linux-toradex.git/drivers/scsi/bnx2i, branch v3.4.71

SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload

2012-10-02T17:30:07+00:00

commit d6532207116307eb7ecbfa7b9e02c53230096a50 upstream.

This patch fixes the following kernel panic invoked by uninitialized fields
in the chip initialization for the 1G bnx2 iSCSI offload.

One of the bits in the chip initialization is being used by the latest
firmware to control overflow packets.  When this control bit gets enabled
erroneously, it would ultimately result in a bad packet placement which would
cause the bnx2 driver to dereference a NULL ptr in the placement handler.

This can happen under certain stress I/O environment under the Linux
iSCSI offload operation.

This change only affects Broadcom's 5709 chipset.

Unable to handle kernel NULL pointer dereference at 0000000000000008 RIP:
 [] :bnx2:bnx2_poll_work+0xd0d/0x13c5
Pid: 0, comm: swapper Tainted: G     ---- 2.6.18-333.el5debug #2
RIP: 0010:[]  [] :bnx2:bnx2_poll_work+0xd0d/0x13c5
RSP: 0018:ffff8101b575bd50  EFLAGS: 00010216
RAX: 0000000000000005 RBX: ffff81007c5fb180 RCX: 0000000000000000
RDX: 0000000000000ffc RSI: 00000000817e8000 RDI: 0000000000000220
RBP: ffff81015bbd7ec0 R08: ffff8100817e9000 R09: 0000000000000000
R10: ffff81007c5fb180 R11: 00000000000000c8 R12: 000000007a25a010
R13: 0000000000000000 R14: 0000000000000005 R15: ffff810159f80558
FS:  0000000000000000(0000) GS:ffff8101afebc240(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000008 CR3: 0000000000201000 CR4: 00000000000006a0
Process swapper (pid: 0, threadinfo ffff8101b5754000, task ffff8101afebd820)
Stack:  000000000000000b ffff810159f80000 0000000000000040 ffff810159f80520
 ffff810159f80500 00cf00cf8008e84b ffffc200100939e0 ffff810009035b20
 0000502900000000 000000be00000001 ffff8100817e7810 00d08101b575bea8
Call Trace:
   [] show_schedstat+0x1c2/0x25b
 [] :bnx2:bnx2_poll+0xf6/0x231
 [] net_rx_action+0xac/0x1b1
 [] __do_softirq+0x89/0x133
 [] call_softirq+0x1c/0x28
 [] do_softirq+0x2c/0x7d
 [] do_IRQ+0xee/0xf7
 [] ret_from_intr+0x0/0xa
   [] acpi_processor_idle_simple+0x1c5/0x341
 [] acpi_processor_idle_simple+0x182/0x341
 [] acpi_processor_idle_simple+0x0/0x341
 [] cpu_idle+0x95/0xb8
 [] start_secondary+0x479/0x488

Signed-off-by: Eddie Wai 
Reviewed-by: Mike Christie 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-03-23T17:07:16+00:00

Pull networking fixes from David Miller:

 1) L2TP doesn't get autoloaded when you try to open an L2TP socket due
    to a missing module alias, fix from Benjamin LaHaise.

 2) Netlabel and RDS should propagate gfp flags given to them by
    callers, fixes from Dan Carpeneter.

 3) Recursive locking fix in usbnet wasn't bulletproof and can result in
    objects going away mid-flight due to races, fix from Ming Lei.

 4) Fix up some confusion about a bool module parameter in netfilter's
    iptable_filter and ip6table_filter, from Rusty Russell.

 5) If SKB recycling is used via napi_reuse_skb() we end up with
    different amounts of headroom reserved than we had at the original
    SKB allocation.  Fix from Eric Dumazet.

 6) Fix races in TG3 driver ring refilling, from Michael Chan.

 7) We have callbacks for IPSEC replay notifiers, but some call sites
    were not using the ops method and instead were calling one of the
    implementations directly.  Oops.  Fix from Steffen Klassert.

 8) Fix IP address validation properly in the bonding driver, the
    previous fix only works with netlink where the subnet mask and IP
    address are changed in one atomic operation.  When 'ifconfig' ioctls
    are used the IP address and the subnet mask are changed in two
    distinct operations.  Fix from Andy Gospodarek.

 9) Provide a sky2 module operation to work around power management
    issues with some BIOSes.  From Stephen Hemminger.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  usbnet: consider device busy at each recieved packet
  bonding: remove entries for master_ip and vlan_ip and query devices instead
  netfilter: remove forward module param confusion.
  usbnet: don't clear urb->dev in tx_complete
  usbnet: increase URB reference count before usb_unlink_urb
  xfrm: Access the replay notify functions via the registered callbacks
  xfrm: Remove unused xfrm_state from xfrm_state_check_space
  RDS: use gfp flags from caller in conn_alloc()
  netlabel: use GFP flags from caller instead of GFP_ATOMIC
  l2tp: enable automatic module loading for l2tp_ppp
  cnic: Fix parity error code conflict
  tg3: Fix RSS ring refill race condition
  sky2: override for PCI legacy power management
  net: fix napi_reuse_skb() skb reserve

cnic: Fix parity error code conflict

2012-03-22T01:57:36+00:00

The recently added parity error handling used an error code that was
already defined for a different error.  This could lead to bnx2x
firmware assert.  We need to fix this with new error codes that are
defined for parity error only.

Signed-off-by: Michael Chan 
Reviewed-by: Eddie Wai 
Reviewed-by: Bhanu Prakash Gollapudi 
Signed-off-by: David S. Miller

[SCSI] bnx2i: Fixed the override of the error_mask module param

2012-02-19T14:09:01+00:00

The error_mask module param overrides has a bug which prevented
the new module param values to take effect.

Also changed the type attribute of the error_mask1/2 module params
from int to uint to allow the MSB to be set.

Signed-off-by: Eddie Wai 
Acked-by: Anil Veerabhadrappa 
Signed-off-by: James Bottomley

[SCSI] bnx2i: use kthread_create_on_node()

2012-02-19T14:09:01+00:00

bnx2i_percpu_thread_create() create per cpu kthread, and should use
proper NUMA aware API.

Signed-off-by: Eric Dumazet 
Acked-by: Eddie Wai 
Signed-off-by: James Bottomley

switch ->is_visible() to returning umode_t

2012-01-04T03:54:55+00:00

Signed-off-by: Al Viro

[SCSI] bnx2i: Fixed kernel panic caused by unprotected task->sc->request deref

2011-12-14T13:05:23+00:00

During session recovery, the conn_stop call will trigger a flush
to all outstanding SCSI cmds in the xmit queue.  This will set
all outstanding task->sc to NULL prior to the session_teardown
call which frees the task memory.

In the bnx2i SCSI response processing path, only the task was being checked
for NULL under the session lock before the task->sc->request dereferencing.
If there are outstanding SCSI cmd responses pending for process, the
following kernel panic can be exposed where task->sc was found to be NULL.

 Call Trace:
[   69.720205]  [] bnx2i_process_new_cqes+0x290/0x3c0 [bnx2i]
[   69.804289]  [] bnx2i_fastpath_notification+0x33/0xa0 [bnx2
i]
[   69.891490]  [] bnx2i_indicate_kcqe+0xdb/0x330 [bnx2i]
[   69.971427]  [] service_kcqes+0x16e/0x1d0 [cnic]
[   70.045132]  [] cnic_service_bnx2x_kcq+0x2a/0x50 [cnic]
[   70.126105]  [] cnic_service_bnx2x_bh+0x43/0x140 [cnic]
[   70.207081]  [] tasklet_action+0x66/0x110
[   70.273521]  [] __do_softirq+0xef/0x220
[   70.337887]  [] call_softirq+0x1c/0x30

This patch adds the !task->sc check and also protects the sc dereferencing
under the session lock.

Signed-off-by: Eddie Wai 
Signed-off-by: James Bottomley

Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6

2011-10-28T23:44:18+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (204 commits)
  [SCSI] qla4xxx: export address/port of connection (fix udev disk names)
  [SCSI] ipr: Fix BUG on adapter dump timeout
  [SCSI] megaraid_sas: Fix instance access in megasas_reset_timer
  [SCSI] hpsa: change confusing message to be more clear
  [SCSI] iscsi class: fix vlan configuration
  [SCSI] qla4xxx: fix data alignment and use nl helpers
  [SCSI] iscsi class: fix link local mispelling
  [SCSI] iscsi class: Replace iscsi_get_next_target_id with IDA
  [SCSI] aacraid: use lower snprintf() limit
  [SCSI] lpfc 8.3.27: Change driver version to 8.3.27
  [SCSI] lpfc 8.3.27: T10 additions for SLI4
  [SCSI] lpfc 8.3.27: Fix queue allocation failure recovery
  [SCSI] lpfc 8.3.27: Change algorithm for getting physical port name
  [SCSI] lpfc 8.3.27: Changed worst case mailbox timeout
  [SCSI] lpfc 8.3.27: Miscellanous logic and interface fixes
  [SCSI] megaraid_sas: Changelog and version update
  [SCSI] megaraid_sas: Add driver workaround for PERC5/1068 kdump kernel panic
  [SCSI] megaraid_sas: Add multiple MSI-X vector/multiple reply queue support
  [SCSI] megaraid_sas: Add support for MegaRAID 9360/9380 12GB/s controllers
  [SCSI] megaraid_sas: Clear FUSION_IN_RESET before enabling interrupts
  ...

Merge branch 'master' of github.com:davem330/net

2011-09-22T07:23:13+00:00

Conflicts:
	MAINTAINERS
	drivers/net/Kconfig
	drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
	drivers/net/ethernet/broadcom/tg3.c
	drivers/net/wireless/iwlwifi/iwl-pci.c
	drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
	drivers/net/wireless/rt2x00/rt2800usb.c
	drivers/net/wireless/wl12xx/main.c

[SCSI] bnx2i: Fixed the endian on TTT for NOP out transmission

2011-08-29T02:42:06+00:00

The iscsi_nopout task's TTT is defined as __be32 while the DMA
memory to the chip is CPU specific.  This creates a problem for
unsolicited NOP-In responses where the TTT is not the RESERVED
tag of 0xFFs.  This patch adds a call to be32_to_cpu for the TTT
specified.

Signed-off-by: Eddie Wai 
Signed-off-by: James Bottomley