Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"This is a set of seven bug fixes. Several fcoe fixes for locking
problems, initiator issues and a VLAN API change, all of which could
eventually lead to data corruption, one fix for a qla2xxx locking
problem which could lead to multiple completions of the same request
(and subsequent data corruption) and a use after free in the ipr
driver. Plus one minor MAINTAINERS file update"
(only six bugfixes in this pull, since I had already pulled the fcoe API
fix directly from Robert Love)
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
[SCSI] ipr: Avoid target_destroy accessing memory after it was freed
[SCSI] qla2xxx: Fix for locking issue between driver ISR and mailbox routines
MAINTAINERS: Fix fcoe mailing list
libfc: extend ex_lock to protect all of fc_seq_send
libfc: Correct check for initiator role
libfcoe: Fix Conflicting FCFs issue in the fabric
+61
-93
+1
-1
MAINTAINERS
+1
-1
MAINTAINERS
+5
-10
drivers/scsi/fcoe/fcoe_ctlr.c
+5
-10
drivers/scsi/fcoe/fcoe_ctlr.c
···
1548
1548
{
1549
1549
struct fcoe_fcf *fcf;
1550
1550
struct fcoe_fcf *best = fip->sel_fcf;
1551
-
struct fcoe_fcf *first;
1552
-
1553
-
first = list_first_entry(&fip->fcfs, struct fcoe_fcf, list);
1554
1551
1555
1552
list_for_each_entry(fcf, &fip->fcfs, list) {
1556
1553
LIBFCOE_FIP_DBG(fip, "consider FCF fab %16.16llx "
···
1565
1568
"" : "un");
1566
1569
continue;
1567
1570
}
1568
-
if (fcf->fabric_name != first->fabric_name ||
1569
-
fcf->vfid != first->vfid ||
1570
-
fcf->fc_map != first->fc_map) {
1571
+
if (!best || fcf->pri < best->pri || best->flogi_sent)
1572
+
best = fcf;
1573
+
if (fcf->fabric_name != best->fabric_name ||
1574
+
fcf->vfid != best->vfid ||
1575
+
fcf->fc_map != best->fc_map) {
1571
1576
LIBFCOE_FIP_DBG(fip, "Conflicting fabric, VFID, "
1572
1577
"or FC-MAP\n");
1573
1578
return NULL;
1574
1579
}
1575
-
if (fcf->flogi_sent)
1576
-
continue;
1577
-
if (!best || fcf->pri < best->pri || best->flogi_sent)
1578
-
best = fcf;
1579
1580
}
1580
1581
fip->sel_fcf = best;
1581
1582
if (best) {
-16
drivers/scsi/ipr.c
-16
drivers/scsi/ipr.c
···
8980
8980
if (!ioa_cfg->res_entries)
8981
8981
goto out;
8982
8982
8983
-
if (ioa_cfg->sis64) {
8984
-
ioa_cfg->target_ids = kzalloc(sizeof(unsigned long) *
8985
-
BITS_TO_LONGS(ioa_cfg->max_devs_supported), GFP_KERNEL);
8986
-
ioa_cfg->array_ids = kzalloc(sizeof(unsigned long) *
8987
-
BITS_TO_LONGS(ioa_cfg->max_devs_supported), GFP_KERNEL);
8988
-
ioa_cfg->vset_ids = kzalloc(sizeof(unsigned long) *
8989
-
BITS_TO_LONGS(ioa_cfg->max_devs_supported), GFP_KERNEL);
8990
-
8991
-
if (!ioa_cfg->target_ids || !ioa_cfg->array_ids
8992
-
|| !ioa_cfg->vset_ids)
8993
-
goto out_free_res_entries;
8994
-
}
8995
-
8996
8983
for (i = 0; i < ioa_cfg->max_devs_supported; i++) {
8997
8984
list_add_tail(&ioa_cfg->res_entries[i].queue, &ioa_cfg->free_res_q);
8998
8985
ioa_cfg->res_entries[i].ioa_cfg = ioa_cfg;
···
9076
9089
ioa_cfg->vpd_cbs, ioa_cfg->vpd_cbs_dma);
9077
9090
out_free_res_entries:
9078
9091
kfree(ioa_cfg->res_entries);
9079
-
kfree(ioa_cfg->target_ids);
9080
-
kfree(ioa_cfg->array_ids);
9081
-
kfree(ioa_cfg->vset_ids);
9082
9092
goto out;
9083
9093
}
9084
9094
+3
-3
drivers/scsi/ipr.h
+3
-3
drivers/scsi/ipr.h
···
1440
1440
/*
1441
1441
* Bitmaps for SIS64 generated target values
1442
1442
*/
1443
-
unsigned long *target_ids;
1444
-
unsigned long *array_ids;
1445
-
unsigned long *vset_ids;
1443
+
unsigned long target_ids[BITS_TO_LONGS(IPR_MAX_SIS64_DEVS)];
1444
+
unsigned long array_ids[BITS_TO_LONGS(IPR_MAX_SIS64_DEVS)];
1445
+
unsigned long vset_ids[BITS_TO_LONGS(IPR_MAX_SIS64_DEVS)];
1446
1446
1447
1447
u16 type; /* CCIN of the card */
1448
1448
+24
-13
drivers/scsi/libfc/fc_exch.c
+24
-13
drivers/scsi/libfc/fc_exch.c
···
463
463
fc_exch_release(ep); /* drop hold for exch in mp */
464
464
}
465
465
466
-
/**
467
-
* fc_seq_send() - Send a frame using existing sequence/exchange pair
468
-
* @lport: The local port that the exchange will be sent on
469
-
* @sp: The sequence to be sent
470
-
* @fp: The frame to be sent on the exchange
471
-
*/
472
-
static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp,
466
+
static int fc_seq_send_locked(struct fc_lport *lport, struct fc_seq *sp,
473
467
struct fc_frame *fp)
474
468
{
475
469
struct fc_exch *ep;
···
473
479
u8 fh_type = fh->fh_type;
474
480
475
481
ep = fc_seq_exch(sp);
476
-
WARN_ON((ep->esb_stat & ESB_ST_SEQ_INIT) != ESB_ST_SEQ_INIT);
482
+
WARN_ON(!(ep->esb_stat & ESB_ST_SEQ_INIT));
477
483
478
484
f_ctl = ntoh24(fh->fh_f_ctl);
479
485
fc_exch_setup_hdr(ep, fp, f_ctl);
···
496
502
error = lport->tt.frame_send(lport, fp);
497
503
498
504
if (fh_type == FC_TYPE_BLS)
499
-
return error;
505
+
goto out;
500
506
501
507
/*
502
508
* Update the exchange and sequence flags,
503
509
* assuming all frames for the sequence have been sent.
504
510
* We can only be called to send once for each sequence.
505
511
*/
506
-
spin_lock_bh(&ep->ex_lock);
507
512
ep->f_ctl = f_ctl & ~FC_FC_FIRST_SEQ; /* not first seq */
508
513
if (f_ctl & FC_FC_SEQ_INIT)
509
514
ep->esb_stat &= ~ESB_ST_SEQ_INIT;
515
+
out:
516
+
return error;
517
+
}
518
+
519
+
/**
520
+
* fc_seq_send() - Send a frame using existing sequence/exchange pair
521
+
* @lport: The local port that the exchange will be sent on
522
+
* @sp: The sequence to be sent
523
+
* @fp: The frame to be sent on the exchange
524
+
*/
525
+
static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp,
526
+
struct fc_frame *fp)
527
+
{
528
+
struct fc_exch *ep;
529
+
int error;
530
+
ep = fc_seq_exch(sp);
531
+
spin_lock_bh(&ep->ex_lock);
532
+
error = fc_seq_send_locked(lport, sp, fp);
510
533
spin_unlock_bh(&ep->ex_lock);
511
534
return error;
512
535
}
···
640
629
if (fp) {
641
630
fc_fill_fc_hdr(fp, FC_RCTL_BA_ABTS, ep->did, ep->sid,
642
631
FC_TYPE_BLS, FC_FC_END_SEQ | FC_FC_SEQ_INIT, 0);
643
-
error = fc_seq_send(ep->lp, sp, fp);
632
+
error = fc_seq_send_locked(ep->lp, sp, fp);
644
633
} else
645
634
error = -ENOBUFS;
646
635
return error;
···
1143
1132
f_ctl = FC_FC_LAST_SEQ | FC_FC_END_SEQ | FC_FC_SEQ_INIT;
1144
1133
f_ctl |= ep->f_ctl;
1145
1134
fc_fill_fc_hdr(fp, rctl, ep->did, ep->sid, fh_type, f_ctl, 0);
1146
-
fc_seq_send(ep->lp, sp, fp);
1135
+
fc_seq_send_locked(ep->lp, sp, fp);
1147
1136
}
1148
1137
1149
1138
/**
···
1318
1307
ap->ba_low_seq_cnt = htons(sp->cnt);
1319
1308
}
1320
1309
sp = fc_seq_start_next_locked(sp);
1321
-
spin_unlock_bh(&ep->ex_lock);
1322
1310
fc_seq_send_last(sp, fp, FC_RCTL_BA_ACC, FC_TYPE_BLS);
1311
+
spin_unlock_bh(&ep->ex_lock);
1323
1312
fc_frame_free(rx_fp);
1324
1313
return;
1325
1314
+1
-1
drivers/scsi/libfc/fc_rport.c
+1
-1
drivers/scsi/libfc/fc_rport.c
···
1962
1962
rdata->flags |= FC_RP_FLAGS_RETRY;
1963
1963
rdata->supported_classes = FC_COS_CLASS3;
1964
1964
1965
-
if (!(lport->service_params & FC_RPORT_ROLE_FCP_INITIATOR))
1965
+
if (!(lport->service_params & FCP_SPPF_INIT_FCN))
1966
1966
return 0;
1967
1967
1968
1968
spp->spp_flags |= rspp->spp_flags & FC_SPP_EST_IMG_PAIR;
+11
drivers/scsi/qla2xxx/qla_inline.h
+11
drivers/scsi/qla2xxx/qla_inline.h
···
278
278
279
279
set_bit(HOST_RAMP_UP_QUEUE_DEPTH, &vha->dpc_flags);
280
280
}
281
+
282
+
static inline void
283
+
qla2x00_handle_mbx_completion(struct qla_hw_data *ha, int status)
284
+
{
285
+
if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
286
+
(status & MBX_INTERRUPT) && ha->flags.mbox_int) {
287
+
set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
288
+
clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
289
+
complete(&ha->mbx_intr_comp);
290
+
}
291
+
}
+4
-23
drivers/scsi/qla2xxx/qla_isr.c
+4
-23
drivers/scsi/qla2xxx/qla_isr.c
···
104
104
RD_REG_WORD(®->hccr);
105
105
}
106
106
}
107
+
qla2x00_handle_mbx_completion(ha, status);
107
108
spin_unlock_irqrestore(&ha->hardware_lock, flags);
108
-
109
-
if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
110
-
(status & MBX_INTERRUPT) && ha->flags.mbox_int) {
111
-
set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
112
-
complete(&ha->mbx_intr_comp);
113
-
}
114
109
115
110
return (IRQ_HANDLED);
116
111
}
···
216
221
WRT_REG_WORD(®->hccr, HCCR_CLR_RISC_INT);
217
222
RD_REG_WORD_RELAXED(®->hccr);
218
223
}
224
+
qla2x00_handle_mbx_completion(ha, status);
219
225
spin_unlock_irqrestore(&ha->hardware_lock, flags);
220
-
221
-
if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
222
-
(status & MBX_INTERRUPT) && ha->flags.mbox_int) {
223
-
set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
224
-
complete(&ha->mbx_intr_comp);
225
-
}
226
226
227
227
return (IRQ_HANDLED);
228
228
}
···
2603
2613
if (unlikely(IS_QLA83XX(ha) && (ha->pdev->revision == 1)))
2604
2614
ndelay(3500);
2605
2615
}
2616
+
qla2x00_handle_mbx_completion(ha, status);
2606
2617
spin_unlock_irqrestore(&ha->hardware_lock, flags);
2607
-
2608
-
if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
2609
-
(status & MBX_INTERRUPT) && ha->flags.mbox_int) {
2610
-
set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
2611
-
complete(&ha->mbx_intr_comp);
2612
-
}
2613
2618
2614
2619
return IRQ_HANDLED;
2615
2620
}
···
2748
2763
}
2749
2764
WRT_REG_DWORD(®->hccr, HCCRX_CLR_RISC_INT);
2750
2765
} while (0);
2766
+
qla2x00_handle_mbx_completion(ha, status);
2751
2767
spin_unlock_irqrestore(&ha->hardware_lock, flags);
2752
2768
2753
-
if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
2754
-
(status & MBX_INTERRUPT) && ha->flags.mbox_int) {
2755
-
set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
2756
-
complete(&ha->mbx_intr_comp);
2757
-
}
2758
2769
return IRQ_HANDLED;
2759
2770
}
2760
2771
-2
drivers/scsi/qla2xxx/qla_mbx.c
-2
drivers/scsi/qla2xxx/qla_mbx.c
+2
-8
drivers/scsi/qla2xxx/qla_mr.c
+2
-8
drivers/scsi/qla2xxx/qla_mr.c
···
148
148
spin_unlock_irqrestore(&ha->hardware_lock, flags);
149
149
150
150
wait_for_completion_timeout(&ha->mbx_intr_comp, mcp->tov * HZ);
151
-
152
-
clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
153
-
154
151
} else {
155
152
ql_dbg(ql_dbg_mbx, vha, 0x112c,
156
153
"Cmd=%x Polling Mode.\n", command);
···
2931
2934
QLAFX00_CLR_INTR_REG(ha, clr_intr);
2932
2935
QLAFX00_RD_INTR_REG(ha);
2933
2936
}
2937
+
2938
+
qla2x00_handle_mbx_completion(ha, status);
2934
2939
spin_unlock_irqrestore(&ha->hardware_lock, flags);
2935
2940
2936
-
if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
2937
-
(status & MBX_INTERRUPT) && ha->flags.mbox_int) {
2938
-
set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
2939
-
complete(&ha->mbx_intr_comp);
2940
-
}
2941
2941
return IRQ_HANDLED;
2942
2942
}
2943
2943
+10
-16
drivers/scsi/qla2xxx/qla_nx.c
+10
-16
drivers/scsi/qla2xxx/qla_nx.c
···
2074
2074
}
2075
2075
WRT_REG_DWORD(®->host_int, 0);
2076
2076
}
2077
-
spin_unlock_irqrestore(&ha->hardware_lock, flags);
2078
-
if (!ha->flags.msi_enabled)
2079
-
qla82xx_wr_32(ha, ha->nx_legacy_intr.tgt_mask_reg, 0xfbff);
2080
2077
2081
2078
#ifdef QL_DEBUG_LEVEL_17
2082
2079
if (!irq && ha->flags.eeh_busy)
···
2082
2085
status, ha->mbx_cmd_flags, ha->flags.mbox_int, stat);
2083
2086
#endif
2084
2087
2085
-
if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
2086
-
(status & MBX_INTERRUPT) && ha->flags.mbox_int) {
2087
-
set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
2088
-
complete(&ha->mbx_intr_comp);
2089
-
}
2088
+
qla2x00_handle_mbx_completion(ha, status);
2089
+
spin_unlock_irqrestore(&ha->hardware_lock, flags);
2090
+
2091
+
if (!ha->flags.msi_enabled)
2092
+
qla82xx_wr_32(ha, ha->nx_legacy_intr.tgt_mask_reg, 0xfbff);
2093
+
2090
2094
return IRQ_HANDLED;
2091
2095
}
2092
2096
···
2147
2149
WRT_REG_DWORD(®->host_int, 0);
2148
2150
} while (0);
2149
2151
2150
-
spin_unlock_irqrestore(&ha->hardware_lock, flags);
2151
-
2152
2152
#ifdef QL_DEBUG_LEVEL_17
2153
2153
if (!irq && ha->flags.eeh_busy)
2154
2154
ql_log(ql_log_warn, vha, 0x5044,
···
2154
2158
status, ha->mbx_cmd_flags, ha->flags.mbox_int, stat);
2155
2159
#endif
2156
2160
2157
-
if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
2158
-
(status & MBX_INTERRUPT) && ha->flags.mbox_int) {
2159
-
set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
2160
-
complete(&ha->mbx_intr_comp);
2161
-
}
2161
+
qla2x00_handle_mbx_completion(ha, status);
2162
+
spin_unlock_irqrestore(&ha->hardware_lock, flags);
2163
+
2162
2164
return IRQ_HANDLED;
2163
2165
}
2164
2166
···
3339
3345
ha->flags.mbox_busy = 0;
3340
3346
ql_log(ql_log_warn, vha, 0x6010,
3341
3347
"Doing premature completion of mbx command.\n");
3342
-
if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags))
3348
+
if (test_and_clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags))
3343
3349
complete(&ha->mbx_intr_comp);
3344
3350
}
3345
3351
}