linux-stable.git/drivers/scsi, branch v3.18.67

scsi: qla2xxx: Get mutex lock before checking optrom_state

2017-08-11T16:30:16+00:00

[ Upstream commit c7702b8c22712a06080e10f1d2dee1a133ec8809 ]

There is a race condition with qla2xxx optrom functions where one thread
might modify optrom buffer, optrom_state while other thread is still
reading from it.

In couple of crashes, it was found that we had successfully passed the
following 'if' check where we confirm optrom_state to be
QLA_SREADING. But by the time we acquired mutex lock to proceed with
memory_read_from_buffer function, some other thread/process had already
modified that option rom buffer and optrom_state from QLA_SREADING to
QLA_SWAITING. Then we got ha->optrom_buffer 0x0 and crashed the system:

        if (ha->optrom_state != QLA_SREADING)
                return 0;

        mutex_lock(&ha->optrom_mutex);
        rval = memory_read_from_buffer(buf, count, &off, ha->optrom_buffer,
            ha->optrom_region_size);
        mutex_unlock(&ha->optrom_mutex);

With current optrom function we get following crash due to a race
condition:

[ 1479.466679] BUG: unable to handle kernel NULL pointer dereference at           (null)
[ 1479.466707] IP: [] memcpy+0x6/0x110
[...]
[ 1479.473673] Call Trace:
[ 1479.474296]  [] ? memory_read_from_buffer+0x3c/0x60
[ 1479.474941]  [] qla2x00_sysfs_read_optrom+0x9c/0xc0 [qla2xxx]
[ 1479.475571]  [] read+0xdb/0x1f0
[ 1479.476206]  [] vfs_read+0x9e/0x170
[ 1479.476839]  [] SyS_read+0x7f/0xe0
[ 1479.477466]  [] system_call_fastpath+0x16/0x1b

Below patch modifies qla2x00_sysfs_read_optrom,
qla2x00_sysfs_write_optrom functions to get the mutex_lock before
checking ha->optrom_state to avoid similar crashes.

The patch was applied and tested and same crashes were no longer
observed again.

Tested-by: Milan P. Gandhi 
Signed-off-by: Milan P. Gandhi 
Reviewed-by: Laurence Oberman 
Acked-by: Himanshu Madhani 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

mpt3sas: Don't overreach ioc->reply_post[] during initialization

2017-08-11T16:30:10+00:00

commit 5ec8a1753bc29efa7e4b1391d691c9c719b30257 upstream.

In _base_make_ioc_operational(), we walk ioc->reply_queue_list and pull
a pointer out of successive elements of ioc->reply_post[] for each entry
in that list if RDPQ is enabled.

Since the code pulls the pointer for the next iteration at the bottom of
the loop, it triggers the a KASAN dump on the final iteration:

    BUG: KASAN: slab-out-of-bounds in _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas] at addr ffff880754816ab0
    Read of size 8 by task modprobe/305
    
    Call Trace:
     [] dump_stack+0x4d/0x6c
     [] print_trailer+0xf9/0x150
     [] object_err+0x34/0x40
     [] kasan_report_error+0x221/0x530
     [] __asan_report_load8_noabort+0x43/0x50
     [] _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas]
     [] mpt3sas_base_attach+0x1991/0x2120 [mpt3sas]
     [] _scsih_probe+0xeb3/0x16b0 [mpt3sas]
     [] local_pci_probe+0xc7/0x170
     [] pci_device_probe+0x20f/0x290
     [] really_probe+0x17d/0x600
     [] __driver_attach+0x153/0x190
     [] bus_for_each_dev+0x11c/0x1a0
     [] driver_attach+0x3d/0x50
     [] bus_add_driver+0x44a/0x5f0
     [] driver_register+0x18c/0x3b0
     [] __pci_register_driver+0x156/0x200
     [] _mpt3sas_init+0x135/0x1000 [mpt3sas]
     [] do_one_initcall+0x113/0x2b0
     [] do_init_module+0x1d0/0x4d8
     [] load_module+0x6729/0x8dc0
     [] SYSC_init_module+0x183/0x1a0
     [] SyS_init_module+0xe/0x10
     [] entry_SYSCALL_64_fastpath+0x12/0x6a

Fix this by pulling the value at the beginning of the loop.

Signed-off-by: Calvin Owens 
Reviewed-by: Johannes Thumshirn 
Reviewed-by: Jens Axboe 
Acked-by: Chaitra Basappa 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

scsi: qla2xxx: don't disable a not previously enabled PCI device

2017-06-14T10:54:19+00:00

commit ddff7ed45edce4a4c92949d3c61cd25d229c4a14 upstream.

When pci_enable_device() or pci_enable_device_mem() fail in
qla2x00_probe_one() we bail out but do a call to
pci_disable_device(). This causes the dev_WARN_ON() in
pci_disable_device() to trigger, as the device wasn't enabled
previously.

So instead of taking the 'probe_out' error path we can directly return
*iff* one of the pci_enable_device() calls fails.

Additionally rename the 'probe_out' goto label's name to the more
descriptive 'disable_device'.

Signed-off-by: Johannes Thumshirn 
Fixes: e315cd28b9ef ("[SCSI] qla2xxx: Code changes for qla data structure refactoring")
Reviewed-by: Bart Van Assche 
Reviewed-by: Giridhar Malavali 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

sg: Fix double-free when drives detach during SG_IO

2017-05-20T12:18:44+00:00

commit f3951a3709ff50990bf3e188c27d346792103432 upstream.

In sg_common_write(), we free the block request and return -ENODEV if
the device is detached in the middle of the SG_IO ioctl().

Unfortunately, sg_finish_rem_req() also tries to free srp->rq, so we
end up freeing rq->cmd in the already free rq object, and then free
the object itself out from under the current user.

This ends up corrupting random memory via the list_head on the rq
object. The most common crash trace I saw is this:

  ------------[ cut here ]------------
  kernel BUG at block/blk-core.c:1420!
  Call Trace:
  [] blk_put_request+0x5b/0x80
  [] sg_finish_rem_req+0x6b/0x120 [sg]
  [] sg_common_write.isra.14+0x459/0x5a0 [sg]
  [] ? selinux_file_alloc_security+0x48/0x70
  [] sg_new_write.isra.17+0x195/0x2d0 [sg]
  [] sg_ioctl+0x644/0xdb0 [sg]
  [] do_vfs_ioctl+0x90/0x520
  [] ? file_has_perm+0x97/0xb0
  [] SyS_ioctl+0x91/0xb0
  [] tracesys+0xdd/0xe2
    RIP [] __blk_put_request+0x154/0x1a0

The solution is straightforward: just set srp->rq to NULL in the
failure branch so that sg_finish_rem_req() doesn't attempt to re-free
it.

Additionally, since sg_rq_end_io() will never be called on the object
when this happens, we need to free memory backing ->cmd if it isn't
embedded in the object itself.

KASAN was extremely helpful in finding the root cause of this bug.

Signed-off-by: Calvin Owens 
Acked-by: Douglas Gilbert 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

scsi: advansys: remove #warning message

2017-05-08T05:44:12+00:00

The advansys driver was converted to the proper DMA API in linux-4.2, but
the 3.18-stable kernel still warns about this:

drivers/scsi/advansys.c:71:2: warning: #warning this driver is still not properly converted to the DMA API [-Wcpp]

The warning clearly is not helpful in 3.18 any more, it just clutters up
the build log. This removes the warning instead, and clarifies the
comment above it.

Cc: Hannes Reinecke 
Signed-off-by: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman

ips: remove pointless #warning

2017-05-08T05:44:11+00:00

commit e03c2da6574223081b786960e39c1e5ecf5d492d upstream.

non-x86 builds want the #warning in the IPS code about compiling on the wrong
architecture removed because it keeps triggering on their platforms build
farms.  Transform from a compile time warning into a runtime one with taint to
preserve the original intent of the authors.

Acked-by: Arnd Bergmann 
Signed-off-by: James Bottomley 
Signed-off-by: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman

aic94xx: Skip reading user settings if flash is not found

2017-04-30T03:49:17+00:00

commit 36dd5acd196574d41de3e81d8264df475bbb7123 upstream.

If no user settings are found it's pointless trying to
read them from flash. So skip that step.
This also fixes a compilation warning about uninitialized variables in
aic94xx.

Signed-off-by: Hannes Reinecke 
Reviewed-by: Christoph Hellwig 
Signed-off-by: James Bottomley 
Cc: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman

scsi: libsas: fix ata xfer length

2017-04-22T05:15:01+00:00

commit 9702c67c6066f583b629cf037d2056245bb7a8e6 upstream.

The total ata xfer length may not be calculated properly, in that we do
not use the proper method to get an sg element dma length.

According to the code comment, sg_dma_len() should be used after
dma_map_sg() is called.

This issue was found by turning on the SMMUv3 in front of the hisi_sas
controller in hip07. Multiple sg elements were being combined into a
single element, but the original first element length was being use as
the total xfer length.

Fixes: ff2aeb1eb64c8a4770a6 ("libata: convert to chained sg")
Signed-off-by: John Garry 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: sg: check length passed to SG_NEXT_CMD_LEN

2017-04-22T05:15:01+00:00

commit bf33f87dd04c371ea33feb821b60d63d754e3124 upstream.

The user can control the size of the next command passed along, but the
value passed to the ioctl isn't checked against the usable max command
size.

Signed-off-by: Peter Chang 
Acked-by: Douglas Gilbert 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: libiscsi: add lock around task lists to fix list corruption regression

2017-04-22T05:15:01+00:00

commit 6f8830f5bbab16e54f261de187f3df4644a5b977 upstream.

There's a rather long standing regression from the commit "libiscsi:
Reduce locking contention in fast path"

Depending on iSCSI target behavior, it's possible to hit the case in
iscsi_complete_task where the task is still on a pending list
(!list_empty(&task->running)).  When that happens the task is removed
from the list while holding the session back_lock, but other task list
modification occur under the frwd_lock.  That leads to linked list
corruption and eventually a panicked system.

Rather than back out the session lock split entirely, in order to try
and keep some of the performance gains this patch adds another lock to
maintain the task lists integrity.

Major enterprise supported kernels have been backing out the lock split
for while now, thanks to the efforts at IBM where a lab setup has the
most reliable reproducer I've seen on this issue.  This patch has been
tested there successfully.

Signed-off-by: Chris Leech 
Fixes: 659743b02c41 ("[SCSI] libiscsi: Reduce locking contention in fast path")
Reported-by: Prashantha Subbarao 
Reviewed-by: Guilherme G. Piccoli 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman