From: Greg Kroah-Hartman Date: Fri, 22 Sep 2017 11:18:35 +0000 (+0200) Subject: 4.13-stable patches X-Git-Tag: v3.18.72~14 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2c1e503d6fa9a4598ece83f30698e0c50bbc7888;p=thirdparty%2Fkernel%2Fstable-queue.git 4.13-stable patches added patches: mailbox-bcm-flexrm-mailbox-fix-mask-used-in-cmpl_start_addr_value.patch scsi-qla2xxx-correction-to-vha-vref_count-timeout.patch scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch scsi-qla2xxx-fix-target-multiqueue-configuration.patch scsi-qla2xxx-update-fw_started-flags-at-qpair-creation.patch scsi-qla2xxx-use-bit_6-to-acquire-fawwpn-from-switch.patch scsi-qla2xxx-use-fabric-name-for-get-port-speed-command.patch scsi-sg-fixup-infoleak-when-using-sg_get_request_table.patch --- diff --git a/queue-4.13/mailbox-bcm-flexrm-mailbox-fix-mask-used-in-cmpl_start_addr_value.patch b/queue-4.13/mailbox-bcm-flexrm-mailbox-fix-mask-used-in-cmpl_start_addr_value.patch new file mode 100644 index 00000000000..a77cca36e35 --- /dev/null +++ b/queue-4.13/mailbox-bcm-flexrm-mailbox-fix-mask-used-in-cmpl_start_addr_value.patch @@ -0,0 +1,39 @@ +From 6d2061b981af165d3e45462e0804b5a1f2f4c7bc Mon Sep 17 00:00:00 2001 +From: Anup Patel +Date: Tue, 1 Aug 2017 16:05:52 +0530 +Subject: mailbox: bcm-flexrm-mailbox: Fix mask used in CMPL_START_ADDR_VALUE() + +From: Anup Patel + +commit 6d2061b981af165d3e45462e0804b5a1f2f4c7bc upstream. + +The mask used in CMPL_START_ADDR_VALUE() should be 27bits instead of +26bits. This incorrect mask was causing completion writes to 40bits +physical address fail. + +This patch fixes mask used in CMPL_START_ADDR_VALUE() macro. + +Fixes: dbc049eee730 ("mailbox: Add driver for Broadcom FlexRM +ring manager") + +Signed-off-by: Anup Patel +Reviewed-by: Ray Jui +Reviewed-by: Scott Branden +Signed-off-by: Jassi Brar +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mailbox/bcm-flexrm-mailbox.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mailbox/bcm-flexrm-mailbox.c ++++ b/drivers/mailbox/bcm-flexrm-mailbox.c +@@ -95,7 +95,7 @@ + + /* Register RING_CMPL_START_ADDR fields */ + #define CMPL_START_ADDR_VALUE(pa) \ +- ((u32)((((u64)(pa)) >> RING_CMPL_ALIGN_ORDER) & 0x03ffffff)) ++ ((u32)((((u64)(pa)) >> RING_CMPL_ALIGN_ORDER) & 0x07ffffff)) + + /* Register RING_CONTROL fields */ + #define CONTROL_MASK_DISABLE_CONTROL 12 diff --git a/queue-4.13/scsi-qla2xxx-correction-to-vha-vref_count-timeout.patch b/queue-4.13/scsi-qla2xxx-correction-to-vha-vref_count-timeout.patch new file mode 100644 index 00000000000..5a621ebcaaf --- /dev/null +++ b/queue-4.13/scsi-qla2xxx-correction-to-vha-vref_count-timeout.patch @@ -0,0 +1,32 @@ +From 6e98095f8fb6d98da34c4e6c34e69e7c638d79c0 Mon Sep 17 00:00:00 2001 +From: Joe Carnuccio +Date: Wed, 23 Aug 2017 15:04:55 -0700 +Subject: scsi: qla2xxx: Correction to vha->vref_count timeout + +From: Joe Carnuccio + +commit 6e98095f8fb6d98da34c4e6c34e69e7c638d79c0 upstream. + +Fix incorrect second argument for wait_event_timeout() + +Fixes: c4a9b538ab2a ("qla2xxx: Allow vref count to timeout on vport delete.") +Signed-off-by: Joe Carnuccio +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_mid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_mid.c ++++ b/drivers/scsi/qla2xxx/qla_mid.c +@@ -74,7 +74,7 @@ qla24xx_deallocate_vp_id(scsi_qla_host_t + * ensures no active vp_list traversal while the vport is removed + * from the queue) + */ +- wait_event_timeout(vha->vref_waitq, atomic_read(&vha->vref_count), ++ wait_event_timeout(vha->vref_waitq, !atomic_read(&vha->vref_count), + 10*HZ); + + spin_lock_irqsave(&ha->vport_slock, flags); diff --git a/queue-4.13/scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch b/queue-4.13/scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch new file mode 100644 index 00000000000..e6949cf6b32 --- /dev/null +++ b/queue-4.13/scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch @@ -0,0 +1,62 @@ +From e6f77540c067b48dee10f1e33678415bfcc89017 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 30 Aug 2017 16:30:35 +0300 +Subject: scsi: qla2xxx: Fix an integer overflow in sysfs code + +From: Dan Carpenter + +commit e6f77540c067b48dee10f1e33678415bfcc89017 upstream. + +The value of "size" comes from the user. When we add "start + size" it +could lead to an integer overflow bug. + +It means we vmalloc() a lot more memory than we had intended. I believe +that on 64 bit systems vmalloc() can succeed even if we ask it to +allocate huge 4GB buffers. So we would get memory corruption and likely +a crash when we call ha->isp_ops->write_optrom() and ->read_optrom(). + +Only root can trigger this bug. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=194061 + +Fixes: b7cc176c9eb3 ("[SCSI] qla2xxx: Allow region-based flash-part accesses.") +Reported-by: shqking +Signed-off-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_attr.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -318,6 +318,8 @@ qla2x00_sysfs_write_optrom_ctl(struct fi + return -EINVAL; + if (start > ha->optrom_size) + return -EINVAL; ++ if (size > ha->optrom_size - start) ++ size = ha->optrom_size - start; + + mutex_lock(&ha->optrom_mutex); + switch (val) { +@@ -343,8 +345,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi + } + + ha->optrom_region_start = start; +- ha->optrom_region_size = start + size > ha->optrom_size ? +- ha->optrom_size - start : size; ++ ha->optrom_region_size = start + size; + + ha->optrom_state = QLA_SREADING; + ha->optrom_buffer = vmalloc(ha->optrom_region_size); +@@ -417,8 +418,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi + } + + ha->optrom_region_start = start; +- ha->optrom_region_size = start + size > ha->optrom_size ? +- ha->optrom_size - start : size; ++ ha->optrom_region_size = start + size; + + ha->optrom_state = QLA_SWRITING; + ha->optrom_buffer = vmalloc(ha->optrom_region_size); diff --git a/queue-4.13/scsi-qla2xxx-fix-target-multiqueue-configuration.patch b/queue-4.13/scsi-qla2xxx-fix-target-multiqueue-configuration.patch new file mode 100644 index 00000000000..dc7fd42b684 --- /dev/null +++ b/queue-4.13/scsi-qla2xxx-fix-target-multiqueue-configuration.patch @@ -0,0 +1,60 @@ +From b7edfa235effb4b4a9816c2345620b11609c123e Mon Sep 17 00:00:00 2001 +From: Michael Hernandez +Date: Wed, 23 Aug 2017 15:04:56 -0700 +Subject: scsi: qla2xxx: Fix target multiqueue configuration + +From: Michael Hernandez + +commit b7edfa235effb4b4a9816c2345620b11609c123e upstream. + +Following error will be logged in to message file while trying to +configure target with multiqueue. + +"Cmd 0x1f aborted with timeout since ISP Abort is pending" +"qla25xx_init_queues Rsp que: 1 init failed." + +Fixes: 82de802ad46e ("scsi: qla2xxx: Preparation for Target MQ.") +Signed-off-by: Quinn Tran +Signed-off-by: Michael Hernandez +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_isr.c | 2 +- + drivers/scsi/qla2xxx/qla_mbx.c | 1 + + drivers/scsi/qla2xxx/qla_target.c | 2 +- + 3 files changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -3429,7 +3429,7 @@ msix_register_fail: + } + + /* Enable MSI-X vector for response queue update for queue 0 */ +- if (IS_QLA25XX(ha) || IS_QLA83XX(ha) || IS_QLA27XX(ha)) { ++ if (IS_QLA83XX(ha) || IS_QLA27XX(ha)) { + if (ha->msixbase && ha->mqiobase && + (ha->max_rsp_queues > 1 || ha->max_req_queues > 1 || + ql2xmqsupport)) +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -54,6 +54,7 @@ static struct rom_cmd { + { MBC_GET_MEM_OFFLOAD_CNTRL_STAT }, + { MBC_GET_RETRY_COUNT }, + { MBC_TRACE_CONTROL }, ++ { MBC_INITIALIZE_MULTIQ }, + }; + + static int is_rom_cmd(uint16_t cmd) +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -6796,7 +6796,7 @@ qlt_probe_one_stage1(struct scsi_qla_hos + if (!QLA_TGT_MODE_ENABLED()) + return; + +- if (ha->mqenable || IS_QLA83XX(ha) || IS_QLA27XX(ha)) { ++ if (IS_QLA83XX(ha) || IS_QLA27XX(ha)) { + ISP_ATIO_Q_IN(base_vha) = &ha->mqiobase->isp25mq.atio_q_in; + ISP_ATIO_Q_OUT(base_vha) = &ha->mqiobase->isp25mq.atio_q_out; + } else { diff --git a/queue-4.13/scsi-qla2xxx-update-fw_started-flags-at-qpair-creation.patch b/queue-4.13/scsi-qla2xxx-update-fw_started-flags-at-qpair-creation.patch new file mode 100644 index 00000000000..898e273dd47 --- /dev/null +++ b/queue-4.13/scsi-qla2xxx-update-fw_started-flags-at-qpair-creation.patch @@ -0,0 +1,28 @@ +From e6373f33a6bba0de9f543f4a7faeaaa536c62997 Mon Sep 17 00:00:00 2001 +From: "himanshu.madhani@cavium.com" +Date: Wed, 23 Aug 2017 15:04:57 -0700 +Subject: scsi: qla2xxx: Update fw_started flags at qpair creation. + +From: himanshu.madhani@cavium.com + +commit e6373f33a6bba0de9f543f4a7faeaaa536c62997 upstream. + +Fixes: 4b60c82736d0 ("scsi: qla2xxx: Add fw_started flags to qpair") +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_init.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -7804,6 +7804,7 @@ struct qla_qpair *qla2xxx_create_qpair(s + ha->queue_pair_map[qpair_id] = qpair; + qpair->id = qpair_id; + qpair->vp_idx = vp_idx; ++ qpair->fw_started = ha->flags.fw_started; + INIT_LIST_HEAD(&qpair->hints_list); + qpair->chip_reset = ha->base_qpair->chip_reset; + qpair->enable_class_2 = ha->base_qpair->enable_class_2; diff --git a/queue-4.13/scsi-qla2xxx-use-bit_6-to-acquire-fawwpn-from-switch.patch b/queue-4.13/scsi-qla2xxx-use-bit_6-to-acquire-fawwpn-from-switch.patch new file mode 100644 index 00000000000..137f659e03f --- /dev/null +++ b/queue-4.13/scsi-qla2xxx-use-bit_6-to-acquire-fawwpn-from-switch.patch @@ -0,0 +1,35 @@ +From fcc5b5cd726c0779cd689362aea82cc9d5a61346 Mon Sep 17 00:00:00 2001 +From: Sawan Chandak +Date: Wed, 23 Aug 2017 15:05:02 -0700 +Subject: scsi: qla2xxx: Use BIT_6 to acquire FAWWPN from switch + +From: Sawan Chandak + +commit fcc5b5cd726c0779cd689362aea82cc9d5a61346 upstream. + +If FA-WWPN feature disabled on the switch side and enabled for the +adapter, then driver would update the port name with switch port name. + +This patch fixes issue by checking correct BIT flag to validate. + +Fixes: 41dc529a4602 ("qla2xxx: Improve RSCN handling in driver") +Signed-off-by: Sawan Chandak +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -3690,7 +3690,7 @@ qla24xx_report_id_acquisition(scsi_qla_h + if (qla_ini_mode_enabled(vha) && + ha->flags.fawwpn_enabled && + (rptid_entry->u.f1.flags & +- VP_FLAGS_NAME_VALID)) { ++ BIT_6)) { + memcpy(vha->port_name, + rptid_entry->u.f1.port_name, + WWN_SIZE); diff --git a/queue-4.13/scsi-qla2xxx-use-fabric-name-for-get-port-speed-command.patch b/queue-4.13/scsi-qla2xxx-use-fabric-name-for-get-port-speed-command.patch new file mode 100644 index 00000000000..28b243f9729 --- /dev/null +++ b/queue-4.13/scsi-qla2xxx-use-fabric-name-for-get-port-speed-command.patch @@ -0,0 +1,34 @@ +From b2e8ae3f0e342a3308b4573790bd42528e51885a Mon Sep 17 00:00:00 2001 +From: Quinn Tran +Date: Wed, 23 Aug 2017 15:05:06 -0700 +Subject: scsi: qla2xxx: Use fabric name for Get Port Speed command + +From: Quinn Tran + +commit b2e8ae3f0e342a3308b4573790bd42528e51885a upstream. + +The Get Port Speed switch command needs the fabric port name of the +remote device. Current code uses the registered WWPN. + +Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery") +Cc: # 4.10+ +Signed-off-by: Quinn Tran +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_gs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -3080,7 +3080,7 @@ int qla24xx_async_gpsc(scsi_qla_host_t * + GPSC_RSP_SIZE); + + /* GPSC req */ +- memcpy(ct_req->req.gpsc.port_name, fcport->port_name, ++ memcpy(ct_req->req.gpsc.port_name, fcport->fabric_port_name, + WWN_SIZE); + + sp->u.iocb_cmd.u.ctarg.req = fcport->ct_desc.ct_sns; diff --git a/queue-4.13/scsi-sg-fixup-infoleak-when-using-sg_get_request_table.patch b/queue-4.13/scsi-sg-fixup-infoleak-when-using-sg_get_request_table.patch new file mode 100644 index 00000000000..5c9d8060cf8 --- /dev/null +++ b/queue-4.13/scsi-sg-fixup-infoleak-when-using-sg_get_request_table.patch @@ -0,0 +1,46 @@ +From 3e0097499839e0fe3af380410eababe5a47c4cf9 Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Fri, 15 Sep 2017 14:05:16 +0200 +Subject: scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE + +From: Hannes Reinecke + +commit 3e0097499839e0fe3af380410eababe5a47c4cf9 upstream. + +When calling SG_GET_REQUEST_TABLE ioctl only a half-filled table is +returned; the remaining part will then contain stale kernel memory +information. This patch zeroes out the entire table to avoid this +issue. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Reviewed-by: Eric Dumazet +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sg.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -839,7 +839,6 @@ sg_fill_request_table(Sg_fd *sfp, sg_req + list_for_each_entry(srp, &sfp->rq_list, entry) { + if (val > SG_MAX_QUEUE) + break; +- memset(&rinfo[val], 0, SZ_SG_REQ_INFO); + rinfo[val].req_state = srp->done + 1; + rinfo[val].problem = + srp->header.masked_status & +@@ -1047,8 +1046,8 @@ sg_ioctl(struct file *filp, unsigned int + else { + sg_req_info_t *rinfo; + +- rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE, +- GFP_KERNEL); ++ rinfo = kzalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE, ++ GFP_KERNEL); + if (!rinfo) + return -ENOMEM; + read_lock_irqsave(&sfp->rq_list_lock, iflags); diff --git a/queue-4.13/series b/queue-4.13/series index ba68d54e40d..d93c96d4fcb 100644 --- a/queue-4.13/series +++ b/queue-4.13/series @@ -63,3 +63,11 @@ scsi-megaraid_sas-check-valid-aen-class-range-to-avoid-kernel-panic.patch scsi-megaraid_sas-return-pended-ioctls-with-cmd_status-mfi_stat_wrong_state-in-case-adapter-is-dead.patch scsi-storvsc-fix-memory-leak-on-ring-buffer-busy.patch scsi-sg-factor-out-sg_fill_request_table.patch +scsi-sg-fixup-infoleak-when-using-sg_get_request_table.patch +scsi-qla2xxx-update-fw_started-flags-at-qpair-creation.patch +scsi-qla2xxx-correction-to-vha-vref_count-timeout.patch +scsi-qla2xxx-fix-target-multiqueue-configuration.patch +scsi-qla2xxx-use-bit_6-to-acquire-fawwpn-from-switch.patch +scsi-qla2xxx-use-fabric-name-for-get-port-speed-command.patch +scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch +mailbox-bcm-flexrm-mailbox-fix-mask-used-in-cmpl_start_addr_value.patch