[SCSI] lpfc 8.3.9: Fix locking and memory issues

- Use the hbalock when changing the fc_flag.
- Use the host_lock when changeing the sli_flag.
- Prevent NULL pointer dereference after dma_alloc_coherent failure.

Signed-off-by: James Smart <james.smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>

1 files changed, 23 insertions, 10 deletions

diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index b890e2dc15db..2359d0bfb734 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -757,11 +757,13 @@ lpfc_linkdown(struct lpfc_hba *phba)
 
         spin_lock_irq(&phba->hbalock);
         phba->fcf.fcf_flag &= ~(FCF_AVAILABLE | FCF_SCAN_DONE);
+        spin_unlock_irq(&phba->hbalock);
         if (phba->link_state > LPFC_LINK_DOWN) {
                 phba->link_state = LPFC_LINK_DOWN;
+                spin_lock_irq(shost->host_lock);
                 phba->pport->fc_flag &= ~FC_LBIT;
+                spin_unlock_irq(shost->host_lock);
         }
-        spin_unlock_irq(&phba->hbalock);
         vports = lpfc_create_vport_work_array(phba);
         if (vports != NULL)
                 for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++) {
@@ -1802,6 +1804,8 @@ lpfc_init_vpi_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq)
 {
         struct lpfc_vport *vport = mboxq->vport;
         struct lpfc_nodelist *ndlp;
+        struct Scsi_Host *shost = lpfc_shost_from_vport(vport);
+
         if (mboxq->u.mb.mbxStatus) {
                 lpfc_printf_vlog(vport, KERN_ERR,
                                 LOG_MBOX,
@@ -1811,9 +1815,9 @@ lpfc_init_vpi_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq)
                 lpfc_vport_set_state(vport, FC_VPORT_FAILED);
                 return;
         }
-        spin_lock_irq(&phba->hbalock);
+        spin_lock_irq(shost->host_lock);
         vport->fc_flag &= ~FC_VPORT_NEEDS_INIT_VPI;
-        spin_unlock_irq(&phba->hbalock);
+        spin_unlock_irq(shost->host_lock);
 
         /* If this port is physical port or FDISC is done, do reg_vpi */
         if ((phba->pport == vport) || (vport->port_state == LPFC_FDISC)) {
@@ -1924,6 +1928,7 @@ lpfc_mbx_cmpl_reg_vfi(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq)
 {
         struct lpfc_dmabuf *dmabuf = mboxq->context1;
         struct lpfc_vport *vport = mboxq->vport;
+        struct Scsi_Host *shost = lpfc_shost_from_vport(vport);
 
         if (mboxq->u.mb.mbxStatus) {
                 lpfc_printf_vlog(vport, KERN_ERR, LOG_MBOX,
@@ -1941,10 +1946,11 @@ lpfc_mbx_cmpl_reg_vfi(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq)
                 goto fail_free_mem;
         }
         /* The VPI is implicitly registered when the VFI is registered */
+        spin_lock_irq(shost->host_lock);
         vport->vpi_state |= LPFC_VPI_REGISTERED;
         vport->fc_flag |= FC_VFI_REGISTERED;
-
         vport->fc_flag &= ~FC_VPORT_NEEDS_REG_VPI;
+        spin_unlock_irq(shost->host_lock);
 
         if (vport->port_state == LPFC_FABRIC_CFG_LINK) {
                 lpfc_start_fdiscs(phba);
@@ -2269,10 +2275,12 @@ lpfc_mbx_cmpl_read_la(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
         }
 
         phba->fc_eventTag = la->eventTag;
+        spin_lock_irq(&phba->hbalock);
         if (la->mm)
                 phba->sli.sli_flag |= LPFC_MENLO_MAINT;
         else
                 phba->sli.sli_flag &= ~LPFC_MENLO_MAINT;
+        spin_unlock_irq(&phba->hbalock);
 
         phba->link_events++;
         if (la->attType == AT_LINK_UP && (!la->mm)) {
@@ -2401,10 +2409,10 @@ lpfc_mbx_cmpl_unreg_vpi(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
                                  mb->mbxStatus);
                 break;
         }
-        spin_lock_irq(&phba->hbalock);
+        spin_lock_irq(shost->host_lock);
         vport->vpi_state &= ~LPFC_VPI_REGISTERED;
         vport->fc_flag |= FC_VPORT_NEEDS_REG_VPI;
-        spin_unlock_irq(&phba->hbalock);
+        spin_unlock_irq(shost->host_lock);
         vport->unreg_vpi_cmpl = VPORT_OK;
         mempool_free(pmb, phba->mbox_mem_pool);
         /*
@@ -2462,8 +2470,10 @@ lpfc_mbx_cmpl_reg_vpi(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
                 goto out;
         }
 
+        spin_lock_irq(shost->host_lock);
         vport->vpi_state |= LPFC_VPI_REGISTERED;
         vport->fc_flag &= ~FC_VPORT_NEEDS_REG_VPI;
+        spin_unlock_irq(shost->host_lock);
         vport->num_disc_nodes = 0;
         /* go thru NPR list and issue ELS PLOGIs */
         if (vport->fc_npr_cnt)
@@ -4620,6 +4630,7 @@ lpfc_unregister_fcf_prep(struct lpfc_hba *phba)
         LPFC_MBOXQ_t *mbox;
         struct lpfc_vport **vports;
         struct lpfc_nodelist *ndlp;
+        struct Scsi_Host *shost;
         int i, rc;
 
         /* Unregister RPIs */
@@ -4638,10 +4649,11 @@ lpfc_unregister_fcf_prep(struct lpfc_hba *phba)
                         if (ndlp)
                                 lpfc_cancel_retry_delay_tmo(vports[i], ndlp);
                         lpfc_mbx_unreg_vpi(vports[i]);
-                        spin_lock_irq(&phba->hbalock);
+                        shost = lpfc_shost_from_vport(vports[i]);
+                        spin_lock_irq(shost->host_lock);
                         vports[i]->fc_flag |= FC_VPORT_NEEDS_INIT_VPI;
                         vports[i]->vpi_state &= ~LPFC_VPI_REGISTERED;
-                        spin_unlock_irq(&phba->hbalock);
+                        spin_unlock_irq(shost->host_lock);
                 }
         lpfc_destroy_vport_work_array(phba, vports);
 
@@ -4671,9 +4683,10 @@ lpfc_unregister_fcf_prep(struct lpfc_hba *phba)
                 return -EIO;
         }
 
-        spin_lock_irq(&phba->hbalock);
+        shost = lpfc_shost_from_vport(phba->pport);
+        spin_lock_irq(shost->host_lock);
         phba->pport->fc_flag &= ~FC_VFI_REGISTERED;
-        spin_unlock_irq(&phba->hbalock);
+        spin_unlock_irq(shost->host_lock);
 
         return 0;
 }