Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"This is seven small fixes which are all for user visible issues that
fortunately only occur in rare circumstances.
The most serious is the sr one in which QEMU can cause us to read
beyond the end of a buffer (I don't think it's exploitable, but just
in case).
The next is the sd capacity fix which means all non 512 byte sector
drives greater than 2TB fail to be correctly sized.
The rest are either in new drivers (qedf) or on error legs"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: ipr: do not set DID_PASSTHROUGH on CHECK CONDITION
scsi: aacraid: fix PCI error recovery path
scsi: sd: Fix capacity calculation with 32-bit sector_t
scsi: qla2xxx: Add fix to read correct register value for ISP82xx.
scsi: qedf: Fix crash due to unsolicited FIP VLAN response.
scsi: sr: Sanity check returned mode data
scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable
+49
-12
+8
-3
drivers/scsi/aacraid/aacraid.h
+8
-3
drivers/scsi/aacraid/aacraid.h
···
1690
1690
#define aac_adapter_sync_cmd(dev, command, p1, p2, p3, p4, p5, p6, status, r1, r2, r3, r4) \
1691
1691
(dev)->a_ops.adapter_sync_cmd(dev, command, p1, p2, p3, p4, p5, p6, status, r1, r2, r3, r4)
1692
1692
1693
-
#define aac_adapter_check_health(dev) \
1694
-
(dev)->a_ops.adapter_check_health(dev)
1695
-
1696
1693
#define aac_adapter_restart(dev, bled, reset_type) \
1697
1694
((dev)->a_ops.adapter_restart(dev, bled, reset_type))
1698
1695
···
2610
2613
{
2611
2614
sector_div(capacity, divisor);
2612
2615
return capacity;
2616
+
}
2617
+
2618
+
static inline int aac_adapter_check_health(struct aac_dev *dev)
2619
+
{
2620
+
if (unlikely(pci_channel_offline(dev->pdev)))
2621
+
return -1;
2622
+
2623
+
return (dev)->a_ops.adapter_check_health(dev);
2613
2624
}
2614
2625
2615
2626
/* SCp.phase values */
+2
-1
drivers/scsi/aacraid/commsup.c
+2
-1
drivers/scsi/aacraid/commsup.c
···
1873
1873
spin_unlock_irqrestore(&aac->fib_lock, flagv);
1874
1874
1875
1875
if (BlinkLED < 0) {
1876
-
printk(KERN_ERR "%s: Host adapter dead %d\n", aac->name, BlinkLED);
1876
+
printk(KERN_ERR "%s: Host adapter is dead (or got a PCI error) %d\n",
1877
+
aac->name, BlinkLED);
1877
1878
goto out;
1878
1879
}
1879
1880
+6
-1
drivers/scsi/ipr.c
+6
-1
drivers/scsi/ipr.c
···
6293
6293
break;
6294
6294
case IPR_IOASC_MED_DO_NOT_REALLOC: /* prevent retries */
6295
6295
case IPR_IOASA_IR_DUAL_IOA_DISABLED:
6296
-
scsi_cmd->result |= (DID_PASSTHROUGH << 16);
6296
+
/*
6297
+
* exception: do not set DID_PASSTHROUGH on CHECK CONDITION
6298
+
* so SCSI mid-layer and upper layers handle it accordingly.
6299
+
*/
6300
+
if (scsi_cmd->result != SAM_STAT_CHECK_CONDITION)
6301
+
scsi_cmd->result |= (DID_PASSTHROUGH << 16);
6297
6302
break;
6298
6303
case IPR_IOASC_BUS_WAS_RESET:
6299
6304
case IPR_IOASC_BUS_WAS_RESET_BY_OTHER:
+2
-1
drivers/scsi/qedf/qedf_fip.c
+2
-1
drivers/scsi/qedf/qedf_fip.c
+1
drivers/scsi/qedf/qedf_main.c
+1
drivers/scsi/qedf/qedf_main.c
+6
-1
drivers/scsi/qla2xxx/qla_os.c
+6
-1
drivers/scsi/qla2xxx/qla_os.c
···
1160
1160
uint32_t qla2x00_isp_reg_stat(struct qla_hw_data *ha)
1161
1161
{
1162
1162
struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
1163
+
struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82;
1163
1164
1164
-
return ((RD_REG_DWORD(®->host_status)) == ISP_REG_DISCONNECT);
1165
+
if (IS_P3P_TYPE(ha))
1166
+
return ((RD_REG_DWORD(®82->host_int)) == ISP_REG_DISCONNECT);
1167
+
else
1168
+
return ((RD_REG_DWORD(®->host_status)) ==
1169
+
ISP_REG_DISCONNECT);
1165
1170
}
1166
1171
1167
1172
/**************************************************************************
+20
-3
drivers/scsi/sd.c
+20
-3
drivers/scsi/sd.c
···
2102
2102
2103
2103
#define READ_CAPACITY_RETRIES_ON_RESET 10
2104
2104
2105
+
/*
2106
+
* Ensure that we don't overflow sector_t when CONFIG_LBDAF is not set
2107
+
* and the reported logical block size is bigger than 512 bytes. Note
2108
+
* that last_sector is a u64 and therefore logical_to_sectors() is not
2109
+
* applicable.
2110
+
*/
2111
+
static bool sd_addressable_capacity(u64 lba, unsigned int sector_size)
2112
+
{
2113
+
u64 last_sector = (lba + 1ULL) << (ilog2(sector_size) - 9);
2114
+
2115
+
if (sizeof(sector_t) == 4 && last_sector > U32_MAX)
2116
+
return false;
2117
+
2118
+
return true;
2119
+
}
2120
+
2105
2121
static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
2106
2122
unsigned char *buffer)
2107
2123
{
···
2183
2167
return -ENODEV;
2184
2168
}
2185
2169
2186
-
if ((sizeof(sdkp->capacity) == 4) && (lba >= 0xffffffffULL)) {
2170
+
if (!sd_addressable_capacity(lba, sector_size)) {
2187
2171
sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
2188
2172
"kernel compiled with support for large block "
2189
2173
"devices.\n");
···
2272
2256
return sector_size;
2273
2257
}
2274
2258
2275
-
if ((sizeof(sdkp->capacity) == 4) && (lba == 0xffffffff)) {
2259
+
if (!sd_addressable_capacity(lba, sector_size)) {
2276
2260
sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
2277
2261
"kernel compiled with support for large block "
2278
2262
"devices.\n");
···
2972
2956
q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
2973
2957
rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
2974
2958
} else
2975
-
rw_max = BLK_DEF_MAX_SECTORS;
2959
+
rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
2960
+
(sector_t)BLK_DEF_MAX_SECTORS);
2976
2961
2977
2962
/* Combine with controller limits */
2978
2963
q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
+4
-2
drivers/scsi/sr.c
+4
-2
drivers/scsi/sr.c
···
836
836
unsigned char *buffer;
837
837
struct scsi_mode_data data;
838
838
struct scsi_sense_hdr sshdr;
839
+
unsigned int ms_len = 128;
839
840
int rc, n;
840
841
841
842
static const char *loadmech[] =
···
863
862
scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr);
864
863
865
864
/* ask for mode page 0x2a */
866
-
rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, 128,
865
+
rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, ms_len,
867
866
SR_TIMEOUT, 3, &data, NULL);
868
867
869
-
if (!scsi_status_is_good(rc)) {
868
+
if (!scsi_status_is_good(rc) || data.length > ms_len ||
869
+
data.header_length + data.block_descriptor_length > data.length) {
870
870
/* failed, drive doesn't have capabilities mode page */
871
871
cd->cdi.speed = 1;
872
872
cd->cdi.mask |= (CDC_CD_R | CDC_CD_RW | CDC_DVD_R |