linux-stable.git/drivers/ata, branch v4.4.205

ata: ep93xx: Use proper enums for directions

2019-11-25T14:54:36+00:00

[ Upstream commit 6adde4a36f1b6a562a1057fbb1065007851050e7 ]

Clang warns when one enumerated type is implicitly converted to another.

drivers/ata/pata_ep93xx.c:662:36: warning: implicit conversion from
enumeration type 'enum dma_data_direction' to different enumeration type
'enum dma_transfer_direction' [-Wenum-conversion]
        drv_data->dma_rx_data.direction = DMA_FROM_DEVICE;
                                        ~ ^~~~~~~~~~~~~~~
drivers/ata/pata_ep93xx.c:670:36: warning: implicit conversion from
enumeration type 'enum dma_data_direction' to different enumeration type
'enum dma_transfer_direction' [-Wenum-conversion]
        drv_data->dma_tx_data.direction = DMA_TO_DEVICE;
                                        ~ ^~~~~~~~~~~~~
drivers/ata/pata_ep93xx.c:681:19: warning: implicit conversion from
enumeration type 'enum dma_data_direction' to different enumeration type
'enum dma_transfer_direction' [-Wenum-conversion]
        conf.direction = DMA_FROM_DEVICE;
                       ~ ^~~~~~~~~~~~~~~
drivers/ata/pata_ep93xx.c:692:19: warning: implicit conversion from
enumeration type 'enum dma_data_direction' to different enumeration type
'enum dma_transfer_direction' [-Wenum-conversion]
        conf.direction = DMA_TO_DEVICE;
                       ~ ^~~~~~~~~~~~~

Use the equivalent valued enums from the expected type so that Clang no
longer warns about a conversion.

DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1
DMA_FROM_DEVICE = DMA_DEV_TO_MEM = 2

Acked-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Nathan Chancellor 
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin

libata: have ata_scsi_rw_xlat() fail invalid passthrough requests

2019-11-25T14:54:26+00:00

commit 2d7271501720038381d45fb3dcbe4831228fc8cc upstream.

For passthrough requests, libata-scsi takes what the user passes in
as gospel. This can be problematic if the user fills in the CDB
incorrectly. One example of that is in request sizes. For read/write
commands, the CDB contains fields describing the transfer length of
the request. These should match with the SG_IO header fields, but
libata-scsi currently does no validation of that.

Check that the number of blocks in the CDB for passthrough requests
matches what was mapped into the request. If the CDB asks for more
data then the validated SG_IO header fields, error it.

Reported-by: Krishna Ram Prakash R 
Reviewed-by: Kees Cook 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

libata: add SG safety checks in SFF pio transfers

2019-09-06T08:18:08+00:00

[ Upstream commit 752ead44491e8c91e14d7079625c5916b30921c5 ]

Abort processing of a command if we run out of mapped data in the
SG list. This should never happen, but a previous bug caused it to
be possible. Play it safe and attempt to abort nicely if we don't
have more SG segments left.

Reviewed-by: Kees Cook 
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin

ata: libahci: do not complain in case of deferred probe

2019-08-25T08:53:00+00:00

[ Upstream commit 090bb803708198e5ab6b0046398c7ed9f4d12d6b ]

Retrieving PHYs can defer the probe, do not spawn an error when
-EPROBE_DEFER is returned, it is normal behavior.

Fixes: b1a9edbda040 ("ata: libahci: allow to use multiple PHYs")
Reviewed-by: Hans de Goede 
Signed-off-by: Miquel Raynal 
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin

libata: zpodd: Fix small read overflow in zpodd_get_mech_type()

2019-08-25T08:53:00+00:00

[ Upstream commit 71d6c505b4d9e6f76586350450e785e3d452b346 ]

Jeffrin reported a KASAN issue:

  BUG: KASAN: global-out-of-bounds in ata_exec_internal_sg+0x50f/0xc70
  Read of size 16 at addr ffffffff91f41f80 by task scsi_eh_1/149
  ...
  The buggy address belongs to the variable:
    cdb.48319+0x0/0x40

Much like commit 18c9a99bce2a ("libata: zpodd: small read overflow in
eject_tray()"), this fixes a cdb[] buffer length, this time in
zpodd_get_mech_type():

We read from the cdb[] buffer in ata_exec_internal_sg(). It has to be
ATAPI_CDB_LEN (16) bytes long, but this buffer is only 12 bytes.

Reported-by: Jeffrin Jose T 
Fixes: afe759511808c ("libata: identify and init ZPODD devices")
Link: https://lore.kernel.org/lkml/201907181423.E808958@keescook/
Tested-by: Jeffrin Jose T 
Reviewed-by: Nick Desaulniers 
Signed-off-by: Kees Cook 
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin

libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk

2019-06-22T06:18:22+00:00

commit 31f6264e225fb92cf6f4b63031424f20797c297d upstream.

We've received a bugreport that using LPM with ST1000LM024 drives leads
to system lockups. So it seems that these models are buggy in more then
1 way. Add NOLPM quirk to the existing quirks entry for BROKEN_FPDMA_AA.

BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1571330
Cc: stable@vger.kernel.org
Reviewed-by: Martin K. Petersen 
Signed-off-by: Hans de Goede 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

libata: fix using DMA buffers on stack

2019-05-16T17:44:59+00:00

[ Upstream commit dd08a8d9a66de4b54575c294a92630299f7e0fe7 ]

When CONFIG_VMAP_STACK=y, __pa() returns incorrect physical address for
a stack virtual address. Stack DMA buffers must be avoided.

Signed-off-by: raymond pang 
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin (Microsoft)

sata_rcar: fix deferred probing

2019-02-20T09:13:08+00:00

[ Upstream commit 9f83cfdb1ace3ef268ecc6fda50058d2ec37d603 ]

The driver overrides the error codes returned by platform_get_irq() to
-EINVAL, so if it returns -EPROBE_DEFER, the driver would fail the probe
permanently instead of the deferred probing. Switch to propagating the
error code upstream, still checking/overriding IRQ0 as libata regards it
as "no IRQ" (thus polling) anyway...

Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq")
Reviewed-by: Simon Horman 
Reviewed-by: Geert Uytterhoeven 
Signed-off-by: Sergei Shtylyov 
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin

libata: whitelist all SAMSUNG MZ7KM* solid-state disks

2018-12-21T13:09:53+00:00

[ Upstream commit fd6f32f78645db32b6b95a42e45da2ddd6de0e67 ]

These devices support read zero after trim (RZAT), as they advertise to
the OS. However, the OS doesn't believe the SSDs unless they are
explicitly whitelisted.

Acked-by: Martin K. Petersen 
Signed-off-by: Juha-Matti Tilli 
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin

ahci: don't ignore result code of ahci_reset_controller()

2018-11-10T15:41:42+00:00

[ Upstream commit d312fefea8387503375f728855c9a62de20c9665 ]

ahci_pci_reset_controller() calls ahci_reset_controller(), which may
fail, but ignores the result code and always returns success. This
may result in failures like below

  ahci 0000:02:00.0: version 3.0
  ahci 0000:02:00.0: enabling device (0000 -> 0003)
  ahci 0000:02:00.0: SSS flag set, parallel bus scan disabled
  ahci 0000:02:00.0: controller reset failed (0xffffffff)
  ahci 0000:02:00.0: failed to stop engine (-5)
    ... repeated many times ...
  ahci 0000:02:00.0: failed to stop engine (-5)
  Unable to handle kernel paging request at virtual address ffff0000093f9018
    ...
  PC is at ahci_stop_engine+0x5c/0xd8 [libahci]
  LR is at ahci_deinit_port.constprop.12+0x1c/0xc0 [libahci]
    ...
  [] ahci_stop_engine+0x5c/0xd8 [libahci]
  [] ahci_deinit_port.constprop.12+0x1c/0xc0 [libahci]
  [] ahci_init_controller+0x80/0x168 [libahci]
  [] ahci_pci_init_controller+0x60/0x68 [ahci]
  [] ahci_init_one+0x75c/0xd88 [ahci]
  [] local_pci_probe+0x3c/0xb8
  [] pci_device_probe+0x138/0x170
  [] driver_probe_device+0x2dc/0x458
  [] __driver_attach+0x114/0x118
  [] bus_for_each_dev+0x60/0xa0
  [] driver_attach+0x20/0x28
  [] bus_add_driver+0x1f0/0x2a8
  [] driver_register+0x60/0xf8
  [] __pci_register_driver+0x3c/0x48
  [] ahci_pci_driver_init+0x1c/0x1000 [ahci]
  [] do_one_initcall+0x38/0x120

where an obvious hardware level failure results in an unnecessary 15 second
delay and a subsequent crash.

So record the result code of ahci_reset_controller() and relay it, rather
than ignoring it.

Signed-off-by: Ard Biesheuvel 
Signed-off-by: Tejun Heo 
Signed-off-by: Sasha Levin