linux-toradex.git/drivers/usb/storage/uas.c, branch v4.9.65

USB: uas: fix bug in handling of alternate settings

2017-10-12T09:51:17+00:00

commit 786de92b3cb26012d3d0f00ee37adf14527f35c4 upstream.

The uas driver has a subtle bug in the way it handles alternate
settings.  The uas_find_uas_alt_setting() routine returns an
altsetting value (the bAlternateSetting number in the descriptor), but
uas_use_uas_driver() then treats that value as an index to the
intf->altsetting array, which it isn't.

Normally this doesn't cause any problems because the various
alternate settings have bAlternateSetting values 0, 1, 2, ..., so the
value is equal to the index in the array.  But this is not guaranteed,
and Andrey Konovalov used the syzkaller fuzzer with KASAN to get a
slab-out-of-bounds error by violating this assumption.

This patch fixes the bug by making uas_find_uas_alt_setting() return a
pointer to the altsetting entry rather than either the value or the
index.  Pointers are less subject to misinterpretation.

Signed-off-by: Alan Stern 
Reported-by: Andrey Konovalov 
Tested-by: Andrey Konovalov 
CC: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman

USB: uas: Fix slave queue_depth not being set

2016-06-01T21:56:24+00:00

Commit 198de51dbc34 ("USB: uas: Limit qdepth at the scsi-host level")
removed the scsi_change_queue_depth() call from uas_slave_configure()
assuming that the slave would inherit the host's queue_depth, which
that commit sets to the same value.

This is incorrect, without the scsi_change_queue_depth() call the slave's
queue_depth defaults to 1, introducing a performance regression.

This commit restores the call, fixing the performance regression.

Cc: stable@vger.kernel.org
Fixes: 198de51dbc34 ("USB: uas: Limit qdepth at the scsi-host level")
Reported-by: Tom Yan 
Signed-off-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman

uas: remove can_queue set in host template

2016-06-01T21:56:24+00:00

Commit 198de51dbc34 ("USB: uas: Limit qdepth at the scsi-host level") made
qdepth limit set in host template (`.can_queue = MAX_CMNDS`) redundant.
Removing it to avoid confusion.

Signed-off-by: Tom Yan 
Acked-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman

usb: storage: fix multi-line comment style

2016-04-26T22:04:38+00:00

No functional changes here, just making sure our
storage driver uses a consistent multi-line comment
style.

Signed-off-by: Felipe Balbi 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: uas: Add a new NO_REPORT_LUNS quirk

2016-04-13T19:02:28+00:00

Add a new NO_REPORT_LUNS quirk and set it for Seagate drives with
an usb-id of: 0bc2:331a, as these will fail to respond to a
REPORT_LUNS command.

Cc: stable@vger.kernel.org
Reported-and-tested-by: David Webb 
Signed-off-by: Hans de Goede 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: uas: Limit qdepth at the scsi-host level

2016-04-13T19:02:28+00:00

Commit 64d513ac31bd ("scsi: use host wide tags by default") causes
the SCSI core to queue more commands then we can handle on devices with
multiple LUNs, limit the queue depth at the scsi-host level instead of
per slave to fix this.

BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1315013
Cc: stable@vger.kernel.org # 4.4.x and 4.5.x
Signed-off-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman

USB: uas: Reduce can_queue to MAX_CMNDS

2016-03-18T16:19:02+00:00

The uas driver can never queue more then MAX_CMNDS (- 1) tags and tags
are shared between luns, so there is no need to claim that we can_queue
some random large number.

Not claiming that we can_queue 65536 commands, fixes the uas driver
failing to initialize while allocating the tag map with a "Page allocation
failure (order 7)" error on systems which have been running for a while
and thus have fragmented memory.

Cc: stable@vger.kernel.org
Reported-and-tested-by: Yves-Alexis Perez 
Signed-off-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman

USB: uas: add full support for RESPONSE IU

2016-01-25T05:00:33+00:00

Some devices send response IUs when you'd expect a sense IU.
As a response to a wrong LUN that is within spec.
We cannot get away without handling for response IUs.
This version fixes the issues Hans raised.

Signed-off-by: Oliver Neukum 
Reviewed-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman

Merge 4.4-rc5 into usb-next as we want those fixes here for testing

2015-12-14T03:20:27+00:00

Signed-off-by: Greg Kroah-Hartman

uas: no gfp argument to uas_submit_urbs()

2015-12-01T22:29:21+00:00

This function must be called with a spinlock held.
Memory can be allocated only with GFP_ATOMIC. Passing
a gfp_t argument is a waste.

Signed-off-by: Oliver Neukum 
Reviewed-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman