linux-stable.git/drivers/scsi, branch v4.8.6

mpt3sas: Don't spam logs if logging level is 0

2016-10-31T11:02:14+00:00

commit 0d667f72b2a20bbac72bec0ab11467fc70bb0f1f upstream.

In _scsih_io_done() we test if the ioc->logging_level does _not_ have
the MPT_DEBUG_REPLY bit set and if it hasn't we print the debug
messages. This unfortunately is the wrong way around.

Note, the actual bug is older than af0094115 but this commit removed the
CONFIG_SCSI_MPT3SAS_LOGGING Kconfig option which hid the bug.

Fixes: af0094115 'mpt2sas, mpt3sas: Remove SCSI_MPTXSAS_LOGGING entry from Kconfig'
Signed-off-by: Johannes Thumshirn 
Acked-by: Chaitra P B 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: cxlflash: Remove the device cleanly in the system shutdown path

2016-10-31T11:02:08+00:00

commit babf985d1e1b0677cb264acd01319d2b9c8f4327 upstream.

Commit 704c4b0ddc03 ("cxlflash: Shutdown notify support for CXL Flash
cards") was recently introduced to notify the AFU when a system is going
down. Due to the position of the cxlflash driver in the device stack,
cxlflash devices are _always_ removed during a reboot/shutdown. This can
lead to a crash if the cxlflash shutdown hook is invoked _after_ the
shutdown hook for the owning virtual PHB. Furthermore, the current
implementation of shutdown/remove hooks for cxlflash are not tolerant to
being invoked when the device is not enabled. This can also lead to a
crash in situations where the remove hook is invoked after the device
has been removed via the vPHBs shutdown hook. An example of this
scenario would be an EEH reset failure while a reboot/shutdown is in
progress.

To solve both problems, the shutdown hook for cxlflash is updated to
simply remove the device. This path already includes the AFU
notification and thus this solution will continue to perform the
original intent. At the same time, the remove hook is updated to protect
against being called when the device is not enabled.

Fixes: 704c4b0ddc03 ("cxlflash: Shutdown notify support for CXL Flash
cards")
Signed-off-by: Uma Krishnan 
Acked-by: Matthew R. Ochs 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: Fix use-after-free

2016-10-28T07:45:26+00:00

commit bcd8f2e94808fcddf6ef3af5f060a36820dcc432 upstream.

This patch fixes one use-after-free report[1] by KASAN.

In __scsi_scan_target(), when a type 31 device is probed,
SCSI_SCAN_TARGET_PRESENT is returned and the target will be scanned
again.

Inside the following scsi_report_lun_scan(), one new scsi_device
instance is allocated, and scsi_probe_and_add_lun() is called again to
probe the target and still see type 31 device, finally
__scsi_remove_device() is called to remove & free the device at the end
of scsi_probe_and_add_lun(), so cause use-after-free in
scsi_report_lun_scan().

And the following SCSI log can be observed:

	scsi 0:0:2:0: scsi scan: INQUIRY pass 1 length 36
	scsi 0:0:2:0: scsi scan: INQUIRY successful with code 0x0
	scsi 0:0:2:0: scsi scan: peripheral device type of 31, no device added
	scsi 0:0:2:0: scsi scan: Sending REPORT LUNS to (try 0)
	scsi 0:0:2:0: scsi scan: REPORT LUNS successful (try 0) result 0x0
	scsi 0:0:2:0: scsi scan: REPORT LUN scan
	scsi 0:0:2:0: scsi scan: INQUIRY pass 1 length 36
	scsi 0:0:2:0: scsi scan: INQUIRY successful with code 0x0
	scsi 0:0:2:0: scsi scan: peripheral device type of 31, no device added
	BUG: KASAN: use-after-free in __scsi_scan_target+0xbf8/0xe40 at addr ffff88007b44a104

This patch fixes the issue by moving the putting reference at
the end of scsi_report_lun_scan().

[1] KASAN report
==================================================================
[    3.274597] PM: Adding info for serio:serio1
[    3.275127] BUG: KASAN: use-after-free in __scsi_scan_target+0xd87/0xdf0 at addr ffff880254d8c304
[    3.275653] Read of size 4 by task kworker/u10:0/27
[    3.275903] CPU: 3 PID: 27 Comm: kworker/u10:0 Not tainted 4.8.0 #2121
[    3.276258] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[    3.276797] Workqueue: events_unbound async_run_entry_fn
[    3.277083]  ffff880254d8c380 ffff880259a37870 ffffffff94bbc6c1 ffff880078402d80
[    3.277532]  ffff880254d8bb80 ffff880259a37898 ffffffff9459fec1 ffff880259a37930
[    3.277989]  ffff880254d8bb80 ffff880078402d80 ffff880259a37920 ffffffff945a0165
[    3.278436] Call Trace:
[    3.278528]  [] dump_stack+0x65/0x84
[    3.278797]  [] kasan_object_err+0x21/0x70
[    3.279063] device: 'psaux': device_add
[    3.279616]  [] kasan_report_error+0x205/0x500
[    3.279651] PM: Adding info for No Bus:psaux
[    3.280202]  [] ? kfree_const+0x22/0x30
[    3.280486]  [] ? kobject_release+0x119/0x370
[    3.280805]  [] __asan_report_load4_noabort+0x43/0x50
[    3.281170]  [] ? __scsi_scan_target+0xd87/0xdf0
[    3.281506]  [] __scsi_scan_target+0xd87/0xdf0
[    3.281848]  [] ? scsi_add_device+0x30/0x30
[    3.282156]  [] ? pm_runtime_autosuspend_expiration+0x60/0x60
[    3.282570]  [] ? _raw_spin_lock+0x17/0x40
[    3.282880]  [] scsi_scan_channel+0x105/0x160
[    3.283200]  [] scsi_scan_host_selected+0x212/0x2f0
[    3.283563]  [] do_scsi_scan_host+0x1bc/0x250
[    3.283882]  [] do_scan_async+0x41/0x450
[    3.284173]  [] async_run_entry_fn+0xfe/0x610
[    3.284492]  [] ? pwq_dec_nr_in_flight+0x124/0x2a0
[    3.284876]  [] ? preempt_count_add+0x130/0x160
[    3.285207]  [] process_one_work+0x544/0x12d0
[    3.285526]  [] worker_thread+0xd9/0x12f0
[    3.285844]  [] ? process_one_work+0x12d0/0x12d0
[    3.286182]  [] kthread+0x1c5/0x260
[    3.286443]  [] ? __switch_to+0x88d/0x1430
[    3.286745]  [] ? kthread_worker_fn+0x5a0/0x5a0
[    3.287085]  [] ret_from_fork+0x1f/0x40
[    3.287368]  [] ? kthread_worker_fn+0x5a0/0x5a0
[    3.287697] Object at ffff880254d8bb80, in cache kmalloc-2048 size: 2048
[    3.288064] Allocated:
[    3.288147] PID = 27
[    3.288218]  [] save_stack_trace+0x2b/0x50
[    3.288531]  [] save_stack+0x46/0xd0
[    3.288806]  [] kasan_kmalloc+0xad/0xe0
[    3.289098]  [] __kmalloc+0x13e/0x250
[    3.289378]  [] scsi_alloc_sdev+0xea/0xcf0
[    3.289701]  [] __scsi_scan_target+0xa06/0xdf0
[    3.290034]  [] scsi_scan_channel+0x105/0x160
[    3.290362]  [] scsi_scan_host_selected+0x212/0x2f0
[    3.290724]  [] do_scsi_scan_host+0x1bc/0x250
[    3.291055]  [] do_scan_async+0x41/0x450
[    3.291354]  [] async_run_entry_fn+0xfe/0x610
[    3.291695]  [] process_one_work+0x544/0x12d0
[    3.292022]  [] worker_thread+0xd9/0x12f0
[    3.292325]  [] kthread+0x1c5/0x260
[    3.292594]  [] ret_from_fork+0x1f/0x40
[    3.292886] Freed:
[    3.292945] PID = 27
[    3.293016]  [] save_stack_trace+0x2b/0x50
[    3.293327]  [] save_stack+0x46/0xd0
[    3.293600]  [] kasan_slab_free+0x71/0xb0
[    3.293916]  [] kfree+0xa2/0x1f0
[    3.294168]  [] scsi_device_dev_release_usercontext+0x50a/0x730
[    3.294598]  [] execute_in_process_context+0xda/0x130
[    3.294974]  [] scsi_device_dev_release+0x1c/0x20
[    3.295322]  [] device_release+0x76/0x1e0
[    3.295626]  [] kobject_release+0x107/0x370
[    3.295942]  [] kobject_put+0x4e/0xa0
[    3.296222]  [] put_device+0x17/0x20
[    3.296497]  [] scsi_device_put+0x7c/0xa0
[    3.296801]  [] __scsi_scan_target+0xd4c/0xdf0
[    3.297132]  [] scsi_scan_channel+0x105/0x160
[    3.297458]  [] scsi_scan_host_selected+0x212/0x2f0
[    3.297829]  [] do_scsi_scan_host+0x1bc/0x250
[    3.298156]  [] do_scan_async+0x41/0x450
[    3.298453]  [] async_run_entry_fn+0xfe/0x610
[    3.298777]  [] process_one_work+0x544/0x12d0
[    3.299105]  [] worker_thread+0xd9/0x12f0
[    3.299408]  [] kthread+0x1c5/0x260
[    3.299676]  [] ret_from_fork+0x1f/0x40
[    3.299967] Memory state around the buggy address:
[    3.300209]  ffff880254d8c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    3.300608]  ffff880254d8c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    3.300986] >ffff880254d8c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    3.301408]                    ^
[    3.301550]  ffff880254d8c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[    3.301987]  ffff880254d8c400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    3.302396]
==================================================================

Cc: Christoph Hellwig 
Signed-off-by: Ming Lei 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: ibmvfc: Fix I/O hang when port is not mapped

2016-10-22T10:40:24+00:00

commit 07d0e9a847401ffd2f09bd450d41644cd090e81d upstream.

If a VFC port gets unmapped in the VIOS, it may not respond with a CRQ
init complete following H_REG_CRQ. If this occurs, we can end up having
called scsi_block_requests and not a resulting unblock until the init
complete happens, which may never occur, and we end up hanging I/O
requests.  This patch ensures the host action stay set to
IBMVFC_HOST_ACTION_TGT_DEL so we move all rports into devloss state and
unblock unless we receive an init complete.

Signed-off-by: Brian King 
Acked-by: Tyrel Datwyler 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: arcmsr: Simplify user_len checking

2016-10-22T10:40:24+00:00

commit 4bd173c30792791a6daca8c64793ec0a4ae8324f upstream.

Do the user_len check first and then the ver_addr allocation so that we
can save us the kfree() on the error path when user_len is >
ARCMSR_API_DATA_BUFLEN.

Signed-off-by: Borislav Petkov 
Cc: Marco Grassi 
Cc: Dan Carpenter 
Cc: Tomas Henzl 
Cc: Martin K. Petersen 
Reviewed-by: Johannes Thumshirn 
Reviewed-by: Tomas Henzl 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()

2016-10-22T10:40:24+00:00

commit 7bc2b55a5c030685b399bb65b6baa9ccc3d1f167 upstream.

We need to put an upper bound on "user_len" so the memcpy() doesn't
overflow.

Reported-by: Marco Grassi 
Signed-off-by: Dan Carpenter 
Reviewed-by: Tomas Henzl 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: configure runtime pm before calling device_add in scsi_add_host_with_dma

2016-10-20T08:03:30+00:00

commit 0d5644b7d8daa3c1d91acb4367731f568c9c9469 upstream.

Runtime PM should be configured already once we call device_add. See
also the description in this mail thread
https://lists.linuxfoundation.org/pipermail/linux-pm/2009-November/023198.html
or the order of calls e.g. in usb_new_device.

The changed order also helps to avoid scenarios where runtime pm for
&shost->shost_gendev is activated whilst the parent is suspended,
resulting in error message "runtime PM trying to activate child device
hostx but parent yyy is not active".

In addition properly reverse the runtime pm calls in the error path.

Signed-off-by: Heiner Kallweit 
Acked-by: Alan Stern 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2016-10-01T14:37:15+00:00

Pull SCSI fix from James Bottomley:
 "One final fix before 4.8.

  There was a memory leak triggered by turning scsi mq off due to the
  fact that we assume on host release that the already running hosts
  weren't mq based because that's the state of the global flag (even
  though they were).

  Fix it by tracking this on a per host host basis"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: Avoid that toggling use_blk_mq triggers a memory leak

Merge remote-tracking branch 'mkp-scsi/4.8/scsi-fixes' into fixes

2016-09-28T05:30:51+00:00

scsi: Avoid that toggling use_blk_mq triggers a memory leak

2016-09-27T00:58:42+00:00

This patch avoids that the following memory leak is triggered if
use_blk_mq is disabled after a SCSI host has been allocated by the
ib_srp driver and before the same SCSI host is freed:

unreferenced object 0xffff8803a168c568 (size 256):
  backtrace:
    [] kmemleak_alloc+0x45/0xa0
    [] __kmalloc_node+0x1e4/0x400
    [] blk_mq_alloc_tag_set+0xb4/0x230
    [] scsi_mq_setup_tags+0xc7/0xd0
    [] scsi_add_host_with_dma+0x216/0x2d0
    [] srp_create_target+0xe55/0x13d0 [ib_srp]
    [] dev_attr_store+0x13/0x20
    [] sysfs_kf_write+0x40/0x50
    [] kernfs_fop_write+0x137/0x1c0
    [] __vfs_write+0x23/0x140
    [] vfs_write+0xb0/0x190
    [] SyS_write+0x44/0xa0
    [] entry_SYSCALL_64_fastpath+0x18/0xa8

Fixes: 9aa9cc4221f5 ("scsi: remove the disable_blk_mq host flag")
Signed-off-by: Bart Van Assche 
Cc: Christoph Hellwig 
Cc: Martin K. Petersen 
Cc: 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen