linux-toradex.git/drivers/scsi, branch v4.17

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2018-06-02T22:54:49+00:00

Pull SCSI fix from James Bottomley:
 "Eve of merge window fix: The original code was so bogus as to be
  casting the wrong generic device to an rport and proceeding to take
  actions based on the bogus values it found.

  Fortunately it seems the location that is dereferenced always exists,
  so the code hasn't oopsed yet, but it certainly annoys the memory
  checkers"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: scsi_transport_srp: Fix shost to rport translation

scsi: scsi_transport_srp: Fix shost to rport translation

2018-05-29T01:23:38+00:00

Since an SRP remote port is attached as a child to shost->shost_gendev
and as the only child, the translation from the shost pointer into an
rport pointer must happen by looking up the shost child that is an
rport. This patch fixes the following KASAN complaint:

BUG: KASAN: slab-out-of-bounds in srp_timed_out+0x57/0x110 [scsi_transport_srp]
Read of size 4 at addr ffff880035d3fcc0 by task kworker/1:0H/19

CPU: 1 PID: 19 Comm: kworker/1:0H Not tainted 4.16.0-rc3-dbg+ #1
Workqueue: kblockd blk_mq_timeout_work
Call Trace:
dump_stack+0x85/0xc7
print_address_description+0x65/0x270
kasan_report+0x231/0x350
srp_timed_out+0x57/0x110 [scsi_transport_srp]
scsi_times_out+0xc7/0x3f0 [scsi_mod]
blk_mq_terminate_expired+0xc2/0x140
bt_iter+0xbc/0xd0
blk_mq_queue_tag_busy_iter+0x1c7/0x350
blk_mq_timeout_work+0x325/0x3f0
process_one_work+0x441/0xa50
worker_thread+0x76/0x6c0
kthread+0x1b2/0x1d0
ret_from_fork+0x24/0x30

Fixes: e68ca75200fe ("scsi_transport_srp: Reduce failover time")
Signed-off-by: Bart Van Assche 
Cc: Hannes Reinecke 
Cc: Johannes Thumshirn 
Cc: Jason Gunthorpe 
Cc: Doug Ledford 
Cc: Laurence Oberman 
Cc: stable@vger.kernel.org
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen

Merge tag 'for-linus-20180524' of git://git.kernel.dk/linux-block

2018-05-24T15:53:20+00:00

Pull block fixes from Jens Axboe:
 "Two fixes that should go into this release:

   - a loop writeback error clearing fix from Jeff

   - the sr sense fix from myself"

* tag 'for-linus-20180524' of git://git.kernel.dk/linux-block:
  loop: clear wb_err in bd_inode when detaching backing file
  sr: pass down correctly sized SCSI sense buffer

sr: pass down correctly sized SCSI sense buffer

2018-05-21T18:21:14+00:00

We're casting the CDROM layer request_sense to the SCSI sense
buffer, but the former is 64 bytes and the latter is 96 bytes.
As we generally allocate these on the stack, we end up blowing
up the stack.

Fix this by wrapping the scsi_execute() call with a properly
sized sense buffer, and copying back the bits for the CDROM
layer.

Cc: stable@vger.kernel.org
Reported-by: Piotr Gabriel Kosinski 
Reported-by: Daniel Shapira 
Tested-by: Kees Cook 
Fixes: 82ed4db499b8 ("block: split scsi_request out of struct request")
Signed-off-by: Jens Axboe

scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()

2018-05-18T14:26:01+00:00

This shall help avoid copying uninitialized memory to the userspace when
calling ioctl(fd, SG_IO) with an empty command.

Reported-by: syzbot+7d26fc1eea198488deab@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Potapenko 
Acked-by: Douglas Gilbert 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen

scsi: core: clean up generated file scsi_devinfo_tbl.c

2018-05-15T02:48:03+00:00

"make clean" should remove the generated file "scsi_devinfo_tbl.c", so
list it in the clean-files variable so that the file gets cleaned up.

Fixes: 345e29608b4b ("scsi: scsi: Export blacklist flags to sysfs")
Cc: Hannes Reinecke 
Signed-off-by: Randy Dunlap 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Martin K. Petersen

scsi: aacraid: Correct hba_send to include iu_type

2018-05-02T03:27:18+00:00

commit b60710ec7d7a ("scsi: aacraid: enable sending of TMFs from
aac_hba_send()") allows aac_hba_send() to send scsi commands, and TMF
requests, but the existing code only updates the iu_type for scsi
commands. For TMF requests we are sending an unknown iu_type to
firmware, which causes a fault.

Include iu_type prior to determining the validity of the command

Reported-by: Noah Misner 
Fixes: b60710ec7d7ab ("aacraid: enable sending of TMFs from aac_hba_send()")
Fixes: 423400e64d377 ("aacraid: Include HBA direct interface")
Tested-by: Noah Misner 
cc: stable@vger.kernel.org
Signed-off-by: Dave Carroll 
Reviewed-by: Raghava Aditya Renukunta 
Reviewed-by: Brian King 
Signed-off-by: Martin K. Petersen

scsi: vmw-pvscsi: return DID_BUS_BUSY for adapter-initated aborts

2018-05-02T03:15:40+00:00

The vmw_pvscsi driver returns DID_ABORT for commands aborted internally
by the adapter, leading to the filesystem going read-only. Change the
result to DID_BUS_BUSY, causing the kernel to retry the command.

Signed-off-by: Jim Gill 
Signed-off-by: Martin K. Petersen

scsi: isci: Fix infinite loop in while loop

2018-04-20T23:23:32+00:00

In the case when the phy_mask is bitwise anded with the phy_index bit is
zero the continue statement currently jumps to the next iteration of the
while loop and phy_index is never actually incremented, potentially
causing an infinite loop if phy_index is less than SCI_MAX_PHS. Fix this
by turning the while loop into a for loop.

Signed-off-by: Colin Ian King 
Signed-off-by: Martin K. Petersen

scsi: storvsc: Set up correct queue depth values for IDE devices

2018-04-20T19:36:02+00:00

Unlike SCSI and FC, we don't use multiple channels for IDE.  Also fix
the calculation for sub-channels.

Signed-off-by: Long Li 
Reviewed-by: Michael Kelley 
Signed-off-by: Martin K. Petersen