstanding IOs only in case of 'physical
+HBA hot unplug' where there won't be any communication with the HBA.
+
+During shutdown also it is possible that HBA hardware can perform DMA
+operations on those outstanding IO buffers which are completed with
+DID_NO_CONNECT by the driver from .shutdown(). So same above fix is applied
+in shutdown path as well.
+
+It is safe to drop the outstanding commands when HBA is inaccessible such
+as when permanent PCI failure happens, when HBA is in non-operational
+state, or when someone does a real HBA hot unplug operation. Since driver
+knows that HBA is inaccessible during these cases, it is safe to drop the
+outstanding commands instead of waiting for SCSI error recovery to kick in
+and clear these outstanding commands.
+
+Link: https://lore.kernel.org/r/1585302763-23007-1-git-send-email-sreekanth.reddy@broadcom.com
+Fixes: c666d3be99c0 ("scsi: mpt3sas: wait for and flush running commands on shutdown/unload")
+Cc: stable@vger.kernel.org #v4.14.174+
+Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -8280,8 +8280,8 @@ static void scsih_remove(struct pci_dev
+ 
+       ioc->remove_host = 1;
+ 
+-      mpt3sas_wait_for_commands_to_complete(ioc);
+-      _scsih_flush_running_cmds(ioc);
++      if (!pci_device_is_present(pdev))
++              _scsih_flush_running_cmds(ioc);
+ 
+       _scsih_fw_event_cleanup_queue(ioc);
+ 
+@@ -8354,8 +8354,8 @@ scsih_shutdown(struct pci_dev *pdev)
+ 
+       ioc->remove_host = 1;
+ 
+-      mpt3sas_wait_for_commands_to_complete(ioc);
+-      _scsih_flush_running_cmds(ioc);
++      if (!pci_device_is_present(pdev))
++              _scsih_flush_running_cmds(ioc);
+ 
+       _scsih_fw_event_cleanup_queue(ioc);
+ 

diff --git a/queue-4.14/series b/queue-4.14/series
index ed4331c4df3aaa489f82c3d298d2b2f2aa41baa8..cd995e3e9d3822b411e9de13894972af8b25677e 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -89,3 +89,4 @@ powerpc-64-tm-don-t-let-userspace-set-regs-trap-via-sigreturn.patch
 powerpc-hash64-devmap-use-h_page_thp_huge-when-setting-up-huge-devmap-pte-entries.patch
 powerpc-xive-use-xive_bad_irq-instead-of-zero-to-catch-non-configured-ipis.patch
 powerpc-kprobes-ignore-traps-that-happened-in-real-mode.patch
+scsi-mpt3sas-fix-kernel-panic-observed-on-soft-hba-unplug.patch