Commit 56cbd0cc authored by James Bottomley's avatar James Bottomley

mvsas: fix panic on expander attached SATA devices

mvsas is giving a General protection fault when it encounters an expander
attached ATA device.  Analysis of mvs_task_prep_ata() shows that the driver is
assuming all ATA devices are locally attached and obtaining the phy mask by
indexing the local phy table (in the HBA structure) with the phy id.  Since
expanders have many more phys than the HBA, this is causing the index into the
HBA phy table to overflow and returning rubbish as the pointer.

mvs_task_prep_ssp() instead does the phy mask using the port properties.
Mirror this in mvs_task_prep_ata() to fix the panic.
Reported-by: default avatarAdam Talbot <ajtalbot1@gmail.com>
Tested-by: default avatarAdam Talbot <ajtalbot1@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarJames Bottomley <JBottomley@Odin.com>
parent 8041708e
...@@ -441,14 +441,11 @@ static u32 mvs_get_ncq_tag(struct sas_task *task, u32 *tag) ...@@ -441,14 +441,11 @@ static u32 mvs_get_ncq_tag(struct sas_task *task, u32 *tag)
static int mvs_task_prep_ata(struct mvs_info *mvi, static int mvs_task_prep_ata(struct mvs_info *mvi,
struct mvs_task_exec_info *tei) struct mvs_task_exec_info *tei)
{ {
struct sas_ha_struct *sha = mvi->sas;
struct sas_task *task = tei->task; struct sas_task *task = tei->task;
struct domain_device *dev = task->dev; struct domain_device *dev = task->dev;
struct mvs_device *mvi_dev = dev->lldd_dev; struct mvs_device *mvi_dev = dev->lldd_dev;
struct mvs_cmd_hdr *hdr = tei->hdr; struct mvs_cmd_hdr *hdr = tei->hdr;
struct asd_sas_port *sas_port = dev->port; struct asd_sas_port *sas_port = dev->port;
struct sas_phy *sphy = dev->phy;
struct asd_sas_phy *sas_phy = sha->sas_phy[sphy->number];
struct mvs_slot_info *slot; struct mvs_slot_info *slot;
void *buf_prd; void *buf_prd;
u32 tag = tei->tag, hdr_tag; u32 tag = tei->tag, hdr_tag;
...@@ -468,7 +465,7 @@ static int mvs_task_prep_ata(struct mvs_info *mvi, ...@@ -468,7 +465,7 @@ static int mvs_task_prep_ata(struct mvs_info *mvi,
slot->tx = mvi->tx_prod; slot->tx = mvi->tx_prod;
del_q = TXQ_MODE_I | tag | del_q = TXQ_MODE_I | tag |
(TXQ_CMD_STP << TXQ_CMD_SHIFT) | (TXQ_CMD_STP << TXQ_CMD_SHIFT) |
(MVS_PHY_ID << TXQ_PHY_SHIFT) | ((sas_port->phy_mask & TXQ_PHY_MASK) << TXQ_PHY_SHIFT) |
(mvi_dev->taskfileset << TXQ_SRS_SHIFT); (mvi_dev->taskfileset << TXQ_SRS_SHIFT);
mvi->tx[mvi->tx_prod] = cpu_to_le32(del_q); mvi->tx[mvi->tx_prod] = cpu_to_le32(del_q);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment