SCSI fixes for 2.6.32-rc7
Subsystems (5)
PATCH 1/1 SCSI fixes for 2.6.32-rc7
This is a set of miscellaneous (but small) fixes for SCSI. The only urgent one is the CVE, but the number of people having the hardware (gdth population approaching zero) makes it less exploit worthy.
The patch is available here:
master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6.git
The short changelog is:
Anil Ravindranath (1):
pmcraid: Fix ppc64 driver build for using cpu_to_le32 on U8 data type
Ben Hutchings (1):
bfa: declare MODULE_FIRMWARE
Brian King (1):
scsi_transport_fc: Fix WARN message for FC passthru failure paths
Dave Jones (1):
gdth: Prevent negative offsets in ioctl CVE-2009-3080
Martin K. Petersen (1):
Fix incorrect reporting of host protection capabilities
Roel Kluin (1):
bfa: fix test in bfad_os_fc_host_init()
Wayne Boyer (1):
ipr: add workaround for MSI interrupts on P7
jack wang (1):
libsas: do not set res = 0 in sas_ex_discover_dev()
And the diffstat:
drivers/scsi/bfa/bfad_fwimg.c | 2 + drivers/scsi/bfa/bfad_im.c | 2 - drivers/scsi/gdth.c | 2 - drivers/scsi/ipr.c | 42 +++++++++++++++++++++++++++++-------- drivers/scsi/ipr.h | 1 drivers/scsi/libsas/sas_expander.c | 1 drivers/scsi/pmcraid.c | 10 ++++---- drivers/scsi/scsi_transport_fc.c | 3 ++ include/scsi/scsi_host.h | 29 +++++++++---------------- 9 files changed, 57 insertions(+), 35 deletions(-)
Full diffs below.
James
---
drivers/scsi/bfa/bfad_fwimg.c +2 -0
@@ -41,6 +41,8 @@ u32 *bfi_image_cb;#define BFAD_FW_FILE_CT "ctfw.bin"#define BFAD_FW_FILE_CB "cbfw.bin" +MODULE_FIRMWARE (BFAD_FW_FILE_CT ); +MODULE_FIRMWARE (BFAD_FW_FILE_CB );u32 * bfad_read_firmware(struct pci_dev *pdev, u32 **bfi_image,
drivers/scsi/bfa/bfad_im.c +1 -1
@@ -948,7 +948,7 @@ bfad_os_fc_host_init(struct bfad_im_port_s *im_port)if (bfad_supported_fc4s & (BFA_PORT_ROLE_FCP_IM |BFA_PORT_ROLE_FCP_TM ))/* For FCP type 0x08 */ fc_host_supported_fc4s (host)[2 ] =1 ; -if (bfad_supported_fc4s |BFA_PORT_ROLE_FCP_IPFC ) +if (bfad_supported_fc4s &BFA_PORT_ROLE_FCP_IPFC )/* For LLC/SNAP type 0x05 */ fc_host_supported_fc4s (host)[3 ] =0x20 ;/* For fibre channel services type 0x20 */
drivers/scsi/gdth.c +1 -1
@@ -2900,7 +2900,7 @@ static int gdth_read_event(gdth_ha_str *ha, int handle, gdth_evt_str *estr) eindex = handle; estr->event_source =0 ; -if (eindex >=MAX_EVENTS ) { +if (eindex <0 || eindex >=MAX_EVENTS ) {spin_unlock_irqrestore (&ha->smp_lock, flags);return eindex; }
drivers/scsi/ipr.c +33 -9
66 lines not on this page · raw message
drivers/scsi/ipr.h +1 -0
@@ -144,6 +144,7 @@#define IPR_IOA_MAX_SECTORS 32767#define IPR_VSET_MAX_SECTORS 512#define IPR_MAX_CDB_LEN 16 +#define IPR_MAX_HRRQ_RETRIES 3#define IPR_DEFAULT_BUS_WIDTH 16#define IPR_80MBs_SCSI_RATE ((80 * 10) / (IPR_DEFAULT_BUS_WIDTH / 8))
drivers/scsi/libsas/sas_expander.c +0 -1
@@ -960,7 +960,6 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id) } } - res =0 ; }return res;
drivers/scsi/pmcraid.c +5 -5
@@ -1071,7 +1071,7 @@ static struct pmcraid_cmd *pmcraid_init_hcam ioarcb->data_transfer_length =cpu_to_le32 (rcb_size); - ioadl[0 ].flags |=cpu_to_le32 (IOADL_FLAGS_READ_LAST ); + ioadl[0 ].flags |=IOADL_FLAGS_READ_LAST ; ioadl[0 ].data_len =cpu_to_le32 (rcb_size); ioadl[0 ].address =cpu_to_le32 (dma);
@@ -2251,7 +2251,7 @@ static void pmcraid_request_sense(struct pmcraid_cmd *cmd) ioadl->address =cpu_to_le64 (cmd->sense_buffer_dma); ioadl->data_len =cpu_to_le32 (SCSI_SENSE_BUFFERSIZE ); - ioadl->flags =cpu_to_le32 (IOADL_FLAGS_LAST_DESC ); + ioadl->flags =IOADL_FLAGS_LAST_DESC ;/* request sense might be called as part of error response processing * which runs in tasklets context. It is possible that mid-layer might
@@ -3017,7 +3017,7 @@ static int pmcraid_build_ioadl( ioadl[i].flags =0 ; }/* setup last descriptor */ - ioadl[i -1 ].flags =cpu_to_le32 (IOADL_FLAGS_LAST_DESC ); + ioadl[i -1 ].flags =IOADL_FLAGS_LAST_DESC ;return 0 ; }
@@ -3387,7 +3387,7 @@ static int pmcraid_build_passthrough_ioadls( }/* setup the last descriptor */ - ioadl[i -1 ].flags =cpu_to_le32 (IOADL_FLAGS_LAST_DESC ); + ioadl[i -1 ].flags =IOADL_FLAGS_LAST_DESC ;return 0 ; }
@@ -5314,7 +5314,7 @@ static void pmcraid_querycfg(struct pmcraid_cmd *cmd)cpu_to_le32 (sizeof (struct pmcraid_config_table )); ioadl = &(ioarcb->add_data.u.ioadl[0 ]); - ioadl->flags =cpu_to_le32 (IOADL_FLAGS_LAST_DESC ); + ioadl->flags =IOADL_FLAGS_LAST_DESC ; ioadl->address =cpu_to_le64 (pinstance->cfg_table_bus_addr); ioadl->data_len =cpu_to_le32 (sizeof (struct pmcraid_config_table ));
drivers/scsi/scsi_transport_fc.c +3 -0
@@ -3656,6 +3656,7 @@ fc_bsg_host_dispatch(struct request_queue *q, struct Scsi_Host *shost, fail_host_msg:/* return the errno failure code as the only status */ BUG_ON (job->reply_len <sizeof (uint32_t )); + job->reply->reply_payload_rcv_len =0 ; job->reply->result = ret; job->reply_len =sizeof (uint32_t );fc_bsg_jobdone (job);
@@ -3741,6 +3742,7 @@ check_bidi: fail_rport_msg:/* return the errno failure code as the only status */ BUG_ON (job->reply_len <sizeof (uint32_t )); + job->reply->reply_payload_rcv_len =0 ; job->reply->result = ret; job->reply_len =sizeof (uint32_t );fc_bsg_jobdone (job);
@@ -3797,6 +3799,7 @@ fc_bsg_request_handler(struct request_queue *q, struct Scsi_Host *shost,/* check if we have the msgcode value at least */ if (job->request_len <sizeof (uint32_t )) {BUG_ON (job->reply_len <sizeof (uint32_t )); + job->reply->reply_payload_rcv_len =0 ; job->reply->result = -ENOMSG ; job->reply_len =sizeof (uint32_t );fc_bsg_jobdone (job);
include/scsi/scsi_host.h +11 -18
@@ -797,30 +797,23 @@ static inline unsigned int scsi_host_get_prot(struct Scsi_Host *shost)static inline unsigned int scsi_host_dif_capable (struct Scsi_Host *shost,unsigned int target_type) { -switch (target_type) { -case 1 : -if (shost->prot_capabilities &SHOST_DIF_TYPE1_PROTECTION ) -return target_type; -case 2 : -if (shost->prot_capabilities &SHOST_DIF_TYPE2_PROTECTION ) -return target_type; -case 3 : -if (shost->prot_capabilities &SHOST_DIF_TYPE3_PROTECTION ) -return target_type; - } +static unsigned char cap[] = {0 , +SHOST_DIF_TYPE1_PROTECTION , +SHOST_DIF_TYPE2_PROTECTION , +SHOST_DIF_TYPE3_PROTECTION }; -return 0 ; +return shost->prot_capabilities & cap[target_type] ? target_type :0 ; }static inline unsigned int scsi_host_dix_capable (struct Scsi_Host *shost,unsigned int target_type) {#if defined(CONFIG_BLK_DEV_INTEGRITY ) -switch (target_type) { -case 0 :return shost->prot_capabilities &SHOST_DIX_TYPE0_PROTECTION ; -case 1 :return shost->prot_capabilities &SHOST_DIX_TYPE1_PROTECTION ; -case 2 :return shost->prot_capabilities &SHOST_DIX_TYPE2_PROTECTION ; -case 3 :return shost->prot_capabilities &SHOST_DIX_TYPE3_PROTECTION ; - } +static unsigned char cap[] = {SHOST_DIX_TYPE0_PROTECTION , +SHOST_DIX_TYPE1_PROTECTION , +SHOST_DIX_TYPE2_PROTECTION , +SHOST_DIX_TYPE3_PROTECTION }; + +return shost->prot_capabilities & cap[target_type];#endif return 0 ; }