Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6edc51a8 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi 

Pull SCSI fixes from James Bottomley:
 "Five small fixes.

  Some of these, like the nested spinlock overwriting saved flags and
  the Kasan use after free look serious, but they seem not to have been
  picked up in testing or seen in the field.

  The biggest user visible issue is probably the wrong device handler
  for Clariion, which means that alua doesn't bind to the array like it
  should"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ipr: Fix async error WARN_ON
  scsi: zfcp: spin_lock_irqsave() is not nestable
  scsi: Remove one useless stack variable
  scsi: Fix use-after-free
  scsi: Replace wrong device handler name for CLARiiON arrays
parents ecd06f28 ebbb7594

drivers/s390/scsi/zfcp_dbf.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -384,7 +384,7 @@ void zfcp_dbf_san(char *tag, struct zfcp_dbf *dbf, 
	/* if (len > rec_len):

	/* if (len > rec_len):

	 * dump data up to cap_len ignoring small duplicate in rec->payload

	 * dump data up to cap_len ignoring small duplicate in rec->payload

	 */

	 */

	spin_lock_irqsave(&dbf->pay_lock, flags);

	spin_lock(&dbf->pay_lock);

	memset(payload, 0, sizeof(*payload));

	memset(payload, 0, sizeof(*payload));

	memcpy(payload->area, paytag, ZFCP_DBF_TAG_LEN);

	memcpy(payload->area, paytag, ZFCP_DBF_TAG_LEN);

	payload->fsf_req_id = req_id;

	payload->fsf_req_id = req_id;

drivers/scsi/ipr.c

+1 −2
Original line number Original line Diff line number Diff line
@@ -2586,7 +2586,6 @@ static void ipr_process_error(struct ipr_cmnd *ipr_cmd) 
	struct ipr_hostrcb *hostrcb = ipr_cmd->u.hostrcb;

	struct ipr_hostrcb *hostrcb = ipr_cmd->u.hostrcb;

	u32 ioasc = be32_to_cpu(ipr_cmd->s.ioasa.hdr.ioasc);

	u32 ioasc = be32_to_cpu(ipr_cmd->s.ioasa.hdr.ioasc);

	u32 fd_ioasc;

	u32 fd_ioasc;

	char *envp[] = { "ASYNC_ERR_LOG=1", NULL };





	if (ioa_cfg->sis64)

	if (ioa_cfg->sis64)

		fd_ioasc = be32_to_cpu(hostrcb->hcam.u.error64.fd_ioasc);

		fd_ioasc = be32_to_cpu(hostrcb->hcam.u.error64.fd_ioasc);
@@ -2607,8 +2606,8 @@ static void ipr_process_error(struct ipr_cmnd *ipr_cmd) 
	}

	}





	list_add_tail(&hostrcb->queue, &ioa_cfg->hostrcb_report_q);

	list_add_tail(&hostrcb->queue, &ioa_cfg->hostrcb_report_q);

	schedule_work(&ioa_cfg->work_q);

	hostrcb = ipr_get_free_hostrcb(ioa_cfg);

	hostrcb = ipr_get_free_hostrcb(ioa_cfg);

	kobject_uevent_env(&ioa_cfg->host->shost_dev.kobj, KOBJ_CHANGE, envp);





	ipr_send_hcam(ioa_cfg, IPR_HCAM_CDB_OP_CODE_LOG_DATA, hostrcb);

	ipr_send_hcam(ioa_cfg, IPR_HCAM_CDB_OP_CODE_LOG_DATA, hostrcb);

}

}

drivers/scsi/scsi_dh.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -36,9 +36,9 @@ struct scsi_dh_blist { 
};

};





static const struct scsi_dh_blist scsi_dh_blist[] = {

static const struct scsi_dh_blist scsi_dh_blist[] = {

	{"DGC", "RAID",			"clariion" },

	{"DGC", "RAID",			"emc" },

	{"DGC", "DISK",			"clariion" },

	{"DGC", "DISK",			"emc" },

	{"DGC", "VRAID",		"clariion" },

	{"DGC", "VRAID",		"emc" },





	{"COMPAQ", "MSA1000 VOLUME",	"hp_sw" },

	{"COMPAQ", "MSA1000 VOLUME",	"hp_sw" },

	{"COMPAQ", "HSV110",		"hp_sw" },

	{"COMPAQ", "HSV110",		"hp_sw" },

drivers/scsi/scsi_scan.c

+1 −5
Original line number Original line Diff line number Diff line
@@ -1307,7 +1307,6 @@ static void scsi_sequential_lun_scan(struct scsi_target *starget, 
static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,

static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,

				enum scsi_scan_mode rescan)

				enum scsi_scan_mode rescan)

{

{

	char devname[64];

	unsigned char scsi_cmd[MAX_COMMAND_SIZE];

	unsigned char scsi_cmd[MAX_COMMAND_SIZE];

	unsigned int length;

	unsigned int length;

	u64 lun;

	u64 lun;
@@ -1349,9 +1348,6 @@ static int scsi_report_lun_scan(struct scsi_target *starget, int bflags, 
		}

		}

	}

	}





	sprintf(devname, "host %d channel %d id %d",

		shost->host_no, sdev->channel, sdev->id);



	/*

	/*

	 * Allocate enough to hold the header (the same size as one scsi_lun)

	 * Allocate enough to hold the header (the same size as one scsi_lun)

	 * plus the number of luns we are requesting.  511 was the default

	 * plus the number of luns we are requesting.  511 was the default
@@ -1470,12 +1466,12 @@ static int scsi_report_lun_scan(struct scsi_target *starget, int bflags, 
 out_err:

 out_err:

	kfree(lun_data);

	kfree(lun_data);

 out:

 out:

	scsi_device_put(sdev);

	if (scsi_device_created(sdev))

	if (scsi_device_created(sdev))

		/*

		/*

		 * the sdev we used didn't appear in the report luns scan

		 * the sdev we used didn't appear in the report luns scan

		 */

		 */

		__scsi_remove_device(sdev);

		__scsi_remove_device(sdev);

	scsi_device_put(sdev);

	return ret;

	return ret;

}

}