Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"This is a set of small bug fixes for lpfc and zfcp and a fix for a
fairly nasty bug in sg where a process which cancels I/O completes in
a kernel thread which would then try to write back to the now gone
userspace and end up writing to a random kernel address instead"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
[SCSI] zfcp: remove access control tables interface (keep sysfs files)
[SCSI] zfcp: fix schedule-inside-lock in scsi_device list loops
[SCSI] zfcp: fix lock imbalance by reworking request queue locking
[SCSI] sg: Fix user memory corruption when SG_IO is interrupted by a signal
[SCSI] lpfc: Don't force CONFIG_GENERIC_CSUM on
+110
-19
+22
-7
drivers/s390/scsi/zfcp_erp.c
+22
-7
drivers/s390/scsi/zfcp_erp.c
···
102
102
103
103
if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_INUSE)
104
104
zfcp_erp_action_dismiss(&port->erp_action);
105
-
else
106
-
shost_for_each_device(sdev, port->adapter->scsi_host)
105
+
else {
106
+
spin_lock(port->adapter->scsi_host->host_lock);
107
+
__shost_for_each_device(sdev, port->adapter->scsi_host)
107
108
if (sdev_to_zfcp(sdev)->port == port)
108
109
zfcp_erp_action_dismiss_lun(sdev);
110
+
spin_unlock(port->adapter->scsi_host->host_lock);
111
+
}
109
112
}
110
113
111
114
static void zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter)
···
595
592
{
596
593
struct scsi_device *sdev;
597
594
598
-
shost_for_each_device(sdev, port->adapter->scsi_host)
595
+
spin_lock(port->adapter->scsi_host->host_lock);
596
+
__shost_for_each_device(sdev, port->adapter->scsi_host)
599
597
if (sdev_to_zfcp(sdev)->port == port)
600
598
_zfcp_erp_lun_reopen(sdev, clear, id, 0);
599
+
spin_unlock(port->adapter->scsi_host->host_lock);
601
600
}
602
601
603
602
static void zfcp_erp_strategy_followup_failed(struct zfcp_erp_action *act)
···
1439
1434
atomic_set_mask(common_mask, &port->status);
1440
1435
read_unlock_irqrestore(&adapter->port_list_lock, flags);
1441
1436
1442
-
shost_for_each_device(sdev, adapter->scsi_host)
1437
+
spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
1438
+
__shost_for_each_device(sdev, adapter->scsi_host)
1443
1439
atomic_set_mask(common_mask, &sdev_to_zfcp(sdev)->status);
1440
+
spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
1444
1441
}
1445
1442
1446
1443
/**
···
1476
1469
}
1477
1470
read_unlock_irqrestore(&adapter->port_list_lock, flags);
1478
1471
1479
-
shost_for_each_device(sdev, adapter->scsi_host) {
1472
+
spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
1473
+
__shost_for_each_device(sdev, adapter->scsi_host) {
1480
1474
atomic_clear_mask(common_mask, &sdev_to_zfcp(sdev)->status);
1481
1475
if (clear_counter)
1482
1476
atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0);
1483
1477
}
1478
+
spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
1484
1479
}
1485
1480
1486
1481
/**
···
1496
1487
{
1497
1488
struct scsi_device *sdev;
1498
1489
u32 common_mask = mask & ZFCP_COMMON_FLAGS;
1490
+
unsigned long flags;
1499
1491
1500
1492
atomic_set_mask(mask, &port->status);
1501
1493
1502
1494
if (!common_mask)
1503
1495
return;
1504
1496
1505
-
shost_for_each_device(sdev, port->adapter->scsi_host)
1497
+
spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags);
1498
+
__shost_for_each_device(sdev, port->adapter->scsi_host)
1506
1499
if (sdev_to_zfcp(sdev)->port == port)
1507
1500
atomic_set_mask(common_mask,
1508
1501
&sdev_to_zfcp(sdev)->status);
1502
+
spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags);
1509
1503
}
1510
1504
1511
1505
/**
···
1523
1511
struct scsi_device *sdev;
1524
1512
u32 common_mask = mask & ZFCP_COMMON_FLAGS;
1525
1513
u32 clear_counter = mask & ZFCP_STATUS_COMMON_ERP_FAILED;
1514
+
unsigned long flags;
1526
1515
1527
1516
atomic_clear_mask(mask, &port->status);
1528
1517
···
1533
1520
if (clear_counter)
1534
1521
atomic_set(&port->erp_counter, 0);
1535
1522
1536
-
shost_for_each_device(sdev, port->adapter->scsi_host)
1523
+
spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags);
1524
+
__shost_for_each_device(sdev, port->adapter->scsi_host)
1537
1525
if (sdev_to_zfcp(sdev)->port == port) {
1538
1526
atomic_clear_mask(common_mask,
1539
1527
&sdev_to_zfcp(sdev)->status);
1540
1528
if (clear_counter)
1541
1529
atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0);
1542
1530
}
1531
+
spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags);
1543
1532
}
1544
1533
1545
1534
/**
+2
-6
drivers/s390/scsi/zfcp_qdio.c
+2
-6
drivers/s390/scsi/zfcp_qdio.c
···
224
224
225
225
static int zfcp_qdio_sbal_check(struct zfcp_qdio *qdio)
226
226
{
227
-
spin_lock_irq(&qdio->req_q_lock);
228
227
if (atomic_read(&qdio->req_q_free) ||
229
228
!(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP))
230
229
return 1;
231
-
spin_unlock_irq(&qdio->req_q_lock);
232
230
return 0;
233
231
}
234
232
···
244
246
{
245
247
long ret;
246
248
247
-
spin_unlock_irq(&qdio->req_q_lock);
248
-
ret = wait_event_interruptible_timeout(qdio->req_q_wq,
249
-
zfcp_qdio_sbal_check(qdio), 5 * HZ);
249
+
ret = wait_event_interruptible_lock_irq_timeout(qdio->req_q_wq,
250
+
zfcp_qdio_sbal_check(qdio), qdio->req_q_lock, 5 * HZ);
250
251
251
252
if (!(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP))
252
253
return -EIO;
···
259
262
zfcp_erp_adapter_reopen(qdio->adapter, 0, "qdsbg_1");
260
263
}
261
264
262
-
spin_lock_irq(&qdio->req_q_lock);
263
265
return -EIO;
264
266
}
265
267
+14
drivers/s390/scsi/zfcp_sysfs.c
+14
drivers/s390/scsi/zfcp_sysfs.c
···
27
27
static ZFCP_DEV_ATTR(_feat, _name, S_IRUGO, \
28
28
zfcp_sysfs_##_feat##_##_name##_show, NULL);
29
29
30
+
#define ZFCP_DEFINE_ATTR_CONST(_feat, _name, _format, _value) \
31
+
static ssize_t zfcp_sysfs_##_feat##_##_name##_show(struct device *dev, \
32
+
struct device_attribute *at,\
33
+
char *buf) \
34
+
{ \
35
+
return sprintf(buf, _format, _value); \
36
+
} \
37
+
static ZFCP_DEV_ATTR(_feat, _name, S_IRUGO, \
38
+
zfcp_sysfs_##_feat##_##_name##_show, NULL);
39
+
30
40
#define ZFCP_DEFINE_A_ATTR(_name, _format, _value) \
31
41
static ssize_t zfcp_sysfs_adapter_##_name##_show(struct device *dev, \
32
42
struct device_attribute *at,\
···
85
75
ZFCP_DEFINE_ATTR(zfcp_unit, unit, access_denied, "%d\n",
86
76
(zfcp_unit_sdev_status(unit) &
87
77
ZFCP_STATUS_COMMON_ACCESS_DENIED) != 0);
78
+
ZFCP_DEFINE_ATTR_CONST(unit, access_shared, "%d\n", 0);
79
+
ZFCP_DEFINE_ATTR_CONST(unit, access_readonly, "%d\n", 0);
88
80
89
81
static ssize_t zfcp_sysfs_port_failed_show(struct device *dev,
90
82
struct device_attribute *attr,
···
359
347
&dev_attr_unit_in_recovery.attr,
360
348
&dev_attr_unit_status.attr,
361
349
&dev_attr_unit_access_denied.attr,
350
+
&dev_attr_unit_access_shared.attr,
351
+
&dev_attr_unit_access_readonly.attr,
362
352
NULL
363
353
};
364
354
static struct attribute_group zfcp_unit_attr_group = {
-1
drivers/scsi/Kconfig
-1
drivers/scsi/Kconfig
+15
-5
fs/bio.c
+15
-5
fs/bio.c
···
1045
1045
int bio_uncopy_user(struct bio *bio)
1046
1046
{
1047
1047
struct bio_map_data *bmd = bio->bi_private;
1048
-
int ret = 0;
1048
+
struct bio_vec *bvec;
1049
+
int ret = 0, i;
1049
1050
1050
-
if (!bio_flagged(bio, BIO_NULL_MAPPED))
1051
-
ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
1052
-
bmd->nr_sgvecs, bio_data_dir(bio) == READ,
1053
-
0, bmd->is_our_pages);
1051
+
if (!bio_flagged(bio, BIO_NULL_MAPPED)) {
1052
+
/*
1053
+
* if we're in a workqueue, the request is orphaned, so
1054
+
* don't copy into a random user address space, just free.
1055
+
*/
1056
+
if (current->mm)
1057
+
ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
1058
+
bmd->nr_sgvecs, bio_data_dir(bio) == READ,
1059
+
0, bmd->is_our_pages);
1060
+
else if (bmd->is_our_pages)
1061
+
bio_for_each_segment_all(bvec, bio, i)
1062
+
__free_page(bvec->bv_page);
1063
+
}
1054
1064
bio_free_map_data(bmd);
1055
1065
bio_put(bio);
1056
1066
return ret;
+57
include/linux/wait.h
+57
include/linux/wait.h
···
811
811
__ret; \
812
812
})
813
813
814
+
#define __wait_event_interruptible_lock_irq_timeout(wq, condition, \
815
+
lock, ret) \
816
+
do { \
817
+
DEFINE_WAIT(__wait); \
818
+
\
819
+
for (;;) { \
820
+
prepare_to_wait(&wq, &__wait, TASK_INTERRUPTIBLE); \
821
+
if (condition) \
822
+
break; \
823
+
if (signal_pending(current)) { \
824
+
ret = -ERESTARTSYS; \
825
+
break; \
826
+
} \
827
+
spin_unlock_irq(&lock); \
828
+
ret = schedule_timeout(ret); \
829
+
spin_lock_irq(&lock); \
830
+
if (!ret) \
831
+
break; \
832
+
} \
833
+
finish_wait(&wq, &__wait); \
834
+
} while (0)
835
+
836
+
/**
837
+
* wait_event_interruptible_lock_irq_timeout - sleep until a condition gets true or a timeout elapses.
838
+
* The condition is checked under the lock. This is expected
839
+
* to be called with the lock taken.
840
+
* @wq: the waitqueue to wait on
841
+
* @condition: a C expression for the event to wait for
842
+
* @lock: a locked spinlock_t, which will be released before schedule()
843
+
* and reacquired afterwards.
844
+
* @timeout: timeout, in jiffies
845
+
*
846
+
* The process is put to sleep (TASK_INTERRUPTIBLE) until the
847
+
* @condition evaluates to true or signal is received. The @condition is
848
+
* checked each time the waitqueue @wq is woken up.
849
+
*
850
+
* wake_up() has to be called after changing any variable that could
851
+
* change the result of the wait condition.
852
+
*
853
+
* This is supposed to be called while holding the lock. The lock is
854
+
* dropped before going to sleep and is reacquired afterwards.
855
+
*
856
+
* The function returns 0 if the @timeout elapsed, -ERESTARTSYS if it
857
+
* was interrupted by a signal, and the remaining jiffies otherwise
858
+
* if the condition evaluated to true before the timeout elapsed.
859
+
*/
860
+
#define wait_event_interruptible_lock_irq_timeout(wq, condition, lock, \
861
+
timeout) \
862
+
({ \
863
+
int __ret = timeout; \
864
+
\
865
+
if (!(condition)) \
866
+
__wait_event_interruptible_lock_irq_timeout( \
867
+
wq, condition, lock, __ret); \
868
+
__ret; \
869
+
})
870
+
814
871
815
872
/*
816
873
* These are the old interfaces to sleep waiting for an event.