[SCSI] lpfc 8.3.18: Fix critical errors

Fix critical errors

- Update send_scsi_event to validate pnode pointer active before copying
  the wwpn information.
- Add a message, mailbox_idle, and unlock before failing SECURITY_MGMT
  or AUTH_PORT mailbox commands
- Prevent spin_lock_irqsave from being called twice in a row.

Signed-off-by: Alex Iannicelli <alex.iannicelli@emulex.com>
Signed-off-by: James Smart <james.smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>

3 files changed, 15 insertions, 5 deletions

diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index f681eea57730..c1cbec01345d 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -3789,8 +3789,13 @@ sysfs_mbox_read(struct file *filp, struct kobject *kobj,
                         break;
                 case MBX_SECURITY_MGMT:
                 case MBX_AUTH_PORT:
-                        if (phba->pci_dev_grp == LPFC_PCI_DEV_OC)
+                        if (phba->pci_dev_grp == LPFC_PCI_DEV_OC) {
+                                printk(KERN_WARNING "mbox_read:Command 0x%x "
+                                       "is not permitted\n", pmb->mbxCommand);
+                                sysfs_mbox_idle(phba);
+                                spin_unlock_irq(&phba->hbalock);
                                 return -EPERM;
+                        }
                         break;
                 case MBX_READ_SPARM64:
                 case MBX_READ_LA:
diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
index f5d60b55f53a..7260c3af555a 100644
--- a/drivers/scsi/lpfc/lpfc_bsg.c
+++ b/drivers/scsi/lpfc/lpfc_bsg.c
@@ -3142,12 +3142,12 @@ lpfc_bsg_menlo_cmd_cmp(struct lpfc_hba *phba,
         job = menlo->set_job;
         job->dd_data = NULL; /* so timeout handler does not reply */
 
-        spin_lock_irqsave(&phba->hbalock, flags);
+        spin_lock(&phba->hbalock);
         cmdiocbq->iocb_flag |= LPFC_IO_WAKE;
         if (cmdiocbq->context2 && rspiocbq)
                 memcpy(&((struct lpfc_iocbq *)cmdiocbq->context2)->iocb,
                        &rspiocbq->iocb, sizeof(IOCB_t));
-        spin_unlock_irqrestore(&phba->hbalock, flags);
+        spin_unlock(&phba->hbalock);
 
         bmp = menlo->bmp;
         rspiocbq = menlo->rspiocbq;
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index 3a658953486c..f64b65a770b8 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -169,6 +169,7 @@ lpfc_update_stats(struct lpfc_hba *phba, struct  lpfc_scsi_buf *lpfc_cmd)
         spin_lock_irqsave(shost->host_lock, flags);
         if (!vport->stat_data_enabled ||
                 vport->stat_data_blocked ||
+                !pnode ||
                 !pnode->lat_data ||
                 (phba->bucket_type == LPFC_NO_BUCKET)) {
                 spin_unlock_irqrestore(shost->host_lock, flags);
@@ -2040,6 +2041,9 @@ lpfc_send_scsi_error_event(struct lpfc_hba *phba, struct lpfc_vport *vport,
         struct lpfc_nodelist *pnode = lpfc_cmd->rdata->pnode;
         unsigned long flags;
 
+        if (!pnode || !NLP_CHK_NODE_ACT(pnode))
+                return;
+
         /* If there is queuefull or busy condition send a scsi event */
         if ((cmnd->result == SAM_STAT_TASK_SET_FULL) ||
                 (cmnd->result == SAM_STAT_BUSY)) {
@@ -3226,10 +3230,11 @@ lpfc_send_taskmgmt(struct lpfc_vport *vport, struct lpfc_rport_data *rdata,
         struct lpfc_scsi_buf *lpfc_cmd;
         struct lpfc_iocbq *iocbq;
         struct lpfc_iocbq *iocbqrsp;
+        struct lpfc_nodelist *pnode = rdata->pnode;
         int ret;
         int status;
 
-        if (!rdata->pnode || !NLP_CHK_NODE_ACT(rdata->pnode))
+        if (!pnode || !NLP_CHK_NODE_ACT(pnode))
                 return FAILED;
 
         lpfc_cmd = lpfc_get_scsi_buf(phba);
@@ -3256,7 +3261,7 @@ lpfc_send_taskmgmt(struct lpfc_vport *vport, struct lpfc_rport_data *rdata,
                          "0702 Issue %s to TGT %d LUN %d "
                          "rpi x%x nlp_flag x%x\n",
                          lpfc_taskmgmt_name(task_mgmt_cmd), tgt_id, lun_id,
-                         rdata->pnode->nlp_rpi, rdata->pnode->nlp_flag);
+                         pnode->nlp_rpi, pnode->nlp_flag);
 
         status = lpfc_sli_issue_iocb_wait(phba, LPFC_FCP_RING,
                                           iocbq, iocbqrsp, lpfc_cmd->timeout);