[lkml]   [2019]   [Jan]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] scsi: isci: initialize shost fully before calling scsi_add_host()
scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates
the command size to allocate based on the prot_capabilities. In the
isci driver, scsi_host_set_prot() is called after scsi_add_host()
so the command size gets calculated to be smaller than it needs to be.
Eventually, scsi_mq_init_request() locates the 'prot_sdb' after the command
assuming it was sized correctly and a buffer overrun may occur.

However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line
size, the mistake can go unnoticed.

The bug was noticed after the struct request size was reduced by
commit 9d037ad707ed ("block: remove req->timeout_list")

Which likely reduced the allocated space for the request by an entire
cache line, enough that the overflow could be hit and it caused a panic,
on boot, at:

RIP: 0010:t10_pi_complete+0x77/0x1c0
Call Trace:

sd_done() would call scsi_prot_sg_count() which reads the number of
entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of
the allocated space it reads a garbage number and erroneously calls

To prevent this, the calls to scsi_host_set_prot() are moved into
isci_host_alloc() before the call to scsi_add_host(). Out of caution,
also move the similar call to scsi_host_set_guard().

Fixes: 3d2d75254915 ("[SCSI] isci: T10 DIF support")
Signed-off-by: Logan Gunthorpe <>
Cc: Intel SCU Linux support <>
Cc: Artur Paszkiewicz <>
Cc: "James E.J. Bottomley" <>
Cc: "Martin K. Petersen" <>
Cc: Christoph Hellwig <>
Cc: Jens Axboe <>
Cc: Jeff Moyer <>
drivers/scsi/isci/init.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
index 68b90c4f79a3..1727d0c71b12 100644
--- a/drivers/scsi/isci/init.c
+++ b/drivers/scsi/isci/init.c
@@ -576,6 +576,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id)
shost->max_lun = ~0;
shost->max_cmd_len = MAX_COMMAND_SIZE;

+ /* turn on DIF support */
+ scsi_host_set_prot(shost,
+ scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC);
err = scsi_add_host(shost, &pdev->dev);
if (err)
goto err_shost;
@@ -663,13 +670,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
goto err_host_alloc;
pci_info->hosts[i] = h;
- /* turn on DIF support */
- scsi_host_set_prot(to_shost(h),
- scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC);

err = isci_setup_interrupts(pdev);
 \ /
  Last update: 2019-01-08 21:51    [W:0.087 / U:4.408 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site