linux.git/drivers/message, branch v3.18.111

scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()

2018-05-30T05:47:33+00:00

[ Upstream commit a7043e9529f3c367cc4d82997e00be034cbe57ca ]

My static checker complains about an out of bounds read:

    drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
    error: buffer overflow 'hd->sel_timeout' 255 <= u32max.

It's true that we probably should have a bounds check here.

Signed-off-by: Dan Carpenter 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

scsi: mptsas: Disable WRITE SAME

2018-04-29T05:45:30+00:00

commit 94e5395d2403c8bc2504a7cbe4c4caaacb7b8b84 upstream.

First generation MPT Fusion controllers can not translate WRITE SAME
when the attached device is a SATA drive. Disable WRITE SAME support.

Reported-by: Nikola Ciprich 
Cc: 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

i2o: hide unsafe ioctl on 64-bit

2017-05-08T05:44:12+00:00

We get a warning about a broken pointer conversion on 64-bit architectures:

drivers/message/i2o/i2o_config.c: In function 'i2o_cfg_passthru':
drivers/message/i2o/i2o_config.c:893:19: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
         (p->virt, (void __user *)sg[i].addr_bus,
                   ^
drivers/message/i2o/i2o_config.c:953:10: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
         ((void __user *)sg[j].addr_bus, sg_list[j].virt,
          ^

This has clearly never worked right, so we can add an #ifdef around the code.
The driver was moved to staging in linux-4.0 and finally removed in 4.2,
so upstream does not have a fix for it.

The driver originally got this mostly right, though probably by accident.

Fixes: f4c2c15b930b ("[PATCH] Convert i2o to compat_ioctl")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman

mptfusion: prevent some memory corruption

2015-12-03T15:04:59+00:00

[ Upstream commit e819cdb198319cccf4af4fc12ac4d796109d8c23 ]

These are signed values the come from the user, we put a cap on the
upper bounds but not on the lower bounds.

We use "karg.dataSgeOffset" to calculate "sz".  We verify "sz" and
proceed as if that means that "karg.dataSgeOffset" is correct but this
fails to consider that the "sz" calculations can have integer overflows.

Signed-off-by: Dan Carpenter 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: James Bottomley 
Signed-off-by: Sasha Levin

Merge tag 'scsi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2014-10-08T01:29:18+00:00

Pull SCSI updates from James Bottomley:
 "This patch set consists of the usual driver updates (megaraid_sas,
  arcmsr, be2iscsi, lpfc, mpt2sas, mpt3sas, qla2xxx, ufs) plus several
  assorted fixes and miscellaneous updates (including the
  pci_msix_enable_range() changes that have been pending for a while)"

* tag 'scsi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (202 commits)
  scsi: add a CONFIG_SCSI_MQ_DEFAULT option
  ufs: definitions for phy interface
  ufs: tune bkops while power managment events
  ufs: Add support for clock scaling using devfreq framework
  ufs: Add freq-table-hz property for UFS device
  ufs: Add support for clock gating
  ufs: refactor configuring power mode
  ufs: add UFS power management support
  ufs: introduce well known logical unit in ufs
  ufs: manually add well known logical units
  ufs: Active Power Mode - configuring bActiveICCLevel
  ufs: improve init sequence
  ufs: refactor query descriptor API support
  ufs: add voting support for host controller power
  ufs: Add clock initialization support
  ufs: Add regulator enable support
  ufs: Allow vendor specific initialization
  scsi: don't add scsi_device if its already visible
  scsi: fix the type for well known LUs
  scsi: fix comment in struct Scsi_Host definition
  ...

mptfusion: enable no_write_same for vmware scsi disks

2014-09-25T12:24:48+00:00

When using a virtual SCSI disk in a VMWare VM if blkdev_issue_zeroout is used
data can be improperly zeroed out using the mptfusion driver. This patch
disables write_same for this driver and the vmware subsystem_vendor which
ensures that manual zeroing out is used instead.

Cc: stable@vger.kernel.org
BugLink: http://bugs.launchpad.net/bugs/1371591
Reported-by: Bruce Lucas 
Tested-by: Chris J Arges 
Signed-off-by: Chris J Arges 
Reviewed-by: Martin K. Petersen 
Signed-off-by: Christoph Hellwig

scsi: use 'depends' instead of 'select' for SCSI_FC_ATTRS

2014-09-16T20:55:55+00:00

There are other kconfig symbols which use SCSI_FC_ATTRS.
In order to maintain sanity and prevent kconfig warnings, change
all of these from using 'select' to using 'depends on' so that
proper symbol dependencies will be honored and circular depends
problems will be avoided.
This fixes kconfig warnings and build errors:

warning: (LIBFC && SCSI_IBMVFC && SCSI_QLA_FC && SCSI_LPFC && ZFCP && SCSI_BFA_FC && SCSI_CHELSIO_FCOE && FUSION_FC) selects SCSI_FC_ATTRS which has unmet direct dependencies (SCSI && NET)
drivers/scsi/scsi_transport_fc.c: In function 'fc_host_post_event':
drivers/scsi/scsi_transport_fc.c:543:7: error: 'scsi_nl_sock' undeclared (first use in this function)
drivers/scsi/scsi_transport_fc.c: In function 'fc_host_post_vendor_event':
drivers/scsi/scsi_transport_fc.c:611:7: error: 'scsi_nl_sock' undeclared (first use in this function)

Reported-by: Fengguang Wu  [0-day test robot]
Signed-off-by: Randy Dunlap 
Signed-off-by: David S. Miller

fusion: fix excess parameter kernel-doc warning

2014-09-16T16:09:49+00:00

Fix kernel-doc excess parameter warning:

Warning(..//drivers/message/fusion/mptbase.c:1411): Excess function parameter 'prod_name' description in 'mpt_get_product_name'

Signed-off-by: Randy Dunlap 
Reviewed-by: Ewan D. Milne 
Signed-off-by: Christoph Hellwig

mptfusion: simplify rounding

2014-09-16T16:09:43+00:00

Rounding up to a multiple of 4 should be done using the ALIGN
macro. As a bonus, this also makes the generated code smaller.

In GetIocFacts(), sz is assigned to a few lines below without being
read in the meantime, so it is ok that it doesn't end up with the same
value as facts->FWImageSize.

Signed-off-by: Rasmus Villemoes 
Reviewed-by: Joe Lawrence 
Signed-off-by: Christoph Hellwig

mptfusion: tweak null pointer checks

2014-07-25T21:16:58+00:00

Fixes the following smatch warnings:

  drivers/message/fusion/mptbase.c:652 mptbase_reply() warn: variable
    dereferenced before check 'reply' (see line 639)

      [JL: No-brainer, the enclosing switch statement dereferences
       reply, so we can't get here unless reply is valid.]

  drivers/message/fusion/mptsas.c:1255 mptsas_taskmgmt_complete() error:
    we previously assumed 'pScsiTmReply' could be null (see line 1227)

      [HCH: Reading the code in mptsas_taskmgmt_complete it's pretty
       obvious that it can't do anything useful if mr/pScsiTmReply are
       NULL, so I suspect it would be best to just return at the
       beginning of the function.

       I'd love to understand if it actually could ever be zero, which I
       doubt.  Maybe the LSI people can shed some light on that?]

  drivers/message/fusion/mptsas.c:3888 mptsas_not_responding_devices()
    error: we previously assumed 'port_info->phy_info' could be null
    (see line 3875)

      [HCH: It's pretty obvious from reading mptsas_sas_io_unit_pg0 that
       we never register a port_info with a NULL phy_info in the lists,
       so all NULL checks on it could be deleted.]

  drivers/message/fusion/mptscsih.c:1284 mptscsih_info() error:
    we previously assumed 'h' could be null (see line 1274)

      [HCH: shost_priv can't return NULL, so the if (h) should be
       removed.]

  drivers/message/fusion/mptscsih.c:1388 mptscsih_qcmd() error: we
    previously assumed 'vdevice' could be null (see line 1373)

      [HCH: vdevice can't ever be NULL here, it's allocated in
       ->slave_alloc and thus guaranteed to be around when
       ->queuecommand is called.]

Signed-off-by: Joe Lawrence 
Acked-by: Sreekanth Reddy 
Signed-off-by: Christoph Hellwig