linux-stable.git/drivers/scsi, branch v3.2.69

Defer processing of REQ_PREEMPT requests for blocked devices

2015-05-09T22:16:35+00:00

commit bba0bdd7ad4713d82338bcd9b72d57e9335a664b upstream.

SCSI transport drivers and SCSI LLDs block a SCSI device if the
transport layer is not operational. This means that in this state
no requests should be processed, even if the REQ_PREEMPT flag has
been set. This patch avoids that a rescan shortly after a cable
pull sporadically triggers the following kernel oops:

BUG: unable to handle kernel paging request at ffffc9001a6bc084
IP: [] mlx4_ib_post_send+0xd2/0xb30 [mlx4_ib]
Process rescan-scsi-bus (pid: 9241, threadinfo ffff88053484a000, task ffff880534aae100)
Call Trace:
 [] srp_post_send+0x65/0x70 [ib_srp]
 [] srp_queuecommand+0x1cf/0x3e0 [ib_srp]
 [] scsi_dispatch_cmd+0x101/0x280 [scsi_mod]
 [] scsi_request_fn+0x411/0x4d0 [scsi_mod]
 [] __blk_run_queue+0x27/0x30
 [] blk_execute_rq_nowait+0x82/0x110
 [] blk_execute_rq+0x62/0xf0
 [] scsi_execute+0xe8/0x190 [scsi_mod]
 [] scsi_execute_req+0xa3/0x130 [scsi_mod]
 [] scsi_probe_lun+0x17a/0x450 [scsi_mod]
 [] scsi_probe_and_add_lun+0x156/0x480 [scsi_mod]
 [] __scsi_scan_target+0xdf/0x1f0 [scsi_mod]
 [] scsi_scan_host_selected+0x183/0x1c0 [scsi_mod]
 [] scsi_scan+0xdb/0xe0 [scsi_mod]
 [] store_scan+0x13/0x20 [scsi_mod]
 [] sysfs_write_file+0xcb/0x160
 [] vfs_write+0xce/0x140
 [] sys_write+0x53/0xa0
 [] system_call_fastpath+0x16/0x1b
 [<00007f611c9d9300>] 0x7f611c9d92ff

Reported-by: Max Gurtuvoy 
Signed-off-by: Bart Van Assche 
Reviewed-by: Mike Christie 
Signed-off-by: James Bottomley 
Signed-off-by: Ben Hutchings

be2iscsi: Fix kernel panic when device initialization fails

2015-05-09T22:16:35+00:00

commit 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 upstream.

Kernel panic was happening as iscsi_host_remove() was called on
a host which was not yet added.

Signed-off-by: John Soni Jose 
Reviewed-by: Mike Christie 
Signed-off-by: James Bottomley 
Signed-off-by: Ben Hutchings

libsas: Fix Kernel Crash in smp_execute_task

2015-05-09T22:16:26+00:00

commit 6302ce4d80aa82b3fdb5c5cd68e7268037091b47 upstream.

This crash was reported:

[  366.947370] sd 3:0:1:0: [sdb] Spinning up disk....
[  368.804046] BUG: unable to handle kernel NULL pointer dereference at           (null)
[  368.804072] IP: [] __mutex_lock_common.isra.7+0x9c/0x15b
[  368.804098] PGD 0
[  368.804114] Oops: 0002 [#1] SMP
[  368.804143] CPU 1
[  368.804151] Modules linked in: sg netconsole s3g(PO) uinput joydev hid_multitouch usbhid hid snd_hda_codec_via cpufreq_userspace cpufreq_powersave cpufreq_stats uhci_hcd cpufreq_conservative snd_hda_intel snd_hda_codec snd_hwdep snd_pcm sdhci_pci snd_page_alloc sdhci snd_timer snd psmouse evdev serio_raw pcspkr soundcore xhci_hcd shpchp s3g_drm(O) mvsas mmc_core ahci libahci drm i2c_core acpi_cpufreq mperf video processor button thermal_sys dm_dmirror exfat_fs exfat_core dm_zcache dm_mod padlock_aes aes_generic padlock_sha iscsi_target_mod target_core_mod configfs sswipe libsas libata scsi_transport_sas picdev via_cputemp hwmon_vid fuse parport_pc ppdev lp parport autofs4 ext4 crc16 mbcache jbd2 sd_mod crc_t10dif usb_storage scsi_mod ehci_hcd usbcore usb_common
[  368.804749]
[  368.804764] Pid: 392, comm: kworker/u:3 Tainted: P        W  O 3.4.87-logicube-ng.22 #1 To be filled by O.E.M. To be filled by O.E.M./EPIA-M920
[  368.804802] RIP: 0010:[]  [] __mutex_lock_common.isra.7+0x9c/0x15b
[  368.804827] RSP: 0018:ffff880117001cc0  EFLAGS: 00010246
[  368.804842] RAX: 0000000000000000 RBX: ffff8801185030d0 RCX: ffff88008edcb420
[  368.804857] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff8801185030d4
[  368.804873] RBP: ffff8801181531c0 R08: 0000000000000020 R09: 00000000fffffffe
[  368.804885] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801185030d4
[  368.804899] R13: 0000000000000002 R14: ffff880117001fd8 R15: ffff8801185030d8
[  368.804916] FS:  0000000000000000(0000) GS:ffff88011fc80000(0000) knlGS:0000000000000000
[  368.804931] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  368.804946] CR2: 0000000000000000 CR3: 000000000160b000 CR4: 00000000000006e0
[  368.804962] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  368.804978] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  368.804995] Process kworker/u:3 (pid: 392, threadinfo ffff880117000000, task ffff8801181531c0)
[  368.805009] Stack:
[  368.805017]  ffff8801185030d8 0000000000000000 ffffffff8161ddf0 ffffffff81056f7c
[  368.805062]  000000000000b503 ffff8801185030d0 ffff880118503000 0000000000000000
[  368.805100]  ffff8801185030d0 ffff8801188b8000 ffff88008edcb420 ffffffff813583ac
[  368.805135] Call Trace:
[  368.805153]  [] ? up+0xb/0x33
[  368.805168]  [] ? mutex_lock+0x16/0x25
[  368.805194]  [] ? smp_execute_task+0x4e/0x222 [libsas]
[  368.805217]  [] ? sas_find_bcast_dev+0x3c/0x15d [libsas]
[  368.805240]  [] ? sas_find_bcast_dev+0x6f/0x15d [libsas]
[  368.805264]  [] ? sas_ex_revalidate_domain+0x37/0x2ec [libsas]
[  368.805280]  [] ? printk+0x43/0x48
[  368.805296]  [] ? _raw_spin_unlock_irqrestore+0xc/0xd
[  368.805318]  [] ? sas_revalidate_domain+0x85/0xb6 [libsas]
[  368.805336]  [] ? process_one_work+0x151/0x27c
[  368.805351]  [] ? worker_thread+0xbb/0x152
[  368.805366]  [] ? manage_workers.isra.29+0x163/0x163
[  368.805382]  [] ? kthread+0x79/0x81
[  368.805399]  [] ? kernel_thread_helper+0x4/0x10
[  368.805416]  [] ? kthread_flush_work_fn+0x9/0x9
[  368.805431]  [] ? gs_change+0x13/0x13
[  368.805442] Code: 83 7d 30 63 7e 04 f3 90 eb ab 4c 8d 63 04 4c 8d 7b 08 4c 89 e7 e8 fa 15 00 00 48 8b 43 10 4c 89 3c 24 48 89 63 10 48 89 44 24 08 <48> 89 20 83 c8 ff 48 89 6c 24 10 87 03 ff c8 74 35 4d 89 ee 41
[  368.805851] RIP  [] __mutex_lock_common.isra.7+0x9c/0x15b
[  368.805877]  RSP 
[  368.805886] CR2: 0000000000000000
[  368.805899] ---[ end trace b720682065d8f4cc ]---

It's directly caused by 89d3cf6 [SCSI] libsas: add mutex for SMP task
execution, but shows a deeper cause: expander functions expect to be able to
cast to and treat domain devices as expanders.  The correct fix is to only do
expander discover when we know we've got an expander device to avoid wrongly
casting a non-expander device.

Reported-by: Praveen Murali 
Tested-by: Praveen Murali 
Signed-off-by: James Bottomley 
[bwh: Backported to 3.2:
 - Adjust context
 - Use sas_dev_type enumerators rather than sas_device_type enumerators]
Signed-off-by: Ben Hutchings

sg: fix read() error reporting

2015-05-09T22:16:18+00:00

commit 3b524a683af8991b4eab4182b947c65f0ce1421b upstream.

Fix SCSI generic read() incorrectly returning success after detecting an
error.

Signed-off-by: Tony Battersby 
Acked-by: Douglas Gilbert 
Signed-off-by: James Bottomley 
Signed-off-by: Ben Hutchings

fixed invalid assignment of 64bit mask to host dma_boundary for scatter gather segment boundary limit.

2015-05-09T22:16:17+00:00

commit f76a610a8b4b6280eaedf48f3af9d5d74e418b66 upstream.

In reference to bug https://bugzilla.redhat.com/show_bug.cgi?id=1097141
Assert is seen with AMD cpu whenever calling pci_alloc_consistent.

[   29.406183] ------------[ cut here ]------------
[   29.410505] kernel BUG at lib/iommu-helper.c:13!

Signed-off-by: Minh Tran 
Fixes: 6733b39a1301b0b020bbcbf3295852e93e624cb1
Signed-off-by: James Bottomley 
Signed-off-by: Ben Hutchings

scsi: correct return values for .eh_abort_handler implementations

2015-02-20T00:49:24+00:00

commit b6c92b7e0af575e2b8b05bdf33633cf9e1661cbf upstream.

The .eh_abort_handler needs to return SUCCESS, FAILED, or
FAST_IO_FAIL. So fixup all callers to adhere to this requirement.

Reviewed-by: Robert Elliott 
Signed-off-by: Hannes Reinecke 
Signed-off-by: Christoph Hellwig 
[bwh: Backported to 3.2: drop changes to esas2r]
Signed-off-by: Ben Hutchings

hpsa: fix a race in cmd_free/scsi_done

2014-12-14T16:24:01+00:00

commit 2cc5bfaf854463d9d1aa52091f60110fbf102a96 upstream.

When the driver calls scsi_done and after that frees it's internal
preallocated memory it can happen that a new job is enqueud before
the memory is freed. The allocation fails and the message
"cmd_alloc returned NULL" is shown.
Patch below fixes it by moving cmd->scsi_done after cmd_free.

Signed-off-by: Tomas Henzl 
Acked-by: Stephen M. Cameron 
Signed-off-by: James Bottomley 
Signed-off-by: Ben Hutchings 
Cc: Masoud Sharbiani

bnx2fc: do not add shared skbs to the fcoe_rx_list

2014-12-14T16:23:58+00:00

commit 01a4cc4d0cd6a836c7b923760e8eb1cbb6a47258 upstream.

In some cases, the fcoe_rx_list may contains multiple instances
of the same skb (the so called "shared skbs").

the bnx2fc_l2_rcv thread is a loop that extracts a skb from the list,
modifies (and destroys) its content and then proceed to the next one.
The problem is that if the skb is shared, the remaining instances will
be corrupted.

The solution is to use skb_share_check() before adding the skb to the
fcoe_rx_list.

[ 6286.808725] ------------[ cut here ]------------
[ 6286.808729] WARNING: at include/scsi/fc_frame.h:173 bnx2fc_l2_rcv_thread+0x425/0x450 [bnx2fc]()
[ 6286.808748] Modules linked in: bnx2x(-) mdio dm_service_time bnx2fc cnic uio fcoe libfcoe 8021q garp stp mrp libfc llc scsi_transport_fc scsi_tgt sg iTCO_wdt iTCO_vendor_support coretemp kvm_intel kvm crct10dif_pclmul crc32_pclmul crc32c_intel e1000e ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper ptp cryptd hpilo serio_raw hpwdt lpc_ich pps_core ipmi_si pcspkr mfd_core ipmi_msghandler shpchp pcc_cpufreq mperf nfsd auth_rpcgss nfs_acl lockd sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sd_mod crc_t10dif crct10dif_common mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit ata_piix drm_kms_helper ttm drm libata i2c_core hpsa dm_mirror dm_region_hash dm_log dm_mod [last unloaded: mdio]
[ 6286.808750] CPU: 3 PID: 1304 Comm: bnx2fc_l2_threa Not tainted 3.10.0-121.el7.x86_64 #1
[ 6286.808750] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013
[ 6286.808752]  0000000000000000 000000000b36e715 ffff8800deba1e00 ffffffff815ec0ba
[ 6286.808753]  ffff8800deba1e38 ffffffff8105dee1 ffffffffa05618c0 ffff8801e4c81888
[ 6286.808754]  ffffe8ffff663868 ffff8801f402b180 ffff8801f56bc000 ffff8800deba1e48
[ 6286.808754] Call Trace:
[ 6286.808759]  [] dump_stack+0x19/0x1b
[ 6286.808762]  [] warn_slowpath_common+0x61/0x80
[ 6286.808763]  [] warn_slowpath_null+0x1a/0x20
[ 6286.808765]  [] bnx2fc_l2_rcv_thread+0x425/0x450 [bnx2fc]
[ 6286.808767]  [] ? bnx2fc_disable+0x90/0x90 [bnx2fc]
[ 6286.808769]  [] kthread+0xcf/0xe0
[ 6286.808770]  [] ? kthread_create_on_node+0x140/0x140
[ 6286.808772]  [] ret_from_fork+0x7c/0xb0
[ 6286.808773]  [] ? kthread_create_on_node+0x140/0x140
[ 6286.808774] ---[ end trace c6cdb939184ccb4e ]---

Signed-off-by: Maurizio Lombardi 
Acked-by: Chad Dupuis 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Ben Hutchings

scsi: only re-lock door after EH on devices that were reset

2014-12-14T16:23:56+00:00

commit 48379270fe6808cf4612ee094adc8da2b7a83baa upstream.

Setups that use the blk-mq I/O path can lock up if a host with a single
device that has its door locked enters EH.  Make sure to only send the
command to re-lock the door to devices that actually were reset and thus
might have lost their state.  Otherwise the EH code might be get blocked
on blk_get_request as all requests for non-reset devices might be in use.

Signed-off-by: Christoph Hellwig 
Reported-by: Meelis Roos 
Tested-by: Meelis Roos 
Reviewed-by: Martin K. Petersen 
Signed-off-by: Ben Hutchings

libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu

2014-11-05T20:27:44+00:00

commit db9bfd64b14a3a8f1868d2164518fdeab1b26ad1 upstream.

This patches fixes a potential buffer overrun in __iscsi_conn_send_pdu.
This function is used by iscsi drivers and userspace to send iscsi PDUs/
commands. For login commands, we have a set buffer size. For all other
commands we do not support data buffers.

This was reported by Dan Carpenter here:
http://www.spinics.net/lists/linux-scsi/msg66838.html

Reported-by: Dan Carpenter 
Signed-off-by: Mike Christie 
Reviewed-by: Sagi Grimberg 
Signed-off-by: Christoph Hellwig 
Signed-off-by: James Bottomley 
Signed-off-by: Ben Hutchings