--- /dev/null
+From b076808051f2c80d38e03fb2f1294f525c7a446d Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Mon, 7 Apr 2014 13:58:35 -0400
+Subject: ib_srpt: Use correct ib_sg_dma primitives
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+commit b076808051f2c80d38e03fb2f1294f525c7a446d upstream.
+
+The code was incorrectly using sg_dma_address() and
+sg_dma_len() instead of ib_sg_dma_address() and
+ib_sg_dma_len().
+
+This prevents srpt from functioning with the
+Intel HCA and indeed will corrupt memory
+badly.
+
+Cc: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Tested-by: Vinod Kumar <vinod.kumar@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1078,6 +1078,7 @@ static void srpt_unmap_sg_to_ib_sge(stru
+ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch,
+ struct srpt_send_ioctx *ioctx)
+ {
++ struct ib_device *dev = ch->sport->sdev->device;
+ struct se_cmd *cmd;
+ struct scatterlist *sg, *sg_orig;
+ int sg_cnt;
+@@ -1124,7 +1125,7 @@ static int srpt_map_sg_to_ib_sge(struct
+
+ db = ioctx->rbufs;
+ tsize = cmd->data_length;
+- dma_len = sg_dma_len(&sg[0]);
++ dma_len = ib_sg_dma_len(dev, &sg[0]);
+ riu = ioctx->rdma_ius;
+
+ /*
+@@ -1155,7 +1156,8 @@ static int srpt_map_sg_to_ib_sge(struct
+ ++j;
+ if (j < count) {
+ sg = sg_next(sg);
+- dma_len = sg_dma_len(sg);
++ dma_len = ib_sg_dma_len(
++ dev, sg);
+ }
+ }
+ } else {
+@@ -1192,8 +1194,8 @@ static int srpt_map_sg_to_ib_sge(struct
+ tsize = cmd->data_length;
+ riu = ioctx->rdma_ius;
+ sg = sg_orig;
+- dma_len = sg_dma_len(&sg[0]);
+- dma_addr = sg_dma_address(&sg[0]);
++ dma_len = ib_sg_dma_len(dev, &sg[0]);
++ dma_addr = ib_sg_dma_address(dev, &sg[0]);
+
+ /* this second loop is really mapped sg_addres to rdma_iu->ib_sge */
+ for (i = 0, j = 0;
+@@ -1216,8 +1218,10 @@ static int srpt_map_sg_to_ib_sge(struct
+ ++j;
+ if (j < count) {
+ sg = sg_next(sg);
+- dma_len = sg_dma_len(sg);
+- dma_addr = sg_dma_address(sg);
++ dma_len = ib_sg_dma_len(
++ dev, sg);
++ dma_addr = ib_sg_dma_address(
++ dev, sg);
+ }
+ }
+ } else {
--- /dev/null
+From d444edc679e7713412f243b792b1f964e5cff1e1 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Wed, 19 Feb 2014 23:32:14 +0000
+Subject: iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit d444edc679e7713412f243b792b1f964e5cff1e1 upstream.
+
+This patch fixes a long-standing bug in iscsit_build_conn_drop_async_message()
+where during ERL=2 connection recovery, a bogus conn_p pointer could
+end up being used to send the ISCSI_OP_ASYNC_EVENT + DROPPING_CONNECTION
+notifying the initiator that cmd->logout_cid has failed.
+
+The bug was manifesting itself as an OOPs in iscsit_allocate_cmd() with
+a bogus conn_p pointer in iscsit_build_conn_drop_async_message().
+
+Reported-by: Arshad Hussain <arshad.hussain@calsoftinc.com>
+Reported-by: santosh kulkarni <santosh.kulkarni@calsoftinc.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -2454,6 +2454,7 @@ static void iscsit_build_conn_drop_async
+ {
+ struct iscsi_cmd *cmd;
+ struct iscsi_conn *conn_p;
++ bool found = false;
+
+ /*
+ * Only send a Asynchronous Message on connections whos network
+@@ -2462,11 +2463,12 @@ static void iscsit_build_conn_drop_async
+ list_for_each_entry(conn_p, &conn->sess->sess_conn_list, conn_list) {
+ if (conn_p->conn_state == TARG_CONN_STATE_LOGGED_IN) {
+ iscsit_inc_conn_usage_count(conn_p);
++ found = true;
+ break;
+ }
+ }
+
+- if (!conn_p)
++ if (!found)
+ return;
+
+ cmd = iscsit_allocate_cmd(conn_p, GFP_ATOMIC);
--- /dev/null
+From e2c70425f05219b142b3a8a9489a622c736db39d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 11 Feb 2014 19:06:33 +0300
+Subject: SCSI: arcmsr: upper 32 of dma address lost
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit e2c70425f05219b142b3a8a9489a622c736db39d upstream.
+
+The original code always set the upper 32 bits to zero because it was
+doing a shift of the wrong variable.
+
+Fixes: 1a4f550a09f8 ('[SCSI] arcmsr: 1.20.00.15: add SATA RAID plus other fixes')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/arcmsr/arcmsr_hba.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/arcmsr/arcmsr_hba.c
++++ b/drivers/scsi/arcmsr/arcmsr_hba.c
+@@ -2501,16 +2501,15 @@ static int arcmsr_polling_ccbdone(struct
+ static int arcmsr_iop_confirm(struct AdapterControlBlock *acb)
+ {
+ uint32_t cdb_phyaddr, cdb_phyaddr_hi32;
+- dma_addr_t dma_coherent_handle;
++
+ /*
+ ********************************************************************
+ ** here we need to tell iop 331 our freeccb.HighPart
+ ** if freeccb.HighPart is not zero
+ ********************************************************************
+ */
+- dma_coherent_handle = acb->dma_coherent_handle;
+- cdb_phyaddr = (uint32_t)(dma_coherent_handle);
+- cdb_phyaddr_hi32 = (uint32_t)((cdb_phyaddr >> 16) >> 16);
++ cdb_phyaddr = lower_32_bits(acb->dma_coherent_handle);
++ cdb_phyaddr_hi32 = upper_32_bits(acb->dma_coherent_handle);
+ acb->cdb_phyaddr_hi32 = cdb_phyaddr_hi32;
+ /*
+ ***********************************************************************
--- /dev/null
+From b2a72ec32d0f499aaadf41264232517a12326df0 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 21 Jan 2014 10:00:10 +0300
+Subject: SCSI: qla2xxx: fix error handling of qla2x00_mem_alloc()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit b2a72ec32d0f499aaadf41264232517a12326df0 upstream.
+
+qla2x00_mem_alloc() returns 1 on success and -ENOMEM on failure. On the
+one hand the caller assumes non-zero is success but on the other hand
+the caller also assumes that it returns an error code.
+
+I've fixed it to return zero on success and a negative error code on
+failure. This matches the documentation as well.
+
+[jejb: checkpatch fix]
+Fixes: e315cd28b9ef ('[SCSI] qla2xxx: Code changes for qla data structure refactoring')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_os.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -2553,7 +2553,7 @@ qla2x00_probe_one(struct pci_dev *pdev,
+ ha->flags.enable_64bit_addressing ? "enable" :
+ "disable");
+ ret = qla2x00_mem_alloc(ha, req_length, rsp_length, &req, &rsp);
+- if (!ret) {
++ if (ret) {
+ ql_log_pci(ql_log_fatal, pdev, 0x0031,
+ "Failed to allocate memory for adapter, aborting.\n");
+
+@@ -3458,10 +3458,10 @@ qla2x00_mem_alloc(struct qla_hw_data *ha
+ else {
+ qla2x00_set_reserved_loop_ids(ha);
+ ql_dbg_pci(ql_dbg_init, ha->pdev, 0x0123,
+- "loop_id_map=%p. \n", ha->loop_id_map);
++ "loop_id_map=%p.\n", ha->loop_id_map);
+ }
+
+- return 1;
++ return 0;
+
+ fail_async_pd:
+ dma_pool_free(ha->s_dma_pool, ha->ex_init_cb, ha->ex_init_cb_dma);
ib-nes-return-an-error-on-ib_copy_from_udata-failure-instead-of-null.patch
ib-mthca-return-an-error-on-ib_copy_to_udata-failure.patch
ib-ehca-returns-an-error-on-ib_copy_to_udata-failure.patch
+ib_srpt-use-correct-ib_sg_dma-primitives.patch
+scsi-qla2xxx-fix-error-handling-of-qla2x00_mem_alloc.patch
+scsi-arcmsr-upper-32-of-dma-address-lost.patch
+iscsi-target-fix-erl-2-async_event-connection-pointer-bug.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
