linux-stable.git/drivers/scsi, branch v3.4.93

hpsa: gen8plus Smart Array IDs

2014-06-11T19:04:20+00:00

commit fe0c9610bb68dd0aad1017456f5e3c31264d70c2 upstream.

Signed-off-by: James Bottomley 
Signed-off-by: Ben Hutchings 
Cc: Rui Xiang 
Signed-off-by: Greg Kroah-Hartman

mpt2sas: Fix for issue Missing delay not getting set during system bootup

2014-06-11T19:04:20+00:00

commit 93cfcb8c998e3fe2c075fa61ab28f7b018e5049a upstream.

commit b0df96a0068daee4f9c2189c29b9053eb6e46b17 upstream.

Missing delay is not getting set properly. The reason is that it is not
defined in the same file from where it is being invoked.  The fix is to move
the missing delay module parameter from mpt2sas_base.c to mpt2sas_scsh.c.

Signed-off-by: Sreekanth Reddy 
Signed-off-by: James Bottomley 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
Cc: Rui Xiang 
Signed-off-by: Greg Kroah-Hartman

mpt2sas: Fix for device scan following host reset could get stuck in a infinite loop

2014-06-11T19:04:20+00:00

commit 6241f22ca12a26ee149cbe31b27bac97dbdc8bc4 upstream.

Modified device scan routine so each configuration page read breaks from the
while loop when the ioc_status is not equal to MPI2_IOCSTATUS_SUCCESS.

[jejb: checkpatch fixes]
Signed-off-by: Sreekanth Reddy 
Signed-off-by: James Bottomley 
[bwh: Backported to 3.2; adjust context]
Signed-off-by: Ben Hutchings 
Cc: Rui Xiang 
Signed-off-by: Greg Kroah-Hartman

isci: Fix a race condition in the SSP task management path

2014-06-11T19:04:20+00:00

commit 96f15f29038e58e1b0a96483e2b369ff446becf1 upstream.

This commit fixes a race condition in the isci driver abort task and SSP
device task management path.  The race is caused when an I/O termination
in the SCU hardware is necessary because of an SSP target timeout condition,
and the check of the I/O end state races against the HW-termination-driven
end state.  The failure of the race meant that no TMF was sent to the device
to clean-up the pending I/O.

Signed-off-by: Jeff Skirvin 
Reviewed-by: Lukasz Dorau 
Signed-off-by: James Bottomley 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
Cc: Rui Xiang 
Signed-off-by: Greg Kroah-Hartman

SCSI: megaraid: missing bounds check in mimd_to_kioc()

2014-05-18T12:25:54+00:00

commit 3de2260140417759c669d391613d583baf03b0cf upstream.

pthru32->dataxferlen comes from the user so we need to check that it's
not too large so we don't overflow the buffer.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Acked-by: Sumit Saxena 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

mpt2sas: Don't disable device twice at suspend.

2014-05-13T12:11:30+00:00

commit af61e27c3f77c7623b5335590ae24b6a5c323e22 upstream.

On suspend, _scsih_suspend calls mpt2sas_base_free_resources, which
in turn calls pci_disable_device if the device is enabled prior to
suspending. However, _scsih_suspend also calls pci_disable_device
itself.

Thus, in the event that the device is enabled prior to suspending,
pci_disable_device will be called twice. This patch removes the
duplicate call to pci_disable_device in _scsi_suspend as it is both
unnecessary and results in a kernel oops.

Signed-off-by: Tyler Stachecki 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

SCSI: arcmsr: upper 32 of dma address lost

2014-05-06T14:51:43+00:00

commit e2c70425f05219b142b3a8a9489a622c736db39d upstream.

The original code always set the upper 32 bits to zero because it was
doing a shift of the wrong variable.

Fixes: 1a4f550a09f8 ('[SCSI] arcmsr: 1.20.00.15: add SATA RAID plus other fixes')
Signed-off-by: Dan Carpenter 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

SCSI: storvsc: NULL pointer dereference fix

2014-03-24T04:37:08+00:00

commit b12bb60d6c350b348a4e1460cd68f97ccae9822e upstream.

If the initialization of storvsc fails, the storvsc_device_destroy()
causes NULL pointer dereference.

storvsc_bus_scan()
  scsi_scan_target()
    __scsi_scan_target()
      scsi_probe_and_add_lun(hostdata=NULL)
        scsi_alloc_sdev(hostdata=NULL)

	  sdev->hostdata = hostdata

	  now the host allocation fails

          __scsi_remove_device(sdev)

	  calls sdev->host->hostt->slave_destroy() ==
	  storvsc_device_destroy(sdev)
	    access of sdev->hostdata->request_mempool

Signed-off-by: Ales Novak 
Signed-off-by: Thomas Abraham 
Reviewed-by: Jiri Kosina 
Acked-by: K. Y. Srinivasan 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

SCSI: qla2xxx: Poll during initialization for ISP25xx and ISP83xx

2014-03-24T04:37:07+00:00

commit b77ed25c9f8402e8b3e49e220edb4ef09ecfbb53 upstream.

Signed-off-by: Giridhar Malavali 
Signed-off-by: Saurav Kashyap 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

SCSI: isci: correct erroneous for_each_isci_host macro

2014-03-24T04:37:07+00:00

commit c59053a23d586675c25d789a7494adfdc02fba57 upstream.

In the first place, the loop 'for' in the macro 'for_each_isci_host'
(drivers/scsi/isci/host.h:314) is incorrect, because it accesses
the 3rd element of 2 element array. After the 2nd iteration it executes
the instruction:
        ihost = to_pci_info(pdev)->hosts[2]
(while the size of the 'hosts' array equals 2) and reads an
out of range element.

In the second place, this loop is incorrectly optimized by GCC v4.8
(see http://marc.info/?l=linux-kernel&m=138998871911336&w=2).
As a result, on platforms with two SCU controllers,
the loop is executed more times than it can be (for i=0,1 and 2).
It causes kernel panic during entering the S3 state
and the following oops after 'rmmod isci':

BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [] __list_add+0x1b/0xc0
Oops: 0000 [#1] SMP
RIP: 0010:[]  [] __list_add+0x1b/0xc0
Call Trace:
  [] __mutex_lock_slowpath+0x114/0x1b0
  [] mutex_lock+0x1f/0x30
  [] sas_disable_events+0x1b/0x50 [libsas]
  [] sas_unregister_ha+0x18/0x60 [libsas]
  [] isci_unregister+0x1e/0x40 [isci]
  [] isci_pci_remove+0x5d/0x100 [isci]
  [] pci_device_remove+0x3b/0xb0
  [] __device_release_driver+0x7f/0xf0
  [] driver_detach+0xa8/0xb0
  [] bus_remove_driver+0x9b/0x120
  [] driver_unregister+0x2c/0x50
  [] pci_unregister_driver+0x23/0x80
  [] isci_exit+0x10/0x1e [isci]
  [] SyS_delete_module+0x16b/0x2d0
  [] ? do_notify_resume+0x61/0xa0
  [] system_call_fastpath+0x16/0x1b

The loop has been corrected.
This patch fixes kernel panic during entering the S3 state
and the above oops.

Signed-off-by: Lukasz Dorau 
Reviewed-by: Maciej Patelczyk 
Tested-by: Lukasz Dorau 
Signed-off-by: Dan Williams 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman