scsi: lpfc: Fix crash on powering off BFS VM with passthrough device

Null pointer dereference when BFS VM is powered off

The driver incorrectly uses sli3_ring on SLI-4 adapters

Use the correct ring structure based on sli_rev

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Tested-by: Raphael Silva <raphasil@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index e81fa7d4deb531d383c3a710cfd08ef6b836973e..c4ceef69bd6b064a341bbf915cb6d5ba843042d7 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -10951,6 +10951,7 @@ lpfc_sli_abort_iocb(struct lpfc_vport *vport, struct lpfc_sli_ring *pring,
        struct lpfc_hba *phba = vport->phba;
        struct lpfc_iocbq *iocbq;
        struct lpfc_iocbq *abtsiocb;
+       struct lpfc_sli_ring *pring_s4;
        IOCB_t *cmd = NULL;
        int errcnt = 0, ret_val = 0;
        int i;
@@ -11004,8 +11005,15 @@ lpfc_sli_abort_iocb(struct lpfc_vport *vport, struct lpfc_sli_ring *pring,
 
                /* Setup callback routine and issue the command. */
                abtsiocb->iocb_cmpl = lpfc_sli_abort_fcp_cmpl;
-               ret_val = lpfc_sli_issue_iocb(phba, pring->ringno,
-                                             abtsiocb, 0);
+               if (phba->sli_rev == LPFC_SLI_REV4) {
+                       pring_s4 = lpfc_sli4_calc_ring(phba, iocbq);
+                       if (!pring_s4)
+                               continue;
+                       ret_val = lpfc_sli_issue_iocb(phba, pring_s4->ringno,
+                                                     abtsiocb, 0);
+               } else
+                       ret_val = lpfc_sli_issue_iocb(phba, pring->ringno,
+                                                     abtsiocb, 0);
                if (ret_val == IOCB_ERROR) {
                        lpfc_sli_release_iocbq(phba, abtsiocb);
                        errcnt++;