1. 10 4月, 2018 12 次提交
    • D
      scsi: dpt_i2o: Use after free in I2ORESETCMD ioctl · 7709e9bd
      Dan Carpenter 提交于
      Here is another use after free if we reset the card.  The adpt_hba_reset()
      function frees "pHba" on error.
      Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      7709e9bd
    • B
      scsi: core: Make scsi_result_to_blk_status() recognize CONDITION MET · f4abab3f
      Bart Van Assche 提交于
      Ensure that CONDITION MET and other non-zero status values that indicate
      success are translated into BLK_STS_OK.
      Signed-off-by: NBart Van Assche <bart.vanassche@wdc.com>
      Cc: Hannes Reinecke <hare@suse.com>
      Cc: Douglas Gilbert <dgilbert@interlog.com>
      Cc: Damien Le Moal <damien.lemoal@wdc.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Lee Duncan <lduncan@suse.com>
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Reviewed-by: NHannes Reinecke <hare@suse.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      f4abab3f
    • B
      scsi: core: Rename __scsi_error_from_host_byte() into scsi_result_to_blk_status() · a77b32d8
      Bart Van Assche 提交于
      Since the next patch will modify this function such that it checks more than
      just the host byte of the SCSI result, rename __scsi_error_from_host_byte()
      into scsi_result_to_blk_status().  This patch does not change any
      functionality.
      Signed-off-by: NBart Van Assche <bart.vanassche@wdc.com>
      Cc: Hannes Reinecke <hare@suse.com>
      Cc: Douglas Gilbert <dgilbert@interlog.com>
      Cc: Damien Le Moal <damien.lemoal@wdc.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Lee Duncan <lduncan@suse.com>
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Reviewed-by: NHannes Reinecke <hare@suse.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      a77b32d8
    • B
      Revert "scsi: core: return BLK_STS_OK for DID_OK in __scsi_error_from_host_byte()" · cbe095e2
      Bart Van Assche 提交于
      The description of commit e39a9735 is wrong: it mentions that commit
      2a842aca introduced a bug in __scsi_error_from_host_byte() although that
      commit did not change the behavior of that function.  Additionally, commit
      e39a9735 introduced a bug: it causes commands that fail with
      hostbyte=DID_OK and driverbyte=DRIVER_SENSE to be completed with
      BLK_STS_OK. Hence revert that commit.
      
      Fixes: e39a9735 ("scsi: core: return BLK_STS_OK for DID_OK in __scsi_error_from_host_byte()")
      Reported-by: NDamien Le Moal <damien.lemoal@wdc.com>
      Signed-off-by: NBart Van Assche <bart.vanassche@wdc.com>
      Cc: Hannes Reinecke <hare@suse.com>
      Cc: Douglas Gilbert <dgilbert@interlog.com>
      Cc: Damien Le Moal <damien.lemoal@wdc.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Lee Duncan <lduncan@suse.com>
      Cc: stable@vger.kernel.org
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Reviewed-by: NHannes Reinecke <hare@suse.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      cbe095e2
    • D
      scsi: aacraid: Insure command thread is not recursively stopped · 1c6b41fb
      Dave Carroll 提交于
      If a recursive IOP_RESET is invoked, usually due to the eh_thread
      handling errors after the first reset, be sure we flag that the command
      thread has been stopped to avoid an Oops of the form;
      
       [ 336.620256] CPU: 28 PID: 1193 Comm: scsi_eh_0 Kdump: loaded Not tainted 4.14.0-49.el7a.ppc64le #1
       [ 336.620297] task: c000003fd630b800 task.stack: c000003fd61a4000
       [ 336.620326] NIP: c000000000176794 LR: c00000000013038c CTR: c00000000024bc10
       [ 336.620361] REGS: c000003fd61a7720 TRAP: 0300 Not tainted (4.14.0-49.el7a.ppc64le)
       [ 336.620395] MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 22084022 XER: 20040000
       [ 336.620435] CFAR: c000000000130388 DAR: 0000000000000000 DSISR: 40000000 SOFTE: 1
       [ 336.620435] GPR00: c00000000013038c c000003fd61a79a0 c0000000014c7e00 0000000000000000
       [ 336.620435] GPR04: 000000000000000c 000000000000000c 9000000000009033 0000000000000477
       [ 336.620435] GPR08: 0000000000000477 0000000000000000 0000000000000000 c008000010f7d940
       [ 336.620435] GPR12: c00000000024bc10 c000000007a33400 c0000000001708a8 c000003fe3b881d8
       [ 336.620435] GPR16: c000003fe3b88060 c000003fd61a7d10 fffffffffffff000 000000000000001e
       [ 336.620435] GPR20: 0000000000000001 c000000000ebf1a0 0000000000000001 c000003fe3b88000
       [ 336.620435] GPR24: 0000000000000003 0000000000000002 c000003fe3b88840 c000003fe3b887e8
       [ 336.620435] GPR28: c000003fe3b88000 c000003fc8181788 0000000000000000 c000003fc8181700
       [ 336.620750] NIP [c000000000176794] exit_creds+0x34/0x160
       [ 336.620775] LR [c00000000013038c] __put_task_struct+0x8c/0x1f0
       [ 336.620804] Call Trace:
       [ 336.620817] [c000003fd61a79a0] [c000003fe3b88000] 0xc000003fe3b88000 (unreliable)
       [ 336.620853] [c000003fd61a79d0] [c00000000013038c] __put_task_struct+0x8c/0x1f0
       [ 336.620889] [c000003fd61a7a00] [c000000000171418] kthread_stop+0x1e8/0x1f0
       [ 336.620922] [c000003fd61a7a40] [c008000010f7448c] aac_reset_adapter+0x14c/0x8d0 [aacraid]
       [ 336.620959] [c000003fd61a7b00] [c008000010f60174] aac_eh_host_reset+0x84/0x100 [aacraid]
       [ 336.621010] [c000003fd61a7b30] [c000000000864f24] scsi_try_host_reset+0x74/0x180
       [ 336.621046] [c000003fd61a7bb0] [c000000000867ac0] scsi_eh_ready_devs+0xc00/0x14d0
       [ 336.625165] [c000003fd61a7ca0] [c0000000008699e0] scsi_error_handler+0x550/0x730
       [ 336.632101] [c000003fd61a7dc0] [c000000000170a08] kthread+0x168/0x1b0
       [ 336.639031] [c000003fd61a7e30] [c00000000000b528] ret_from_kernel_thread+0x5c/0xb4
       [ 336.645971] Instruction dump:
       [ 336.648743] 384216a0 7c0802a6 fbe1fff8 f8010010 f821ffd1 7c7f1b78 60000000 60000000
       [ 336.657056] 39400000 e87f0838 f95f0838 7c0004ac <7d401828> 314affff 7d40192d 40c2fff4
       [ 336.663997] -[ end trace 4640cf8d4945ad95 ]-
      
      So flag when the thread is stopped by setting the thread pointer to NULL.
      Signed-off-by: NDave Carroll <david.carroll@microsemi.com>
      Reviewed-by: NRaghava Aditya Renukunta <raghavaaditya.renukunta@microsemi.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      1c6b41fb
    • J
      scsi: qla2xxx: Correct setting of SAM_STAT_CHECK_CONDITION · 584d7aad
      Johannes Thumshirn 提交于
      Bart reports that in qla_isr.c's qla2x00_handle_dif_error we're wrongly
      shifting the SAM_STAT_CHECK_CONDITION by one instead of directly ORing it
      onto the SCSI command's result.
      Signed-off-by: NJohannes Thumshirn <jthumshirn@suse.de>
      Reported-by: NBart Van Assche <Bart.VanAssche@wdc.com>
      Cc: Himanshu Madhani <himanshu.madhani@cavium.com>
      Reviewed-by: NHannes Reinecke <hare@suse.com>
      Reviewed-by: NBart Van Assche <bart.vanassche@wdc.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      584d7aad
    • J
      scsi: qla2xxx: correctly shift host byte · f7d5182c
      Johannes Thumshirn 提交于
      The SCSI host byte has to be shifted by 16 not 6.
      
      As Bart pointed out this patch does not change any functionality because
      DID_OK == 0, but a wrong shift is irritating for the reviewer.
      Signed-off-by: NJohannes Thumshirn <jthumshirn@suse.de>
      Reviewed-by: NBart Van Assche <bart.vanassche@wdc.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      f7d5182c
    • B
      scsi: qla2xxx: Fix race condition between iocb timeout and initialisation · e74e7d95
      Ben Hutchings 提交于
      qla2x00_init_timer() calls add_timer() on the iocb timeout timer, which
      means the timeout function pointer and any data that the function depends on
      must be initialised beforehand.
      
      Move this initialisation before each call to qla2x00_init_timer().  In some
      cases qla2x00_init_timer() initialises a completion structure needed by the
      timeout function, so move the call to add_timer() after that.
      Signed-off-by: NBen Hutchings <ben.hutchings@codethink.co.uk>
      Acked-by: NHimanshu Madhani <himanshu.madhani@cavium.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      e74e7d95
    • B
      scsi: qla2xxx: Avoid double completion of abort command · 3a9910d7
      Ben Hutchings 提交于
      qla2x00_tmf_sp_done() now deletes the timer that will run
      qla2x00_tmf_iocb_timeout(), but doesn't check whether the timer already
      expired.  Check the return value from del_timer() to avoid calling
      complete() a second time.
      
      Fixes: 4440e46d ("[SCSI] qla2xxx: Add IOCB Abort command asynchronous ...")
      Fixes: 1514839b ("scsi: qla2xxx: Fix NULL pointer crash due to active ...")
      Signed-off-by: NBen Hutchings <ben.hutchings@codethink.co.uk>
      Acked-by: NHimanshu Madhani <himanshu.madhani@cavium.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      3a9910d7
    • B
      scsi: qla2xxx: Fix small memory leak in qla2x00_probe_one on probe failure · 6d634067
      Bill Kuzeja 提交于
      The code that fixes the crashes in the following commit introduced a small
      memory leak:
      
      commit 6a2cf8d3 ("scsi: qla2xxx: Fix crashes in qla2x00_probe_one on probe failure")
      
      Fixing this requires a bit of reworking, which I've explained. Also provide
      some code cleanup.
      
      There is a small window in qla2x00_probe_one where if qla2x00_alloc_queues
      fails, we end up never freeing req and rsp and leak 0xc0 and 0xc8 bytes
      respectively (the sizes of req and rsp).
      
      I originally put in checks to test for this condition which were based on
      the incorrect assumption that if ha->rsp_q_map and ha->req_q_map were
      allocated, then rsp and req were allocated as well. This is incorrect.
      There is a window between these allocations:
      
             ret = qla2x00_mem_alloc(ha, req_length, rsp_length, &req, &rsp);
                      goto probe_hw_failed;
      
      [if successful, both rsp and req allocated]
      
             base_vha = qla2x00_create_host(sht, ha);
                      goto probe_hw_failed;
      
             ret = qla2x00_request_irqs(ha, rsp);
                      goto probe_failed;
      
             if (qla2x00_alloc_queues(ha, req, rsp)) {
                      goto probe_failed;
      
      [if successful, now ha->rsp_q_map and ha->req_q_map allocated]
      
      To simplify this, we should just set req and rsp to NULL after we free
      them. Sounds simple enough? The problem is that req and rsp are pointers
      defined in the qla2x00_probe_one and they are not always passed by reference
      to the routines that free them.
      
      Here are paths which can free req and rsp:
      
      PATH 1:
      qla2x00_probe_one
         ret = qla2x00_mem_alloc(ha, req_length, rsp_length, &req, &rsp);
         [req and rsp are passed by reference, but if this fails, we currently
          do not NULL out req and rsp. Easily fixed]
      
      PATH 2:
      qla2x00_probe_one
         failing in qla2x00_request_irqs or qla2x00_alloc_queues
            probe_failed:
               qla2x00_free_device(base_vha);
                  qla2x00_free_req_que(ha, req)
                  qla2x00_free_rsp_que(ha, rsp)
      
      PATH 3:
      qla2x00_probe_one:
         failing in qla2x00_mem_alloc or qla2x00_create_host
            probe_hw_failed:
               qla2x00_free_req_que(ha, req)
               qla2x00_free_rsp_que(ha, rsp)
      
      PATH 1: This should currently work, but it doesn't because rsp and rsp are
      not set to NULL in qla2x00_mem_alloc. Easily remedied.
      
      PATH 2: req and rsp aren't passed in at all to qla2x00_free_device but are
      derived from ha->req_q_map[0] and ha->rsp_q_map[0]. These are only set up if
      qla2x00_alloc_queues succeeds.
      
      In qla2x00_free_queues, we are protected from crashing if these don't exist
      because req_qid_map and rsp_qid_map are only set on their allocation. We are
      guarded in this way:
      
              for (cnt = 0; cnt < ha->max_req_queues; cnt++) {
                      if (!test_bit(cnt, ha->req_qid_map))
                              continue;
      
      PATH 3: This works. We haven't freed req or rsp yet (or they were never
      allocated if qla2x00_mem_alloc failed), so we'll attempt to free them here.
      
      To summarize, there are a few small changes to make this work correctly and
      (and for some cleanup):
      
      1) (For PATH 1) Set *rsp and *req to NULL in case of failure in
      qla2x00_mem_alloc so these are correctly set to NULL back in
      qla2x00_probe_one
      
      2) After jumping to probe_failed: and calling qla2x00_free_device,
      explicitly set rsp and req to NULL so further calls with these pointers do
      not crash, i.e. the free queue calls in the probe_hw_failed section we fall
      through to.
      
      3) Fix return code check in the call to qla2x00_alloc_queues. We currently
      drop the return code on the floor. The probe fails but the caller of the
      probe doesn't have an error code, so it attaches to pci. This can result in
      a crash on module shutdown.
      
      4) Remove unnecessary NULL checks in qla2x00_free_req_que,
      qla2x00_free_rsp_que, and the egregious NULL checks before kfrees and vfrees
      in qla2x00_mem_free.
      
      I tested this out running a scenario where the card breaks at various times
      during initialization. I made sure I forced every error exit path in
      qla2x00_probe_one.
      
      Cc: <stable@vger.kernel.org> # v4.16
      Fixes: 6a2cf8d3 ("scsi: qla2xxx: Fix crashes in qla2x00_probe_one on probe failure")
      Signed-off-by: NBill Kuzeja <william.kuzeja@stratus.com>
      Acked-by: NHimanshu Madhani <himanshu.madhani@cavium.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      6d634067
    • J
      scsi: scsi_dh: Don't look for NULL devices handlers by name · 2ee5671e
      Johannes Thumshirn 提交于
      Currently scsi_dh_lookup() doesn't check for NULL as a device name. This
      combined with nvme over dm-mpath results in the following messages
      emitted by device-mapper:
      
       device-mapper: multipath: Could not failover device 259:67: Handler scsi_dh_(null) error 14.
      
      Let scsi_dh_lookup() fail fast on NULL names.
      
      [mkp: typo fix]
      
      Cc: <stable@vger.kernel.org> # v4.16
      Signed-off-by: NJohannes Thumshirn <jthumshirn@suse.de>
      Reviewed-by: NHannes Reinecke <hare@suse.com>
      Reviewed-by: NBart Van Assche <bart.vanassche@wdc.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      2ee5671e
    • C
      scsi: core: remove redundant assignment to shost->use_blk_mq · cbee67c2
      Colin Ian King 提交于
      The first assignment to shost->use_blk_mq is redundant as it is
      overwritten by the following statement. Remove this redundant code.
      
      Detected by CoverityScan, CID#1466993 ("Unused value")
      Signed-off-by: NColin Ian King <colin.king@canonical.com>
      Reviewed-by: NBart Van Assche <bart.vanassche@wdc.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      cbee67c2
  2. 28 3月, 2018 1 次提交
  3. 27 3月, 2018 1 次提交
  4. 26 3月, 2018 1 次提交
  5. 22 3月, 2018 25 次提交