linux-stable.git/drivers/scsi, branch v3.16.7

qla2xxx: Fix shost use-after-free on device removal

2014-10-30T16:40:12+00:00

commit db7157d4cfce6edf052452fb1d327d4d11b67f4c upstream.

Once calling scsi_host_put, be careful to not access qla_hw_data through
the Scsi_Host private data (ie, scsi_qla_host base_vha).

Fixes: fe1b806f4f71 ("qla2xxx: Refactor shutdown code so some functionality can be reused")
Signed-off-by: Joe Lawrence 
Acked-by: Chad Dupuis 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

qla2xxx: Use correct offset to req-q-out for reserve calculation

2014-10-30T16:40:12+00:00

commit 75554b68ac1e018bca00d68a430b92ada8ab52dd upstream.

Signed-off-by: Arun Easi 
Signed-off-by: Saurav Kashyap 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

qla2xxx: fix kernel NULL pointer access

2014-10-30T16:40:12+00:00

commit 78c2106a50e067f7168ee8c0944baaeb0e988272 upstream.

This patch is to fix regression added by commit id
51a07f84649d2be206c4c2ad9a612956db0c2f8c.

When allocating memory for new session original patch does
not assign vha to op->vha resulting into NULL pointer
access during qlt_create_sess_from_atio().

Signed-off-by: Himanshu Madhani 
Signed-off-by: Saurav Kashyap 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

be2iscsi: check ip buffer before copying

2014-10-30T16:40:11+00:00

commit a41a9ad3bbf61fae0b6bfb232153da60d14fdbd9 upstream.

Dan Carpenter found a issue where be2iscsi would copy the ip
from userspace to the driver buffer before checking the len
of the data being copied:
http://marc.info/?l=linux-scsi&m=140982651504251&w=2

This patch just has us only copy what we the driver buffer
can support.

Tested-by: John Soni Jose 
Signed-off-by: Mike Christie 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

SCSI: libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu

2014-10-05T20:41:05+00:00

commit db9bfd64b14a3a8f1868d2164518fdeab1b26ad1 upstream.

This patches fixes a potential buffer overrun in __iscsi_conn_send_pdu.
This function is used by iscsi drivers and userspace to send iscsi PDUs/
commands. For login commands, we have a set buffer size. For all other
commands we do not support data buffers.

This was reported by Dan Carpenter here:
http://www.spinics.net/lists/linux-scsi/msg66838.html

Reported-by: Dan Carpenter 
Signed-off-by: Mike Christie 
Reviewed-by: Sagi Grimberg 
Signed-off-by: Christoph Hellwig 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address

2014-09-17T16:22:08+00:00

commit 03a6c3ff3282ee9fa893089304d951e0be93a144 upstream.

bfa_swap_words() shifts its argument (assumed to be 64-bit) by 32 bits
each way.  In two places the argument type is dma_addr_t, which may be
32-bit, in which case the effect of the bit shift is undefined:

drivers/scsi/bfa/bfa_fcpim.c: In function 'bfa_ioim_send_ioreq':
drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: left shift count >= width of type [enabled by default]
    addr = bfa_sgaddr_le(sg_dma_address(sg));
    ^
drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: right shift count >= width of type [enabled by default]
drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: left shift count >= width of type [enabled by default]
    addr = bfa_sgaddr_le(sg_dma_address(sg));
    ^
drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: right shift count >= width of type [enabled by default]

Avoid this by adding casts to u64 in bfa_swap_words().

Compile-tested only.

Signed-off-by: Ben Hutchings 
Reviewed-by: Martin K. Petersen 
Acked-by: Anil Gurumurthy 
Fixes: f16a17507b09 ('[SCSI] bfa: remove all OS wrappers')
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

SCSI: save command pool address of Scsi_Host

2014-09-17T16:22:00+00:00

commit f6105c0808880c2c432b79bc81b37cc244c300c8 upstream.

If a scsi host driver specifies .cmd_len in it's scsi_host_template, a driver's
private command pool is needed. scsi_find_host_cmd_pool() will locate it, but
scsi_alloc_host_cmd_pool() isn't saving the pool address in the host template.

This will result in an access error when the host is removed.

Avoid the problem by saving the address of a new allocated command pool where
it is expected.

Signed-off-by: Juergen Gross 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Christoph Hellwig 
Fixes: 89d9a567952baec13e26ada3e438f1b642d66b6e
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

scsi_transport_srp: Fix fast_io_fail_tmo=dev_loss_tmo=off behavior

2014-09-17T16:22:00+00:00

commit cd53eb686d2418eda938aad3c9da42b7dfa9351f upstream.

If scsi_remove_host() is called while an rport is in the blocked state
then scsi_remove_host() will only finish if the rport is unblocked
from inside a timer function. Make sure that an rport only enters the
blocked state if a timer will be started that will unblock it. This
avoids that unloading the ib_srp kernel module after having
disconnected the initiator from the target system results in a
deadlock if both the fast_io_fail_tmo and dev_loss_tmo parameters have
been set to "off".

Signed-off-by: Bart Van Assche 
Reviewed-by: Sagi Grimberg 
Reviewed-by: David Dillow 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

scsi: do not issue SCSI RSOC command to Promise Vtrak E610f

2014-09-17T16:22:00+00:00

commit 0213436a2cc5e4a5ca2fabfaa4d3877097f3b13f upstream.

Some devices don't like REPORT SUPPORTED OPERATION CODES and will
simply timeout causing sd_mod init to take a very very long time.
Introduce BLIST_NO_RSOC scsi scan flag, that stops RSOC from being
issued. Add it to Promise Vtrak E610f entry in scsi scan
blacklist. Fixes bug #79901 reported at
https://bugzilla.kernel.org/show_bug.cgi?id=79901

Fixes: 98dcc2946adb ("SCSI: sd: Update WRITE SAME heuristics")

Signed-off-by: Janusz Dziemidowicz 
Reviewed-by: Martin K. Petersen 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

scsi: add a blacklist flag which enables VPD page inquiries

2014-09-17T16:22:00+00:00

commit c1d40a527e885a40bb9ea6c46a1b1145d42b66a0 upstream.

Despite supporting modern SCSI features some storage devices continue to
claim conformance to an older version of the SPC spec. This is done for
compatibility with legacy operating systems.

Linux by default will not attempt to read VPD pages on devices that
claim SPC-2 or older. Introduce a blacklist flag that can be used to
trigger VPD page inquiries on devices that are known to support them.

Reported-by: KY Srinivasan 
Tested-by: KY Srinivasan 
Reviewed-by: KY Srinivasan 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman