linux-stable.git/drivers/scsi, branch v3.13.6 Linux kernel stable tree qla2xxx: Fix kernel panic on selective retransmission request 2014-03-07T06:06:29+00:00 Dr. Greg Wettstein greg@enjellic.com 2014-02-24T19:59:53+00:00 b7dd2bb40cc2e8eb357d772a55c36b762794dfe2 commit 6f58c780e5a5b43a6d2121e0d43cdcba1d3cc5fc upstream. A selective retransmission request (SRR) is a fibre-channel protocol control request which provides support for requesting retransmission of a data sequence in response to an issue such as frame loss or corruption. These events are experienced infrequently in fibre-channel based networks which makes it difficult to test and assess codepaths which handle these events. We were fortunate enough, for some definition of fortunate, to have a metro-area single-mode SAN link which, at 10 GBPS sustained load levels, would consistently generate SRR's in a SCST based target implementation using our SCST/in-kernel Qlogic target interface driver. In response to an SRR the in-kernel Qlogic target driver immediately panics resulting in a catastrophic storage failure for serviced initiators. The culprit was a debug statement in the qla_target.c file which does not verify that a pointer to the SCSI CDB is not null. The unchecked pointer dereference results in the kernel panic and resultant system failure. The other two references to the SCSI CDB by the SRR handling code use a ternary operator to verify a non-null pointer is being acted on. This patch simply adds a similar test to the implicated debug statement. This patch is a candidate for any stable kernel being maintained since it addresses a potentially catastrophic event with minimal downside. Signed-off-by: Dr. Greg Wettstein <greg@enjellic.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 6f58c780e5a5b43a6d2121e0d43cdcba1d3cc5fc upstream.

A selective retransmission request (SRR) is a fibre-channel
protocol control request which provides support for requesting
retransmission of a data sequence in response to an issue such as
frame loss or corruption.  These events are experienced
infrequently in fibre-channel based networks which makes
it difficult to test and assess codepaths which handle these
events.

We were fortunate enough, for some definition of fortunate, to
have a metro-area single-mode SAN link which, at 10 GBPS
sustained load levels, would consistently generate SRR's in
a SCST based target implementation using our SCST/in-kernel
Qlogic target interface driver.  In response to an SRR the
in-kernel Qlogic target driver immediately panics resulting
in a catastrophic storage failure for serviced initiators.

The culprit was a debug statement in the qla_target.c file which
does not verify that a pointer to the SCSI CDB is not null.
The unchecked pointer dereference results in the kernel panic
and resultant system failure.

The other two references to the SCSI CDB by the SRR handling code
use a ternary operator to verify a non-null pointer is being
acted on.  This patch simply adds a similar test to the implicated
debug statement.

This patch is a candidate for any stable kernel being maintained
since it addresses a potentially catastrophic event with
minimal downside.

Signed-off-by: Dr. Greg Wettstein <greg@enjellic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
virtio-scsi: Fix hotcpu_notifier use-after-free with virtscsi_freeze 2014-02-06T19:34:10+00:00 Asias He asias.hejun@gmail.com 2014-01-15T23:48:48+00:00 f91c20513353a088257f2b1264d497b3dcfe81de commit f466f75385369a181409e46da272db3de6f5c5cb upstream. vqs are freed in virtscsi_freeze but the hotcpu_notifier is not unregistered. We will have a use-after-free usage when the notifier callback is called after virtscsi_freeze. Fixes: 285e71ea6f3583a85e27cb2b9a7d8c35d4c0d558 ("virtio-scsi: reset virtqueue affinity when doing cpu hotplug") Signed-off-by: Asias He <asias.hejun@gmail.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit f466f75385369a181409e46da272db3de6f5c5cb upstream.

vqs are freed in virtscsi_freeze but the hotcpu_notifier is not
unregistered. We will have a use-after-free usage when the notifier
callback is called after virtscsi_freeze.

Fixes: 285e71ea6f3583a85e27cb2b9a7d8c35d4c0d558
("virtio-scsi: reset virtqueue affinity when doing cpu hotplug")

Signed-off-by: Asias He <asias.hejun@gmail.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
SCSI: qla4xxx: overflow in qla4xxx_set_chap_entry() 2014-02-06T19:34:10+00:00 Dan Carpenter dan.carpenter@oracle.com 2013-11-13T07:48:11+00:00 8507df5828d2335c6a07c87804e18df0ff2a4af1 commit 3c60cfd73966797746530768d66597d025a69804 upstream. We should cap the size of memcpy() because it comes from the network and can't be trusted. Fixes: 26ffd7b45fe9 ('[SCSI] qla4xxx: Add support to set CHAP entries') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 3c60cfd73966797746530768d66597d025a69804 upstream.

We should cap the size of memcpy() because it comes from the network
and can't be trusted.

Fixes: 26ffd7b45fe9 ('[SCSI] qla4xxx: Add support to set CHAP entries')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
SCSI: bfa: Chinook quad port 16G FC HBA claim issue 2014-02-06T19:34:10+00:00 Vijaya Mohan Guvva vmohan@brocade.com 2013-12-04T13:43:58+00:00 e88f3608e8230b5d82353701656e0f60166114b6 commit dcaf9aed995c2b2a49fb86bbbcfa2f92c797ab5d upstream. Bfa driver crash is observed while pushing the firmware on to chinook quad port card due to uninitialized bfi_image_ct2 access which gets initialized only for CT2 ASIC based cards after request_firmware(). For quard port chinook (CT2 ASIC based), bfi_image_ct2 is not getting initialized as there is no check for chinook PCI device ID before request_firmware and instead bfi_image_cb is initialized as it is the default case for card type check. This patch includes changes to read the right firmware for quad port chinook. Signed-off-by: Vijaya Mohan Guvva <vmohan@brocade.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit dcaf9aed995c2b2a49fb86bbbcfa2f92c797ab5d upstream.

Bfa driver crash is observed while pushing the firmware on to chinook
quad port card due to uninitialized bfi_image_ct2 access which gets
initialized only for CT2 ASIC based cards after request_firmware().
For quard port chinook (CT2 ASIC based), bfi_image_ct2 is not getting
initialized as there is no check for chinook PCI device ID before
request_firmware and instead bfi_image_cb is initialized as it is the
default case for card type check.

This patch includes changes to read the right firmware for quad port chinook.

Signed-off-by: Vijaya Mohan Guvva <vmohan@brocade.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
qla2xxx: Fix scsi_host leak on qlt_lport_register callback failure 2013-12-19T22:50:17+00:00 Nicholas Bellinger nab@linux-iscsi.org 2013-12-17T09:51:22+00:00 dcd211997ddba3229e875f5990ea14f920934729 This patch fixes a possible scsi_host reference leak in qlt_lport_register(), when a non zero return from the passed (*callback) does not call drop the local reference via scsi_host_put() before returning. This currently does not effect existing tcm_qla2xxx code as the passed callback will never fail, but fix this up regardless for future code. Cc: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> 
This patch fixes a possible scsi_host reference leak in qlt_lport_register(),
when a non zero return from the passed (*callback) does not call drop the
local reference via scsi_host_put() before returning.

This currently does not effect existing tcm_qla2xxx code as the passed callback
will never fail, but fix this up regardless for future code.

Cc: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
qla2xxx: Fix schedule_delayed_work() for target timeout calculations 2013-12-12T00:06:20+00:00 Shivaram Upadhyayula shivaram.u@quadstor.com 2013-12-10T10:36:40+00:00 63832aabec12a28a41a221773ab3819d30ba0a67 This patch fixes two cases in qla_target.c code where the schedule_delayed_work() value was being incorrectly calculated from sess->expires - jiffies. Signed-off-by: Shivaram U <shivaram.u@quadstor.com> Cc: <stable@vger.kernel.org> #3.6+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> 
This patch fixes two cases in qla_target.c code where the
schedule_delayed_work() value was being incorrectly calculated
from sess->expires - jiffies.

Signed-off-by: Shivaram U <shivaram.u@quadstor.com>
Cc: <stable@vger.kernel.org> #3.6+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi 2013-12-06T16:30:18+00:00 Linus Torvalds torvalds@linux-foundation.org 2013-12-06T16:30:18+00:00 7adfff587bc4d9ed8f85a31b12464513fda886a2 Pull SCSI fixes from James Bottomley: "This is a set of nine fixes (and one author update). The libsas one should fix discovery in eSATA devices, the WRITE_SAME one is the largest, but it should fix a lot of problems we've been getting with the emulated RAID devices (they've been effectively lying about support and then firmware has been choking on the commands). The rest are various crash, hang or warn driver fixes" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: [SCSI] bfa: Fix crash when symb name set for offline vport [SCSI] enclosure: fix WARN_ON in dual path device removing [SCSI] pm80xx: Tasklets synchronization fix. [SCSI] pm80xx: Resetting the phy state. [SCSI] pm80xx: Fix for direct attached device. [SCSI] pm80xx: Module author addition [SCSI] hpsa: return 0 from driver probe function on success, not 1 [SCSI] hpsa: do not discard scsi status on aborted commands [SCSI] Disable WRITE SAME for RAID and virtual host adapter drivers [SCSI] libsas: fix usage of ata_tf_to_fis 
Pull SCSI fixes from James Bottomley:
 "This is a set of nine fixes (and one author update).

  The libsas one should fix discovery in eSATA devices, the WRITE_SAME
  one is the largest, but it should fix a lot of problems we've been
  getting with the emulated RAID devices (they've been effectively lying
  about support and then firmware has been choking on the commands).

  The rest are various crash, hang or warn driver fixes"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  [SCSI] bfa: Fix crash when symb name set for offline vport
  [SCSI] enclosure: fix WARN_ON in dual path device removing
  [SCSI] pm80xx: Tasklets synchronization fix.
  [SCSI] pm80xx: Resetting the phy state.
  [SCSI] pm80xx: Fix for direct attached device.
  [SCSI] pm80xx: Module author addition
  [SCSI] hpsa: return 0 from driver probe function on success, not 1
  [SCSI] hpsa: do not discard scsi status on aborted commands
  [SCSI] Disable WRITE SAME for RAID and virtual host adapter drivers
  [SCSI] libsas: fix usage of ata_tf_to_fis
[SCSI] bfa: Fix crash when symb name set for offline vport 2013-12-03T14:56:49+00:00 Vijaya Mohan Guvva vmohan@brocade.com 2013-11-21T09:37:49+00:00 22a08538dca5c0630226f1c0c58dccd12e463d22 This patch fixes a crash when tried setting symbolic name for an offline vport through sysfs. Crash is due to uninitialized pointer lport->ns, which gets initialized only on linkup (port online). Signed-off-by: Vijaya Mohan Guvva <vmohan@brocade.com> Cc: stable@vger.kernel.org Signed-off-by: James Bottomley <JBottomley@Parallels.com> 
This patch fixes a crash when tried setting symbolic name for an offline
vport through sysfs. Crash is due to uninitialized pointer lport->ns,
which gets initialized only on linkup (port online).

Signed-off-by: Vijaya Mohan Guvva <vmohan@brocade.com>
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
[SCSI] pm80xx: Tasklets synchronization fix. 2013-12-02T18:47:38+00:00 Nikith Ganigarakoppal Nikith.Ganigarakoppal@pmcs.com 2013-11-11T09:58:14+00:00 6cd60b37f72b2d15b8983431546af50b7064935d When multiple vectors are used, the vector variable is over written, resulting in unhandled operation for those vectors. This fix prevents the problem by maitaining HBA instance and vector values for each irq. [jejb: checkpatch fixes] Signed-off-by: Nikith.Ganigarakoppal@pmcs.com Signed-off-by: Anandkumar.Santhanam@pmcs.com Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 
When multiple vectors are used, the vector variable is over written,
resulting in unhandled operation for those vectors.
This fix prevents the problem by maitaining HBA instance and
vector values for each irq.

[jejb: checkpatch fixes]
Signed-off-by: Nikith.Ganigarakoppal@pmcs.com
Signed-off-by: Anandkumar.Santhanam@pmcs.com
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
[SCSI] pm80xx: Resetting the phy state. 2013-12-02T18:35:52+00:00 Nikith Ganigarakoppal Nikith.Ganigarakoppal@pmcs.com 2013-10-30T10:53:47+00:00 7d029005484a6125a91a075518b9cfde830bc709 Setting the phy state for hard reset response. After sending hard reset for a device ,phy down event sets the phy state to zero but for phy up event it will not set the phy state again.This will cause problem to successive hard resets. Signed-off-by: Nikith.Ganigarakoppal@pmcs.com Signed-off-by: Anandkumar.Santhanam@pmcs.com Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 
Setting the phy state for hard reset response.
After sending hard reset for a device ,phy down event sets
the phy state to zero but for phy up event it will not set
the phy state again.This will cause problem to successive
hard resets.

Signed-off-by: Nikith.Ganigarakoppal@pmcs.com
Signed-off-by: Anandkumar.Santhanam@pmcs.com
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>