linux-stable.git/drivers/scsi, branch v3.10.63

bnx2fc: do not add shared skbs to the fcoe_rx_list

2014-12-06T23:05:49+00:00

commit 01a4cc4d0cd6a836c7b923760e8eb1cbb6a47258 upstream.

In some cases, the fcoe_rx_list may contains multiple instances
of the same skb (the so called "shared skbs").

the bnx2fc_l2_rcv thread is a loop that extracts a skb from the list,
modifies (and destroys) its content and then proceed to the next one.
The problem is that if the skb is shared, the remaining instances will
be corrupted.

The solution is to use skb_share_check() before adding the skb to the
fcoe_rx_list.

[ 6286.808725] ------------[ cut here ]------------
[ 6286.808729] WARNING: at include/scsi/fc_frame.h:173 bnx2fc_l2_rcv_thread+0x425/0x450 [bnx2fc]()
[ 6286.808748] Modules linked in: bnx2x(-) mdio dm_service_time bnx2fc cnic uio fcoe libfcoe 8021q garp stp mrp libfc llc scsi_transport_fc scsi_tgt sg iTCO_wdt iTCO_vendor_support coretemp kvm_intel kvm crct10dif_pclmul crc32_pclmul crc32c_intel e1000e ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper ptp cryptd hpilo serio_raw hpwdt lpc_ich pps_core ipmi_si pcspkr mfd_core ipmi_msghandler shpchp pcc_cpufreq mperf nfsd auth_rpcgss nfs_acl lockd sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sd_mod crc_t10dif crct10dif_common mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit ata_piix drm_kms_helper ttm drm libata i2c_core hpsa dm_mirror dm_region_hash dm_log dm_mod [last unloaded: mdio]
[ 6286.808750] CPU: 3 PID: 1304 Comm: bnx2fc_l2_threa Not tainted 3.10.0-121.el7.x86_64 #1
[ 6286.808750] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013
[ 6286.808752]  0000000000000000 000000000b36e715 ffff8800deba1e00 ffffffff815ec0ba
[ 6286.808753]  ffff8800deba1e38 ffffffff8105dee1 ffffffffa05618c0 ffff8801e4c81888
[ 6286.808754]  ffffe8ffff663868 ffff8801f402b180 ffff8801f56bc000 ffff8800deba1e48
[ 6286.808754] Call Trace:
[ 6286.808759]  [] dump_stack+0x19/0x1b
[ 6286.808762]  [] warn_slowpath_common+0x61/0x80
[ 6286.808763]  [] warn_slowpath_null+0x1a/0x20
[ 6286.808765]  [] bnx2fc_l2_rcv_thread+0x425/0x450 [bnx2fc]
[ 6286.808767]  [] ? bnx2fc_disable+0x90/0x90 [bnx2fc]
[ 6286.808769]  [] kthread+0xcf/0xe0
[ 6286.808770]  [] ? kthread_create_on_node+0x140/0x140
[ 6286.808772]  [] ret_from_fork+0x7c/0xb0
[ 6286.808773]  [] ? kthread_create_on_node+0x140/0x140
[ 6286.808774] ---[ end trace c6cdb939184ccb4e ]---

Signed-off-by: Maurizio Lombardi 
Acked-by: Chad Dupuis 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

SCSI: hpsa: fix a race in cmd_free/scsi_done

2014-11-21T17:22:55+00:00

commit 2cc5bfaf854463d9d1aa52091f60110fbf102a96 upstream.

When the driver calls scsi_done and after that frees it's internal
preallocated memory it can happen that a new job is enqueud before
the memory is freed. The allocation fails and the message
"cmd_alloc returned NULL" is shown.
Patch below fixes it by moving cmd->scsi_done after cmd_free.

Signed-off-by: Tomas Henzl 
Acked-by: Stephen M. Cameron 
Signed-off-by: James Bottomley 
Cc: Masoud Sharbiani 
Signed-off-by: Greg Kroah-Hartman

scsi: only re-lock door after EH on devices that were reset

2014-11-21T17:22:53+00:00

commit 48379270fe6808cf4612ee094adc8da2b7a83baa upstream.

Setups that use the blk-mq I/O path can lock up if a host with a single
device that has its door locked enters EH.  Make sure to only send the
command to re-lock the door to devices that actually were reset and thus
might have lost their state.  Otherwise the EH code might be get blocked
on blk_get_request as all requests for non-reset devices might be in use.

Signed-off-by: Christoph Hellwig 
Reported-by: Meelis Roos 
Tested-by: Meelis Roos 
Reviewed-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

qla_target: don't delete changed nacls

2014-11-14T16:47:57+00:00

commit f4c24db1b7ad0ce84409e15744d26c6f86a96840 upstream.

The code is currently riddled with "drop the hardware_lock to avoid a
deadlock" bugs that expose races.  One of those races seems to expose a
valid warning in tcm_qla2xxx_clear_nacl_from_fcport_map.  Add some
bandaid to it.

Signed-off-by: Joern Engel 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

qla2xxx: Use correct offset to req-q-out for reserve calculation

2014-10-30T16:35:10+00:00

commit 75554b68ac1e018bca00d68a430b92ada8ab52dd upstream.

Signed-off-by: Arun Easi 
Signed-off-by: Saurav Kashyap 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

be2iscsi: check ip buffer before copying

2014-10-30T16:35:10+00:00

commit a41a9ad3bbf61fae0b6bfb232153da60d14fdbd9 upstream.

Dan Carpenter found a issue where be2iscsi would copy the ip
from userspace to the driver buffer before checking the len
of the data being copied:
http://marc.info/?l=linux-scsi&m=140982651504251&w=2

This patch just has us only copy what we the driver buffer
can support.

Tested-by: John Soni Jose 
Signed-off-by: Mike Christie 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

SCSI: libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu

2014-10-05T21:54:12+00:00

commit db9bfd64b14a3a8f1868d2164518fdeab1b26ad1 upstream.

This patches fixes a potential buffer overrun in __iscsi_conn_send_pdu.
This function is used by iscsi drivers and userspace to send iscsi PDUs/
commands. For login commands, we have a set buffer size. For all other
commands we do not support data buffers.

This was reported by Dan Carpenter here:
http://www.spinics.net/lists/linux-scsi/msg66838.html

Reported-by: Dan Carpenter 
Signed-off-by: Mike Christie 
Reviewed-by: Sagi Grimberg 
Signed-off-by: Christoph Hellwig 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address

2014-09-17T16:03:59+00:00

commit 03a6c3ff3282ee9fa893089304d951e0be93a144 upstream.

bfa_swap_words() shifts its argument (assumed to be 64-bit) by 32 bits
each way.  In two places the argument type is dma_addr_t, which may be
32-bit, in which case the effect of the bit shift is undefined:

drivers/scsi/bfa/bfa_fcpim.c: In function 'bfa_ioim_send_ioreq':
drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: left shift count >= width of type [enabled by default]
    addr = bfa_sgaddr_le(sg_dma_address(sg));
    ^
drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: right shift count >= width of type [enabled by default]
drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: left shift count >= width of type [enabled by default]
    addr = bfa_sgaddr_le(sg_dma_address(sg));
    ^
drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: right shift count >= width of type [enabled by default]

Avoid this by adding casts to u64 in bfa_swap_words().

Compile-tested only.

Signed-off-by: Ben Hutchings 
Reviewed-by: Martin K. Petersen 
Acked-by: Anil Gurumurthy 
Fixes: f16a17507b09 ('[SCSI] bfa: remove all OS wrappers')
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

drivers: scsi: storvsc: Correctly handle TEST_UNIT_READY failure

2014-09-17T16:03:58+00:00

commit 3533f8603d28b77c62d75ec899449a99bc6b77a1 upstream.

On some Windows hosts on FC SANs, TEST_UNIT_READY can return SRB_STATUS_ERROR.
Correctly handle this. Note that there is sufficient sense information to
support scsi error handling even in this case.

Signed-off-by: K. Y. Srinivasan 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

Drivers: scsi: storvsc: Implement a eh_timed_out handler

2014-09-17T16:03:58+00:00

commit 56b26e69c8283121febedd12b3cc193384af46b9 upstream.

On Azure, we have seen instances of unbounded I/O latencies. To deal with
this issue, implement handler that can reset the timeout. Note that the
host gaurantees that it will respond to each command that has been issued.

Signed-off-by: K. Y. Srinivasan 
Reviewed-by: Hannes Reinecke 
[hch: added a better comment explaining the issue]
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman