--- /dev/null
+From 6d2061b981af165d3e45462e0804b5a1f2f4c7bc Mon Sep 17 00:00:00 2001
+From: Anup Patel <anup.patel@broadcom.com>
+Date: Tue, 1 Aug 2017 16:05:52 +0530
+Subject: mailbox: bcm-flexrm-mailbox: Fix mask used in CMPL_START_ADDR_VALUE()
+
+From: Anup Patel <anup.patel@broadcom.com>
+
+commit 6d2061b981af165d3e45462e0804b5a1f2f4c7bc upstream.
+
+The mask used in CMPL_START_ADDR_VALUE() should be 27bits instead of
+26bits. This incorrect mask was causing completion writes to 40bits
+physical address fail.
+
+This patch fixes mask used in CMPL_START_ADDR_VALUE() macro.
+
+Fixes: dbc049eee730 ("mailbox: Add driver for Broadcom FlexRM
+ring manager")
+
+Signed-off-by: Anup Patel <anup.patel@broadcom.com>
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Reviewed-by: Scott Branden <scott.branden@broadcom.com>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mailbox/bcm-flexrm-mailbox.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mailbox/bcm-flexrm-mailbox.c
++++ b/drivers/mailbox/bcm-flexrm-mailbox.c
+@@ -95,7 +95,7 @@
+
+ /* Register RING_CMPL_START_ADDR fields */
+ #define CMPL_START_ADDR_VALUE(pa) \
+- ((u32)((((u64)(pa)) >> RING_CMPL_ALIGN_ORDER) & 0x03ffffff))
++ ((u32)((((u64)(pa)) >> RING_CMPL_ALIGN_ORDER) & 0x07ffffff))
+
+ /* Register RING_CONTROL fields */
+ #define CONTROL_MASK_DISABLE_CONTROL 12
--- /dev/null
+From 6e98095f8fb6d98da34c4e6c34e69e7c638d79c0 Mon Sep 17 00:00:00 2001
+From: Joe Carnuccio <joe.carnuccio@cavium.com>
+Date: Wed, 23 Aug 2017 15:04:55 -0700
+Subject: scsi: qla2xxx: Correction to vha->vref_count timeout
+
+From: Joe Carnuccio <joe.carnuccio@cavium.com>
+
+commit 6e98095f8fb6d98da34c4e6c34e69e7c638d79c0 upstream.
+
+Fix incorrect second argument for wait_event_timeout()
+
+Fixes: c4a9b538ab2a ("qla2xxx: Allow vref count to timeout on vport delete.")
+Signed-off-by: Joe Carnuccio <joe.carnuccio@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_mid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_mid.c
++++ b/drivers/scsi/qla2xxx/qla_mid.c
+@@ -74,7 +74,7 @@ qla24xx_deallocate_vp_id(scsi_qla_host_t
+ * ensures no active vp_list traversal while the vport is removed
+ * from the queue)
+ */
+- wait_event_timeout(vha->vref_waitq, atomic_read(&vha->vref_count),
++ wait_event_timeout(vha->vref_waitq, !atomic_read(&vha->vref_count),
+ 10*HZ);
+
+ spin_lock_irqsave(&ha->vport_slock, flags);
--- /dev/null
+From e6f77540c067b48dee10f1e33678415bfcc89017 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 30 Aug 2017 16:30:35 +0300
+Subject: scsi: qla2xxx: Fix an integer overflow in sysfs code
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit e6f77540c067b48dee10f1e33678415bfcc89017 upstream.
+
+The value of "size" comes from the user. When we add "start + size" it
+could lead to an integer overflow bug.
+
+It means we vmalloc() a lot more memory than we had intended. I believe
+that on 64 bit systems vmalloc() can succeed even if we ask it to
+allocate huge 4GB buffers. So we would get memory corruption and likely
+a crash when we call ha->isp_ops->write_optrom() and ->read_optrom().
+
+Only root can trigger this bug.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=194061
+
+Fixes: b7cc176c9eb3 ("[SCSI] qla2xxx: Allow region-based flash-part accesses.")
+Reported-by: shqking <shqking@gmail.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_attr.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -318,6 +318,8 @@ qla2x00_sysfs_write_optrom_ctl(struct fi
+ return -EINVAL;
+ if (start > ha->optrom_size)
+ return -EINVAL;
++ if (size > ha->optrom_size - start)
++ size = ha->optrom_size - start;
+
+ mutex_lock(&ha->optrom_mutex);
+ switch (val) {
+@@ -343,8 +345,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi
+ }
+
+ ha->optrom_region_start = start;
+- ha->optrom_region_size = start + size > ha->optrom_size ?
+- ha->optrom_size - start : size;
++ ha->optrom_region_size = start + size;
+
+ ha->optrom_state = QLA_SREADING;
+ ha->optrom_buffer = vmalloc(ha->optrom_region_size);
+@@ -417,8 +418,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi
+ }
+
+ ha->optrom_region_start = start;
+- ha->optrom_region_size = start + size > ha->optrom_size ?
+- ha->optrom_size - start : size;
++ ha->optrom_region_size = start + size;
+
+ ha->optrom_state = QLA_SWRITING;
+ ha->optrom_buffer = vmalloc(ha->optrom_region_size);
--- /dev/null
+From b7edfa235effb4b4a9816c2345620b11609c123e Mon Sep 17 00:00:00 2001
+From: Michael Hernandez <michael.hernandez@cavium.com>
+Date: Wed, 23 Aug 2017 15:04:56 -0700
+Subject: scsi: qla2xxx: Fix target multiqueue configuration
+
+From: Michael Hernandez <michael.hernandez@cavium.com>
+
+commit b7edfa235effb4b4a9816c2345620b11609c123e upstream.
+
+Following error will be logged in to message file while trying to
+configure target with multiqueue.
+
+"Cmd 0x1f aborted with timeout since ISP Abort is pending"
+"qla25xx_init_queues Rsp que: 1 init failed."
+
+Fixes: 82de802ad46e ("scsi: qla2xxx: Preparation for Target MQ.")
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Michael Hernandez <michael.hernandez@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_isr.c | 2 +-
+ drivers/scsi/qla2xxx/qla_mbx.c | 1 +
+ drivers/scsi/qla2xxx/qla_target.c | 2 +-
+ 3 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -3429,7 +3429,7 @@ msix_register_fail:
+ }
+
+ /* Enable MSI-X vector for response queue update for queue 0 */
+- if (IS_QLA25XX(ha) || IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
++ if (IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
+ if (ha->msixbase && ha->mqiobase &&
+ (ha->max_rsp_queues > 1 || ha->max_req_queues > 1 ||
+ ql2xmqsupport))
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -54,6 +54,7 @@ static struct rom_cmd {
+ { MBC_GET_MEM_OFFLOAD_CNTRL_STAT },
+ { MBC_GET_RETRY_COUNT },
+ { MBC_TRACE_CONTROL },
++ { MBC_INITIALIZE_MULTIQ },
+ };
+
+ static int is_rom_cmd(uint16_t cmd)
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -6796,7 +6796,7 @@ qlt_probe_one_stage1(struct scsi_qla_hos
+ if (!QLA_TGT_MODE_ENABLED())
+ return;
+
+- if (ha->mqenable || IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
++ if (IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
+ ISP_ATIO_Q_IN(base_vha) = &ha->mqiobase->isp25mq.atio_q_in;
+ ISP_ATIO_Q_OUT(base_vha) = &ha->mqiobase->isp25mq.atio_q_out;
+ } else {
--- /dev/null
+From e6373f33a6bba0de9f543f4a7faeaaa536c62997 Mon Sep 17 00:00:00 2001
+From: "himanshu.madhani@cavium.com" <himanshu.madhani@cavium.com>
+Date: Wed, 23 Aug 2017 15:04:57 -0700
+Subject: scsi: qla2xxx: Update fw_started flags at qpair creation.
+
+From: himanshu.madhani@cavium.com <himanshu.madhani@cavium.com>
+
+commit e6373f33a6bba0de9f543f4a7faeaaa536c62997 upstream.
+
+Fixes: 4b60c82736d0 ("scsi: qla2xxx: Add fw_started flags to qpair")
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_init.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -7804,6 +7804,7 @@ struct qla_qpair *qla2xxx_create_qpair(s
+ ha->queue_pair_map[qpair_id] = qpair;
+ qpair->id = qpair_id;
+ qpair->vp_idx = vp_idx;
++ qpair->fw_started = ha->flags.fw_started;
+ INIT_LIST_HEAD(&qpair->hints_list);
+ qpair->chip_reset = ha->base_qpair->chip_reset;
+ qpair->enable_class_2 = ha->base_qpair->enable_class_2;
--- /dev/null
+From fcc5b5cd726c0779cd689362aea82cc9d5a61346 Mon Sep 17 00:00:00 2001
+From: Sawan Chandak <sawan.chandak@cavium.com>
+Date: Wed, 23 Aug 2017 15:05:02 -0700
+Subject: scsi: qla2xxx: Use BIT_6 to acquire FAWWPN from switch
+
+From: Sawan Chandak <sawan.chandak@cavium.com>
+
+commit fcc5b5cd726c0779cd689362aea82cc9d5a61346 upstream.
+
+If FA-WWPN feature disabled on the switch side and enabled for the
+adapter, then driver would update the port name with switch port name.
+
+This patch fixes issue by checking correct BIT flag to validate.
+
+Fixes: 41dc529a4602 ("qla2xxx: Improve RSCN handling in driver")
+Signed-off-by: Sawan Chandak <sawan.chandak@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -3690,7 +3690,7 @@ qla24xx_report_id_acquisition(scsi_qla_h
+ if (qla_ini_mode_enabled(vha) &&
+ ha->flags.fawwpn_enabled &&
+ (rptid_entry->u.f1.flags &
+- VP_FLAGS_NAME_VALID)) {
++ BIT_6)) {
+ memcpy(vha->port_name,
+ rptid_entry->u.f1.port_name,
+ WWN_SIZE);
--- /dev/null
+From b2e8ae3f0e342a3308b4573790bd42528e51885a Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Wed, 23 Aug 2017 15:05:06 -0700
+Subject: scsi: qla2xxx: Use fabric name for Get Port Speed command
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit b2e8ae3f0e342a3308b4573790bd42528e51885a upstream.
+
+The Get Port Speed switch command needs the fabric port name of the
+remote device. Current code uses the registered WWPN.
+
+Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
+Cc: <stable@vger.kernel.org> # 4.10+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_gs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3080,7 +3080,7 @@ int qla24xx_async_gpsc(scsi_qla_host_t *
+ GPSC_RSP_SIZE);
+
+ /* GPSC req */
+- memcpy(ct_req->req.gpsc.port_name, fcport->port_name,
++ memcpy(ct_req->req.gpsc.port_name, fcport->fabric_port_name,
+ WWN_SIZE);
+
+ sp->u.iocb_cmd.u.ctarg.req = fcport->ct_desc.ct_sns;
--- /dev/null
+From 3e0097499839e0fe3af380410eababe5a47c4cf9 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Fri, 15 Sep 2017 14:05:16 +0200
+Subject: scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE
+
+From: Hannes Reinecke <hare@suse.de>
+
+commit 3e0097499839e0fe3af380410eababe5a47c4cf9 upstream.
+
+When calling SG_GET_REQUEST_TABLE ioctl only a half-filled table is
+returned; the remaining part will then contain stale kernel memory
+information. This patch zeroes out the entire table to avoid this
+issue.
+
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sg.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -839,7 +839,6 @@ sg_fill_request_table(Sg_fd *sfp, sg_req
+ list_for_each_entry(srp, &sfp->rq_list, entry) {
+ if (val > SG_MAX_QUEUE)
+ break;
+- memset(&rinfo[val], 0, SZ_SG_REQ_INFO);
+ rinfo[val].req_state = srp->done + 1;
+ rinfo[val].problem =
+ srp->header.masked_status &
+@@ -1047,8 +1046,8 @@ sg_ioctl(struct file *filp, unsigned int
+ else {
+ sg_req_info_t *rinfo;
+
+- rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
+- GFP_KERNEL);
++ rinfo = kzalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
++ GFP_KERNEL);
+ if (!rinfo)
+ return -ENOMEM;
+ read_lock_irqsave(&sfp->rq_list_lock, iflags);
scsi-megaraid_sas-return-pended-ioctls-with-cmd_status-mfi_stat_wrong_state-in-case-adapter-is-dead.patch
scsi-storvsc-fix-memory-leak-on-ring-buffer-busy.patch
scsi-sg-factor-out-sg_fill_request_table.patch
+scsi-sg-fixup-infoleak-when-using-sg_get_request_table.patch
+scsi-qla2xxx-update-fw_started-flags-at-qpair-creation.patch
+scsi-qla2xxx-correction-to-vha-vref_count-timeout.patch
+scsi-qla2xxx-fix-target-multiqueue-configuration.patch
+scsi-qla2xxx-use-bit_6-to-acquire-fawwpn-from-switch.patch
+scsi-qla2xxx-use-fabric-name-for-get-port-speed-command.patch
+scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch
+mailbox-bcm-flexrm-mailbox-fix-mask-used-in-cmpl_start_addr_value.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
