Commit Graph

23372 Commits

Author SHA1 Message Date
Colin Ian King
638eec06c7 scsi: lpfc: Fix spelling mistake "unsolicted" -> "unsolicited"
There are spelling mistakes in a log message and two comments. Fix them.

Link: https://lore.kernel.org/r/20220928222116.68294-1-colin.i.king@gmail.com
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-10-01 05:56:24 -04:00
Manish Rangankar
0b863257c1 scsi: qla2xxx: Use transport-defined speed mask for supported_speeds
One of the sysfs values reported for supported_speeds was not valid (20Gb/s
reported instead of 64Gb/s).  Instead of driver internal speed mask
definition, use speed mask defined in transport_fc for reporting
host->supported_speeds.

Link: https://lore.kernel.org/r/20220927115946.17559-1-njavali@marvell.com
Cc: stable@vger.kernel.org
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Manish Rangankar <mrangankar@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-10-01 05:54:07 -04:00
Rafael Mendonca
3ddeabd153 scsi: qla2xxx: Fix serialization of DCBX TLV data request
Commit b6faaaf796 ("scsi: qla2xxx: Serialize mailbox request") serialized
mailbox requests from userspace using the 'optrom' mutex. However, in the
case of DCBX TLV data, if the memory for it is already allocated, then the
mailbox request ends up not being serialized because it is done without
holding the 'optrom' mutex.

Link: https://lore.kernel.org/r/20220926230245.790508-1-rafaelmendsr@gmail.com
Fixes: b6faaaf796 ("scsi: qla2xxx: Serialize mailbox request")
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Rafael Mendonca <rafaelmendsr@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-10-01 05:48:23 -04:00
Guixin Liu
27b571cc45 scsi: megaraid_sas: Move megasas_dbg_lvl init to megasas_init()
The megasas_dbg_lvl is a driver level parameter. Do not initialize it in
the probe path. Otherwise we will miss the debug print when binding a
new device to the megaraid driver.

Link: https://lore.kernel.org/r/1663145283-4872-6-git-send-email-kanie@linux.alibaba.com
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-10-01 05:21:31 -04:00
Guixin Liu
ad40d51992 scsi: megaraid_sas: Remove unnecessary memset()
Remove memset() of pd_list and ld_ids in megasas_get_device_list().

These lists will be cleared by megasas_host_device_list_query(),
megasas_get_pd_list(), and megasas_ld_list_query().

Link: https://lore.kernel.org/r/1663145283-4872-5-git-send-email-kanie@linux.alibaba.com
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-10-01 05:21:31 -04:00
Guixin Liu
17883cd59f scsi: megaraid_sas: Simplify megasas_update_device_list
Remove unnecessary dcmd_ret check and goto statement.

Link: https://lore.kernel.org/r/1663145283-4872-4-git-send-email-kanie@linux.alibaba.com
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-10-01 05:21:31 -04:00
Guixin Liu
9b201b5dff scsi: megaraid_sas: Correct an error message
Correct the error message logged when allocation of ioc_init_request fails.

Link: https://lore.kernel.org/r/1663145283-4872-3-git-send-email-kanie@linux.alibaba.com
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-10-01 05:21:30 -04:00
Guixin Liu
9b78d8fade scsi: megaraid_sas: Correct value passed to scsi_device_lookup()
The "id" parameter currently passed to scsi_device_lookup() when removing a
device is incorrect. It should be "ld_target_id %
MEGASAS_MAX_DEV_PER_CHANNEL".

Link: https://lore.kernel.org/r/1663145283-4872-2-git-send-email-kanie@linux.alibaba.com
Fixes: ae6874ba4b ("scsi: megaraid_sas: Early detection of VD deletion through RaidMap update")
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-10-01 05:21:30 -04:00
Mike Christie
57569c37f0 scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
Fix a NULL pointer crash that occurs when we are freeing the socket at the
same time we access it via sysfs.

The problem is that:

 1. iscsi_sw_tcp_conn_get_param() and iscsi_sw_tcp_host_get_param() take
    the frwd_lock and do sock_hold() then drop the frwd_lock. sock_hold()
    does a get on the "struct sock".

 2. iscsi_sw_tcp_release_conn() does sockfd_put() which does the last put
    on the "struct socket" and that does __sock_release() which sets the
    sock->ops to NULL.

 3. iscsi_sw_tcp_conn_get_param() and iscsi_sw_tcp_host_get_param() then
    call kernel_getpeername() which accesses the NULL sock->ops.

Above we do a get on the "struct sock", but we needed a get on the "struct
socket". Originally, we just held the frwd_lock the entire time but in
commit bcf3a2953d ("scsi: iscsi: iscsi_tcp: Avoid holding spinlock while
calling getpeername()") we switched to refcount based because the network
layer changed and started taking a mutex in that path, so we could no
longer hold the frwd_lock.

Instead of trying to maintain multiple refcounts, this just has us use a
mutex for accessing the socket in the interface code paths.

Link: https://lore.kernel.org/r/20220907221700.10302-1-michael.christie@oracle.com
Fixes: bcf3a2953d ("scsi: iscsi: iscsi_tcp: Avoid holding spinlock while calling getpeername()")
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 14:27:47 -04:00
Jules Irenge
c863a2dcb9 scsi: mpi3mr: Remove unnecessary cast
coccinelle reports a warning:

  WARNING: casting value returned by memory allocation function to (struct
  mpi3mr_throttle_group_info *) is useless

To fix this, the unnecessary cast is removed.

Link: https://lore.kernel.org/r/Yx+kp8NxHvDHs7dv@playground
Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 14:22:56 -04:00
Linus Torvalds
6022f21046 scsi: stex: Properly zero out the passthrough command structure
The passthrough structure is declared off of the stack, so it needs to be
set to zero before copied back to userspace to prevent any unintentional
data leakage.  Switch things to be statically allocated which will fill the
unused fields with 0 automatically.

Link: https://lore.kernel.org/r/YxrjN3OOw2HHl9tx@kroah.com
Cc: stable@kernel.org
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: hdthky <hdthky0@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 14:15:03 -04:00
Sreekanth Reddy
f616efbee9 scsi: mpi3mr: Update driver version to 8.2.0.3.0
Update driver version to 8.2.0.3.0.

Link: https://lore.kernel.org/r/20220912135742.11764-10-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:49:52 -04:00
Sreekanth Reddy
2e31be8697 scsi: mpi3mr: Fix scheduling while atomic type bug
Fix 'scheduling while atomic' type bug, which is observed when
pci_irq_vector() is called from interrupt context.

Link: https://lore.kernel.org/r/20220912135742.11764-9-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:49:52 -04:00
Sreekanth Reddy
f84e8b5bb5 scsi: mpi3mr: Scan the devices during resume time
Scan the target devices during system resume time and add or remove the
target device with the SML if the corresponding target device is newly
added or removed respectively.

Link: https://lore.kernel.org/r/20220912135742.11764-8-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:49:52 -04:00
Sreekanth Reddy
130fc180a4 scsi: mpi3mr: Free enclosure objects during driver unload
Free the enclosure device objects during driver unload and before
rescanning the target devices during controller reset.

Link: https://lore.kernel.org/r/20220912135742.11764-7-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:49:52 -04:00
Sreekanth Reddy
bad2f28da6 scsi: mpi3mr: Handle 0xF003 Fault Code
Handle the 0xF003 controller fault code as a special case by marking the
controller as unrecoverable with logging a message indicating the driver
marks the controller as unrecoverable due to the specific fault.

Link: https://lore.kernel.org/r/20220912135742.11764-6-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:49:52 -04:00
Sreekanth Reddy
f2a79d2030 scsi: mpi3mr: Graceful handling of surprise removal of PCIe HBA
Implement graceful handling of surprise or orderly removal of PCIe HBA:

 - Detect a hot removal of the controller at certain critical places in the
   driver. Early detection will help to reduce the time taken for cleaning
   up the hot-removed controller at the driver level.

 - Poll the status of the port enable issued after reset once every 5
   seconds to avoid a long delay in detecting unavailable controller.

Link: https://lore.kernel.org/r/20220912135742.11764-5-sreekanth.reddy@broadcom.com
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:49:52 -04:00
Sreekanth Reddy
7f9f953d53 scsi: mpi3mr: Schedule IRQ kthreads only on non-RT kernels
In RT kernels, the IRQ handler's code is executed as a kernel
thread. Modify the driver to avoid explicitly scheduling the IRQ kernel
thread.

Link: https://lore.kernel.org/r/20220912135742.11764-4-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:49:51 -04:00
Sreekanth Reddy
47cd930ee6 scsi: mpi3mr: Support new power management framework
Switch to the new generic PCI power management framework. Also, remove
unnecessary calls to the PCI helper functions (such as
pci_set_power_state(), pci_enable_wake(), pci_save_state(),
pci_restore_state() etc).

Link: https://lore.kernel.org/r/20220912135742.11764-3-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:49:51 -04:00
Sreekanth Reddy
ee6f2d6bb2 scsi: mpi3mr: Update mpi3 header files
Update the mpi3 header files.

Link: https://lore.kernel.org/r/20220912135742.11764-2-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:49:51 -04:00
Damien Le Moal
d82e68483b scsi: mpt3sas: Revert "scsi: mpt3sas: Fix ioc->base_readl() use"
This reverts commit 7ab4d2441b as it is
breaking the mpt3sas driver on big-endian machines.

Link: https://lore.kernel.org/r/20220916130111.168195-3-damien.lemoal@opensource.wdc.com
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:34:54 -04:00
Damien Le Moal
f920642e40 scsi: mpt3sas: Revert "scsi: mpt3sas: Fix writel() use"
This reverts commit b4efbec4c2 as it is
breaking the mpt3sas driver on big-endian machines.

Link: https://lore.kernel.org/r/20220916130111.168195-2-damien.lemoal@opensource.wdc.com
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:34:54 -04:00
Lukas Bulwahn
d4a0a0f2c8 scsi: wd33c93: Remove dead code related to the long-gone config WD33C93_PIO
The historical commit 5e018f7e60c9 ("Remove PC9800 support") from 2004 in
linux's history.git removed the config WD33C93_PIO to tweak the scsi
wd33c93 driver for the PC9800.

Some dead code in drivers/scsi/wd33c93.[ch] under an ifdef WD33C93_PIO
continued to remain in the repository until now.

Remove this dead code.

This issue was discovered with ./scripts/checkkconfigsymbols.py.

Link: https://lore.kernel.org/r/20220920112921.25275-1-lukas.bulwahn@gmail.com
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:29:53 -04:00
Wu Bo
48517eefb2 scsi: core: Add I/O timeout count for SCSI device
Currently struct scsi_device maintains counters for requests, completions,
and errors but is missing a counter for timeouts.

For better tracking of timeouts, add a suitable counter.

Link: https://lore.kernel.org/r/1663666339-17560-1-git-send-email-wubo40@huawei.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Wu Bo <wubo40@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:25:34 -04:00
Saurav Kashyap
592642e6b1 scsi: qedf: Populate sysfs attributes for vport
Few vport parameters were displayed by systool as 'Unknown' or 'NULL'.
Copy speed, supported_speed, frame_size and update port_type for NPIV port.

Link: https://lore.kernel.org/r/20220919134434.3513-1-njavali@marvell.com
Cc: stable@vger.kernel.org
Tested-by: Guangwu Zhang <guazhang@redhat.com>
Reviewed-by: John Meneghini <jmeneghi@redhat.com>
Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:16:55 -04:00
Gustavo A. R. Silva
fd2f045202 scsi: pm8001: Replace one-element array with flexible-array member
One-element arrays are deprecated, and we are replacing them with flexible
array members instead. So, replace one-element array with flexible-array
member in struct fw_control_info.

This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines
on memcpy() and help us make progress towards globally enabling
-fstrict-flex-arrays=3 [1].

Link: https://github.com/KSPP/linux/issues/79
Link: https://github.com/KSPP/linux/issues/207
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101836 [1]
Link: https://lore.kernel.org/r/Yyy31OuBza1FJCXP@work
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:09:36 -04:00
Gustavo A. R. Silva
0fb9125e2a scsi: 3w-xxxx: Replace one-element array with flexible-array member
One-element arrays are deprecated, and we are replacing them with flexible
array members instead. So, replace one-element array with flexible-array
member in struct TAG_TW_New_Ioctl and refactor the rest of the code,
accordingly.

Notice that, in multiple places, the subtraction of 1 from
sizeof(TW_New_Ioctl) is removed, as this operation is now implicit
after the flex-array transformation.

Link: https://github.com/KSPP/linux/issues/79
Link: https://github.com/KSPP/linux/issues/206
Link: https://lore.kernel.org/r/YyyyvB30jnjRaw/F@work
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:06:00 -04:00
Gustavo A. R. Silva
d20796627f scsi: hptiop: Replace one-element array with flexible-array member in struct hpt_iop_request_ioctl_command()
One-element arrays are deprecated, and we are replacing them with flexible
array members instead. So, replace one-element array with flexible-array
member in struct hpt_iop_request_ioctl_command.

Link: https://github.com/KSPP/linux/issues/79
Link: https://github.com/KSPP/linux/issues/205
Link: https://lore.kernel.org/r/YyyUvuId7dAZadej@work
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:04:17 -04:00
Gustavo A. R. Silva
5b12a568cc scsi: hptiop: Use struct_size() helper in code related to struct hpt_iop_request_scsi_command
Prefer struct_size() over open-coded versions of idiom:

sizeof(struct-with-flex-array) + sizeof(typeof-flex-array-elements) * count

where count is the max number of items the flexible array is supposed to
contain.

Link: https://github.com/KSPP/linux/issues/160
Link: https://lore.kernel.org/r/54e2bb1e39b21394c5a90cacbadfb6136b012788.1663865333.git.gustavoars@kernel.org
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:02:23 -04:00
Gustavo A. R. Silva
c682df7199 scsi: hptiop: Replace one-element array with flexible-array member
One-element arrays are deprecated, and we are replacing them with flexible
array members instead. So, replace one-element array with flexible-array
member in struct hpt_iop_request_scsi_command and refactor the rest of the
code, accordingly.

The following pieces of code suggest that the one element of array sg_list
in struct hpt_iop_request_scsi_command is not taken into account when
calculating the total size for both struct hpt_iop_request_scsi_command and
the maximum number of elements sg_list will contain:

1047         req->header.size = cpu_to_le32(
1048                                 sizeof(struct hpt_iop_request_scsi_command)
1049                                  - sizeof(struct hpt_iopsg)
1050                                  + sg_count * sizeof(struct hpt_iopsg));

1400         req_size = sizeof(struct hpt_iop_request_scsi_command)                            1401                 + sizeof(struct hpt_iopsg) * (hba->max_sg_descriptors - 1);

So it's safe to replace the one-element array with a flexible-array member
and update the code above, accordingly: now we don't need to subtract
sizeof(struct hpt_iopsg) from sizeof(struct hpt_iop_request_scsi_command)
because this is implicitly done by the flex-array transformation.

Link: https://github.com/KSPP/linux/issues/79
Link: https://github.com/KSPP/linux/issues/205
Link: https://lore.kernel.org/r/6238ccf37798e36d783f5ce5e483e6837e98be79.1663865333.git.gustavoars@kernel.org
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 13:02:23 -04:00
John Garry
d8c22c4697 scsi: pm8001: Fix running_req for internal abort commands
Disabling the remote phy for a SATA disk causes a hang:

root@(none)$ more /sys/class/sas_phy/phy-0:0:8/target_port_protocols
sata
root@(none)$ echo 0 > sys/class/sas_phy/phy-0:0:8/enable
root@(none)$ [   67.855950] sas: ex 500e004aaaaaaa1f phy08 change count has changed
[   67.920585] sd 0:0:2:0: [sdc] Synchronizing SCSI cache
[   67.925780] sd 0:0:2:0: [sdc] Synchronize Cache(10) failed: Result: hostbyte=0x04 driverbyte=DRIVER_OK
[   67.935094] sd 0:0:2:0: [sdc] Stopping disk
[   67.939305] sd 0:0:2:0: [sdc] Start/Stop Unit failed: Result: hostbyte=0x04 driverbyte=DRIVER_OK
...
[  123.998998] INFO: task kworker/u192:1:642 blocked for more than 30 seconds.
[  124.005960]   Not tainted 6.0.0-rc1-205202-gf26f8f761e83 #218
[  124.012049] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  124.019872] task:kworker/u192:1  state:D stack:0 pid:  642 ppid: 2 flags:0x00000008
[  124.028223] Workqueue: 0000:04:00.0_event_q sas_port_event_worker
[  124.034319] Call trace:
[  124.036758]  __switch_to+0x128/0x278
[  124.040333]  __schedule+0x434/0xa58
[  124.043820]  schedule+0x94/0x138
[  124.047045]  schedule_timeout+0x2fc/0x368
[  124.051052]  wait_for_completion+0xdc/0x200
[  124.055234]  __flush_workqueue+0x1a8/0x708
[  124.059328]  sas_porte_broadcast_rcvd+0xa8/0xc0
[  124.063858]  sas_port_event_worker+0x60/0x98
[  124.068126]  process_one_work+0x3f8/0x660
[  124.072134]  worker_thread+0x70/0x700
[  124.075793]  kthread+0x1a4/0x1b8
[  124.079014]  ret_from_fork+0x10/0x20

The issue is that the per-device running_req read in
pm8001_dev_gone_notify() never goes to zero and we never make progress.
This is caused by missing accounting for running_req for when an internal
abort command completes.

In commit 2cbbf48977 ("scsi: pm8001: Use libsas internal abort support")
we started to send internal abort commands as a proper sas_task. In this
when we deliver a sas_task to HW the per-device running_req is incremented
in pm8001_queue_command(). However it is never decremented for internal
abort commnds, so decrement in pm8001_mpi_task_abort_resp().

Link: https://lore.kernel.org/r/1663854664-76165-1-git-send-email-john.garry@huawei.com
Fixes: 2cbbf48977 ("scsi: pm8001: Use libsas internal abort support")
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 12:58:37 -04:00
Duoming Zhou
46ba53c306 scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
When executing SMP task failed, the smp_execute_task_sg() calls del_timer()
to delete "slow_task->timer". However, if the timer handler
sas_task_internal_timedout() is running, the del_timer() in
smp_execute_task_sg() will not stop it and a UAF will happen. The process
is shown below:

      (thread 1)               |        (thread 2)
smp_execute_task_sg()          | sas_task_internal_timedout()
 ...                           |
 del_timer()                   |
 ...                           |  ...
 sas_free_task(task)           |
  kfree(task->slow_task) //FREE|
                               |  task->slow_task->... //USE

Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure
the timer handler have finished before the "task->slow_task" is
deallocated.

Link: https://lore.kernel.org/r/20220920144213.10536-1-duoming@zju.edu.cn
Fixes: 2908d778ab ("[SCSI] aic94xx: new driver")
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 12:56:07 -04:00
Kees Cook
d88a0240ff scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage
In order to help the compiler reason about the destination buffer in struct
fc_nl_event, add a flexible array member for this purpose.  However, since
the header is UAPI, it must not change size or layout, so a union is used.

The allocation size calculations are also corrected (it was potentially
allocating an extra 8 bytes), and the padding is zeroed to avoid leaking
kernel heap memory contents.

Detected at run-time by the recently added memcpy() bounds checking:

  memcpy: detected field-spanning write (size 8) of single field "&event->event_data" at drivers/scsi/scsi_transport_fc.c:581 (size 4)

Link: https://lore.kernel.org/linux-next/42404B5E-198B-4FD3-94D6-5E16CF579EF3@linux.ibm.com/
Link: https://lore.kernel.org/r/20220921205155.1451649-1-keescook@chromium.org
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Reported-by: Sachin Sant <sachinp@linux.ibm.com>
Tested-by: Sachin Sant <sachinp@linux.ibm.com>
Reviewed-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 12:52:48 -04:00
Lukas Bulwahn
3d217b9ac5 scsi: core: Make SCSI_MOD depend on BLOCK for cleaner .config files
SCSI_MOD is a helper config symbol for configuring RAID_ATTRS properly,
i.e., RAID_ATTRS needs to be m when SCSI=m.

This helper config symbol SCSI_MOD still shows up even in kernel
configurations that do not select the block subsystem and where SCSI is not
even a configuration option mentioned and selectable.

Make this SCSI_MOD depend on BLOCK, so that it only shows up when it is
slightly relevant in the kernel configuration.

Link: https://lore.kernel.org/r/20220919060112.24802-1-lukas.bulwahn@gmail.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 12:46:59 -04:00
Martin Wilck
7f615c1b59 scsi: scsi_transport_fc: Use %u for dev_loss_tmo
dev_loss_tmo is an unsigned value. Using "%d" as output format causes
irritating negative values to be shown in sysfs.

Link: https://lore.kernel.org/r/20220902131519.16513-1-mwilck@suse.com
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Martin Wilck <mwilck@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:37:01 -04:00
Xuezhi Zhang
9acb9f0efb scsi: csiostor: Convert sysfs snprintf() to sysfs_emit()
Follow the advice of the Documentation/filesystems/sysfs.rst and show()
should only use sysfs_emit() or sysfs_emit_at() when formatting the value
to be returned to user space.

Link: https://lore.kernel.org/r/20220901015130.419307-1-zhangxuezhi3@gmail.com
Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Xuezhi Zhang <zhangxuezhi1@coolpad.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:35:21 -04:00
Xuezhi Zhang
68a97feb4b scsi: megaraid: Convert sysfs snprintf() to sysfs_emit()
Fix up sysfs show entries to use sysfs_emit()

Link: https://lore.kernel.org/r/20220831140325.396295-1-zhangxuezhi3@gmail.com
Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Xuezhi Zhang <zhangxuezhi1@coolpad.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:34:34 -04:00
wangjianli
59f4e39d35 scsi: ibmvscsi_tgt: Fix repeated words in comment
Delete the redundant word 'to'.

Link: https://lore.kernel.org/r/20220908130910.35680-1-wangjianli@cdjrlc.com
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: wangjianli <wangjianli@cdjrlc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:30:26 -04:00
James Smart
7170cb1a85 scsi: lpfc: Update lpfc version to 14.2.0.7
Update lpfc version to 14.2.0.7

Link: https://lore.kernel.org/r/20220911221505.117655-14-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:18:28 -04:00
James Smart
a4de8356b6 scsi: lpfc: Fix various issues reported by tools
This patch fixes below Smatch reported issues:

 1. lpfc_hbadisc.c:3020 lpfc_mbx_cmpl_fcf_rr_read_fcf_rec()
    error: uninitialized symbol 'vlan_id'.

 2. lpfc_hbadisc.c:3121 lpfc_mbx_cmpl_read_fcf_rec()
    error: uninitialized symbol 'vlan_id'.

 3. lpfc_init.c:335 lpfc_dump_wakeup_param_cmpl()
    warn: always true condition '(prg->dist < 4) => (0-3 < 4)'

 4. lpfc_init.c:2419 lpfc_parse_vpd()
    warn: inconsistent indenting.

 5. lpfc_init.c:13248 lpfc_sli4_enable_msi()
    warn: 'phba->pcidev->irq' 2147483648 can't fit into 65535
    'eqhdl->irq'

 6. lpfc_debugfs.c:5300 lpfc_idiag_extacc_avail_get()
    error: uninitialized symbol 'ext_cnt'

 7. lpfc_debugfs.c:5300 lpfc_idiag_extacc_avail_get()
    error: uninitialized symbol 'ext_size'

 8. lpfc_vmid.c:248 lpfc_vmid_get_appid()
    warn: sleeping in atomic context.

 9. lpfc_init.c:8342 lpfc_sli4_driver_resource_setup()
    warn: missing error code 'rc'.

10. lpfc_init.c:13573 lpfc_sli4_hba_unset()
    warn: variable dereferenced before check 'phba->pport' (see
    line 13546)

11. lpfc_auth.c:1923 lpfc_auth_handle_dhchap_reply()
    error: double free of 'hash_value'

Fixes:

 1. Initialize vlan_id to LPFC_FCOE_NULL_VID.

 2. Initialize vlan_id to LPFC_FCOE_NULL_VID.

 3. prg->dist is a 2 bit field. Its value can only be between 0-3.
    Remove redundent check 'if (prg->dist < 4)'.

 4. Fix inconsistent indenting.  Moved logic into helper function
    lpfc_fill_vpd().

 5. Define 'eqhdl->irq' as int value as pci_irq_vector() returns int.
    Also, check for return value of pci_irq_vector() and log message in
    case of failure.

 6. Initialize 'ext_cnt' to 0.

 7. Initialize 'ext_size' to 0.

 8. Use alloc_percpu_gfp() with GFP_ATOMIC flag.

 9. 'rc' was not updated when dma_pool_create() fails.  Update 'rc =
     -ENOMEM' when dma_pool_create() fails before calling goto statement.

10. Add check for 'phba->pport' in lpfc_cpuhp_remove().

11. Initialize 'hash_value' to NULL, same like 'aug_chal' variable.

Link: https://lore.kernel.org/r/20220911221505.117655-13-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:18:28 -04:00
James Smart
dbb1e2ff87 scsi: lpfc: Add reporting capability for Link Degrade Signaling
Firmware reports link degrade signaling via ACQES.

Handlers and new additions to the SET_FEATURES mbox command are implemented
so that link degrade parameters for 64GB capable links are reported through
EDC ELS frames.

Link: https://lore.kernel.org/r/20220911221505.117655-12-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:18:27 -04:00
James Smart
045c58c875 scsi: lpfc: Rework FDMI attribute registration for unintential padding
Removed the lpfc_fdmi_attr_entry and lpfc_fdmi_attr_def structures that had
a union causing unintentional zero padding, which required the usage of
__packed.  They are replaced with explicit lpfc_fdmi_attr_u32,
lpfc_fdmi_attr_wwn, lpfc_fdmi_attr_fc4types, and lpfc_fdmi_attr_string
structure defines instead of living in a union.  This rids of ambiguous
compiler zero padding, and entailed cleaning up bitwise endian
declarations.

As such, all FDMI attribute registration routines are replaced with generic
void *arg and handlers for each of the newly defined attribute structure
types.

Link: https://lore.kernel.org/r/20220911221505.117655-11-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:18:27 -04:00
James Smart
2649809cd1 scsi: lpfc: Rework lpfc_fdmi_cmd() routine for cleanup and consistency
Switch case logics are reworked so they appear more similar and
consistent. This eliminates compiler errors indicating unaligned pointer
values and packed members.

Added comments to explain previous size offset accumulations.

Link: https://lore.kernel.org/r/20220911221505.117655-10-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:18:27 -04:00
James Smart
d8cdd33a66 scsi: lpfc: Rename mp/bmp dma buffers to rq/rsp in lpfc_fdmi_cmd
Clarify naming of the mp/bmp dma buffers:

 - Rename mp to rq as it is the request buffer

 - Rename bmp to rsp as it is the response buffer

This reduces confusion about what the buffer content is based on their
name.

Link: https://lore.kernel.org/r/20220911221505.117655-9-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:18:27 -04:00
James Smart
21828e3c91 scsi: lpfc: Update congestion mode logging for Emulex SAN Manager application
If there is a congestion or automated congestion response mode change, then
log the reported change to kmsg.

Link: https://lore.kernel.org/r/20220911221505.117655-8-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:18:27 -04:00
James Smart
6e5c5d246e scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba
On a PCI hotplug capable system, it is possible for scsi_device_put() to
happen after lpfc_pci_remove_one() is called.  As a result, the
sdev->host->hostt->module dereference is for a previously freed memory
location because the phba structure containing the hostt template was
already freed when lpfc_pci_remove_one() returned.

Since the lpfc module is still loaded during power slot disable, all
scsi_host_templates should be declared as part of the global data segment
instead of inside the heap allocated phba structure.  This way the
sdev->host->hostt memory area is always valid as long as the module is
loaded regardless if PCI hotplug dynamically allocates or frees phba
structures.

Move all scsi_host_templates in the phba structure to global variables.
Create a small helper routine to determine appropriate sg_tablesize during
shost allocation.

Link: https://lore.kernel.org/r/20220911221505.117655-7-jsmart2021@gmail.com
Co-developed-by: Dwip N. Banerjee <dnbanerg@us.ibm.com>
Signed-off-by: Dwip N. Banerjee <dnbanerg@us.ibm.com>
Co-developed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:18:27 -04:00
James Smart
845363516b scsi: lpfc: Fix multiple NVMe remoteport registration calls for the same NPort ID
When a target makes the mistake of registering a FC4 type with the fabric,
but then rejects a PRLI of that type, the lpfc driver incorrectly retries
the PRLI causing multiple registrations with the transport. The driver
needs to detect the reject reason data and stop any retry.

Rework the PRLI reject scenarios.

Link: https://lore.kernel.org/r/20220911221505.117655-6-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:18:27 -04:00
James Smart
0630a1f7ea scsi: lpfc: Add missing free iocb and nlp kref put for early return VMID cases
Sometimes VMID targets are not getting rediscovered after a port reset.

The iocb is not freed in lpfc_cmpl_ct_cmd_vmid(), which is the completion
function for the appid CT commands.  So after a port reset, the count of
sges is less than the expected count of 250.  This causes post reset
operation logic to fail and keep the port offline.

Fix by freeing the iocb and kref put for the lpfc_cmpl_ct_cmd_vmid() early
return cases.

Link: https://lore.kernel.org/r/20220911221505.117655-5-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:18:27 -04:00
James Smart
b873d10372 scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload
In a situation where the node state changes while a REG_LOGIN is in
progress, the LPFC_MBOXQ_t structure is cleared and reused for an
UNREG_LOGIN command to release RPI resources without first freeing the mbuf
pool resource allocated for REG_LOGIN.

Release mbuf pool resource prior to repurposing of the mailbox command
structure from REG_LOGIN to UNREG_LOGIN.

Link: https://lore.kernel.org/r/20220911221505.117655-4-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:18:26 -04:00
James Smart
11d6583d81 scsi: lpfc: Fix FLOGI ACC with wrong SID in PT2PT topology
When a FLOGI is received before we have issued our FLOGI, the ACC response
to the received FLOGI is issued with SID 2 instead of the expected fabric
controller SID.  Certain target vendors ignore the malformed ACC with SID 2
and wait for a properly filled ACC with a fabric controller SID.

The lpfc_sli_prep_wqe() routine depends on the FC_PT2PT flag to fill in the
fabric controller SID when in PT2PT mode, but due to a previous commit the
flag was getting cleared.  Fix by adding a check for the defer_flogi_acc
flag to know whether or not to clear the FC_PT2PT flag on link up.

Link: https://lore.kernel.org/r/20220911221505.117655-3-jsmart2021@gmail.com
Fixes: 439b93293f ("scsi: lpfc: Fix unsolicited FLOGI receive handling during PT2PT discovery")
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-15 22:18:26 -04:00