linux-stable.git/drivers/scsi, branch v3.10.58

SCSI: libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu

2014-10-05T21:54:12+00:00

commit db9bfd64b14a3a8f1868d2164518fdeab1b26ad1 upstream.

This patches fixes a potential buffer overrun in __iscsi_conn_send_pdu.
This function is used by iscsi drivers and userspace to send iscsi PDUs/
commands. For login commands, we have a set buffer size. For all other
commands we do not support data buffers.

This was reported by Dan Carpenter here:
http://www.spinics.net/lists/linux-scsi/msg66838.html

Reported-by: Dan Carpenter 
Signed-off-by: Mike Christie 
Reviewed-by: Sagi Grimberg 
Signed-off-by: Christoph Hellwig 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address

2014-09-17T16:03:59+00:00

commit 03a6c3ff3282ee9fa893089304d951e0be93a144 upstream.

bfa_swap_words() shifts its argument (assumed to be 64-bit) by 32 bits
each way.  In two places the argument type is dma_addr_t, which may be
32-bit, in which case the effect of the bit shift is undefined:

drivers/scsi/bfa/bfa_fcpim.c: In function 'bfa_ioim_send_ioreq':
drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: left shift count >= width of type [enabled by default]
    addr = bfa_sgaddr_le(sg_dma_address(sg));
    ^
drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: right shift count >= width of type [enabled by default]
drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: left shift count >= width of type [enabled by default]
    addr = bfa_sgaddr_le(sg_dma_address(sg));
    ^
drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: right shift count >= width of type [enabled by default]

Avoid this by adding casts to u64 in bfa_swap_words().

Compile-tested only.

Signed-off-by: Ben Hutchings 
Reviewed-by: Martin K. Petersen 
Acked-by: Anil Gurumurthy 
Fixes: f16a17507b09 ('[SCSI] bfa: remove all OS wrappers')
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

drivers: scsi: storvsc: Correctly handle TEST_UNIT_READY failure

2014-09-17T16:03:58+00:00

commit 3533f8603d28b77c62d75ec899449a99bc6b77a1 upstream.

On some Windows hosts on FC SANs, TEST_UNIT_READY can return SRB_STATUS_ERROR.
Correctly handle this. Note that there is sufficient sense information to
support scsi error handling even in this case.

Signed-off-by: K. Y. Srinivasan 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

Drivers: scsi: storvsc: Implement a eh_timed_out handler

2014-09-17T16:03:58+00:00

commit 56b26e69c8283121febedd12b3cc193384af46b9 upstream.

On Azure, we have seen instances of unbounded I/O latencies. To deal with
this issue, implement handler that can reset the timeout. Note that the
host gaurantees that it will respond to each command that has been issued.

Signed-off-by: K. Y. Srinivasan 
Reviewed-by: Hannes Reinecke 
[hch: added a better comment explaining the issue]
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

hpsa: fix bad -ENOMEM return value in hpsa_big_passthru_ioctl

2014-09-05T23:28:36+00:00

commit 0758f4f732b08b6ef07f2e5f735655cf69fea477 upstream.

When copy_from_user fails, return -EFAULT, not -ENOMEM

Signed-off-by: Stephen M. Cameron 
Reported-by: Robert Elliott 
Reviewed-by: Joe Handzik 
Reviewed-by: Scott Teel 
Reviewed by: Mike MIller 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

scsi: handle flush errors properly

2014-08-07T21:30:25+00:00

commit 89fb4cd1f717a871ef79fa7debbe840e3225cd54 upstream.

Flush commands don't transfer data and thus need to be special cased
in the I/O completion handler so that we can propagate errors to
the block layer and filesystem.

Signed-off-by: James Bottomley 
Reported-by: Steven Haber 
Tested-by: Steven Haber 
Reviewed-by: Martin K. Petersen 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

sym53c8xx_2: Set DID_REQUEUE return code when aborting squeue

2014-07-09T18:14:03+00:00

commit fd1232b214af43a973443aec6a2808f16ee5bf70 upstream.

This patch fixes I/O errors with the sym53c8xx_2 driver when the disk
returns QUEUE FULL status.

When the controller encounters an error (including QUEUE FULL or BUSY
status), it aborts all not yet submitted requests in the function
sym_dequeue_from_squeue.

This function aborts them with DID_SOFT_ERROR.

If the disk has full tag queue, the request that caused the overflow is
aborted with QUEUE FULL status (and the scsi midlayer properly retries
it until it is accepted by the disk), but the sym53c8xx_2 driver aborts
the following requests with DID_SOFT_ERROR --- for them, the midlayer
does just a few retries and then signals the error up to sd.

The result is that disk returning QUEUE FULL causes request failures.

The error was reproduced on 53c895 with COMPAQ BD03685A24 disk
(rebranded ST336607LC) with command queue 48 or 64 tags.  The disk has
64 tags, but under some access patterns it return QUEUE FULL when there
are less than 64 pending tags.  The SCSI specification allows returning
QUEUE FULL anytime and it is up to the host to retry.

Signed-off-by: Mikulas Patocka 
Cc: Matthew Wilcox 
Cc: James Bottomley 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

virtio-scsi: fix various bad behavior on aborted requests

2014-07-09T18:13:59+00:00

commit 8faeb529b2dabb9df691d614dda18910a43d05c9 upstream.

Even though the virtio-scsi spec guarantees that all requests related
to the TMF will have been completed by the time the TMF itself completes,
the request queue's callback might not have run yet.  This causes requests
to be completed more than once, and as a result triggers a variety of
BUGs or oopses.

Signed-off-by: Paolo Bonzini 
Reviewed-by: Venkatesh Srinivas 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

virtio-scsi: avoid cancelling uninitialized work items

2014-07-09T18:13:59+00:00

commit cdda0e5acbb78f7b777049f8c27899e5c5bb368f upstream.

Calling the workqueue interface on uninitialized work items isn't a
good idea even if they're zeroed. It's not failing catastrophically only
through happy accidents.

Signed-off-by: Paolo Bonzini 
Reviewed-by: Stefan Hajnoczi 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

ibmvscsi: Add memory barriers for send / receive

2014-07-09T18:13:59+00:00

commit 7114aae02742d6b5c5a0d39a41deb61d415d3717 upstream.

Add a memory barrier prior to sending a new command to the VIOS
to ensure the VIOS does not receive stale data in the command buffer.
Also add a memory barrier when processing the CRQ for completed commands.

Signed-off-by: Brian King 
Acked-by: Nathan Fontenot 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman