From: Greg Kroah-Hartman Date: Fri, 2 May 2014 02:52:25 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.4.89~27 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2551a61a6296c0d6e1318ca27f686bb96d1f2372;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: ib_srpt-use-correct-ib_sg_dma-primitives.patch iscsi-target-fix-erl-2-async_event-connection-pointer-bug.patch scsi-arcmsr-upper-32-of-dma-address-lost.patch scsi-qla2xxx-fix-error-handling-of-qla2x00_mem_alloc.patch --- diff --git a/queue-3.10/ib_srpt-use-correct-ib_sg_dma-primitives.patch b/queue-3.10/ib_srpt-use-correct-ib_sg_dma-primitives.patch new file mode 100644 index 00000000000..66c297fcc4e --- /dev/null +++ b/queue-3.10/ib_srpt-use-correct-ib_sg_dma-primitives.patch @@ -0,0 +1,81 @@ +From b076808051f2c80d38e03fb2f1294f525c7a446d Mon Sep 17 00:00:00 2001 +From: Mike Marciniszyn +Date: Mon, 7 Apr 2014 13:58:35 -0400 +Subject: ib_srpt: Use correct ib_sg_dma primitives + +From: Mike Marciniszyn + +commit b076808051f2c80d38e03fb2f1294f525c7a446d upstream. + +The code was incorrectly using sg_dma_address() and +sg_dma_len() instead of ib_sg_dma_address() and +ib_sg_dma_len(). + +This prevents srpt from functioning with the +Intel HCA and indeed will corrupt memory +badly. + +Cc: Bart Van Assche +Reviewed-by: Dennis Dalessandro +Tested-by: Vinod Kumar +Signed-off-by: Mike Marciniszyn +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -1078,6 +1078,7 @@ static void srpt_unmap_sg_to_ib_sge(stru + static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, + struct srpt_send_ioctx *ioctx) + { ++ struct ib_device *dev = ch->sport->sdev->device; + struct se_cmd *cmd; + struct scatterlist *sg, *sg_orig; + int sg_cnt; +@@ -1124,7 +1125,7 @@ static int srpt_map_sg_to_ib_sge(struct + + db = ioctx->rbufs; + tsize = cmd->data_length; +- dma_len = sg_dma_len(&sg[0]); ++ dma_len = ib_sg_dma_len(dev, &sg[0]); + riu = ioctx->rdma_ius; + + /* +@@ -1155,7 +1156,8 @@ static int srpt_map_sg_to_ib_sge(struct + ++j; + if (j < count) { + sg = sg_next(sg); +- dma_len = sg_dma_len(sg); ++ dma_len = ib_sg_dma_len( ++ dev, sg); + } + } + } else { +@@ -1192,8 +1194,8 @@ static int srpt_map_sg_to_ib_sge(struct + tsize = cmd->data_length; + riu = ioctx->rdma_ius; + sg = sg_orig; +- dma_len = sg_dma_len(&sg[0]); +- dma_addr = sg_dma_address(&sg[0]); ++ dma_len = ib_sg_dma_len(dev, &sg[0]); ++ dma_addr = ib_sg_dma_address(dev, &sg[0]); + + /* this second loop is really mapped sg_addres to rdma_iu->ib_sge */ + for (i = 0, j = 0; +@@ -1216,8 +1218,10 @@ static int srpt_map_sg_to_ib_sge(struct + ++j; + if (j < count) { + sg = sg_next(sg); +- dma_len = sg_dma_len(sg); +- dma_addr = sg_dma_address(sg); ++ dma_len = ib_sg_dma_len( ++ dev, sg); ++ dma_addr = ib_sg_dma_address( ++ dev, sg); + } + } + } else { diff --git a/queue-3.10/iscsi-target-fix-erl-2-async_event-connection-pointer-bug.patch b/queue-3.10/iscsi-target-fix-erl-2-async_event-connection-pointer-bug.patch new file mode 100644 index 00000000000..3c08c67be5c --- /dev/null +++ b/queue-3.10/iscsi-target-fix-erl-2-async_event-connection-pointer-bug.patch @@ -0,0 +1,50 @@ +From d444edc679e7713412f243b792b1f964e5cff1e1 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Wed, 19 Feb 2014 23:32:14 +0000 +Subject: iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug + +From: Nicholas Bellinger + +commit d444edc679e7713412f243b792b1f964e5cff1e1 upstream. + +This patch fixes a long-standing bug in iscsit_build_conn_drop_async_message() +where during ERL=2 connection recovery, a bogus conn_p pointer could +end up being used to send the ISCSI_OP_ASYNC_EVENT + DROPPING_CONNECTION +notifying the initiator that cmd->logout_cid has failed. + +The bug was manifesting itself as an OOPs in iscsit_allocate_cmd() with +a bogus conn_p pointer in iscsit_build_conn_drop_async_message(). + +Reported-by: Arshad Hussain +Reported-by: santosh kulkarni +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -2454,6 +2454,7 @@ static void iscsit_build_conn_drop_async + { + struct iscsi_cmd *cmd; + struct iscsi_conn *conn_p; ++ bool found = false; + + /* + * Only send a Asynchronous Message on connections whos network +@@ -2462,11 +2463,12 @@ static void iscsit_build_conn_drop_async + list_for_each_entry(conn_p, &conn->sess->sess_conn_list, conn_list) { + if (conn_p->conn_state == TARG_CONN_STATE_LOGGED_IN) { + iscsit_inc_conn_usage_count(conn_p); ++ found = true; + break; + } + } + +- if (!conn_p) ++ if (!found) + return; + + cmd = iscsit_allocate_cmd(conn_p, GFP_ATOMIC); diff --git a/queue-3.10/scsi-arcmsr-upper-32-of-dma-address-lost.patch b/queue-3.10/scsi-arcmsr-upper-32-of-dma-address-lost.patch new file mode 100644 index 00000000000..be29e49b7a7 --- /dev/null +++ b/queue-3.10/scsi-arcmsr-upper-32-of-dma-address-lost.patch @@ -0,0 +1,43 @@ +From e2c70425f05219b142b3a8a9489a622c736db39d Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 11 Feb 2014 19:06:33 +0300 +Subject: SCSI: arcmsr: upper 32 of dma address lost + +From: Dan Carpenter + +commit e2c70425f05219b142b3a8a9489a622c736db39d upstream. + +The original code always set the upper 32 bits to zero because it was +doing a shift of the wrong variable. + +Fixes: 1a4f550a09f8 ('[SCSI] arcmsr: 1.20.00.15: add SATA RAID plus other fixes') +Signed-off-by: Dan Carpenter +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/arcmsr/arcmsr_hba.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/arcmsr/arcmsr_hba.c ++++ b/drivers/scsi/arcmsr/arcmsr_hba.c +@@ -2501,16 +2501,15 @@ static int arcmsr_polling_ccbdone(struct + static int arcmsr_iop_confirm(struct AdapterControlBlock *acb) + { + uint32_t cdb_phyaddr, cdb_phyaddr_hi32; +- dma_addr_t dma_coherent_handle; ++ + /* + ******************************************************************** + ** here we need to tell iop 331 our freeccb.HighPart + ** if freeccb.HighPart is not zero + ******************************************************************** + */ +- dma_coherent_handle = acb->dma_coherent_handle; +- cdb_phyaddr = (uint32_t)(dma_coherent_handle); +- cdb_phyaddr_hi32 = (uint32_t)((cdb_phyaddr >> 16) >> 16); ++ cdb_phyaddr = lower_32_bits(acb->dma_coherent_handle); ++ cdb_phyaddr_hi32 = upper_32_bits(acb->dma_coherent_handle); + acb->cdb_phyaddr_hi32 = cdb_phyaddr_hi32; + /* + *********************************************************************** diff --git a/queue-3.10/scsi-qla2xxx-fix-error-handling-of-qla2x00_mem_alloc.patch b/queue-3.10/scsi-qla2xxx-fix-error-handling-of-qla2x00_mem_alloc.patch new file mode 100644 index 00000000000..6cb4f86676c --- /dev/null +++ b/queue-3.10/scsi-qla2xxx-fix-error-handling-of-qla2x00_mem_alloc.patch @@ -0,0 +1,51 @@ +From b2a72ec32d0f499aaadf41264232517a12326df0 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 21 Jan 2014 10:00:10 +0300 +Subject: SCSI: qla2xxx: fix error handling of qla2x00_mem_alloc() + +From: Dan Carpenter + +commit b2a72ec32d0f499aaadf41264232517a12326df0 upstream. + +qla2x00_mem_alloc() returns 1 on success and -ENOMEM on failure. On the +one hand the caller assumes non-zero is success but on the other hand +the caller also assumes that it returns an error code. + +I've fixed it to return zero on success and a negative error code on +failure. This matches the documentation as well. + +[jejb: checkpatch fix] +Fixes: e315cd28b9ef ('[SCSI] qla2xxx: Code changes for qla data structure refactoring') +Signed-off-by: Dan Carpenter +Acked-by: Saurav Kashyap +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_os.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -2553,7 +2553,7 @@ qla2x00_probe_one(struct pci_dev *pdev, + ha->flags.enable_64bit_addressing ? "enable" : + "disable"); + ret = qla2x00_mem_alloc(ha, req_length, rsp_length, &req, &rsp); +- if (!ret) { ++ if (ret) { + ql_log_pci(ql_log_fatal, pdev, 0x0031, + "Failed to allocate memory for adapter, aborting.\n"); + +@@ -3458,10 +3458,10 @@ qla2x00_mem_alloc(struct qla_hw_data *ha + else { + qla2x00_set_reserved_loop_ids(ha); + ql_dbg_pci(ql_dbg_init, ha->pdev, 0x0123, +- "loop_id_map=%p. \n", ha->loop_id_map); ++ "loop_id_map=%p.\n", ha->loop_id_map); + } + +- return 1; ++ return 0; + + fail_async_pd: + dma_pool_free(ha->s_dma_pool, ha->ex_init_cb, ha->ex_init_cb_dma); diff --git a/queue-3.10/series b/queue-3.10/series index 1ef5e068b0b..c0be9cfbe21 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -49,3 +49,7 @@ ib-ipath-fix-potential-buffer-overrun-in-sending-diag-packet-routine.patch ib-nes-return-an-error-on-ib_copy_from_udata-failure-instead-of-null.patch ib-mthca-return-an-error-on-ib_copy_to_udata-failure.patch ib-ehca-returns-an-error-on-ib_copy_to_udata-failure.patch +ib_srpt-use-correct-ib_sg_dma-primitives.patch +scsi-qla2xxx-fix-error-handling-of-qla2x00_mem_alloc.patch +scsi-arcmsr-upper-32-of-dma-address-lost.patch +iscsi-target-fix-erl-2-async_event-connection-pointer-bug.patch