Patch "scsi: lpfc: Fix illegal memory access on Abort IOCBs" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    scsi: lpfc: Fix illegal memory access on Abort IOCBs

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     scsi-lpfc-fix-illegal-memory-access-on-abort-iocbs.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 95804069a2b2aa6876b4cbfed7fc3a0e18e767e4
Author: James Smart <jsmart2021@xxxxxxxxx>
Date:   Wed Apr 21 16:44:33 2021 -0700

    scsi: lpfc: Fix illegal memory access on Abort IOCBs
    
    [ Upstream commit e1364711359f3ced054bda9920477c8bf93b74c5 ]
    
    In devloss timer handler and in backend calls to terminate remote port I/O,
    there is logic to walk through all active IOCBs and validate them to
    potentially trigger an abort request. This logic is causing illegal memory
    accesses which leads to a crash. Abort IOCBs, which may be on the list, do
    not have an associated lpfc_io_buf struct. The driver is trying to map an
    lpfc_io_buf struct on the IOCB and which results in a bogus address thus
    the issue.
    
    Fix by skipping over ABORT IOCBs (CLOSE IOCBs are ABORTS that don't send
    ABTS) in the IOCB scan logic.
    
    Link: https://lore.kernel.org/r/20210421234433.102079-1-jsmart2021@xxxxxxxxx
    Co-developed-by: Justin Tee <justin.tee@xxxxxxxxxxxx>
    Signed-off-by: Justin Tee <justin.tee@xxxxxxxxxxxx>
    Signed-off-by: James Smart <jsmart2021@xxxxxxxxx>
    Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index ef7cef316d21..795460eda6a5 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -11337,13 +11337,20 @@ lpfc_sli_validate_fcp_iocb(struct lpfc_iocbq *iocbq, struct lpfc_vport *vport,
 			   lpfc_ctx_cmd ctx_cmd)
 {
 	struct lpfc_io_buf *lpfc_cmd;
+	IOCB_t *icmd = NULL;
 	int rc = 1;
 
 	if (iocbq->vport != vport)
 		return rc;
 
-	if (!(iocbq->iocb_flag &  LPFC_IO_FCP) ||
-	    !(iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ))
+	if (!(iocbq->iocb_flag & LPFC_IO_FCP) ||
+	    !(iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ) ||
+	      iocbq->iocb_flag & LPFC_DRIVER_ABORTED)
+		return rc;
+
+	icmd = &iocbq->iocb;
+	if (icmd->ulpCommand == CMD_ABORT_XRI_CN ||
+	    icmd->ulpCommand == CMD_CLOSE_XRI_CN)
 		return rc;
 
 	lpfc_cmd = container_of(iocbq, struct lpfc_io_buf, cur_iocbq);