From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 17 May 2018 07:58:48 +0000 (+0200)
Subject: 4.14-stable patches
X-Git-Tag: v4.16.10~25
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=03fb9fc09cd1c801d0e73d8f58296ee2b5c9e5dd;p=thirdparty%2Fkernel%2Fstable-queue.git

4.14-stable patches

added patches:
	scsi-aacraid-correct-hba_send-to-include-iu_type.patch
---

diff --git a/queue-4.14/scsi-aacraid-correct-hba_send-to-include-iu_type.patch b/queue-4.14/scsi-aacraid-correct-hba_send-to-include-iu_type.patch
new file mode 100644
index 00000000000..b8d860d44e8
--- /dev/null
+++ b/queue-4.14/scsi-aacraid-correct-hba_send-to-include-iu_type.patch
@@ -0,0 +1,57 @@
+From 7d3af7d96af7b9f51e1ef67b6f4725f545737da2 Mon Sep 17 00:00:00 2001
+From: Dave Carroll <david.carroll@microsemi.com>
+Date: Wed, 25 Apr 2018 10:24:20 -0600
+Subject: scsi: aacraid: Correct hba_send to include iu_type
+
+From: Dave Carroll <david.carroll@microsemi.com>
+
+commit 7d3af7d96af7b9f51e1ef67b6f4725f545737da2 upstream.
+
+commit b60710ec7d7a ("scsi: aacraid: enable sending of TMFs from
+aac_hba_send()") allows aac_hba_send() to send scsi commands, and TMF
+requests, but the existing code only updates the iu_type for scsi
+commands. For TMF requests we are sending an unknown iu_type to
+firmware, which causes a fault.
+
+Include iu_type prior to determining the validity of the command
+
+Reported-by: Noah Misner <nmisner@us.ibm.com>
+Fixes: b60710ec7d7ab ("aacraid: enable sending of TMFs from aac_hba_send()")
+Fixes: 423400e64d377 ("aacraid: Include HBA direct interface")
+Tested-by: Noah Misner <nmisner@us.ibm.com>
+cc: stable@vger.kernel.org
+Signed-off-by: Dave Carroll <david.carroll@microsemi.com>
+Reviewed-by: Raghava Aditya Renukunta <RaghavaAditya.Renukunta@microsemi.com>
+Reviewed-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/aacraid/commsup.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/aacraid/commsup.c
++++ b/drivers/scsi/aacraid/commsup.c
+@@ -752,6 +752,8 @@ int aac_hba_send(u8 command, struct fib
+ 	int wait;
+ 	unsigned long flags = 0;
+ 	unsigned long mflags = 0;
++	struct aac_hba_cmd_req *hbacmd = (struct aac_hba_cmd_req *)
++			fibptr->hw_fib_va;
+ 
+ 	fibptr->flags = (FIB_CONTEXT_FLAG | FIB_CONTEXT_FLAG_NATIVE_HBA);
+ 	if (callback) {
+@@ -762,11 +764,9 @@ int aac_hba_send(u8 command, struct fib
+ 		wait = 1;
+ 
+ 
+-	if (command == HBA_IU_TYPE_SCSI_CMD_REQ) {
+-		struct aac_hba_cmd_req *hbacmd =
+-			(struct aac_hba_cmd_req *)fibptr->hw_fib_va;
++	hbacmd->iu_type = command;
+ 
+-		hbacmd->iu_type = command;
++	if (command == HBA_IU_TYPE_SCSI_CMD_REQ) {
+ 		/* bit1 of request_id must be 0 */
+ 		hbacmd->request_id =
+ 			cpu_to_le32((((u32)(fibptr - dev->fibs)) << 2) + 1);
diff --git a/queue-4.14/series b/queue-4.14/series
index 6db5b3752d9..4d958a7246c 100644
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -37,3 +37,4 @@ ipv6-fix-uninit-value-in-ip6_multipath_l3_keys.patch
 net-mlx5e-allow-offloading-ipv4-header-re-write-for-icmp.patch
 nsh-fix-infinite-loop.patch
 udp-fix-so_bindtodevice.patch
+scsi-aacraid-correct-hba_send-to-include-iu_type.patch