linux-stable.git/drivers/scsi, branch linux-3.16.y

scsi: sg: add sg_remove_request in sg_write

2020-06-11T18:05:52+00:00

commit 83c6f2390040f188cc25b270b4befeb5628c1aee upstream.

If the __copy_from_user function failed we need to call sg_remove_request
in sg_write.

Link: https://lore.kernel.org/r/610618d9-e983-fd56-ed0f-639428343af7@huawei.com
Acked-by: Douglas Gilbert 
Signed-off-by: Wu Bo 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
[groeck: Backport to v5.4.y and older kernels]
Signed-off-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

scsi: sg: add sg_remove_request in sg_common_write

2020-06-11T18:05:51+00:00

commit 849f8583e955dbe3a1806e03ecacd5e71cce0a08 upstream.

If the dxfer_len is greater than 256M then the request is invalid and we
need to call sg_remove_request in sg_common_write.

Link: https://lore.kernel.org/r/1586777361-17339-1-git-send-email-huawei.libin@huawei.com
Fixes: f930c7043663 ("scsi: sg: only check for dxfer_len greater than 256M")
Acked-by: Douglas Gilbert 
Signed-off-by: Li Bin 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

scsi: sg: fix minor memory leak in error path

2020-06-11T18:05:51+00:00

commit c170e5a8d222537e98aa8d4fddb667ff7a2ee114 upstream.

Fix a minor memory leak when there is an error opening a /dev/sg device.

Fixes: cc833acbee9d ("sg: O_EXCL and other lock handling")
Cc: 
Reviewed-by: Ewan D. Milne 
Signed-off-by: Tony Battersby 
Reviewed-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

scsi: sg: don't return bogus Sg_requests

2020-06-11T18:05:50+00:00

commit 48ae8484e9fc324b4968d33c585e54bc98e44d61 upstream.

If the list search in sg_get_rq_mark() fails to find a valid request, we
return a bogus element. This then can later lead to a GPF in
sg_remove_scat().

So don't return bogus Sg_requests in sg_get_rq_mark() but NULL in case
the list search doesn't find a valid request.

Signed-off-by: Johannes Thumshirn 
Reported-by: Andrey Konovalov 
Cc: Hannes Reinecke 
Cc: Christoph Hellwig 
Cc: Doug Gilbert 
Reviewed-by: Hannes Reinecke 
Acked-by: Doug Gilbert 
Signed-off-by: Martin K. Petersen 
Cc: Tony Battersby 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

scsi: sg: only check for dxfer_len greater than 256M

2020-06-11T18:05:50+00:00

commit f930c7043663188429cd9b254e9d761edfc101ce upstream.

Don't make any assumptions on the sg_io_hdr_t::dxfer_direction or the
sg_io_hdr_t::dxferp in order to determine if it is a valid request. The
only way we can check for bad requests is by checking if the length
exceeds 256M.

Signed-off-by: Johannes Thumshirn 
Fixes: 28676d869bbb (scsi: sg: check for valid direction before starting the request)
Reported-by: Jason L Tibbitts III 
Tested-by: Jason L Tibbitts III 
Suggested-by: Doug Gilbert 
Cc: Doug Gilbert 
Cc: 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16: Include ]
Signed-off-by: Ben Hutchings

scsi: sg: fix static checker warning in sg_is_valid_dxfer

2020-06-11T18:05:50+00:00

commit 14074aba4bcda3764c9a702b276308b89901d5b6 upstream.

dxfer_len is an unsigned int and we always assign a value > 0 to it, so
it doesn't make any sense to check if it is < 0. We can't really check
dxferp as well as we have both NULL and not NULL cases in the possible
call paths.

So just return true for SG_DXFER_FROM_DEV transfer in
sg_is_valid_dxfer().

Signed-off-by: Johannes Thumshirn 
Reported-by: Colin Ian King 
Reported-by: Dan Carpenter 
Cc: Douglas Gilbert 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

scsi: sg: fix SG_DXFER_FROM_DEV transfers

2020-06-11T18:05:49+00:00

commit 68c59fcea1f2c6a54c62aa896cc623c1b5bc9b47 upstream.

SG_DXFER_FROM_DEV transfers do not necessarily have a dxferp as we set
it to NULL for the old sg_io read/write interface, but must have a
length bigger than 0. This fixes a regression introduced by commit
28676d869bbb ("scsi: sg: check for valid direction before starting the
request")

Signed-off-by: Johannes Thumshirn 
Fixes: 28676d869bbb ("scsi: sg: check for valid direction before starting the request")
Reported-by: Chris Clayton 
Tested-by: Chris Clayton 
Cc: Douglas Gilbert 
Reviewed-by: Hannes Reinecke 
Tested-by: Chris Clayton 
Acked-by: Douglas Gilbert 
Signed-off-by: Martin K. Petersen 
Cc: Cristian Crinteanu 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

scsi: sg: close race condition in sg_remove_sfp_usercontext()

2020-06-11T18:05:49+00:00

commit 97d27b0dd015e980ade63fda111fd1353276e28b upstream.

sg_remove_sfp_usercontext() is clearing any sg requests, but needs to
take 'rq_list_lock' when modifying the list.

Reported-by: Christoph Hellwig 
Signed-off-by: Hannes Reinecke 
Reviewed-by: Johannes Thumshirn 
Tested-by: Johannes Thumshirn 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

scsi: sg: check for valid direction before starting the request

2020-06-11T18:05:47+00:00

commit 28676d869bbb5257b5f14c0c95ad3af3a7019dd5 upstream.

Check for a valid direction before starting the request, otherwise we
risk running into an assertion in the scsi midlayer checking for valid
requests.

[mkp: fixed typo]

Signed-off-by: Johannes Thumshirn 
Link: http://www.spinics.net/lists/linux-scsi/msg104400.html
Reported-by: Dmitry Vyukov 
Signed-off-by: Hannes Reinecke 
Tested-by: Johannes Thumshirn 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

scsi: sg: disable SET_FORCE_LOW_DMA

2020-06-11T18:05:47+00:00

commit 745dfa0d8ec26b24f3304459ff6e9eacc5c8351b upstream.

The ioctl SET_FORCE_LOW_DMA has never worked since the initial git
check-in, and the respective setting is nowadays handled correctly. So
disable it entirely.

Signed-off-by: Hannes Reinecke 
Reviewed-by: Johannes Thumshirn 
Tested-by: Johannes Thumshirn 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings