Bug 116771 - NULL pointer dereference when 'cat /sys/class/fc_host/host1/fabric_name'
Summary: NULL pointer dereference when 'cat /sys/class/fc_host/host1/fabric_name'
Status: NEW
Alias: None
Product: SCSI Drivers
Classification: Unclassified
Component: QLOGIC QLA2XXX (show other bugs)
Hardware: x86-64 Linux
: P1 high
Assignee: scsi_drivers-qla2xxx
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-04-20 01:06 UTC by changlimin
Modified: 2016-07-03 02:45 UTC (History)
2 users (show)

See Also:
Kernel Version: 4.6-rc1 to 4.6-rc4
Subsystem:
Regression: No
Bisected commit-id:


Attachments
attachment-8185-0.html (318 bytes, text/html)
2016-04-20 01:06 UTC, himanshu.madhani@cavium.com
Details
Test Patch (864 bytes, patch)
2016-07-03 02:45 UTC, [account disabled by administrator]
Details | Diff

Description changlimin 2016-04-20 01:06:18 UTC
1. A HBA card installed in HP ProLiant DL560 Gen8, BIOS P77 08/03/2014.
07:00.0 Fibre Channel [0c04]: QLogic Corp. ISP2532-based 8Gb Fibre Channel to PCI Express HBA [1077:2532] (rev 02)
07:00.1 Fibre Channel [0c04]: QLogic Corp. ISP2532-based 8Gb Fibre Channel to PCI Express HBA [1077:2532] (rev 02)

2. After install 4.6-rc1 to 4.6-rc4 kernel, NULL pointer dereference when 'cat /sys/class/fc_host/host1/fabric_name'.  Kernel 4.5.1 is good.

3. The reason is starget->dev.parent is NULL in qla2x00_get_starget_node_name
    qla2x00_get_starget_node_name(struct scsi_target *starget)
    {
	struct Scsi_Host *host = dev_to_shost(starget->dev.parent);

4. Detail log:
 BUG: unable to handle kernel NULL pointer dereference at 0000000000000058
 IP: [<ffffffffa844df97>] scsi_is_host_device+0x7/0x20
 PGD 0
 Oops: 0000 [#4] SMP
 Modules linked in: target_core_user uio iscsi_target_mod tcm_loop vhost_scsi vhost target_core_file target_core_iblock target_core_pscsi target_core_mod iscsi_tcp ocfs2_dlmfs libiscsi_tcp libiscsi ocfs2_stack_o2cb scsi_transport_iscsi ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs nbd dm_round_robin bridge stp llc x86_pkg_temp_thermal intel_powerclamp kvm_intel ipmi_ssif i2c_core kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel dm_multipath aes_x86_64 glue_helper irqbypass lrw gf128mul ablk_helper cryptd ipmi_si serio_raw ipmi_msghandler hpilo nfsd auth_rpcgss nfs_acl lockd grace sunrpc ext4 jbd2 mbcache hid_generic tg3 qla2xxx bnx2x hwmon usbhid hpsa ptp mdio hid scsi_transport_sas scsi_transport_fc pps_core libcrc32c
 CPU: 1 PID: 2666 Comm: libvirtd Tainted: G      D         4.6.0-rc1 #1
 Hardware name: HP ProLiant DL560 Gen8, BIOS P77 08/03/2014
 task: ffff881fea668000 ti: ffff881fea694000 task.ti: ffff881fea694000
 RIP: 0010:[<ffffffffa844df97>]  [<ffffffffa844df97>] scsi_is_host_device+0x7/0x20
 RSP: 0018:ffff881fea697cf0  EFLAGS: 00010246
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff880ff8eef1d0
 RDX: ffff880ff8b9a000 RSI: ffff881ff8c82340 RDI: 0000000000000000
 RBP: ffff881fea697d08 R08: ffff880ff9a49c38 R09: ffff880ff2b0b980
 R10: ffff880ff8b9a000 R11: ffff880ff9f7dac0 R12: ffff880ff8353000
 R13: ffff881ff8545900 R14: ffff880ff06bc900 R15: 0000000000000001
 FS:  00007fcf43dee700(0000) GS:ffff880ffee40000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000058 CR3: 0000001ff84bd000 CR4: 00000000000406e0
 Stack:
  ffffffffc053e125 ffff880ff8353000 ffff880ff8b9a000 ffff881fea697d10
  ffff881fea697d30 ffffffffc03801bb ffff881ff8c82340 ffffffffa8870cb0
  ffff881fea697d50 ffffffffa8432980 ffffffffa8625882 ffff880ff06bc900
 Call Trace:
  [<ffffffffc053e125>] ? qla2x00_get_starget_node_name+0x25/0x90 [qla2xxx]
  [<ffffffffc03801bb>] ? show_fc_host_fabric_name+0x4b/0x80 [scsi_transport_fc]
  [<ffffffffa8432980>] ? dev_attr_show+0x20/0x50
  [<ffffffffa8625882>] ? mutex_lock+0x12/0x30
  [<ffffffffa8264c0c>] ? sysfs_kf_seq_show+0xbc/0x130
  [<ffffffffa8263493>] ? kernfs_seq_show+0x23/0x30
  [<ffffffffa820c87a>] ? seq_read+0xca/0x360
  [<ffffffffa81f93e2>] ? do_filp_open+0x92/0xe0
  [<ffffffffa8263d8a>] ? kernfs_fop_read+0x10a/0x160
  [<ffffffffa81e7e78>] ? __vfs_read+0x28/0xe0
  [<ffffffffa8298170>] ? security_file_permission+0xa0/0xc0
  [<ffffffffa81e8d17>] ? rw_verify_area+0x57/0xd0
  [<ffffffffa81e8e12>] ? vfs_read+0x82/0x110
  [<ffffffffa81ea096>] ? SyS_read+0x46/0xa0
  [<ffffffffa8002c3e>] ? do_syscall_64+0x5e/0xc0
  [<ffffffffa86277e5>] ? entry_SYSCALL64_slow_path+0x25/0x25
 Code: 00 00 00 90 66 66 66 66 90 0f b7 06 55 39 87 b0 fc ff ff 48 89 e5 5d 0f 94 c0 0f b6 c0 c3 66 0f 1f 44 00 00 66 66 66 66 90 31 c0 <48> 81 7f 58 60 77 d3 a8 55 48 89 e5 5d 0f 94 c0 c3 0f 1f 84 00
 RIP  [<ffffffffa844df97>] scsi_is_host_device+0x7/0x20
  RSP <ffff881fea697cf0>
 CR2: 0000000000000058
 ---[ end trace 8d3e3efe3450a7ba ]---
Comment 1 himanshu.madhani@cavium.com 2016-04-20 01:06:35 UTC
Created attachment 213351 [details]
attachment-8185-0.html
Comment 2 [account disabled by administrator] 2016-07-03 02:45:24 UTC
See if the below patch triggers anything new for you.
Comment 3 [account disabled by administrator] 2016-07-03 02:45:38 UTC
Created attachment 221831 [details]
Test Patch

Note You need to log in before you can comment on or make changes to this bug.