linux-toradex.git/drivers/scsi/st.c, branch tegra-10.9.1

SCSI: st: fix mdata->page_order handling

2010-01-06T23:03:13+00:00

commit c982c368bb90adbd312faa05d0cfd842e9ab45a7 upstream.

dio transfer always resets mdata->page_order to zero. It breaks
high-order pages previously allocated for non-dio transfer.

This patches adds reserved_page_order to st_buffer structure to save
page order for non-dio transfer.

http://bugzilla.kernel.org/show_bug.cgi?id=14563

When enlarge_buffer() allocates 524288 from 0, st uses six-order page
allocation. So mdata->page_order is 6 and frp_seg is 2.

After that, if st uses dio, sgl_map_user_pages() sets
mdata->page_order to 0 for st_do_scsi(). After that, when we call
normalize_buffer(), it frees only free frp_seg * PAGE_SIZE (2 * 4096)
though we should free frp_seg * PAGE_SIZE << 6 (2 * 4096 << 6). So we
see buffer_size is set to 516096 (524288 - 8192).

Reported-by: Joachim Breuer 
Tested-by: Joachim Breuer 
Acked-by: Kai Makisara 
Signed-off-by: FUJITA Tomonori 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

[SCSI] st: fix possible memory use after free after MTSETBLK ioctl

2009-10-02T19:11:58+00:00

A memory use after free bug can manifest if the MTSETBLK or SET_DENS_AND_BLK
ioctl features are used to set the tape's blocksize from 0 to non-zero.
After the driver sets the new block size, in this one case it calls
normalize_buffer() to free the device's internal data buffers.  However, the
ioctl code assumes there is always a buffer and does not check or allocate
a buffer if there isn't one.  So any following ioctl calls can corrupt
a part of memory by writing data to memory that the st driver had freed.

This patch removes the normalize_buffer() call and the specialness of
changing from a 0 to non-zero blocksize to fix the possible use of
memory after it has been freed by the st driver.

signed-off-by: David Jeffery 
Acked-by: Kai Makisara 
Signed-off-by: James Bottomley

[SCSI] Merge branch 'linus'

2009-06-12T15:02:03+00:00

Conflicts:
	drivers/message/fusion/mptsas.c

fixed up conflict between req->data_len accessors and mptsas driver updates.

Signed-off-by: James Bottomley

[SCSI] st: fix gcc 4.4 warning

2009-05-23T20:44:06+00:00

This patch fixes the GCC 4.4 warning reported by David Binderman and Sergey
Senozhatsky. The old version was working correctly but was not easy to read.

Signed-off-by: Kai Makisara 
Signed-off-by: James Bottomley

block: Use accessor functions for queue limits

2009-05-22T21:22:54+00:00

Convert all external users of queue limits to using wrapper functions
instead of poking the request queue variables directly.

Signed-off-by: Martin K. Petersen 
Signed-off-by: Jens Axboe

block: add rq->resid_len

2009-05-11T07:50:53+00:00

rq->data_len served two purposes - the length of data buffer on issue
and the residual count on completion.  This duality creates some
headaches.

First of all, block layer and low level drivers can't really determine
what rq->data_len contains while a request is executing.  It could be
the total request length or it coulde be anything else one of the
lower layers is using to keep track of residual count.  This
complicates things because blk_rq_bytes() and thus
[__]blk_end_request_all() relies on rq->data_len for PC commands.
Drivers which want to report residual count should first cache the
total request length, update rq->data_len and then complete the
request with the cached data length.

Secondly, it makes requests default to reporting full residual count,
ie. reporting that no data transfer occurred.  The residual count is
an exception not the norm; however, the driver should clear
rq->data_len to zero to signify the normal cases while leaving it
alone means no data transfer occurred at all.  This reverse default
behavior complicates code unnecessarily and renders block PC on some
drivers (ide-tape/floppy) unuseable.

This patch adds rq->resid_len which is used only for residual count.

While at it, remove now unnecessasry blk_rq_bytes() caching in
ide_pc_intr() as rq->data_len is not changed anymore.

Boaz	: spotted missing conversion in osd
Sergei	: spotted too early conversion to blk_rq_bytes() in ide-tape

[ Impact: cleanup residual count handling, report 0 resid by default ]

Signed-off-by: Tejun Heo 
Cc: James Bottomley 
Cc: Bartlomiej Zolnierkiewicz 
Cc: Borislav Petkov 
Cc: Sergei Shtylyov 
Cc: Mike Miller 
Cc: Eric Moore 
Cc: Alan Stern 
Cc: FUJITA Tomonori 
Cc: Doug Gilbert 
Cc: Mike Miller 
Cc: Eric Moore 
Cc: Darrick J. Wong 
Cc: Pete Zaitcev 
Cc: Boaz Harrosh 
Signed-off-by: Jens Axboe

[SCSI] Remove SUGGEST flags

2009-03-12T17:58:02+00:00

The SUGGEST_* flags in the SCSI command result have been out of fashion
for a while and we don't actually use them in the error handling.
Remove the remaining occurrences.

Signed-off-by: Martin K. Petersen 
Signed-off-by: James Bottomley

[SCSI] st: retry enlarge_buffer allocation

2009-01-02T18:06:52+00:00

Make enlarge_buffer() retry allocation if the previously chosen page
order was too small. Really limit the page order to 6. Return error if
the maximum order is not large enough for the request.

Signed-off-by: Kai Makisara 
Signed-off-by: James Bottomley

[SCSI] st: integrate st_scsi_kern_execute and st_do_scsi

2009-01-02T18:06:33+00:00

This integrates st_scsi_kern_execute and st_do_scsi. IOW, it removes
st_scsi_kern_execute. Then st has a single function, st_do_scsi, to
perform SCSI commands.

Signed-off-by: Kai Makisara 
Signed-off-by: James Bottomley

[SCSI] st: remove unused frp_sg_current

2009-01-02T18:02:25+00:00

frp_sg_current in struct st_buffer is always zero. We don't need it.

Signed-off-by: FUJITA Tomonori 
Acked-by: Kai Makisara 
Signed-off-by: James Bottomley