linux-stable.git/include/scsi, branch linux-5.19.y

scsi: iscsi: Add recv workqueue helpers

2022-10-24T07:57:58+00:00

[ Upstream commit 8af809966c0b34cfacd8da9a412689b8e9910354 ]

Add helpers to allow the drivers to run their recv paths from libiscsi's
workqueue.

Link: https://lore.kernel.org/r/20220616224557.115234-3-michael.christie@oracle.com
Reviewed-by: Lee Duncan 
Signed-off-by: Mike Christie 
Signed-off-by: Martin K. Petersen 
Stable-dep-of: 57569c37f0ad ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()")
Signed-off-by: Sasha Levin

scsi: iscsi: Rename iscsi_conn_queue_work()

2022-10-24T07:57:57+00:00

[ Upstream commit 4b9f8ce4d5e823e42944c5a0a4842b0f936365ad ]

Rename iscsi_conn_queue_work() to iscsi_conn_queue_xmit() to reflect that
it handles queueing of xmits only.

Link: https://lore.kernel.org/r/20220616224557.115234-2-michael.christie@oracle.com
Reviewed-by: Lee Duncan 
Reviewed-by: Wu Bo 
Signed-off-by: Mike Christie 
Signed-off-by: Martin K. Petersen 
Stable-dep-of: 57569c37f0ad ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()")
Signed-off-by: Sasha Levin

scsi: stex: Properly zero out the passthrough command structure

2022-10-15T06:01:43+00:00

commit 6022f210461fef67e6e676fd8544ca02d1bcfa7a upstream.

The passthrough structure is declared off of the stack, so it needs to be
set to zero before copied back to userspace to prevent any unintentional
data leakage.  Switch things to be statically allocated which will fill the
unused fields with 0 automatically.

Link: https://lore.kernel.org/r/YxrjN3OOw2HHl9tx@kroah.com
Cc: stable@kernel.org
Cc: "James E.J. Bottomley" 
Cc: "Martin K. Petersen" 
Cc: Dan Carpenter 
Reported-by: hdthky 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: core: Fix a use-after-free

2022-09-28T09:32:01+00:00

[ Upstream commit 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 ]

There are two .exit_cmd_priv implementations. Both implementations use
resources associated with the SCSI host. Make sure that these resources are
still available when .exit_cmd_priv is called by waiting inside
scsi_remove_host() until the tag set has been freed.

This commit fixes the following use-after-free:

==================================================================
BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
Read of size 8 at addr ffff888100337000 by task multipathd/16727
Call Trace:
 
 dump_stack_lvl+0x34/0x44
 print_report.cold+0x5e/0x5db
 kasan_report+0xab/0x120
 srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
 scsi_mq_exit_request+0x4d/0x70
 blk_mq_free_rqs+0x143/0x410
 __blk_mq_free_map_and_rqs+0x6e/0x100
 blk_mq_free_tag_set+0x2b/0x160
 scsi_host_dev_release+0xf3/0x1a0
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 scsi_device_dev_release_usercontext+0x4c1/0x4e0
 execute_in_process_context+0x23/0x90
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 scsi_disk_release+0x3f/0x50
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 disk_release+0x17f/0x1b0
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 dm_put_table_device+0xa3/0x160 [dm_mod]
 dm_put_device+0xd0/0x140 [dm_mod]
 free_priority_group+0xd8/0x110 [dm_multipath]
 free_multipath+0x94/0xe0 [dm_multipath]
 dm_table_destroy+0xa2/0x1e0 [dm_mod]
 __dm_destroy+0x196/0x350 [dm_mod]
 dev_remove+0x10c/0x160 [dm_mod]
 ctl_ioctl+0x2c2/0x590 [dm_mod]
 dm_ctl_ioctl+0x5/0x10 [dm_mod]
 __x64_sys_ioctl+0xb4/0xf0
 dm_ctl_ioctl+0x5/0x10 [dm_mod]
 __x64_sys_ioctl+0xb4/0xf0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

Link: https://lore.kernel.org/r/20220826002635.919423-1-bvanassche@acm.org
Fixes: 65ca846a5314 ("scsi: core: Introduce {init,exit}_cmd_priv()")
Cc: Ming Lei 
Cc: Christoph Hellwig 
Cc: Mike Christie 
Cc: Hannes Reinecke 
Cc: John Garry 
Cc: Li Zhijian 
Reported-by: Li Zhijian 
Tested-by: Li Zhijian 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: iscsi: Fix session removal on shutdown

2022-08-17T13:15:22+00:00

[ Upstream commit 31500e902759322ba3c64b60dabae2704e738df8 ]

When the system is shutting down, iscsid is not running so we will not get
a response to the ISCSI_ERR_INVALID_HOST error event. The system shutdown
will then hang waiting on userspace to remove the session.

This has libiscsi force the destruction of the session from the kernel when
iscsi_host_remove() is called from a driver's shutdown callout.

This fixes a regression added in qedi boot with commit d1f2ce77638d ("scsi:
qedi: Fix host removal with running sessions") which made qedi use the
common session removal function that waits on userspace instead of rolling
its own kernel based removal.

Link: https://lore.kernel.org/r/20220616222738.5722-7-michael.christie@oracle.com
Fixes: d1f2ce77638d ("scsi: qedi: Fix host removal with running sessions")
Tested-by: Nilesh Javali 
Reviewed-by: Lee Duncan 
Reviewed-by: Nilesh Javali 
Signed-off-by: Mike Christie 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: iscsi: Add helper to remove a session from the kernel

2022-08-17T13:15:22+00:00

[ Upstream commit bb42856bfd54fda1cbc7c470fcf5db1596938f4f ]

During qedi shutdown we need to stop the iSCSI layer from sending new nops
as pings and from responding to target ones and make sure there is no
running connection cleanups. Commit d1f2ce77638d ("scsi: qedi: Fix host
removal with running sessions") converted the driver to use the libicsi
helper to drive session removal, so the above issues could be handled. The
problem is that during system shutdown iscsid will not be running so when
we try to remove the root session we will hang waiting for userspace to
reply.

Add a helper that will drive the destruction of sessions like these during
system shutdown.

Link: https://lore.kernel.org/r/20220616222738.5722-5-michael.christie@oracle.com
Tested-by: Nilesh Javali 
Reviewed-by: Nilesh Javali 
Signed-off-by: Mike Christie 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2022-05-26T02:09:48+00:00

Pull SCSI updates from James Bottomley:
 "This consists of a small set of driver updates (lpfc, ufs, mpt3sas
  mpi3mr, iscsi target). Apart from that this is mostly small fixes with
  very few core changes (the biggest one being VPD caching)"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (177 commits)
  scsi: target: tcmu: Avoid holding XArray lock when calling lock_page
  scsi: elx: efct: Remove NULL check after calling container_of()
  scsi: dpt_i2o: Drop redundant spinlock initialization
  scsi: qedf: Remove redundant variable op
  scsi: hisi_sas: Fix memory ordering in hisi_sas_task_deliver()
  scsi: fnic: Replace DMA mask of 64 bits with 47 bits
  scsi: mpi3mr: Add target device related sysfs attributes
  scsi: mpi3mr: Add shost related sysfs attributes
  scsi: elx: efct: Remove redundant memset() statement
  scsi: megaraid_sas: Remove redundant memset() statement
  scsi: mpi3mr: Return error if dma_alloc_coherent() fails
  scsi: hisi_sas: Fix rescan after deleting a disk
  scsi: hisi_sas: Use sas_ata_wait_after_reset() in IT nexus reset
  scsi: libsas: Refactor sas_ata_hard_reset()
  scsi: mpt3sas: Update driver version to 42.100.00.00
  scsi: mpt3sas: Fix junk chars displayed while printing ChipName
  scsi: ipr: Use kobj_to_dev()
  scsi: mpi3mr: Fix a NULL vs IS_ERR() bug in mpi3mr_bsg_init()
  scsi: bnx2fc: Avoid using get_cpu() in bnx2fc_cmd_alloc()
  scsi: libfc: Remove get_cpu() semantics in fc_exch_em_alloc()
  ...

Merge tag 'Wstringop-overflow-fixes-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux

2022-05-25T20:52:24+00:00

Pull Wstringop-overflow fixes from Gustavo Silva:
 "Fix some -Wstringop-overflow warnings when building with GCC-11. All
  the patches have been in linux-next during the last development cycle.

  This is part of the ongoing efforts to globally enable
  -Wstringop-overflow"

* tag 'Wstringop-overflow-fixes-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux:
  drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
  drm/amd/display: Fix Wstringop-overflow warnings in dc_link_dp.c
  scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()

scsi: libsas: Refactor sas_ata_hard_reset()

2022-05-20T00:16:25+00:00

Create function sas_ata_wait_after_reset() from sas_ata_hard_reset() as
some LLDDs may want to check for a remote ATA phy is up after reset.

Link: https://lore.kernel.org/r/1652354134-171343-2-git-send-email-john.garry@huawei.com
Tested-by: Yihang Li 
Reviewed-by: Xiang Chen 
Signed-off-by: John Garry 
Signed-off-by: Martin K. Petersen

scsi: fcoe: Add a local_lock to fcoe_percpu

2022-05-17T01:26:50+00:00

fcoe_get_paged_crc_eof() relies on the caller having preemption disabled to
ensure the per-CPU fcoe_percpu context remains valid throughout the
call. This is done by either holding spinlocks (such as bnx2fc_global_lock
or qedf_global_lock) or the get_cpu() from fcoe_alloc_paged_crc_eof(). This
last one breaks PREEMPT_RT semantics as there can be memory allocation and
end up sleeping in atomic contexts.

Introduce a local_lock_t to struct fcoe_percpu that will keep the non-RT
case the same, mapping to preempt_disable/enable, while RT will use a
per-CPU spinlock allowing the region to be preemptible but still maintain
CPU locality. The other users of fcoe_percpu are already safe in this
regard and do not require local_lock()ing.

Link: https://lore.kernel.org/r/20211117025956.79616-3-dave@stgolabs.net
Link: https://lore.kernel.org/r/20220506105758.283887-2-bigeasy@linutronix.de
Acked-by: Sebastian Andrzej Siewior 
Signed-off-by: Davidlohr Bueso 
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Martin K. Petersen