[SCSI] lpfc driver 8.0.30 : fix get_stats panic

Fix panic in lpfc_get_stats()

Symptoms: Panic on sysfs stats access

Cause: In lpfc_get_stats() we are writing to memory that we do not
own.

Fix: Fix our stats structure allocation. Embed phba->link_stats in
struct lpfc_hba and stop treating it like rogue structure.

Note: Embedding midlayer/transport structure in our structure caused
need for more files to include midlayer/transport headers.

Signed-off-by: James Smart <James.Smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 3bb82aae432e5d09d63a8c294732d0c55cc75729..adb95674823fb86e45dfb28b4f6a4aa4c285dd23 100644 (file)
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -342,9 +342,6 @@ struct lpfc_hba {
 #define VPD_MASK            0xf         /* mask for any vpd data */
 
        struct timer_list els_tmofunc;
-
-       void *link_stats;
-
        /*
         * stat  counters
         */
@@ -370,6 +367,8 @@ struct lpfc_hba {
        struct list_head freebufList;
        struct list_head ctrspbuflist;
        struct list_head rnidrspbuflist;
+
+       struct fc_host_statistics link_stats;
 };
 
 

diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 3cea928830192b15a27db74a703902072d3a1b08..f37b7642c59d5c7c920a86528caf739974af66a5 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -988,8 +988,7 @@ lpfc_get_stats(struct Scsi_Host *shost)
 {
        struct lpfc_hba *phba = (struct lpfc_hba *)shost->hostdata[0];
        struct lpfc_sli *psli = &phba->sli;
-       struct fc_host_statistics *hs =
-                       (struct fc_host_statistics *)phba->link_stats;
+       struct fc_host_statistics *hs = &phba->link_stats;
        LPFC_MBOXQ_t *pmboxq;
        MAILBOX_t *pmb;
        int rc=0;
@@ -1020,6 +1019,8 @@ lpfc_get_stats(struct Scsi_Host *shost)
                return NULL;
        }
 
+       memset(hs, 0, sizeof (struct fc_host_statistics));
+
        hs->tx_frames = pmb->un.varRdStatus.xmitFrameCnt;
        hs->tx_words = (pmb->un.varRdStatus.xmitByteCnt * 256);
        hs->rx_frames = pmb->un.varRdStatus.rcvFrameCnt;

diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index 78adee4699af668bca94db5515fc3176c0e4c11d..b3880eca2f3c4d78befccb82dbee5b8a90533860 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -29,6 +29,7 @@
 
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_host.h>
+#include <scsi/scsi_transport_fc.h>
 
 #include "lpfc_hw.h"
 #include "lpfc_sli.h"

diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 34d416d2b007b09893e2b716efabcd217e09642f..1b6d1dcdabb38044bc577774574ee5fe1feb2488 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -1339,14 +1339,12 @@ lpfc_pci_probe_one(struct pci_dev *pdev, const struct pci_device_id *pid)
        if (pci_request_regions(pdev, LPFC_DRIVER_NAME))
                goto out_disable_device;
 
-       host = scsi_host_alloc(&lpfc_template,
-                       sizeof (struct lpfc_hba) + sizeof (unsigned long));
+       host = scsi_host_alloc(&lpfc_template, sizeof (struct lpfc_hba));
        if (!host)
                goto out_release_regions;
 
        phba = (struct lpfc_hba*)host->hostdata;
        memset(phba, 0, sizeof (struct lpfc_hba));
-       phba->link_stats = (void *)&phba[1];
        phba->host = host;
 
        phba->fc_flag |= FC_LOADING;

diff --git a/drivers/scsi/lpfc/lpfc_mbox.c b/drivers/scsi/lpfc/lpfc_mbox.c
index c27cf94795db52c7f3a520805443cb414963f356..afcd54d51f16532fdfbae58919e5d27e01d18d8e 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_mbox.c
+++ b/drivers/scsi/lpfc/lpfc_mbox.c
@@ -23,6 +23,9 @@
 #include <linux/pci.h>
 #include <linux/interrupt.h>
 
+#include <scsi/scsi_device.h>
+#include <scsi/scsi_transport_fc.h>
+
 #include "lpfc_hw.h"
 #include "lpfc_sli.h"
 #include "lpfc_disc.h"

diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index a5cfb6421fa94c002bce5dbe862c655649e5e6cb..034a8bfa9ac8d3a11271b7e1c784edf60cbfdb67 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -23,6 +23,9 @@
 #include <linux/pci.h>
 #include <linux/interrupt.h>
 
+#include <scsi/scsi_device.h>
+#include <scsi/scsi_transport_fc.h>
+
 #include "lpfc_hw.h"
 #include "lpfc_sli.h"
 #include "lpfc_disc.h"

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 1775508ed2762e88918cdc25a89b978932a8adf9..e027f47081034828b7fa212d4f736358bc9fb9eb 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -27,6 +27,7 @@
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_host.h>
+#include <scsi/scsi_transport_fc.h>
 
 #include "lpfc_hw.h"
 #include "lpfc_sli.h"