- 03 Nov, 2015 13 commits
-
-
Calvin Owens authored
In sg_common_write(), we free the block request and return -ENODEV if the device is detached in the middle of the SG_IO ioctl(). Unfortunately, sg_finish_rem_req() also tries to free srp->rq, so we end up freeing rq->cmd in the already free rq object, and then free the object itself out from under the current user. This ends up corrupting random memory via the list_head on the rq object. The most common crash trace I saw is this: ------------[ cut here ]------------ kernel BUG at block/blk-core.c:1420! Call Trace: [<ffffffff81281eab>] blk_put_request+0x5b/0x80 [<ffffffffa0069e5b>] sg_finish_rem_req+0x6b/0x120 [sg] [<ffffffffa006bcb9>] sg_common_write.isra.14+0x459/0x5a0 [sg] [<ffffffff8125b328>] ? selinux_file_alloc_security+0x48/0x70 [<ffffffffa006bf95>] sg_new_write.isra.17+0x195/0x2d0 [sg] [<ffffffffa006cef4>] sg_ioctl+0x644/0xdb0 [sg] [<ffffffff81170f80>] do_vfs_ioctl+0x90/0x520 [<ffffffff81258967>] ? file_has_perm+0x97/0xb0 [<ffffffff811714a1>] SyS_ioctl+0x91/0xb0 [<ffffffff81602afb>] tracesys+0xdd/0xe2 RIP [<ffffffff81281e04>] __blk_put_request+0x154/0x1a0 The solution is straightforward: just set srp->rq to NULL in the failure branch so that sg_finish_rem_req() doesn't attempt to re-free it. Additionally, since sg_rq_end_io() will never be called on the object when this happens, we need to free memory backing ->cmd if it isn't embedded in the object itself. KASAN was extremely helpful in finding the root cause of this bug. Signed-off-by:Calvin Owens <calvinowens@fb.com> Acked-by:
Douglas Gilbert <dgilbert@interlog.com> Signed-off-by:
Martin K. Petersen <martin.petersen@oracle.com>
-
Benjamin Rood authored
If MSI(X) interrupts are disabled via the kernel command line (pci=nomsi), the pm8001 driver will kernel panic because it does not detect that MSI interrupts are disabled and will soldier on and attempt to configure MSI interrupts anyways. This leads to a kernel panic, most likely because a required data structure is not available down the line. Using the pci_msi_enabled() function in order to detect if MSI interrupts are enabled before configuring them resolves this issue and avoids a kernel panic when the module is loaded. Additionally, the irq_vector structure must be initialized when legacy interrupts are being used otherwise legacy interrupts will simply not function and result in another panic. Signed-off-by:
Benjamin Rood <brood@attotech.com> Reviewed-by:
Jack Wang <jinpu.wang@profitbricks.com> Reviewed-by:
Hannes Reinecke <hare@suse.de> Signed-off-by:
-
Benjamin Rood authored
The documentation for the 8070 and 8072 SPCv chip explicitly states that a minimum of 500ms must elapse before issuing commands, otherwise the SPCv may not process them and the firmware may get into an unrecoverable state requiring a reboot. While the Linux guys will probably think this is 'racy', it is called out in the chip documentation and inserting this delay makes power management function properly. Signed-off-by:
-
Benjamin Rood authored
ATTO adapters do not support this feature. If the firmware fails to be ready, it should not check the examined registers in order to examine the state of the feature in order to prevent undefined behavior. Signed-off-by:
-
Benjamin Rood authored
PHY profiles are not saved in NVRAM on ATTO 12Gb SAS controllers. Therefore, in order for the controller to function in a wide range of configurations, the PHY profiles must be statically set. This patch provides the necessary functionality to do so. Signed-off-by:
-
Benjamin Rood authored
ATTO SAS controllers retrieve the SAS address from the NVRAM in a location different from non-ATTO PMC Sierra SAS controllers. This patch makes the necessary adjustments in order to retrieve the SAS address on these types of adapters. Signed-off-by:
-
Benjamin Rood authored
These PCI IDs allow the pm8001 driver to load against ATTO 12Gb SAS controllers that use PMC Sierra 8070 and PMC Sierra 8072 SAS chips. Signed-off-by:
-
Benjamin Rood authored
These SAS controllers support speeds up to 12Gb. Signed-off-by:
-
Benjamin Rood authored
Previuosly, all PMC Sierra 80xx controllers are assumed to be a motherboard controller, except if the subsystem vendor ID was equal to PCI_VENDOR_ID_ADAPTEC. The driver then attempts to load PHY settings from NVRAM. While this may be correct behavior for most controllers, it does not work with Adaptec and ATTO controllers since they do not store PHY settings in NVRAM and choose to use either custom PHY settings or chip defaults. Loading random values from NVRAM may cause the controllers to malfunction in this edge case. Signed-off-by:
-
Brian King authored
This patch fixes an issue seen with an IBM 2145 (SVC) where, following an error injection test which results in paths going offline, when they came back online, the path would timeout the REPORT_LUNS issued during the scan. This timeout situation continued until retries were expired, resulting in falling back to a sequential LUN scan. Then, since the target responds with PQ=1, PDT=0 for all possible LUNs, due to the way the sequential LUN scan code works, we end up adding 512 LUNs for each target, when there is really only a small handful of LUNs that are actually present. This patch increases the timeout used on the REPORT_LUNS to 30 seconds. This patch solves the issue of 512 non existent LUNs showing up after this event. Signed-off-by:
Brian King <brking@linux.vnet.ibm.com> Reviewed-by:
-
sumit.saxena@avagotech.com authored
Signed-off-by:
Sumit Saxena <sumit.saxena@avagotech.com> Reviewed-by:
Tomas Henzl <thenzl@redhat.com> Signed-off-by:
-
sumit.saxena@avagotech.com authored
Signed-off-by:
-
sumit.saxena@avagotech.com authored
This is an issue on SMAP enabled CPUs and 32 bit apps running on 64 bit OS. Do not access user memory from kernel code. The SMAP bit restricts accessing user memory from kernel code. Cc: <stable@vger.kernel.org> Signed-off-by:
Kashyap Desai <kashyap.desai@avagotech.com> Reviewed-by:
-
- 29 Oct, 2015 19 commits
-
-
sumit.saxena@avagotech.com authored
Signed-off-by:
-
sumit.saxena@avagotech.com authored
It may happen (kdump), that an interrupt is invoked just after the setup_irqs function was called but before the tasklet was initialised. At this phase the hw ints should have been disabled, but for unknown reason this mechanism seems to not work properly. From: Tomas Henzl <thenzl@redhat.com> Signed-off-by:
-
sumit.saxena@avagotech.com authored
Signed-off-by:
-
sumit.saxena@avagotech.com authored
Signed-off-by:
-
sumit.saxena@avagotech.com authored
Do not use PAGE_SIZE marco to calculate max_sectors per I/O request. Driver code assumes PAGE_SIZE will be always 4096 which can lead to wrongly calculated value if PAGE_SIZE is not 4096. This issue was reported in Ubuntu Bugzilla Bug #1475166. Cc: <stable@vger.kernel.org> Signed-off-by:
-
sumit.saxena@avagotech.com authored
Signed-off-by:
-
sumit.saxena@avagotech.com authored
Signed-off-by:
-
sumit.saxena@avagotech.com authored
Remove PCI id based checks and use instance->ctrl_context to decide whether controller is MFI-based or a Fusion adapter. Additionally, Fusion adapters are divided into two categories: Thunderbolt and Invader. Signed-off-by:
-
sumit.saxena@avagotech.com authored
Expose non-disk (TAPE drive, CD-ROM) unconditionally. Cc: <stable@vger.kernel.org> Signed-off-by:
-
sumit.saxena@avagotech.com authored
Signed-off-by:
-
sumit.saxena@avagotech.com authored
Some of these code changes were proposed by David Binderman. Removed redudant check of requestorId. Redundant condition: instance.requestorId. Check for plasma firmware 1.11 are now restructured to support only specific device id. Signed-off-by:
-
sumit.saxena@avagotech.com authored
Syncro firmware supports round robin I/O switching on dual path. Driver uses validHandles to check for dual path. However, it is supposed to check for values > 1 (not > 2). Signed-off-by:
-
sumit.saxena@avagotech.com authored
Print firmware events in human-readable form. This will help users track any critical firmware events without special application support. Sample syslogd output: megaraid_sas 0000:02:00.0: 8619 (491648347s/0x0020/WARN) - Controller temperature threshold exceeded. This may indicate inadequate system cooling. Switching to low performance mode. The format of logged events is: "<pci_dev_id>: <sequence_number> (<timestamp>/<locale>/<class>) - <description>" Signed-off-by:
-
sumit.saxena@avagotech.com authored
Fix the issue reported at: http://marc.info/?l=linux-scsi&m=143694494104544&w=2 Try to do chip reset at driver load time. If firmware fails to reach ready state, try chip reset using adp_reset() callback. For Fusion adapters the call back was previously void. Provide a suitable reset function. Signed-off-by:
-
sumit.saxena@avagotech.com authored
Driver will expose max sge = 256 (earlier it was 64) if firmware supports extended IO size (1M). Signed-off-by:
-
sumit.saxena@avagotech.com authored
Signed-off-by:
-
sumit.saxena@avagotech.com authored
Implemented JBOD map which will provide quick access for JBOD path and also provide sequence number. This will help hardware to fail command to the FW in case of any sequence mismatch. Fast Path I/O for JBOD will refer JBOD map (which has sequence number per JBOD device) instead of RAID map. Previously, the driver used RAID map to get device handle for fast path I/O and this not have sequence number information. Now, driver will use JBOD map instead. As part of error handling, if JBOD map is failed/not supported by firmware, driver will continue using legacy behavior. Now there will be three IO paths for JBOD (syspd): - JBOD map with sequence number (Fast Path) - RAID map without sequence number (Fast Path) - FW path via h/w exception queue deliberately setup devhandle 0xFFFF (FW path). Relevant data structures: - Driver send new DCMD MR_DCMD_SYSTEM_PD_MAP_GET_INFO for this purpose. - struct MR_PD_CFG_SEQ- This structure represent map of single physical device. - struct MR_PD_CFG_SEQ_NUM_SYNC- This structure represent whole JBOD map in general(size, count of sysPDs configured, struct MR_PD_CFG_SEQ of syspD with 0 index). - JBOD sequence map size is: sizeof(struct MR_PD_CFG_SEQ_NUM_SYNC) + (sizeof(struct MR_PD_CFG_SEQ) * (MAX_PHYSICAL_DEVICES - 1)) which is allocated while setting up JBOD map at driver load time. Signed-off-by:
-
sumit.saxena@avagotech.com authored
Signed-off-by:
-
sumit.saxena@avagotech.com authored
Signed-off-by:
-
- 27 Oct, 2015 8 commits
-
-
Alan Stern authored
The "compatible" matching algorithm used for looking up old-style blacklist entries in a scsi_dev_info_list is buggy. The core of the algorithm looks like this: if (memcmp(devinfo->vendor, vendor, min(max, strlen(devinfo->vendor)))) /* not a match */ where max is the length of the device's vendor string after leading spaces have been removed but trailing spaces have not. Because of the min() computation, either entry could be a proper substring of the other and the code would still think that they match. In the case originally reported, the device's vendor and product strings were "Inateck " and " ". These matched against the following entry in the global device list: {"", "Scanner", "1.80", BLIST_NOLUN} because "" is a substring of "Inateck " and "" (the result of removing leading spaces from the device's product string) is a substring of "Scanner". The mistaken match prevented the system from scanning and finding the device's second Logical Unit. This patch fixes the problem by making two changes. First, the code for leading-space removal is hoisted out of the loop. (This means it will sometimes run unnecessarily, but since a large percentage of all lookups involve the "compatible" entries in global device list, this should be an overall improvement.) Second and more importantly, the patch removes trailing spaces and adds a check to verify that the two resulting strings are exactly the same length. This prevents matches where one entry is a proper substring of the other. Signed-off-by:Alan Stern <stern@rowland.harvard.edu> Reported-by:
Giulio Bernardi <ugilio@gmail.com> Tested-by:
James Bottomley <JBottomley@Odin.com>
-
Alan Stern authored
In drivers/scsi/scsi_devinfo.c, the scsi_dev_info_list_del_keyed() and scsi_get_device_flags_keyed() routines contain a large amount of duplicate code for finding vendor/product matches in a scsi_dev_info_list. This patch factors out the duplicate code and puts it in a separate function, scsi_dev_info_list_find(). Signed-off-by:
-
Maurizio Lombardi authored
the kernel prints some warnings when compiled with CONFIG_DMA_API_DEBUG. This is because the fnic driver doesn't check the return value of pci_map_single(). [ 11.942770] scsi host12: fnic [ 11.950811] ------------[ cut here ]------------ [ 11.950818] WARNING: at lib/dma-debug.c:937 check_unmap+0x47b/0x920() [ 11.950821] fnic 0000:0c:00.0: DMA-API: device driver failed to check map error[device address=0x0000002020a30040] [size=44 bytes] [mapped as single] Signed-off-by:
Maurizio Lombardi <mlombard@redhat.com> Reviewed-by:
Johannes Thumshirn <jthumshirn@suse.de> Reviewed By: Tomas Henzl <thenzl@redhat.com> Signed-off-by:
-
Ketan Mukadam authored
We would like to get the following updates in: Revert ownership to "Emulex" from "Avago Technologies" Signed-off-by:Ketan Mukadam <ketan.mukadam@avagotech.com> Reviewed-by:
Mike Christie <michaelc@cs.wisc.edu> Signed-off-by:
-
Ketan Mukadam authored
Signed-off-by:
-
Shirish Pargaonkar authored
Do not log error for netevents that need no action such as NETDEV_REGISTER 0x0005, NETDEV_CHANGEADDR, and NETDEV_CHANGENAME. It results in logging error messages such as these [ 35.315872] bnx2fc: Unknown netevent 5 [ 35.315935] bnx2fc: Unknown netevent 8 [ 35.353866] bnx2fc: Unknown netevent 10 and generating bug reports. Remove logging this message as an ERROR instead of turning them into either DEBUG or INFO level messages. Signed-off-by:
Shirish Pargaonkar <spargaonkar@suse.com> Acked-by:
Eddie Wai <eddie.wai@broadcom.com> Acked-by:
Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by:
-
James Smart authored
Signed-off-by:
Dick Kennedy <dick.kennedy@avagotech.com> Signed-off-by:
James Smart <james.smart@avagotech.com> Signed-off-by:
-
James Smart authored
Initial link up defaults were not properly being tracked relative to initial FLOGI or pt2pt PLOGI. Add code to initialize them. Signed-off-by:
Hannes Reinecke <hare@suse.com> Signed-off-by:
-
