- 26 Jul, 2023 4 commits
-
-
Lin Ma authored
The current NETLINK_ISCSI netlink parsing loop checks every nlmsg to make sure the length is bigger than sizeof(struct iscsi_uevent) and then calls iscsi_if_recv_msg(). nlh = nlmsg_hdr(skb); if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) || skb->len < nlh->nlmsg_len) { break; } ... err = iscsi_if_recv_msg(skb, nlh, &group); Hence, in iscsi_if_recv_msg() the nlmsg_data can be safely converted to iscsi_uevent as the length is already checked. However, in other cases the length of nlattr payload is not checked before the payload is converted to other data structures. One example is iscsi_set_path() which converts the payload to type iscsi_path without any checks: params = (struct iscsi_path *)((char *)ev + sizeof(*ev)); Whereas iscsi_if_transport_conn() correctly checks the pdu_len: pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev); if ((ev->u.send_pdu.hdr_size > pdu_len) .. err = -EINVAL; To sum up, some code paths called in iscsi_if_recv_msg() do not check the length of the data (see below picture) and directly convert the data to another data structure. This could result in an out-of-bound reads and heap dirty data leakage. _________ nlmsg_len(nlh) _______________ / \ +----------+--------------+---------------------------+ | nlmsghdr | iscsi_uevent | data | +----------+--------------+---------------------------+ \ / iscsi_uevent->u.set_param.len Fix the issue by adding the length check before accessing it. To clean up the code, an additional parameter named rlen is added. The rlen is calculated at the beginning of iscsi_if_recv_msg() which avoids duplicated calculation. Fixes: ac20c7bf ("[SCSI] iscsi_transport: Added Ping support") Fixes: 43514774 ("[SCSI] iscsi class: Add new NETLINK_ISCSI messages for cnic/bnx2i driver.") Fixes: 1d9bf13a ("[SCSI] iscsi class: add iscsi host set param event") Fixes: 01cb225d ("[SCSI] iscsi: add target discvery event to transport class") Fixes: 264faaaa ("[SCSI] iscsi: add transport end point callbacks") Fixes: fd7255f5 ("[SCSI] iscsi: add sysfs attrs for uspace sync up") Signed-off-by:Lin Ma <linma@zju.edu.cn> Link: https://lore.kernel.org/r/20230725024529.428311-1-linma@zju.edu.cnReviewed-by:
Chris Leech <cleech@redhat.com> Signed-off-by:
Martin K. Petersen <martin.petersen@oracle.com>
-
Bart Van Assche authored
Although the code for residual handling in the SRP initiator follows the SCSI documentation, that documentation has never been correct. Because scsi_finish_command() starts from the data buffer length and subtracts the residual, scsi_set_resid() must not be called if a residual overflow occurs. Hence remove the scsi_set_resid() calls from the SRP initiator if a residual overflow occurrs. Cc: Leon Romanovsky <leon@kernel.org> Cc: Jason Gunthorpe <jgg@nvidia.com> Fixes: 9237f04e ("scsi: core: Fix scsi_get/set_resid() interface") Fixes: e714531a ("IB/srp: Fix residual handling") Signed-off-by:
Bart Van Assche <bvanassche@acm.org> Link: https://lore.kernel.org/r/20230724200843.3376570-3-bvanassche@acm.orgAcked-by:
Leon Romanovsky <leon@kernel.org> Signed-off-by:
-
Bart Van Assche authored
Only call scsi_set_resid() in case of an underflow. Do not call scsi_set_resid() in case of an overflow. Cc: Avri Altman <avri.altman@wdc.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Fixes: cb38845d ("scsi: ufs: core: Set the residual byte count") Signed-off-by:
Avri Altman <avri.altman@wdc.com> Reviewed-by:
Adrian Hunter <adrian.hunter@intel.com> Signed-off-by:
-
Arnd Bergmann authored
A recent change removed the only user of a local variable that needs to now also be removed: drivers/ufs/host/ufs-qcom.c: In function 'ufs_qcom_mcq_esi_handler': drivers/ufs/host/ufs-qcom.c:1652:31: error: unused variable 'host' [-Werror=unused-variable] Fixes: 8f2b7865 ("scsi: ufs: qcom: Get queue ID from MSI index in ESI handler") Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/llvm/64c00cd4.630a0220.6ad79.0eac@mx.google.com/ Link: https://lore.kernel.org/r/20230724122029.1430482-1-arnd@kernel.orgReviewed-by:
Abel Vesa <abel.vesa@linaro.org> Reviewed-by:
Manivannan Sadhasivam <mani@kernel.org> Reviewed-by:
Nick Desaulniers <ndesaulniers@google.com> Signed-off-by:
-
- 23 Jul, 2023 36 commits
-
-
Bart Van Assche authored
Interest among UFS users in HPB has reduced significantly. I am not aware of any current users of the HPB functionality. Hence remove HPB support from the kernel. A note: the work in JEDEC on a successor for HPB is nearing completion. Zoned storage for UFS or ZUFS combines the UFS standard with ZBC-2. Acked-by:
Bean Huo <beanhuo@micron.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: ChanWoo Lee <cw9316.lee@samsung.com> Cc: Daejun Park <daejun7.park@samsung.com> Cc: Keoseong Park <keosung.park@samsung.com> Signed-off-by:
-
Bart Van Assche authored
Because scsi_finish_command() subtracts the residual from the buffer length, residual overflows must not be reported. Reflect this in the SCSI documentation. See also commit 9237f04e ("scsi: core: Fix scsi_get/set_resid() interface") Cc: Damien Le Moal <dlemoal@kernel.org> Cc: Hannes Reinecke <hare@suse.de> Cc: Douglas Gilbert <dgilbert@interlog.com> Cc: stable@vger.kernel.org Signed-off-by:
-
Nitin Rawat authored
Devfreq uses the default DEVFREQ_TIMER_DEFERRABLE mode which uses the deferred timer for scheduling the devfreq load monitor function. This causes the load monitoring to be done only with non-idle CPUs and not making use of the idle CPUs. Hence, use the DEVFREQ_TIMER_DELAYED mode which uses the delayed timer thereby making use of idle CPUs as well for load monitoring. Co-developed-by:
Asutosh Das <quic_asutoshd@quicinc.com> Signed-off-by:
Nitin Rawat <quic_nitirawa@quicinc.com> Link: https://lore.kernel.org/r/20230720093446.30697-1-quic_nitirawa@quicinc.comSigned-off-by:
-
Martin K. Petersen authored
Nilesh Javali <njavali@marvell.com> says: Martin, Please apply the qla2xxx driver bug fixes to the scsi tree at your earliest convenience. Link: https://lore.kernel.org/r/20230714070104.40052-1-njavali@marvell.comSigned-off-by:
-
Nilesh Javali authored
Signed-off-by:
Nilesh Javali <njavali@marvell.com> Link: https://lore.kernel.org/r/20230714070104.40052-11-njavali@marvell.comReviewed-by:
Himanshu Madhani <himanshu.madhani@oracle.com> Signed-off-by:
-
Quinn Tran authored
Different behavior were experienced of session being torn down vs not when TMF is timed out. When FW detects the time out, the session is torn down. When driver detects the time out, the session is not torn down. Allow TMF error to return to upper layer without session tear down. Cc: stable@vger.kernel.org Signed-off-by:
Quinn Tran <qutran@marvell.com> Signed-off-by:
-
Quinn Tran authored
Task management can retry up to 5 times when FW resource becomes bottle neck. Between the retries, there is a short sleep. Current code assumes the chip has not reset or session has not changed. Check for chip reset or session change before sending Task management. Cc: stable@vger.kernel.org Fixes: 9803fb5d ("scsi: qla2xxx: Fix task management cmd failure") Signed-off-by:
-
Quinn Tran authored
Some consider noisy log as test failure. Turn off noisy message log. Cc: stable@vger.kernel.org Signed-off-by:
-
Quinn Tran authored
Connection does not resume after a host reset / chip reset. The cause of the blockage is due to the FCF_ASYNC_ACTIVE left on. The gnl command was interrupted by the chip reset. On exiting the command, this flag should be turn off to allow relogin to reoccur. Clear this flag to prevent blockage. Cc: stable@vger.kernel.org Fixes: 17e64648 ("scsi: qla2xxx: Correct fcport flags handling") Signed-off-by:
-
Quinn Tran authored
Link up failure occurred where driver failed to see certain events from FW indicating link up (AEN 8011) and fabric login completion (AEN 8014). Without these 2 events, driver would not proceed forward to scan the fabric. The cause of this is due to delay in the receive of interrupt for Mailbox 60 that causes qla to set the fw_started flag late. The late setting of this flag causes other interrupts to be dropped. These dropped interrupts happen to be the link up (AEN 8011) and fabric login completion (AEN 8014). Set fw_started flag early to prevent interrupts being dropped. Cc: stable@vger.kernel.org Signed-off-by:
-
Quinn Tran authored
For each TMF request, driver iterates through each qpair and flushes commands associated to the TMF. At the end of the qpair flush, a Marker is used to complete the flush transaction. This process was repeated for each qpair. The multiple flush and marker for this TMF request seems to cause confusion for FW. Instead, 1 flush is sent to FW. Driver would wait for FW to go through all the I/Os on each qpair to be read then return. Driver then closes out the transaction with a Marker. Cc: stable@vger.kernel.org Fixes: d90171dd ("scsi: qla2xxx: Multi-que support for TMF") Signed-off-by:
-
Quinn Tran authored
Per FW recommendation, 8 TMF's can be outstanding for each function. Previously, it allowed 8 per target. Limit TMF to 8 per function. Cc: stable@vger.kernel.org Fixes: 6a876796 ("scsi: qla2xxx: Fix task management cmd fail due to unavailable resource") Signed-off-by:
-
Quinn Tran authored
During NVMe queue creation, a new qpair is created. FW resource limit needs to be re-adjusted to take into account the new qpair. Otherwise, NVMe command can not go through. This issue was discovered while testing/forcing FW execution to fail at load time. Add call to readjust IOCB and exchange limit. In addition, get FW state command and require FW to be running. Otherwise, error is generated. Cc: stable@vger.kernel.org Signed-off-by:
-
Quinn Tran authored
System crash when using debug kernel due to link list corruption. The cause of the link list corruption is due to session deletion was allowed to queue up twice. Here's the internal trace that show the same port was allowed to double queue for deletion on different cpu. 20808683956 015 qla2xxx [0000:13:00.1]-e801:4: Scheduling sess ffff93ebf9306800 for deletion 50:06:0e:80:12:48:ff:50 fc4_type 1 20808683957 027 qla2xxx [0000:13:00.1]-e801:4: Scheduling sess ffff93ebf9306800 for deletion 50:06:0e:80:12:48:ff:50 fc4_type 1 Move the clearing/setting of deleted flag lock. Cc: stable@vger.kernel.org Fixes: 726b8548 ("qla2xxx: Add framework for async fabric discovery") Signed-off-by:
-
Martin K. Petersen authored
Justin Tee <justintee8345@gmail.com> says: Update lpfc to revision 14.2.0.14 This patch set contains logging improvements, kref handling fixes, discovery bug fixes, and refactoring of repeated code. The patches were cut against Martin's 6.6/scsi-queue tree. Link: https://lore.kernel.org/r/20230712180522.112722-1-justintee8345@gmail.comSigned-off-by:
-
Justin Tee authored
Update copyrights to 2023 for files modified in the 14.2.0.14 patch set. Signed-off-by:
Justin Tee <justin.tee@broadcom.com> Link: https://lore.kernel.org/r/20230712180522.112722-13-justintee8345@gmail.comSigned-off-by:
-
Justin Tee authored
Update lpfc version to 14.2.0.14 Signed-off-by:
-
Justin Tee authored
Currently, we have dated logic to work around the differences between SLI-4 and SLI-3 resource reporting through sysfs. Leave the SLI-3 path untouched, but for SLI4 path, retrieve resource values from the phba->sli4_hba->max_cfg_param structure. Max values are populated during ACQE events right after READ_CONFIG mbox cmd is sent. Instead of the dated subtraction logic, used resource calculation is directly fed into sysfs for display. Signed-off-by:
-
Justin Tee authored
During initialization, a lot of the same logic is used on MSI-X vector CPU affinity assignment. Create a lpfc_next_present_cpu() helper routine, and apply its usage for refactoring purposes. Signed-off-by:
-
Justin Tee authored
A mailbox timeout error usually indicates something has gone wrong, and a follow up reset of the HBA is a typical recovery mechanism. Introduce a MBX_TMO_ERR flag to detect such cases and have lpfc_els_flush_cmd abort ELS commands if the MBX_TMO_ERR flag condition was set. This ensures all of the registered SGL resources meant for ELS traffic are not leaked after an HBA reset. Signed-off-by:
-
Justin Tee authored
This patch provides better target rport recovery when a target rport is running in initiator mode to discover the fabric. Such a target will issue a LOGO before switching back to strict target mode and changes are made to recover the login. Log messages are also updated accordingly. Signed-off-by:
-
Justin Tee authored
Previously, Establish Image Pair was set in all PRLI_ACC responses regardless if the received PRLI was from an initiator or target function. Specific target vendors that can operate in both initiator and target mode, may view the PRLI_ACC with Establish Image Pair set as an invalid service parameter when operating in initiator only mode. This causes discovery issues later when the target switches on its target mode function. Revise logic that determines an rport's role as an initiator or target and set the Establish Image Pair service parameter bit only if the Target Function bit is set. Signed-off-by:
-
Justin Tee authored
The ndlp kref count implementation in lpfc_dev_loss_tmo_callbk() removes the initial node reference when a vport is unloading. When lpfc_cleanup() sends a DEVICE_RM event and is in NPR state, the driver calls lpfc_drop_node(). Subsequently, lpfc_drop_node() also removes an ndlp kref thinking it is the initial reference. This unintentionally introduces an extra kref decrement on the ndlp object. Fix by using the NLP_DROPPED node flag in lpfc_dev_loss_tmo_callbk() and lpfc_drop_node() to coordinate the removal of the initial node reference. In lpfc_dev_loss_tmo_callbk(), remove the SCSI transport reference provided the node is registered in the dev_loss context because the driver cannot call the SCSI transport in dev_loss context or afterwards. And, have lpfc_drop_node() not remove a reference if another thread is acting or has already acted on it. Signed-off-by:
-
Justin Tee authored
Conditionalize when to put an ndlp into recovery mode when processing RSCNs. As long as an ndlp state is beyond a PLOGI issue and has been mapped to a transport layer before, the ndlp qualifies to be put into recovery mode. Otherwise, treat the ndlp rport normally through the discovery engine. Signed-off-by:
-
Justin Tee authored
In lpfc_cmpl_els_flogi(), the return out: label decrements the ndlp kref signaling that FLOGI processing on the ndlp is complete. In loop topology path, there is an unnecessary ndlp put because it also branches to the out: label. This also signals ndlp usage completion too soon. As such, remove the extra lpfc_nlp_put() when in loop topology. Signed-off-by:
-
Justin Tee authored
The driver is reaching into a nvme_fc_cmd_iu ptr that belongs to the transport during an abort. This could cause an unintentional ptr dereference into memory that the driver does not own. Since the nvme_fc_cmd_iu ptr was for logging purposes only, simplify the log message such that the nvme_fc_cmd_iu reference is no longer needed. Signed-off-by:
-
Justin Tee authored
The firmware diagnostic dump log message does not need to be a part of the driver's log trace buffer because it is an expected user triggered event. Change LOG_TRACE_EVENT verbose flag to LOG_SLI. Signed-off-by:
-
Rob Herring authored
The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it as merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other. They also include platform_device.h and of.h. As a result, there's a pretty much random mix of those include files used throughout the tree. In order to detangle these headers and replace the implicit includes with struct declarations, users need to explicitly include the correct includes. Signed-off-by:
Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/r/20230714175052.4066150-1-robh@kernel.orgSigned-off-by:
-
Rob Herring authored
The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it as merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other. They also include platform_device.h and of.h. As a result, there's a pretty much random mix of those include files used throughout the tree. In order to detangle these headers and replace the implicit includes with struct declarations, users need to explicitly include the correct includes. Signed-off-by:
-
Rob Herring authored
The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it as merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other. They also include platform_device.h and of.h. As a result, there's a pretty much random mix of those include files used throughout the tree. In order to detangle these headers and replace the implicit includes with struct declarations, users need to explicitly include the correct includes. Signed-off-by:
Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by:
-
Yang Li authored
Use colons to separate parameter names from their specific meanings to silence the following warnings: drivers/ufs/core/ufs-mcq.c:499: warning: Function parameter or member 'hba' not described in 'ufshcd_mcq_sq_cleanup' drivers/ufs/core/ufs-mcq.c:499: warning: Function parameter or member 'task_tag' not described in 'ufshcd_mcq_sq_cleanup' drivers/ufs/core/ufs-mcq.c:560: warning: Function parameter or member 'utrd' not described in 'ufshcd_mcq_nullify_sqe' drivers/ufs/core/ufs-mcq.c:583: warning: Function parameter or member 'hba' not described in 'ufshcd_mcq_sqe_search' drivers/ufs/core/ufs-mcq.c:583: warning: Function parameter or member 'hwq' not described in 'ufshcd_mcq_sqe_search' drivers/ufs/core/ufs-mcq.c:583: warning: Function parameter or member 'task_tag' not described in 'ufshcd_mcq_sqe_search' drivers/ufs/core/ufs-mcq.c:630: warning: Function parameter or member 'cmd' not described in 'ufshcd_mcq_abort' Reported-by:
Abaci Robot <abaci@linux.alibaba.com> Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5850Signed-off-by:
Yang Li <yang.lee@linux.alibaba.com> Link: https://lore.kernel.org/r/20230712075836.15375-1-yang.lee@linux.alibaba.comReviewed-by:
Randy Dunlap <rdunlap@infradead.org> Reviewed-by:
-
Yang Li authored
There is no need to call the dev_err() function directly to print a custom message when handling an error from either the platform_get_irq() or platform_get_irq_byname() functions as both are going to display an appropriate error message in case of a failure. ./drivers/ufs/host/ufs-mediatek.c:864:3-10: line 864 is redundant because platform_get_irq() already prints an error Reported-by:
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by:
-
Ziqi Chen authored
Lock the MSI descriptor storage of a device when configuring ESI. Otherwise we would see warnings during boot. Signed-off-by:
Ziqi Chen <quic_ziqichen@quicinc.com> Link: https://lore.kernel.org/r/1689065327-45039-1-git-send-email-quic_ziqichen@quicinc.comSigned-off-by:
-
Ziqi Chen authored
platform_msi_domain_alloc_irqs() does not always get consecutive IRQ numbers, hence queue IDs calculated out from IRQ numbers may be incorrect if we assume IRQ numbers are consecutive. Fix this by passing msi_desc to ESI handler to use msi_desc->msi_index as queue ID. Co-developed-by:
Can Guo <quic_cang@quicinc.com> Signed-off-by:
-
Yihang Li authored
Currently spinlock hisi_hba->lock is used by both interrupts and threads which requires the use of spin_lock_irqsave()/spin_unlock_irqrestore(). However, some places still use spin_lock()/spin_unlock(). Reviewing the code revealed that it is unnecessary to use hisi_hba->lock in the function hisi_sas_port_notify_formed() which is the only place that uses the spinlock in interrupt context. So delete unused lock in hisi_sas_port_notify_formed(). Signed-off-by:
Yihang Li <liyihang9@huawei.com> Signed-off-by:
Xiang Chen <chenxiang66@hisilicon.com> Link: https://lore.kernel.org/r/1689045300-44318-4-git-send-email-chenxiang66@hisilicon.comSigned-off-by:
-
Yihang Li authored
When FIO and debugfs snapshot occur concurrently, some SATA I/Os are failed to return to the upper layer due to the setting of HISI_SAS_REJECT_CMD_BIT. Then the SCSI layer invokes the error processing thread. However, sas_ata_hard_reset() in EH also fails to be reset due to the setting of HISI_SAS_REJECT_CMD_BIT. As a result, the device is disabled. Calling scsi_block_requests() in the front of a debugfs snapshot and wait command complete before setting HISI_SAS_REJECT_CMD_BIT to avoid SATA I/O failures. Signed-off-by:
-
