luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

SCSI fixes on 20161021

Browse Source 
Five small fixes.  Some of these, like the nested spinlock overwriting saved
 flags and the Kasan use after free look serious, but they seem not to have
 been picked up in testing or seen in the field.  The biggest user visible
 issue is probably the wrong device handler for Clariion, which means that alua
 doesn't bind to the array like it should.
 
 Signed-off-by: James Bottomley <jejb@linux.vnet.ibm.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJYCkR8AAoJEAVr7HOZEZN44WYQALPU6JSf/NAEv6wNAoD4eUBu
 uwIfLHn+gUDKZFX5n+XZs4UsBtSQqRtIzooem7Xp5WmC8H/aZgFJTn+F7xkZ9YKY
 hCm0E5Frz2K1euXeASdlbRmGm+sXec4YVu0mzdy8LON15uJNkqJAPq/RxVvhqQzo
 8KwZ8dp1Gbed8DB8Ka/WkIciEY3xR/9Man+bFTOV/XJ7tiZYxsTtclFVWZ2KrDwn
 1J9ZLGr4x1+YsusQc0zA9ykGO3XVUxdG8HHRLtAQo6IKK+SDOO0+6p3B94Ay0YSb
 XPdeA8XVqC5kmOX6HBAGYa0uzcoFFVYU3ADw4cFmbvfOvaaeeM4vuhG4vm++ieVI
 NjX/+9epyc25lJ6S2frCaR1rRHjODLbuo2xgEcs+2wuQu4cYrQxIZUUVeeLB11HO
 WFzaSS8CFmDRokxR1sqFNq1o+JQ3jcnbQwc2awrYDfzV4RPRcHUx0HNIEo0JVsjJ
 oMKCSiEJG6RslRNC1hTJGtdxPk9A4MtQBhfzhdqHBJvKQZjO7g3ivOcbHn0iMk1g
 9U+fWvhaXRDXUEiiGFip3rLNnmN0lQCWWtq4jvYBY6VBT39V2FauGJ8707HeCujN
 GKFRM60qzIc7Xus24HfgUp6/BMMwTrL7T3TLUxukRKS1G+N/qKHpev3i96NB0gAY
 Rn39EUX/YIEuTONNnv50
 =nB7G
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Five small fixes.

  Some of these, like the nested spinlock overwriting saved flags and
  the Kasan use after free look serious, but they seem not to have been
  picked up in testing or seen in the field.

  The biggest user visible issue is probably the wrong device handler
  for Clariion, which means that alua doesn't bind to the array like it
  should"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ipr: Fix async error WARN_ON
  scsi: zfcp: spin_lock_irqsave() is not nestable
  scsi: Remove one useless stack variable
  scsi: Fix use-after-free
  scsi: Replace wrong device handler name for CLARiiON arrays
This commit is contained in:
Linus Torvalds 2016-10-21 10:57:09 -07:00
commit 6edc51a8d4
4 changed files with 6 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/s390/scsi/zfcp_dbf.c
View File

@ -384,7 +384,7 @@ void zfcp_dbf_san(char *tag, struct zfcp_dbf *dbf,
/* if (len > rec_len): /* if (len > rec_len):
* dump data up to cap_len ignoring small duplicate in rec->payload * dump data up to cap_len ignoring small duplicate in rec->payload
*/ */
spin_lock_irqsave(&dbf->pay_lock, flags); spin_lock(&dbf->pay_lock);
memset(payload, 0, sizeof(*payload)); memset(payload, 0, sizeof(*payload));
memcpy(payload->area, paytag, ZFCP_DBF_TAG_LEN); memcpy(payload->area, paytag, ZFCP_DBF_TAG_LEN);
payload->fsf_req_id = req_id; payload->fsf_req_id = req_id;

3
drivers/scsi/ipr.c
View File

@ -2586,7 +2586,6 @@ static void ipr_process_error(struct ipr_cmnd *ipr_cmd)
struct ipr_hostrcb *hostrcb = ipr_cmd->u.hostrcb; struct ipr_hostrcb *hostrcb = ipr_cmd->u.hostrcb;
u32 ioasc = be32_to_cpu(ipr_cmd->s.ioasa.hdr.ioasc); u32 ioasc = be32_to_cpu(ipr_cmd->s.ioasa.hdr.ioasc);
u32 fd_ioasc; u32 fd_ioasc;
char *envp[] = { "ASYNC_ERR_LOG=1", NULL };
if (ioa_cfg->sis64) if (ioa_cfg->sis64)
fd_ioasc = be32_to_cpu(hostrcb->hcam.u.error64.fd_ioasc); fd_ioasc = be32_to_cpu(hostrcb->hcam.u.error64.fd_ioasc);
@ -2607,8 +2606,8 @@ static void ipr_process_error(struct ipr_cmnd *ipr_cmd)
} }
list_add_tail(&hostrcb->queue, &ioa_cfg->hostrcb_report_q); list_add_tail(&hostrcb->queue, &ioa_cfg->hostrcb_report_q);
schedule_work(&ioa_cfg->work_q);
hostrcb = ipr_get_free_hostrcb(ioa_cfg); hostrcb = ipr_get_free_hostrcb(ioa_cfg);
kobject_uevent_env(&ioa_cfg->host->shost_dev.kobj, KOBJ_CHANGE, envp);
ipr_send_hcam(ioa_cfg, IPR_HCAM_CDB_OP_CODE_LOG_DATA, hostrcb); ipr_send_hcam(ioa_cfg, IPR_HCAM_CDB_OP_CODE_LOG_DATA, hostrcb);
} }

6
drivers/scsi/scsi_dh.c
View File

@ -36,9 +36,9 @@ struct scsi_dh_blist {
}; };
static const struct scsi_dh_blist scsi_dh_blist[] = { static const struct scsi_dh_blist scsi_dh_blist[] = {
{"DGC", "RAID", "clariion" }, {"DGC", "RAID", "emc" },
{"DGC", "DISK", "clariion" }, {"DGC", "DISK", "emc" },
{"DGC", "VRAID", "clariion" }, {"DGC", "VRAID", "emc" },
{"COMPAQ", "MSA1000 VOLUME", "hp_sw" }, {"COMPAQ", "MSA1000 VOLUME", "hp_sw" },
{"COMPAQ", "HSV110", "hp_sw" }, {"COMPAQ", "HSV110", "hp_sw" },

6
drivers/scsi/scsi_scan.c
View File

@ -1307,7 +1307,6 @@ static void scsi_sequential_lun_scan(struct scsi_target *starget,
static int scsi_report_lun_scan(struct scsi_target *starget, int bflags, static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
enum scsi_scan_mode rescan) enum scsi_scan_mode rescan)
{ {
char devname[64];
unsigned char scsi_cmd[MAX_COMMAND_SIZE]; unsigned char scsi_cmd[MAX_COMMAND_SIZE];
unsigned int length; unsigned int length;
u64 lun; u64 lun;
@ -1349,9 +1348,6 @@ static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
} }
} }
sprintf(devname, "host %d channel %d id %d",
shost->host_no, sdev->channel, sdev->id);
/* /*
* Allocate enough to hold the header (the same size as one scsi_lun) * Allocate enough to hold the header (the same size as one scsi_lun)
* plus the number of luns we are requesting. 511 was the default * plus the number of luns we are requesting. 511 was the default
@ -1470,12 +1466,12 @@ static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
out_err: out_err:
kfree(lun_data); kfree(lun_data);
out: out:
scsi_device_put(sdev);
if (scsi_device_created(sdev)) if (scsi_device_created(sdev))
/* /*
* the sdev we used didn't appear in the report luns scan * the sdev we used didn't appear in the report luns scan
*/ */
__scsi_remove_device(sdev); __scsi_remove_device(sdev);
scsi_device_put(sdev);
return ret; return ret;
} }