On Mon, 18 Oct 2021 15:26:50 +0300, Dmitry Bogdanov wrote:
> sgl is freed in the target stack in target_release_cmd_kref before
> calling qlt_free_cmd, but there is an unmap of sgl in qlt_free_cmd that
> causes such a panic if sgl is not yet DMA unmapped:
>
> NIP dma_direct_unmap_sg+0xdc/0x180
> LR dma_direct_unmap_sg+0xc8/0x180
> Call Trace:
> ql_dbg_prefix+0x68/0xc0 [qla2xxx] (unreliable)
> dma_unmap_sg_attrs+0x54/0xf0
> qlt_unmap_sg.part.19+0x54/0x1c0 [qla2xxx]
> qlt_free_cmd+0x124/0x1d0 [qla2xxx]
> tcm_qla2xxx_release_cmd+0x4c/0xa0 [tcm_qla2xxx]
> target_put_sess_cmd+0x198/0x370 [target_core_mod]
> transport_generic_free_cmd+0x6c/0x1b0 [target_core_mod]
> tcm_qla2xxx_complete_free+0x6c/0x90 [tcm_qla2xxx]
>
> [...]
Applied to 5.15/scsi-fixes, thanks!
[1/1] scsi: qla2xxx: fix unmap already freed sgl
https://git.kernel.org/mkp/scsi/c/4a8f71014b4d
--
Martin K. Petersen Oracle Linux Engineering
