The few lines below the kfree of hdr_buf may go to the label err_free
which will also free hdr_buf.  The most straightforward solution seems to
be to just move the kfree of hdr_buf after these gotos.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@r@
identifier E;
expression E1;
iterator I;
statement S;
@@

*kfree(E);
... when != E = E1
    when != I(E,...) S
    when != &E
*kfree(E);
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The best way to fix this is to eliminate the intenal kmalloc() and
make the caller allocate the required amount of storage.
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Now that hot add works correctly, if a new device is added, we're still
operating on stale enclosure data, so fix that by updating the enclosure
diagnostic pages when we get notified of a device hot add
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Right at the moment, hot removal of a device within an enclosure does
nothing (because the intf_remove only copes with enclosure removal not
with component removal). Fix this by adding a function to remove the
component.  Also needed to fix the prototype of
enclosure_remove_device, since we know the device we've removed but
not the internal component number
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

In a situation either with expanders or with multiple enclosure
devices, hot add doesn't always work.  This is because we try to find
a single enclosure device attached to the host.  Fix this by looping
over all enclosure devices attached to the host and also by making the
find loop recognise that the enclosure devices may be expander remote
(i.e. not parented by the host).
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

SES had its own code to retrieve VPD from devices; convert it to use the
new scsi_get_vpd_page helper.
Signed-off-by: NMatthew Wilcox <willy@linux.intel.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

[jejb: limit ioctl to returning 20 characters to avoid overrun
       on long device names and add a few more conversions]
Signed-off-by: NKay Sievers <kay.sievers@vrfy.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

scsi_execute() and scsi_execute_req() discard the residual length
information. Some callers need it. This adds residual argument
(optional) to scsi_execute and scsi_execute_req.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

There are a few kerneloops.org reports like this one:

http://www.kerneloops.org/search.php?search=ses_match_to_enclosure

That seem to imply we're running off the end of the VPD inquiry data
(although at 512 bytes, it should be long enough for just about
anything).  we should be using correctly sized buffers anyway, so put
those in and hope this oops goes away.

Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Timeouts are measured in jiffies, not in seconds.
Signed-off-by: NMatthew Wilcox <willy@linux.intel.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

It's big, but there doesn't seem to be a way to split it up smaller...
Signed-off-by: NTony Jones <tonyj@suse.de>
Signed-off-by: NKay Sievers <kay.sievers@vrfy.org>
Cc: Roland Dreier <rolandd@cisco.com>
Cc: Sean Hefty <sean.hefty@intel.com>
Cc: Hal Rosenstock <hal.rosenstock@gmail.com>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

one system: initrd get courrupted:

RAMDISK: Compressed image found at block 0
RAMDISK: incomplete write (-28 != 2048) 134217728
crc error
VFS: Mounted root (ext2 filesystem).
Freeing unused kernel memory: 388k freed
init_special_inode: bogus i_mode (177777)
Warning: unable to open an initial console.
init_special_inode: bogus i_mode (177777)
init_special_inode: bogus i_mode (177777)
Kernel panic - not syncing: No init found.  Try passing init= option to kernel.

bisected to
commit 9927c688
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Sun Feb 3 15:48:56 2008 -0600

    [SCSI] ses: add new Enclosure ULD

changes:
1. change char to unsigned char to avoid type change later.
2. preserve len for page1
3. need to move desc_ptr even the entry is not enclosure_component_device/raid.
   so keep desc_ptr on right position
4. record page7 len, and double check if desc_ptr out of boundary before touch.
5. fix typo in subenclosure checking: should use hdr_buf instead.

[jejb: style fixes]
Signed-off-by: NYinghai Lu <yinghai.lu@sun.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

fix leaking with scomp leaking when failing. Also free page10 on
driver removal and remove one extra space.
Signed-off-by: NYinghai Lu <yinghai.lu@sun.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This adds support to SCSI for enclosure services devices. It also makes
use of the enclosure services added in an earlier patch to display the
enclosure topology in sysfs.

At the moment, the enclosures are SAS specific, but if anyone actually
has a non-SAS enclosure that follows the SES-2 standard, we can add that
as well.

On my Vitesse based system, the enclosures show up like this:

sparkweed:~# ls -l /sys/class/enclosure/0\:0\:1\:0/
total 0
-r--r--r-- 1 root root 4096 2008-02-03 15:44 components
lrwxrwxrwx 1 root root    0 2008-02-03 15:44 device -> ../../../devices/pci0000:01/0000:01:02.0/host0/port-0:0/expander-0:0/port-0:0:12/end_device-0:0:12/target0:0:1/0:0:1:0
drwxr-xr-x 2 root root    0 2008-02-03 15:44 SLOT 000
drwxr-xr-x 2 root root    0 2008-02-03 15:44 SLOT 001
drwxr-xr-x 2 root root    0 2008-02-03 15:44 SLOT 002
drwxr-xr-x 2 root root    0 2008-02-03 15:44 SLOT 003
drwxr-xr-x 2 root root    0 2008-02-03 15:44 SLOT 004
drwxr-xr-x 2 root root    0 2008-02-03 15:44 SLOT 005
lrwxrwxrwx 1 root root    0 2008-02-03 15:44 subsystem -> ../../enclosure
--w------- 1 root root 4096 2008-02-03 15:44 uevent

And the individual occupied slots like this:

sparkweed:~# ls -l /sys/class/enclosure/0\:0\:1\:0/SLOT\ 001/
total 0
-rw-r--r-- 1 root root 4096 2008-02-03 15:45 active
lrwxrwxrwx 1 root root    0 2008-02-03 15:45 device -> ../../../../devices/pci0000:01/0000:01:02.0/host0/port-0:0/expander-0:0/port-0:0:11/end_device-0:0:11/target0:0:0/0:0:0:0
-rw-r--r-- 1 root root 4096 2008-02-03 15:45 fault
-rw-r--r-- 1 root root 4096 2008-02-03 15:45 locate
-rw-r--r-- 1 root root 4096 2008-02-03 15:45 status
lrwxrwxrwx 1 root root    0 2008-02-03 15:45 subsystem -> ../../../enclosure_component
-r--r--r-- 1 root root 4096 2008-02-03 15:45 type
--w------- 1 root root 4096 2008-02-03 15:45 uevent

You can flash the various blinky lights by echoing to the fault and locate files.

>From the device's point of view, you can see it has an enclosure like this:

sparkweed:~# ls /sys/class/scsi_disk/0\:0\:0\:0/device/
block:sda                     generic        queue_depth          state
bsg:0:0:0:0                   iocounterbits  queue_type           subsystem
bus                           iodone_cnt     rescan               timeout
delete                        ioerr_cnt      rev                  type
device_blocked                iorequest_cnt  scsi_device:0:0:0:0  uevent
driver                        modalias       scsi_disk:0:0:0:0    vendor
enclosure_component:SLOT 001  model          scsi_generic:sg0
evt_media_change              power          scsi_level

Note the enclosure_component:SLOT 001 which shows where in the enclosure
this device fits.

The astute will notice that I'm using SCSI VPD Inquiries to identify the
devices.  This, unfortunately, won't work for SATA devices unless we do
some really nasty hacking about on the SAT because the only think that
knows the SAS addresses for SATA devices is libsas, not libata where the
SAT resides.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>