Commit 2a6edd86 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi 

Pull SCSI fixes from James Bottomley:
 "Fixes only in drivers (ufs, mvsas, qla2xxx, target) that came in just
  before or during the merge window.

  The most important one is the qla2xxx which reverts a conversion to
  fix flexible array member warnings, that went up in this merge window
  but which turned out on further testing to be causing data corruption"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
  scsi: ufs: sysfs: Make HID attributes visible
  scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
  scsi: ufs: core: Fix PM QoS mutex initialization
  scsi: ufs: core: Fix runtime suspend error deadlock
  Revert "scsi: qla2xxx: Fix memcpy() field-spanning write issue"
  scsi: target: target_core_configfs: Add length check to avoid buffer overflow
parents 9591fdb0 558ae457

drivers/scsi/mvsas/mv_init.c

+1 −1
Original line number Diff line number Diff line
@@ -124,7 +124,7 @@ static void mvs_free(struct mvs_info *mvi) 
	if (mvi->shost)

		scsi_host_put(mvi->shost);

	list_for_each_entry(mwq, &mvi->wq_list, entry)

		cancel_delayed_work(&mwq->work_q);

		cancel_delayed_work_sync(&mwq->work_q);

	kfree(mvi->rsvd_tags);

	kfree(mvi);

}

drivers/scsi/qla2xxx/qla_def.h

+4 −6
Original line number Diff line number Diff line
@@ -4890,7 +4890,9 @@ struct purex_item { 
			     struct purex_item *pkt);

	atomic_t in_use;

	uint16_t size;

	uint8_t iocb[] __counted_by(size);

	struct {

		uint8_t iocb[64];

	} iocb;

};



#include "qla_edif.h"
@@ -5099,6 +5101,7 @@ typedef struct scsi_qla_host { 
		struct list_head head;

		spinlock_t lock;

	} purex_list;

	struct purex_item default_item;



	struct name_list_extended gnl;

	/* Count of active session/fcport */
@@ -5127,11 +5130,6 @@ typedef struct scsi_qla_host { 
#define DPORT_DIAG_IN_PROGRESS                 BIT_0

#define DPORT_DIAG_CHIP_RESET_IN_PROGRESS      BIT_1

	uint16_t dport_status;



	/* Must be last --ends in a flexible-array member. */

	TRAILING_OVERLAP(struct purex_item, default_item, iocb,

		uint8_t __default_item_iocb[QLA_DEFAULT_PAYLOAD_SIZE];

	);

} scsi_qla_host_t;



struct qla27xx_image_status {

drivers/scsi/qla2xxx/qla_isr.c

+9 −8
Original line number Diff line number Diff line
@@ -1077,17 +1077,17 @@ static struct purex_item * 
qla24xx_alloc_purex_item(scsi_qla_host_t *vha, uint16_t size)

{

	struct purex_item *item = NULL;

	uint8_t item_hdr_size = sizeof(*item);



	if (size > QLA_DEFAULT_PAYLOAD_SIZE) {

		item = kzalloc(struct_size(item, iocb, size), GFP_ATOMIC);

		item = kzalloc(item_hdr_size +

		    (size - QLA_DEFAULT_PAYLOAD_SIZE), GFP_ATOMIC);

	} else {

		if (atomic_inc_return(&vha->default_item.in_use) == 1) {

			item = &vha->default_item;

			goto initialize_purex_header;

		} else {

			item = kzalloc(

				struct_size(item, iocb, QLA_DEFAULT_PAYLOAD_SIZE),

				GFP_ATOMIC);

			item = kzalloc(item_hdr_size, GFP_ATOMIC);

		}

	}

	if (!item) {
@@ -1127,16 +1127,17 @@ qla24xx_queue_purex_item(scsi_qla_host_t *vha, struct purex_item *pkt, 
 * @vha: SCSI driver HA context

 * @pkt: ELS packet

 */

static struct purex_item *

qla24xx_copy_std_pkt(struct scsi_qla_host *vha, void *pkt)

static struct purex_item

*qla24xx_copy_std_pkt(struct scsi_qla_host *vha, void *pkt)

{

	struct purex_item *item;



	item = qla24xx_alloc_purex_item(vha, QLA_DEFAULT_PAYLOAD_SIZE);

	item = qla24xx_alloc_purex_item(vha,

					QLA_DEFAULT_PAYLOAD_SIZE);

	if (!item)

		return item;



	memcpy(&item->iocb, pkt, QLA_DEFAULT_PAYLOAD_SIZE);

	memcpy(&item->iocb, pkt, sizeof(item->iocb));

	return item;

}

drivers/scsi/qla2xxx/qla_nvme.c

+1 −1
Original line number Diff line number Diff line
@@ -1308,7 +1308,7 @@ void qla2xxx_process_purls_iocb(void **pkt, struct rsp_que **rsp) 


	ql_dbg(ql_dbg_unsol, vha, 0x2121,

	       "PURLS OP[%01x] size %d xchg addr 0x%x portid %06x\n",

	       item->iocb[3], item->size, uctx->exchange_address,

	       item->iocb.iocb[3], item->size, uctx->exchange_address,

	       fcport->d_id.b24);

	/* +48    0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

	 * ----- -----------------------------------------------

drivers/scsi/qla2xxx/qla_os.c

+2 −3
Original line number Diff line number Diff line
@@ -6459,10 +6459,9 @@ void qla24xx_process_purex_rdp(struct scsi_qla_host *vha, 
void

qla24xx_free_purex_item(struct purex_item *item)

{

	if (item == &item->vha->default_item) {

	if (item == &item->vha->default_item)

		memset(&item->vha->default_item, 0, sizeof(struct purex_item));

		memset(&item->vha->__default_item_iocb, 0, QLA_DEFAULT_PAYLOAD_SIZE);

	} else

	else

		kfree(item);

}