- 25 Sep, 2022 26 commits
-
-
Linus Torvalds authored
The passthrough structure is declared off of the stack, so it needs to be set to zero before copied back to userspace to prevent any unintentional data leakage. Switch things to be statically allocated which will fill the unused fields with 0 automatically. Link: https://lore.kernel.org/r/YxrjN3OOw2HHl9tx@kroah.com Cc: stable@kernel.org Cc: "James E.J. Bottomley" <jejb@linux.ibm.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: Dan Carpenter <dan.carpenter@oracle.com> Reported-by:
hdthky <hdthky0@gmail.com> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
Martin K. Petersen <martin.petersen@oracle.com>
-
Sreekanth Reddy authored
Update driver version to 8.2.0.3.0. Link: https://lore.kernel.org/r/20220912135742.11764-10-sreekanth.reddy@broadcom.comSigned-off-by:
Sreekanth Reddy <sreekanth.reddy@broadcom.com> Signed-off-by:
-
Sreekanth Reddy authored
Fix 'scheduling while atomic' type bug, which is observed when pci_irq_vector() is called from interrupt context. Link: https://lore.kernel.org/r/20220912135742.11764-9-sreekanth.reddy@broadcom.comSigned-off-by:
-
Sreekanth Reddy authored
Scan the target devices during system resume time and add or remove the target device with the SML if the corresponding target device is newly added or removed respectively. Link: https://lore.kernel.org/r/20220912135742.11764-8-sreekanth.reddy@broadcom.comSigned-off-by:
-
Sreekanth Reddy authored
Free the enclosure device objects during driver unload and before rescanning the target devices during controller reset. Link: https://lore.kernel.org/r/20220912135742.11764-7-sreekanth.reddy@broadcom.comSigned-off-by:
-
Sreekanth Reddy authored
Handle the 0xF003 controller fault code as a special case by marking the controller as unrecoverable with logging a message indicating the driver marks the controller as unrecoverable due to the specific fault. Link: https://lore.kernel.org/r/20220912135742.11764-6-sreekanth.reddy@broadcom.comSigned-off-by:
-
Sreekanth Reddy authored
Implement graceful handling of surprise or orderly removal of PCIe HBA: - Detect a hot removal of the controller at certain critical places in the driver. Early detection will help to reduce the time taken for cleaning up the hot-removed controller at the driver level. - Poll the status of the port enable issued after reset once every 5 seconds to avoid a long delay in detecting unavailable controller. Link: https://lore.kernel.org/r/20220912135742.11764-5-sreekanth.reddy@broadcom.comReported-by:
kernel test robot <lkp@intel.com> Signed-off-by:
-
Sreekanth Reddy authored
In RT kernels, the IRQ handler's code is executed as a kernel thread. Modify the driver to avoid explicitly scheduling the IRQ kernel thread. Link: https://lore.kernel.org/r/20220912135742.11764-4-sreekanth.reddy@broadcom.comSigned-off-by:
-
Sreekanth Reddy authored
Switch to the new generic PCI power management framework. Also, remove unnecessary calls to the PCI helper functions (such as pci_set_power_state(), pci_enable_wake(), pci_save_state(), pci_restore_state() etc). Link: https://lore.kernel.org/r/20220912135742.11764-3-sreekanth.reddy@broadcom.comSigned-off-by:
-
Sreekanth Reddy authored
Update the mpi3 header files. Link: https://lore.kernel.org/r/20220912135742.11764-2-sreekanth.reddy@broadcom.comSigned-off-by:
-
Damien Le Moal authored
This reverts commit 7ab4d244 as it is breaking the mpt3sas driver on big-endian machines. Link: https://lore.kernel.org/r/20220916130111.168195-3-damien.lemoal@opensource.wdc.comSigned-off-by:
Damien Le Moal <damien.lemoal@opensource.wdc.com> Signed-off-by:
-
Damien Le Moal authored
This reverts commit b4efbec4 as it is breaking the mpt3sas driver on big-endian machines. Link: https://lore.kernel.org/r/20220916130111.168195-2-damien.lemoal@opensource.wdc.comSigned-off-by:
-
Lukas Bulwahn authored
The historical commit 5e018f7e ("Remove PC9800 support") from 2004 in linux's history.git removed the config WD33C93_PIO to tweak the scsi wd33c93 driver for the PC9800. Some dead code in drivers/scsi/wd33c93.[ch] under an ifdef WD33C93_PIO continued to remain in the repository until now. Remove this dead code. This issue was discovered with ./scripts/checkkconfigsymbols.py. Link: https://lore.kernel.org/r/20220920112921.25275-1-lukas.bulwahn@gmail.comSigned-off-by:
Lukas Bulwahn <lukas.bulwahn@gmail.com> Signed-off-by:
-
Wu Bo authored
Currently struct scsi_device maintains counters for requests, completions, and errors but is missing a counter for timeouts. For better tracking of timeouts, add a suitable counter. Link: https://lore.kernel.org/r/1663666339-17560-1-git-send-email-wubo40@huawei.comReviewed-by:
Bart Van Assche <bvanassche@acm.org> Signed-off-by:
Wu Bo <wubo40@huawei.com> Signed-off-by:
-
Saurav Kashyap authored
Few vport parameters were displayed by systool as 'Unknown' or 'NULL'. Copy speed, supported_speed, frame_size and update port_type for NPIV port. Link: https://lore.kernel.org/r/20220919134434.3513-1-njavali@marvell.com Cc: stable@vger.kernel.org Tested-by:
Guangwu Zhang <guazhang@redhat.com> Reviewed-by:
John Meneghini <jmeneghi@redhat.com> Signed-off-by:
Saurav Kashyap <skashyap@marvell.com> Signed-off-by:
Nilesh Javali <njavali@marvell.com> Signed-off-by:
-
Gustavo A. R. Silva authored
One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct fw_control_info. This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1]. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/207 Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101836 [1] Link: https://lore.kernel.org/r/Yyy31OuBza1FJCXP@workReviewed-by:
Kees Cook <keescook@chromium.org> Acked-by:
Jack Wang <jinpu.wang@ionos.com> Signed-off-by:
Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by:
-
Gustavo A. R. Silva authored
One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct TAG_TW_New_Ioctl and refactor the rest of the code, accordingly. Notice that, in multiple places, the subtraction of 1 from sizeof(TW_New_Ioctl) is removed, as this operation is now implicit after the flex-array transformation. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/206 Link: https://lore.kernel.org/r/YyyyvB30jnjRaw/F@workReviewed-by:
-
Gustavo A. R. Silva authored
scsi: hptiop: Replace one-element array with flexible-array member in struct hpt_iop_request_ioctl_command() One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct hpt_iop_request_ioctl_command. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/205 Link: https://lore.kernel.org/r/YyyUvuId7dAZadej@workReviewed-by:
-
Gustavo A. R. Silva authored
Prefer struct_size() over open-coded versions of idiom: sizeof(struct-with-flex-array) + sizeof(typeof-flex-array-elements) * count where count is the max number of items the flexible array is supposed to contain. Link: https://github.com/KSPP/linux/issues/160 Link: https://lore.kernel.org/r/54e2bb1e39b21394c5a90cacbadfb6136b012788.1663865333.git.gustavoars@kernel.orgReviewed-by:
-
Gustavo A. R. Silva authored
One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct hpt_iop_request_scsi_command and refactor the rest of the code, accordingly. The following pieces of code suggest that the one element of array sg_list in struct hpt_iop_request_scsi_command is not taken into account when calculating the total size for both struct hpt_iop_request_scsi_command and the maximum number of elements sg_list will contain: 1047 req->header.size = cpu_to_le32( 1048 sizeof(struct hpt_iop_request_scsi_command) 1049 - sizeof(struct hpt_iopsg) 1050 + sg_count * sizeof(struct hpt_iopsg)); 1400 req_size = sizeof(struct hpt_iop_request_scsi_command) 1401 + sizeof(struct hpt_iopsg) * (hba->max_sg_descriptors - 1); So it's safe to replace the one-element array with a flexible-array member and update the code above, accordingly: now we don't need to subtract sizeof(struct hpt_iopsg) from sizeof(struct hpt_iop_request_scsi_command) because this is implicitly done by the flex-array transformation. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/205 Link: https://lore.kernel.org/r/6238ccf37798e36d783f5ce5e483e6837e98be79.1663865333.git.gustavoars@kernel.orgReviewed-by:
-
John Garry authored
Disabling the remote phy for a SATA disk causes a hang: root@(none)$ more /sys/class/sas_phy/phy-0:0:8/target_port_protocols sata root@(none)$ echo 0 > sys/class/sas_phy/phy-0:0:8/enable root@(none)$ [ 67.855950] sas: ex 500e004aaaaaaa1f phy08 change count has changed [ 67.920585] sd 0:0:2:0: [sdc] Synchronizing SCSI cache [ 67.925780] sd 0:0:2:0: [sdc] Synchronize Cache(10) failed: Result: hostbyte=0x04 driverbyte=DRIVER_OK [ 67.935094] sd 0:0:2:0: [sdc] Stopping disk [ 67.939305] sd 0:0:2:0: [sdc] Start/Stop Unit failed: Result: hostbyte=0x04 driverbyte=DRIVER_OK ... [ 123.998998] INFO: task kworker/u192:1:642 blocked for more than 30 seconds. [ 124.005960] Not tainted 6.0.0-rc1-205202-gf26f8f761e83 #218 [ 124.012049] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 124.019872] task:kworker/u192:1 state:D stack:0 pid: 642 ppid: 2 flags:0x00000008 [ 124.028223] Workqueue: 0000:04:00.0_event_q sas_port_event_worker [ 124.034319] Call trace: [ 124.036758] __switch_to+0x128/0x278 [ 124.040333] __schedule+0x434/0xa58 [ 124.043820] schedule+0x94/0x138 [ 124.047045] schedule_timeout+0x2fc/0x368 [ 124.051052] wait_for_completion+0xdc/0x200 [ 124.055234] __flush_workqueue+0x1a8/0x708 [ 124.059328] sas_porte_broadcast_rcvd+0xa8/0xc0 [ 124.063858] sas_port_event_worker+0x60/0x98 [ 124.068126] process_one_work+0x3f8/0x660 [ 124.072134] worker_thread+0x70/0x700 [ 124.075793] kthread+0x1a4/0x1b8 [ 124.079014] ret_from_fork+0x10/0x20 The issue is that the per-device running_req read in pm8001_dev_gone_notify() never goes to zero and we never make progress. This is caused by missing accounting for running_req for when an internal abort command completes. In commit 2cbbf489 ("scsi: pm8001: Use libsas internal abort support") we started to send internal abort commands as a proper sas_task. In this when we deliver a sas_task to HW the per-device running_req is incremented in pm8001_queue_command(). However it is never decremented for internal abort commnds, so decrement in pm8001_mpi_task_abort_resp(). Link: https://lore.kernel.org/r/1663854664-76165-1-git-send-email-john.garry@huawei.com Fixes: 2cbbf489 ("scsi: pm8001: Use libsas internal abort support") Acked-by:
John Garry <john.garry@huawei.com> Signed-off-by:
-
Duoming Zhou authored
When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to delete "slow_task->timer". However, if the timer handler sas_task_internal_timedout() is running, the del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below: (thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ... sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the "task->slow_task" is deallocated. Link: https://lore.kernel.org/r/20220920144213.10536-1-duoming@zju.edu.cn Fixes: 2908d778 ("[SCSI] aic94xx: new driver") Reviewed-by:Jason Yan <yanaijie@huawei.com> Signed-off-by:
Duoming Zhou <duoming@zju.edu.cn> Signed-off-by:
-
Kees Cook authored
In order to help the compiler reason about the destination buffer in struct fc_nl_event, add a flexible array member for this purpose. However, since the header is UAPI, it must not change size or layout, so a union is used. The allocation size calculations are also corrected (it was potentially allocating an extra 8 bytes), and the padding is zeroed to avoid leaking kernel heap memory contents. Detected at run-time by the recently added memcpy() bounds checking: memcpy: detected field-spanning write (size 8) of single field "&event->event_data" at drivers/scsi/scsi_transport_fc.c:581 (size 4) Link: https://lore.kernel.org/linux-next/42404B5E-198B-4FD3-94D6-5E16CF579EF3@linux.ibm.com/ Link: https://lore.kernel.org/r/20220921205155.1451649-1-keescook@chromium.org Cc: "James E.J. Bottomley" <jejb@linux.ibm.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: linux-scsi@vger.kernel.org Reported-by:
Sachin Sant <sachinp@linux.ibm.com> Tested-by:
James Smart <jsmart2021@gmail.com> Signed-off-by:
-
Arthur Simchaev authored
Remove Query-Request API function declarations from include/ufs/ufshcd.h and move them to the ufs core private header. Link: https://lore.kernel.org/r/1663761485-2532-1-git-send-email-Arthur.Simchaev@wdc.comReviewed-by:
Bean Huo <beanhuo@micron.com> Reviewed-by:
Arthur Simchaev <Arthur.Simchaev@wdc.com> Signed-off-by:
-
Lukas Bulwahn authored
SCSI_MOD is a helper config symbol for configuring RAID_ATTRS properly, i.e., RAID_ATTRS needs to be m when SCSI=m. This helper config symbol SCSI_MOD still shows up even in kernel configurations that do not select the block subsystem and where SCSI is not even a configuration option mentioned and selectable. Make this SCSI_MOD depend on BLOCK, so that it only shows up when it is slightly relevant in the kernel configuration. Link: https://lore.kernel.org/r/20220919060112.24802-1-lukas.bulwahn@gmail.comReviewed-by:
-
Arun Easi authored
Fix this compilation error seen when CONFIG_TRACING is not enabled: drivers/scsi/qla2xxx/qla_os.c: In function 'qla_trace_init': drivers/scsi/qla2xxx/qla_os.c:2854:25: error: implicit declaration of function 'trace_array_get_by_name'; did you mean 'trace_array_set_clr_event'? [-Werror=implicit-function-declaration] 2854 | qla_trc_array = trace_array_get_by_name("qla2xxx"); | ^~~~~~~~~~~~~~~~~~~~~~~ | trace_array_set_clr_event drivers/scsi/qla2xxx/qla_os.c: In function 'qla_trace_uninit': drivers/scsi/qla2xxx/qla_os.c:2869:9: error: implicit declaration of function 'trace_array_put' [-Werror=implicit-function-declaration] 2869 | trace_array_put(qla_trc_array); | ^~~~~~~~~~~~~~~ Link: https://lore.kernel.org/r/20220907233308.4153-2-aeasi@marvell.comReported-by:Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by:
Arun Easi <aeasi@marvell.com> Signed-off-by:
-
- 16 Sep, 2022 14 commits
-
-
Martin Wilck authored
dev_loss_tmo is an unsigned value. Using "%d" as output format causes irritating negative values to be shown in sysfs. Link: https://lore.kernel.org/r/20220902131519.16513-1-mwilck@suse.comReviewed-by:
Steffen Maier <maier@linux.ibm.com> Signed-off-by:
Martin Wilck <mwilck@suse.com> Signed-off-by:
-
Xuezhi Zhang authored
Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Link: https://lore.kernel.org/r/20220901015130.419307-1-zhangxuezhi3@gmail.comReviewed-by:
Xuezhi Zhang <zhangxuezhi1@coolpad.com> Signed-off-by:
-
Xuezhi Zhang authored
Fix up sysfs show entries to use sysfs_emit() Link: https://lore.kernel.org/r/20220831140325.396295-1-zhangxuezhi3@gmail.comReviewed-by:
-
wangjianli authored
Delete the redundant word 'to'. Link: https://lore.kernel.org/r/20220908130910.35680-1-wangjianli@cdjrlc.comReviewed-by:
Chaitanya Kulkarni <kch@nvidia.com> Signed-off-by:
wangjianli <wangjianli@cdjrlc.com> Signed-off-by:
-
James Smart authored
Update lpfc version to 14.2.0.7 Link: https://lore.kernel.org/r/20220911221505.117655-14-jsmart2021@gmail.comCo-developed-by:
Justin Tee <justin.tee@broadcom.com> Signed-off-by:
-
James Smart authored
This patch fixes below Smatch reported issues: 1. lpfc_hbadisc.c:3020 lpfc_mbx_cmpl_fcf_rr_read_fcf_rec() error: uninitialized symbol 'vlan_id'. 2. lpfc_hbadisc.c:3121 lpfc_mbx_cmpl_read_fcf_rec() error: uninitialized symbol 'vlan_id'. 3. lpfc_init.c:335 lpfc_dump_wakeup_param_cmpl() warn: always true condition '(prg->dist < 4) => (0-3 < 4)' 4. lpfc_init.c:2419 lpfc_parse_vpd() warn: inconsistent indenting. 5. lpfc_init.c:13248 lpfc_sli4_enable_msi() warn: 'phba->pcidev->irq' 2147483648 can't fit into 65535 'eqhdl->irq' 6. lpfc_debugfs.c:5300 lpfc_idiag_extacc_avail_get() error: uninitialized symbol 'ext_cnt' 7. lpfc_debugfs.c:5300 lpfc_idiag_extacc_avail_get() error: uninitialized symbol 'ext_size' 8. lpfc_vmid.c:248 lpfc_vmid_get_appid() warn: sleeping in atomic context. 9. lpfc_init.c:8342 lpfc_sli4_driver_resource_setup() warn: missing error code 'rc'. 10. lpfc_init.c:13573 lpfc_sli4_hba_unset() warn: variable dereferenced before check 'phba->pport' (see line 13546) 11. lpfc_auth.c:1923 lpfc_auth_handle_dhchap_reply() error: double free of 'hash_value' Fixes: 1. Initialize vlan_id to LPFC_FCOE_NULL_VID. 2. Initialize vlan_id to LPFC_FCOE_NULL_VID. 3. prg->dist is a 2 bit field. Its value can only be between 0-3. Remove redundent check 'if (prg->dist < 4)'. 4. Fix inconsistent indenting. Moved logic into helper function lpfc_fill_vpd(). 5. Define 'eqhdl->irq' as int value as pci_irq_vector() returns int. Also, check for return value of pci_irq_vector() and log message in case of failure. 6. Initialize 'ext_cnt' to 0. 7. Initialize 'ext_size' to 0. 8. Use alloc_percpu_gfp() with GFP_ATOMIC flag. 9. 'rc' was not updated when dma_pool_create() fails. Update 'rc = -ENOMEM' when dma_pool_create() fails before calling goto statement. 10. Add check for 'phba->pport' in lpfc_cpuhp_remove(). 11. Initialize 'hash_value' to NULL, same like 'aug_chal' variable. Link: https://lore.kernel.org/r/20220911221505.117655-13-jsmart2021@gmail.comCo-developed-by: -
James Smart authored
Firmware reports link degrade signaling via ACQES. Handlers and new additions to the SET_FEATURES mbox command are implemented so that link degrade parameters for 64GB capable links are reported through EDC ELS frames. Link: https://lore.kernel.org/r/20220911221505.117655-12-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
Removed the lpfc_fdmi_attr_entry and lpfc_fdmi_attr_def structures that had a union causing unintentional zero padding, which required the usage of __packed. They are replaced with explicit lpfc_fdmi_attr_u32, lpfc_fdmi_attr_wwn, lpfc_fdmi_attr_fc4types, and lpfc_fdmi_attr_string structure defines instead of living in a union. This rids of ambiguous compiler zero padding, and entailed cleaning up bitwise endian declarations. As such, all FDMI attribute registration routines are replaced with generic void *arg and handlers for each of the newly defined attribute structure types. Link: https://lore.kernel.org/r/20220911221505.117655-11-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
Switch case logics are reworked so they appear more similar and consistent. This eliminates compiler errors indicating unaligned pointer values and packed members. Added comments to explain previous size offset accumulations. Link: https://lore.kernel.org/r/20220911221505.117655-10-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
Clarify naming of the mp/bmp dma buffers: - Rename mp to rq as it is the request buffer - Rename bmp to rsp as it is the response buffer This reduces confusion about what the buffer content is based on their name. Link: https://lore.kernel.org/r/20220911221505.117655-9-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
If there is a congestion or automated congestion response mode change, then log the reported change to kmsg. Link: https://lore.kernel.org/r/20220911221505.117655-8-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
On a PCI hotplug capable system, it is possible for scsi_device_put() to happen after lpfc_pci_remove_one() is called. As a result, the sdev->host->hostt->module dereference is for a previously freed memory location because the phba structure containing the hostt template was already freed when lpfc_pci_remove_one() returned. Since the lpfc module is still loaded during power slot disable, all scsi_host_templates should be declared as part of the global data segment instead of inside the heap allocated phba structure. This way the sdev->host->hostt memory area is always valid as long as the module is loaded regardless if PCI hotplug dynamically allocates or frees phba structures. Move all scsi_host_templates in the phba structure to global variables. Create a small helper routine to determine appropriate sg_tablesize during shost allocation. Link: https://lore.kernel.org/r/20220911221505.117655-7-jsmart2021@gmail.comCo-developed-by:
Dwip N. Banerjee <dnbanerg@us.ibm.com> Signed-off-by:
Daniel Wagner <dwagner@suse.de> Signed-off-by:
-
James Smart authored
When a target makes the mistake of registering a FC4 type with the fabric, but then rejects a PRLI of that type, the lpfc driver incorrectly retries the PRLI causing multiple registrations with the transport. The driver needs to detect the reject reason data and stop any retry. Rework the PRLI reject scenarios. Link: https://lore.kernel.org/r/20220911221505.117655-6-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
Sometimes VMID targets are not getting rediscovered after a port reset. The iocb is not freed in lpfc_cmpl_ct_cmd_vmid(), which is the completion function for the appid CT commands. So after a port reset, the count of sges is less than the expected count of 250. This causes post reset operation logic to fail and keep the port offline. Fix by freeing the iocb and kref put for the lpfc_cmpl_ct_cmd_vmid() early return cases. Link: https://lore.kernel.org/r/20220911221505.117655-5-jsmart2021@gmail.comCo-developed-by:
-
