linux-toradex.git/drivers/scsi/bfa, branch v4.9.128

scsi: bfa: integer overflow in debugfs

2017-12-20T09:07:33+00:00

[ Upstream commit 3e351275655d3c84dc28abf170def9786db5176d ]

We could allocate less memory than intended because we do:

	bfad->regdata = kzalloc(len << 2, GFP_KERNEL);

The shift can overflow leading to a crash.  This is debugfs code so the
impact is very small.  I fixed the network version of this in March with
commit 13e2d5187f6b ("bna: integer overflow bug in debugfs").

Fixes: ab2a9ba189e8 ("[SCSI] bfa: add debugfs support")
Signed-off-by: Dan Carpenter 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

scsi: bfa: Increase requested firmware version to 3.2.5.1

2017-08-07T01:59:50+00:00

[ Upstream commit 2d1148f0f45079d25a0fa0d67e4fdb2a656d12fb ]

bna & bfa firmware version 3.2.5.1 was submitted to linux-firmware on
Feb 17 19:10:20 2015 -0500 in 0ab54ff1dc ("linux-firmware: Add QLogic BR
Series Adapter Firmware").

bna was updated to use the newer firmware on Feb 19 16:02:32 2015 -0500 in
3f307c3d70 ("bna: Update the Driver and Firmware Version")

bfa was not updated. I presume this was an oversight but it broke support
for bfa+bna cards such as the following
	04:00.0 Fibre Channel [0c04]: Brocade Communications Systems, Inc.
		1010/1020/1007/1741 10Gbps CNA [1657:0014] (rev 01)
	04:00.1 Fibre Channel [0c04]: Brocade Communications Systems, Inc.
		1010/1020/1007/1741 10Gbps CNA [1657:0014] (rev 01)
	04:00.2 Ethernet controller [0200]: Brocade Communications Systems,
		Inc. 1010/1020/1007/1741 10Gbps CNA [1657:0014] (rev 01)
	04:00.3 Ethernet controller [0200]: Brocade Communications Systems,
		Inc. 1010/1020/1007/1741 10Gbps CNA [1657:0014] (rev 01)

Currently, if the bfa module is loaded first, bna fails to probe the
respective devices with
[  215.026787] bna: QLogic BR-series 10G Ethernet driver - version: 3.2.25.1
[  215.043707] bna 0000:04:00.2: bar0 mapped to ffffc90001fc0000, len 262144
[  215.060656] bna 0000:04:00.2: initialization failed err=1
[  215.073893] bna 0000:04:00.3: bar0 mapped to ffffc90002040000, len 262144
[  215.090644] bna 0000:04:00.3: initialization failed err=1

Whereas if bna is loaded first, bfa fails with
[  249.592109] QLogic BR-series BFA FC/FCOE SCSI driver - version: 3.2.25.0
[  249.610738] bfa 0000:04:00.0: Running firmware version is incompatible with the driver version
[  249.833513] bfa 0000:04:00.0: bfa init failed
[  249.833919] scsi host6: QLogic BR-series FC/FCOE Adapter, hwpath: 0000:04:00.0 driver: 3.2.25.0
[  249.841446] bfa 0000:04:00.1: Running firmware version is incompatible with the driver version
[  250.045449] bfa 0000:04:00.1: bfa init failed
[  250.045962] scsi host7: QLogic BR-series FC/FCOE Adapter, hwpath: 0000:04:00.1 driver: 3.2.25.0

Increase bfa's requested firmware version. Also increase the driver
version.  I only tested that all of the devices probe without error.

Reported-by: Tim Ehlers 
Signed-off-by: Benjamin Poirier 
Acked-by: Rasesh Mody 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

scsi: bfa: Do not dereference port before it is null checked

2016-09-02T10:09:16+00:00

Port is deferenced before it is null sanity checked, hence we
potentially have a null pointer dereference bug. Instead, initialise
trl_enabled from port->fcs->bfa after we are sure port is not null.

Signed-off-by: Colin Ian King 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen

scripts/spelling.txt: add "fimware" misspelling

2016-05-20T02:12:14+00:00

A few instances of "fimware" instead of "firmware" were found.  Fix
these and add it to the spelling.txt file.

Signed-off-by: Kees Cook 
Reported-by: Randy Dunlap 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

bfa: fix bfa_fcb_itnim_alloc() error handling

2016-05-10T02:18:42+00:00

The caller assumes that "itnim" is NULL on error and non-NULL on success
but really "itnim" is uninitialized on error.  This function should just
use normal error handling where it returns zero on success and negative
on failure.

Signed-off-by: Dan Carpenter 
Acked-by: Anil Gurumurthy 
Signed-off-by: Martin K. Petersen

bfa: deinline __bfa_trc() and __bfa_trc32()

2016-02-24T02:27:02+00:00

__bfa_trc() compiles to 115 bytes of machine code.
With this .config: http://busybox.net/~vda/kernel_config
there are 1494 calls of __bfa_trc().

__bfa_trc32() is very similar, so it is uninlined too.
However, it appears to be unused, therefore this patch
ifdefs it out.

Change in code size is about 130,000 bytes:

    text     data      bss       dec     hex filename
85975426 22294712 20627456 128897594 7aed23a vmlinux.before
85842882 22294584 20627456 128764922 7accbfa vmlinux

[mkp: Removed unused __bfa_trc32()]

Signed-off-by: Denys Vlasenko 
Acked-by: Anil Gurumurthy 
CC: Fabian Frederick 
CC: Anil Gurumurthy 
CC: Christoph Hellwig 
CC: Guenter Roeck 
CC: Ben Hutchings 
CC: James Bottomley 
CC: linux-kernel@vger.kernel.org
CC: linux-scsi@vger.kernel.org
Signed-off-by: Martin K. Petersen

bfa: use strncpy() instead of memcpy()

2016-02-24T02:27:02+00:00

BFA_MFG_NAME is "QLogic" which is only 7 bytes, but we are copying 8
bytes.  It's harmless because the badding byte is likely zero but it
makes static checkers complain.

Signed-off-by: Dan Carpenter 
Acked-by: Anil Gurumurthy 
Signed-off-by: Martin K. Petersen

bfa: Update driver version to 3.2.25.0

2015-12-02T22:07:57+00:00

Signed-off-by: Sudarsana Kalluru 
Signed-off-by: Anil Gurumurthy 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen

bfa: File header and user visible string changes

2015-12-02T22:07:38+00:00

Signed-off-by: Sudarsana Kalluru 
Signed-off-by: Anil Gurumurthy 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen

bfa: Fix for crash when bfa_itnim is NULL

2015-12-02T22:06:45+00:00

Fix a very corner case when the port gets disconnected and the BFA and
FCS layers clean up references to the IT nexus.  During this window if a
task management command is issued by the SCSI-ML and ends up referencing
a NULL itnim, it could lead to a crash.

Signed-off-by: Sudarsana Kalluru 
Signed-off-by: Anil Gurumurthy 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen