The controller memory buffer is remapped into a kernel address on each reset, but the driver was setting the submission queue base address only on the very first queue creation. The remapped address is likely to change after a reset, so accessing the old address will hit a kernel bug.

This patch fixes that by setting the queue's CMB base address each time the queue is created.

Cherry-pick from upstream commit 815c6704bf9f ("nvme-pci: Remap CMB SQ entries on every controller reset")

Fixes: f63572dff1421 ("nvme: unmap CMB and remove sysfs file in reset path") Reported-by: Christian Black christian.d.black@intel.com Cc: Jon Derrick jonathan.derrick@intel.com Cc: stable@vger.kernel.org # 4.9+ Signed-off-by: Keith Busch keith.busch@intel.com Reviewed-by: Christoph Hellwig hch@lst.de Signed-off-by: Gavin Shan shan.gavin@linux.alibaba.com --- drivers/nvme/host/pci.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 52d540f089e0..84fb47c4ad5c 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -1174,18 +1174,16 @@ static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq, int sq_idx, int depth) { int qid = nvmeq->sq[sq_idx].id; - if (qid && dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) { - unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth), - dev->ctrl.page_size); - nvmeq->sq[sq_idx].sq_dma_addr = dev->cmb_bus_addr + offset; - nvmeq->sq[sq_idx].sq_cmds_io = dev->cmb + offset; - } else { - nvmeq->sq[sq_idx].sq_cmds = dma_alloc_coherent(dev->dev, - SQ_SIZE(depth), - &nvmeq->sq[sq_idx].sq_dma_addr, GFP_KERNEL); - if (!nvmeq->sq[sq_idx].sq_cmds) - return -ENOMEM; - } + + /* CMB SQEs will be mapped before creation */ + if (qid && dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) + return 0; + + nvmeq->sq[sq_idx].sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth), + &nvmeq->sq[sq_idx].sq_dma_addr, + GFP_KERNEL); + if (!nvmeq->sq[sq_idx].sq_cmds) + return -ENOMEM;

return 0; } @@ -1280,6 +1278,13 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid) struct nvme_dev *dev = nvmeq->dev; int result, i;

+ if (dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) { + unsigned offset = (qid - 1) * roundup(SQ_SIZE(nvmeq->q_depth), + dev->ctrl.page_size); + nvmeq->sq[0].sq_dma_addr = dev->cmb_bus_addr + offset; + nvmeq->sq[0].sq_cmds_io = dev->cmb + offset; + } + nvmeq->cq_vector = qid - 1; result = adapter_alloc_cq(dev, nvmeq->cq_id, nvmeq); if (result < 0)