Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5f8ebd36 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi 



Pull SCSI fixes from James Bottomley:
 "This is a set of three fixes for data corruption (libsas task file),
  oops causing (NULL in scsi_cmd_to_driver) and driver failure (bnx2i).
  The oops caused by the NULL in scsi_cmd_to_driver() manifests in
  scsi_eh_send_cmd() and has been seen by several people now.

  Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com&gt;">

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  [SCSI] bnx2i: Removed the reference to the netdev->base_addr
  [SCSI] libsas: fix taskfile corruption in sas_ata_qc_fill_rtf
  [SCSI] Fix NULL dereferences in scsi_cmd_to_driver
parents 8a76e538 a7717180

drivers/scsi/aic94xx/aic94xx_task.c

+1 −1
Original line number Diff line number Diff line
@@ -201,7 +201,7 @@ static void asd_get_response_tasklet(struct asd_ascb *ascb, 


		if (SAS_STATUS_BUF_SIZE >= sizeof(*resp)) {

			resp->frame_len = le16_to_cpu(*(__le16 *)(r+6));

			memcpy(&resp->ending_fis[0], r+16, 24);

			memcpy(&resp->ending_fis[0], r+16, ATA_RESP_FIS_SIZE);

			ts->buf_valid_size = sizeof(*resp);

		}

	}

drivers/scsi/bnx2i/bnx2i.h

+1 −0
Original line number Diff line number Diff line
@@ -350,6 +350,7 @@ struct bnx2i_hba { 
	struct pci_dev *pcidev;

	struct net_device *netdev;

	void __iomem *regview;

	resource_size_t reg_base;



	u32 age;

	unsigned long cnic_dev_type;

drivers/scsi/bnx2i/bnx2i_hwi.c

+1 −2
Original line number Diff line number Diff line
@@ -2724,7 +2724,6 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep) 
		goto arm_cq;

	}



	reg_base = ep->hba->netdev->base_addr;

	if ((test_bit(BNX2I_NX2_DEV_5709, &ep->hba->cnic_dev_type)) &&

	    (ep->hba->mail_queue_access == BNX2I_MQ_BIN_MODE)) {

		config2 = REG_RD(ep->hba, BNX2_MQ_CONFIG2);
@@ -2740,7 +2739,7 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep) 
		/* 5709 device in normal node and 5706/5708 devices */

		reg_off = CTX_OFFSET + (MB_KERNEL_CTX_SIZE * cid_num);



	ep->qp.ctx_base = ioremap_nocache(reg_base + reg_off,

	ep->qp.ctx_base = ioremap_nocache(ep->hba->reg_base + reg_off,

					  MB_KERNEL_CTX_SIZE);

	if (!ep->qp.ctx_base)

		return -ENOMEM;

drivers/scsi/bnx2i/bnx2i_iscsi.c

+5 −5
Original line number Diff line number Diff line
@@ -811,13 +811,13 @@ struct bnx2i_hba *bnx2i_alloc_hba(struct cnic_dev *cnic) 
	bnx2i_identify_device(hba);

	bnx2i_setup_host_queue_size(hba, shost);



	hba->reg_base = pci_resource_start(hba->pcidev, 0);

	if (test_bit(BNX2I_NX2_DEV_5709, &hba->cnic_dev_type)) {

		hba->regview = ioremap_nocache(hba->netdev->base_addr,

					       BNX2_MQ_CONFIG2);

		hba->regview = pci_iomap(hba->pcidev, 0, BNX2_MQ_CONFIG2);

		if (!hba->regview)

			goto ioreg_map_err;

	} else if (test_bit(BNX2I_NX2_DEV_57710, &hba->cnic_dev_type)) {

		hba->regview = ioremap_nocache(hba->netdev->base_addr, 4096);

		hba->regview = pci_iomap(hba->pcidev, 0, 4096);

		if (!hba->regview)

			goto ioreg_map_err;

	}
@@ -884,7 +884,7 @@ cid_que_err: 
	bnx2i_free_mp_bdt(hba);

mp_bdt_mem_err:

	if (hba->regview) {

		iounmap(hba->regview);

		pci_iounmap(hba->pcidev, hba->regview);

		hba->regview = NULL;

	}

ioreg_map_err:
@@ -910,7 +910,7 @@ void bnx2i_free_hba(struct bnx2i_hba *hba) 
	pci_dev_put(hba->pcidev);



	if (hba->regview) {

		iounmap(hba->regview);

		pci_iounmap(hba->pcidev, hba->regview);

		hba->regview = NULL;

	}

	bnx2i_free_mp_bdt(hba);

drivers/scsi/libsas/sas_ata.c

+6 −6
Original line number Diff line number Diff line
@@ -139,12 +139,12 @@ static void sas_ata_task_done(struct sas_task *task) 
	if (stat->stat == SAS_PROTO_RESPONSE || stat->stat == SAM_STAT_GOOD ||

	    ((stat->stat == SAM_STAT_CHECK_CONDITION &&

	      dev->sata_dev.command_set == ATAPI_COMMAND_SET))) {

		ata_tf_from_fis(resp->ending_fis, &dev->sata_dev.tf);

		memcpy(dev->sata_dev.fis, resp->ending_fis, ATA_RESP_FIS_SIZE);



		if (!link->sactive) {

			qc->err_mask |= ac_err_mask(dev->sata_dev.tf.command);

			qc->err_mask |= ac_err_mask(dev->sata_dev.fis[2]);

		} else {

			link->eh_info.err_mask |= ac_err_mask(dev->sata_dev.tf.command);

			link->eh_info.err_mask |= ac_err_mask(dev->sata_dev.fis[2]);

			if (unlikely(link->eh_info.err_mask))

				qc->flags |= ATA_QCFLAG_FAILED;

		}
@@ -161,8 +161,8 @@ static void sas_ata_task_done(struct sas_task *task) 
				qc->flags |= ATA_QCFLAG_FAILED;

			}



			dev->sata_dev.tf.feature = 0x04; /* status err */

			dev->sata_dev.tf.command = ATA_ERR;

			dev->sata_dev.fis[3] = 0x04; /* status err */

			dev->sata_dev.fis[2] = ATA_ERR;

		}

	}
@@ -269,7 +269,7 @@ static bool sas_ata_qc_fill_rtf(struct ata_queued_cmd *qc) 
{

	struct domain_device *dev = qc->ap->private_data;



	memcpy(&qc->result_tf, &dev->sata_dev.tf, sizeof(qc->result_tf));

	ata_tf_from_fis(dev->sata_dev.fis, &qc->result_tf);

	return true;

}