Commit f65420df authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi 

Pull SCSI fixes from James Bottomley:
 "This is the final round of mostly small fixes in our initial submit.

  It's mostly minor fixes and driver updates. The only change of note is
  adding a virt_boundary_mask to the SCSI host and host template to
  parametrise this for NVMe devices instead of having them do a call in
  slave_alloc. It's a fairly straightforward conversion except in the
  two NVMe handling drivers that didn't set it who now have a virtual
  infinity parameter added"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (24 commits)
  scsi: megaraid_sas: set an unlimited max_segment_size
  scsi: mpt3sas: set an unlimited max_segment_size for SAS 3.0 HBAs
  scsi: IB/srp: set virt_boundary_mask in the scsi host
  scsi: IB/iser: set virt_boundary_mask in the scsi host
  scsi: storvsc: set virt_boundary_mask in the scsi host template
  scsi: ufshcd: set max_segment_size in the scsi host template
  scsi: core: take the DMA max mapping size into account
  scsi: core: add a host / host template field for the virt boundary
  scsi: core: Fix race on creating sense cache
  scsi: sd_zbc: Fix compilation warning
  scsi: libfc: fix null pointer dereference on a null lport
  scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized
  scsi: zfcp: fix request object use-after-free in send path causing wrong traces
  scsi: zfcp: fix request object use-after-free in send path causing seqno errors
  scsi: megaraid_sas: Update driver version to 07.710.50.00
  scsi: megaraid_sas: Add module parameter for FW Async event logging
  scsi: megaraid_sas: Enable msix_load_balance for Invader and later controllers
  scsi: megaraid_sas: Fix calculation of target ID
  scsi: lpfc: reduce stack size with CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE
  scsi: devinfo: BLIST_TRY_VPD_PAGES for SanDisk Cruzer Blade
  ...
parents 168c7997 07d9aa14

drivers/infiniband/ulp/iser/iscsi_iser.c

+7 −28
Original line number Diff line number Diff line
@@ -611,6 +611,7 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep, 
	struct Scsi_Host *shost;

	struct iser_conn *iser_conn = NULL;

	struct ib_conn *ib_conn;

	struct ib_device *ib_dev;

	u32 max_fr_sectors;



	shost = iscsi_host_alloc(&iscsi_iser_sht, 0, 0);
@@ -641,16 +642,19 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep, 
		}



		ib_conn = &iser_conn->ib_conn;

		ib_dev = ib_conn->device->ib_device;

		if (ib_conn->pi_support) {

			u32 sig_caps = ib_conn->device->ib_device->attrs.sig_prot_cap;

			u32 sig_caps = ib_dev->attrs.sig_prot_cap;



			scsi_host_set_prot(shost, iser_dif_prot_caps(sig_caps));

			scsi_host_set_guard(shost, SHOST_DIX_GUARD_IP |

						   SHOST_DIX_GUARD_CRC);

		}



		if (iscsi_host_add(shost,

				   ib_conn->device->ib_device->dev.parent)) {

		if (!(ib_dev->attrs.device_cap_flags & IB_DEVICE_SG_GAPS_REG))

			shost->virt_boundary_mask = ~MASK_4K;



		if (iscsi_host_add(shost, ib_dev->dev.parent)) {

			mutex_unlock(&iser_conn->state_mutex);

			goto free_host;

		}
@@ -956,30 +960,6 @@ static umode_t iser_attr_is_visible(int param_type, int param) 
	return 0;

}



static int iscsi_iser_slave_alloc(struct scsi_device *sdev)

{

	struct iscsi_session *session;

	struct iser_conn *iser_conn;

	struct ib_device *ib_dev;



	mutex_lock(&unbind_iser_conn_mutex);



	session = starget_to_session(scsi_target(sdev))->dd_data;

	iser_conn = session->leadconn->dd_data;

	if (!iser_conn) {

		mutex_unlock(&unbind_iser_conn_mutex);

		return -ENOTCONN;

	}

	ib_dev = iser_conn->ib_conn.device->ib_device;



	if (!(ib_dev->attrs.device_cap_flags & IB_DEVICE_SG_GAPS_REG))

		blk_queue_virt_boundary(sdev->request_queue, ~MASK_4K);



	mutex_unlock(&unbind_iser_conn_mutex);



	return 0;

}



static struct scsi_host_template iscsi_iser_sht = {

	.module                 = THIS_MODULE,

	.name                   = "iSCSI Initiator over iSER",
@@ -992,7 +972,6 @@ static struct scsi_host_template iscsi_iser_sht = { 
	.eh_device_reset_handler= iscsi_eh_device_reset,

	.eh_target_reset_handler = iscsi_eh_recover_target,

	.target_alloc		= iscsi_target_alloc,

	.slave_alloc            = iscsi_iser_slave_alloc,

	.proc_name              = "iscsi_iser",

	.this_id                = -1,

	.track_queue_depth	= 1,

drivers/infiniband/ulp/srp/ib_srp.c

+3 −15
Original line number Diff line number Diff line
@@ -3046,20 +3046,6 @@ static int srp_target_alloc(struct scsi_target *starget) 
	return 0;

}



static int srp_slave_alloc(struct scsi_device *sdev)

{

	struct Scsi_Host *shost = sdev->host;

	struct srp_target_port *target = host_to_target(shost);

	struct srp_device *srp_dev = target->srp_host->srp_dev;

	struct ib_device *ibdev = srp_dev->dev;



	if (!(ibdev->attrs.device_cap_flags & IB_DEVICE_SG_GAPS_REG))

		blk_queue_virt_boundary(sdev->request_queue,

					~srp_dev->mr_page_mask);



	return 0;

}



static int srp_slave_configure(struct scsi_device *sdev)

{

	struct Scsi_Host *shost = sdev->host;
@@ -3262,7 +3248,6 @@ static struct scsi_host_template srp_template = { 
	.name				= "InfiniBand SRP initiator",

	.proc_name			= DRV_NAME,

	.target_alloc			= srp_target_alloc,

	.slave_alloc			= srp_slave_alloc,

	.slave_configure		= srp_slave_configure,

	.info				= srp_target_info,

	.queuecommand			= srp_queuecommand,
@@ -3806,6 +3791,9 @@ static ssize_t srp_create_target(struct device *dev, 
	target_host->max_cmd_len = sizeof ((struct srp_cmd *) (void *) 0L)->cdb;

	target_host->max_segment_size = ib_dma_max_seg_size(ibdev);



	if (!(ibdev->attrs.device_cap_flags & IB_DEVICE_SG_GAPS_REG))

		target_host->virt_boundary_mask = ~srp_dev->mr_page_mask;



	target = host_to_target(target_host);



	target->net		= kobj_ns_grab_current(KOBJ_NS_TYPE_NET);

drivers/s390/scsi/zfcp_erp.c

+7 −0
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt



#include <linux/kthread.h>

#include <linux/bug.h>

#include "zfcp_ext.h"

#include "zfcp_reqlist.h"
@@ -217,6 +218,12 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(enum zfcp_erp_act_type need, 
	struct zfcp_erp_action *erp_action;

	struct zfcp_scsi_dev *zfcp_sdev;



	if (WARN_ON_ONCE(need != ZFCP_ERP_ACTION_REOPEN_LUN &&

			 need != ZFCP_ERP_ACTION_REOPEN_PORT &&

			 need != ZFCP_ERP_ACTION_REOPEN_PORT_FORCED &&

			 need != ZFCP_ERP_ACTION_REOPEN_ADAPTER))

		return NULL;



	switch (need) {

	case ZFCP_ERP_ACTION_REOPEN_LUN:

		zfcp_sdev = sdev_to_zfcp(sdev);

drivers/s390/scsi/zfcp_fsf.c

+48 −7
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt



#include <linux/blktrace_api.h>

#include <linux/types.h>

#include <linux/slab.h>

#include <scsi/fc/fc_els.h>

#include "zfcp_ext.h"
@@ -741,6 +742,7 @@ static struct zfcp_fsf_req *zfcp_fsf_req_create(struct zfcp_qdio *qdio, 


static int zfcp_fsf_req_send(struct zfcp_fsf_req *req)

{

	const bool is_srb = zfcp_fsf_req_is_status_read_buffer(req);

	struct zfcp_adapter *adapter = req->adapter;

	struct zfcp_qdio *qdio = adapter->qdio;

	int req_id = req->req_id;
@@ -757,8 +759,20 @@ static int zfcp_fsf_req_send(struct zfcp_fsf_req *req) 
		return -EIO;

	}



	/*

	 * NOTE: DO NOT TOUCH ASYNC req PAST THIS POINT.

	 *	 ONLY TOUCH SYNC req AGAIN ON req->completion.

	 *

	 * The request might complete and be freed concurrently at any point

	 * now. This is not protected by the QDIO-lock (req_q_lock). So any

	 * uncontrolled access after this might result in an use-after-free bug.

	 * Only if the request doesn't have ZFCP_STATUS_FSFREQ_CLEANUP set, and

	 * when it is completed via req->completion, is it safe to use req

	 * again.

	 */



	/* Don't increase for unsolicited status */

	if (!zfcp_fsf_req_is_status_read_buffer(req))

	if (!is_srb)

		adapter->fsf_req_seq_no++;

	adapter->req_no++;
@@ -805,6 +819,7 @@ int zfcp_fsf_status_read(struct zfcp_qdio *qdio) 
	retval = zfcp_fsf_req_send(req);

	if (retval)

		goto failed_req_send;

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */



	goto out;
@@ -914,8 +929,10 @@ struct zfcp_fsf_req *zfcp_fsf_abort_fcp_cmnd(struct scsi_cmnd *scmnd) 
	req->qtcb->bottom.support.req_handle = (u64) old_req_id;



	zfcp_fsf_start_timer(req, ZFCP_FSF_SCSI_ER_TIMEOUT);

	if (!zfcp_fsf_req_send(req))

	if (!zfcp_fsf_req_send(req)) {

		/* NOTE: DO NOT TOUCH req, UNTIL IT COMPLETES! */

		goto out;

	}



out_error_free:

	zfcp_fsf_req_free(req);
@@ -1098,6 +1115,7 @@ int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *wka_port, 
	ret = zfcp_fsf_req_send(req);

	if (ret)

		goto failed_send;

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */



	goto out;
@@ -1198,6 +1216,7 @@ int zfcp_fsf_send_els(struct zfcp_adapter *adapter, u32 d_id, 
	ret = zfcp_fsf_req_send(req);

	if (ret)

		goto failed_send;

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */



	goto out;
@@ -1243,6 +1262,7 @@ int zfcp_fsf_exchange_config_data(struct zfcp_erp_action *erp_action) 
		zfcp_fsf_req_free(req);

		erp_action->fsf_req_id = 0;

	}

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */

out:

	spin_unlock_irq(&qdio->req_q_lock);

	return retval;
@@ -1279,8 +1299,10 @@ int zfcp_fsf_exchange_config_data_sync(struct zfcp_qdio *qdio, 
	zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);

	retval = zfcp_fsf_req_send(req);

	spin_unlock_irq(&qdio->req_q_lock);

	if (!retval)

	if (!retval) {

		/* NOTE: ONLY TOUCH SYNC req AGAIN ON req->completion. */

		wait_for_completion(&req->completion);

	}



	zfcp_fsf_req_free(req);

	return retval;
@@ -1330,6 +1352,7 @@ int zfcp_fsf_exchange_port_data(struct zfcp_erp_action *erp_action) 
		zfcp_fsf_req_free(req);

		erp_action->fsf_req_id = 0;

	}

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */

out:

	spin_unlock_irq(&qdio->req_q_lock);

	return retval;
@@ -1372,8 +1395,10 @@ int zfcp_fsf_exchange_port_data_sync(struct zfcp_qdio *qdio, 
	retval = zfcp_fsf_req_send(req);

	spin_unlock_irq(&qdio->req_q_lock);



	if (!retval)

	if (!retval) {

		/* NOTE: ONLY TOUCH SYNC req AGAIN ON req->completion. */

		wait_for_completion(&req->completion);

	}



	zfcp_fsf_req_free(req);
@@ -1493,6 +1518,7 @@ int zfcp_fsf_open_port(struct zfcp_erp_action *erp_action) 
		erp_action->fsf_req_id = 0;

		put_device(&port->dev);

	}

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */

out:

	spin_unlock_irq(&qdio->req_q_lock);

	return retval;
@@ -1557,6 +1583,7 @@ int zfcp_fsf_close_port(struct zfcp_erp_action *erp_action) 
		zfcp_fsf_req_free(req);

		erp_action->fsf_req_id = 0;

	}

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */

out:

	spin_unlock_irq(&qdio->req_q_lock);

	return retval;
@@ -1600,6 +1627,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port) 
{

	struct zfcp_qdio *qdio = wka_port->adapter->qdio;

	struct zfcp_fsf_req *req;

	unsigned long req_id = 0;

	int retval = -EIO;



	spin_lock_irq(&qdio->req_q_lock);
@@ -1622,14 +1650,17 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port) 
	hton24(req->qtcb->bottom.support.d_id, wka_port->d_id);

	req->data = wka_port;



	req_id = req->req_id;



	zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);

	retval = zfcp_fsf_req_send(req);

	if (retval)

		zfcp_fsf_req_free(req);

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */

out:

	spin_unlock_irq(&qdio->req_q_lock);

	if (!retval)

		zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);

		zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req_id);

	return retval;

}
@@ -1655,6 +1686,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port) 
{

	struct zfcp_qdio *qdio = wka_port->adapter->qdio;

	struct zfcp_fsf_req *req;

	unsigned long req_id = 0;

	int retval = -EIO;



	spin_lock_irq(&qdio->req_q_lock);
@@ -1677,14 +1709,17 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port) 
	req->data = wka_port;

	req->qtcb->header.port_handle = wka_port->handle;



	req_id = req->req_id;



	zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);

	retval = zfcp_fsf_req_send(req);

	if (retval)

		zfcp_fsf_req_free(req);

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */

out:

	spin_unlock_irq(&qdio->req_q_lock);

	if (!retval)

		zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id);

		zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req_id);

	return retval;

}
@@ -1776,6 +1811,7 @@ int zfcp_fsf_close_physical_port(struct zfcp_erp_action *erp_action) 
		zfcp_fsf_req_free(req);

		erp_action->fsf_req_id = 0;

	}

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */

out:

	spin_unlock_irq(&qdio->req_q_lock);

	return retval;
@@ -1899,6 +1935,7 @@ int zfcp_fsf_open_lun(struct zfcp_erp_action *erp_action) 
		zfcp_fsf_req_free(req);

		erp_action->fsf_req_id = 0;

	}

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */

out:

	spin_unlock_irq(&qdio->req_q_lock);

	return retval;
@@ -1987,6 +2024,7 @@ int zfcp_fsf_close_lun(struct zfcp_erp_action *erp_action) 
		zfcp_fsf_req_free(req);

		erp_action->fsf_req_id = 0;

	}

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */

out:

	spin_unlock_irq(&qdio->req_q_lock);

	return retval;
@@ -2299,6 +2337,7 @@ int zfcp_fsf_fcp_cmnd(struct scsi_cmnd *scsi_cmnd) 
	retval = zfcp_fsf_req_send(req);

	if (unlikely(retval))

		goto failed_scsi_cmnd;

	/* NOTE: DO NOT TOUCH req PAST THIS POINT! */



	goto out;
@@ -2373,8 +2412,10 @@ struct zfcp_fsf_req *zfcp_fsf_fcp_task_mgmt(struct scsi_device *sdev, 
	zfcp_fc_fcp_tm(fcp_cmnd, sdev, tm_flags);



	zfcp_fsf_start_timer(req, ZFCP_FSF_SCSI_ER_TIMEOUT);

	if (!zfcp_fsf_req_send(req))

	if (!zfcp_fsf_req_send(req)) {

		/* NOTE: DO NOT TOUCH req, UNTIL IT COMPLETES! */

		goto out;

	}



	zfcp_fsf_req_free(req);

	req = NULL;

drivers/scsi/hosts.c

+3 −0
Original line number Diff line number Diff line
@@ -462,6 +462,9 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize) 
	else

		shost->dma_boundary = 0xffffffff;



	if (sht->virt_boundary_mask)

		shost->virt_boundary_mask = sht->virt_boundary_mask;



	device_initialize(&shost->shost_gendev);

	dev_set_name(&shost->shost_gendev, "host%d", shost->host_no);

	shost->shost_gendev.bus = &scsi_bus_type;

CRA Git | Maintained and supported by SUSTech CRA and CCSE