https://bugzilla.kernel.org/show_bug.cgi?id=116771 Bug ID: 116771 Summary: NULL pointer dereference when 'cat /sys/class/fc_host/host1/fabric_name' Product: SCSI Drivers Version: 2.5 Kernel Version: 4.6-rc1 to 4.6-rc4 Hardware: x86-64 OS: Linux Tree: Mainline Status: NEW Severity: high Priority: P1 Component: QLOGIC QLA2XXX Assignee: scsi_drivers-qla2xxx@xxxxxxxxxxxxxxxxxxxx Reporter: changlimin@xxxxxxx Regression: No 1. A HBA card installed in HP ProLiant DL560 Gen8, BIOS P77 08/03/2014. 07:00.0 Fibre Channel [0c04]: QLogic Corp. ISP2532-based 8Gb Fibre Channel to PCI Express HBA [1077:2532] (rev 02) 07:00.1 Fibre Channel [0c04]: QLogic Corp. ISP2532-based 8Gb Fibre Channel to PCI Express HBA [1077:2532] (rev 02) 2. After install 4.6-rc1 to 4.6-rc4 kernel, NULL pointer dereference when 'cat /sys/class/fc_host/host1/fabric_name'. Kernel 4.5.1 is good. 3. The reason is starget->dev.parent is NULL in qla2x00_get_starget_node_name qla2x00_get_starget_node_name(struct scsi_target *starget) { struct Scsi_Host *host = dev_to_shost(starget->dev.parent); 4. Detail log: BUG: unable to handle kernel NULL pointer dereference at 0000000000000058 IP: [<ffffffffa844df97>] scsi_is_host_device+0x7/0x20 PGD 0 Oops: 0000 [#4] SMP Modules linked in: target_core_user uio iscsi_target_mod tcm_loop vhost_scsi vhost target_core_file target_core_iblock target_core_pscsi target_core_mod iscsi_tcp ocfs2_dlmfs libiscsi_tcp libiscsi ocfs2_stack_o2cb scsi_transport_iscsi ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs nbd dm_round_robin bridge stp llc x86_pkg_temp_thermal intel_powerclamp kvm_intel ipmi_ssif i2c_core kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel dm_multipath aes_x86_64 glue_helper irqbypass lrw gf128mul ablk_helper cryptd ipmi_si serio_raw ipmi_msghandler hpilo nfsd auth_rpcgss nfs_acl lockd grace sunrpc ext4 jbd2 mbcache hid_generic tg3 qla2xxx bnx2x hwmon usbhid hpsa ptp mdio hid scsi_transport_sas scsi_transport_fc pps_core libcrc32c CPU: 1 PID: 2666 Comm: libvirtd Tainted: G D 4.6.0-rc1 #1 Hardware name: HP ProLiant DL560 Gen8, BIOS P77 08/03/2014 task: ffff881fea668000 ti: ffff881fea694000 task.ti: ffff881fea694000 RIP: 0010:[<ffffffffa844df97>] [<ffffffffa844df97>] scsi_is_host_device+0x7/0x20 RSP: 0018:ffff881fea697cf0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff880ff8eef1d0 RDX: ffff880ff8b9a000 RSI: ffff881ff8c82340 RDI: 0000000000000000 RBP: ffff881fea697d08 R08: ffff880ff9a49c38 R09: ffff880ff2b0b980 R10: ffff880ff8b9a000 R11: ffff880ff9f7dac0 R12: ffff880ff8353000 R13: ffff881ff8545900 R14: ffff880ff06bc900 R15: 0000000000000001 FS: 00007fcf43dee700(0000) GS:ffff880ffee40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000058 CR3: 0000001ff84bd000 CR4: 00000000000406e0 Stack: ffffffffc053e125 ffff880ff8353000 ffff880ff8b9a000 ffff881fea697d10 ffff881fea697d30 ffffffffc03801bb ffff881ff8c82340 ffffffffa8870cb0 ffff881fea697d50 ffffffffa8432980 ffffffffa8625882 ffff880ff06bc900 Call Trace: [<ffffffffc053e125>] ? qla2x00_get_starget_node_name+0x25/0x90 [qla2xxx] [<ffffffffc03801bb>] ? show_fc_host_fabric_name+0x4b/0x80 [scsi_transport_fc] [<ffffffffa8432980>] ? dev_attr_show+0x20/0x50 [<ffffffffa8625882>] ? mutex_lock+0x12/0x30 [<ffffffffa8264c0c>] ? sysfs_kf_seq_show+0xbc/0x130 [<ffffffffa8263493>] ? kernfs_seq_show+0x23/0x30 [<ffffffffa820c87a>] ? seq_read+0xca/0x360 [<ffffffffa81f93e2>] ? do_filp_open+0x92/0xe0 [<ffffffffa8263d8a>] ? kernfs_fop_read+0x10a/0x160 [<ffffffffa81e7e78>] ? __vfs_read+0x28/0xe0 [<ffffffffa8298170>] ? security_file_permission+0xa0/0xc0 [<ffffffffa81e8d17>] ? rw_verify_area+0x57/0xd0 [<ffffffffa81e8e12>] ? vfs_read+0x82/0x110 [<ffffffffa81ea096>] ? SyS_read+0x46/0xa0 [<ffffffffa8002c3e>] ? do_syscall_64+0x5e/0xc0 [<ffffffffa86277e5>] ? entry_SYSCALL64_slow_path+0x25/0x25 Code: 00 00 00 90 66 66 66 66 90 0f b7 06 55 39 87 b0 fc ff ff 48 89 e5 5d 0f 94 c0 0f b6 c0 c3 66 0f 1f 44 00 00 66 66 66 66 90 31 c0 <48> 81 7f 58 60 77 d3 a8 55 48 89 e5 5d 0f 94 c0 c3 0f 1f 84 00 RIP [<ffffffffa844df97>] scsi_is_host_device+0x7/0x20 RSP <ffff881fea697cf0> CR2: 0000000000000058 ---[ end trace 8d3e3efe3450a7ba ]--- -- You are receiving this mail because: You are watching the assignee of the bug. -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
