--- /dev/null
+From b076808051f2c80d38e03fb2f1294f525c7a446d Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Mon, 7 Apr 2014 13:58:35 -0400
+Subject: ib_srpt: Use correct ib_sg_dma primitives
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+commit b076808051f2c80d38e03fb2f1294f525c7a446d upstream.
+
+The code was incorrectly using sg_dma_address() and
+sg_dma_len() instead of ib_sg_dma_address() and
+ib_sg_dma_len().
+
+This prevents srpt from functioning with the
+Intel HCA and indeed will corrupt memory
+badly.
+
+Cc: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Tested-by: Vinod Kumar <vinod.kumar@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1078,6 +1078,7 @@ static void srpt_unmap_sg_to_ib_sge(stru
+ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch,
+ struct srpt_send_ioctx *ioctx)
+ {
++ struct ib_device *dev = ch->sport->sdev->device;
+ struct se_cmd *cmd;
+ struct scatterlist *sg, *sg_orig;
+ int sg_cnt;
+@@ -1125,7 +1126,7 @@ static int srpt_map_sg_to_ib_sge(struct
+
+ db = ioctx->rbufs;
+ tsize = cmd->data_length;
+- dma_len = sg_dma_len(&sg[0]);
++ dma_len = ib_sg_dma_len(dev, &sg[0]);
+ riu = ioctx->rdma_ius;
+
+ /*
+@@ -1156,7 +1157,8 @@ static int srpt_map_sg_to_ib_sge(struct
+ ++j;
+ if (j < count) {
+ sg = sg_next(sg);
+- dma_len = sg_dma_len(sg);
++ dma_len = ib_sg_dma_len(
++ dev, sg);
+ }
+ }
+ } else {
+@@ -1193,8 +1195,8 @@ static int srpt_map_sg_to_ib_sge(struct
+ tsize = cmd->data_length;
+ riu = ioctx->rdma_ius;
+ sg = sg_orig;
+- dma_len = sg_dma_len(&sg[0]);
+- dma_addr = sg_dma_address(&sg[0]);
++ dma_len = ib_sg_dma_len(dev, &sg[0]);
++ dma_addr = ib_sg_dma_address(dev, &sg[0]);
+
+ /* this second loop is really mapped sg_addres to rdma_iu->ib_sge */
+ for (i = 0, j = 0;
+@@ -1217,8 +1219,10 @@ static int srpt_map_sg_to_ib_sge(struct
+ ++j;
+ if (j < count) {
+ sg = sg_next(sg);
+- dma_len = sg_dma_len(sg);
+- dma_addr = sg_dma_address(sg);
++ dma_len = ib_sg_dma_len(
++ dev, sg);
++ dma_addr = ib_sg_dma_address(
++ dev, sg);
+ }
+ }
+ } else {
--- /dev/null
+From d444edc679e7713412f243b792b1f964e5cff1e1 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Wed, 19 Feb 2014 23:32:14 +0000
+Subject: iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit d444edc679e7713412f243b792b1f964e5cff1e1 upstream.
+
+This patch fixes a long-standing bug in iscsit_build_conn_drop_async_message()
+where during ERL=2 connection recovery, a bogus conn_p pointer could
+end up being used to send the ISCSI_OP_ASYNC_EVENT + DROPPING_CONNECTION
+notifying the initiator that cmd->logout_cid has failed.
+
+The bug was manifesting itself as an OOPs in iscsit_allocate_cmd() with
+a bogus conn_p pointer in iscsit_build_conn_drop_async_message().
+
+Reported-by: Arshad Hussain <arshad.hussain@calsoftinc.com>
+Reported-by: santosh kulkarni <santosh.kulkarni@calsoftinc.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -2352,6 +2352,7 @@ static void iscsit_build_conn_drop_async
+ {
+ struct iscsi_cmd *cmd;
+ struct iscsi_conn *conn_p;
++ bool found = false;
+
+ /*
+ * Only send a Asynchronous Message on connections whos network
+@@ -2360,11 +2361,12 @@ static void iscsit_build_conn_drop_async
+ list_for_each_entry(conn_p, &conn->sess->sess_conn_list, conn_list) {
+ if (conn_p->conn_state == TARG_CONN_STATE_LOGGED_IN) {
+ iscsit_inc_conn_usage_count(conn_p);
++ found = true;
+ break;
+ }
+ }
+
+- if (!conn_p)
++ if (!found)
+ return;
+
+ cmd = iscsit_allocate_cmd(conn_p, GFP_ATOMIC);
--- /dev/null
+From e2c70425f05219b142b3a8a9489a622c736db39d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 11 Feb 2014 19:06:33 +0300
+Subject: SCSI: arcmsr: upper 32 of dma address lost
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit e2c70425f05219b142b3a8a9489a622c736db39d upstream.
+
+The original code always set the upper 32 bits to zero because it was
+doing a shift of the wrong variable.
+
+Fixes: 1a4f550a09f8 ('[SCSI] arcmsr: 1.20.00.15: add SATA RAID plus other fixes')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/arcmsr/arcmsr_hba.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/arcmsr/arcmsr_hba.c
++++ b/drivers/scsi/arcmsr/arcmsr_hba.c
+@@ -2500,16 +2500,15 @@ static int arcmsr_polling_ccbdone(struct
+ static int arcmsr_iop_confirm(struct AdapterControlBlock *acb)
+ {
+ uint32_t cdb_phyaddr, cdb_phyaddr_hi32;
+- dma_addr_t dma_coherent_handle;
++
+ /*
+ ********************************************************************
+ ** here we need to tell iop 331 our freeccb.HighPart
+ ** if freeccb.HighPart is not zero
+ ********************************************************************
+ */
+- dma_coherent_handle = acb->dma_coherent_handle;
+- cdb_phyaddr = (uint32_t)(dma_coherent_handle);
+- cdb_phyaddr_hi32 = (uint32_t)((cdb_phyaddr >> 16) >> 16);
++ cdb_phyaddr = lower_32_bits(acb->dma_coherent_handle);
++ cdb_phyaddr_hi32 = upper_32_bits(acb->dma_coherent_handle);
+ acb->cdb_phyaddr_hi32 = cdb_phyaddr_hi32;
+ /*
+ ***********************************************************************
ib-nes-return-an-error-on-ib_copy_from_udata-failure-instead-of-null.patch
ib-mthca-return-an-error-on-ib_copy_to_udata-failure.patch
ib-ehca-returns-an-error-on-ib_copy_to_udata-failure.patch
+ib_srpt-use-correct-ib_sg_dma-primitives.patch
+scsi-arcmsr-upper-32-of-dma-address-lost.patch
+iscsi-target-fix-erl-2-async_event-connection-pointer-bug.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
