linux-stable.git/drivers/scsi, branch v3.4.1 Linux kernel stable tree isci: fix oem parameter validation on single controller skus 2012-06-01T07:18:15+00:00 Dan Williams dan.j.williams@intel.com 2012-04-30T18:57:44+00:00 694450c8fa0dd37c49910c8d278cd68fab219006 commit fc25f79af321c01a739150ba2c09435cf977a63d upstream. OEM parameters [1] are parsed from the platform option-rom / efi driver. By default the driver was validating the parameters for the dual-controller case, but in single-controller case only the first set of parameters may be valid. Limit the validation to the number of actual controllers detected otherwise the driver may fail to parse the valid parameters leading to driver-load or runtime failures. [1] the platform specific set of phy address, configuration,and analog tuning values Reported-by: Dave Jiang <dave.jiang@intel.com> Tested-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit fc25f79af321c01a739150ba2c09435cf977a63d upstream.

OEM parameters [1] are parsed from the platform option-rom / efi
driver.  By default the driver was validating the parameters for the
dual-controller case, but in single-controller case only the first set
of parameters may be valid.

Limit the validation to the number of actual controllers detected
otherwise the driver may fail to parse the valid parameters leading to
driver-load or runtime failures.

[1] the platform specific set of phy address, configuration,and analog
    tuning values

Reported-by: Dave Jiang <dave.jiang@intel.com>
Tested-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
SCSI: mpt2sas: Fix for panic happening because of improper memory allocation 2012-06-01T07:18:15+00:00 nagalakshmi.nandigama@lsi.com nagalakshmi.nandigama@lsi.com 2012-03-20T06:40:01+00:00 3102e700882480237273c4e45a65f23fce0dd345 commit e42fafc25fa86c61824e8d4c5e7582316415d24f upstream. The ioc->pfacts member in the IOC structure is getting set to zero following a call to _base_get_ioc_facts due to the memset in that routine. So if the ioc->pfacts was read after a host reset, there would be a NULL pointer dereference. The routine _base_get_ioc_facts is called from context of host reset. The problem in _base_get_ioc_facts is the size of Mpi2IOCFactsReply is 64, whereas the sizeof "struct mpt2sas_facts" is 60, so there is a four byte overflow resulting from the memset. Also, there is memset in _base_get_port_facts using the incorrect structure, it should be "struct mpt2sas_port_facts" instead of Mpi2PortFactsReply. Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit e42fafc25fa86c61824e8d4c5e7582316415d24f upstream.

The ioc->pfacts member in the IOC structure is getting set to zero
following a call to _base_get_ioc_facts due to the memset in that routine.
So if the ioc->pfacts was read after a host reset, there would be a NULL
pointer dereference. The routine _base_get_ioc_facts is called from context
of host reset.  The problem in _base_get_ioc_facts  is the size of
Mpi2IOCFactsReply is 64, whereas the sizeof "struct mpt2sas_facts" is 60,
so there is a four byte overflow resulting from the memset.

Also, there is memset in _base_get_port_facts using the incorrect structure,
it should be "struct mpt2sas_port_facts" instead of Mpi2PortFactsReply.

Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[SCSI] virtio_scsi: fix TMF use-after-free 2012-05-10T07:27:06+00:00 Paolo Bonzini pbonzini@redhat.com 2012-05-04T10:32:04+00:00 e4594bb50518eb89c447be97dabd5bd99f405d71 Fix a use-after-free in the TMF path, where cmd may have been already freed by virtscsi_complete_free when wait_for_completion restarts executing virtscsi_tmf. Technically a race, but in practice the command will always be freed long before the completion waiter is awoken. The fix is to make callers specifying a completion responsible for freeing the command in all cases. Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 
Fix a use-after-free in the TMF path, where cmd may have been already
freed by virtscsi_complete_free when wait_for_completion restarts
executing virtscsi_tmf.  Technically a race, but in practice the command
will always be freed long before the completion waiter is awoken.

The fix is to make callers specifying a completion responsible for
freeing the command in all cases.

Signed-off-by: Hu Tao <hutao@cn.fujitsu.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
[SCSI] fix oops in all legacy host adapters caused by 6f381fa 2012-05-10T07:24:13+00:00 James Bottomley jbottomley@parallels.com 2012-05-04T09:40:04+00:00 3c8d9a957d0ae62c2815393a781ab7ff4d5205e7 Commit 6f381fa344911d5a234b13574433cf23036f9467 Author: Lin Ming <ming.m.lin@intel.com> [SCSI] scsi_lib: use correct DMA device in __scsi_alloc_queue Caused a regression where we oops in every legacy mode SCSI host driver because they supply a NULL pointer to scsi_add_host(). Fix this by checking for the NULL in scsi_add_host_with_dma() and changing the DMA device to being the platform_bus in that case (which replicates the original behaviour). Reported-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 
Commit 6f381fa344911d5a234b13574433cf23036f9467
Author: Lin Ming <ming.m.lin@intel.com>

[SCSI] scsi_lib: use correct DMA device in __scsi_alloc_queue
 
Caused a regression where we oops in every legacy mode SCSI host driver
because they supply a NULL pointer to scsi_add_host().  Fix this by checking
for the NULL in scsi_add_host_with_dma() and changing the DMA device to being
the platform_bus in that case (which replicates the original behaviour).

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
[SCSI] qla2xxx: Update version number to 8.04.00.03-k. 2012-05-10T07:19:10+00:00 Chad Dupuis chad.dupuis@qlogic.com 2012-04-25T14:26:17+00:00 6abd7f132a4b74d9cdd3ef79fc71ca73909631f2 Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
[SCSI] qla2xxx: Properly check for current state after the fabric-login request. 2012-05-10T07:18:04+00:00 Saurav Kashyap saurav.kashyap@qlogic.com 2012-04-25T14:26:16+00:00 aaf4d3e2c647b5d1b24082b766c173e6c7edf79b [jejb: checkpatch fixes] Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 
[jejb: checkpatch fixes]
Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
[SCSI] qla2xxx: Proper completion to scsi-ml for scsi status task_set_full and busy. 2012-05-10T07:15:19+00:00 Giridhar Malavali giridhar.malavali@qlogic.com 2012-04-25T14:26:15+00:00 4aee57667e9b237d0bd0c5a167c8b6103a27756a In case of firmmware detected under-run condition and scsi status of task_set_full or busy_condition, return that to the mid layer for proper error handling instead of DID_ERROR (which causes error handler activation and a full retry). Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 
In case of firmmware detected under-run condition and scsi status of
task_set_full or busy_condition, return that to the mid layer for proper error
handling instead of DID_ERROR (which causes error handler activation and a
full retry).

Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
[SCSI] qla2xxx: Block flash access from application when device is initialized for ISP82xx. 2012-05-10T07:10:58+00:00 Giridhar Malavali giridhar.malavali@qlogic.com 2012-04-25T14:26:14+00:00 a49393f2ae13e3a0c61dbdbea77c2ff7614df474 Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
[SCSI] qla2xxx: Fix reset time out as qla2xxx not ack to reset request. 2012-05-10T07:07:49+00:00 Vikas Chaudhary vikas.chaudhary@qlogic.com 2012-04-25T14:26:13+00:00 f4e1648a4f4acc964cefc51c1637aad0dca6c517 Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 
Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
[SCSI] libfc: update mfs boundry checking 2012-04-25T07:46:29+00:00 Vasu Dev vasu.dev@intel.com 2012-04-06T22:52:51+00:00 93f90e5186053611fe93d889e99ee2852f4da250 A previous commit changed the mfs checking to ensure the new mfs is less or equal to the mfs supported by the FCF. This doesn't work for BRDCM cards as they set an mfs of 2048 regardless of whether the switch returns a larger mfs. This patch validates the new mfs against the upper and lower spec defined boundries for a FCoE mfs. Signed-off-by: Vasu Dev <vasu.dev@intel.com> Signed-off-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com> Signed-off-by: Robert Love <robert.w.love@intel.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> 
A previous commit changed the mfs checking to ensure the new
mfs is less or equal to the mfs supported by the FCF. This
doesn't work for BRDCM cards as they set an mfs of 2048 regardless
of whether the switch returns a larger mfs.

This patch validates the new mfs against the upper and lower spec
defined boundries for a FCoE mfs.

Signed-off-by: Vasu Dev <vasu.dev@intel.com>
Signed-off-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com>
Signed-off-by: Robert Love <robert.w.love@intel.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>