Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:

- a couple of serious fixes: use after free and blacklist for WRITE
SAME

- one error leg fix: write_pending failure

- one user experience problem: do not override max_sectors_kb

- one minor unused function removal

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: ibmvscsis: Fix write_pending failure path
scsi: libiscsi: Remove iscsi_destroy_session
scsi: libiscsi: Fix use-after-free race during iscsi_session_teardown
scsi: sd: Do not override max_sectors_kb sysfs setting
scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP

+36 -31
+1 -1
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
··· 3767 3767 */ 3768 3768 if ((vscsi->flags & (CLIENT_FAILED | RESPONSE_Q_DOWN))) { 3769 3769 pr_err("write_pending failed since: %d\n", vscsi->flags); 3770 - return 0; 3770 + return -EIO; 3771 3771 } 3772 3772 3773 3773 rc = srp_transfer_data(cmd, &vio_iu(iue)->srp.cmd, ibmvscsis_rdma,
+4 -4
drivers/scsi/libiscsi.c
··· 2851 2851 /** 2852 2852 * iscsi_session_teardown - destroy session, host, and cls_session 2853 2853 * @cls_session: iscsi session 2854 - * 2855 - * The driver must have called iscsi_remove_session before 2856 - * calling this. 2857 2854 */ 2858 2855 void iscsi_session_teardown(struct iscsi_cls_session *cls_session) 2859 2856 { ··· 2859 2862 struct Scsi_Host *shost = session->host; 2860 2863 2861 2864 iscsi_pool_free(&session->cmdpool); 2865 + 2866 + iscsi_remove_session(cls_session); 2862 2867 2863 2868 kfree(session->password); 2864 2869 kfree(session->password_in); ··· 2876 2877 kfree(session->portal_type); 2877 2878 kfree(session->discovery_parent_type); 2878 2879 2879 - iscsi_destroy_session(cls_session); 2880 + iscsi_free_session(cls_session); 2881 + 2880 2882 iscsi_host_dec_session_cnt(shost); 2881 2883 module_put(owner); 2882 2884 }
+3
drivers/scsi/scsi_scan.c
··· 956 956 if (*bflags & BLIST_NO_DIF) 957 957 sdev->no_dif = 1; 958 958 959 + if (*bflags & BLIST_UNMAP_LIMIT_WS) 960 + sdev->unmap_limit_for_ws = 1; 961 + 959 962 sdev->eh_timeout = SCSI_DEFAULT_EH_TIMEOUT; 960 963 961 964 if (*bflags & BLIST_TRY_VPD_PAGES)
-16
drivers/scsi/scsi_transport_iscsi.c
··· 2211 2211 EXPORT_SYMBOL_GPL(iscsi_free_session); 2212 2212 2213 2213 /** 2214 - * iscsi_destroy_session - destroy iscsi session 2215 - * @session: iscsi_session 2216 - * 2217 - * Can be called by a LLD or iscsi_transport. There must not be 2218 - * any running connections. 2219 - */ 2220 - int iscsi_destroy_session(struct iscsi_cls_session *session) 2221 - { 2222 - iscsi_remove_session(session); 2223 - ISCSI_DBG_TRANS_SESSION(session, "Completing session destruction\n"); 2224 - iscsi_free_session(session); 2225 - return 0; 2226 - } 2227 - EXPORT_SYMBOL_GPL(iscsi_destroy_session); 2228 - 2229 - /** 2230 2214 * iscsi_create_conn - create iscsi class connection 2231 2215 * @session: iscsi cls session 2232 2216 * @dd_size: private driver data size
+26 -9
drivers/scsi/sd.c
··· 715 715 break; 716 716 717 717 case SD_LBP_WS16: 718 - max_blocks = min_not_zero(sdkp->max_ws_blocks, 719 - (u32)SD_MAX_WS16_BLOCKS); 718 + if (sdkp->device->unmap_limit_for_ws) 719 + max_blocks = sdkp->max_unmap_blocks; 720 + else 721 + max_blocks = sdkp->max_ws_blocks; 722 + 723 + max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS16_BLOCKS); 720 724 break; 721 725 722 726 case SD_LBP_WS10: 723 - max_blocks = min_not_zero(sdkp->max_ws_blocks, 724 - (u32)SD_MAX_WS10_BLOCKS); 727 + if (sdkp->device->unmap_limit_for_ws) 728 + max_blocks = sdkp->max_unmap_blocks; 729 + else 730 + max_blocks = sdkp->max_ws_blocks; 731 + 732 + max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS10_BLOCKS); 725 733 break; 726 734 727 735 case SD_LBP_ZERO: ··· 3107 3099 sd_read_security(sdkp, buffer); 3108 3100 } 3109 3101 3110 - sdkp->first_scan = 0; 3111 - 3112 3102 /* 3113 3103 * We now have all cache related info, determine how we deal 3114 3104 * with flush requests. ··· 3121 3115 q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max); 3122 3116 3123 3117 /* 3124 - * Use the device's preferred I/O size for reads and writes 3118 + * Determine the device's preferred I/O size for reads and writes 3125 3119 * unless the reported value is unreasonably small, large, or 3126 3120 * garbage. 3127 3121 */ ··· 3135 3129 rw_max = min_not_zero(logical_to_sectors(sdp, dev_max), 3136 3130 (sector_t)BLK_DEF_MAX_SECTORS); 3137 3131 3138 - /* Combine with controller limits */ 3139 - q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q)); 3132 + /* Do not exceed controller limit */ 3133 + rw_max = min(rw_max, queue_max_hw_sectors(q)); 3134 + 3135 + /* 3136 + * Only update max_sectors if previously unset or if the current value 3137 + * exceeds the capabilities of the hardware. 3138 + */ 3139 + if (sdkp->first_scan || 3140 + q->limits.max_sectors > q->limits.max_dev_sectors || 3141 + q->limits.max_sectors > q->limits.max_hw_sectors) 3142 + q->limits.max_sectors = rw_max; 3143 + 3144 + sdkp->first_scan = 0; 3140 3145 3141 3146 set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity)); 3142 3147 sd_config_write_same(sdkp);
+1
include/scsi/scsi_device.h
··· 192 192 unsigned no_dif:1; /* T10 PI (DIF) should be disabled */ 193 193 unsigned broken_fua:1; /* Don't set FUA bit */ 194 194 unsigned lun_in_cdb:1; /* Store LUN bits in CDB[1] */ 195 + unsigned unmap_limit_for_ws:1; /* Use the UNMAP limit for WRITE SAME */ 195 196 196 197 atomic_t disk_events_disable_depth; /* disable depth for disk events */ 197 198
+1
include/scsi/scsi_devinfo.h
··· 29 29 #define BLIST_TRY_VPD_PAGES 0x10000000 /* Attempt to read VPD pages */ 30 30 #define BLIST_NO_RSOC 0x20000000 /* don't try to issue RSOC */ 31 31 #define BLIST_MAX_1024 0x40000000 /* maximum 1024 sector cdb length */ 32 + #define BLIST_UNMAP_LIMIT_WS 0x80000000 /* Use UNMAP limit for WRITE SAME */ 32 33 33 34 #endif
-1
include/scsi/scsi_transport_iscsi.h
··· 434 434 unsigned int target_id); 435 435 extern void iscsi_remove_session(struct iscsi_cls_session *session); 436 436 extern void iscsi_free_session(struct iscsi_cls_session *session); 437 - extern int iscsi_destroy_session(struct iscsi_cls_session *session); 438 437 extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess, 439 438 int dd_size, uint32_t cid); 440 439 extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);