Commit 7ffca2bb authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi 

Pull SCSI fixes from James Bottomley:
 "Four fixes, all in drivers, all of which can lead to user visible
  problems in certain situations"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: target: Fix NULL dereference on XCOPY completion
  scsi: mpt3sas: Transition IOC to Ready state during shutdown
  scsi: target: Fix protect handling in WRITE SAME(32)
  scsi: iscsi: Fix iface sysfs attr detection
parents 0ee818c3 a47fa413

drivers/scsi/mpt3sas/mpt3sas_base.c

+16 −16
Original line number Diff line number Diff line
@@ -2983,13 +2983,13 @@ _base_check_enable_msix(struct MPT3SAS_ADAPTER *ioc) 
}



/**

 * _base_free_irq - free irq

 * mpt3sas_base_free_irq - free irq

 * @ioc: per adapter object

 *

 * Freeing respective reply_queue from the list.

 */

static void

_base_free_irq(struct MPT3SAS_ADAPTER *ioc)

void

mpt3sas_base_free_irq(struct MPT3SAS_ADAPTER *ioc)

{

	struct adapter_reply_queue *reply_q, *next;
@@ -3191,12 +3191,12 @@ _base_check_and_enable_high_iops_queues(struct MPT3SAS_ADAPTER *ioc, 
}



/**

 * _base_disable_msix - disables msix

 * mpt3sas_base_disable_msix - disables msix

 * @ioc: per adapter object

 *

 */

static void

_base_disable_msix(struct MPT3SAS_ADAPTER *ioc)

void

mpt3sas_base_disable_msix(struct MPT3SAS_ADAPTER *ioc)

{

	if (!ioc->msix_enable)

		return;
@@ -3304,8 +3304,8 @@ _base_enable_msix(struct MPT3SAS_ADAPTER *ioc) 
	for (i = 0; i < ioc->reply_queue_count; i++) {

		r = _base_request_irq(ioc, i);

		if (r) {

			_base_free_irq(ioc);

			_base_disable_msix(ioc);

			mpt3sas_base_free_irq(ioc);

			mpt3sas_base_disable_msix(ioc);

			goto try_ioapic;

		}

	}
@@ -3342,8 +3342,8 @@ mpt3sas_base_unmap_resources(struct MPT3SAS_ADAPTER *ioc) 


	dexitprintk(ioc, ioc_info(ioc, "%s\n", __func__));



	_base_free_irq(ioc);

	_base_disable_msix(ioc);

	mpt3sas_base_free_irq(ioc);

	mpt3sas_base_disable_msix(ioc);



	kfree(ioc->replyPostRegisterIndex);

	ioc->replyPostRegisterIndex = NULL;
@@ -7613,14 +7613,14 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) 
}



/**

 * _base_make_ioc_ready - put controller in READY state

 * mpt3sas_base_make_ioc_ready - put controller in READY state

 * @ioc: per adapter object

 * @type: FORCE_BIG_HAMMER or SOFT_RESET

 *

 * Return: 0 for success, non-zero for failure.

 */

static int

_base_make_ioc_ready(struct MPT3SAS_ADAPTER *ioc, enum reset_type type)

int

mpt3sas_base_make_ioc_ready(struct MPT3SAS_ADAPTER *ioc, enum reset_type type)

{

	u32 ioc_state;

	int rc;
@@ -7897,7 +7897,7 @@ mpt3sas_base_free_resources(struct MPT3SAS_ADAPTER *ioc) 
	if (ioc->chip_phys && ioc->chip) {

		mpt3sas_base_mask_interrupts(ioc);

		ioc->shost_recovery = 1;

		_base_make_ioc_ready(ioc, SOFT_RESET);

		mpt3sas_base_make_ioc_ready(ioc, SOFT_RESET);

		ioc->shost_recovery = 0;

	}
@@ -8017,7 +8017,7 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) 
	ioc->build_sg_mpi = &_base_build_sg;

	ioc->build_zero_len_sge_mpi = &_base_build_zero_len_sge;



	r = _base_make_ioc_ready(ioc, SOFT_RESET);

	r = mpt3sas_base_make_ioc_ready(ioc, SOFT_RESET);

	if (r)

		goto out_free_resources;
@@ -8471,7 +8471,7 @@ mpt3sas_base_hard_reset_handler(struct MPT3SAS_ADAPTER *ioc, 
	_base_pre_reset_handler(ioc);

	mpt3sas_wait_for_commands_to_complete(ioc);

	mpt3sas_base_mask_interrupts(ioc);

	r = _base_make_ioc_ready(ioc, type);

	r = mpt3sas_base_make_ioc_ready(ioc, type);

	if (r)

		goto out;

	_base_clear_outstanding_commands(ioc);

drivers/scsi/mpt3sas/mpt3sas_base.h

+4 −0
Original line number Diff line number Diff line
@@ -1730,6 +1730,10 @@ do { ioc_err(ioc, "In func: %s\n", __func__); \ 
	status, mpi_request, sz); } while (0)



int mpt3sas_wait_for_ioc(struct MPT3SAS_ADAPTER *ioc, int wait_count);

int

mpt3sas_base_make_ioc_ready(struct MPT3SAS_ADAPTER *ioc, enum reset_type type);

void mpt3sas_base_free_irq(struct MPT3SAS_ADAPTER *ioc);

void mpt3sas_base_disable_msix(struct MPT3SAS_ADAPTER *ioc);



/* scsih shared API */

struct scsi_cmnd *mpt3sas_scsih_scsi_lookup_get(struct MPT3SAS_ADAPTER *ioc,

drivers/scsi/mpt3sas/mpt3sas_scsih.c

+6 −1
Original line number Diff line number Diff line
@@ -11295,7 +11295,12 @@ scsih_shutdown(struct pci_dev *pdev) 


	_scsih_ir_shutdown(ioc);

	_scsih_nvme_shutdown(ioc);

	mpt3sas_base_detach(ioc);

	mpt3sas_base_mask_interrupts(ioc);

	ioc->shost_recovery = 1;

	mpt3sas_base_make_ioc_ready(ioc, SOFT_RESET);

	ioc->shost_recovery = 0;

	mpt3sas_base_free_irq(ioc);

	mpt3sas_base_disable_msix(ioc);

}

drivers/scsi/scsi_transport_iscsi.c

+34 −56
Original line number Diff line number Diff line
@@ -439,39 +439,10 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, 
	struct device *dev = container_of(kobj, struct device, kobj);

	struct iscsi_iface *iface = iscsi_dev_to_iface(dev);

	struct iscsi_transport *t = iface->transport;

	int param;

	int param_type;

	int param = -1;



	if (attr == &dev_attr_iface_enabled.attr)

		param = ISCSI_NET_PARAM_IFACE_ENABLE;

	else if (attr == &dev_attr_iface_vlan_id.attr)

		param = ISCSI_NET_PARAM_VLAN_ID;

	else if (attr == &dev_attr_iface_vlan_priority.attr)

		param = ISCSI_NET_PARAM_VLAN_PRIORITY;

	else if (attr == &dev_attr_iface_vlan_enabled.attr)

		param = ISCSI_NET_PARAM_VLAN_ENABLED;

	else if (attr == &dev_attr_iface_mtu.attr)

		param = ISCSI_NET_PARAM_MTU;

	else if (attr == &dev_attr_iface_port.attr)

		param = ISCSI_NET_PARAM_PORT;

	else if (attr == &dev_attr_iface_ipaddress_state.attr)

		param = ISCSI_NET_PARAM_IPADDR_STATE;

	else if (attr == &dev_attr_iface_delayed_ack_en.attr)

		param = ISCSI_NET_PARAM_DELAYED_ACK_EN;

	else if (attr == &dev_attr_iface_tcp_nagle_disable.attr)

		param = ISCSI_NET_PARAM_TCP_NAGLE_DISABLE;

	else if (attr == &dev_attr_iface_tcp_wsf_disable.attr)

		param = ISCSI_NET_PARAM_TCP_WSF_DISABLE;

	else if (attr == &dev_attr_iface_tcp_wsf.attr)

		param = ISCSI_NET_PARAM_TCP_WSF;

	else if (attr == &dev_attr_iface_tcp_timer_scale.attr)

		param = ISCSI_NET_PARAM_TCP_TIMER_SCALE;

	else if (attr == &dev_attr_iface_tcp_timestamp_en.attr)

		param = ISCSI_NET_PARAM_TCP_TIMESTAMP_EN;

	else if (attr == &dev_attr_iface_cache_id.attr)

		param = ISCSI_NET_PARAM_CACHE_ID;

	else if (attr == &dev_attr_iface_redirect_en.attr)

		param = ISCSI_NET_PARAM_REDIRECT_EN;

	else if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr)

		param = ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO;

	else if (attr == &dev_attr_iface_header_digest.attr)
@@ -508,6 +479,38 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, 
		param = ISCSI_IFACE_PARAM_STRICT_LOGIN_COMP_EN;

	else if (attr == &dev_attr_iface_initiator_name.attr)

		param = ISCSI_IFACE_PARAM_INITIATOR_NAME;



	if (param != -1)

		return t->attr_is_visible(ISCSI_IFACE_PARAM, param);



	if (attr == &dev_attr_iface_vlan_id.attr)

		param = ISCSI_NET_PARAM_VLAN_ID;

	else if (attr == &dev_attr_iface_vlan_priority.attr)

		param = ISCSI_NET_PARAM_VLAN_PRIORITY;

	else if (attr == &dev_attr_iface_vlan_enabled.attr)

		param = ISCSI_NET_PARAM_VLAN_ENABLED;

	else if (attr == &dev_attr_iface_mtu.attr)

		param = ISCSI_NET_PARAM_MTU;

	else if (attr == &dev_attr_iface_port.attr)

		param = ISCSI_NET_PARAM_PORT;

	else if (attr == &dev_attr_iface_ipaddress_state.attr)

		param = ISCSI_NET_PARAM_IPADDR_STATE;

	else if (attr == &dev_attr_iface_delayed_ack_en.attr)

		param = ISCSI_NET_PARAM_DELAYED_ACK_EN;

	else if (attr == &dev_attr_iface_tcp_nagle_disable.attr)

		param = ISCSI_NET_PARAM_TCP_NAGLE_DISABLE;

	else if (attr == &dev_attr_iface_tcp_wsf_disable.attr)

		param = ISCSI_NET_PARAM_TCP_WSF_DISABLE;

	else if (attr == &dev_attr_iface_tcp_wsf.attr)

		param = ISCSI_NET_PARAM_TCP_WSF;

	else if (attr == &dev_attr_iface_tcp_timer_scale.attr)

		param = ISCSI_NET_PARAM_TCP_TIMER_SCALE;

	else if (attr == &dev_attr_iface_tcp_timestamp_en.attr)

		param = ISCSI_NET_PARAM_TCP_TIMESTAMP_EN;

	else if (attr == &dev_attr_iface_cache_id.attr)

		param = ISCSI_NET_PARAM_CACHE_ID;

	else if (attr == &dev_attr_iface_redirect_en.attr)

		param = ISCSI_NET_PARAM_REDIRECT_EN;

	else if (iface->iface_type == ISCSI_IFACE_TYPE_IPV4) {

		if (attr == &dev_attr_ipv4_iface_ipaddress.attr)

			param = ISCSI_NET_PARAM_IPV4_ADDR;
@@ -598,32 +601,7 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, 
		return 0;

	}



	switch (param) {

	case ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO:

	case ISCSI_IFACE_PARAM_HDRDGST_EN:

	case ISCSI_IFACE_PARAM_DATADGST_EN:

	case ISCSI_IFACE_PARAM_IMM_DATA_EN:

	case ISCSI_IFACE_PARAM_INITIAL_R2T_EN:

	case ISCSI_IFACE_PARAM_DATASEQ_INORDER_EN:

	case ISCSI_IFACE_PARAM_PDU_INORDER_EN:

	case ISCSI_IFACE_PARAM_ERL:

	case ISCSI_IFACE_PARAM_MAX_RECV_DLENGTH:

	case ISCSI_IFACE_PARAM_FIRST_BURST:

	case ISCSI_IFACE_PARAM_MAX_R2T:

	case ISCSI_IFACE_PARAM_MAX_BURST:

	case ISCSI_IFACE_PARAM_CHAP_AUTH_EN:

	case ISCSI_IFACE_PARAM_BIDI_CHAP_EN:

	case ISCSI_IFACE_PARAM_DISCOVERY_AUTH_OPTIONAL:

	case ISCSI_IFACE_PARAM_DISCOVERY_LOGOUT_EN:

	case ISCSI_IFACE_PARAM_STRICT_LOGIN_COMP_EN:

	case ISCSI_IFACE_PARAM_INITIATOR_NAME:

		param_type = ISCSI_IFACE_PARAM;

		break;

	default:

		param_type = ISCSI_NET_PARAM;

	}



	return t->attr_is_visible(param_type, param);

	return t->attr_is_visible(ISCSI_NET_PARAM, param);

}



static struct attribute *iscsi_iface_attrs[] = {

drivers/target/target_core_sbc.c

+17 −18
Original line number Diff line number Diff line
@@ -25,7 +25,7 @@ 
#include "target_core_alua.h"



static sense_reason_t

sbc_check_prot(struct se_device *, struct se_cmd *, unsigned char *, u32, bool);

sbc_check_prot(struct se_device *, struct se_cmd *, unsigned char, u32, bool);

static sense_reason_t sbc_execute_unmap(struct se_cmd *cmd);



static sense_reason_t
@@ -279,14 +279,14 @@ static inline unsigned long long transport_lba_64_ext(unsigned char *cdb) 
}



static sense_reason_t

sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *ops)

sbc_setup_write_same(struct se_cmd *cmd, unsigned char flags, struct sbc_ops *ops)

{

	struct se_device *dev = cmd->se_dev;

	sector_t end_lba = dev->transport->get_blocks(dev) + 1;

	unsigned int sectors = sbc_get_write_same_sectors(cmd);

	sense_reason_t ret;



	if ((flags[0] & 0x04) || (flags[0] & 0x02)) {

	if ((flags & 0x04) || (flags & 0x02)) {

		pr_err("WRITE_SAME PBDATA and LBDATA"

			" bits not supported for Block Discard"

			" Emulation\n");
@@ -308,7 +308,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o 
	}



	/* We always have ANC_SUP == 0 so setting ANCHOR is always an error */

	if (flags[0] & 0x10) {

	if (flags & 0x10) {

		pr_warn("WRITE SAME with ANCHOR not supported\n");

		return TCM_INVALID_CDB_FIELD;

	}
@@ -316,7 +316,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o 
	 * Special case for WRITE_SAME w/ UNMAP=1 that ends up getting

	 * translated into block discard requests within backend code.

	 */

	if (flags[0] & 0x08) {

	if (flags & 0x08) {

		if (!ops->execute_unmap)

			return TCM_UNSUPPORTED_SCSI_OPCODE;
@@ -331,7 +331,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o 
	if (!ops->execute_write_same)

		return TCM_UNSUPPORTED_SCSI_OPCODE;



	ret = sbc_check_prot(dev, cmd, &cmd->t_task_cdb[0], sectors, true);

	ret = sbc_check_prot(dev, cmd, flags >> 5, sectors, true);

	if (ret)

		return ret;
@@ -717,10 +717,9 @@ sbc_set_prot_op_checks(u8 protect, bool fabric_prot, enum target_prot_type prot_ 
}



static sense_reason_t

sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb,

sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char protect,

	       u32 sectors, bool is_write)

{

	u8 protect = cdb[1] >> 5;

	int sp_ops = cmd->se_sess->sup_prot_ops;

	int pi_prot_type = dev->dev_attrib.pi_prot_type;

	bool fabric_prot = false;
@@ -768,7 +767,7 @@ sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb, 
		fallthrough;

	default:

		pr_err("Unable to determine pi_prot_type for CDB: 0x%02x "

		       "PROTECT: 0x%02x\n", cdb[0], protect);

		       "PROTECT: 0x%02x\n", cmd->t_task_cdb[0], protect);

		return TCM_INVALID_CDB_FIELD;

	}
@@ -843,7 +842,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) 
		if (sbc_check_dpofua(dev, cmd, cdb))

			return TCM_INVALID_CDB_FIELD;



		ret = sbc_check_prot(dev, cmd, cdb, sectors, false);

		ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, false);

		if (ret)

			return ret;
@@ -857,7 +856,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) 
		if (sbc_check_dpofua(dev, cmd, cdb))

			return TCM_INVALID_CDB_FIELD;



		ret = sbc_check_prot(dev, cmd, cdb, sectors, false);

		ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, false);

		if (ret)

			return ret;
@@ -871,7 +870,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) 
		if (sbc_check_dpofua(dev, cmd, cdb))

			return TCM_INVALID_CDB_FIELD;



		ret = sbc_check_prot(dev, cmd, cdb, sectors, false);

		ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, false);

		if (ret)

			return ret;
@@ -892,7 +891,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) 
		if (sbc_check_dpofua(dev, cmd, cdb))

			return TCM_INVALID_CDB_FIELD;



		ret = sbc_check_prot(dev, cmd, cdb, sectors, true);

		ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, true);

		if (ret)

			return ret;
@@ -906,7 +905,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) 
		if (sbc_check_dpofua(dev, cmd, cdb))

			return TCM_INVALID_CDB_FIELD;



		ret = sbc_check_prot(dev, cmd, cdb, sectors, true);

		ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, true);

		if (ret)

			return ret;
@@ -921,7 +920,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) 
		if (sbc_check_dpofua(dev, cmd, cdb))

			return TCM_INVALID_CDB_FIELD;



		ret = sbc_check_prot(dev, cmd, cdb, sectors, true);

		ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, true);

		if (ret)

			return ret;
@@ -980,7 +979,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) 
			size = sbc_get_size(cmd, 1);

			cmd->t_task_lba = get_unaligned_be64(&cdb[12]);



			ret = sbc_setup_write_same(cmd, &cdb[10], ops);

			ret = sbc_setup_write_same(cmd, cdb[10], ops);

			if (ret)

				return ret;

			break;
@@ -1079,7 +1078,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) 
		size = sbc_get_size(cmd, 1);

		cmd->t_task_lba = get_unaligned_be64(&cdb[2]);



		ret = sbc_setup_write_same(cmd, &cdb[1], ops);

		ret = sbc_setup_write_same(cmd, cdb[1], ops);

		if (ret)

			return ret;

		break;
@@ -1097,7 +1096,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) 
		 * Follow sbcr26 with WRITE_SAME (10) and check for the existence

		 * of byte 1 bit 3 UNMAP instead of original reserved field

		 */

		ret = sbc_setup_write_same(cmd, &cdb[1], ops);

		ret = sbc_setup_write_same(cmd, cdb[1], ops);

		if (ret)

			return ret;

		break;