Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"This is five bug fixes, two of which fix long standing problems
causing crashes (sd and mvsas). The remaining three are hung (isci
race) or lost (qla2xxx, isci) devices"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
[SCSI] isci: fix breakage caused by >16byte CDB patch
[SCSI] mvsas: Fix kernel panic on tile due to unaligned data access
[SCSI] sd: fix crash when UA received on DIF enabled device
[SCSI] qla2xxx: Properly set the tagging for commands.
[SCSI] isci: Fix a race condition in the SSP task management path
+32
-24
+1
-1
drivers/scsi/isci/request.c
+1
-1
drivers/scsi/isci/request.c
···
185
185
cmd_iu->_r_c = 0;
186
186
187
187
sci_swab32_cpy(&cmd_iu->cdb, task->ssp_task.cmd->cmnd,
188
-
task->ssp_task.cmd->cmd_len / sizeof(u32));
188
+
(task->ssp_task.cmd->cmd_len+3) / sizeof(u32));
189
189
}
190
190
191
191
static void sci_task_request_build_ssp_task_iu(struct isci_request *ireq)
+6
-3
drivers/scsi/isci/task.c
+6
-3
drivers/scsi/isci/task.c
···
491
491
struct isci_tmf tmf;
492
492
int ret = TMF_RESP_FUNC_FAILED;
493
493
unsigned long flags;
494
+
int target_done_already = 0;
494
495
495
496
/* Get the isci_request reference from the task. Note that
496
497
* this check does not depend on the pending request list
···
506
505
/* If task is already done, the request isn't valid */
507
506
if (!(task->task_state_flags & SAS_TASK_STATE_DONE) &&
508
507
(task->task_state_flags & SAS_TASK_AT_INITIATOR) &&
509
-
old_request)
508
+
old_request) {
510
509
idev = isci_get_device(task->dev->lldd_dev);
511
-
510
+
target_done_already = test_bit(IREQ_COMPLETE_IN_TARGET,
511
+
&old_request->flags);
512
+
}
512
513
spin_unlock(&task->task_state_lock);
513
514
spin_unlock_irqrestore(&ihost->scic_lock, flags);
514
515
···
564
561
565
562
if (task->task_proto == SAS_PROTOCOL_SMP ||
566
563
sas_protocol_ata(task->task_proto) ||
567
-
test_bit(IREQ_COMPLETE_IN_TARGET, &old_request->flags) ||
564
+
target_done_already ||
568
565
test_bit(IDEV_GONE, &idev->flags)) {
569
566
570
567
spin_unlock_irqrestore(&ihost->scic_lock, flags);
+8
-3
drivers/scsi/mvsas/mv_sas.c
+8
-3
drivers/scsi/mvsas/mv_sas.c
···
1857
1857
goto out;
1858
1858
}
1859
1859
1860
-
/* error info record present */
1861
-
if (unlikely((rx_desc & RXQ_ERR) && (*(u64 *) slot->response))) {
1860
+
/*
1861
+
* error info record present; slot->response is 32 bit aligned but may
1862
+
* not be 64 bit aligned, so check for zero in two 32 bit reads
1863
+
*/
1864
+
if (unlikely((rx_desc & RXQ_ERR)
1865
+
&& (*((u32 *)slot->response)
1866
+
|| *(((u32 *)slot->response) + 1)))) {
1862
1867
mv_dprintk("port %d slot %d rx_desc %X has error info"
1863
1868
"%016llX.\n", slot->port->sas_port.id, slot_idx,
1864
-
rx_desc, (u64)(*(u64 *)slot->response));
1869
+
rx_desc, get_unaligned_le64(slot->response));
1865
1870
tstat->stat = mvs_slot_err(mvi, task, slot_idx);
1866
1871
tstat->resp = SAS_TASK_COMPLETE;
1867
1872
goto out;
+1
drivers/scsi/mvsas/mv_sas.h
+1
drivers/scsi/mvsas/mv_sas.h
+9
-2
drivers/scsi/qla2xxx/qla_iocb.c
+9
-2
drivers/scsi/qla2xxx/qla_iocb.c
···
419
419
__constant_cpu_to_le16(CF_SIMPLE_TAG);
420
420
break;
421
421
}
422
+
} else {
423
+
cmd_pkt->control_flags = __constant_cpu_to_le16(CF_SIMPLE_TAG);
422
424
}
423
425
424
426
/* Load SCSI command packet. */
···
1309
1307
fcp_cmnd->task_attribute = TSK_ORDERED;
1310
1308
break;
1311
1309
default:
1312
-
fcp_cmnd->task_attribute = 0;
1310
+
fcp_cmnd->task_attribute = TSK_SIMPLE;
1313
1311
break;
1314
1312
}
1315
1313
} else {
1316
-
fcp_cmnd->task_attribute = 0;
1314
+
fcp_cmnd->task_attribute = TSK_SIMPLE;
1317
1315
}
1318
1316
1319
1317
cmd_pkt->fcp_rsp_dseg_len = 0; /* Let response come in status iocb */
···
1527
1525
case ORDERED_QUEUE_TAG:
1528
1526
cmd_pkt->task = TSK_ORDERED;
1529
1527
break;
1528
+
default:
1529
+
cmd_pkt->task = TSK_SIMPLE;
1530
+
break;
1530
1531
}
1532
+
} else {
1533
+
cmd_pkt->task = TSK_SIMPLE;
1531
1534
}
1532
1535
1533
1536
/* Load SCSI command packet. */
+7
-15
drivers/scsi/sd.c
+7
-15
drivers/scsi/sd.c
···
838
838
839
839
static void sd_unprep_fn(struct request_queue *q, struct request *rq)
840
840
{
841
+
struct scsi_cmnd *SCpnt = rq->special;
842
+
841
843
if (rq->cmd_flags & REQ_DISCARD) {
842
844
free_page((unsigned long)rq->buffer);
843
845
rq->buffer = NULL;
846
+
}
847
+
if (SCpnt->cmnd != rq->cmd) {
848
+
mempool_free(SCpnt->cmnd, sd_cdb_pool);
849
+
SCpnt->cmnd = NULL;
850
+
SCpnt->cmd_len = 0;
844
851
}
845
852
}
846
853
···
1726
1719
out:
1727
1720
if (rq_data_dir(SCpnt->request) == READ && scsi_prot_sg_count(SCpnt))
1728
1721
sd_dif_complete(SCpnt, good_bytes);
1729
-
1730
-
if (scsi_host_dif_capable(sdkp->device->host, sdkp->protection_type)
1731
-
== SD_DIF_TYPE2_PROTECTION && SCpnt->cmnd != SCpnt->request->cmd) {
1732
-
1733
-
/* We have to print a failed command here as the
1734
-
* extended CDB gets freed before scsi_io_completion()
1735
-
* is called.
1736
-
*/
1737
-
if (result)
1738
-
scsi_print_command(SCpnt);
1739
-
1740
-
mempool_free(SCpnt->cmnd, sd_cdb_pool);
1741
-
SCpnt->cmnd = NULL;
1742
-
SCpnt->cmd_len = 0;
1743
-
}
1744
1722
1745
1723
return good_bytes;
1746
1724
}