Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
"Six fixes, all of which appear to have user visible consequences.

The DMA one is a regression fix from the merge window and of the
others, four are driver specific and one specific to the target code"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: ufs: Use explicit access size in ufshcd_dump_regs
scsi: tcmu: fix use after free
scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
scsi: lpfc: nvmet: avoid hang / use-after-free when destroying targetport
scsi: lpfc: nvme: avoid hang / use-after-free when destroying localport
scsi: communicate max segment size to the DMA mapping code

+47 -45
+4 -5
drivers/ata/pata_macio.c
··· 915 915 .sg_tablesize = MAX_DCMDS, 916 916 /* We may not need that strict one */ 917 917 .dma_boundary = ATA_DMA_BOUNDARY, 918 + /* Not sure what the real max is but we know it's less than 64K, let's 919 + * use 64K minus 256 920 + */ 921 + .max_segment_size = MAX_DBDMA_SEG, 918 922 .slave_configure = pata_macio_slave_config, 919 923 }; 920 924 ··· 1047 1043 1048 1044 /* Make sure we have sane initial timings in the cache */ 1049 1045 pata_macio_default_timings(priv); 1050 - 1051 - /* Not sure what the real max is but we know it's less than 64K, let's 1052 - * use 64K minus 256 1053 - */ 1054 - dma_set_max_seg_size(priv->dev, MAX_DBDMA_SEG); 1055 1046 1056 1047 /* Allocate libata host for 1 port */ 1057 1048 memset(&pinfo, 0, sizeof(struct ata_port_info));
+9 -13
drivers/ata/sata_inic162x.c
··· 245 245 246 246 static struct scsi_host_template inic_sht = { 247 247 ATA_BASE_SHT(DRV_NAME), 248 - .sg_tablesize = LIBATA_MAX_PRD, /* maybe it can be larger? */ 249 - .dma_boundary = INIC_DMA_BOUNDARY, 248 + .sg_tablesize = LIBATA_MAX_PRD, /* maybe it can be larger? */ 249 + 250 + /* 251 + * This controller is braindamaged. dma_boundary is 0xffff like others 252 + * but it will lock up the whole machine HARD if 65536 byte PRD entry 253 + * is fed. Reduce maximum segment size. 254 + */ 255 + .dma_boundary = INIC_DMA_BOUNDARY, 256 + .max_segment_size = 65536 - 512, 250 257 }; 251 258 252 259 static const int scr_map[] = { ··· 872 865 rc = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); 873 866 if (rc) { 874 867 dev_err(&pdev->dev, "32-bit consistent DMA enable failed\n"); 875 - return rc; 876 - } 877 - 878 - /* 879 - * This controller is braindamaged. dma_boundary is 0xffff 880 - * like others but it will lock up the whole machine HARD if 881 - * 65536 byte PRD entry is fed. Reduce maximum segment size. 882 - */ 883 - rc = dma_set_max_seg_size(&pdev->dev, 65536 - 512); 884 - if (rc) { 885 - dev_err(&pdev->dev, "failed to set the maximum segment size\n"); 886 868 return rc; 887 869 } 888 870
+1 -4
drivers/firewire/sbp2.c
··· 1144 1144 if (device->is_local) 1145 1145 return -ENODEV; 1146 1146 1147 - if (dma_get_max_seg_size(device->card->device) > SBP2_MAX_SEG_SIZE) 1148 - WARN_ON(dma_set_max_seg_size(device->card->device, 1149 - SBP2_MAX_SEG_SIZE)); 1150 - 1151 1147 shost = scsi_host_alloc(&scsi_driver_template, sizeof(*tgt)); 1152 1148 if (shost == NULL) 1153 1149 return -ENOMEM; ··· 1606 1610 .eh_abort_handler = sbp2_scsi_abort, 1607 1611 .this_id = -1, 1608 1612 .sg_tablesize = SG_ALL, 1613 + .max_segment_size = SBP2_MAX_SEG_SIZE, 1609 1614 .can_queue = 1, 1610 1615 .sdev_attrs = sbp2_scsi_sysfs_attrs, 1611 1616 };
+4 -5
drivers/scsi/aacraid/linit.c
··· 1747 1747 shost->max_sectors = (shost->sg_tablesize * 8) + 112; 1748 1748 } 1749 1749 1750 - error = dma_set_max_seg_size(&pdev->dev, 1751 - (aac->adapter_info.options & AAC_OPT_NEW_COMM) ? 1752 - (shost->max_sectors << 9) : 65536); 1753 - if (error) 1754 - goto out_deinit; 1750 + if (aac->adapter_info.options & AAC_OPT_NEW_COMM) 1751 + shost->max_segment_size = shost->max_sectors << 9; 1752 + else 1753 + shost->max_segment_size = 65536; 1755 1754 1756 1755 /* 1757 1756 * Firmware printf works only with older firmware.
+1 -1
drivers/scsi/csiostor/csio_attr.c
··· 594 594 } 595 595 596 596 fc_vport_set_state(fc_vport, FC_VPORT_INITIALIZING); 597 + ln->fc_vport = fc_vport; 597 598 598 599 if (csio_fcoe_alloc_vnp(hw, ln)) 599 600 goto error; 600 601 601 602 *(struct csio_lnode **)fc_vport->dd_data = ln; 602 - ln->fc_vport = fc_vport; 603 603 if (!fc_vport->node_name) 604 604 fc_vport->node_name = wwn_to_u64(csio_ln_wwnn(ln)); 605 605 if (!fc_vport->port_name)
+9 -7
drivers/scsi/lpfc/lpfc_nvme.c
··· 297 297 lport); 298 298 299 299 /* release any threads waiting for the unreg to complete */ 300 - complete(&lport->lport_unreg_done); 300 + if (lport->vport->localport) 301 + complete(lport->lport_unreg_cmp); 301 302 } 302 303 303 304 /* lpfc_nvme_remoteport_delete ··· 2546 2545 */ 2547 2546 void 2548 2547 lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport, 2549 - struct lpfc_nvme_lport *lport) 2548 + struct lpfc_nvme_lport *lport, 2549 + struct completion *lport_unreg_cmp) 2550 2550 { 2551 2551 #if (IS_ENABLED(CONFIG_NVME_FC)) 2552 2552 u32 wait_tmo; ··· 2559 2557 */ 2560 2558 wait_tmo = msecs_to_jiffies(LPFC_NVME_WAIT_TMO * 1000); 2561 2559 while (true) { 2562 - ret = wait_for_completion_timeout(&lport->lport_unreg_done, 2563 - wait_tmo); 2560 + ret = wait_for_completion_timeout(lport_unreg_cmp, wait_tmo); 2564 2561 if (unlikely(!ret)) { 2565 2562 lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_IOERR, 2566 2563 "6176 Lport %p Localport %p wait " ··· 2593 2592 struct lpfc_nvme_lport *lport; 2594 2593 struct lpfc_nvme_ctrl_stat *cstat; 2595 2594 int ret; 2595 + DECLARE_COMPLETION_ONSTACK(lport_unreg_cmp); 2596 2596 2597 2597 if (vport->nvmei_support == 0) 2598 2598 return; 2599 2599 2600 2600 localport = vport->localport; 2601 - vport->localport = NULL; 2602 2601 lport = (struct lpfc_nvme_lport *)localport->private; 2603 2602 cstat = lport->cstat; 2604 2603 ··· 2609 2608 /* lport's rport list is clear. Unregister 2610 2609 * lport and release resources. 2611 2610 */ 2612 - init_completion(&lport->lport_unreg_done); 2611 + lport->lport_unreg_cmp = &lport_unreg_cmp; 2613 2612 ret = nvme_fc_unregister_localport(localport); 2614 2613 2615 2614 /* Wait for completion. This either blocks 2616 2615 * indefinitely or succeeds 2617 2616 */ 2618 - lpfc_nvme_lport_unreg_wait(vport, lport); 2617 + lpfc_nvme_lport_unreg_wait(vport, lport, &lport_unreg_cmp); 2618 + vport->localport = NULL; 2619 2619 kfree(cstat); 2620 2620 2621 2621 /* Regardless of the unregister upcall response, clear
+1 -1
drivers/scsi/lpfc/lpfc_nvme.h
··· 50 50 /* Declare nvme-based local and remote port definitions. */ 51 51 struct lpfc_nvme_lport { 52 52 struct lpfc_vport *vport; 53 - struct completion lport_unreg_done; 53 + struct completion *lport_unreg_cmp; 54 54 /* Add stats counters here */ 55 55 struct lpfc_nvme_ctrl_stat *cstat; 56 56 atomic_t fc4NvmeLsRequests;
+5 -3
drivers/scsi/lpfc/lpfc_nvmet.c
··· 1003 1003 struct lpfc_nvmet_tgtport *tport = targetport->private; 1004 1004 1005 1005 /* release any threads waiting for the unreg to complete */ 1006 - complete(&tport->tport_unreg_done); 1006 + if (tport->phba->targetport) 1007 + complete(tport->tport_unreg_cmp); 1007 1008 } 1008 1009 1009 1010 static void ··· 1693 1692 struct lpfc_nvmet_tgtport *tgtp; 1694 1693 struct lpfc_queue *wq; 1695 1694 uint32_t qidx; 1695 + DECLARE_COMPLETION_ONSTACK(tport_unreg_cmp); 1696 1696 1697 1697 if (phba->nvmet_support == 0) 1698 1698 return; ··· 1703 1701 wq = phba->sli4_hba.nvme_wq[qidx]; 1704 1702 lpfc_nvmet_wqfull_flush(phba, wq, NULL); 1705 1703 } 1706 - init_completion(&tgtp->tport_unreg_done); 1704 + tgtp->tport_unreg_cmp = &tport_unreg_cmp; 1707 1705 nvmet_fc_unregister_targetport(phba->targetport); 1708 - wait_for_completion_timeout(&tgtp->tport_unreg_done, 5); 1706 + wait_for_completion_timeout(&tport_unreg_cmp, 5); 1709 1707 lpfc_nvmet_cleanup_io_context(phba); 1710 1708 } 1711 1709 phba->targetport = NULL;
+1 -1
drivers/scsi/lpfc/lpfc_nvmet.h
··· 34 34 /* Used for NVME Target */ 35 35 struct lpfc_nvmet_tgtport { 36 36 struct lpfc_hba *phba; 37 - struct completion tport_unreg_done; 37 + struct completion *tport_unreg_cmp; 38 38 39 39 /* Stats counters - lpfc_nvmet_unsol_ls_buffer */ 40 40 atomic_t rcv_ls_req_in;
+2 -2
drivers/scsi/scsi_lib.c
··· 1842 1842 blk_queue_segment_boundary(q, shost->dma_boundary); 1843 1843 dma_set_seg_boundary(dev, shost->dma_boundary); 1844 1844 1845 - blk_queue_max_segment_size(q, 1846 - min(shost->max_segment_size, dma_get_max_seg_size(dev))); 1845 + blk_queue_max_segment_size(q, shost->max_segment_size); 1846 + dma_set_max_seg_size(dev, shost->max_segment_size); 1847 1847 1848 1848 /* 1849 1849 * Set a reasonable default alignment: The larger of 32-byte (dword),
+8 -2
drivers/scsi/ufs/ufshcd.c
··· 108 108 int ufshcd_dump_regs(struct ufs_hba *hba, size_t offset, size_t len, 109 109 const char *prefix) 110 110 { 111 - u8 *regs; 111 + u32 *regs; 112 + size_t pos; 113 + 114 + if (offset % 4 != 0 || len % 4 != 0) /* keep readl happy */ 115 + return -EINVAL; 112 116 113 117 regs = kzalloc(len, GFP_KERNEL); 114 118 if (!regs) 115 119 return -ENOMEM; 116 120 117 - memcpy_fromio(regs, hba->mmio_base + offset, len); 121 + for (pos = 0; pos < len; pos += 4) 122 + regs[pos / 4] = ufshcd_readl(hba, offset + pos); 123 + 118 124 ufshcd_hex_dump(prefix, regs, len); 119 125 kfree(regs); 120 126
+2 -1
drivers/target/target_core_user.c
··· 1317 1317 * target_complete_cmd will translate this to LUN COMM FAILURE 1318 1318 */ 1319 1319 scsi_status = SAM_STAT_CHECK_CONDITION; 1320 + list_del_init(&cmd->queue_entry); 1320 1321 } else { 1322 + list_del_init(&cmd->queue_entry); 1321 1323 idr_remove(&udev->commands, id); 1322 1324 tcmu_free_cmd(cmd); 1323 1325 scsi_status = SAM_STAT_TASK_SET_FULL; 1324 1326 } 1325 - list_del_init(&cmd->queue_entry); 1326 1327 1327 1328 pr_debug("Timing out cmd %u on dev %s that is %s.\n", 1328 1329 id, udev->name, is_running ? "inflight" : "queued");