From: Greg Kroah-Hartman Date: Fri, 2 May 2014 02:52:30 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.4.89~25 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1e59db3bfa2aebb49c481ef7f23ad8845f95e25a;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: ib_srpt-use-correct-ib_sg_dma-primitives.patch iscsi-target-fix-erl-2-async_event-connection-pointer-bug.patch scsi-arcmsr-upper-32-of-dma-address-lost.patch --- diff --git a/queue-3.4/ib_srpt-use-correct-ib_sg_dma-primitives.patch b/queue-3.4/ib_srpt-use-correct-ib_sg_dma-primitives.patch new file mode 100644 index 00000000000..dce7b06e568 --- /dev/null +++ b/queue-3.4/ib_srpt-use-correct-ib_sg_dma-primitives.patch @@ -0,0 +1,81 @@ +From b076808051f2c80d38e03fb2f1294f525c7a446d Mon Sep 17 00:00:00 2001 +From: Mike Marciniszyn +Date: Mon, 7 Apr 2014 13:58:35 -0400 +Subject: ib_srpt: Use correct ib_sg_dma primitives + +From: Mike Marciniszyn + +commit b076808051f2c80d38e03fb2f1294f525c7a446d upstream. + +The code was incorrectly using sg_dma_address() and +sg_dma_len() instead of ib_sg_dma_address() and +ib_sg_dma_len(). + +This prevents srpt from functioning with the +Intel HCA and indeed will corrupt memory +badly. + +Cc: Bart Van Assche +Reviewed-by: Dennis Dalessandro +Tested-by: Vinod Kumar +Signed-off-by: Mike Marciniszyn +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -1078,6 +1078,7 @@ static void srpt_unmap_sg_to_ib_sge(stru + static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, + struct srpt_send_ioctx *ioctx) + { ++ struct ib_device *dev = ch->sport->sdev->device; + struct se_cmd *cmd; + struct scatterlist *sg, *sg_orig; + int sg_cnt; +@@ -1125,7 +1126,7 @@ static int srpt_map_sg_to_ib_sge(struct + + db = ioctx->rbufs; + tsize = cmd->data_length; +- dma_len = sg_dma_len(&sg[0]); ++ dma_len = ib_sg_dma_len(dev, &sg[0]); + riu = ioctx->rdma_ius; + + /* +@@ -1156,7 +1157,8 @@ static int srpt_map_sg_to_ib_sge(struct + ++j; + if (j < count) { + sg = sg_next(sg); +- dma_len = sg_dma_len(sg); ++ dma_len = ib_sg_dma_len( ++ dev, sg); + } + } + } else { +@@ -1193,8 +1195,8 @@ static int srpt_map_sg_to_ib_sge(struct + tsize = cmd->data_length; + riu = ioctx->rdma_ius; + sg = sg_orig; +- dma_len = sg_dma_len(&sg[0]); +- dma_addr = sg_dma_address(&sg[0]); ++ dma_len = ib_sg_dma_len(dev, &sg[0]); ++ dma_addr = ib_sg_dma_address(dev, &sg[0]); + + /* this second loop is really mapped sg_addres to rdma_iu->ib_sge */ + for (i = 0, j = 0; +@@ -1217,8 +1219,10 @@ static int srpt_map_sg_to_ib_sge(struct + ++j; + if (j < count) { + sg = sg_next(sg); +- dma_len = sg_dma_len(sg); +- dma_addr = sg_dma_address(sg); ++ dma_len = ib_sg_dma_len( ++ dev, sg); ++ dma_addr = ib_sg_dma_address( ++ dev, sg); + } + } + } else { diff --git a/queue-3.4/iscsi-target-fix-erl-2-async_event-connection-pointer-bug.patch b/queue-3.4/iscsi-target-fix-erl-2-async_event-connection-pointer-bug.patch new file mode 100644 index 00000000000..71c439fc922 --- /dev/null +++ b/queue-3.4/iscsi-target-fix-erl-2-async_event-connection-pointer-bug.patch @@ -0,0 +1,50 @@ +From d444edc679e7713412f243b792b1f964e5cff1e1 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Wed, 19 Feb 2014 23:32:14 +0000 +Subject: iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug + +From: Nicholas Bellinger + +commit d444edc679e7713412f243b792b1f964e5cff1e1 upstream. + +This patch fixes a long-standing bug in iscsit_build_conn_drop_async_message() +where during ERL=2 connection recovery, a bogus conn_p pointer could +end up being used to send the ISCSI_OP_ASYNC_EVENT + DROPPING_CONNECTION +notifying the initiator that cmd->logout_cid has failed. + +The bug was manifesting itself as an OOPs in iscsit_allocate_cmd() with +a bogus conn_p pointer in iscsit_build_conn_drop_async_message(). + +Reported-by: Arshad Hussain +Reported-by: santosh kulkarni +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -2352,6 +2352,7 @@ static void iscsit_build_conn_drop_async + { + struct iscsi_cmd *cmd; + struct iscsi_conn *conn_p; ++ bool found = false; + + /* + * Only send a Asynchronous Message on connections whos network +@@ -2360,11 +2361,12 @@ static void iscsit_build_conn_drop_async + list_for_each_entry(conn_p, &conn->sess->sess_conn_list, conn_list) { + if (conn_p->conn_state == TARG_CONN_STATE_LOGGED_IN) { + iscsit_inc_conn_usage_count(conn_p); ++ found = true; + break; + } + } + +- if (!conn_p) ++ if (!found) + return; + + cmd = iscsit_allocate_cmd(conn_p, GFP_ATOMIC); diff --git a/queue-3.4/scsi-arcmsr-upper-32-of-dma-address-lost.patch b/queue-3.4/scsi-arcmsr-upper-32-of-dma-address-lost.patch new file mode 100644 index 00000000000..05cf693b57e --- /dev/null +++ b/queue-3.4/scsi-arcmsr-upper-32-of-dma-address-lost.patch @@ -0,0 +1,43 @@ +From e2c70425f05219b142b3a8a9489a622c736db39d Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 11 Feb 2014 19:06:33 +0300 +Subject: SCSI: arcmsr: upper 32 of dma address lost + +From: Dan Carpenter + +commit e2c70425f05219b142b3a8a9489a622c736db39d upstream. + +The original code always set the upper 32 bits to zero because it was +doing a shift of the wrong variable. + +Fixes: 1a4f550a09f8 ('[SCSI] arcmsr: 1.20.00.15: add SATA RAID plus other fixes') +Signed-off-by: Dan Carpenter +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/arcmsr/arcmsr_hba.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/arcmsr/arcmsr_hba.c ++++ b/drivers/scsi/arcmsr/arcmsr_hba.c +@@ -2500,16 +2500,15 @@ static int arcmsr_polling_ccbdone(struct + static int arcmsr_iop_confirm(struct AdapterControlBlock *acb) + { + uint32_t cdb_phyaddr, cdb_phyaddr_hi32; +- dma_addr_t dma_coherent_handle; ++ + /* + ******************************************************************** + ** here we need to tell iop 331 our freeccb.HighPart + ** if freeccb.HighPart is not zero + ******************************************************************** + */ +- dma_coherent_handle = acb->dma_coherent_handle; +- cdb_phyaddr = (uint32_t)(dma_coherent_handle); +- cdb_phyaddr_hi32 = (uint32_t)((cdb_phyaddr >> 16) >> 16); ++ cdb_phyaddr = lower_32_bits(acb->dma_coherent_handle); ++ cdb_phyaddr_hi32 = upper_32_bits(acb->dma_coherent_handle); + acb->cdb_phyaddr_hi32 = cdb_phyaddr_hi32; + /* + *********************************************************************** diff --git a/queue-3.4/series b/queue-3.4/series index d697e5e0620..c7578a1cb8d 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -23,3 +23,6 @@ ib-ipath-fix-potential-buffer-overrun-in-sending-diag-packet-routine.patch ib-nes-return-an-error-on-ib_copy_from_udata-failure-instead-of-null.patch ib-mthca-return-an-error-on-ib_copy_to_udata-failure.patch ib-ehca-returns-an-error-on-ib_copy_to_udata-failure.patch +ib_srpt-use-correct-ib_sg_dma-primitives.patch +scsi-arcmsr-upper-32-of-dma-address-lost.patch +iscsi-target-fix-erl-2-async_event-connection-pointer-bug.patch