<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/scsi, branch v3.2.26</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>libsas: fix sas_discover_devices return code handling</title>
<updated>2012-08-02T13:37:56+00:00</updated>
<author>
<name>Dan Williams</name>
<email>dan.j.williams@intel.com</email>
</author>
<published>2012-06-22T06:36:20+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=533c8ed12eea42986cb692c45c4c86512d1ca37d'/>
<id>533c8ed12eea42986cb692c45c4c86512d1ca37d</id>
<content type='text'>
commit b17caa174a7e1fd2e17b26e210d4ee91c4c28b37 upstream.

commit 198439e4 [SCSI] libsas: do not set res = 0 in sas_ex_discover_dev()
commit 19252de6 [SCSI] libsas: fix wide port hotplug issues

The above commits seem to have confused the return value of
sas_ex_discover_dev which is non-zero on failure and
sas_ex_join_wide_port which just indicates short circuiting discovery on
already established ports.  The result is random discovery failures
depending on configuration.

Calls to sas_ex_join_wide_port are the source of the trouble as its
return value is errantly assigned to 'res'.  Convert it to bool and stop
returning its result up the stack.

Tested-by: Dan Melnic &lt;dan.melnic@amd.com&gt;
Reported-by: Dan Melnic &lt;dan.melnic@amd.com&gt;
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
Reviewed-by: Jack Wang &lt;jack_wang@usish.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit b17caa174a7e1fd2e17b26e210d4ee91c4c28b37 upstream.

commit 198439e4 [SCSI] libsas: do not set res = 0 in sas_ex_discover_dev()
commit 19252de6 [SCSI] libsas: fix wide port hotplug issues

The above commits seem to have confused the return value of
sas_ex_discover_dev which is non-zero on failure and
sas_ex_join_wide_port which just indicates short circuiting discovery on
already established ports.  The result is random discovery failures
depending on configuration.

Calls to sas_ex_join_wide_port are the source of the trouble as its
return value is errantly assigned to 'res'.  Convert it to bool and stop
returning its result up the stack.

Tested-by: Dan Melnic &lt;dan.melnic@amd.com&gt;
Reported-by: Dan Melnic &lt;dan.melnic@amd.com&gt;
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
Reviewed-by: Jack Wang &lt;jack_wang@usish.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>libsas: continue revalidation</title>
<updated>2012-08-02T13:37:56+00:00</updated>
<author>
<name>Dan Williams</name>
<email>dan.j.williams@intel.com</email>
</author>
<published>2012-06-22T06:36:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=705c1a5ba71fc1fad9ed0f2fd15e31db2c623dfd'/>
<id>705c1a5ba71fc1fad9ed0f2fd15e31db2c623dfd</id>
<content type='text'>
commit 26f2f199ff150d8876b2641c41e60d1c92d2fb81 upstream.

Continue running revalidation until no more broadcast devices are
discovered.  Fixes cases where re-discovery completes too early in a
domain with multiple expanders with pending re-discovery events.
Servicing BCNs can get backed up behind error recovery.

Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 26f2f199ff150d8876b2641c41e60d1c92d2fb81 upstream.

Continue running revalidation until no more broadcast devices are
discovered.  Fixes cases where re-discovery completes too early in a
domain with multiple expanders with pending re-discovery events.
Servicing BCNs can get backed up behind error recovery.

Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>fix eh wakeup (scsi_schedule_eh vs scsi_restart_operations)</title>
<updated>2012-08-02T13:37:56+00:00</updated>
<author>
<name>Dan Williams</name>
<email>dan.j.williams@intel.com</email>
</author>
<published>2012-06-22T06:25:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c6e92669dd2703bd2243c2b16cd5a5283135151b'/>
<id>c6e92669dd2703bd2243c2b16cd5a5283135151b</id>
<content type='text'>
commit 57fc2e335fd3c2f898ee73570dc81426c28dc7b4 upstream.

Rapid ata hotplug on a libsas controller results in cases where libsas
is waiting indefinitely on eh to perform an ata probe.

A race exists between scsi_schedule_eh() and scsi_restart_operations()
in the case when scsi_restart_operations() issues i/o to other devices
in the sas domain.  When this happens the host state transitions from
SHOST_RECOVERY (set by scsi_schedule_eh) back to SHOST_RUNNING and
-&gt;host_busy is non-zero so we put the eh thread to sleep even though
-&gt;host_eh_scheduled is active.

Before putting the error handler to sleep we need to check if the
host_state needs to return to SHOST_RECOVERY for another trip through
eh.  Since i/o that is released by scsi_restart_operations has been
blocked for at least one eh cycle, this implementation allows those
i/o's to run before another eh cycle starts to discourage hung task
timeouts.

Reported-by: Tom Jackson &lt;thomas.p.jackson@intel.com&gt;
Tested-by: Tom Jackson &lt;thomas.p.jackson@intel.com&gt;
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 57fc2e335fd3c2f898ee73570dc81426c28dc7b4 upstream.

Rapid ata hotplug on a libsas controller results in cases where libsas
is waiting indefinitely on eh to perform an ata probe.

A race exists between scsi_schedule_eh() and scsi_restart_operations()
in the case when scsi_restart_operations() issues i/o to other devices
in the sas domain.  When this happens the host state transitions from
SHOST_RECOVERY (set by scsi_schedule_eh) back to SHOST_RUNNING and
-&gt;host_busy is non-zero so we put the eh thread to sleep even though
-&gt;host_eh_scheduled is active.

Before putting the error handler to sleep we need to check if the
host_state needs to return to SHOST_RECOVERY for another trip through
eh.  Since i/o that is released by scsi_restart_operations has been
blocked for at least one eh cycle, this implementation allows those
i/o's to run before another eh cycle starts to discourage hung task
timeouts.

Reported-by: Tom Jackson &lt;thomas.p.jackson@intel.com&gt;
Tested-by: Tom Jackson &lt;thomas.p.jackson@intel.com&gt;
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>fix hot unplug vs async scan race</title>
<updated>2012-08-02T13:37:55+00:00</updated>
<author>
<name>Dan Williams</name>
<email>dan.j.williams@intel.com</email>
</author>
<published>2012-06-22T06:47:28+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f60c4d00f7e25849c1e743cf66fde70bdac63dae'/>
<id>f60c4d00f7e25849c1e743cf66fde70bdac63dae</id>
<content type='text'>
commit 3b661a92e869ebe2358de8f4b3230ad84f7fce51 upstream.

The following crash results from cases where the end_device has been
removed before scsi_sysfs_add_sdev has had a chance to run.

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000098
 IP: [&lt;ffffffff8115e100&gt;] sysfs_create_dir+0x32/0xb6
 ...
 Call Trace:
  [&lt;ffffffff8125e4a8&gt;] kobject_add_internal+0x120/0x1e3
  [&lt;ffffffff81075149&gt;] ? trace_hardirqs_on+0xd/0xf
  [&lt;ffffffff8125e641&gt;] kobject_add_varg+0x41/0x50
  [&lt;ffffffff8125e70b&gt;] kobject_add+0x64/0x66
  [&lt;ffffffff8131122b&gt;] device_add+0x12d/0x63a
  [&lt;ffffffff814b65ea&gt;] ? _raw_spin_unlock_irqrestore+0x47/0x56
  [&lt;ffffffff8107de15&gt;] ? module_refcount+0x89/0xa0
  [&lt;ffffffff8132f348&gt;] scsi_sysfs_add_sdev+0x4e/0x28a
  [&lt;ffffffff8132dcbb&gt;] do_scan_async+0x9c/0x145

...teach scsi_sysfs_add_devices() to check for deleted devices() before
trying to add them, and teach scsi_remove_target() how to remove targets
that have not been added via device_add().

Reported-by: Dariusz Majchrzak &lt;dariusz.majchrzak@intel.com&gt;
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 3b661a92e869ebe2358de8f4b3230ad84f7fce51 upstream.

The following crash results from cases where the end_device has been
removed before scsi_sysfs_add_sdev has had a chance to run.

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000098
 IP: [&lt;ffffffff8115e100&gt;] sysfs_create_dir+0x32/0xb6
 ...
 Call Trace:
  [&lt;ffffffff8125e4a8&gt;] kobject_add_internal+0x120/0x1e3
  [&lt;ffffffff81075149&gt;] ? trace_hardirqs_on+0xd/0xf
  [&lt;ffffffff8125e641&gt;] kobject_add_varg+0x41/0x50
  [&lt;ffffffff8125e70b&gt;] kobject_add+0x64/0x66
  [&lt;ffffffff8131122b&gt;] device_add+0x12d/0x63a
  [&lt;ffffffff814b65ea&gt;] ? _raw_spin_unlock_irqrestore+0x47/0x56
  [&lt;ffffffff8107de15&gt;] ? module_refcount+0x89/0xa0
  [&lt;ffffffff8132f348&gt;] scsi_sysfs_add_sdev+0x4e/0x28a
  [&lt;ffffffff8132dcbb&gt;] do_scan_async+0x9c/0x145

...teach scsi_sysfs_add_devices() to check for deleted devices() before
trying to add them, and teach scsi_remove_target() how to remove targets
that have not been added via device_add().

Reported-by: Dariusz Majchrzak &lt;dariusz.majchrzak@intel.com&gt;
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Avoid dangling pointer in scsi_requeue_command()</title>
<updated>2012-08-02T13:37:55+00:00</updated>
<author>
<name>Bart Van Assche</name>
<email>bvanassche@acm.org</email>
</author>
<published>2012-06-29T15:34:26+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=09411e4280933eb335e1f723dc215a5583c3be8f'/>
<id>09411e4280933eb335e1f723dc215a5583c3be8f</id>
<content type='text'>
commit 940f5d47e2f2e1fa00443921a0abf4822335b54d upstream.

When we call scsi_unprep_request() the command associated with the request
gets destroyed and therefore drops its reference on the device.  If this was
the only reference, the device may get released and we end up with a NULL
pointer deref when we call blk_requeue_request.

Reported-by: Mike Christie &lt;michaelc@cs.wisc.edu&gt;
Signed-off-by: Bart Van Assche &lt;bvanassche@acm.org&gt;
Reviewed-by: Mike Christie &lt;michaelc@cs.wisc.edu&gt;
Reviewed-by: Tejun Heo &lt;tj@kernel.org&gt;
[jejb: enhance commend and add commit log for stable]
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 940f5d47e2f2e1fa00443921a0abf4822335b54d upstream.

When we call scsi_unprep_request() the command associated with the request
gets destroyed and therefore drops its reference on the device.  If this was
the only reference, the device may get released and we end up with a NULL
pointer deref when we call blk_requeue_request.

Reported-by: Mike Christie &lt;michaelc@cs.wisc.edu&gt;
Signed-off-by: Bart Van Assche &lt;bvanassche@acm.org&gt;
Reviewed-by: Mike Christie &lt;michaelc@cs.wisc.edu&gt;
Reviewed-by: Tejun Heo &lt;tj@kernel.org&gt;
[jejb: enhance commend and add commit log for stable]
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Fix device removal NULL pointer dereference</title>
<updated>2012-08-02T13:37:54+00:00</updated>
<author>
<name>Bart Van Assche</name>
<email>bvanassche@acm.org</email>
</author>
<published>2012-06-29T15:33:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=9c63d964e3f093b858a6f06875a68bc4206f71ba'/>
<id>9c63d964e3f093b858a6f06875a68bc4206f71ba</id>
<content type='text'>
commit 67bd94130015c507011af37858989b199c52e1de upstream.

Use blk_queue_dead() to test whether the queue is dead instead
of !sdev. Since scsi_prep_fn() may be invoked concurrently with
__scsi_remove_device(), keep the queuedata (sdev) pointer in
__scsi_remove_device(). This patch fixes a kernel oops that
can be triggered by USB device removal. See also
http://www.spinics.net/lists/linux-scsi/msg56254.html.

Other changes included in this patch:
- Swap the blk_cleanup_queue() and kfree() calls in
  scsi_host_dev_release() to make that code easier to grasp.
- Remove the queue dead check from scsi_run_queue() since the
  queue state can change anyway at any point in that function
  where the queue lock is not held.
- Remove the queue dead check from the start of scsi_request_fn()
  since it is redundant with the scsi_device_online() check.

Reported-by: Jun'ichi Nomura &lt;j-nomura@ce.jp.nec.com&gt;
Signed-off-by: Bart Van Assche &lt;bvanassche@acm.org&gt;
Reviewed-by: Mike Christie &lt;michaelc@cs.wisc.edu&gt;
Reviewed-by: Tejun Heo &lt;tj@kernel.org&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 67bd94130015c507011af37858989b199c52e1de upstream.

Use blk_queue_dead() to test whether the queue is dead instead
of !sdev. Since scsi_prep_fn() may be invoked concurrently with
__scsi_remove_device(), keep the queuedata (sdev) pointer in
__scsi_remove_device(). This patch fixes a kernel oops that
can be triggered by USB device removal. See also
http://www.spinics.net/lists/linux-scsi/msg56254.html.

Other changes included in this patch:
- Swap the blk_cleanup_queue() and kfree() calls in
  scsi_host_dev_release() to make that code easier to grasp.
- Remove the queue dead check from scsi_run_queue() since the
  queue state can change anyway at any point in that function
  where the queue lock is not held.
- Remove the queue dead check from the start of scsi_request_fn()
  since it is redundant with the scsi_device_online() check.

Reported-by: Jun'ichi Nomura &lt;j-nomura@ce.jp.nec.com&gt;
Signed-off-by: Bart Van Assche &lt;bvanassche@acm.org&gt;
Reviewed-by: Mike Christie &lt;michaelc@cs.wisc.edu&gt;
Reviewed-by: Tejun Heo &lt;tj@kernel.org&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Fix NULL dereferences in scsi_cmd_to_driver</title>
<updated>2012-08-02T13:37:37+00:00</updated>
<author>
<name>Mark Rustad</name>
<email>mark.d.rustad@intel.com</email>
</author>
<published>2012-06-21T19:23:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2b2c3e47f0a98261d5d6ab7f61420fb4e479b472'/>
<id>2b2c3e47f0a98261d5d6ab7f61420fb4e479b472</id>
<content type='text'>
commit 222a806af830fda34ad1f6bc991cd226916de060 upstream.

Avoid crashing if the private_data pointer happens to be NULL. This has
been seen sometimes when a host reset happens, notably when there are
many LUNs:

host3: Assigned Port ID 0c1601
scsi host3: libfc: Host reset succeeded on port (0c1601)
BUG: unable to handle kernel NULL pointer dereference at 0000000000000350
IP: [&lt;ffffffff81352bb8&gt;] scsi_send_eh_cmnd+0x58/0x3a0
&lt;snip&gt;
Process scsi_eh_3 (pid: 4144, threadinfo ffff88030920c000, task ffff880326b160c0)
Stack:
 000000010372e6ba 0000000000000282 000027100920dca0 ffffffffa0038ee0
 0000000000000000 0000000000030003 ffff88030920dc80 ffff88030920dc80
 00000002000e0000 0000000a00004000 ffff8803242f7760 ffff88031326ed80
Call Trace:
 [&lt;ffffffff8105b590&gt;] ? lock_timer_base+0x70/0x70
 [&lt;ffffffff81352fbe&gt;] scsi_eh_tur+0x3e/0xc0
 [&lt;ffffffff81353a36&gt;] scsi_eh_test_devices+0x76/0x170
 [&lt;ffffffff81354125&gt;] scsi_eh_host_reset+0x85/0x160
 [&lt;ffffffff81354291&gt;] scsi_eh_ready_devs+0x91/0x110
 [&lt;ffffffff813543fd&gt;] scsi_unjam_host+0xed/0x1f0
 [&lt;ffffffff813546a8&gt;] scsi_error_handler+0x1a8/0x200
 [&lt;ffffffff81354500&gt;] ? scsi_unjam_host+0x1f0/0x1f0
 [&lt;ffffffff8106ec3e&gt;] kthread+0x9e/0xb0
 [&lt;ffffffff81509264&gt;] kernel_thread_helper+0x4/0x10
 [&lt;ffffffff8106eba0&gt;] ? kthread_freezable_should_stop+0x70/0x70
 [&lt;ffffffff81509260&gt;] ? gs_change+0x13/0x13
Code: 25 28 00 00 00 48 89 45 c8 31 c0 48 8b 87 80 00 00 00 48 8d b5 60 ff ff ff 89 d1 48 89 fb 41 89 d6 4c 89 fa 48 8b 80 b8 00 00 00
 &lt;48&gt; 8b 80 50 03 00 00 48 8b 00 48 89 85 38 ff ff ff 48 8b 07 4c
RIP  [&lt;ffffffff81352bb8&gt;] scsi_send_eh_cmnd+0x58/0x3a0
 RSP &lt;ffff88030920dc50&gt;
CR2: 0000000000000350

Signed-off-by: Mark Rustad &lt;mark.d.rustad@intel.com&gt;
Tested-by: Marcus Dennis &lt;marcusx.e.dennis@intel.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 222a806af830fda34ad1f6bc991cd226916de060 upstream.

Avoid crashing if the private_data pointer happens to be NULL. This has
been seen sometimes when a host reset happens, notably when there are
many LUNs:

host3: Assigned Port ID 0c1601
scsi host3: libfc: Host reset succeeded on port (0c1601)
BUG: unable to handle kernel NULL pointer dereference at 0000000000000350
IP: [&lt;ffffffff81352bb8&gt;] scsi_send_eh_cmnd+0x58/0x3a0
&lt;snip&gt;
Process scsi_eh_3 (pid: 4144, threadinfo ffff88030920c000, task ffff880326b160c0)
Stack:
 000000010372e6ba 0000000000000282 000027100920dca0 ffffffffa0038ee0
 0000000000000000 0000000000030003 ffff88030920dc80 ffff88030920dc80
 00000002000e0000 0000000a00004000 ffff8803242f7760 ffff88031326ed80
Call Trace:
 [&lt;ffffffff8105b590&gt;] ? lock_timer_base+0x70/0x70
 [&lt;ffffffff81352fbe&gt;] scsi_eh_tur+0x3e/0xc0
 [&lt;ffffffff81353a36&gt;] scsi_eh_test_devices+0x76/0x170
 [&lt;ffffffff81354125&gt;] scsi_eh_host_reset+0x85/0x160
 [&lt;ffffffff81354291&gt;] scsi_eh_ready_devs+0x91/0x110
 [&lt;ffffffff813543fd&gt;] scsi_unjam_host+0xed/0x1f0
 [&lt;ffffffff813546a8&gt;] scsi_error_handler+0x1a8/0x200
 [&lt;ffffffff81354500&gt;] ? scsi_unjam_host+0x1f0/0x1f0
 [&lt;ffffffff8106ec3e&gt;] kthread+0x9e/0xb0
 [&lt;ffffffff81509264&gt;] kernel_thread_helper+0x4/0x10
 [&lt;ffffffff8106eba0&gt;] ? kthread_freezable_should_stop+0x70/0x70
 [&lt;ffffffff81509260&gt;] ? gs_change+0x13/0x13
Code: 25 28 00 00 00 48 89 45 c8 31 c0 48 8b 87 80 00 00 00 48 8d b5 60 ff ff ff 89 d1 48 89 fb 41 89 d6 4c 89 fa 48 8b 80 b8 00 00 00
 &lt;48&gt; 8b 80 50 03 00 00 48 8b 00 48 89 85 38 ff ff ff 48 8b 07 4c
RIP  [&lt;ffffffff81352bb8&gt;] scsi_send_eh_cmnd+0x58/0x3a0
 RSP &lt;ffff88030920dc50&gt;
CR2: 0000000000000350

Signed-off-by: Mark Rustad &lt;mark.d.rustad@intel.com&gt;
Tested-by: Marcus Dennis &lt;marcusx.e.dennis@intel.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>libsas: fix taskfile corruption in sas_ata_qc_fill_rtf</title>
<updated>2012-07-25T03:11:12+00:00</updated>
<author>
<name>Dan Williams</name>
<email>dan.j.williams@intel.com</email>
</author>
<published>2012-06-22T17:52:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=cb480c94c8e89014cdb54201a413bf9d36f6cd41'/>
<id>cb480c94c8e89014cdb54201a413bf9d36f6cd41</id>
<content type='text'>
commit 6ef1b512f4e6f936d89aa20be3d97a7ec7c290ac upstream.

fill_result_tf() grabs the taskfile flags from the originating qc which
sas_ata_qc_fill_rtf() promptly overwrites.  The presence of an
ata_taskfile in the sata_device makes it tempting to just copy the full
contents in sas_ata_qc_fill_rtf().  However, libata really only wants
the fis contents and expects the other portions of the taskfile to not
be touched by -&gt;qc_fill_rtf.  To that end store a fis buffer in the
sata_device and use ata_tf_from_fis() like every other -&gt;qc_fill_rtf()
implementation.

Reported-by: Praveen Murali &lt;pmurali@logicube.com&gt;
Tested-by: Praveen Murali &lt;pmurali@logicube.com&gt;
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 6ef1b512f4e6f936d89aa20be3d97a7ec7c290ac upstream.

fill_result_tf() grabs the taskfile flags from the originating qc which
sas_ata_qc_fill_rtf() promptly overwrites.  The presence of an
ata_taskfile in the sata_device makes it tempting to just copy the full
contents in sas_ata_qc_fill_rtf().  However, libata really only wants
the fis contents and expects the other portions of the taskfile to not
be touched by -&gt;qc_fill_rtf.  To that end store a fis buffer in the
sata_device and use ata_tf_from_fis() like every other -&gt;qc_fill_rtf()
implementation.

Reported-by: Praveen Murali &lt;pmurali@logicube.com&gt;
Tested-by: Praveen Murali &lt;pmurali@logicube.com&gt;
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>mpt2sas: Fix unsafe using smp_processor_id() in preemptible</title>
<updated>2012-06-19T22:18:14+00:00</updated>
<author>
<name>nagalakshmi.nandigama@lsi.com</name>
<email>nagalakshmi.nandigama@lsi.com</email>
</author>
<published>2012-04-17T05:55:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=b3f92ffcf17680fc2064962c41debb424a2be403'/>
<id>b3f92ffcf17680fc2064962c41debb424a2be403</id>
<content type='text'>
commit a2c658505bf5c75516ee0a79287223e86a2474af upstream.

When CONFIG_DEBUG_PREEMPT is enabled, bug is observed in the smp_processor_id().
This is because smp_processor_id() is not called in preempt safe condition.

To fix this issue, use raw_smp_processor_id instead of smp_processor_id.

Signed-off-by: Nagalakshmi Nandigama &lt;nagalakshmi.nandigama@lsi.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit a2c658505bf5c75516ee0a79287223e86a2474af upstream.

When CONFIG_DEBUG_PREEMPT is enabled, bug is observed in the smp_processor_id().
This is because smp_processor_id() is not called in preempt safe condition.

To fix this issue, use raw_smp_processor_id instead of smp_processor_id.

Signed-off-by: Nagalakshmi Nandigama &lt;nagalakshmi.nandigama@lsi.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>fix scsi_wait_scan</title>
<updated>2012-06-10T13:41:47+00:00</updated>
<author>
<name>James Bottomley</name>
<email>jbottomley@parallels.com</email>
</author>
<published>2012-05-30T09:45:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=fd680782af2f335685fb30c87b52fbebf3d224e7'/>
<id>fd680782af2f335685fb30c87b52fbebf3d224e7</id>
<content type='text'>
commit 1ff2f40305772b159a91c19590ee159d3a504afc upstream.

Commit  c751085943362143f84346d274e0011419c84202
Author: Rafael J. Wysocki &lt;rjw@sisk.pl&gt;
Date:   Sun Apr 12 20:06:56 2009 +0200

    PM/Hibernate: Wait for SCSI devices scan to complete during resume

Broke the scsi_wait_scan module in 2.6.30.  Apparently debian still uses it so
fix it and backport to stable before removing it in 3.6.

The breakage is caused because the function template in
include/scsi/scsi_scan.h is defined to be a nop unless SCSI is built in.
That means that in the modular case (which is every distro), the
scsi_wait_scan module does a simple async_synchronize_full() instead of
waiting for scans.

Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 1ff2f40305772b159a91c19590ee159d3a504afc upstream.

Commit  c751085943362143f84346d274e0011419c84202
Author: Rafael J. Wysocki &lt;rjw@sisk.pl&gt;
Date:   Sun Apr 12 20:06:56 2009 +0200

    PM/Hibernate: Wait for SCSI devices scan to complete during resume

Broke the scsi_wait_scan module in 2.6.30.  Apparently debian still uses it so
fix it and backport to stable before removing it in 3.6.

The breakage is caused because the function template in
include/scsi/scsi_scan.h is defined to be a nop unless SCSI is built in.
That means that in the modular case (which is every distro), the
scsi_wait_scan module does a simple async_synchronize_full() instead of
waiting for scans.

Signed-off-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
</feed>
