tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull more SCSI updates from James Bottomley:
"This is the set of changes collected since just before the merge
window opened. It's mostly minor fixes in drivers.

The one non-driver set is the three optical disk (sr) changes where
two are error path fixes and one is a helper conversion.

The big driver change is the hpsa compat_alloc_userspace rework by Al
so he can kill the remaining user. This has been tested and acked by
the maintainer"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (21 commits)
scsi: acornscsi: Fix an error handling path in acornscsi_probe()
scsi: storvsc: Remove memset before memory freeing in storvsc_suspend()
scsi: cxlflash: Remove an unnecessary NULL check
scsi: ibmvscsi: Don't send host info in adapter info MAD after LPM
scsi: sr: Fix sr_probe() missing deallocate of device minor
scsi: sr: Fix sr_probe() missing mutex_destroy
scsi: st: Convert convert get_user_pages() --> pin_user_pages()
scsi: target: Rename target_setup_cmd_from_cdb() to target_cmd_parse_cdb()
scsi: target: Fix NULL pointer dereference
scsi: target: Initialize LUN in transport_init_se_cmd()
scsi: target: Factor out a new helper, target_cmd_init_cdb()
scsi: hpsa: hpsa_ioctl(): Tidy up a bit
scsi: hpsa: Get rid of compat_alloc_user_space()
scsi: hpsa: Don't bother with vmalloc for BIG_IOCTL_Command_struct
scsi: hpsa: Lift {BIG_,}IOCTL_Command_struct copy{in,out} into hpsa_ioctl()
scsi: ufs: Remove redundant urgent_bkop_lvl initialization
scsi: ufs: Don't update urgent bkops level when toggling auto bkops
scsi: qedf: Remove redundant initialization of variable rc
scsi: mpt3sas: Fix memset() in non-RDPQ mode
scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj
...

Linus Torvalds 3df83e16 91fa5884

+199 -197
+3 -1
drivers/scsi/arm/acornscsi.c
··· 2911 2911 2912 2912 ashost->base = ecardm_iomap(ec, ECARD_RES_MEMC, 0, 0); 2913 2913 ashost->fast = ecardm_iomap(ec, ECARD_RES_IOCFAST, 0, 0); 2914 - if (!ashost->base || !ashost->fast) 2914 + if (!ashost->base || !ashost->fast) { 2915 + ret = -ENOMEM; 2915 2916 goto out_put; 2917 + } 2916 2918 2917 2919 host->irq = ec->irq; 2918 2920 ashost->host = host;
-3
drivers/scsi/cxlflash/main.c
··· 47 47 struct sisl_ioasa *ioasa; 48 48 u32 resid; 49 49 50 - if (unlikely(!cmd)) 51 - return; 52 - 53 50 ioasa = &(cmd->sa); 54 51 55 52 if (ioasa->rc.flags & SISL_RC_FLAGS_UNDERRUN) {
+90 -109
drivers/scsi/hpsa.c
··· 254 254 static irqreturn_t do_hpsa_intr_msi(int irq, void *dev_id); 255 255 static int hpsa_ioctl(struct scsi_device *dev, unsigned int cmd, 256 256 void __user *arg); 257 + static int hpsa_passthru_ioctl(struct ctlr_info *h, 258 + IOCTL_Command_struct *iocommand); 259 + static int hpsa_big_passthru_ioctl(struct ctlr_info *h, 260 + BIG_IOCTL_Command_struct *ioc); 257 261 258 262 #ifdef CONFIG_COMPAT 259 263 static int hpsa_compat_ioctl(struct scsi_device *dev, unsigned int cmd, ··· 6221 6217 static int hpsa_ioctl32_passthru(struct scsi_device *dev, unsigned int cmd, 6222 6218 void __user *arg) 6223 6219 { 6224 - IOCTL32_Command_struct __user *arg32 = 6225 - (IOCTL32_Command_struct __user *) arg; 6220 + struct ctlr_info *h = sdev_to_hba(dev); 6221 + IOCTL32_Command_struct __user *arg32 = arg; 6226 6222 IOCTL_Command_struct arg64; 6227 - IOCTL_Command_struct __user *p = compat_alloc_user_space(sizeof(arg64)); 6228 6223 int err; 6229 6224 u32 cp; 6230 6225 6226 + if (!arg) 6227 + return -EINVAL; 6228 + 6231 6229 memset(&arg64, 0, sizeof(arg64)); 6232 - err = 0; 6233 - err |= copy_from_user(&arg64.LUN_info, &arg32->LUN_info, 6234 - sizeof(arg64.LUN_info)); 6235 - err |= copy_from_user(&arg64.Request, &arg32->Request, 6236 - sizeof(arg64.Request)); 6237 - err |= copy_from_user(&arg64.error_info, &arg32->error_info, 6238 - sizeof(arg64.error_info)); 6239 - err |= get_user(arg64.buf_size, &arg32->buf_size); 6240 - err |= get_user(cp, &arg32->buf); 6241 - arg64.buf = compat_ptr(cp); 6242 - err |= copy_to_user(p, &arg64, sizeof(arg64)); 6243 - 6244 - if (err) 6230 + if (copy_from_user(&arg64, arg32, offsetof(IOCTL_Command_struct, buf))) 6245 6231 return -EFAULT; 6232 + if (get_user(cp, &arg32->buf)) 6233 + return -EFAULT; 6234 + arg64.buf = compat_ptr(cp); 6246 6235 6247 - err = hpsa_ioctl(dev, CCISS_PASSTHRU, p); 6236 + if (atomic_dec_if_positive(&h->passthru_cmds_avail) < 0) 6237 + return -EAGAIN; 6238 + err = hpsa_passthru_ioctl(h, &arg64); 6239 + atomic_inc(&h->passthru_cmds_avail); 6248 6240 if (err) 6249 6241 return err; 6250 - err |= copy_in_user(&arg32->error_info, &p->error_info, 6251 - sizeof(arg32->error_info)); 6252 - if (err) 6242 + if (copy_to_user(&arg32->error_info, &arg64.error_info, 6243 + sizeof(arg32->error_info))) 6253 6244 return -EFAULT; 6254 - return err; 6245 + return 0; 6255 6246 } 6256 6247 6257 6248 static int hpsa_ioctl32_big_passthru(struct scsi_device *dev, 6258 6249 unsigned int cmd, void __user *arg) 6259 6250 { 6260 - BIG_IOCTL32_Command_struct __user *arg32 = 6261 - (BIG_IOCTL32_Command_struct __user *) arg; 6251 + struct ctlr_info *h = sdev_to_hba(dev); 6252 + BIG_IOCTL32_Command_struct __user *arg32 = arg; 6262 6253 BIG_IOCTL_Command_struct arg64; 6263 - BIG_IOCTL_Command_struct __user *p = 6264 - compat_alloc_user_space(sizeof(arg64)); 6265 6254 int err; 6266 6255 u32 cp; 6267 6256 6257 + if (!arg) 6258 + return -EINVAL; 6268 6259 memset(&arg64, 0, sizeof(arg64)); 6269 - err = 0; 6270 - err |= copy_from_user(&arg64.LUN_info, &arg32->LUN_info, 6271 - sizeof(arg64.LUN_info)); 6272 - err |= copy_from_user(&arg64.Request, &arg32->Request, 6273 - sizeof(arg64.Request)); 6274 - err |= copy_from_user(&arg64.error_info, &arg32->error_info, 6275 - sizeof(arg64.error_info)); 6276 - err |= get_user(arg64.buf_size, &arg32->buf_size); 6277 - err |= get_user(arg64.malloc_size, &arg32->malloc_size); 6278 - err |= get_user(cp, &arg32->buf); 6279 - arg64.buf = compat_ptr(cp); 6280 - err |= copy_to_user(p, &arg64, sizeof(arg64)); 6281 - 6282 - if (err) 6260 + if (copy_from_user(&arg64, arg32, 6261 + offsetof(BIG_IOCTL32_Command_struct, buf))) 6283 6262 return -EFAULT; 6263 + if (get_user(cp, &arg32->buf)) 6264 + return -EFAULT; 6265 + arg64.buf = compat_ptr(cp); 6284 6266 6285 - err = hpsa_ioctl(dev, CCISS_BIG_PASSTHRU, p); 6267 + if (atomic_dec_if_positive(&h->passthru_cmds_avail) < 0) 6268 + return -EAGAIN; 6269 + err = hpsa_big_passthru_ioctl(h, &arg64); 6270 + atomic_inc(&h->passthru_cmds_avail); 6286 6271 if (err) 6287 6272 return err; 6288 - err |= copy_in_user(&arg32->error_info, &p->error_info, 6289 - sizeof(arg32->error_info)); 6290 - if (err) 6273 + if (copy_to_user(&arg32->error_info, &arg64.error_info, 6274 + sizeof(arg32->error_info))) 6291 6275 return -EFAULT; 6292 - return err; 6276 + return 0; 6293 6277 } 6294 6278 6295 6279 static int hpsa_compat_ioctl(struct scsi_device *dev, unsigned int cmd, ··· 6350 6358 return 0; 6351 6359 } 6352 6360 6353 - static int hpsa_passthru_ioctl(struct ctlr_info *h, void __user *argp) 6361 + static int hpsa_passthru_ioctl(struct ctlr_info *h, 6362 + IOCTL_Command_struct *iocommand) 6354 6363 { 6355 - IOCTL_Command_struct iocommand; 6356 6364 struct CommandList *c; 6357 6365 char *buff = NULL; 6358 6366 u64 temp64; 6359 6367 int rc = 0; 6360 6368 6361 - if (!argp) 6362 - return -EINVAL; 6363 6369 if (!capable(CAP_SYS_RAWIO)) 6364 6370 return -EPERM; 6365 - if (copy_from_user(&iocommand, argp, sizeof(iocommand))) 6366 - return -EFAULT; 6367 - if ((iocommand.buf_size < 1) && 6368 - (iocommand.Request.Type.Direction != XFER_NONE)) { 6371 + if ((iocommand->buf_size < 1) && 6372 + (iocommand->Request.Type.Direction != XFER_NONE)) { 6369 6373 return -EINVAL; 6370 6374 } 6371 - if (iocommand.buf_size > 0) { 6372 - buff = kmalloc(iocommand.buf_size, GFP_KERNEL); 6375 + if (iocommand->buf_size > 0) { 6376 + buff = kmalloc(iocommand->buf_size, GFP_KERNEL); 6373 6377 if (buff == NULL) 6374 6378 return -ENOMEM; 6375 - if (iocommand.Request.Type.Direction & XFER_WRITE) { 6379 + if (iocommand->Request.Type.Direction & XFER_WRITE) { 6376 6380 /* Copy the data into the buffer we created */ 6377 - if (copy_from_user(buff, iocommand.buf, 6378 - iocommand.buf_size)) { 6381 + if (copy_from_user(buff, iocommand->buf, 6382 + iocommand->buf_size)) { 6379 6383 rc = -EFAULT; 6380 6384 goto out_kfree; 6381 6385 } 6382 6386 } else { 6383 - memset(buff, 0, iocommand.buf_size); 6387 + memset(buff, 0, iocommand->buf_size); 6384 6388 } 6385 6389 } 6386 6390 c = cmd_alloc(h); ··· 6386 6398 c->scsi_cmd = SCSI_CMD_BUSY; 6387 6399 /* Fill in Command Header */ 6388 6400 c->Header.ReplyQueue = 0; /* unused in simple mode */ 6389 - if (iocommand.buf_size > 0) { /* buffer to fill */ 6401 + if (iocommand->buf_size > 0) { /* buffer to fill */ 6390 6402 c->Header.SGList = 1; 6391 6403 c->Header.SGTotal = cpu_to_le16(1); 6392 6404 } else { /* no buffers to fill */ 6393 6405 c->Header.SGList = 0; 6394 6406 c->Header.SGTotal = cpu_to_le16(0); 6395 6407 } 6396 - memcpy(&c->Header.LUN, &iocommand.LUN_info, sizeof(c->Header.LUN)); 6408 + memcpy(&c->Header.LUN, &iocommand->LUN_info, sizeof(c->Header.LUN)); 6397 6409 6398 6410 /* Fill in Request block */ 6399 - memcpy(&c->Request, &iocommand.Request, 6411 + memcpy(&c->Request, &iocommand->Request, 6400 6412 sizeof(c->Request)); 6401 6413 6402 6414 /* Fill in the scatter gather information */ 6403 - if (iocommand.buf_size > 0) { 6415 + if (iocommand->buf_size > 0) { 6404 6416 temp64 = dma_map_single(&h->pdev->dev, buff, 6405 - iocommand.buf_size, DMA_BIDIRECTIONAL); 6417 + iocommand->buf_size, DMA_BIDIRECTIONAL); 6406 6418 if (dma_mapping_error(&h->pdev->dev, (dma_addr_t) temp64)) { 6407 6419 c->SG[0].Addr = cpu_to_le64(0); 6408 6420 c->SG[0].Len = cpu_to_le32(0); ··· 6410 6422 goto out; 6411 6423 } 6412 6424 c->SG[0].Addr = cpu_to_le64(temp64); 6413 - c->SG[0].Len = cpu_to_le32(iocommand.buf_size); 6425 + c->SG[0].Len = cpu_to_le32(iocommand->buf_size); 6414 6426 c->SG[0].Ext = cpu_to_le32(HPSA_SG_LAST); /* not chaining */ 6415 6427 } 6416 6428 rc = hpsa_scsi_do_simple_cmd(h, c, DEFAULT_REPLY_QUEUE, 6417 6429 NO_TIMEOUT); 6418 - if (iocommand.buf_size > 0) 6430 + if (iocommand->buf_size > 0) 6419 6431 hpsa_pci_unmap(h->pdev, c, 1, DMA_BIDIRECTIONAL); 6420 6432 check_ioctl_unit_attention(h, c); 6421 6433 if (rc) { ··· 6424 6436 } 6425 6437 6426 6438 /* Copy the error information out */ 6427 - memcpy(&iocommand.error_info, c->err_info, 6428 - sizeof(iocommand.error_info)); 6429 - if (copy_to_user(argp, &iocommand, sizeof(iocommand))) { 6430 - rc = -EFAULT; 6431 - goto out; 6432 - } 6433 - if ((iocommand.Request.Type.Direction & XFER_READ) && 6434 - iocommand.buf_size > 0) { 6439 + memcpy(&iocommand->error_info, c->err_info, 6440 + sizeof(iocommand->error_info)); 6441 + if ((iocommand->Request.Type.Direction & XFER_READ) && 6442 + iocommand->buf_size > 0) { 6435 6443 /* Copy the data out of the buffer we created */ 6436 - if (copy_to_user(iocommand.buf, buff, iocommand.buf_size)) { 6444 + if (copy_to_user(iocommand->buf, buff, iocommand->buf_size)) { 6437 6445 rc = -EFAULT; 6438 6446 goto out; 6439 6447 } ··· 6441 6457 return rc; 6442 6458 } 6443 6459 6444 - static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp) 6460 + static int hpsa_big_passthru_ioctl(struct ctlr_info *h, 6461 + BIG_IOCTL_Command_struct *ioc) 6445 6462 { 6446 - BIG_IOCTL_Command_struct *ioc; 6447 6463 struct CommandList *c; 6448 6464 unsigned char **buff = NULL; 6449 6465 int *buff_size = NULL; ··· 6454 6470 u32 sz; 6455 6471 BYTE __user *data_ptr; 6456 6472 6457 - if (!argp) 6458 - return -EINVAL; 6459 6473 if (!capable(CAP_SYS_RAWIO)) 6460 6474 return -EPERM; 6461 - ioc = vmemdup_user(argp, sizeof(*ioc)); 6462 - if (IS_ERR(ioc)) { 6463 - status = PTR_ERR(ioc); 6464 - goto cleanup1; 6465 - } 6475 + 6466 6476 if ((ioc->buf_size < 1) && 6467 - (ioc->Request.Type.Direction != XFER_NONE)) { 6468 - status = -EINVAL; 6469 - goto cleanup1; 6470 - } 6477 + (ioc->Request.Type.Direction != XFER_NONE)) 6478 + return -EINVAL; 6471 6479 /* Check kmalloc limits using all SGs */ 6472 - if (ioc->malloc_size > MAX_KMALLOC_SIZE) { 6473 - status = -EINVAL; 6474 - goto cleanup1; 6475 - } 6476 - if (ioc->buf_size > ioc->malloc_size * SG_ENTRIES_IN_CMD) { 6477 - status = -EINVAL; 6478 - goto cleanup1; 6479 - } 6480 + if (ioc->malloc_size > MAX_KMALLOC_SIZE) 6481 + return -EINVAL; 6482 + if (ioc->buf_size > ioc->malloc_size * SG_ENTRIES_IN_CMD) 6483 + return -EINVAL; 6480 6484 buff = kcalloc(SG_ENTRIES_IN_CMD, sizeof(char *), GFP_KERNEL); 6481 6485 if (!buff) { 6482 6486 status = -ENOMEM; ··· 6537 6565 6538 6566 /* Copy the error information out */ 6539 6567 memcpy(&ioc->error_info, c->err_info, sizeof(ioc->error_info)); 6540 - if (copy_to_user(argp, ioc, sizeof(*ioc))) { 6541 - status = -EFAULT; 6542 - goto cleanup0; 6543 - } 6544 6568 if ((ioc->Request.Type.Direction & XFER_READ) && ioc->buf_size > 0) { 6545 6569 int i; 6546 6570 ··· 6562 6594 kfree(buff); 6563 6595 } 6564 6596 kfree(buff_size); 6565 - kvfree(ioc); 6566 6597 return status; 6567 6598 } 6568 6599 ··· 6577 6610 * ioctl 6578 6611 */ 6579 6612 static int hpsa_ioctl(struct scsi_device *dev, unsigned int cmd, 6580 - void __user *arg) 6613 + void __user *argp) 6581 6614 { 6582 - struct ctlr_info *h; 6583 - void __user *argp = (void __user *)arg; 6615 + struct ctlr_info *h = sdev_to_hba(dev); 6584 6616 int rc; 6585 - 6586 - h = sdev_to_hba(dev); 6587 6617 6588 6618 switch (cmd) { 6589 6619 case CCISS_DEREGDISK: ··· 6592 6628 return hpsa_getpciinfo_ioctl(h, argp); 6593 6629 case CCISS_GETDRIVVER: 6594 6630 return hpsa_getdrivver_ioctl(h, argp); 6595 - case CCISS_PASSTHRU: 6631 + case CCISS_PASSTHRU: { 6632 + IOCTL_Command_struct iocommand; 6633 + 6634 + if (!argp) 6635 + return -EINVAL; 6636 + if (copy_from_user(&iocommand, argp, sizeof(iocommand))) 6637 + return -EFAULT; 6596 6638 if (atomic_dec_if_positive(&h->passthru_cmds_avail) < 0) 6597 6639 return -EAGAIN; 6598 - rc = hpsa_passthru_ioctl(h, argp); 6640 + rc = hpsa_passthru_ioctl(h, &iocommand); 6599 6641 atomic_inc(&h->passthru_cmds_avail); 6642 + if (!rc && copy_to_user(argp, &iocommand, sizeof(iocommand))) 6643 + rc = -EFAULT; 6600 6644 return rc; 6601 - case CCISS_BIG_PASSTHRU: 6645 + } 6646 + case CCISS_BIG_PASSTHRU: { 6647 + BIG_IOCTL_Command_struct ioc; 6648 + if (!argp) 6649 + return -EINVAL; 6650 + if (copy_from_user(&ioc, argp, sizeof(ioc))) 6651 + return -EFAULT; 6602 6652 if (atomic_dec_if_positive(&h->passthru_cmds_avail) < 0) 6603 6653 return -EAGAIN; 6604 - rc = hpsa_big_passthru_ioctl(h, argp); 6654 + rc = hpsa_big_passthru_ioctl(h, &ioc); 6605 6655 atomic_inc(&h->passthru_cmds_avail); 6656 + if (!rc && copy_to_user(argp, &ioc, sizeof(ioc))) 6657 + rc = -EFAULT; 6606 6658 return rc; 6659 + } 6607 6660 default: 6608 6661 return -ENOTTY; 6609 6662 }
+2
drivers/scsi/ibmvscsi/ibmvscsi.c
··· 415 415 int rc = 0; 416 416 struct vio_dev *vdev = to_vio_dev(hostdata->dev); 417 417 418 + set_adapter_info(hostdata); 419 + 418 420 /* Re-enable the CRQ */ 419 421 do { 420 422 if (rc)
+1 -1
drivers/scsi/iscsi_boot_sysfs.c
··· 352 352 boot_kobj->kobj.kset = boot_kset->kset; 353 353 if (kobject_init_and_add(&boot_kobj->kobj, &iscsi_boot_ktype, 354 354 NULL, name, index)) { 355 - kfree(boot_kobj); 355 + kobject_put(&boot_kobj->kobj); 356 356 return NULL; 357 357 } 358 358 boot_kobj->data = data;
+1 -4
drivers/scsi/mpt3sas/mpt3sas_base.c
··· 4984 4984 for (i = 0; i < count; i++) { 4985 4985 if ((i % RDPQ_MAX_INDEX_IN_ONE_CHUNK == 0) && dma_alloc_count) { 4986 4986 ioc->reply_post[i].reply_post_free = 4987 - dma_pool_alloc(ioc->reply_post_free_dma_pool, 4987 + dma_pool_zalloc(ioc->reply_post_free_dma_pool, 4988 4988 GFP_KERNEL, 4989 4989 &ioc->reply_post[i].reply_post_free_dma); 4990 4990 if (!ioc->reply_post[i].reply_post_free) ··· 5008 5008 ioc->reply_post[i].reply_post_free_dma)); 5009 5009 return -EAGAIN; 5010 5010 } 5011 - memset(ioc->reply_post[i].reply_post_free, 0, 5012 - RDPQ_MAX_INDEX_IN_ONE_CHUNK * 5013 - reply_post_free_sz); 5014 5011 dma_alloc_count--; 5015 5012 5016 5013 } else {
+1 -1
drivers/scsi/qedf/qedf_fip.c
··· 20 20 #define MY_FIP_ALL_FCF_MACS ((__u8[6]) { 1, 0x10, 0x18, 1, 0, 2 }) 21 21 static u8 my_fcoe_all_fcfs[ETH_ALEN] = MY_FIP_ALL_FCF_MACS; 22 22 unsigned long flags = 0; 23 - int rc = -1; 23 + int rc; 24 24 25 25 skb = dev_alloc_skb(sizeof(struct fip_vlan)); 26 26 if (!skb) {
+6 -1
drivers/scsi/sr.c
··· 792 792 disk->queue = sdev->request_queue; 793 793 794 794 if (register_cdrom(disk, &cd->cdi)) 795 - goto fail_put; 795 + goto fail_minor; 796 796 797 797 /* 798 798 * Initialize block layer runtime PM stuffs before the ··· 810 810 811 811 return 0; 812 812 813 + fail_minor: 814 + spin_lock(&sr_index_lock); 815 + clear_bit(minor, sr_index_bits); 816 + spin_unlock(&sr_index_lock); 813 817 fail_put: 814 818 put_disk(disk); 819 + mutex_destroy(&cd->lock); 815 820 fail_free: 816 821 kfree(cd); 817 822 fail:
+5 -15
drivers/scsi/st.c
··· 4921 4921 unsigned long end = (uaddr + count + PAGE_SIZE - 1) >> PAGE_SHIFT; 4922 4922 unsigned long start = uaddr >> PAGE_SHIFT; 4923 4923 const int nr_pages = end - start; 4924 - int res, i, j; 4924 + int res, i; 4925 4925 struct page **pages; 4926 4926 struct rq_map_data *mdata = &STbp->map_data; 4927 4927 ··· 4943 4943 4944 4944 /* Try to fault in all of the necessary pages */ 4945 4945 /* rw==READ means read from drive, write into memory area */ 4946 - res = get_user_pages_fast(uaddr, nr_pages, rw == READ ? FOLL_WRITE : 0, 4946 + res = pin_user_pages_fast(uaddr, nr_pages, rw == READ ? FOLL_WRITE : 0, 4947 4947 pages); 4948 4948 4949 4949 /* Errors and no page mapped should return here */ ··· 4963 4963 return nr_pages; 4964 4964 out_unmap: 4965 4965 if (res > 0) { 4966 - for (j=0; j < res; j++) 4967 - put_page(pages[j]); 4966 + unpin_user_pages(pages, res); 4968 4967 res = 0; 4969 4968 } 4970 4969 kfree(pages); ··· 4975 4976 static int sgl_unmap_user_pages(struct st_buffer *STbp, 4976 4977 const unsigned int nr_pages, int dirtied) 4977 4978 { 4978 - int i; 4979 + /* FIXME: cache flush missing for rw==READ */ 4980 + unpin_user_pages_dirty_lock(STbp->mapped_pages, nr_pages, dirtied); 4979 4981 4980 - for (i=0; i < nr_pages; i++) { 4981 - struct page *page = STbp->mapped_pages[i]; 4982 - 4983 - if (dirtied) 4984 - SetPageDirty(page); 4985 - /* FIXME: cache flush missing for rw==READ 4986 - * FIXME: call the correct reference counting function 4987 - */ 4988 - put_page(page); 4989 - } 4990 4982 kfree(STbp->mapped_pages); 4991 4983 STbp->mapped_pages = NULL; 4992 4984
-3
drivers/scsi/storvsc_drv.c
··· 2035 2035 2036 2036 vmbus_close(hv_dev->channel); 2037 2037 2038 - memset(stor_device->stor_chns, 0, 2039 - num_possible_cpus() * sizeof(void *)); 2040 - 2041 2038 kfree(stor_device->stor_chns); 2042 2039 stor_device->stor_chns = NULL; 2043 2040
+1 -5
drivers/scsi/ufs/ufshcd.c
··· 5076 5076 hba->ee_ctrl_mask &= ~MASK_EE_URGENT_BKOPS; 5077 5077 ufshcd_disable_auto_bkops(hba); 5078 5078 } 5079 + hba->urgent_bkops_lvl = BKOPS_STATUS_PERF_IMPACT; 5079 5080 hba->is_urgent_bkops_lvl_checked = false; 5080 5081 } 5081 5082 ··· 5124 5123 err = ufshcd_enable_auto_bkops(hba); 5125 5124 else 5126 5125 err = ufshcd_disable_auto_bkops(hba); 5127 - hba->urgent_bkops_lvl = curr_status; 5128 5126 out: 5129 5127 return err; 5130 5128 } ··· 7372 7372 ret = ufshcd_link_startup(hba); 7373 7373 if (ret) 7374 7374 goto out; 7375 - 7376 - /* set the default level for urgent bkops */ 7377 - hba->urgent_bkops_lvl = BKOPS_STATUS_PERF_IMPACT; 7378 - hba->is_urgent_bkops_lvl_checked = false; 7379 7375 7380 7376 /* Debug counters initialization */ 7381 7377 ufshcd_clear_dbg_ufs_stats(hba);
+17 -14
drivers/target/iscsi/iscsi_target.c
··· 1158 1158 transport_init_se_cmd(&cmd->se_cmd, &iscsi_ops, 1159 1159 conn->sess->se_sess, be32_to_cpu(hdr->data_length), 1160 1160 cmd->data_direction, sam_task_attr, 1161 - cmd->sense_buffer + 2); 1161 + cmd->sense_buffer + 2, scsilun_to_int(&hdr->lun)); 1162 1162 1163 1163 pr_debug("Got SCSI Command, ITT: 0x%08x, CmdSN: 0x%08x," 1164 1164 " ExpXferLen: %u, Length: %u, CID: %hu\n", hdr->itt, ··· 1167 1167 1168 1168 target_get_sess_cmd(&cmd->se_cmd, true); 1169 1169 1170 - cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd, 1171 - scsilun_to_int(&hdr->lun)); 1170 + cmd->sense_reason = target_cmd_init_cdb(&cmd->se_cmd, hdr->cdb); 1171 + if (cmd->sense_reason) { 1172 + if (cmd->sense_reason == TCM_OUT_OF_RESOURCES) { 1173 + return iscsit_add_reject_cmd(cmd, 1174 + ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf); 1175 + } 1176 + 1177 + goto attach_cmd; 1178 + } 1179 + 1180 + cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd); 1172 1181 if (cmd->sense_reason) 1173 1182 goto attach_cmd; 1174 1183 1175 1184 /* only used for printks or comparing with ->ref_task_tag */ 1176 1185 cmd->se_cmd.tag = (__force u32)cmd->init_task_tag; 1177 - cmd->sense_reason = target_setup_cmd_from_cdb(&cmd->se_cmd, hdr->cdb); 1178 - if (cmd->sense_reason) { 1179 - if (cmd->sense_reason == TCM_OUT_OF_RESOURCES) { 1180 - return iscsit_add_reject_cmd(cmd, 1181 - ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf); 1182 - } 1183 - 1186 + cmd->sense_reason = target_cmd_parse_cdb(&cmd->se_cmd); 1187 + if (cmd->sense_reason) 1184 1188 goto attach_cmd; 1185 - } 1186 1189 1187 1190 if (iscsit_build_pdu_and_seq_lists(cmd, payload_length) < 0) { 1188 1191 return iscsit_add_reject_cmd(cmd, ··· 2003 2000 2004 2001 transport_init_se_cmd(&cmd->se_cmd, &iscsi_ops, 2005 2002 conn->sess->se_sess, 0, DMA_NONE, 2006 - TCM_SIMPLE_TAG, cmd->sense_buffer + 2); 2003 + TCM_SIMPLE_TAG, cmd->sense_buffer + 2, 2004 + scsilun_to_int(&hdr->lun)); 2007 2005 2008 2006 target_get_sess_cmd(&cmd->se_cmd, true); 2009 2007 ··· 2042 2038 * Locate the struct se_lun for all TMRs not related to ERL=2 TASK_REASSIGN 2043 2039 */ 2044 2040 if (function != ISCSI_TM_FUNC_TASK_REASSIGN) { 2045 - ret = transport_lookup_tmr_lun(&cmd->se_cmd, 2046 - scsilun_to_int(&hdr->lun)); 2041 + ret = transport_lookup_tmr_lun(&cmd->se_cmd); 2047 2042 if (ret < 0) { 2048 2043 se_tmr->response = ISCSI_TMF_RSP_NO_LUN; 2049 2044 goto attach;
+8 -11
drivers/target/target_core_device.c
··· 45 45 struct se_device *g_lun0_dev; 46 46 47 47 sense_reason_t 48 - transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun) 48 + transport_lookup_cmd_lun(struct se_cmd *se_cmd) 49 49 { 50 50 struct se_lun *se_lun = NULL; 51 51 struct se_session *se_sess = se_cmd->se_sess; ··· 54 54 sense_reason_t ret = TCM_NO_SENSE; 55 55 56 56 rcu_read_lock(); 57 - deve = target_nacl_find_deve(nacl, unpacked_lun); 57 + deve = target_nacl_find_deve(nacl, se_cmd->orig_fe_lun); 58 58 if (deve) { 59 59 atomic_long_inc(&deve->total_cmds); 60 60 ··· 74 74 75 75 se_cmd->se_lun = se_lun; 76 76 se_cmd->pr_res_key = deve->pr_res_key; 77 - se_cmd->orig_fe_lun = unpacked_lun; 78 77 se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD; 79 78 se_cmd->lun_ref_active = true; 80 79 ··· 82 83 pr_err("TARGET_CORE[%s]: Detected WRITE_PROTECTED LUN" 83 84 " Access for 0x%08llx\n", 84 85 se_cmd->se_tfo->fabric_name, 85 - unpacked_lun); 86 + se_cmd->orig_fe_lun); 86 87 rcu_read_unlock(); 87 88 ret = TCM_WRITE_PROTECTED; 88 89 goto ref_dev; ··· 97 98 * REPORT_LUNS, et al to be returned when no active 98 99 * MappedLUN=0 exists for this Initiator Port. 99 100 */ 100 - if (unpacked_lun != 0) { 101 + if (se_cmd->orig_fe_lun != 0) { 101 102 pr_err("TARGET_CORE[%s]: Detected NON_EXISTENT_LUN" 102 103 " Access for 0x%08llx from %s\n", 103 104 se_cmd->se_tfo->fabric_name, 104 - unpacked_lun, 105 + se_cmd->orig_fe_lun, 105 106 nacl->initiatorname); 106 107 return TCM_NON_EXISTENT_LUN; 107 108 } 108 109 109 110 se_lun = se_sess->se_tpg->tpg_virt_lun0; 110 111 se_cmd->se_lun = se_sess->se_tpg->tpg_virt_lun0; 111 - se_cmd->orig_fe_lun = 0; 112 112 se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD; 113 113 114 114 percpu_ref_get(&se_lun->lun_ref); ··· 143 145 } 144 146 EXPORT_SYMBOL(transport_lookup_cmd_lun); 145 147 146 - int transport_lookup_tmr_lun(struct se_cmd *se_cmd, u64 unpacked_lun) 148 + int transport_lookup_tmr_lun(struct se_cmd *se_cmd) 147 149 { 148 150 struct se_dev_entry *deve; 149 151 struct se_lun *se_lun = NULL; ··· 153 155 unsigned long flags; 154 156 155 157 rcu_read_lock(); 156 - deve = target_nacl_find_deve(nacl, unpacked_lun); 158 + deve = target_nacl_find_deve(nacl, se_cmd->orig_fe_lun); 157 159 if (deve) { 158 160 se_lun = rcu_dereference(deve->se_lun); 159 161 ··· 164 166 165 167 se_cmd->se_lun = se_lun; 166 168 se_cmd->pr_res_key = deve->pr_res_key; 167 - se_cmd->orig_fe_lun = unpacked_lun; 168 169 se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD; 169 170 se_cmd->lun_ref_active = true; 170 171 } ··· 174 177 pr_debug("TARGET_CORE[%s]: Detected NON_EXISTENT_LUN" 175 178 " Access for 0x%08llx for %s\n", 176 179 se_cmd->se_tfo->fabric_name, 177 - unpacked_lun, 180 + se_cmd->orig_fe_lun, 178 181 nacl->initiatorname); 179 182 return -ENODEV; 180 183 }
+2 -2
drivers/target/target_core_tmr.c
··· 148 148 * code. 149 149 */ 150 150 if (!tmr->tmr_dev) 151 - WARN_ON_ONCE(transport_lookup_tmr_lun(tmr->task_cmd, 152 - se_cmd->orig_fe_lun) < 0); 151 + WARN_ON_ONCE(transport_lookup_tmr_lun(tmr->task_cmd) < 152 + 0); 153 153 154 154 target_put_cmd_and_wait(se_cmd); 155 155
+45 -16
drivers/target/target_core_transport.c
··· 1364 1364 u32 data_length, 1365 1365 int data_direction, 1366 1366 int task_attr, 1367 - unsigned char *sense_buffer) 1367 + unsigned char *sense_buffer, u64 unpacked_lun) 1368 1368 { 1369 1369 INIT_LIST_HEAD(&cmd->se_delayed_node); 1370 1370 INIT_LIST_HEAD(&cmd->se_qf_node); ··· 1383 1383 cmd->data_direction = data_direction; 1384 1384 cmd->sam_task_attr = task_attr; 1385 1385 cmd->sense_buffer = sense_buffer; 1386 + cmd->orig_fe_lun = unpacked_lun; 1386 1387 1387 1388 cmd->state_active = false; 1388 1389 } ··· 1411 1410 } 1412 1411 1413 1412 sense_reason_t 1414 - target_setup_cmd_from_cdb(struct se_cmd *cmd, unsigned char *cdb) 1413 + target_cmd_init_cdb(struct se_cmd *cmd, unsigned char *cdb) 1415 1414 { 1416 - struct se_device *dev = cmd->se_dev; 1417 1415 sense_reason_t ret; 1418 1416 1417 + cmd->t_task_cdb = &cmd->__t_task_cdb[0]; 1419 1418 /* 1420 1419 * Ensure that the received CDB is less than the max (252 + 8) bytes 1421 1420 * for VARIABLE_LENGTH_CMD ··· 1424 1423 pr_err("Received SCSI CDB with command_size: %d that" 1425 1424 " exceeds SCSI_MAX_VARLEN_CDB_SIZE: %d\n", 1426 1425 scsi_command_size(cdb), SCSI_MAX_VARLEN_CDB_SIZE); 1427 - return TCM_INVALID_CDB_FIELD; 1426 + ret = TCM_INVALID_CDB_FIELD; 1427 + goto err; 1428 1428 } 1429 1429 /* 1430 1430 * If the received CDB is larger than TCM_MAX_COMMAND_SIZE, ··· 1440 1438 " %u > sizeof(cmd->__t_task_cdb): %lu ops\n", 1441 1439 scsi_command_size(cdb), 1442 1440 (unsigned long)sizeof(cmd->__t_task_cdb)); 1443 - return TCM_OUT_OF_RESOURCES; 1441 + ret = TCM_OUT_OF_RESOURCES; 1442 + goto err; 1444 1443 } 1445 - } else 1446 - cmd->t_task_cdb = &cmd->__t_task_cdb[0]; 1444 + } 1447 1445 /* 1448 1446 * Copy the original CDB into cmd-> 1449 1447 */ 1450 1448 memcpy(cmd->t_task_cdb, cdb, scsi_command_size(cdb)); 1451 1449 1452 1450 trace_target_sequencer_start(cmd); 1451 + return 0; 1452 + 1453 + err: 1454 + /* 1455 + * Copy the CDB here to allow trace_target_cmd_complete() to 1456 + * print the cdb to the trace buffers. 1457 + */ 1458 + memcpy(cmd->t_task_cdb, cdb, min(scsi_command_size(cdb), 1459 + (unsigned int)TCM_MAX_COMMAND_SIZE)); 1460 + return ret; 1461 + } 1462 + EXPORT_SYMBOL(target_cmd_init_cdb); 1463 + 1464 + sense_reason_t 1465 + target_cmd_parse_cdb(struct se_cmd *cmd) 1466 + { 1467 + struct se_device *dev = cmd->se_dev; 1468 + sense_reason_t ret; 1453 1469 1454 1470 ret = dev->transport->parse_cdb(cmd); 1455 1471 if (ret == TCM_UNSUPPORTED_SCSI_OPCODE) ··· 1486 1466 atomic_long_inc(&cmd->se_lun->lun_stats.cmd_pdus); 1487 1467 return 0; 1488 1468 } 1489 - EXPORT_SYMBOL(target_setup_cmd_from_cdb); 1469 + EXPORT_SYMBOL(target_cmd_parse_cdb); 1490 1470 1491 1471 /* 1492 1472 * Used by fabric module frontends to queue tasks directly. ··· 1608 1588 * target_core_fabric_ops->queue_status() callback 1609 1589 */ 1610 1590 transport_init_se_cmd(se_cmd, se_tpg->se_tpg_tfo, se_sess, 1611 - data_length, data_dir, task_attr, sense); 1591 + data_length, data_dir, task_attr, sense, 1592 + unpacked_lun); 1612 1593 1613 1594 if (flags & TARGET_SCF_USE_CPUID) 1614 1595 se_cmd->se_cmd_flags |= SCF_USE_CPUID; ··· 1632 1611 */ 1633 1612 if (flags & TARGET_SCF_BIDI_OP) 1634 1613 se_cmd->se_cmd_flags |= SCF_BIDI; 1635 - /* 1636 - * Locate se_lun pointer and attach it to struct se_cmd 1637 - */ 1638 - rc = transport_lookup_cmd_lun(se_cmd, unpacked_lun); 1614 + 1615 + rc = target_cmd_init_cdb(se_cmd, cdb); 1639 1616 if (rc) { 1640 1617 transport_send_check_condition_and_sense(se_cmd, rc, 0); 1641 1618 target_put_sess_cmd(se_cmd); 1642 1619 return 0; 1643 1620 } 1644 1621 1645 - rc = target_setup_cmd_from_cdb(se_cmd, cdb); 1622 + /* 1623 + * Locate se_lun pointer and attach it to struct se_cmd 1624 + */ 1625 + rc = transport_lookup_cmd_lun(se_cmd); 1626 + if (rc) { 1627 + transport_send_check_condition_and_sense(se_cmd, rc, 0); 1628 + target_put_sess_cmd(se_cmd); 1629 + return 0; 1630 + } 1631 + 1632 + rc = target_cmd_parse_cdb(se_cmd); 1646 1633 if (rc != 0) { 1647 1634 transport_generic_request_failure(se_cmd, rc); 1648 1635 return 0; ··· 1811 1782 BUG_ON(!se_tpg); 1812 1783 1813 1784 transport_init_se_cmd(se_cmd, se_tpg->se_tpg_tfo, se_sess, 1814 - 0, DMA_NONE, TCM_SIMPLE_TAG, sense); 1785 + 0, DMA_NONE, TCM_SIMPLE_TAG, sense, unpacked_lun); 1815 1786 /* 1816 1787 * FIXME: Currently expect caller to handle se_cmd->se_tmr_req 1817 1788 * allocation failure. ··· 1839 1810 goto failure; 1840 1811 } 1841 1812 1842 - ret = transport_lookup_tmr_lun(se_cmd, unpacked_lun); 1813 + ret = transport_lookup_tmr_lun(se_cmd); 1843 1814 if (ret) 1844 1815 goto failure; 1845 1816
+2 -2
drivers/target/target_core_user.c
··· 1007 1007 entry->hdr.cmd_id = 0; /* not used for PAD */ 1008 1008 entry->hdr.kflags = 0; 1009 1009 entry->hdr.uflags = 0; 1010 - tcmu_flush_dcache_range(entry, sizeof(*entry)); 1010 + tcmu_flush_dcache_range(entry, sizeof(entry->hdr)); 1011 1011 1012 1012 UPDATE_HEAD(mb->cmd_head, pad_size, udev->cmdr_size); 1013 1013 tcmu_flush_dcache_range(mb, sizeof(*mb)); ··· 1072 1072 cdb_off = CMDR_OFF + cmd_head + base_command_size; 1073 1073 memcpy((void *) mb + cdb_off, se_cmd->t_task_cdb, scsi_command_size(se_cmd->t_task_cdb)); 1074 1074 entry->req.cdb_off = cdb_off; 1075 - tcmu_flush_dcache_range(entry, sizeof(*entry)); 1075 + tcmu_flush_dcache_range(entry, command_size); 1076 1076 1077 1077 UPDATE_HEAD(mb->cmd_head, command_size, udev->cmdr_size); 1078 1078 tcmu_flush_dcache_range(mb, sizeof(*mb));
+6 -3
drivers/target/target_core_xcopy.c
··· 526 526 } 527 527 cmd->se_cmd_flags |= SCF_SE_LUN_CMD; 528 528 529 + if (target_cmd_init_cdb(cmd, cdb)) 530 + return -EINVAL; 531 + 529 532 cmd->tag = 0; 530 - if (target_setup_cmd_from_cdb(cmd, cdb)) 533 + if (target_cmd_parse_cdb(cmd)) 531 534 return -EINVAL; 532 535 533 536 if (transport_generic_map_mem_to_cmd(cmd, xop->xop_data_sg, ··· 588 585 (unsigned long long)src_lba, src_sectors, length); 589 586 590 587 transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, length, 591 - DMA_FROM_DEVICE, 0, &xpt_cmd.sense_buffer[0]); 588 + DMA_FROM_DEVICE, 0, &xpt_cmd.sense_buffer[0], 0); 592 589 593 590 rc = target_xcopy_setup_pt_cmd(&xpt_cmd, xop, src_dev, &cdb[0], 594 591 remote_port); ··· 633 630 (unsigned long long)dst_lba, dst_sectors, length); 634 631 635 632 transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, length, 636 - DMA_TO_DEVICE, 0, &xpt_cmd.sense_buffer[0]); 633 + DMA_TO_DEVICE, 0, &xpt_cmd.sense_buffer[0], 0); 637 634 638 635 rc = target_xcopy_setup_pt_cmd(&xpt_cmd, xop, dst_dev, &cdb[0], 639 636 remote_port);
+4 -2
drivers/usb/gadget/function/f_tcm.c
··· 1052 1052 transport_init_se_cmd(se_cmd, 1053 1053 tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo, 1054 1054 tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE, 1055 - cmd->prio_attr, cmd->sense_iu.sense); 1055 + cmd->prio_attr, cmd->sense_iu.sense, 1056 + cmd->unpacked_lun); 1056 1057 goto out; 1057 1058 } 1058 1059 ··· 1183 1182 transport_init_se_cmd(se_cmd, 1184 1183 tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo, 1185 1184 tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE, 1186 - cmd->prio_attr, cmd->sense_iu.sense); 1185 + cmd->prio_attr, cmd->sense_iu.sense, 1186 + cmd->unpacked_lun); 1187 1187 goto out; 1188 1188 } 1189 1189
+5 -4
include/target/target_core_fabric.h
··· 150 150 151 151 void transport_init_se_cmd(struct se_cmd *, 152 152 const struct target_core_fabric_ops *, 153 - struct se_session *, u32, int, int, unsigned char *); 154 - sense_reason_t transport_lookup_cmd_lun(struct se_cmd *, u64); 155 - sense_reason_t target_setup_cmd_from_cdb(struct se_cmd *, unsigned char *); 153 + struct se_session *, u32, int, int, unsigned char *, u64); 154 + sense_reason_t transport_lookup_cmd_lun(struct se_cmd *); 155 + sense_reason_t target_cmd_init_cdb(struct se_cmd *, unsigned char *); 156 + sense_reason_t target_cmd_parse_cdb(struct se_cmd *); 156 157 int target_submit_cmd_map_sgls(struct se_cmd *, struct se_session *, 157 158 unsigned char *, unsigned char *, u64, u32, int, int, int, 158 159 struct scatterlist *, u32, struct scatterlist *, u32, ··· 188 187 void core_tmr_release_req(struct se_tmr_req *); 189 188 int transport_generic_handle_tmr(struct se_cmd *); 190 189 void transport_generic_request_failure(struct se_cmd *, sense_reason_t); 191 - int transport_lookup_tmr_lun(struct se_cmd *, u64); 190 + int transport_lookup_tmr_lun(struct se_cmd *); 192 191 void core_allocate_nexus_loss_ua(struct se_node_acl *acl); 193 192 194 193 struct se_node_acl *core_tpg_get_initiator_node_acl(struct se_portal_group *tpg,