<feed xmlns='http://www.w3.org/2005/Atom'>
<title>kernel/linux.git/drivers/s390/scsi, branch v6.3</title>
<subtitle>Linux kernel stable tree (mirror)</subtitle>
<id>https://git.radix-linux.su/kernel/linux.git/atom?h=v6.3</id>
<link rel='self' href='https://git.radix-linux.su/kernel/linux.git/atom?h=v6.3'/>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/'/>
<updated>2023-02-22T03:00:51+00:00</updated>
<entry>
<title>scsi: zfcp: Trace when request remove fails after qdio send fails</title>
<updated>2023-02-22T03:00:51+00:00</updated>
<author>
<name>Benjamin Block</name>
<email>bblock@linux.ibm.com</email>
</author>
<published>2023-02-21T17:56:00+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=901b894af5b933cf6576eec05746f34b46e2ac83'/>
<id>urn:sha1:901b894af5b933cf6576eec05746f34b46e2ac83</id>
<content type='text'>
When we fail to send a FSF request in 'zfcp_fsf_req_send()' when calling
'zfcp_qdio_send()' we try to remove the request object from our internal
hash table again to prevent keeping a stale memory reference. This removal
might still - very much theoretically - fail.

To store some evidence of when this happens add a new trace record for
this case; tag: 'fsrsrmf'.

We reuse the 'ZFCP_DBF_HBA_RES' trace ID for this, but mark all fields
other then the request ID with ~0, to make fairly obvious that these are
invalid values. This faking has to be done because we don't have a valid
request object at this point, and can not safely access any of the memory
of the old object - we just failed to find it in our hash table, so it
might be gone already.

Here is an example of a decoded trace record:

    Timestamp      : 2023-02-17-13:09:12:748140
    Area           : HBA
    Subarea        : 1
    Level          : -
    Exception      : 000003ff7ff500c2
    CPU ID         : 0011
    Caller         : 0x0
    Record ID      : 1
    Tag            : fsrsrmf
    Request ID     : 0x0000000080126ab6
    Request status : 0xffffffff
    FSF cmnd       : 0xffffffff
    FSF sequence no: 0xffffffff
    FSF issued     : 2042-09-18-01:53:47:370495
    FSF stat       : 0xffffffff
    FSF stat qual  : ffffffff ffffffff ffffffff ffffffff
    Prot stat      : 0xffffffff
    Prot stat qual : ffffffff ffffffff ffffffff ffffffff
    Port handle    : 0xffffffff
    LUN handle     : 0xffffffff

This provides at least some basic evidence that this event happened, and
what object was affected.

Link: https://lore.kernel.org/r/99b8246b2d71b63fa4f9c56333e2037502f7f5af.1677000450.git.bblock@linux.ibm.com
Signed-off-by: Benjamin Block &lt;bblock@linux.ibm.com&gt;
Reviewed-by: Steffen Maier &lt;maier@linux.ibm.com&gt;
Signed-off-by: Martin K. Petersen &lt;martin.petersen@oracle.com&gt;
</content>
</entry>
<entry>
<title>scsi: zfcp: Change the type of all fsf request id fields and variables to u64</title>
<updated>2023-02-22T03:00:51+00:00</updated>
<author>
<name>Benjamin Block</name>
<email>bblock@linux.ibm.com</email>
</author>
<published>2023-02-21T17:55:59+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=3ab01810153b0ca26cfc846ba72996b250adde6d'/>
<id>urn:sha1:3ab01810153b0ca26cfc846ba72996b250adde6d</id>
<content type='text'>
We use different integer types throughout zfcp to store the FSF request ID
and related values; some places use 'unsigned long' and others 'u64'.  On
s390x these are effectively the same type, but this might cause confusions
and is generally inconsistent.

The specification for the used hardware specifies this value as a 64-bit
number, and ultimately we use this value to communicate with the hardware,
so it makes sense to change the type of all these variables to 'u64' where
we can.  The only exception being when we store it in the 'host_scribble'
field of a 'struct scsi_cmnd'; for this case we add a build time check to
make sure they are compatible.

Link: https://lore.kernel.org/r/9c9cbe5acc2b419a22dce2fed847e3db91b60201.1677000450.git.bblock@linux.ibm.com
Signed-off-by: Benjamin Block &lt;bblock@linux.ibm.com&gt;
Reviewed-by: Steffen Maier &lt;maier@linux.ibm.com&gt;
Signed-off-by: Martin K. Petersen &lt;martin.petersen@oracle.com&gt;
</content>
</entry>
<entry>
<title>scsi: zfcp: Make the type for accessing request hashtable buckets size_t</title>
<updated>2023-02-22T03:00:51+00:00</updated>
<author>
<name>Benjamin Block</name>
<email>bblock@linux.ibm.com</email>
</author>
<published>2023-02-21T17:55:58+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=79f9abd64719cc71ba78a76574e21dc8266c65a3'/>
<id>urn:sha1:79f9abd64719cc71ba78a76574e21dc8266c65a3</id>
<content type='text'>
The appropriate type for array indices is 'size_t' and the current
implementation in 'zfcp_reqlist.h' mixes 'int' and 'unsigned int' in
different places to access the hashtable buckets of our internal request
hash table.

To prevent any confusion, change all places to 'size_t'.

Link: https://lore.kernel.org/r/64afe93f6263c6b07815937826cd7d5fc4f1a674.1677000450.git.bblock@linux.ibm.com
Signed-off-by: Benjamin Block &lt;bblock@linux.ibm.com&gt;
Reviewed-by: Steffen Maier &lt;maier@linux.ibm.com&gt;
Signed-off-by: Martin K. Petersen &lt;martin.petersen@oracle.com&gt;
</content>
</entry>
<entry>
<title>Merge tag 'random-6.2-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random</title>
<updated>2022-12-13T00:22:22+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2022-12-13T00:22:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=268325bda5299836a6ad4c3952474a2be125da5f'/>
<id>urn:sha1:268325bda5299836a6ad4c3952474a2be125da5f</id>
<content type='text'>
Pull random number generator updates from Jason Donenfeld:

 - Replace prandom_u32_max() and various open-coded variants of it,
   there is now a new family of functions that uses fast rejection
   sampling to choose properly uniformly random numbers within an
   interval:

       get_random_u32_below(ceil) - [0, ceil)
       get_random_u32_above(floor) - (floor, U32_MAX]
       get_random_u32_inclusive(floor, ceil) - [floor, ceil]

   Coccinelle was used to convert all current users of
   prandom_u32_max(), as well as many open-coded patterns, resulting in
   improvements throughout the tree.

   I'll have a "late" 6.1-rc1 pull for you that removes the now unused
   prandom_u32_max() function, just in case any other trees add a new
   use case of it that needs to converted. According to linux-next,
   there may be two trivial cases of prandom_u32_max() reintroductions
   that are fixable with a 's/.../.../'. So I'll have for you a final
   conversion patch doing that alongside the removal patch during the
   second week.

   This is a treewide change that touches many files throughout.

 - More consistent use of get_random_canary().

 - Updates to comments, documentation, tests, headers, and
   simplification in configuration.

 - The arch_get_random*_early() abstraction was only used by arm64 and
   wasn't entirely useful, so this has been replaced by code that works
   in all relevant contexts.

 - The kernel will use and manage random seeds in non-volatile EFI
   variables, refreshing a variable with a fresh seed when the RNG is
   initialized. The RNG GUID namespace is then hidden from efivarfs to
   prevent accidental leakage.

   These changes are split into random.c infrastructure code used in the
   EFI subsystem, in this pull request, and related support inside of
   EFISTUB, in Ard's EFI tree. These are co-dependent for full
   functionality, but the order of merging doesn't matter.

 - Part of the infrastructure added for the EFI support is also used for
   an improvement to the way vsprintf initializes its siphash key,
   replacing an sleep loop wart.

 - The hardware RNG framework now always calls its correct random.c
   input function, add_hwgenerator_randomness(), rather than sometimes
   going through helpers better suited for other cases.

 - The add_latent_entropy() function has long been called from the fork
   handler, but is a no-op when the latent entropy gcc plugin isn't
   used, which is fine for the purposes of latent entropy.

   But it was missing out on the cycle counter that was also being mixed
   in beside the latent entropy variable. So now, if the latent entropy
   gcc plugin isn't enabled, add_latent_entropy() will expand to a call
   to add_device_randomness(NULL, 0), which adds a cycle counter,
   without the absent latent entropy variable.

 - The RNG is now reseeded from a delayed worker, rather than on demand
   when used. Always running from a worker allows it to make use of the
   CPU RNG on platforms like S390x, whose instructions are too slow to
   do so from interrupts. It also has the effect of adding in new inputs
   more frequently with more regularity, amounting to a long term
   transcript of random values. Plus, it helps a bit with the upcoming
   vDSO implementation (which isn't yet ready for 6.2).

 - The jitter entropy algorithm now tries to execute on many different
   CPUs, round-robining, in hopes of hitting even more memory latencies
   and other unpredictable effects. It also will mix in a cycle counter
   when the entropy timer fires, in addition to being mixed in from the
   main loop, to account more explicitly for fluctuations in that timer
   firing. And the state it touches is now kept within the same cache
   line, so that it's assured that the different execution contexts will
   cause latencies.

* tag 'random-6.2-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: (23 commits)
  random: include &lt;linux/once.h&gt; in the right header
  random: align entropy_timer_state to cache line
  random: mix in cycle counter when jitter timer fires
  random: spread out jitter callback to different CPUs
  random: remove extraneous period and add a missing one in comments
  efi: random: refresh non-volatile random seed when RNG is initialized
  vsprintf: initialize siphash key using notifier
  random: add back async readiness notifier
  random: reseed in delayed work rather than on-demand
  random: always mix cycle counter in add_latent_entropy()
  hw_random: use add_hwgenerator_randomness() for early entropy
  random: modernize documentation comment on get_random_bytes()
  random: adjust comment to account for removed function
  random: remove early archrandom abstraction
  random: use random.trust_{bootloader,cpu} command line option only
  stackprotector: actually use get_random_canary()
  stackprotector: move get_random_canary() into stackprotector.h
  treewide: use get_random_u32_inclusive() when possible
  treewide: use get_random_u32_{above,below}() instead of manual loop
  treewide: use get_random_u32_below() instead of deprecated function
  ...
</content>
</entry>
<entry>
<title>treewide: use get_random_u32_below() instead of deprecated function</title>
<updated>2022-11-18T01:15:15+00:00</updated>
<author>
<name>Jason A. Donenfeld</name>
<email>Jason@zx2c4.com</email>
</author>
<published>2022-10-10T02:44:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=8032bf1233a74627ce69b803608e650f3f35971c'/>
<id>urn:sha1:8032bf1233a74627ce69b803608e650f3f35971c</id>
<content type='text'>
This is a simple mechanical transformation done by:

@@
expression E;
@@
- prandom_u32_max
+ get_random_u32_below
  (E)

Reviewed-by: Kees Cook &lt;keescook@chromium.org&gt;
Reviewed-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Acked-by: Darrick J. Wong &lt;djwong@kernel.org&gt; # for xfs
Reviewed-by: SeongJae Park &lt;sj@kernel.org&gt; # for damon
Reviewed-by: Jason Gunthorpe &lt;jgg@nvidia.com&gt; # for infiniband
Reviewed-by: Russell King (Oracle) &lt;rmk+kernel@armlinux.org.uk&gt; # for arm
Acked-by: Ulf Hansson &lt;ulf.hansson@linaro.org&gt; # for mmc
Signed-off-by: Jason A. Donenfeld &lt;Jason@zx2c4.com&gt;
</content>
</entry>
<entry>
<title>scsi: zfcp: Fix double free of FSF request when qdio send fails</title>
<updated>2022-11-17T17:51:06+00:00</updated>
<author>
<name>Benjamin Block</name>
<email>bblock@linux.ibm.com</email>
</author>
<published>2022-11-16T10:50:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=0954256e970ecf371b03a6c9af2cf91b9c4085ff'/>
<id>urn:sha1:0954256e970ecf371b03a6c9af2cf91b9c4085ff</id>
<content type='text'>
We used to use the wrong type of integer in 'zfcp_fsf_req_send()' to cache
the FSF request ID when sending a new FSF request. This is used in case the
sending fails and we need to remove the request from our internal hash
table again (so we don't keep an invalid reference and use it when we free
the request again).

In 'zfcp_fsf_req_send()' we used to cache the ID as 'int' (signed and 32
bit wide), but the rest of the zfcp code (and the firmware specification)
handles the ID as 'unsigned long'/'u64' (unsigned and 64 bit wide [s390x
ELF ABI]).  For one this has the obvious problem that when the ID grows
past 32 bit (this can happen reasonably fast) it is truncated to 32 bit
when storing it in the cache variable and so doesn't match the original ID
anymore.  The second less obvious problem is that even when the original ID
has not yet grown past 32 bit, as soon as the 32nd bit is set in the
original ID (0x80000000 = 2'147'483'648) we will have a mismatch when we
cast it back to 'unsigned long'. As the cached variable is of a signed
type, the compiler will choose a sign-extending instruction to load the 32
bit variable into a 64 bit register (e.g.: 'lgf %r11,188(%r15)'). So once
we pass the cached variable into 'zfcp_reqlist_find_rm()' to remove the
request again all the leading zeros will be flipped to ones to extend the
sign and won't match the original ID anymore (this has been observed in
practice).

If we can't successfully remove the request from the hash table again after
'zfcp_qdio_send()' fails (this happens regularly when zfcp cannot notify
the adapter about new work because the adapter is already gone during
e.g. a ChpID toggle) we will end up with a double free.  We unconditionally
free the request in the calling function when 'zfcp_fsf_req_send()' fails,
but because the request is still in the hash table we end up with a stale
memory reference, and once the zfcp adapter is either reset during recovery
or shutdown we end up freeing the same memory twice.

The resulting stack traces vary depending on the kernel and have no direct
correlation to the place where the bug occurs. Here are three examples that
have been seen in practice:

  list_del corruption. next-&gt;prev should be 00000001b9d13800, but was 00000000dead4ead. (next=00000001bd131a00)
  ------------[ cut here ]------------
  kernel BUG at lib/list_debug.c:62!
  monitor event: 0040 ilc:2 [#1] PREEMPT SMP
  Modules linked in: ...
  CPU: 9 PID: 1617 Comm: zfcperp0.0.1740 Kdump: loaded
  Hardware name: ...
  Krnl PSW : 0704d00180000000 00000003cbeea1f8 (__list_del_entry_valid+0x98/0x140)
             R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
  Krnl GPRS: 00000000916d12f1 0000000080000000 000000000000006d 00000003cb665cd6
             0000000000000001 0000000000000000 0000000000000000 00000000d28d21e8
             00000000d3844000 00000380099efd28 00000001bd131a00 00000001b9d13800
             00000000d3290100 0000000000000000 00000003cbeea1f4 00000380099efc70
  Krnl Code: 00000003cbeea1e8: c020004f68a7        larl    %r2,00000003cc8d7336
             00000003cbeea1ee: c0e50027fd65        brasl   %r14,00000003cc3e9cb8
            #00000003cbeea1f4: af000000            mc      0,0
            &gt;00000003cbeea1f8: c02000920440        larl    %r2,00000003cd12aa78
             00000003cbeea1fe: c0e500289c25        brasl   %r14,00000003cc3fda48
             00000003cbeea204: b9040043            lgr     %r4,%r3
             00000003cbeea208: b9040051            lgr     %r5,%r1
             00000003cbeea20c: b9040032            lgr     %r3,%r2
  Call Trace:
   [&lt;00000003cbeea1f8&gt;] __list_del_entry_valid+0x98/0x140
  ([&lt;00000003cbeea1f4&gt;] __list_del_entry_valid+0x94/0x140)
   [&lt;000003ff7ff502fe&gt;] zfcp_fsf_req_dismiss_all+0xde/0x150 [zfcp]
   [&lt;000003ff7ff49cd0&gt;] zfcp_erp_strategy_do_action+0x160/0x280 [zfcp]
   [&lt;000003ff7ff4a22e&gt;] zfcp_erp_strategy+0x21e/0xca0 [zfcp]
   [&lt;000003ff7ff4ad34&gt;] zfcp_erp_thread+0x84/0x1a0 [zfcp]
   [&lt;00000003cb5eece8&gt;] kthread+0x138/0x150
   [&lt;00000003cb557f3c&gt;] __ret_from_fork+0x3c/0x60
   [&lt;00000003cc4172ea&gt;] ret_from_fork+0xa/0x40
  INFO: lockdep is turned off.
  Last Breaking-Event-Address:
   [&lt;00000003cc3e9d04&gt;] _printk+0x4c/0x58
  Kernel panic - not syncing: Fatal exception: panic_on_oops

or:

  Unable to handle kernel pointer dereference in virtual kernel address space
  Failing address: 6b6b6b6b6b6b6000 TEID: 6b6b6b6b6b6b6803
  Fault in home space mode while using kernel ASCE.
  AS:0000000063b10007 R3:0000000000000024
  Oops: 0038 ilc:3 [#1] SMP
  Modules linked in: ...
  CPU: 10 PID: 0 Comm: swapper/10 Kdump: loaded
  Hardware name: ...
  Krnl PSW : 0404d00180000000 000003ff7febaf8e (zfcp_fsf_reqid_check+0x86/0x158 [zfcp])
             R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
  Krnl GPRS: 5a6f1cfa89c49ac3 00000000aff2c4c8 6b6b6b6b6b6b6b6b 00000000000002a8
             0000000000000000 0000000000000055 0000000000000000 00000000a8515800
             0700000000000000 00000000a6e14500 00000000aff2c000 000000008003c44c
             000000008093c700 0000000000000010 00000380009ebba8 00000380009ebb48
  Krnl Code: 000003ff7febaf7e: a7f4003d            brc     15,000003ff7febaff8
             000003ff7febaf82: e32020000004        lg      %r2,0(%r2)
            #000003ff7febaf88: ec2100388064        cgrj    %r2,%r1,8,000003ff7febaff8
            &gt;000003ff7febaf8e: e3b020100020        cg      %r11,16(%r2)
             000003ff7febaf94: a774fff7            brc     7,000003ff7febaf82
             000003ff7febaf98: ec280030007c        cgij    %r2,0,8,000003ff7febaff8
             000003ff7febaf9e: e31020080004        lg      %r1,8(%r2)
             000003ff7febafa4: e33020000004        lg      %r3,0(%r2)
  Call Trace:
   [&lt;000003ff7febaf8e&gt;] zfcp_fsf_reqid_check+0x86/0x158 [zfcp]
   [&lt;000003ff7febbdbc&gt;] zfcp_qdio_int_resp+0x6c/0x170 [zfcp]
   [&lt;000003ff7febbf90&gt;] zfcp_qdio_irq_tasklet+0xd0/0x108 [zfcp]
   [&lt;0000000061d90a04&gt;] tasklet_action_common.constprop.0+0xdc/0x128
   [&lt;000000006292f300&gt;] __do_softirq+0x130/0x3c0
   [&lt;0000000061d906c6&gt;] irq_exit_rcu+0xfe/0x118
   [&lt;000000006291e818&gt;] do_io_irq+0xc8/0x168
   [&lt;000000006292d516&gt;] io_int_handler+0xd6/0x110
   [&lt;000000006292d596&gt;] psw_idle_exit+0x0/0xa
  ([&lt;0000000061d3be50&gt;] arch_cpu_idle+0x40/0xd0)
   [&lt;000000006292ceea&gt;] default_idle_call+0x52/0xf8
   [&lt;0000000061de4fa4&gt;] do_idle+0xd4/0x168
   [&lt;0000000061de51fe&gt;] cpu_startup_entry+0x36/0x40
   [&lt;0000000061d4faac&gt;] smp_start_secondary+0x12c/0x138
   [&lt;000000006292d88e&gt;] restart_int_handler+0x6e/0x90
  Last Breaking-Event-Address:
   [&lt;000003ff7febaf94&gt;] zfcp_fsf_reqid_check+0x8c/0x158 [zfcp]
  Kernel panic - not syncing: Fatal exception in interrupt

or:

  Unable to handle kernel pointer dereference in virtual kernel address space
  Failing address: 523b05d3ae76a000 TEID: 523b05d3ae76a803
  Fault in home space mode while using kernel ASCE.
  AS:0000000077c40007 R3:0000000000000024
  Oops: 0038 ilc:3 [#1] SMP
  Modules linked in: ...
  CPU: 3 PID: 453 Comm: kworker/3:1H Kdump: loaded
  Hardware name: ...
  Workqueue: kblockd blk_mq_run_work_fn
  Krnl PSW : 0404d00180000000 0000000076fc0312 (__kmalloc+0xd2/0x398)
             R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
  Krnl GPRS: ffffffffffffffff 523b05d3ae76abf6 0000000000000000 0000000000092a20
             0000000000000002 00000007e49b5cc0 00000007eda8f000 0000000000092a20
             00000007eda8f000 00000003b02856b9 00000000000000a8 523b05d3ae76abf6
             00000007dd662000 00000007eda8f000 0000000076fc02b2 000003e0037637a0
  Krnl Code: 0000000076fc0302: c004000000d4	brcl	0,76fc04aa
             0000000076fc0308: b904001b		lgr	%r1,%r11
            #0000000076fc030c: e3106020001a	algf	%r1,32(%r6)
            &gt;0000000076fc0312: e31010000082	xg	%r1,0(%r1)
             0000000076fc0318: b9040001		lgr	%r0,%r1
             0000000076fc031c: e30061700082	xg	%r0,368(%r6)
             0000000076fc0322: ec59000100d9	aghik	%r5,%r9,1
             0000000076fc0328: e34003b80004	lg	%r4,952
  Call Trace:
   [&lt;0000000076fc0312&gt;] __kmalloc+0xd2/0x398
   [&lt;0000000076f318f2&gt;] mempool_alloc+0x72/0x1f8
   [&lt;000003ff8027c5f8&gt;] zfcp_fsf_req_create.isra.7+0x40/0x268 [zfcp]
   [&lt;000003ff8027f1bc&gt;] zfcp_fsf_fcp_cmnd+0xac/0x3f0 [zfcp]
   [&lt;000003ff80280f1a&gt;] zfcp_scsi_queuecommand+0x122/0x1d0 [zfcp]
   [&lt;000003ff800b4218&gt;] scsi_queue_rq+0x778/0xa10 [scsi_mod]
   [&lt;00000000771782a0&gt;] __blk_mq_try_issue_directly+0x130/0x208
   [&lt;000000007717a124&gt;] blk_mq_request_issue_directly+0x4c/0xa8
   [&lt;000003ff801302e2&gt;] dm_mq_queue_rq+0x2ea/0x468 [dm_mod]
   [&lt;0000000077178c12&gt;] blk_mq_dispatch_rq_list+0x33a/0x818
   [&lt;000000007717f064&gt;] __blk_mq_do_dispatch_sched+0x284/0x2f0
   [&lt;000000007717f44c&gt;] __blk_mq_sched_dispatch_requests+0x1c4/0x218
   [&lt;000000007717fa7a&gt;] blk_mq_sched_dispatch_requests+0x52/0x90
   [&lt;0000000077176d74&gt;] __blk_mq_run_hw_queue+0x9c/0xc0
   [&lt;0000000076da6d74&gt;] process_one_work+0x274/0x4d0
   [&lt;0000000076da7018&gt;] worker_thread+0x48/0x560
   [&lt;0000000076daef18&gt;] kthread+0x140/0x160
   [&lt;000000007751d144&gt;] ret_from_fork+0x28/0x30
  Last Breaking-Event-Address:
   [&lt;0000000076fc0474&gt;] __kmalloc+0x234/0x398
  Kernel panic - not syncing: Fatal exception: panic_on_oops

To fix this, simply change the type of the cache variable to 'unsigned
long', like the rest of zfcp and also the argument for
'zfcp_reqlist_find_rm()'. This prevents truncation and wrong sign extension
and so can successfully remove the request from the hash table.

Fixes: e60a6d69f1f8 ("[SCSI] zfcp: Remove function zfcp_reqlist_find_safe")
Cc: &lt;stable@vger.kernel.org&gt; #v2.6.34+
Signed-off-by: Benjamin Block &lt;bblock@linux.ibm.com&gt;
Link: https://lore.kernel.org/r/979f6e6019d15f91ba56182f1aaf68d61bf37fc6.1668595505.git.bblock@linux.ibm.com
Reviewed-by: Steffen Maier &lt;maier@linux.ibm.com&gt;
Signed-off-by: Martin K. Petersen &lt;martin.petersen@oracle.com&gt;
</content>
</entry>
<entry>
<title>s390: move from strlcpy with unused retval to strscpy</title>
<updated>2022-08-30T20:00:33+00:00</updated>
<author>
<name>Wolfram Sang</name>
<email>wsa+renesas@sang-engineering.com</email>
</author>
<published>2022-08-18T20:59:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=820109fb11f24baf16ed86e232939877df3e9f0c'/>
<id>urn:sha1:820109fb11f24baf16ed86e232939877df3e9f0c</id>
<content type='text'>
Follow the advice of the below link and prefer 'strscpy' in this
subsystem. Conversion is 1:1 because the return value is not used.
Generated by a coccinelle script.

Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/
Signed-off-by: Wolfram Sang &lt;wsa+renesas@sang-engineering.com&gt;
Acked-by: Jakub Kicinski &lt;kuba@kernel.org&gt;
Acked-by: Benjamin Block &lt;bblock@linux.ibm.com&gt;
Acked-by: Alexandra Winter &lt;wintera@linux.ibm.com&gt;
Link: https://lore.kernel.org/r/20220818205948.6360-1-wsa+renesas@sang-engineering.com
Link: https://lore.kernel.org/r/20220818210102.7301-1-wsa+renesas@sang-engineering.com
[gor@linux.ibm.com: squashed two changes linked above together]
Signed-off-by: Vasily Gorbik &lt;gor@linux.ibm.com&gt;
</content>
</entry>
<entry>
<title>scsi: zfcp: Fix missing auto port scan and thus missing target ports</title>
<updated>2022-08-01T23:50:00+00:00</updated>
<author>
<name>Steffen Maier</name>
<email>maier@linux.ibm.com</email>
</author>
<published>2022-07-29T16:25:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=4da8c5f76825269f28d6a89fa752934a4bcb6dfa'/>
<id>urn:sha1:4da8c5f76825269f28d6a89fa752934a4bcb6dfa</id>
<content type='text'>
Case (1):
  The only waiter on wka_port-&gt;completion_wq is zfcp_fc_wka_port_get()
  trying to open a WKA port. As such it should only be woken up by WKA port
  *open* responses, not by WKA port close responses.

Case (2):
  A close WKA port response coming in just after having sent a new open WKA
  port request and before blocking for the open response with wait_event()
  in zfcp_fc_wka_port_get() erroneously renders the wait_event a NOP
  because the close handler overwrites wka_port-&gt;status. Hence the
  wait_event condition is erroneously true and it does not enter blocking
  state.

With non-negligible probability, the following time space sequence happens
depending on timing without this fix:

user process        ERP thread zfcp work queue tasklet system work queue
============        ========== =============== ======= =================
$ echo 1 &gt; online
zfcp_ccw_set_online
zfcp_ccw_activate
zfcp_erp_adapter_reopen
msleep scan backoff zfcp_erp_strategy
|                   ...
|                   zfcp_erp_action_cleanup
|                   ...
|                   queue delayed scan_work
|                   queue ns_up_work
|                              ns_up_work:
|                              zfcp_fc_wka_port_get
|                               open wka request
|                                              open response
|                              GSPN FC-GS
|                              RSPN FC-GS [NPIV-only]
|                              zfcp_fc_wka_port_put
|                               (--wka-&gt;refcount==0)
|                               sched delayed wka-&gt;work
|
~~~Case (1)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
zfcp_erp_wait
flush scan_work
|                                                      wka-&gt;work:
|                                                      wka-&gt;status=CLOSING
|                                                      close wka request
|                              scan_work:
|                              zfcp_fc_wka_port_get
|                               (wka-&gt;status==CLOSING)
|                               wka-&gt;status=OPENING
|                               open wka request
|                               wait_event
|                               |              close response
|                               |              wka-&gt;status=OFFLINE
|                               |              wake_up /*WRONG*/
~~~Case (2)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|                                                      wka-&gt;work:
|                                                      wka-&gt;status=CLOSING
|                                                      close wka request
zfcp_erp_wait
flush scan_work
|                              scan_work:
|                              zfcp_fc_wka_port_get
|                               (wka-&gt;status==CLOSING)
|                               wka-&gt;status=OPENING
|                               open wka request
|                                              close response
|                                              wka-&gt;status=OFFLINE
|                                              wake_up /*WRONG&amp;NOP*/
|                               wait_event /*NOP*/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|                               (wka-&gt;status!=ONLINE)
|                               return -EIO
|                              return early
                                               open response
                                               wka-&gt;status=ONLINE
                                               wake_up /*NOP*/

So we erroneously end up with no automatic port scan. This is a big problem
when it happens during boot. The timing is influenced by v3.19 commit
18f87a67e6d6 ("zfcp: auto port scan resiliency").

Fix it by fully mutually excluding zfcp_fc_wka_port_get() and
zfcp_fc_wka_port_offline(). For that to work, we make the latter block
until we got the response for a close WKA port. In order not to penalize
the system workqueue, we move wka_port-&gt;work to our own adapter workqueue.
Note that before v2.6.30 commit 828bc1212a68 ("[SCSI] zfcp: Set WKA-port to
offline on adapter deactivation"), zfcp did block in
zfcp_fc_wka_port_offline() as well, but with a different condition.

While at it, make non-functional cleanups to improve code reading in
zfcp_fc_wka_port_get(). If we cannot send the WKA port open request, don't
rely on the subsequent wait_event condition to immediately let this case
pass without blocking. Also don't want to rely on the additional condition
handling the refcount to be skipped just to finally return with -EIO.

Link: https://lore.kernel.org/r/20220729162529.1620730-1-maier@linux.ibm.com
Fixes: 5ab944f97e09 ("[SCSI] zfcp: attach and release SAN nameserver port on demand")
Cc: &lt;stable@vger.kernel.org&gt; #v2.6.28+
Reviewed-by: Benjamin Block &lt;bblock@linux.ibm.com&gt;
Signed-off-by: Steffen Maier &lt;maier@linux.ibm.com&gt;
Signed-off-by: Martin K. Petersen &lt;martin.petersen@oracle.com&gt;
</content>
</entry>
<entry>
<title>scsi: zfcp: Drop redundant "the" in the comments</title>
<updated>2022-07-07T21:33:58+00:00</updated>
<author>
<name>Jiang Jian</name>
<email>jiangjian@cdjrlc.com</email>
</author>
<published>2022-07-06T15:59:40+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=9821106213c826f9c3dbccb617ce76f8981c8aba'/>
<id>urn:sha1:9821106213c826f9c3dbccb617ce76f8981c8aba</id>
<content type='text'>
There is an unexpected word "the" in the comments that needs to be dropped.

file: ./drivers/s390/scsi/zfcp_diag.h
line: 5
* Definitions for handling diagnostics in the the zfcp device driver.
changed to
* Definitions for handling diagnostics in the zfcp device driver.

Link: https://lore.kernel.org/r/20220621114207.106405-1-jiangjian@cdjrlc.com
Link: https://lore.kernel.org/r/4c02fefa19ab46f0f163990bde3ce10bd9c7caf1.1657122360.git.bblock@linux.ibm.com
Reviewed-by: Benjamin Block &lt;bblock@linux.ibm.com&gt;
Signed-off-by: Jiang Jian &lt;jiangjian@cdjrlc.com&gt;
Signed-off-by: Benjamin Block &lt;bblock@linux.ibm.com&gt;
Signed-off-by: Martin K. Petersen &lt;martin.petersen@oracle.com&gt;
</content>
</entry>
<entry>
<title>scsi: zfcp: Declare zfcp_sdev_attrs as static</title>
<updated>2022-07-07T21:33:58+00:00</updated>
<author>
<name>Julian Wiedmann</name>
<email>jwi@linux.ibm.com</email>
</author>
<published>2022-07-06T15:59:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=b9787bdfdba5ab0e558e3d142b1c2f6a54cbf6b1'/>
<id>urn:sha1:b9787bdfdba5ab0e558e3d142b1c2f6a54cbf6b1</id>
<content type='text'>
These attributes are now only accessed through the
zfcp_sysfs_sdev_attr_group.

Link: https://lore.kernel.org/r/0791b9149ebfa39e6b8eab093113cd2527dbf3d3.1657122360.git.bblock@linux.ibm.com
Fixes: d8d7cf3f7d07 ("scsi: zfcp: Switch to attribute groups")
Reviewed-by: Benjamin Block &lt;bblock@linux.ibm.com&gt;
Signed-off-by: Julian Wiedmann &lt;jwi@linux.ibm.com&gt;
Signed-off-by: Benjamin Block &lt;bblock@linux.ibm.com&gt;
Signed-off-by: Martin K. Petersen &lt;martin.petersen@oracle.com&gt;
</content>
</entry>
</feed>
