[PATCH] scsi: qla2xxx: Protect VPD aux image query with optrom mutex

[Jiale Yao]

qla2x00_sysfs_read_vpd() calls qla28xx_get_aux_images() before taking
optrom_mutex. That helper reads flash directly, so it can overlap with
other flash operations that hold optrom_mutex. The resulting image
selection can be based on corrupted auxiliary image status and cause the
wrong VPD region to be read.

Take optrom_mutex before querying the auxiliary images and keep it held
until the selected VPD region has been read, matching the locking order
used by qla2x00_sysfs_read_nvram().

Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/scsi/qla2xxx/qla_attr.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index a4ca22024ede..03feade738e2 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -560,6 +560,12 @@ qla2x00_sysfs_read_vpd(struct file *filp, struct kobject *kobj,
 
 	faddr = ha->flt_region_vpd << 2;
 
+	mutex_lock(&ha->optrom_mutex);
+	if (qla2x00_chip_is_down(vha)) {
+		mutex_unlock(&ha->optrom_mutex);
+		return -EAGAIN;
+	}
+
 	if (IS_QLA28XX(ha)) {
 		qla28xx_get_aux_images(vha, &active_regions);
 		if (active_regions.aux.vpd_nvram == QLA27XX_SECONDARY_IMAGE)
@@ -571,12 +577,6 @@ qla2x00_sysfs_read_vpd(struct file *filp, struct kobject *kobj,
 		    "primary" : "secondary");
 	}
 
-	mutex_lock(&ha->optrom_mutex);
-	if (qla2x00_chip_is_down(vha)) {
-		mutex_unlock(&ha->optrom_mutex);
-		return -EAGAIN;
-	}
-
 	ha->isp_ops->read_optrom(vha, ha->vpd, faddr, ha->vpd_size);
 	mutex_unlock(&ha->optrom_mutex);
 
-- 
2.34.1