linux-stable.git/drivers/scsi, branch v4.1.45

scsi: qla2xxx: Fix an integer overflow in sysfs code

2017-10-04T11:43:02+00:00

[ Upstream commit e6f77540c067b48dee10f1e33678415bfcc89017 ]

The value of "size" comes from the user.  When we add "start + size" it
could lead to an integer overflow bug.

It means we vmalloc() a lot more memory than we had intended.  I believe
that on 64 bit systems vmalloc() can succeed even if we ask it to
allocate huge 4GB buffers.  So we would get memory corruption and likely
a crash when we call ha->isp_ops->write_optrom() and ->read_optrom().

Only root can trigger this bug.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=194061

Cc: 
Fixes: b7cc176c9eb3 ("[SCSI] qla2xxx: Allow region-based flash-part accesses.")
Reported-by: shqking 
Signed-off-by: Dan Carpenter 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE

2017-10-04T11:43:02+00:00

[ Upstream commit 3e0097499839e0fe3af380410eababe5a47c4cf9 ]

When calling SG_GET_REQUEST_TABLE ioctl only a half-filled table is
returned; the remaining part will then contain stale kernel memory
information.  This patch zeroes out the entire table to avoid this
issue.

Signed-off-by: Hannes Reinecke 
Reviewed-by: Bart Van Assche 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Eric Dumazet 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: sg: factor out sg_fill_request_table()

2017-10-04T11:43:01+00:00

[ Upstream commit 4759df905a474d245752c9dc94288e779b8734dd ]

Factor out sg_fill_request_table() for better readability.

[mkp: typos, applied by hand]

Signed-off-by: Hannes Reinecke 
Reviewed-by: Bart Van Assche 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: sg: off by one in sg_ioctl()

2017-10-04T11:43:01+00:00

[ Upstream commit bd46fc406b30d1db1aff8dabaff8d18bb423fdcf ]

If "val" is SG_MAX_QUEUE then we are one element beyond the end of the
"rinfo" array so the > should be >=.

Fixes: 109bade9c625 ("scsi: sg: use standard lists for sg_requests")
Signed-off-by: Dan Carpenter 
Acked-by: Douglas Gilbert 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: sg: use standard lists for sg_requests

2017-10-04T11:43:01+00:00

[ Upstream commit 109bade9c625c89bb5ea753aaa1a0a97e6fbb548 ]

'Sg_request' is using a private list implementation; convert it to
standard lists.

Signed-off-by: Hannes Reinecke 
Reviewed-by: Johannes Thumshirn 
Tested-by: Johannes Thumshirn 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: sg: remove 'save_scat_len'

2017-10-04T11:43:01+00:00

[ Upstream commit 136e57bf43dc4babbfb8783abbf707d483cacbe3 ]

Unused.

Signed-off-by: Hannes Reinecke 
Reviewed-by: Johannes Thumshirn 
Tested-by: Johannes Thumshirn 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: storvsc: fix memory leak on ring buffer busy

2017-10-04T11:43:00+00:00

[ Upstream commit 0208eeaa650c5c866a3242201678a19e6dc4a14e ]

When storvsc is sending I/O to Hyper-v, it may allocate a bigger buffer
descriptor for large data payload that can't fit into a pre-allocated
buffer descriptor. This bigger buffer is freed on return path.

If I/O request to Hyper-v fails due to ring buffer busy, the storvsc
allocated buffer descriptor should also be freed.

[mkp: applied by hand]

Fixes: be0cf6ca301c ("scsi: storvsc: Set the tablesize based on the information given by the host")
Cc: 
Signed-off-by: Long Li 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: megaraid_sas: Return pended IOCTLs with cmd_status MFI_STAT_WRONG_STATE in case adapter is dead

2017-10-04T11:43:00+00:00

[ Upstream commit eb3fe263a48b0d27b229c213929c4cb3b1b39a0f ]

After a kill adapter, since the cmd_status is not set, the IOCTLs will
be hung in driver resulting in application hang.  Set cmd_status
MFI_STAT_WRONG_STATE when completing pended IOCTLs.

Signed-off-by: Kashyap Desai 
Signed-off-by: Shivasharan S 
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke 
Reviewed-by: Tomas Henzl 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: sg: recheck MMAP_IO request length with lock held

2017-10-04T01:36:46+00:00

[ Upstream commit 8d26f491116feaa0b16de370b6a7ba40a40fa0b4 ]

Commit 1bc0eb044615 ("scsi: sg: protect accesses to 'reserved' page
array") adds needed concurrency protection for the "reserve" buffer.
Some checks that are initially made outside the lock are replicated once
the lock is taken to ensure the checks and resulting decisions are made
using consistent state.

The check that a request with flag SG_FLAG_MMAP_IO set fits in the
reserve buffer also needs to be performed again under the lock to ensure
the reserve buffer length compared against matches the value in effect
when the request is linked to the reserve buffer.  An -ENOMEM should be
returned in this case, instead of switching over to an indirect buffer
as for non-MMAP_IO requests.

Signed-off-by: Todd Poynor 
Acked-by: Douglas Gilbert 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE

2017-10-04T01:36:46+00:00

[ Upstream commit 6a8dadcca81fceff9976e8828cceb072873b7bd5 ]

Take f_mutex around mmap() processing to protect against races with the
SG_SET_RESERVED_SIZE ioctl.  Ensure the reserve buffer length remains
consistent during the mapping operation, and set the "mmap called" flag
to prevent further changes to the reserved buffer size as an atomic
operation with the mapping.

[mkp: fixed whitespace]

Signed-off-by: Todd Poynor 
Acked-by: Douglas Gilbert 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin