Skip to contentSkip to conversation

SCSI fixes for 4.14-rc1

GIT PULL James Bottomley 1 participant 1 message Sep 19, 2017

Subsystems (3)
SCSI SCSI SG driver Arm/riscpc architecture
lore
Share & tools
lore

James Bottomley

author maintainer
#0 lore raw

This is a set of five small fixes: one is a null deref fix which is pretty critical for the fc transport class and one fixes a potential security issue of sg leaking kernel information.

The patch is available here:

git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git scsi-fixes

The short changelog is:

Arnd Bergmann (1):
scsi: acornscsi: fix build error

Christoph Hellwig (1):
scsi: scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout

Hannes Reinecke (2):
scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE
scsi: sg: factor out sg_fill_request_table()

Lukas Czerner (1):
scsi: sd: Remove unnecessary condition in sd_read_block_limits()

and the diffstat:

 drivers/scsi/arm/acornscsi.c     |  6 ++--
 drivers/scsi/scsi_transport_fc.c |  2 +-
 drivers/scsi/sd.c                |  2 --
 drivers/scsi/sg.c                | 64 ++++++++++++++++++++++------------------
 4 files changed, 40 insertions(+), 34 deletions(-)

With full diff below

James

---

drivers/scsi/arm/acornscsi.c +3 -3
index 690816f3c6af..421fe869a11e 100644
@@ -2725,9 +2725,9 @@ int acornscsi_abort(struct scsi_cmnd *SCpnt)
  * Params   : SCpnt  - command causing reset
  * Returns  : one of SCSI_RESET_ macros
  */
-int acornscsi_host_reset(struct Scsi_Host *shpnt)
+int acornscsi_host_reset(struct scsi_cmnd *SCpnt)
 {
-	AS_Host *host = (AS_Host *)shpnt->hostdata;
+	AS_Host *host = (AS_Host *)SCpnt->device->host->hostdata;
 	struct scsi_cmnd *SCptr;
     
     host->stats.resets += 1;

@@ -2741,7 +2741,7 @@ int acornscsi_host_reset(struct Scsi_Host *shpnt)
 
 	printk(KERN_WARNING "acornscsi_reset: ");
 	print_sbic_status(asr, ssr, host->scsi.phase);
-	for (devidx = 0; devidx < 9; devidx ++) {
+	for (devidx = 0; devidx < 9; devidx++)
 	    acornscsi_dumplog(host, devidx);
     }
 #endif
drivers/scsi/scsi_transport_fc.c +1 -1
index 3c6bc0081fcb..ba9d70f8a6a1 100644
@@ -3571,7 +3571,7 @@ fc_vport_sched_delete(struct work_struct *work)
 static enum blk_eh_timer_return
 fc_bsg_job_timeout(struct request *req)
 {
-	struct bsg_job *job = (void *) req->special;
+	struct bsg_job *job = blk_mq_rq_to_pdu(req);
 	struct Scsi_Host *shost = fc_bsg_to_shost(job);
 	struct fc_rport *rport = fc_bsg_to_rport(job);
 	struct fc_internal *i = to_fc_internal(shost->transportt);
drivers/scsi/sd.c +0 -2
index 11c1738c2100..fb9f8b5f4673 100644
@@ -2915,8 +2915,6 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
 				sd_config_discard(sdkp, SD_LBP_WS16);
 			else if (sdkp->lbpws10)
 				sd_config_discard(sdkp, SD_LBP_WS10);
-			else if (sdkp->lbpu && sdkp->max_unmap_blocks)
-				sd_config_discard(sdkp, SD_LBP_UNMAP);
 			else
 				sd_config_discard(sdkp, SD_LBP_DISABLE);
 		}
drivers/scsi/sg.c +36 -28

80 lines not on this page · raw message