Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"Ten fixes, seven of which are in drivers.
The core fixes are one to fix a potential crash on resume, one to sort
out our reference count releases to avoid releasing in-use modules and
one to adjust the cmd per lun calculation to avoid an overflow in
hyper-v"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: ufs: ufs-pci: Force a full restore after suspend-to-disk
scsi: qla2xxx: Fix unmap of already freed sgl
scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()
scsi: qla2xxx: Return -ENOMEM if kzalloc() fails
scsi: sd: Fix crashes in sd_resume_runtime()
scsi: mpi3mr: Fix duplicate device entries when scanning through sysfs
scsi: core: Put LLD module refcnt after SCSI device is released
scsi: storvsc: Fix validation for unsolicited incoming packets
scsi: iscsi: Fix set_param() handling
scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
+69
-41
+2
-1
drivers/scsi/hosts.c
+2
-1
drivers/scsi/hosts.c
···
220
220
goto fail;
221
221
}
222
222
223
-
shost->cmd_per_lun = min_t(short, shost->cmd_per_lun,
223
+
/* Use min_t(int, ...) in case shost->can_queue exceeds SHRT_MAX */
224
+
shost->cmd_per_lun = min_t(int, shost->cmd_per_lun,
224
225
shost->can_queue);
225
226
226
227
error = scsi_init_sense_cache(shost);
+1
-1
drivers/scsi/mpi3mr/mpi3mr_os.c
+1
-1
drivers/scsi/mpi3mr/mpi3mr_os.c
+1
-1
drivers/scsi/qla2xxx/qla_bsg.c
+1
-1
drivers/scsi/qla2xxx/qla_bsg.c
+1
-1
drivers/scsi/qla2xxx/qla_os.c
+1
-1
drivers/scsi/qla2xxx/qla_os.c
+5
-9
drivers/scsi/qla2xxx/qla_target.c
+5
-9
drivers/scsi/qla2xxx/qla_target.c
···
3319
3319
"RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n",
3320
3320
vha->flags.online, qla2x00_reset_active(vha),
3321
3321
cmd->reset_count, qpair->chip_reset);
3322
-
spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
3323
-
return 0;
3322
+
goto out_unmap_unlock;
3324
3323
}
3325
3324
3326
3325
/* Does F/W have an IOCBs for this request */
···
3444
3445
prm.sg = NULL;
3445
3446
prm.req_cnt = 1;
3446
3447
3447
-
/* Calculate number of entries and segments required */
3448
-
if (qlt_pci_map_calc_cnt(&prm) != 0)
3449
-
return -EAGAIN;
3450
-
3451
3448
if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) ||
3452
3449
(cmd->sess && cmd->sess->deleted)) {
3453
3450
/*
···
3460
3465
cmd->reset_count, qpair->chip_reset);
3461
3466
return 0;
3462
3467
}
3468
+
3469
+
/* Calculate number of entries and segments required */
3470
+
if (qlt_pci_map_calc_cnt(&prm) != 0)
3471
+
return -EAGAIN;
3463
3472
3464
3473
spin_lock_irqsave(qpair->qp_lock_ptr, flags);
3465
3474
/* Does F/W have an IOCBs for this request */
···
3868
3869
be16_to_cpu(cmd->atio.u.isp24.fcp_hdr.ox_id));
3869
3870
3870
3871
BUG_ON(cmd->cmd_in_wq);
3871
-
3872
-
if (cmd->sg_mapped)
3873
-
qlt_unmap_sg(cmd->vha, cmd);
3874
3872
3875
3873
if (!cmd->q_full)
3876
3874
qlt_decr_num_pend_cmds(cmd->vha);
+3
-1
drivers/scsi/scsi.c
+3
-1
drivers/scsi/scsi.c
···
553
553
*/
554
554
void scsi_device_put(struct scsi_device *sdev)
555
555
{
556
-
module_put(sdev->host->hostt->module);
556
+
struct module *mod = sdev->host->hostt->module;
557
+
557
558
put_device(&sdev->sdev_gendev);
559
+
module_put(mod);
558
560
}
559
561
EXPORT_SYMBOL(scsi_device_put);
560
562
+9
drivers/scsi/scsi_sysfs.c
+9
drivers/scsi/scsi_sysfs.c
···
449
449
struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
450
450
struct scsi_vpd *vpd_pg0 = NULL, *vpd_pg89 = NULL;
451
451
unsigned long flags;
452
+
struct module *mod;
452
453
453
454
sdev = container_of(work, struct scsi_device, ew.work);
455
+
456
+
mod = sdev->host->hostt->module;
454
457
455
458
scsi_dh_release_device(sdev);
456
459
···
505
502
506
503
if (parent)
507
504
put_device(parent);
505
+
module_put(mod);
508
506
}
509
507
510
508
static void scsi_device_dev_release(struct device *dev)
511
509
{
512
510
struct scsi_device *sdp = to_scsi_device(dev);
511
+
512
+
/* Set module pointer as NULL in case of module unloading */
513
+
if (!try_module_get(sdp->host->hostt->module))
514
+
sdp->host->hostt->module = NULL;
515
+
513
516
execute_in_process_context(scsi_device_dev_release_usercontext,
514
517
&sdp->ew);
515
518
}
-2
drivers/scsi/scsi_transport_iscsi.c
-2
drivers/scsi/scsi_transport_iscsi.c
···
2930
2930
session->recovery_tmo = value;
2931
2931
break;
2932
2932
default:
2933
-
err = transport->set_param(conn, ev->u.set_param.param,
2934
-
data, ev->u.set_param.len);
2935
2933
if ((conn->state == ISCSI_CONN_BOUND) ||
2936
2934
(conn->state == ISCSI_CONN_UP)) {
2937
2935
err = transport->set_param(conn, ev->u.set_param.param,
+6
-1
drivers/scsi/sd.c
+6
-1
drivers/scsi/sd.c
···
3683
3683
static int sd_resume_runtime(struct device *dev)
3684
3684
{
3685
3685
struct scsi_disk *sdkp = dev_get_drvdata(dev);
3686
-
struct scsi_device *sdp = sdkp->device;
3686
+
struct scsi_device *sdp;
3687
+
3688
+
if (!sdkp) /* E.g.: runtime resume at the start of sd_probe() */
3689
+
return 0;
3690
+
3691
+
sdp = sdkp->device;
3687
3692
3688
3693
if (sdp->ignore_media_change) {
3689
3694
/* clear the device's sense data */
+23
-9
drivers/scsi/storvsc_drv.c
+23
-9
drivers/scsi/storvsc_drv.c
···
1285
1285
foreach_vmbus_pkt(desc, channel) {
1286
1286
struct vstor_packet *packet = hv_pkt_data(desc);
1287
1287
struct storvsc_cmd_request *request = NULL;
1288
+
u32 pktlen = hv_pkt_datalen(desc);
1288
1289
u64 rqst_id = desc->trans_id;
1290
+
u32 minlen = rqst_id ? sizeof(struct vstor_packet) -
1291
+
stor_device->vmscsi_size_delta : sizeof(enum vstor_packet_operation);
1289
1292
1290
-
if (hv_pkt_datalen(desc) < sizeof(struct vstor_packet) -
1291
-
stor_device->vmscsi_size_delta) {
1292
-
dev_err(&device->device, "Invalid packet len\n");
1293
+
if (pktlen < minlen) {
1294
+
dev_err(&device->device,
1295
+
"Invalid pkt: id=%llu, len=%u, minlen=%u\n",
1296
+
rqst_id, pktlen, minlen);
1293
1297
continue;
1294
1298
}
1295
1299
···
1306
1302
if (rqst_id == 0) {
1307
1303
/*
1308
1304
* storvsc_on_receive() looks at the vstor_packet in the message
1309
-
* from the ring buffer. If the operation in the vstor_packet is
1310
-
* COMPLETE_IO, then we call storvsc_on_io_completion(), and
1311
-
* dereference the guest memory address. Make sure we don't call
1312
-
* storvsc_on_io_completion() with a guest memory address that is
1313
-
* zero if Hyper-V were to construct and send such a bogus packet.
1305
+
* from the ring buffer.
1306
+
*
1307
+
* - If the operation in the vstor_packet is COMPLETE_IO, then
1308
+
* we call storvsc_on_io_completion(), and dereference the
1309
+
* guest memory address. Make sure we don't call
1310
+
* storvsc_on_io_completion() with a guest memory address
1311
+
* that is zero if Hyper-V were to construct and send such
1312
+
* a bogus packet.
1313
+
*
1314
+
* - If the operation in the vstor_packet is FCHBA_DATA, then
1315
+
* we call cache_wwn(), and access the data payload area of
1316
+
* the packet (wwn_packet); however, there is no guarantee
1317
+
* that the packet is big enough to contain such area.
1318
+
* Future-proof the code by rejecting such a bogus packet.
1314
1319
*/
1315
-
if (packet->operation == VSTOR_OPERATION_COMPLETE_IO) {
1320
+
if (packet->operation == VSTOR_OPERATION_COMPLETE_IO ||
1321
+
packet->operation == VSTOR_OPERATION_FCHBA_DATA) {
1316
1322
dev_err(&device->device, "Invalid packet with ID of 0\n");
1317
1323
continue;
1318
1324
}
+18
-15
drivers/scsi/ufs/ufshcd-pci.c
+18
-15
drivers/scsi/ufs/ufshcd-pci.c
···
370
370
371
371
static int ufs_intel_resume(struct ufs_hba *hba, enum ufs_pm_op op)
372
372
{
373
-
/*
374
-
* To support S4 (suspend-to-disk) with spm_lvl other than 5, the base
375
-
* address registers must be restored because the restore kernel can
376
-
* have used different addresses.
377
-
*/
378
-
ufshcd_writel(hba, lower_32_bits(hba->utrdl_dma_addr),
379
-
REG_UTP_TRANSFER_REQ_LIST_BASE_L);
380
-
ufshcd_writel(hba, upper_32_bits(hba->utrdl_dma_addr),
381
-
REG_UTP_TRANSFER_REQ_LIST_BASE_H);
382
-
ufshcd_writel(hba, lower_32_bits(hba->utmrdl_dma_addr),
383
-
REG_UTP_TASK_REQ_LIST_BASE_L);
384
-
ufshcd_writel(hba, upper_32_bits(hba->utmrdl_dma_addr),
385
-
REG_UTP_TASK_REQ_LIST_BASE_H);
386
-
387
373
if (ufshcd_is_link_hibern8(hba)) {
388
374
int ret = ufshcd_uic_hibern8_exit(hba);
389
375
···
448
462
.resume = ufs_intel_resume,
449
463
.device_reset = ufs_intel_device_reset,
450
464
};
465
+
466
+
#ifdef CONFIG_PM_SLEEP
467
+
static int ufshcd_pci_restore(struct device *dev)
468
+
{
469
+
struct ufs_hba *hba = dev_get_drvdata(dev);
470
+
471
+
/* Force a full reset and restore */
472
+
ufshcd_set_link_off(hba);
473
+
474
+
return ufshcd_system_resume(dev);
475
+
}
476
+
#endif
451
477
452
478
/**
453
479
* ufshcd_pci_shutdown - main function to put the controller in reset state
···
544
546
}
545
547
546
548
static const struct dev_pm_ops ufshcd_pci_pm_ops = {
547
-
SET_SYSTEM_SLEEP_PM_OPS(ufshcd_system_suspend, ufshcd_system_resume)
548
549
SET_RUNTIME_PM_OPS(ufshcd_runtime_suspend, ufshcd_runtime_resume, NULL)
549
550
#ifdef CONFIG_PM_SLEEP
551
+
.suspend = ufshcd_system_suspend,
552
+
.resume = ufshcd_system_resume,
553
+
.freeze = ufshcd_system_suspend,
554
+
.thaw = ufshcd_system_resume,
555
+
.poweroff = ufshcd_system_suspend,
556
+
.restore = ufshcd_pci_restore,
550
557
.prepare = ufshcd_suspend_prepare,
551
558
.complete = ufshcd_resume_complete,
552
559
#endif