Patch "scsi: libsas: fix length error in sas_smp_handler()" has been added to the 4.14-stable tree

This is a note to let you know that I've just added the patch titled

scsi: libsas: fix length error in sas_smp_handler()

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
scsi-libsas-fix-length-error-in-sas_smp_handler.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Jason Yan <[email protected]>
Date: Mon, 11 Dec 2017 15:03:33 +0800
Subject: scsi: libsas: fix length error in sas_smp_handler()

From: Jason Yan <[email protected]>

commit 621f6401fdeefe96dfe9eab4b167c7c39f552bb0 upstream.

The return value of smp_execute_task_sg() is the untransferred residual, but bsg_job_done() requires the length of payload received. This makes SMP passthrough commands from userland by sg ioctl to libsas get a wrong response. The userland tools such as smp_utils failed because of these wrong responses:

~#smp_discover /dev/bsg/expander-2\:13
response too short, len=0
~#smp_discover /dev/bsg/expander-2\:134
response too short, len=0

Fix this by passing the actual received length to bsg_job_done(). And if smp_execute_task_sg() returns 0, this means received length is exactly the buffer length.

[mkp: typo]

---
 drivers/scsi/libsas/sas_expander.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

@@ -2145,7 +2145,7 @@ void sas_smp_handler(struct bsg_job *job
 		struct sas_rphy *rphy)
 {
 	struct domain_device *dev;
-	unsigned int reslen = 0;
+	unsigned int rcvlen = 0;
 	int ret = -EINVAL;
 
 	/* no rphy means no smp target support (ie aic94xx host) */

@@ -2179,12 +2179,12 @@ void sas_smp_handler(struct bsg_job *job
 
 	ret = smp_execute_task_sg(dev, job->request_payload.sg_list,
 			job->reply_payload.sg_list);
-	if (ret > 0) {
-		/* positive number is the untransferred residual */
-		reslen = ret;
+	if (ret >= 0) {
+		/* bsg_job_done() requires the length received  */
+		rcvlen = job->reply_payload.payload_len - ret;
 		ret = 0;
 	}
 
 out:
-	bsg_job_done(job, ret, reslen);
+	bsg_job_done(job, ret, rcvlen);
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/scsi-libsas-fix-length-error-in-sas_smp_handler.patch