Skip to content

Commit 403a39f

Browse files
torvaldstorvalds
committed
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley: "This is seven small fixes which are all for user visible issues that fortunately only occur in rare circumstances. The most serious is the sr one in which QEMU can cause us to read beyond the end of a buffer (I don't think it's exploitable, but just in case). The next is the sd capacity fix which means all non 512 byte sector drives greater than 2TB fail to be correctly sized. The rest are either in new drivers (qedf) or on error legs" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ipr: do not set DID_PASSTHROUGH on CHECK CONDITION scsi: aacraid: fix PCI error recovery path scsi: sd: Fix capacity calculation with 32-bit sector_t scsi: qla2xxx: Add fix to read correct register value for ISP82xx. scsi: qedf: Fix crash due to unsolicited FIP VLAN response. scsi: sr: Sanity check returned mode data scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable
2 parents be84a46 + 0e1bfea commit 403a39f

File tree

8 files changed

+49
-12
lines changed

8 files changed

+49
-12
lines changed

‎drivers/scsi/aacraid/aacraid.h

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1690,9 +1690,6 @@ struct aac_dev
16901690
#define aac_adapter_sync_cmd(dev, command, p1, p2, p3, p4, p5, p6, status, r1, r2, r3, r4) \
16911691
(dev)->a_ops.adapter_sync_cmd(dev, command, p1, p2, p3, p4, p5, p6, status, r1, r2, r3, r4)
16921692

1693-
#define aac_adapter_check_health(dev) \
1694-
(dev)->a_ops.adapter_check_health(dev)
1695-
16961693
#define aac_adapter_restart(dev, bled, reset_type) \
16971694
((dev)->a_ops.adapter_restart(dev, bled, reset_type))
16981695

@@ -2615,6 +2612,14 @@ static inline unsigned int cap_to_cyls(sector_t capacity, unsigned divisor)
26152612
return capacity;
26162613
}
26172614

2615+
static inline int aac_adapter_check_health(struct aac_dev *dev)
2616+
{
2617+
if (unlikely(pci_channel_offline(dev->pdev)))
2618+
return -1;
2619+
2620+
return (dev)->a_ops.adapter_check_health(dev);
2621+
}
2622+
26182623
/* SCp.phase values */
26192624
#define AAC_OWNER_MIDLEVEL 0x101
26202625
#define AAC_OWNER_LOWLEVEL 0x102

‎drivers/scsi/aacraid/commsup.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1873,7 +1873,8 @@ int aac_check_health(struct aac_dev * aac)
18731873
spin_unlock_irqrestore(&aac->fib_lock, flagv);
18741874

18751875
if (BlinkLED < 0) {
1876-
printk(KERN_ERR "%s: Host adapter dead %d\n", aac->name, BlinkLED);
1876+
printk(KERN_ERR "%s: Host adapter is dead (or got a PCI error) %d\n",
1877+
aac->name, BlinkLED);
18771878
goto out;
18781879
}
18791880

‎drivers/scsi/ipr.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6293,7 +6293,12 @@ static void ipr_erp_start(struct ipr_ioa_cfg *ioa_cfg,
62936293
break;
62946294
case IPR_IOASC_MED_DO_NOT_REALLOC: /* prevent retries */
62956295
case IPR_IOASA_IR_DUAL_IOA_DISABLED:
6296-
scsi_cmd->result |= (DID_PASSTHROUGH << 16);
6296+
/*
6297+
* exception: do not set DID_PASSTHROUGH on CHECK CONDITION
6298+
* so SCSI mid-layer and upper layers handle it accordingly.
6299+
*/
6300+
if (scsi_cmd->result != SAM_STAT_CHECK_CONDITION)
6301+
scsi_cmd->result |= (DID_PASSTHROUGH << 16);
62976302
break;
62986303
case IPR_IOASC_BUS_WAS_RESET:
62996304
case IPR_IOASC_BUS_WAS_RESET_BY_OTHER:

‎drivers/scsi/qedf/qedf_fip.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,8 @@ static void qedf_fcoe_process_vlan_resp(struct qedf_ctx *qedf,
9999
qedf_set_vlan_id(qedf, vid);
100100

101101
/* Inform waiter that it's ok to call fcoe_ctlr_link up() */
102-
complete(&qedf->fipvlan_compl);
102+
if (!completion_done(&qedf->fipvlan_compl))
103+
complete(&qedf->fipvlan_compl);
103104
}
104105
}
105106

‎drivers/scsi/qedf/qedf_main.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2803,6 +2803,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
28032803
atomic_set(&qedf->num_offloads, 0);
28042804
qedf->stop_io_on_error = false;
28052805
pci_set_drvdata(pdev, qedf);
2806+
init_completion(&qedf->fipvlan_compl);
28062807

28072808
QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_INFO,
28082809
"QLogic FastLinQ FCoE Module qedf %s, "

‎drivers/scsi/qla2xxx/qla_os.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1160,8 +1160,13 @@ static inline
11601160
uint32_t qla2x00_isp_reg_stat(struct qla_hw_data *ha)
11611161
{
11621162
struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
1163+
struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82;
11631164

1164-
return ((RD_REG_DWORD(&reg->host_status)) == ISP_REG_DISCONNECT);
1165+
if (IS_P3P_TYPE(ha))
1166+
return ((RD_REG_DWORD(&reg82->host_int)) == ISP_REG_DISCONNECT);
1167+
else
1168+
return ((RD_REG_DWORD(&reg->host_status)) ==
1169+
ISP_REG_DISCONNECT);
11651170
}
11661171

11671172
/**************************************************************************

‎drivers/scsi/sd.c

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2102,6 +2102,22 @@ static void read_capacity_error(struct scsi_disk *sdkp, struct scsi_device *sdp,
21022102

21032103
#define READ_CAPACITY_RETRIES_ON_RESET 10
21042104

2105+
/*
2106+
* Ensure that we don't overflow sector_t when CONFIG_LBDAF is not set
2107+
* and the reported logical block size is bigger than 512 bytes. Note
2108+
* that last_sector is a u64 and therefore logical_to_sectors() is not
2109+
* applicable.
2110+
*/
2111+
static bool sd_addressable_capacity(u64 lba, unsigned int sector_size)
2112+
{
2113+
u64 last_sector = (lba + 1ULL) << (ilog2(sector_size) - 9);
2114+
2115+
if (sizeof(sector_t) == 4 && last_sector > U32_MAX)
2116+
return false;
2117+
2118+
return true;
2119+
}
2120+
21052121
static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
21062122
unsigned char *buffer)
21072123
{
@@ -2167,7 +2183,7 @@ static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
21672183
return -ENODEV;
21682184
}
21692185

2170-
if ((sizeof(sdkp->capacity) == 4) && (lba >= 0xffffffffULL)) {
2186+
if (!sd_addressable_capacity(lba, sector_size)) {
21712187
sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
21722188
"kernel compiled with support for large block "
21732189
"devices.\n");
@@ -2256,7 +2272,7 @@ static int read_capacity_10(struct scsi_disk *sdkp, struct scsi_device *sdp,
22562272
return sector_size;
22572273
}
22582274

2259-
if ((sizeof(sdkp->capacity) == 4) && (lba == 0xffffffff)) {
2275+
if (!sd_addressable_capacity(lba, sector_size)) {
22602276
sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
22612277
"kernel compiled with support for large block "
22622278
"devices.\n");
@@ -2956,7 +2972,8 @@ static int sd_revalidate_disk(struct gendisk *disk)
29562972
q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
29572973
rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
29582974
} else
2959-
rw_max = BLK_DEF_MAX_SECTORS;
2975+
rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
2976+
(sector_t)BLK_DEF_MAX_SECTORS);
29602977

29612978
/* Combine with controller limits */
29622979
q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));

‎drivers/scsi/sr.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -836,6 +836,7 @@ static void get_capabilities(struct scsi_cd *cd)
836836
unsigned char *buffer;
837837
struct scsi_mode_data data;
838838
struct scsi_sense_hdr sshdr;
839+
unsigned int ms_len = 128;
839840
int rc, n;
840841

841842
static const char *loadmech[] =
@@ -862,10 +863,11 @@ static void get_capabilities(struct scsi_cd *cd)
862863
scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr);
863864

864865
/* ask for mode page 0x2a */
865-
rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, 128,
866+
rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, ms_len,
866867
SR_TIMEOUT, 3, &data, NULL);
867868

868-
if (!scsi_status_is_good(rc)) {
869+
if (!scsi_status_is_good(rc) || data.length > ms_len ||
870+
data.header_length + data.block_descriptor_length > data.length) {
869871
/* failed, drive doesn't have capabilities mode page */
870872
cd->cdi.speed = 1;
871873
cd->cdi.mask |= (CDC_CD_R | CDC_CD_RW | CDC_DVD_R |

0 commit comments

Comments
 (0)