On 11/18/19 8:28 PM, James Smart wrote:
On 11/18/2019 4:30 AM, Hannes Reinecke wrote:
The lpfc driver allocates a cpu_map based on the number of possible
cpus during startup. If a CPU hotplug occurs the number of CPUs
might change, causing an out-of-bounds access when trying to lookup
the hardware index for a given CPU.
Suggested-by: Daniel Wagner <daniel.wagner@xxxxxxxx>
Signed-off-by: Hannes Reinecke <hare@xxxxxxx>
---
drivers/scsi/lpfc/lpfc_scsi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c
b/drivers/scsi/lpfc/lpfc_scsi.c
index ba26df90a36a..2380452a8efd 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -642,7 +642,8 @@ lpfc_get_scsi_buf_s4(struct lpfc_hba *phba, struct
lpfc_nodelist *ndlp,
int tag;
struct fcp_cmd_rsp_buf *tmp = NULL;
- cpu = raw_smp_processor_id();
+ cpu = min_t(u32, raw_smp_processor_id(),
+ phba->sli4_hba.num_possible_cpu);
if (cmnd && phba->cfg_fcp_io_sched == LPFC_FCP_SCHED_BY_HDWQ) {
tag = blk_mq_unique_tag(cmnd->request);
idx = blk_mq_unique_tag_to_hwq(tag);
This should be unnecessary with the lpfc 12.6.0.1 and 12.6.0.2 patches
that tie into cpu onling/offlining and cpu hot add.
I am curious, how if a cpu is hot removed - how num_possible dynamically
changes (to a lower value ?) such that a thread can be running on a cpu
that returns a higher cpu number than num_possible ?
Actually, the behaviour of num_possible_cpus() under cpu hotplug seems
to be implementation-specific.
One might want to set it to the max value at all times, which has the
drawback that you'd need to scale per-cpu values with that number,
leading to a massive memory overhead as only very few installation will
ever reach that number.
Others might want to set to the max value at the current configuration,
implying that it might change under CPU hotplug.
Which seems to be the case for PowerPC, which was the case which
triggered the issue at hand.
But maybe it was a plain bug in the CPU hotplug implementation; one
should be asking BenH for details here.
Cheers,
Hannes
--
Dr. Hannes Reinecke Teamlead Storage & Networking
hare@xxxxxxx +49 911 74053 688
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Felix Imendörffer, Mary Higgins, Sri Rasiah
HRB 21284 (AG Nürnberg)
