linux-toradex.git/drivers/ata/libata.h, branch v5.0

scsi: libsas: dynamically allocate and free ata host

2018-06-20T02:02:25+00:00

Commit 2623c7a5f2 ("libata: add refcounting to ata_host") v4.17+ introduced
refcounting to ata_host and will increase or decrease the refcount when
adding or deleting transport ATA port.

Now the ata host for libsas is embedded in domain_device, and the ->kref
member is not initialized. Afer we add ata transport class, ata_host_get()
will be called when adding transport ATA port and a warning will be
triggered as below:

refcount_t: increment on 0; use-after-free.
WARNING: CPU: 2 PID: 103 at
lib/refcount.c:153 refcount_inc+0x40/0x48 ......  Call trace:
 refcount_inc+0x40/0x48
 ata_host_get+0x10/0x18
 ata_tport_add+0x40/0x120
 ata_sas_tport_add+0xc/0x14
 sas_ata_init+0x7c/0xc8
 sas_discover_domain+0x380/0x53c
 process_one_work+0x12c/0x288
 worker_thread+0x58/0x3f0
 kthread+0xfc/0x128
 ret_from_fork+0x10/0x18

And also when removing transport ATA port ata_host_put() will be called and
another similar warning will be triggered. If the refcount decreased to
zero, the ata host will be freed. But this ata host is only part of
domain_device, it cannot be freed directly.

So we have to change this embedded static ata host to a dynamically
allocated ata host and initialize the ->kref member. To use ata_host_get()
and ata_host_put() in libsas, we need to move the declaration of these
functions to the public libata.h and export them.

Fixes: b6240a4df018 ("scsi: libsas: add transport class for ATA devices")
Signed-off-by: Jason Yan 
CC: John Garry 
CC: Taras Kondratiuk 
CC: Tejun Heo 
Acked-by: Tejun Heo 
Signed-off-by: Martin K. Petersen

libata: add refcounting to ata_host

2018-03-13T20:29:10+00:00

After commit 9a6d6a2ddabb ("ata: make ata port as parent device of scsi
host") manual driver unbind/remove causes use-after-free.

Unbind unconditionally invokes devres_release_all() which calls
ata_host_release() and frees ata_host/ata_port memory while it is still
being referenced as a parent of SCSI host. When SCSI host is finally
released scsi_host_dev_release() calls put_device(parent) and accesses
freed ata_port memory.

Add reference counting to make sure that ata_host lives long enough.

Bug report: https://lkml.org/lkml/2017/11/1/945
Fixes: 9a6d6a2ddabb ("ata: make ata port as parent device of scsi host")
Cc: Tejun Heo 
Cc: Lin Ming 
Cc: linux-ide@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Taras Kondratiuk 
Signed-off-by: Tejun Heo

Merge branch 'for-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata

2017-11-15T22:11:41+00:00

Pull libata updates from Tejun Heo:
 "Nothing too interesting or alarming. Other than a new power saving
  mode addition to ahci and crash fix on a tracepoint, all changes are
  trivial or device-specific"

* 'for-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata: (22 commits)
  ahci: imx: Handle increased read failures for IMX53 temperature sensor in low frequency mode.
  ata: sata_dwc_460ex: Propagate platform device ID to DMA driver
  ata: fixes kernel crash while tracing ata_eh_link_autopsy event
  ata: pata_pdc2027x: Fix space before '[' error.
  libata: fix spelling mistake: 'ambigious' -> 'ambiguous'
  ata: ceva: Add SMMU support for SATA IP
  ata: ceva: Correct the suspend and resume logic for SATA
  ata: ceva: Correct the AXI bus configuration for SATA ports
  ata: ceva: Add CCI support for SATA if CCI is enabled
  ata: ceva: Make RxWaterMark value as module parameter
  ata: ceva: Disable Device Sleep capability
  ata: ceva: Add gen 3 mode support in driver
  ata: ceva: Move sata port phy oob settings to device-tree
  devicetree: bindings: Add sata port phy config parameters in ahci-ceva
  ata: mark expected switch fall-throughs
  ata: sata_mv: remove a redundant assignment to pointer ehi
  ahci: Add support for Cavium's fifth generation SATA controller
  ata: sata_rcar: Use of_device_get_match_data() helper
  libata: make ata_port_type const
  libata: make static arrays const, reduces object code size
  ...

libata: Convert timers to use timer_setup()

2017-10-17T15:37:37+00:00

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Signed-off-by: Kees Cook 
Signed-off-by: Thomas Gleixner 
Acked-by: Tejun Heo 
Cc: linux-ide@vger.kernel.org
Link: https://lkml.kernel.org/r/20171005004842.GA23011@beast

libata: make ata_port_type const

2017-10-02T16:57:55+00:00

Make this const as it is only stored in the const field of a device
structure. Make the declaration in header const too.

Structure found using Coccinelle and changes done by hand.

Signed-off-by: Bhumika Goyal 
Signed-off-by: Tejun Heo

libata: move ata_read_log_page to libata-core.c

2017-06-05T19:29:21+00:00

It is core functionality, and only one of the users is in the EH code.

Signed-off-by: Christoph Hellwig 
Signed-off-by: Tejun Heo

ata: update references for libata documentation

2017-05-16T15:25:59+00:00

The libata documentation is now using ReST. Update references
to it to point to the new place.

Signed-off-by: Mauro Carvalho Chehab 
Acked-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Tejun Heo

Merge branch 'for-4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata

2017-02-22T01:21:32+00:00

Pull libata updates from Tejun Heo:

 - Bartlomiej added pata_falcon

 - Christoph is trying to remove use of static 4k buf.  It's still WIP

 - config cleanup around HAS_DMA

 - other fixes and driver-specific changes

* 'for-4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata: (29 commits)
  ata: pata_of_platform: using of_property_read_u32() helper
  pata_atiixp: Don't use unconnected secondary port on SB600/SB700
  libata-sff: Don't scan disabled ports when checking for legacy mode.
  pata_octeon_cf: remove unused local variables from octeon_cf_set_piomode()
  ahci: qoriq: added ls2088a platforms support
  ahci: qoriq: report error when ecc register address is missing in dts
  ahci: qoriq: added a condition to enable dma coherence
  Revert "libata: switch to dynamic allocation instead of ata_scsi_rbuf"
  ahci: imx: fix building without hwmon or thermal
  ata: add Atari Falcon PATA controller driver
  ata: pass queued command to ->sff_data_xfer method
  ata: allow subsystem to be used on m68k arch
  libata: switch to dynamic allocation instead of ata_scsi_rbuf
  libata: don't call ata_scsi_rbuf_fill for command without a response buffer
  libata: call ->scsi_done from ata_scsi_simulate
  libata: remove the done callback from ata_scsi_args
  libata: move struct ata_scsi_args to libata-scsi.c
  libata: avoid global response buffer in atapi_qc_complete
  libata-eh: Use switch() instead of sparse array for protocol strings
  ata: sata_mv: Convert to devm_ioremap_resource()
  ...

scsi: remove eh_timed_out methods in the transport template

2017-02-07T00:10:03+00:00

Instead define the timeout behavior purely based on the host_template
eh_timed_out method and wire up the existing transport implementations
in the host templates.  This also clears up the confusion that the
transport template method overrides the host template one, so some
drivers have to re-override the transport template one.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Reviewed-by: Tyrel Datwyler 
Signed-off-by: Martin K. Petersen

libata: move struct ata_scsi_args to libata-scsi.c

2017-01-10T15:55:39+00:00

It's only used in libata-scsi.c, so move it closer to the users.

Signed-off-by: Christoph Hellwig 
Signed-off-by: Tejun Heo