Skip to content

Commit 9e9fbe4

Browse files
torvaldstorvalds
committed
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley: "Twelve fixes, eleven in drivers (target, qla2xx, scsi_debug, mpt3sas, ufs). The core fix is a minor correction to the previous state update fix for the iscsi daemons" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: scsi_debug: Zero clear zones at reset write pointer scsi: core: sysfs: Fix setting device state to SDEV_RUNNING scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() scsi: target: configfs: Delete unnecessary checks for NULL scsi: target: core: Use RCU helpers for INQUIRY t10_alua_tg_pt_gp scsi: mpt3sas: Fix incorrect system timestamp scsi: mpt3sas: Fix system going into read-only mode scsi: mpt3sas: Fix kernel panic during drive powercycle test scsi: ufs: ufs-mediatek: Add put_device() after of_find_device_by_node() scsi: scsi_debug: Fix type in min_t to avoid stack OOB scsi: qla2xxx: edif: Fix off by one bug in qla_edif_app_getfcinfo() scsi: ufs: ufshpb: Fix warning in ufshpb_set_hpb_read_to_upiu()
2 parents 7413927 + 2d62253 commit 9e9fbe4

File tree

10 files changed

+108
-39
lines changed

10 files changed

+108
-39
lines changed

‎drivers/scsi/mpt3sas/mpt3sas_base.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -639,8 +639,8 @@ static void _base_sync_drv_fw_timestamp(struct MPT3SAS_ADAPTER *ioc)
639639
mpi_request->IOCParameter = MPI26_SET_IOC_PARAMETER_SYNC_TIMESTAMP;
640640
current_time = ktime_get_real();
641641
TimeStamp = ktime_to_ms(current_time);
642-
mpi_request->Reserved7 = cpu_to_le32(TimeStamp & 0xFFFFFFFF);
643-
mpi_request->IOCParameterValue = cpu_to_le32(TimeStamp >> 32);
642+
mpi_request->Reserved7 = cpu_to_le32(TimeStamp >> 32);
643+
mpi_request->IOCParameterValue = cpu_to_le32(TimeStamp & 0xFFFFFFFF);
644644
init_completion(&ioc->scsih_cmds.done);
645645
ioc->put_smid_default(ioc, smid);
646646
dinitprintk(ioc, ioc_info(ioc,

‎drivers/scsi/mpt3sas/mpt3sas_base.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,8 @@
142142

143143
#define MPT_MAX_CALLBACKS 32
144144

145+
#define MPT_MAX_HBA_NUM_PHYS 32
146+
145147
#define INTERNAL_CMDS_COUNT 10 /* reserved cmds */
146148
/* reserved for issuing internally framed scsi io cmds */
147149
#define INTERNAL_SCSIIO_CMDS_COUNT 3
@@ -798,6 +800,7 @@ struct _sas_phy {
798800
* @enclosure_handle: handle for this a member of an enclosure
799801
* @device_info: bitwise defining capabilities of this sas_host/expander
800802
* @responding: used in _scsih_expander_device_mark_responding
803+
* @nr_phys_allocated: Allocated memory for this many count phys
801804
* @phy: a list of phys that make up this sas_host/expander
802805
* @sas_port_list: list of ports attached to this sas_host/expander
803806
* @port: hba port entry containing node's port number info
@@ -813,6 +816,7 @@ struct _sas_node {
813816
u16 enclosure_handle;
814817
u64 enclosure_logical_id;
815818
u8 responding;
819+
u8 nr_phys_allocated;
816820
struct hba_port *port;
817821
struct _sas_phy *phy;
818822
struct list_head sas_port_list;

‎drivers/scsi/mpt3sas/mpt3sas_scsih.c

Lines changed: 57 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3869,7 +3869,7 @@ _scsih_ublock_io_device(struct MPT3SAS_ADAPTER *ioc,
38693869

38703870
shost_for_each_device(sdev, ioc->shost) {
38713871
sas_device_priv_data = sdev->hostdata;
3872-
if (!sas_device_priv_data)
3872+
if (!sas_device_priv_data || !sas_device_priv_data->sas_target)
38733873
continue;
38743874
if (sas_device_priv_data->sas_target->sas_address
38753875
!= sas_address)
@@ -6406,11 +6406,26 @@ _scsih_sas_port_refresh(struct MPT3SAS_ADAPTER *ioc)
64066406
int i, j, count = 0, lcount = 0;
64076407
int ret;
64086408
u64 sas_addr;
6409+
u8 num_phys;
64096410

64106411
drsprintk(ioc, ioc_info(ioc,
64116412
"updating ports for sas_host(0x%016llx)\n",
64126413
(unsigned long long)ioc->sas_hba.sas_address));
64136414

6415+
mpt3sas_config_get_number_hba_phys(ioc, &num_phys);
6416+
if (!num_phys) {
6417+
ioc_err(ioc, "failure at %s:%d/%s()!\n",
6418+
__FILE__, __LINE__, __func__);
6419+
return;
6420+
}
6421+
6422+
if (num_phys > ioc->sas_hba.nr_phys_allocated) {
6423+
ioc_err(ioc, "failure at %s:%d/%s()!\n",
6424+
__FILE__, __LINE__, __func__);
6425+
return;
6426+
}
6427+
ioc->sas_hba.num_phys = num_phys;
6428+
64146429
port_table = kcalloc(ioc->sas_hba.num_phys,
64156430
sizeof(struct hba_port), GFP_KERNEL);
64166431
if (!port_table)
@@ -6611,6 +6626,30 @@ _scsih_sas_host_refresh(struct MPT3SAS_ADAPTER *ioc)
66116626
ioc->sas_hba.phy[i].hba_vphy = 1;
66126627
}
66136628

6629+
/*
6630+
* Add new HBA phys to STL if these new phys got added as part
6631+
* of HBA Firmware upgrade/downgrade operation.
6632+
*/
6633+
if (!ioc->sas_hba.phy[i].phy) {
6634+
if ((mpt3sas_config_get_phy_pg0(ioc, &mpi_reply,
6635+
&phy_pg0, i))) {
6636+
ioc_err(ioc, "failure at %s:%d/%s()!\n",
6637+
__FILE__, __LINE__, __func__);
6638+
continue;
6639+
}
6640+
ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
6641+
MPI2_IOCSTATUS_MASK;
6642+
if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
6643+
ioc_err(ioc, "failure at %s:%d/%s()!\n",
6644+
__FILE__, __LINE__, __func__);
6645+
continue;
6646+
}
6647+
ioc->sas_hba.phy[i].phy_id = i;
6648+
mpt3sas_transport_add_host_phy(ioc,
6649+
&ioc->sas_hba.phy[i], phy_pg0,
6650+
ioc->sas_hba.parent_dev);
6651+
continue;
6652+
}
66146653
ioc->sas_hba.phy[i].handle = ioc->sas_hba.handle;
66156654
attached_handle = le16_to_cpu(sas_iounit_pg0->PhyData[i].
66166655
AttachedDevHandle);
@@ -6622,6 +6661,19 @@ _scsih_sas_host_refresh(struct MPT3SAS_ADAPTER *ioc)
66226661
attached_handle, i, link_rate,
66236662
ioc->sas_hba.phy[i].port);
66246663
}
6664+
/*
6665+
* Clear the phy details if this phy got disabled as part of
6666+
* HBA Firmware upgrade/downgrade operation.
6667+
*/
6668+
for (i = ioc->sas_hba.num_phys;
6669+
i < ioc->sas_hba.nr_phys_allocated; i++) {
6670+
if (ioc->sas_hba.phy[i].phy &&
6671+
ioc->sas_hba.phy[i].phy->negotiated_linkrate >=
6672+
SAS_LINK_RATE_1_5_GBPS)
6673+
mpt3sas_transport_update_links(ioc,
6674+
ioc->sas_hba.sas_address, 0, i,
6675+
MPI2_SAS_NEG_LINK_RATE_PHY_DISABLED, NULL);
6676+
}
66256677
out:
66266678
kfree(sas_iounit_pg0);
66276679
}
@@ -6654,7 +6706,10 @@ _scsih_sas_host_add(struct MPT3SAS_ADAPTER *ioc)
66546706
__FILE__, __LINE__, __func__);
66556707
return;
66566708
}
6657-
ioc->sas_hba.phy = kcalloc(num_phys,
6709+
6710+
ioc->sas_hba.nr_phys_allocated = max_t(u8,
6711+
MPT_MAX_HBA_NUM_PHYS, num_phys);
6712+
ioc->sas_hba.phy = kcalloc(ioc->sas_hba.nr_phys_allocated,
66586713
sizeof(struct _sas_phy), GFP_KERNEL);
66596714
if (!ioc->sas_hba.phy) {
66606715
ioc_err(ioc, "failure at %s:%d/%s()!\n",

‎drivers/scsi/qla2xxx/qla_edif.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -865,7 +865,7 @@ qla_edif_app_getfcinfo(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
865865
"APP request entry - portid=%06x.\n", tdid.b24);
866866

867867
/* Ran out of space */
868-
if (pcnt > app_req.num_ports)
868+
if (pcnt >= app_req.num_ports)
869869
break;
870870

871871
if (tdid.b24 != 0 && tdid.b24 != fcport->d_id.b24)

‎drivers/scsi/scsi_debug.c

Lines changed: 26 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1189,7 +1189,7 @@ static int p_fill_from_dev_buffer(struct scsi_cmnd *scp, const void *arr,
11891189
__func__, off_dst, scsi_bufflen(scp), act_len,
11901190
scsi_get_resid(scp));
11911191
n = scsi_bufflen(scp) - (off_dst + act_len);
1192-
scsi_set_resid(scp, min_t(int, scsi_get_resid(scp), n));
1192+
scsi_set_resid(scp, min_t(u32, scsi_get_resid(scp), n));
11931193
return 0;
11941194
}
11951195

@@ -1562,7 +1562,8 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
15621562
unsigned char pq_pdt;
15631563
unsigned char *arr;
15641564
unsigned char *cmd = scp->cmnd;
1565-
int alloc_len, n, ret;
1565+
u32 alloc_len, n;
1566+
int ret;
15661567
bool have_wlun, is_disk, is_zbc, is_disk_zbc;
15671568

15681569
alloc_len = get_unaligned_be16(cmd + 3);
@@ -1585,7 +1586,8 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
15851586
kfree(arr);
15861587
return check_condition_result;
15871588
} else if (0x1 & cmd[1]) { /* EVPD bit set */
1588-
int lu_id_num, port_group_id, target_dev_id, len;
1589+
int lu_id_num, port_group_id, target_dev_id;
1590+
u32 len;
15891591
char lu_id_str[6];
15901592
int host_no = devip->sdbg_host->shost->host_no;
15911593

@@ -1676,9 +1678,9 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
16761678
kfree(arr);
16771679
return check_condition_result;
16781680
}
1679-
len = min(get_unaligned_be16(arr + 2) + 4, alloc_len);
1681+
len = min_t(u32, get_unaligned_be16(arr + 2) + 4, alloc_len);
16801682
ret = fill_from_dev_buffer(scp, arr,
1681-
min(len, SDEBUG_MAX_INQ_ARR_SZ));
1683+
min_t(u32, len, SDEBUG_MAX_INQ_ARR_SZ));
16821684
kfree(arr);
16831685
return ret;
16841686
}
@@ -1714,7 +1716,7 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
17141716
}
17151717
put_unaligned_be16(0x2100, arr + n); /* SPL-4 no version claimed */
17161718
ret = fill_from_dev_buffer(scp, arr,
1717-
min_t(int, alloc_len, SDEBUG_LONG_INQ_SZ));
1719+
min_t(u32, alloc_len, SDEBUG_LONG_INQ_SZ));
17181720
kfree(arr);
17191721
return ret;
17201722
}
@@ -1729,8 +1731,8 @@ static int resp_requests(struct scsi_cmnd *scp,
17291731
unsigned char *cmd = scp->cmnd;
17301732
unsigned char arr[SCSI_SENSE_BUFFERSIZE]; /* assume >= 18 bytes */
17311733
bool dsense = !!(cmd[1] & 1);
1732-
int alloc_len = cmd[4];
1733-
int len = 18;
1734+
u32 alloc_len = cmd[4];
1735+
u32 len = 18;
17341736
int stopped_state = atomic_read(&devip->stopped);
17351737

17361738
memset(arr, 0, sizeof(arr));
@@ -1774,7 +1776,7 @@ static int resp_requests(struct scsi_cmnd *scp,
17741776
arr[7] = 0xa;
17751777
}
17761778
}
1777-
return fill_from_dev_buffer(scp, arr, min_t(int, len, alloc_len));
1779+
return fill_from_dev_buffer(scp, arr, min_t(u32, len, alloc_len));
17781780
}
17791781

17801782
static int resp_start_stop(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
@@ -2312,7 +2314,8 @@ static int resp_mode_sense(struct scsi_cmnd *scp,
23122314
{
23132315
int pcontrol, pcode, subpcode, bd_len;
23142316
unsigned char dev_spec;
2315-
int alloc_len, offset, len, target_dev_id;
2317+
u32 alloc_len, offset, len;
2318+
int target_dev_id;
23162319
int target = scp->device->id;
23172320
unsigned char *ap;
23182321
unsigned char arr[SDEBUG_MAX_MSENSE_SZ];
@@ -2468,7 +2471,7 @@ static int resp_mode_sense(struct scsi_cmnd *scp,
24682471
arr[0] = offset - 1;
24692472
else
24702473
put_unaligned_be16((offset - 2), arr + 0);
2471-
return fill_from_dev_buffer(scp, arr, min_t(int, alloc_len, offset));
2474+
return fill_from_dev_buffer(scp, arr, min_t(u32, alloc_len, offset));
24722475
}
24732476

24742477
#define SDEBUG_MAX_MSELECT_SZ 512
@@ -2499,11 +2502,11 @@ static int resp_mode_select(struct scsi_cmnd *scp,
24992502
__func__, param_len, res);
25002503
md_len = mselect6 ? (arr[0] + 1) : (get_unaligned_be16(arr + 0) + 2);
25012504
bd_len = mselect6 ? arr[3] : get_unaligned_be16(arr + 6);
2502-
if (md_len > 2) {
2505+
off = bd_len + (mselect6 ? 4 : 8);
2506+
if (md_len > 2 || off >= res) {
25032507
mk_sense_invalid_fld(scp, SDEB_IN_DATA, 0, -1);
25042508
return check_condition_result;
25052509
}
2506-
off = bd_len + (mselect6 ? 4 : 8);
25072510
mpage = arr[off] & 0x3f;
25082511
ps = !!(arr[off] & 0x80);
25092512
if (ps) {
@@ -2583,7 +2586,8 @@ static int resp_ie_l_pg(unsigned char *arr)
25832586
static int resp_log_sense(struct scsi_cmnd *scp,
25842587
struct sdebug_dev_info *devip)
25852588
{
2586-
int ppc, sp, pcode, subpcode, alloc_len, len, n;
2589+
int ppc, sp, pcode, subpcode;
2590+
u32 alloc_len, len, n;
25872591
unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
25882592
unsigned char *cmd = scp->cmnd;
25892593

@@ -2653,9 +2657,9 @@ static int resp_log_sense(struct scsi_cmnd *scp,
26532657
mk_sense_invalid_fld(scp, SDEB_IN_CDB, 3, -1);
26542658
return check_condition_result;
26552659
}
2656-
len = min_t(int, get_unaligned_be16(arr + 2) + 4, alloc_len);
2660+
len = min_t(u32, get_unaligned_be16(arr + 2) + 4, alloc_len);
26572661
return fill_from_dev_buffer(scp, arr,
2658-
min_t(int, len, SDEBUG_MAX_INQ_ARR_SZ));
2662+
min_t(u32, len, SDEBUG_MAX_INQ_ARR_SZ));
26592663
}
26602664

26612665
static inline bool sdebug_dev_is_zoned(struct sdebug_dev_info *devip)
@@ -4430,7 +4434,7 @@ static int resp_report_zones(struct scsi_cmnd *scp,
44304434
put_unaligned_be64(sdebug_capacity - 1, arr + 8);
44314435

44324436
rep_len = (unsigned long)desc - (unsigned long)arr;
4433-
ret = fill_from_dev_buffer(scp, arr, min_t(int, alloc_len, rep_len));
4437+
ret = fill_from_dev_buffer(scp, arr, min_t(u32, alloc_len, rep_len));
44344438

44354439
fini:
44364440
read_unlock(macc_lckp);
@@ -4653,6 +4657,7 @@ static void zbc_rwp_zone(struct sdebug_dev_info *devip,
46534657
struct sdeb_zone_state *zsp)
46544658
{
46554659
enum sdebug_z_cond zc;
4660+
struct sdeb_store_info *sip = devip2sip(devip, false);
46564661

46574662
if (zbc_zone_is_conv(zsp))
46584663
return;
@@ -4664,6 +4669,10 @@ static void zbc_rwp_zone(struct sdebug_dev_info *devip,
46644669
if (zsp->z_cond == ZC4_CLOSED)
46654670
devip->nr_closed--;
46664671

4672+
if (zsp->z_wp > zsp->z_start)
4673+
memset(sip->storep + zsp->z_start * sdebug_sector_size, 0,
4674+
(zsp->z_wp - zsp->z_start) * sdebug_sector_size);
4675+
46674676
zsp->z_non_seq_resource = false;
46684677
zsp->z_wp = zsp->z_start;
46694678
zsp->z_cond = ZC1_EMPTY;

‎drivers/scsi/scsi_sysfs.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -812,7 +812,7 @@ store_state_field(struct device *dev, struct device_attribute *attr,
812812

813813
mutex_lock(&sdev->state_mutex);
814814
if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) {
815-
ret = count;
815+
ret = 0;
816816
} else {
817817
ret = scsi_device_set_state(sdev, state);
818818
if (ret == 0 && state == SDEV_RUNNING)

‎drivers/scsi/ufs/ufs-mediatek.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1189,6 +1189,7 @@ static int ufs_mtk_probe(struct platform_device *pdev)
11891189
}
11901190
link = device_link_add(dev, &reset_pdev->dev,
11911191
DL_FLAG_AUTOPROBE_CONSUMER);
1192+
put_device(&reset_pdev->dev);
11921193
if (!link) {
11931194
dev_notice(dev, "add reset device_link fail\n");
11941195
goto skip_reset;

‎drivers/scsi/ufs/ufshpb.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,7 @@ ufshpb_set_hpb_read_to_upiu(struct ufs_hba *hba, struct ufshcd_lrb *lrbp,
331331
cdb[0] = UFSHPB_READ;
332332

333333
if (hba->dev_quirks & UFS_DEVICE_QUIRK_SWAP_L2P_ENTRY_FOR_HPB_READ)
334-
ppn_tmp = swab64(ppn);
334+
ppn_tmp = (__force __be64)swab64((__force u64)ppn);
335335

336336
/* ppn value is stored as big-endian in the host memory */
337337
memcpy(&cdb[6], &ppn_tmp, sizeof(__be64));

‎drivers/target/target_core_fabric_configfs.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -520,7 +520,7 @@ static ssize_t target_fabric_port_alua_tg_pt_gp_show(struct config_item *item,
520520
{
521521
struct se_lun *lun = item_to_lun(item);
522522

523-
if (!lun || !lun->lun_se_dev)
523+
if (!lun->lun_se_dev)
524524
return -ENODEV;
525525

526526
return core_alua_show_tg_pt_gp_info(lun, page);
@@ -531,7 +531,7 @@ static ssize_t target_fabric_port_alua_tg_pt_gp_store(struct config_item *item,
531531
{
532532
struct se_lun *lun = item_to_lun(item);
533533

534-
if (!lun || !lun->lun_se_dev)
534+
if (!lun->lun_se_dev)
535535
return -ENODEV;
536536

537537
return core_alua_store_tg_pt_gp_info(lun, page, count);
@@ -542,7 +542,7 @@ static ssize_t target_fabric_port_alua_tg_pt_offline_show(
542542
{
543543
struct se_lun *lun = item_to_lun(item);
544544

545-
if (!lun || !lun->lun_se_dev)
545+
if (!lun->lun_se_dev)
546546
return -ENODEV;
547547

548548
return core_alua_show_offline_bit(lun, page);
@@ -553,7 +553,7 @@ static ssize_t target_fabric_port_alua_tg_pt_offline_store(
553553
{
554554
struct se_lun *lun = item_to_lun(item);
555555

556-
if (!lun || !lun->lun_se_dev)
556+
if (!lun->lun_se_dev)
557557
return -ENODEV;
558558

559559
return core_alua_store_offline_bit(lun, page, count);
@@ -564,7 +564,7 @@ static ssize_t target_fabric_port_alua_tg_pt_status_show(
564564
{
565565
struct se_lun *lun = item_to_lun(item);
566566

567-
if (!lun || !lun->lun_se_dev)
567+
if (!lun->lun_se_dev)
568568
return -ENODEV;
569569

570570
return core_alua_show_secondary_status(lun, page);
@@ -575,7 +575,7 @@ static ssize_t target_fabric_port_alua_tg_pt_status_store(
575575
{
576576
struct se_lun *lun = item_to_lun(item);
577577

578-
if (!lun || !lun->lun_se_dev)
578+
if (!lun->lun_se_dev)
579579
return -ENODEV;
580580

581581
return core_alua_store_secondary_status(lun, page, count);
@@ -586,7 +586,7 @@ static ssize_t target_fabric_port_alua_tg_pt_write_md_show(
586586
{
587587
struct se_lun *lun = item_to_lun(item);
588588

589-
if (!lun || !lun->lun_se_dev)
589+
if (!lun->lun_se_dev)
590590
return -ENODEV;
591591

592592
return core_alua_show_secondary_write_metadata(lun, page);
@@ -597,7 +597,7 @@ static ssize_t target_fabric_port_alua_tg_pt_write_md_store(
597597
{
598598
struct se_lun *lun = item_to_lun(item);
599599

600-
if (!lun || !lun->lun_se_dev)
600+
if (!lun->lun_se_dev)
601601
return -ENODEV;
602602

603603
return core_alua_store_secondary_write_metadata(lun, page, count);

0 commit comments

Comments
 (0)