linux/drivers/scsi, branch v2.6.32

[SCSI] fix crash when disconnecting usb storage

2009-11-26T16:04:22Z

__scsi_remove_device() in scsi_forget_host() is executed out of scan_mutex and races with scsi_destroy_sdev() <- scsi_sysfs_add_devices() <- scsi_finish_async_scan(). The result is use after free and/or double free, oops. The fix is simple, move scsi_forget_host() under scan_mutex. scsi_forget_host() is just sequence of __scsi_remove_device(). All another calls of __scsi_remove_device() are made under scan_mutex. So that it is safe. Signed-off-by: Alexey Kuznetsov Signed-off-by: Denis V. Lunev Signed-off-by: Andrew Morton Signed-off-by: James Bottomley

[SCSI] fix async scan add/remove race resulting in an oops

2009-11-26T15:43:39Z

Async scanning introduced a very wide window where the SCSI device is up and running but has not yet been added to sysfs. We delay the adding until all scans have completed to retain the same ordering as sync scanning. This delay in visibility causes an oops if a device is removed before we make it visible because the SCSI removal routines have an inbuilt assumption that if a device is in SDEV_RUNNING state, it must be visible (which is not necessarily true in the async scanning case). Fix this by introducing an additional is_visible flag which we can use to condition the tear down so we do the right thing for running but not yet made visible. Reported-by: Alexey Kuznetsov Signed-off-by: James Bottomley

[SCSI] sd: Return correct error code for DIF

2009-11-26T14:54:46Z

sd_dif.c was not updated to return -EILSEQ, leading to error handling failures in applications which provide their own integrity metadata (as opposed to being protected by the block layer functions). Signed-off-by: Martin K. Petersen Signed-off-by: James Bottomley

[SCSI] bfa: declare MODULE_FIRMWARE

2009-11-11T17:21:06Z

Signed-off-by: Ben Hutchings Acked-by: Jing Huang Signed-off-by: James Bottomley

[SCSI] gdth: Prevent negative offsets in ioctl CVE-2009-3080

2009-11-11T17:14:21Z

A negative offset could be used to index before the event buffer and lead to a security breach. Signed-off-by: Dave Jones Cc: Stable Tree Signed-off-by: James Bottomley

[SCSI] libsas: do not set res = 0 in sas_ex_discover_dev()

2009-11-06T19:10:42Z

We should not set res to 0 in function sas_ex_discover_dev in order to let it discover it further when wide port hotplug in . Signed-off-by: Tom Peng Signed-off-by: Jack Wang Signed-off-by: James Bottomley

[SCSI] pmcraid: Fix ppc64 driver build for using cpu_to_le32 on U8 data type

2009-11-06T17:09:28Z

Fix a reported ppc64 driver build issue. Removed cpu_to_le32 conversion usage for flags in struct pmcraid_ioadl_desc. This was breaking the driver build in ppc64. drivers/scsi/pmcraid.c: In function 'pmcraid_request_sense': drivers/scsi/pmcraid.c:2254: warning: large integer implicitly truncated to unsigned type Signed-off-by: Anil Ravindranath Signed-off-by: James Bottomley

[SCSI] ipr: add workaround for MSI interrupts on P7

2009-11-06T17:09:27Z

This patch adds some additional logic to the interrupt service routine to fix a potential problem where an MSI interrupt does not get cleared the first time. Signed-off-by: Wayne Boyer Acked-by: Brian King Signed-off-by: James Bottomley

[SCSI] scsi_transport_fc: Fix WARN message for FC passthru failure paths

2009-11-06T17:09:26Z

There are three error paths in the FC passthru code where job->reply->reply_payload_rcv_len does not get initialized, resulting in the WARN_ON in fc_bsg_jobdone going off. This patch fixes this. An example of one of the WARN_ON messages seen: Badness at drivers/scsi/scsi_transport_fc.c:3424 NIP: d000000000bf21ac LR: d000000000bf2684 CTR: c0000000003f753c REGS: c00000004eb03430 TRAP: 0700 Not tainted (2.6.32-rc4-git) MSR: 8000000000029032 CR: 24008444 XER: 00000012 TASK = c00000004c3fc9c0[3243] 'fcping' THREAD: c00000004eb00000 CPU: 0 GPR00: 0000000000000001 c00000004eb036b0 d000000000c01da0 000000004bf17fc0 GPR04: c00000004cd256a0 c00000007e011ce0 c00000007e011d00 c00000004e718000 GPR08: c00000004cd256a0 c00000004eb03ad0 c00000004cd25a90 0000000000000020 GPR12: d000000000bf7848 c000000000b62600 0000000000000060 fffffffffffffff4 GPR16: ffffffffffffffd6 c00000004c7a3060 ffffffff80000003 c00000004b0f0310 GPR20: c00000004e71b180 c00000004c7a3060 0000000000000004 0000000000000000 GPR24: c00000004e71b000 c00000004c7a3000 c00000004b0f0000 c00000004e718000 GPR28: c00000004cd256a0 c00000004cd25a90 d000000000c01db0 c00000004e01d680 NIP [d000000000bf21ac] .fc_bsg_jobdone+0x64/0x9c [scsi_transport_fc] LR [d000000000bf2684] .fc_bsg_request_handler+0x4a0/0x564 [scsi_transport_fc] Call Trace: [c00000004eb036b0] [c0000000003f755c] .get_device+0x20/0x38 (unreliable) [c00000004eb03720] [d000000000bf2684] .fc_bsg_request_handler+0x4a0/0x564 [scsi_transport_fc] [c00000004eb03820] [c0000000002c9b5c] .__generic_unplug_device+0x58/0x70 [c00000004eb038a0] [c0000000002ce9fc] .blk_execute_rq_nowait+0x70/0xf4 [c00000004eb03930] [c0000000002ceb2c] .blk_execute_rq+0xac/0x100 [c00000004eb03a60] [c0000000002d51b4] .bsg_ioctl+0x1fc/0x264 [c00000004eb03c10] [c00000000018a89c] .vfs_ioctl+0x54/0xec [c00000004eb03ca0] [c00000000018b01c] .do_vfs_ioctl+0x640/0x6a8 [c00000004eb03d80] [c00000000018b0fc] .SyS_ioctl+0x78/0xbc [c00000004eb03e30] [c0000000000085b4] syscall_exit+0x0/0x40 Instruction dump: 8003004c 2fa80000 90090104 38000000 900a0108 419e0038 e9230040 81680108 80690004 7f835840 7c101026 5400f7fe <0b000000> 7d605b78 7f8b1840 409d0008 Signed-off-by: Brian King Acked-By: James Smart Signed-off-by: James Bottomley

[SCSI] bfa: fix test in bfad_os_fc_host_init()

2009-11-03T15:29:58Z

BFA_PORT_ROLE_FCP_IPFC is 0x04 so this always evaluates to true Signed-off-by: Roel Kluin Acked-by: Jing Huang Signed-off-by: James Bottomley