Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b2848792 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi 

Pull SCSI fixes from James Bottomley:
 "Six fairly small fixes.  The ipr, mpt3sas and ses ones all trigger
  oopses.  The megaraid one fixes an attach failure on io mapped only
  cards, the fcoe one is an obvious problem in the error path and the
  aacraid one is a theoretical security issue (ability to trick the
  kernel into a buffer overrun)"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  ses: Fix racy cleanup of /sys in remove_dev()
  mpt3sas: Fix resume on WarpDrive flash cards
  ipr: Fix sync scsi scan
  megaraid_sas: Fix probing cards without io port
  aacraid: Check size values after double-fetch from user
  fcoe: Use kfree_skb() instead of kfree()
parents 080ebb15 01b3add8

drivers/scsi/aacraid/commctrl.c

+11 −2
Original line number Diff line number Diff line
@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) 
	struct fib *fibptr;

	struct hw_fib * hw_fib = (struct hw_fib *)0;

	dma_addr_t hw_fib_pa = (dma_addr_t)0LL;

	unsigned size;

	unsigned int size, osize;

	int retval;



	if (dev->in_reset) {
@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) 
	 *	will not overrun the buffer when we copy the memory. Return

	 *	an error if we would.

	 */

	size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr);

	osize = size = le16_to_cpu(kfib->header.Size) +

		sizeof(struct aac_fibhdr);

	if (size < le16_to_cpu(kfib->header.SenderSize))

		size = le16_to_cpu(kfib->header.SenderSize);

	if (size > dev->max_fib_size) {
@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) 
		goto cleanup;

	}



	/* Sanity check the second copy */

	if ((osize != le16_to_cpu(kfib->header.Size) +

		sizeof(struct aac_fibhdr))

		|| (size < le16_to_cpu(kfib->header.SenderSize))) {

		retval = -EINVAL;

		goto cleanup;

	}



	if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) {

		aac_adapter_interrupt(dev);

		/*

drivers/scsi/fcoe/fcoe_ctlr.c

+1 −1
Original line number Diff line number Diff line
@@ -2923,7 +2923,7 @@ static int fcoe_ctlr_vlan_recv(struct fcoe_ctlr *fip, struct sk_buff *skb) 
	mutex_unlock(&fip->ctlr_mutex);



drop:

	kfree(skb);

	kfree_skb(skb);

	return rc;

}

drivers/scsi/megaraid/megaraid_sas_base.c

+3 −3
Original line number Diff line number Diff line
@@ -5037,7 +5037,7 @@ static int megasas_init_fw(struct megasas_instance *instance) 
	/* Find first memory bar */

	bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM);

	instance->bar = find_first_bit(&bar_list, sizeof(unsigned long));

	if (pci_request_selected_regions(instance->pdev, instance->bar,

	if (pci_request_selected_regions(instance->pdev, 1<<instance->bar,

					 "megasas: LSI")) {

		dev_printk(KERN_DEBUG, &instance->pdev->dev, "IO memory region busy!\n");

		return -EBUSY;
@@ -5339,7 +5339,7 @@ static int megasas_init_fw(struct megasas_instance *instance) 
	iounmap(instance->reg_set);



      fail_ioremap:

	pci_release_selected_regions(instance->pdev, instance->bar);

	pci_release_selected_regions(instance->pdev, 1<<instance->bar);



	return -EINVAL;

}
@@ -5360,7 +5360,7 @@ static void megasas_release_mfi(struct megasas_instance *instance) 


	iounmap(instance->reg_set);



	pci_release_selected_regions(instance->pdev, instance->bar);

	pci_release_selected_regions(instance->pdev, 1<<instance->bar);

}



/**

drivers/scsi/megaraid/megaraid_sas_fusion.c

+1 −1
Original line number Diff line number Diff line
@@ -2603,7 +2603,7 @@ megasas_release_fusion(struct megasas_instance *instance) 


	iounmap(instance->reg_set);



	pci_release_selected_regions(instance->pdev, instance->bar);

	pci_release_selected_regions(instance->pdev, 1<<instance->bar);

}



/**

drivers/scsi/mpt3sas/mpt3sas_base.c

+11 −11
Original line number Diff line number Diff line
@@ -2188,6 +2188,17 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc) 
	} else

		ioc->msix96_vector = 0;



	if (ioc->is_warpdrive) {

		ioc->reply_post_host_index[0] = (resource_size_t __iomem *)

		    &ioc->chip->ReplyPostHostIndex;



		for (i = 1; i < ioc->cpu_msix_table_sz; i++)

			ioc->reply_post_host_index[i] =

			(resource_size_t __iomem *)

			((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)

			* 4)));

	}



	list_for_each_entry(reply_q, &ioc->reply_queue_list, list)

		pr_info(MPT3SAS_FMT "%s: IRQ %d\n",

		    reply_q->name,  ((ioc->msix_enable) ? "PCI-MSI-X enabled" :
@@ -5280,17 +5291,6 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) 
	if (r)

		goto out_free_resources;



	if (ioc->is_warpdrive) {

		ioc->reply_post_host_index[0] = (resource_size_t __iomem *)

		    &ioc->chip->ReplyPostHostIndex;



		for (i = 1; i < ioc->cpu_msix_table_sz; i++)

			ioc->reply_post_host_index[i] =

			(resource_size_t __iomem *)

			((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)

			* 4)));

	}



	pci_set_drvdata(ioc->pdev, ioc->shost);

	r = _base_get_ioc_facts(ioc, CAN_SLEEP);

	if (r)