Skip to content

scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool

Ewan D. Milne requested to merge e-milne/centos-stream-9:RHEL-38285 into main

scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool

JIRA: https://issues.redhat.com/browse/RHEL-38285 CVE: CVE-2023-52811 Upstream Status: From upstream linux mainline

In practice the driver should never send more commands than are allocated to a queue's event pool. In the unlikely event that this happens, the code asserts a BUG_ON, and in the case that the kernel is not configured to crash on panic returns a junk event pointer from the empty event list causing things to spiral from there. This BUG_ON is a historical artifact of the ibmvfc driver first being upstreamed, and it is well known now that the use of BUG_ON is bad practice except in the most unrecoverable scenario. There is nothing about this scenario that prevents the driver from recovering and carrying on.

Remove the BUG_ON in question from ibmvfc_get_event() and return a NULL pointer in the case of an empty event pool. Update all call sites to ibmvfc_get_event() to check for a NULL pointer and perfrom the appropriate failure or recovery action.

Signed-off-by: Tyrel Datwyler tyreld@linux.ibm.com Link: https://lore.kernel.org/r/20230921225435.3537728-2-tyreld@linux.ibm.com Reviewed-by: Brian King brking@linux.vnet.ibm.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com (cherry picked from commit b39f2d10b86d0af353ea339e5815820026bca48f) Signed-off-by: Ewan D. Milne emilne@redhat.com

Merge request reports