linux-stable.git/drivers/usb/storage, branch v4.13.2

usb-storage: fix deadlock involving host lock and scsi_done

2017-07-30T14:18:27+00:00

Christoph Hellwig says that since version 4.12, the kernel switched to
using blk-mq by default.  The old code used a softirq for handling
request completions, but blk-mq can handle completions in the caller's
context.  This may cause a problem for usb-storage, because it invokes
the ->scsi_done callback while holding the host lock, and the
completion routine sometimes tries to acquire the same lock (when
running the error handler, for example).

The consequence is that the existing code will sometimes deadlock upon
error completion of a SCSI command (with a lockdep warning).

This is easy enough to fix, since usb-storage doesn't really need to
hold the host lock while the callback runs.  It was simpler to write
it that way, but moving the call outside the locked region is pretty
easy and there's no downside.  That's what this patch does.

Signed-off-by: Alan Stern 
Reported-and-tested-by: Arthur Marsh 
CC: Christoph Hellwig 
CC: 
Signed-off-by: Greg Kroah-Hartman

uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069

2017-07-30T14:18:27+00:00

Similar to commit d595259fbb7a ("usb-storage: Add ignore-residue quirk for
Initio INIC-3619") for INIC-3169 in unusual_devs.h but INIC-3069 already
present in unusual_uas.h. Both in same controller IC family.

Issue is that MakeMKV fails during key exchange with installed bluray drive
with following error:

002004:0000 Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED'
occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'

Signed-off-by: Alan Swanson 
Acked-by: Oliver Neukum 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usb: storage: return on error to avoid a null pointer dereference

2017-07-17T11:11:57+00:00

When us->extra is null the driver is not initialized, however, a
later call to osd200_scsi_to_ata is made that dereferences
us->extra, causing a null pointer dereference.  The code
currently detects and reports that the driver is not initialized;
add a return to avoid the subsequent dereference issue in this
check.

Thanks to Alan Stern for pointing out that srb->result needs setting
to DID_ERROR << 16

Detected by CoverityScan, CID#100308 ("Dereference after null check")

Signed-off-by: Colin Ian King 
Cc: stable 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

Merge 4.12-rc2 into usb-next

2017-05-22T07:00:23+00:00

We want the USB fixes in here as well to handle testing and merge
issues.

Signed-off-by: Greg Kroah-Hartman

USB: ene_usb6250: turn off the Removable flag

2017-05-18T14:05:25+00:00

In the ene_usb6250 sub-driver for usb-storage, the INQUIRY data
returned by the driver indicates that the device has removable media.
While this is technically correct (memory cards can be removed from
the reader), it is not useful because the device automatically
disconnects itself from the USB bus when no media is present.

In addition, the driver does not support the PREVENT-ALLOW MEDIUM
REMOVAL and START STOP UNIT commands, and this can cause
user-interface frameworks to get confused when the user asks for the
card to be removed or ejected.

This patch fixes the problem by changing the INQUIRY data to specify
non-removable media; in practice this value works much better.

Signed-off-by: Alan Stern 
Reported-and-tested-by: Andreas Hartmann 
Signed-off-by: Greg Kroah-Hartman

USB: ene_usb6250: remove subroutine duplication

2017-05-18T14:05:24+00:00

In the ene_usb6250 sub-driver for usb-storage, the sd_scsi_inquiry()
and ms_scsi_inquiry() subroutines (one meant for use with SD memory
cards and the other for use with MS memory cards) are exact
duplicates.  This patch removes the duplication by creating a single
do_scsi_inquiry() command and using it instead of the other two.

Signed-off-by: Alan Stern 
Tested-by: Andreas Hartmann 
Signed-off-by: Greg Kroah-Hartman

USB: ene_usb6250: implement REQUEST SENSE

2017-05-18T14:05:24+00:00

In the ene_usb6250 sub-driver for usb-storage, there is no support for
the REQUEST SENSE command.  This command is issued whenever a failure
occurs, and without it the driver has no way to tell the SCSI core
what the reason for the failure was.

This patch adds a do_scsi_request_sense() routine to the driver.  The
new routine reports the error code stored by the previous command.

Signed-off-by: Alan Stern 
Reported-and-tested-by: Andreas Hartmann 
Signed-off-by: Greg Kroah-Hartman

USB: ene_usb6250: fix SCSI residue overwriting

2017-05-18T14:05:24+00:00

In the ene_usb6250 sub-driver for usb-storage, the SCSI residue is not
reported correctly.  The residue is initialized to 0, but this value
is overwritten whenever the driver sends firmware to the card reader
before performing the current command.  As a result, a valid READ or
WRITE operation appears to have failed, causing the SCSI core to retry
the command multiple times and eventually fail.

This patch fixes the problem by resetting the SCSI residue to 0 after
sending firmware to the device.

Signed-off-by: Alan Stern 
Reported-and-tested-by: Andreas Hartmann 
Signed-off-by: Greg Kroah-Hartman

USB: ene_usb6250: fix first command execution

2017-05-18T14:05:24+00:00

In the ene_usb6250 sub-driver for usb-storage, the ene_transport()
routine is supposed to initialize the driver before executing the
current command, if the initialization has not already been performed.
However, a bug in the routine causes it to skip the command after
doing the initialization.  Also, the routine does not return an
appropriate error code if either the initialization or the command
fails.

As a result of the first bug, the first command (a SCSI INQUIRY) is
not carried out.  The results can be seen in the system log, in the
form of a warning message and empty or garbage INQUIRY data:

Apr 18 22:40:08 notebook2 kernel: scsi host6: scsi scan: INQUIRY result too short (5), using 36
Apr 18 22:40:08 notebook2 kernel: scsi 6:0:0:0: Direct-Access                                    PQ: 0 ANSI: 0

This patch fixes both errors.

Signed-off-by: Alan Stern 
Reported-and-tested-by: Andreas Hartmann 
Signed-off-by: Greg Kroah-Hartman

USB: ene_usb6250: fix DMA to the stack

2017-05-17T09:27:40+00:00

The ene_usb6250 sub-driver in usb-storage does USB I/O to buffers on
the stack, which doesn't work with vmapped stacks.  This patch fixes
the problem by allocating a separate 512-byte buffer at probe time and
using it for all of the offending I/O operations.

Signed-off-by: Alan Stern 
Reported-and-tested-by: Andreas Hartmann 
CC: 
Signed-off-by: Greg Kroah-Hartman