[SCSI] bnx2fc: Fix kernel panic when deleting NPIV ports

Deleting NPIV port causes a kernel panic when the NPIV port is in the same zone
as the physical port and shares the same LUN. This happens due to the fact that
vport destroy and unsolicited ELS are scheduled to run on the same workqueue,
and vport destroy destroys the lport and the unsolicited ELS tries to access
the invalid lport.  This patch fixes this issue by maintaining a list of valid
lports and verifying if the lport is valid or not before accessing it.

Signed-off-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

1 files changed, 27 insertions, 1 deletions

diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 8f894e410b5d..5c8c59e5bade 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -1228,6 +1228,7 @@ static int bnx2fc_interface_setup(struct bnx2fc_hba *hba,
         hba->ctlr.get_src_addr = bnx2fc_get_src_mac;
         set_bit(BNX2FC_CTLR_INIT_DONE, &hba->init_done);
 
+        INIT_LIST_HEAD(&hba->vports);
         rc = bnx2fc_netdev_setup(hba);
         if (rc)
                 goto setup_err;
@@ -1264,8 +1265,15 @@ static struct fc_lport *bnx2fc_if_create(struct bnx2fc_hba *hba,
         struct fcoe_port        *port;
         struct Scsi_Host        *shost;
         struct fc_vport         *vport = dev_to_vport(parent);
+        struct bnx2fc_lport     *blport;
         int                     rc = 0;
 
+        blport = kzalloc(sizeof(struct bnx2fc_lport), GFP_KERNEL);
+        if (!blport) {
+                BNX2FC_HBA_DBG(hba->ctlr.lp, "Unable to alloc bnx2fc_lport\n");
+                return NULL;
+        }
+
         /* Allocate Scsi_Host structure */
         if (!npiv)
                 lport = libfc_host_alloc(&bnx2fc_shost_template, sizeof(*port));
@@ -1274,7 +1282,7 @@ static struct fc_lport *bnx2fc_if_create(struct bnx2fc_hba *hba,
 
         if (!lport) {
                 printk(KERN_ERR PFX "could not allocate scsi host structure\n");
-                return NULL;
+                goto free_blport;
         }
         shost = lport->host;
         port = lport_priv(lport);
@@ -1330,12 +1338,20 @@ static struct fc_lport *bnx2fc_if_create(struct bnx2fc_hba *hba,
         }
 
         bnx2fc_interface_get(hba);
+
+        spin_lock_bh(&hba->hba_lock);
+        blport->lport = lport;
+        list_add_tail(&blport->list, &hba->vports);
+        spin_unlock_bh(&hba->hba_lock);
+
         return lport;
 
 shost_err:
         scsi_remove_host(shost);
 lp_config_err:
         scsi_host_put(lport->host);
+free_blport:
+        kfree(blport);
         return NULL;
 }
 
@@ -1351,6 +1367,7 @@ static void bnx2fc_if_destroy(struct fc_lport *lport)
 {
         struct fcoe_port *port = lport_priv(lport);
         struct bnx2fc_hba *hba = port->priv;
+        struct bnx2fc_lport *blport, *tmp;
 
         BNX2FC_HBA_DBG(hba->ctlr.lp, "ENTERED bnx2fc_if_destroy\n");
         /* Stop the transmit retry timer */
@@ -1375,6 +1392,15 @@ static void bnx2fc_if_destroy(struct fc_lport *lport)
         /* Free memory used by statistical counters */
         fc_lport_free_stats(lport);
 
+        spin_lock_bh(&hba->hba_lock);
+        list_for_each_entry_safe(blport, tmp, &hba->vports, list) {
+                if (blport->lport == lport) {
+                        list_del(&blport->list);
+                        kfree(blport);
+                }
+        }
+        spin_unlock_bh(&hba->hba_lock);
+
         /* Release Scsi_Host */
         scsi_host_put(lport->host);