Commit Graph

284 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
f5ea8b2710 Merge 5.15.80 into android14-5.15
Changes in 5.15.80
	mm: hwpoison: refactor refcount check handling
	mm: hwpoison: handle non-anonymous THP correctly
	mm: shmem: don't truncate page if memory failure happens
	ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe"
	ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe"
	ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe"
	ASoC: mt6660: Keep the pm_runtime enables before component stuff in mt6660_i2c_probe
	ASoC: rt1019: Fix the TDM settings
	ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK
	spi: intel: Fix the offset to get the 64K erase opcode
	ASoC: codecs: jz4725b: add missed Line In power control bit
	ASoC: codecs: jz4725b: fix reported volume for Master ctl
	ASoC: codecs: jz4725b: use right control for Capture Volume
	ASoC: codecs: jz4725b: fix capture selector naming
	ASoC: Intel: sof_sdw: add quirk variant for LAPBC710 NUC15
	selftests/futex: fix build for clang
	selftests/intel_pstate: fix build for ARCH=x86_64
	ASoC: rt1308-sdw: add the default value of some registers
	drm/amd/display: Remove wrong pipe control lock
	ACPI: scan: Add LATT2021 to acpi_ignore_dep_ids[]
	RDMA/efa: Add EFA 0xefa2 PCI ID
	btrfs: raid56: properly handle the error when unable to find the missing stripe
	NFSv4: Retry LOCK on OLD_STATEID during delegation return
	ACPI: x86: Add another system to quirk list for forcing StorageD3Enable
	firmware: arm_scmi: Cleanup the core driver removal callback
	i2c: tegra: Allocate DMA memory for DMA engine
	i2c: i801: add lis3lv02d's I2C address for Vostro 5568
	drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid
	btrfs: remove pointless and double ulist frees in error paths of qgroup tests
	Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
	x86/cpu: Add several Intel server CPU model numbers
	ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> "Route"
	mtd: spi-nor: intel-spi: Disable write protection only if asked
	spi: intel: Use correct mask for flash and protected regions
	KVM: x86/pmu: Do not speculatively query Intel GP PMCs that don't exist yet
	hugetlbfs: don't delete error page from pagecache
	arm64: dts: qcom: sa8155p-adp: Specify which LDO modes are allowed
	arm64: dts: qcom: sm8150-xperia-kumano: Specify which LDO modes are allowed
	arm64: dts: qcom: sm8250-xperia-edo: Specify which LDO modes are allowed
	arm64: dts: qcom: sm8350-hdk: Specify which LDO modes are allowed
	spi: stm32: Print summary 'callbacks suppressed' message
	ARM: dts: at91: sama7g5: fix signal name of pin PB2
	ASoC: core: Fix use-after-free in snd_soc_exit()
	ASoC: tas2770: Fix set_tdm_slot in case of single slot
	ASoC: tas2764: Fix set_tdm_slot in case of single slot
	ARM: at91: pm: avoid soft resetting AC DLL
	serial: 8250: omap: Fix missing PM runtime calls for omap8250_set_mctrl()
	serial: 8250_omap: remove wait loop from Errata i202 workaround
	serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove()
	serial: 8250: omap: Flush PM QOS work on remove
	serial: imx: Add missing .thaw_noirq hook
	tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send
	bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
	ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
	pinctrl: rockchip: list all pins in a possible mux route for PX30
	scsi: scsi_transport_sas: Fix error handling in sas_phy_add()
	block: sed-opal: kmalloc the cmd/resp buffers
	bpf: Fix memory leaks in __check_func_call
	arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro
	siox: fix possible memory leak in siox_device_add()
	parport_pc: Avoid FIFO port location truncation
	pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
	drm/vc4: kms: Fix IS_ERR() vs NULL check for vc4_kms
	drm/panel: simple: set bpc field for logic technologies displays
	drm/drv: Fix potential memory leak in drm_dev_init()
	drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()
	ARM: dts: imx7: Fix NAND controller size-cells
	arm64: dts: imx8mm: Fix NAND controller size-cells
	arm64: dts: imx8mn: Fix NAND controller size-cells
	ata: libata-transport: fix double ata_host_put() in ata_tport_add()
	ata: libata-transport: fix error handling in ata_tport_add()
	ata: libata-transport: fix error handling in ata_tlink_add()
	ata: libata-transport: fix error handling in ata_tdev_add()
	nfp: change eeprom length to max length enumerators
	MIPS: fix duplicate definitions for exported symbols
	MIPS: Loongson64: Add WARN_ON on kexec related kmalloc failed
	bpf: Initialize same number of free nodes for each pcpu_freelist
	net: bgmac: Drop free_netdev() from bgmac_enet_remove()
	mISDN: fix possible memory leak in mISDN_dsp_element_register()
	net: hinic: Fix error handling in hinic_module_init()
	net: stmmac: ensure tx function is not running in stmmac_xdp_release()
	soc: imx8m: Enable OCOTP clock before reading the register
	net: liquidio: release resources when liquidio driver open failed
	mISDN: fix misuse of put_device() in mISDN_register_device()
	net: macvlan: Use built-in RCU list checking
	net: caif: fix double disconnect client in chnl_net_open()
	bnxt_en: Remove debugfs when pci_register_driver failed
	net: mhi: Fix memory leak in mhi_net_dellink()
	net: dsa: make dsa_master_ioctl() see through port_hwtstamp_get() shims
	xen/pcpu: fix possible memory leak in register_pcpu()
	net: ionic: Fix error handling in ionic_init_module()
	net: ena: Fix error handling in ena_init()
	net: hns3: fix setting incorrect phy link ksettings for firmware in resetting process
	bridge: switchdev: Fix memory leaks when changing VLAN protocol
	drbd: use after free in drbd_create_device()
	platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized
	platform/surface: aggregator: Do not check for repeated unsequenced packets
	cifs: add check for returning value of SMB2_close_init
	net: ag71xx: call phylink_disconnect_phy if ag71xx_hw_enable() fail in ag71xx_open()
	net/x25: Fix skb leak in x25_lapb_receive_frame()
	cifs: Fix wrong return value checking when GETFLAGS
	net: microchip: sparx5: Fix potential null-ptr-deref in sparx_stats_init() and sparx5_start()
	net: thunderbolt: Fix error handling in tbnet_init()
	cifs: add check for returning value of SMB2_set_info_init
	ftrace: Fix the possible incorrect kernel message
	ftrace: Optimize the allocation for mcount entries
	ftrace: Fix null pointer dereference in ftrace_add_mod()
	ring_buffer: Do not deactivate non-existant pages
	tracing: Fix memory leak in tracing_read_pipe()
	tracing/ring-buffer: Have polling block on watermark
	tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event()
	tracing: Fix wild-memory-access in register_synth_event()
	tracing: Fix race where eprobes can be called before the event
	tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit()
	tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit()
	drm/amd/display: Add HUBP surface flip interrupt handler
	ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()
	ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro
	ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360
	Revert "usb: dwc3: disable USB core PHY management"
	slimbus: qcom-ngd: Fix build error when CONFIG_SLIM_QCOM_NGD_CTRL=y && CONFIG_QCOM_RPROC_COMMON=m
	slimbus: stream: correct presence rate frequencies
	speakup: fix a segfault caused by switching consoles
	USB: bcma: Make GPIO explicitly optional
	USB: serial: option: add Sierra Wireless EM9191
	USB: serial: option: remove old LARA-R6 PID
	USB: serial: option: add u-blox LARA-R6 00B modem
	USB: serial: option: add u-blox LARA-L6 modem
	USB: serial: option: add Fibocom FM160 0x0111 composition
	usb: add NO_LPM quirk for Realforce 87U Keyboard
	usb: chipidea: fix deadlock in ci_otg_del_timer
	usb: cdns3: host: fix endless superspeed hub port reset
	usb: typec: mux: Enter safe mode only when pins need to be reconfigured
	iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger()
	iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
	iio: adc: mp2629: fix wrong comparison of channel
	iio: adc: mp2629: fix potential array out of bound access
	iio: pressure: ms5611: changed hardcoded SPI speed to value limited
	dm ioctl: fix misbehavior if list_versions races with module loading
	serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs
	serial: 8250: Flush DMA Rx on RLSI
	serial: 8250_lpss: Configure DMA also w/o DMA filter
	Input: iforce - invert valid length check when fetching device IDs
	maccess: Fix writing offset in case of fault in strncpy_from_kernel_nofault()
	net: phy: marvell: add sleep time after enabling the loopback bit
	scsi: zfcp: Fix double free of FSF request when qdio send fails
	iommu/vt-d: Preset Access bit for IOVA in FL non-leaf paging entries
	iommu/vt-d: Set SRE bit only when hardware has SRS cap
	firmware: coreboot: Register bus in module init
	mmc: core: properly select voltage range without power cycle
	mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout
	mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
	docs: update mediator contact information in CoC doc
	misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
	perf/x86/intel/pt: Fix sampling using single range output
	nvme: restrict management ioctls to admin
	nvme: ensure subsystem reset is single threaded
	serial: 8250_lpss: Use 16B DMA burst with Elkhart Lake
	perf: Improve missing SIGTRAP checking
	ring-buffer: Include dropped pages in counting dirty patches
	tracing: Fix warning on variable 'struct trace_array'
	net: use struct_group to copy ip/ipv6 header addresses
	scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()
	scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper()
	kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case
	Input: i8042 - fix leaking of platform device on module removal
	macvlan: enforce a consistent minimal mtu
	tcp: cdg: allow tcp_cdg_release() to be called multiple times
	kcm: avoid potential race in kcm_tx_work
	kcm: close race conditions on sk_receive_queue
	9p: trans_fd/p9_conn_cancel: drop client lock earlier
	gfs2: Check sb_bsize_shift after reading superblock
	gfs2: Switch from strlcpy to strscpy
	9p/trans_fd: always use O_NONBLOCK read/write
	wifi: wext: use flex array destination for memcpy()
	mm: fs: initialize fsdata passed to write_begin/write_end interface
	net/9p: use a dedicated spinlock for trans_fd
	ntfs: fix use-after-free in ntfs_attr_find()
	ntfs: fix out-of-bounds read in ntfs_attr_find()
	ntfs: check overflow when iterating ATTR_RECORDs
	Linux 5.15.80

Change-Id: Idc9aa4c30c528dd194bc813201cbb2c5df8c1d62
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2022-11-28 16:08:50 +00:00
Yuan Can
71beab7119 scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper()
[ Upstream commit e208a1d795a08d1ac0398c79ad9c58106531bcc5 ]

If device_register() fails in sdebug_add_host_helper(), it will goto clean
and sdbg_host will be freed, but sdbg_host->host_list will not be removed
from sdebug_host_list, then list traversal may cause UAF. Fix it.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Yuan Can <yuancan@huawei.com>
Link: https://lore.kernel.org/r/20221117084421.58918-1-yuancan@huawei.com
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-11-26 09:24:50 +01:00
Greg Kroah-Hartman
99387927eb Merge 5.15.51 into android14-5.15
Changes in 5.15.51
	random: schedule mix_interrupt_randomness() less often
	random: quiet urandom warning ratelimit suppression message
	ALSA: hda/via: Fix missing beep setup
	ALSA: hda/conexant: Fix missing beep setup
	ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop
	ALSA: hda/realtek - ALC897 headset MIC no sound
	ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly
	ALSA: hda/realtek: Add quirk for Clevo PD70PNT
	ALSA: hda/realtek: Add quirk for Clevo NS50PU
	net: openvswitch: fix parsing of nw_proto for IPv6 fragments
	9p: Fix refcounting during full path walks for fid lookups
	9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl
	9p: fix fid refcount leak in v9fs_vfs_get_link
	btrfs: fix hang during unmount when block group reclaim task is running
	btrfs: prevent remounting to v1 space cache for subpage mount
	btrfs: add error messages to all unrecognized mount options
	scsi: ibmvfc: Store vhost pointer during subcrq allocation
	scsi: ibmvfc: Allocate/free queue resource only during probe/remove
	mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing
	mmc: mediatek: wait dma stop bit reset to 0
	xen/gntdev: Avoid blocking in unmap_grant_pages()
	MAINTAINERS: Add new IOMMU development mailing list
	mtd: rawnand: gpmi: Fix setting busy timeout setting
	ata: libata: add qc->flags in ata_qc_complete_template tracepoint
	dm era: commit metadata in postsuspend after worker stops
	dm mirror log: clear log bits up to BITS_PER_LONG boundary
	tracing/kprobes: Check whether get_kretprobe() returns NULL in kretprobe_dispatcher()
	drm/i915: Implement w/a 22010492432 for adl-s
	USB: serial: pl2303: add support for more HXN (G) types
	USB: serial: option: add Telit LE910Cx 0x1250 composition
	USB: serial: option: add Quectel EM05-G modem
	USB: serial: option: add Quectel RM500K module support
	drm/msm: Ensure mmap offset is initialized
	drm/msm: Fix double pm_runtime_disable() call
	netfilter: use get_random_u32 instead of prandom
	scsi: scsi_debug: Fix zone transition to full condition
	drm/msm: Switch ordering of runpm put vs devfreq_idle
	scsi: iscsi: Exclude zero from the endpoint ID range
	xsk: Fix generic transmit when completion queue reservation fails
	drm/msm: use for_each_sgtable_sg to iterate over scatterlist
	bpf: Fix request_sock leak in sk lookup helpers
	drm/sun4i: Fix crash during suspend after component bind failure
	bpf, x86: Fix tail call count offset calculation on bpf2bpf call
	scsi: storvsc: Correct reporting of Hyper-V I/O size limits
	phy: aquantia: Fix AN when higher speeds than 1G are not advertised
	KVM: arm64: Prevent kmemleak from accessing pKVM memory
	net: Write lock dev_base_lock without disabling bottom halves.
	net: fix data-race in dev_isalive()
	tipc: fix use-after-free Read in tipc_named_reinit
	igb: fix a use-after-free issue in igb_clean_tx_ring
	bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
	ethtool: Fix get module eeprom fallback
	net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
	drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf
	drm/msm/dp: check core_initialized before disable interrupts at dp_display_unbind()
	drm/msm/dp: Drop now unused hpd_high member
	drm/msm/dp: dp_link_parse_sink_count() return immediately if aux read failed
	drm/msm/dp: do not initialize phy until plugin interrupt received
	drm/msm/dp: force link training for display resolution change
	perf arm-spe: Don't set data source if it's not a memory operation
	erspan: do not assume transport header is always set
	net/tls: fix tls_sk_proto_close executed repeatedly
	udmabuf: add back sanity check
	selftests: netfilter: correct PKTGEN_SCRIPT_PATHS in nft_concat_range.sh
	xen-blkfront: Handle NULL gendisk
	x86/xen: Remove undefined behavior in setup_features()
	MIPS: Remove repetitive increase irq_err_count
	afs: Fix dynamic root getattr
	ice: ethtool: advertise 1000M speeds properly
	regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips
	regmap-irq: Fix offset/index mismatch in read_sub_irq_data()
	igb: Make DMA faster when CPU is active on the PCIe link
	virtio_net: fix xdp_rxq_info bug after suspend/resume
	Revert "net/tls: fix tls_sk_proto_close executed repeatedly"
	sock: redo the psock vs ULP protection check
	nvme-pci: add NO APST quirk for Kioxia device
	nvme: move the Samsung X5 quirk entry to the core quirks
	gpio: winbond: Fix error code in winbond_gpio_get()
	s390/cpumf: Handle events cycles and instructions identical
	iio: mma8452: fix probe fail when device tree compatible is used.
	iio: magnetometer: yas530: Fix memchr_inv() misuse
	iio: adc: vf610: fix conversion mode sysfs node name
	usb: typec: wcove: Drop wrong dependency to INTEL_SOC_PMIC
	xhci: turn off port power in shutdown
	xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI
	xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI
	usb: gadget: Fix non-unique driver names in raw-gadget driver
	USB: gadget: Fix double-free bug in raw_gadget driver
	usb: chipidea: udc: check request status before setting device address
	dt-bindings: usb: ohci: Increase the number of PHYs
	dt-bindings: usb: ehci: Increase the number of PHYs
	btrfs: don't set lock_owner when locking extent buffer for reading
	btrfs: fix deadlock with fsync+fiemap+transaction commit
	f2fs: attach inline_data after setting compression
	iio:humidity:hts221: rearrange iio trigger get and register
	iio:chemical:ccs811: rearrange iio trigger get and register
	iio:accel:kxcjk-1013: rearrange iio trigger get and register
	iio:accel:bma180: rearrange iio trigger get and register
	iio:accel:mxc4005: rearrange iio trigger get and register
	iio: accel: mma8452: ignore the return value of reset operation
	iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up()
	iio: trigger: sysfs: fix use-after-free on remove
	iio: adc: stm32: fix maximum clock rate for stm32mp15x
	iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value)
	iio: afe: rescale: Fix boolean logic bug
	iio: adc: stm32: Fix ADCs iteration in irq handler
	iio: adc: stm32: Fix IRQs on STM32F4 by removing custom spurious IRQs message
	iio: adc: axp288: Override TS pin bias current for some models
	iio: adc: rzg2l_adc: add missing fwnode_handle_put() in rzg2l_adc_parse_properties()
	iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client
	iio: adc: ti-ads131e08: add missing fwnode_handle_put() in ads131e08_alloc_channels()
	xtensa: xtfpga: Fix refcount leak bug in setup
	xtensa: Fix refcount leak bug in time.c
	parisc/stifb: Fix fb_is_primary_device() only available with CONFIG_FB_STI
	parisc: Enable ARCH_HAS_STRICT_MODULE_RWX
	powerpc/microwatt: wire up rng during setup_arch()
	powerpc: Enable execve syscall exit tracepoint
	powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address
	powerpc/powernv: wire up rng during setup_arch
	drm/msm/dp: Always clear mask bits to disable interrupts at dp_ctrl_reset_irq_ctrl()
	ARM: dts: imx7: Move hsic_phy power domain to HSIC PHY node
	ARM: dts: imx6qdl: correct PU regulator ramp delay
	arm64: dts: ti: k3-am64-main: Remove support for HS400 speed mode
	ARM: exynos: Fix refcount leak in exynos_map_pmu
	soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe
	ARM: Fix refcount leak in axxia_boot_secondary
	memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings
	ARM: cns3xxx: Fix refcount leak in cns3xxx_init
	modpost: fix section mismatch check for exported init/exit sections
	ARM: dts: bcm2711-rpi-400: Fix GPIO line names
	random: update comment from copy_to_user() -> copy_to_iter()
	perf build-id: Fix caching files with a wrong build ID
	dma-direct: use the correct size for dma_set_encrypted()
	kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS (2nd attempt)
	powerpc/pseries: wire up rng during setup_arch()
	Linux 5.15.51

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic8819a78d2d84055e7a6d44bdfab6a6cd8296dac
2022-07-13 17:32:01 +02:00
Damien Le Moal
7d5fe94333 scsi: scsi_debug: Fix zone transition to full condition
[ Upstream commit 566d3c57eb526f32951af15866086e236ce1fc8a ]

When a write command to a sequential write required or sequential write
preferred zone result in the zone write pointer reaching the end of the
zone, the zone condition must be set to full AND the number of implicitly
or explicitly open zones updated to have a correct accounting for zone
resources. However, the function zbc_inc_wp() only sets the zone condition
to full without updating the open zone counters, resulting in a zone state
machine breakage.

Introduce the helper function zbc_set_zone_full() and use it in
zbc_inc_wp() to correctly transition zones to the full condition.

Link: https://lore.kernel.org/r/20220608011302.92061-1-damien.lemoal@opensource.wdc.com
Fixes: f0d1cf9378 ("scsi: scsi_debug: Add ZBC zone commands")
Reviewed-by: Niklas Cassel <niklas.cassel@wdc.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-06-29 09:03:21 +02:00
Jaegeuk Kim
6a1eb03a82 Merge remote-tracking branch 'aosp/upstream-f2fs-stable-linux-5.15.y' into android14-5.15
* aosp/upstream-f2fs-stable-linux-5.15.y:
  f2fs: attach inline_data after setting compression
  f2fs: fix to tag gcing flag on page during file defragment
  f2fs: replace F2FS_I(inode) and sbi by the local variable
  f2fs: add f2fs_init_write_merge_io function
  f2fs: avoid unneeded error handling for revoke_entry_slab allocation
  f2fs: allow compression for mmap files in compress_mode=user
  f2fs: fix typo in comment
  f2fs: make f2fs_read_inline_data() more readable
  f2fs: fix to do sanity check for inline inode
  f2fs: fix fallocate to use file_modified to update permissions consistently
  f2fs: don't use casefolded comparison for "." and ".."
  f2fs: do not stop GC when requiring a free section
  f2fs: keep wait_ms if EAGAIN happens
  f2fs: introduce f2fs_gc_control to consolidate f2fs_gc parameters
  f2fs: reject test_dummy_encryption when !CONFIG_FS_ENCRYPTION
  f2fs: kill volatile write support
  f2fs: change the current atomic write way
  f2fs: don't need inode lock for system hidden quota
  f2fs: stop allocating pinned sections if EAGAIN happens
  f2fs: skip GC if possible when checkpoint disabling
  f2fs: give priority to select unpinned section for foreground GC
  f2fs: fix to do sanity check on total_data_blocks
  f2fs: fix deadloop in foreground GC
  f2fs: fix to do sanity check on block address in f2fs_do_zero_range()
  f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()
  f2fs: write checkpoint during FG_GC
  f2fs: fix to clear dirty inode in f2fs_evict_inode()
  f2fs: ensure only power of 2 zone sizes are allowed
  f2fs: call bdev_zone_sectors() only once on init_blkz_info()
  f2fs: extend stat_lock to avoid potential race in statfs
  f2fs: avoid infinite loop to flush node pages
  f2fs: use flush command instead of FUA for zoned device
  f2fs: remove WARN_ON in f2fs_is_valid_blkaddr
  f2fs: replace usage of found with dedicated list iterator variable
  f2fs: Remove usage of list iterator pas the loop for list_move_tail()
  f2fs: fix dereference of stale list iterator after loop body
  f2fs: fix to do sanity check on inline_dots inode
  f2fs: introduce data read/write showing path info
  f2fs: remove unnecessary f2fs_lock_op in f2fs_new_inode
  f2fs: don't set GC_FAILURE_PIN for background GC
  f2fs: check pinfile in gc_data_segment() in advance
  f2fs: should not truncate blocks during roll-forward recovery
  f2fs: fix wrong condition check when failing metapage read
  f2fs: keep io_flags to avoid IO split due to different op_flags in two fio holders
  f2fs: remove obsolete whint_mode
  f2fs: pass the bio operation to bio_alloc_bioset
  f2fs: don't pass a bio to f2fs_target_device
  f2fs: replace congestion_wait() calls with io_schedule_timeout()
  FROMGIT: scsi: scsi_debug: Add gap zone support
  FROMGIT: scsi: scsi_debug: Rename zone type constants
  FROMGIT: scsi: scsi_debug: Fix a typo
  FROMGIT: scsi: sd: sd_zbc: Hide gap zones
  FROMGIT: scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics()
  FROMGIT: scsi: sd: sd_zbc: Introduce struct zoned_disk_info
  FROMGIT: scsi: sd: sd_zbc: Use logical blocks as unit when querying zones
  FROMGIT: scsi: sd: sd_zbc: Verify that the zone size is a power of two
  FROMGIT: scsi: sd: sd_zbc: Improve source code documentation

Bug: 228919347
Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
Change-Id: If51d1a03be757e74034b297c4f54df23b501da71
2022-06-07 16:31:14 -07:00
Damien Le Moal
423088083d FROMGIT: scsi: scsi_debug: Add gap zone support
Add the 'zone_cap_mb' kernel module parameter. This parameter defines the
zone capacity. The zone capacity must be less than or equal to the zone
size.

Report that sequential write zones and gap zones are paired in the Zoned
Block Device Characteristics VPD page (page B6h).

This patch has been tested as follows:

modprobe scsi_debug delay=0 sector_size=512 dev_size_mb=128 zbc=host-managed zone_nr_conv=16 zone_size_mb=4 zone_cap_mb=3
modprobe brd rd_nr=1 rd_size=$((1<<20))
mkfs.f2fs -m /dev/ram0 -c /dev/${scsi_debug_dev}
mount /dev/ram0 /mnt
 # Run a fio job that uses /mnt

Link: https://lore.kernel.org/r/20220421183023.3462291-10-bvanassche@acm.org
Cc: Douglas Gilbert <dgilbert@interlog.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
[ bvanassche: Switched to reporting a constant zone starting LBA granularity ]
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 230616396
(cherry picked from commit 4a5fc1c6d75261f2f014a961d39ab10aae66a0f9 mkp-scsi/staging)
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Change-Id: Ie8010a82a0070123cd56fcd0bf70ffa81d397d66
2022-04-28 15:51:57 -07:00
Damien Le Moal
c8622f49e4 FROMGIT: scsi: scsi_debug: Rename zone type constants
Rename the scsi_debug zone type constants to prevent a conflict with the
ZBC_ZONE_TYPE_GAP constant from include/scsi/scsi_proto.h.

Link: https://lore.kernel.org/r/20220421183023.3462291-9-bvanassche@acm.org
Cc: Douglas Gilbert <dgilbert@interlog.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
[ bvanassche: Extracted these changes from a larger patch ]
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 230616396
(cherry picked from commit 35dbe2b9a7b0c92777c855c6a2cca8390f4c166b mkp-scsi/staging)
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Change-Id: Ibd71fb99c22839188b66649c948afe1a600f8c03
2022-04-28 15:51:57 -07:00
Bart Van Assche
b27960f108 FROMGIT: scsi: scsi_debug: Fix a typo
Change a single occurrence of "nad" into "and".

Link: https://lore.kernel.org/r/20220421183023.3462291-8-bvanassche@acm.org
Cc: Douglas Gilbert <dgilbert@interlog.com>
Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 230616396
(cherry picked from commit 897284e8a04894537b58a079a2729a70731c229d mkp-scsi/staging)
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Change-Id: I6181e5a9a3a1d20e6d71c99aef6c1a2e9d3ac053
2022-04-28 15:51:57 -07:00
George Kennedy
dfc3fff637 scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
commit e0a2c28da11e2c2b963fc01d50acbf03045ac732 upstream.

In resp_mode_select() sanity check the block descriptor len to avoid UAF.

BUG: KASAN: use-after-free in resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509
Read of size 1 at addr ffff888026670f50 by task scsicmd/15032

CPU: 1 PID: 15032 Comm: scsicmd Not tainted 5.15.0-01d0625 #15
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Call Trace:
 <TASK>
 dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:107
 print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:257
 kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:443
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306
 resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509
 schedule_resp+0x4af/0x1a10 drivers/scsi/scsi_debug.c:5483
 scsi_debug_queuecommand+0x8c9/0x1e70 drivers/scsi/scsi_debug.c:7537
 scsi_queue_rq+0x16b4/0x2d10 drivers/scsi/scsi_lib.c:1521
 blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1640
 __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325
 blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358
 __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1762
 __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1839
 blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891
 blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474
 blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:63
 sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:837
 sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:775
 sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:941
 sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1166
 __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:52
 do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:50
 entry_SYSCALL_64_after_hwframe+0x44/0xae arch/x86/entry/entry_64.S:113

Link: https://lore.kernel.org/r/1637262208-28850-1-git-send-email-george.kennedy@oracle.com
Reported-by: syzkaller <syzkaller@googlegroups.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-22 09:32:51 +01:00
George Kennedy
3085147645 scsi: scsi_debug: Fix type in min_t to avoid stack OOB
commit 36e07d7ede88a1f1ef8f0f209af5b7612324ac2c upstream.

Change min_t() to use type "u32" instead of type "int" to avoid stack out
of bounds. With min_t() type "int" the values get sign extended and the
larger value gets used causing stack out of bounds.

BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:191 [inline]
BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x1de/0x240 lib/scatterlist.c:976
Read of size 127 at addr ffff888072607128 by task syz-executor.7/18707

CPU: 1 PID: 18707 Comm: syz-executor.7 Not tainted 5.15.0-syzk #1
Hardware name: Red Hat KVM, BIOS 1.13.0-2
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106
 print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:256
 __kasan_report mm/kasan/report.c:442 [inline]
 kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:459
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189
 memcpy+0x23/0x60 mm/kasan/shadow.c:65
 memcpy include/linux/fortify-string.h:191 [inline]
 sg_copy_buffer+0x1de/0x240 lib/scatterlist.c:976
 sg_copy_from_buffer+0x33/0x40 lib/scatterlist.c:1000
 fill_from_dev_buffer.part.34+0x82/0x130 drivers/scsi/scsi_debug.c:1162
 fill_from_dev_buffer drivers/scsi/scsi_debug.c:1888 [inline]
 resp_readcap16+0x365/0x3b0 drivers/scsi/scsi_debug.c:1887
 schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478
 scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533
 scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline]
 scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699
 blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639
 __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325
 blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358
 __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761
 __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1838
 blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891
 blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474
 blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62
 sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:836
 sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:774
 sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:939
 sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl fs/ioctl.c:860 [inline]
 __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Link: https://lore.kernel.org/r/1636484247-21254-1-git-send-email-george.kennedy@oracle.com
Reported-by: syzkaller <syzkaller@googlegroups.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-22 09:32:50 +01:00
George Kennedy
47d11d3520 scsi: scsi_debug: Don't call kcalloc() if size arg is zero
commit 3344b58b53a76199dae48faa396e9fc37bf86992 upstream.

If the size arg to kcalloc() is zero, it returns ZERO_SIZE_PTR.  Because of
that, for a following NULL pointer check to work on the returned pointer,
kcalloc() must not be called with the size arg equal to zero. Return early
without error before the kcalloc() call if size arg is zero.

BUG: KASAN: null-ptr-deref in memcpy include/linux/fortify-string.h:191 [inline]
BUG: KASAN: null-ptr-deref in sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974
Write of size 4 at addr 0000000000000010 by task syz-executor.1/22789

CPU: 1 PID: 22789 Comm: syz-executor.1 Not tainted 5.15.0-syzk #1
Hardware name: Red Hat KVM, BIOS 1.13.0-2
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106
 __kasan_report mm/kasan/report.c:446 [inline]
 kasan_report.cold.14+0x112/0x117 mm/kasan/report.c:459
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189
 memcpy+0x3b/0x60 mm/kasan/shadow.c:66
 memcpy include/linux/fortify-string.h:191 [inline]
 sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974
 do_dout_fetch drivers/scsi/scsi_debug.c:2954 [inline]
 do_dout_fetch drivers/scsi/scsi_debug.c:2946 [inline]
 resp_verify+0x49e/0x930 drivers/scsi/scsi_debug.c:4276
 schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478
 scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533
 scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline]
 scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699
 blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639
 __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325
 blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358
 __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761
 __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1838
 blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891
 blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474
 blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62
 blk_execute_rq+0xdb/0x360 block/blk-exec.c:102
 sg_scsi_ioctl drivers/scsi/scsi_ioctl.c:621 [inline]
 scsi_ioctl+0x8bb/0x15c0 drivers/scsi/scsi_ioctl.c:930
 sg_ioctl_common+0x172d/0x2710 drivers/scsi/sg.c:1112
 sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl fs/ioctl.c:860 [inline]
 __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Link: https://lore.kernel.org/r/1636056397-13151-1-git-send-email-george.kennedy@oracle.com
Reported-by: syzkaller <syzkaller@googlegroups.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-22 09:32:50 +01:00
Shin'ichiro Kawasaki
ebacb44cb2 scsi: scsi_debug: Fix buffer size of REPORT ZONES command
commit 7db0e0c8190a086ef92ce5bb960836cde49540aa upstream.

According to ZBC and SPC specifications, the unit of ALLOCATION LENGTH
field of REPORT ZONES command is byte. However, current scsi_debug
implementation handles it as number of zones to calculate buffer size to
report zones. When the ALLOCATION LENGTH has a large number, this results
in too large buffer size and causes memory allocation failure.  Fix the
failure by handling ALLOCATION LENGTH as byte unit.

Link: https://lore.kernel.org/r/20211207010638.124280-1-shinichiro.kawasaki@wdc.com
Fixes: f0d1cf9378 ("scsi: scsi_debug: Add ZBC zone commands")
Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-14 10:57:16 +01:00
Shin'ichiro Kawasaki
8b3b9aaada scsi: scsi_debug: Zero clear zones at reset write pointer
[ Upstream commit 2d62253eb1b60f4ce8b39125eee282739b519297 ]

When a reset is requested the position of the write pointer is updated but
the data in the corresponding zone is not cleared. Instead scsi_debug
returns any data written before the write pointer was reset. This is an
error and prevents using scsi_debug for stale page cache testing of the
BLKRESETZONE ioctl.

Zero written data in the zone when resetting the write pointer.

Link: https://lore.kernel.org/r/20211122061223.298890-1-shinichiro.kawasaki@wdc.com
Fixes: f0d1cf9378 ("scsi: scsi_debug: Add ZBC zone commands")
Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-01 09:04:50 +01:00
Ye Bin
66523553fa scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
[ Upstream commit f347c26836c270199de1599c3cd466bb7747caa9 ]

The following issue was observed running syzkaller:

BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline]
BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831
Read of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815

CPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xe4/0x14a lib/dump_stack.c:118
 print_address_description+0x73/0x280 mm/kasan/report.c:253
 kasan_report_error mm/kasan/report.c:352 [inline]
 kasan_report+0x272/0x370 mm/kasan/report.c:410
 memcpy+0x1f/0x50 mm/kasan/kasan.c:302
 memcpy include/linux/string.h:377 [inline]
 sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831
 fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021
 resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772
 schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429
 scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835
 scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896
 scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034
 __blk_run_queue_uncond block/blk-core.c:464 [inline]
 __blk_run_queue+0x1a4/0x380 block/blk-core.c:484
 blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78
 sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847
 sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716
 sg_write+0x64/0xa0 drivers/scsi/sg.c:622
 __vfs_write+0xed/0x690 fs/read_write.c:485
kill_bdev:block_device:00000000e138492c
 vfs_write+0x184/0x4c0 fs/read_write.c:549
 ksys_write+0x107/0x240 fs/read_write.c:599
 do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

We get 'alen' from command its type is int. If userspace passes a large
length we will get a negative 'alen'.

Switch n, alen, and rlen to u32.

Link: https://lore.kernel.org/r/20211013033913.2551004-3-yebin10@huawei.com
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Ye Bin <yebin10@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-25 09:48:29 +01:00
Ye Bin
5b8bed6464 scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
[ Upstream commit 4e3ace0051e7e504b55d239daab8789dd89b863c ]

The following warning was observed running syzkaller:

[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in;
[ 3813.830724]    program syz-executor not setting count and/or reply_len properly
[ 3813.836956] ==================================================================
[ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0
[ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549
[ 3813.846612] Call Trace:
[ 3813.846995]  dump_stack+0x108/0x15f
[ 3813.847524]  print_address_description+0xa5/0x372
[ 3813.848243]  kasan_report.cold+0x236/0x2a8
[ 3813.849439]  check_memory_region+0x240/0x270
[ 3813.850094]  memcpy+0x30/0x80
[ 3813.850553]  sg_copy_buffer+0x157/0x1e0
[ 3813.853032]  sg_copy_from_buffer+0x13/0x20
[ 3813.853660]  fill_from_dev_buffer+0x135/0x370
[ 3813.854329]  resp_readcap16+0x1ac/0x280
[ 3813.856917]  schedule_resp+0x41f/0x1630
[ 3813.858203]  scsi_debug_queuecommand+0xb32/0x17e0
[ 3813.862699]  scsi_dispatch_cmd+0x330/0x950
[ 3813.863329]  scsi_request_fn+0xd8e/0x1710
[ 3813.863946]  __blk_run_queue+0x10b/0x230
[ 3813.864544]  blk_execute_rq_nowait+0x1d8/0x400
[ 3813.865220]  sg_common_write.isra.0+0xe61/0x2420
[ 3813.871637]  sg_write+0x6c8/0xef0
[ 3813.878853]  __vfs_write+0xe4/0x800
[ 3813.883487]  vfs_write+0x17b/0x530
[ 3813.884008]  ksys_write+0x103/0x270
[ 3813.886268]  __x64_sys_write+0x77/0xc0
[ 3813.886841]  do_syscall_64+0x106/0x360
[ 3813.887415]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

This issue can be reproduced with the following syzkaller log:

r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00')
open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000)
r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782)
write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d"], 0x126)

In resp_readcap16() we get "int alloc_len" value -1104926854, and then pass
the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This
leads to OOB in sg_copy_buffer().

To solve this issue, define alloc_len as u32.

Link: https://lore.kernel.org/r/20211013033913.2551004-2-yebin10@huawei.com
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Ye Bin <yebin10@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-25 09:48:29 +01:00
Linus Torvalds
a9c9a6f741 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI updates from James Bottomley:
 "This series consists of the usual driver updates (ufs, qla2xxx,
  target, smartpqi, lpfc, mpt3sas).

  The core change causing the most churn was replacing the command
  request field request with a macro, allowing us to offset map to it
  and remove the redundant field; the same was also done for the tag
  field.

  The most impactful change is the final removal of scsi_ioctl, which
  has been deprecated for over a decade"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (293 commits)
  scsi: ufs: Fix ufshcd_request_sense_async() for Samsung KLUFG8RHDA-B2D1
  scsi: ufs: ufs-exynos: Fix static checker warning
  scsi: mpt3sas: Use the proper SCSI midlayer interfaces for PI
  scsi: lpfc: Use the proper SCSI midlayer interfaces for PI
  scsi: lpfc: Copyright updates for 14.0.0.1 patches
  scsi: lpfc: Update lpfc version to 14.0.0.1
  scsi: lpfc: Add bsg support for retrieving adapter cmf data
  scsi: lpfc: Add cmf_info sysfs entry
  scsi: lpfc: Add debugfs support for cm framework buffers
  scsi: lpfc: Add support for maintaining the cm statistics buffer
  scsi: lpfc: Add rx monitoring statistics
  scsi: lpfc: Add support for the CM framework
  scsi: lpfc: Add cmfsync WQE support
  scsi: lpfc: Add support for cm enablement buffer
  scsi: lpfc: Add cm statistics buffer support
  scsi: lpfc: Add EDC ELS support
  scsi: lpfc: Expand FPIN and RDF receive logging
  scsi: lpfc: Add MIB feature enablement support
  scsi: lpfc: Add SET_HOST_DATA mbox cmd to pass date/time info to firmware
  scsi: fc: Add EDC ELS definition
  ...
2021-09-02 15:09:46 -07:00
Bart Van Assche
a6e76e6f2c scsi: scsi_debug: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
Prepare for removal of the request pointer by using scsi_cmd_to_rq()
instead. This patch does not change any functionality.

Link: https://lore.kernel.org/r/20210809230355.8186-42-bvanassche@acm.org
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-08-11 22:25:41 -04:00
Uwe Kleine-König
fc7a6209d5 bus: Make remove callback return void
The driver core ignores the return value of this callback because there
is only little it can do when a device disappears.

This is the final bit of a long lasting cleanup quest where several
buses were converted to also return void from their remove callback.
Additionally some resource leaks were fixed that were caused by drivers
returning an error code in the expectation that the driver won't go
away.

With struct bus_type::remove returning void it's prevented that newly
implemented buses return an ignored error code and so don't anticipate
wrong expectations for driver authors.

Reviewed-by: Tom Rix <trix@redhat.com> (For fpga)
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Reviewed-by: Cornelia Huck <cohuck@redhat.com> (For drivers/s390 and drivers/vfio)
Acked-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> (For ARM, Amba and related parts)
Acked-by: Mark Brown <broonie@kernel.org>
Acked-by: Chen-Yu Tsai <wens@csie.org> (for sunxi-rsb)
Acked-by: Pali Rohár <pali@kernel.org>
Acked-by: Mauro Carvalho Chehab <mchehab@kernel.org> (for media)
Acked-by: Hans de Goede <hdegoede@redhat.com> (For drivers/platform)
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-By: Vinod Koul <vkoul@kernel.org>
Acked-by: Juergen Gross <jgross@suse.com> (For xen)
Acked-by: Lee Jones <lee.jones@linaro.org> (For mfd)
Acked-by: Johannes Thumshirn <jth@kernel.org> (For mcb)
Acked-by: Johan Hovold <johan@kernel.org>
Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> (For slimbus)
Acked-by: Kirti Wankhede <kwankhede@nvidia.com> (For vfio)
Acked-by: Maximilian Luz <luzmaximilian@gmail.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> (For ulpi and typec)
Acked-by: Samuel Iglesias Gonsálvez <siglesias@igalia.com> (For ipack)
Acked-by: Geoff Levand <geoff@infradead.org> (For ps3)
Acked-by: Yehezkel Bernat <YehezkelShB@gmail.com> (For thunderbolt)
Acked-by: Alexander Shishkin <alexander.shishkin@linux.intel.com> (For intel_th)
Acked-by: Dominik Brodowski <linux@dominikbrodowski.net> (For pcmcia)
Acked-by: Rafael J. Wysocki <rafael@kernel.org> (For ACPI)
Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org> (rpmsg and apr)
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> (For intel-ish-hid)
Acked-by: Dan Williams <dan.j.williams@intel.com> (For CXL, DAX, and NVDIMM)
Acked-by: William Breathitt Gray <vilhelm.gray@gmail.com> (For isa)
Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de> (For firewire)
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> (For hid)
Acked-by: Thorsten Scherer <t.scherer@eckelmann.de> (For siox)
Acked-by: Sven Van Asbroeck <TheSven73@gmail.com> (For anybuss)
Acked-by: Ulf Hansson <ulf.hansson@linaro.org> (For MMC)
Acked-by: Wolfram Sang <wsa@kernel.org> # for I2C
Acked-by: Sudeep Holla <sudeep.holla@arm.com>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Acked-by: Finn Thain <fthain@linux-m68k.org>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20210713193522.1770306-6-u.kleine-koenig@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-07-21 11:53:42 +02:00
Martin K. Petersen
f7be677227 scsi: scsi_debug: Improve RDPROTECT/WRPROTECT handling
It is useful for testing purposes to be able to inject errors by writing
bad protection information to media with checking disabled and then
attempting to read it back. Extend scsi_debug's PI verification logic to
give the driver feature parity with commercially available drives. Almost
all devices with PI capability support RDPROTECT and WRPROTECT values of 0,
1, and 3.

Link: https://lore.kernel.org/r/20210609033929.3815-10-martin.petersen@oracle.com
Reviewed-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Message-Id: <20210609033929.3815-10-martin.petersen@oracle.com>
2021-07-20 22:10:42 -04:00
Martin K. Petersen
c78be80d20 scsi: scsi_debug: Remove dump_sector()
The function used to dump sectors containing protection information errors
was useful during initial development over a decade ago.  However,
dump_sector() substantially slows down the system during testing due to
writing an entire sector's worth of data to syslog on every error.

We now log plenty of information about the nature of detected protection
information errors throughout the stack. Dumping the entire contents of an
offending sector is no longer needed.

Link: https://lore.kernel.org/r/20210609033929.3815-9-martin.petersen@oracle.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Message-Id: <20210609033929.3815-9-martin.petersen@oracle.com>
2021-07-20 22:10:42 -04:00
Hannes Reinecke
464a00c9e0 scsi: core: Kill DRIVER_SENSE
Replace the check for DRIVER_SENSE with a check for
scsi_status_is_check_condition().

Audit all callsites to ensure the SAM status is set correctly. For
backwards compability move the DRIVER_SENSE definition to sg.h, and update
sg, bsg, and scsi_ioctl to set the DRIVER_SENSE driver_status whenever
SAM_STAT_CHECK_CONDITION is present.

[mkp: fix zeroday srp warning]

Link: https://lore.kernel.org/r/20210427083046.31620-10-hare@suse.de
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

fix
2021-05-31 22:48:21 -04:00
Hannes Reinecke
f2b1e9c6f8 scsi: core: Introduce scsi_build_sense()
Introduce scsi_build_sense() as a wrapper around scsi_build_sense_buffer()
to format the buffer and set the correct SCSI status.

Link: https://lore.kernel.org/r/20210427083046.31620-8-hare@suse.de
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-05-31 22:48:21 -04:00
Uwe Kleine-König
8fb82abccc scsi: scsi_debug: Drop if with an always false condition
to_sdebug_host() is a container_of operation, so it never returns NULL.

Link: https://lore.kernel.org/r/20210506203206.254258-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-05-14 22:34:31 -04:00
Douglas Gilbert
fc09acb7de scsi: scsi_debug: Fix cmd_per_lun, set to max_queue
Make sure that the cmd_per_lun value placed in the host template never
exceeds the can_queue value. If the max_queue driver parameter is not
specified then both cmd_per_lun and can_queue are set to CAN_QUEUE.
CAN_QUEUE is a compile time constant and is used to dimension an array to
hold queued requests. If the max_queue driver parameter is given it is must
be less than or equal to CAN_QUEUE and if so, the host template values are
adjusted.

Remove undocumented code that allowed queue_depth to exceed CAN_QUEUE and
cause stack full type errors. There is a documented way to do that with
every_nth and

    echo 0x8000 > /sys/bus/pseudo/drivers/scsi_debug/opts

See: https://sg.danny.cz/sg/scsi_debug.html

Tweak some formatting, and add a suggestion to the "trim poll_queues"
warning.

Link: https://lore.kernel.org/r/20210415015031.607153-1-dgilbert@interlog.com
Reported-by: Kashyap Desai <kashyap.desai@broadcom.com>
Reviewed-by: John Garry <john.garry@hauwei.com>
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-05-02 22:41:44 -04:00
Douglas Gilbert
771f712ba5 scsi: scsi_debug: Fix cmd duration calculation
In some cases, sdebug_defer::cmpl_ts (completion timestamp) wasn't being
properly set when REQ_HIPRI was given. Fix that and improve code to only
call ktime_get_boottime_ns() for commands with REQ_HIPRI set as cmpl_ts is
only used in that case.

Link: https://lore.kernel.org/r/20210304014107.307625-1-dgilbert@interlog.com
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-03-04 17:37:03 -05:00
Douglas Gilbert
4a0c6f432d scsi: scsi_debug: Add new defer type for mq_poll
Add a new sdeb_defer_type enumeration: SDEB_DEFER_POLL for requests that
have REQ_HIPRI set in cmd_flags field. It is expected that these requests
will be polled via the mq_poll entry point which is driven by calls to
blk_poll() in the block layer. Therefore timer events are not 'wired up' in
the normal fashion.

There are still cases with short delays (e.g. < 10 microseconds) where by
the time the command response processing occurs, the delay is already
exceeded in which case the code calls scsi_done() directly. In such cases
there is no window for mq_poll() to be called.

Add 'mq_polls' counter that increments on each scsi_done() called via the
mq_poll entry point. Can be used to show (with 'cat
/proc/scsi/scsi_debug/<host_id>') that blk_poll() is causing completions
rather than some other mechanism.

Link: https://lore.kernel.org/r/20210215074048.19424-5-kashyap.desai@broadcom.com
Tested-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-03-04 17:37:03 -05:00
Kashyap Desai
c4b57d89ba scsi: scsi_debug: mq_poll support
Add support of the mq_poll interface to scsi_debug.  This feature
requires shared host tag support in kernel and driver.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Tested-by: Douglas Gilbert <dgilbert@interlog.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>

Link: https://lore.kernel.org/r/20210215074048.19424-4-kashyap.desai@broadcom.com
Cc: dgilbert@interlog.com
Cc: linux-block@vger.kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-03-04 17:37:03 -05:00
Linus Torvalds
bdb39c9509 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI updates from James Bottomley:
 "This series consists of the usual driver updates (ufs, ibmvfc,
  qla2xxx, hisi_sas, pm80xx) plus the removal of the gdth driver (which
  is bound to cause conflicts with a trivial change somewhere).

  The only big major rework of note is the one from Hannes trying to
  clean up our result handling code in the drivers to make it
  consistent"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (194 commits)
  scsi: MAINTAINERS: Adjust to reflect gdth scsi driver removal
  scsi: ufs: Give clk scaling min gear a value
  scsi: lpfc: Fix 'physical' typos
  scsi: megaraid_mbox: Fix spelling of 'allocated'
  scsi: qla2xxx: Simplify the calculation of variables
  scsi: message: fusion: Fix 'physical' typos
  scsi: target: core: Change ASCQ for residual write
  scsi: target: core: Signal WRITE residuals
  scsi: target: core: Set residuals for 4Kn devices
  scsi: hisi_sas: Add trace FIFO debugfs support
  scsi: hisi_sas: Flush workqueue in hisi_sas_v3_remove()
  scsi: hisi_sas: Enable debugfs support by default
  scsi: hisi_sas: Don't check .nr_hw_queues in hisi_sas_task_prep()
  scsi: hisi_sas: Remove deferred probe check in hisi_sas_v2_probe()
  scsi: lpfc: Add auto select on IRQ_POLL
  scsi: ncr53c8xx: Fix typos
  scsi: lpfc: Fix ancient double free
  scsi: qla2xxx: Fix some memory corruption
  scsi: qla2xxx: Remove redundant NULL check
  scsi: megaraid: Fix ifnullfree.cocci warnings
  ...
2021-02-22 10:24:58 -08:00
Maurizio Lombardi
f852c596f2 scsi: scsi_debug: Fix a memory leak
The sdebug_q_arr pointer must be freed when the module is unloaded.

$ cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff888e1cfb0000 (size 4096):
  comm "modprobe", pid 165555, jiffies 4325987516 (age 685.194s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000458f4f5d>] 0xffffffffc06702d9
    [<000000003edc4b1f>] do_one_initcall+0xe9/0x57d
    [<00000000da7d518c>] do_init_module+0x1d1/0x6f0
    [<000000009a6a9248>] load_module+0x36bd/0x4f50
    [<00000000ddb0c3ce>] __do_sys_init_module+0x1db/0x260
    [<000000009532db57>] do_syscall_64+0xa5/0x420
    [<000000002916b13d>] entry_SYSCALL_64_after_hwframe+0x6a/0xdf

Fixes: 87c715dcde ("scsi: scsi_debug: Add per_host_store option")
Link: https://lore.kernel.org/r/20210208111734.34034-1-mlombard@redhat.com
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-02-08 21:51:25 -05:00
Hannes Reinecke
7a64c81448 scsi: scsi_debug: Do not set COMMAND_COMPLETE
COMMAND_COMPLETE is defined as '0', so setting it is quite pointless.

Link: https://lore.kernel.org/r/20210113090500.129644-23-hare@suse.de
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-01-22 21:14:10 -05:00
Dinghao Liu
3b01d7ea4d scsi: scsi_debug: Fix memleak in scsi_debug_init()
When sdeb_zbc_model does not match BLK_ZONED_NONE, BLK_ZONED_HA or
BLK_ZONED_HM, we should free sdebug_q_arr to prevent memleak. Also there is
no need to execute sdebug_erase_store() on failure of sdeb_zbc_model_str().

Link: https://lore.kernel.org/r/20201226061503.20050-1-dinghao.liu@zju.edu.cn
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-01-05 23:28:11 -05:00
Linus Torvalds
55e0500eb5 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI updates from James Bottomley:
 "The usual driver updates (ufs, qla2xxx, tcmu, ibmvfc, lpfc, smartpqi,
  hisi_sas, qedi, qedf, mpt3sas) and minor bug fixes.

  There are only three core changes: adding sense codes, cleaning up
  noretry and adding an option for limitless retries"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (226 commits)
  scsi: hisi_sas: Recover PHY state according to the status before reset
  scsi: hisi_sas: Filter out new PHY up events during suspend
  scsi: hisi_sas: Add device link between SCSI devices and hisi_hba
  scsi: hisi_sas: Add check for methods _PS0 and _PR0
  scsi: hisi_sas: Add controller runtime PM support for v3 hw
  scsi: hisi_sas: Switch to new framework to support suspend and resume
  scsi: hisi_sas: Use hisi_hba->cq_nvecs for calling calling synchronize_irq()
  scsi: qedf: Remove redundant assignment to variable 'rc'
  scsi: lpfc: Remove unneeded variable 'status' in lpfc_fcp_cpu_map_store()
  scsi: snic: Convert to use DEFINE_SEQ_ATTRIBUTE macro
  scsi: qla4xxx: Delete unneeded variable 'status' in qla4xxx_process_ddb_changed
  scsi: sun_esp: Use module_platform_driver to simplify the code
  scsi: sun3x_esp: Use module_platform_driver to simplify the code
  scsi: sni_53c710: Use module_platform_driver to simplify the code
  scsi: qlogicpti: Use module_platform_driver to simplify the code
  scsi: mac_esp: Use module_platform_driver to simplify the code
  scsi: jazz_esp: Use module_platform_driver to simplify the code
  scsi: mvumi: Fix error return in mvumi_io_attach()
  scsi: lpfc: Drop nodelist reference on error in lpfc_gen_req()
  scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs()
  ...
2020-10-14 15:15:35 -07:00
John Garry
f7c4cdc712 scsi: scsi_debug: Support host tagset
When host_max_queue is set (> 0), set the Scsi_Host.host_tagset such that
blk-mq will use a hostwide tagset over all SCSI host submission queues.

This means that we may expose all submission queues and always use the hwq
chosen by blk-mq.

And since if sdebug_host_max_queue is set, sdebug_max_queue is fixed to the
same value, we can simplify how sdebug_driver_template.can_queue is set.

Signed-off-by: John Garry <john.garry@huawei.com>
Tested-by: Douglas Gilbert <dgilbert@interlog.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-10-06 08:33:44 -06:00
Martin K. Petersen
02f7415054 Merge branch '5.9/scsi-fixes' into 5.10/scsi-ufs
Resolve UFS discrepancies between fixes and queue.

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-09-15 11:36:40 -04:00
John Pittman
8c65723566 scsi: scsi_debug: Make sdebug_build_parts() respect virtual_gb
If virtual_gb is passed while using num_parts, when creating the
partitions, virtual_gb is not respected.  Set num_sectors using
get_sdebug_capacity() to pull virtual_gb if set.

Link: https://lore.kernel.org/r/20200902211434.9979-3-jpittman@redhat.com
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: John Pittman <jpittman@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-09-02 22:49:54 -04:00
John Pittman
979e0dc345 scsi: scsi_debug: Adjust num_parts to create equally sized partitions
Currently when using the num_parts parameter, partitions are aligned and
the end sector is one prior to the next start.  This creates different
sized partitions. Create instead equally sized partitions by trimming the
end of each partition to the size of the smallest partition.  This aligns
better with what one would expect from automatically created partitions and
can be helpful with testing things such as raid which often expect legs of
the same size.  Minimal space is lost as the initial partition starting
size is calculated by dividing num_sectors by sdebug_num_parts.

Link: https://lore.kernel.org/r/20200902211434.9979-2-jpittman@redhat.com
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: John Pittman <jpittman@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-09-02 22:49:53 -04:00
Douglas Gilbert
ad0c7775e7 scsi: scsi_debug: Implement lun_format
Implement 'flat space LUN addressing', which allows us to raise the max_lun
limitation to 16384. The maximum number of LUNs prior to this patch was
256.

Link: https://lore.kernel.org/r/20200821042249.5097-1-dgilbert@interlog.com
Suggested-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-09-01 21:58:28 -04:00
Niklas Cassel
75d46c6d15 scsi: scsi_debug: Remove superfluous close zone in resp_open_zone()
resp_open_zone() always calls zbc_open_zone() with parameter explicit set
to true.

If zbc_open_zone() is called with parameter explicit set to true, and the
current zone state is implicit open, it will call zbc_close_zone() on the
zone before proceeding.

Therefore, there is no need for resp_open_zone() to call zbc_close_zone()
on an implicitly open zone before calling zbc_open_zone().

Remove superfluous close zone in resp_open_zone().

Link: https://lore.kernel.org/r/20200821130007.39938-1-niklas.cassel@wdc.com
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-08-24 23:02:18 -04:00
Douglas Gilbert
223f91b480 scsi: scsi_debug: Fix scp is NULL errors
John Garry reported 'sdebug_q_cmd_complete: scp is NULL' failures that were
mainly seen on aarch64 machines (e.g. RPi 4 with four A72 CPUs). The
problem was tracked down to a missing critical section on a "short circuit"
path. Namely, the time to process the current command so far has already
exceeded the requested command duration (i.e. the number of nanoseconds in
the ndelay parameter).

The random=1 parameter setting was pivotal in finding this error.  The
failure scenario involved first taking that "short circuit" path (due to a
very short command duration) and then taking the more likely
hrtimer_start() path (due to a longer command duration). With random=1 each
command's duration is taken from the uniformly distributed [0..ndelay)
interval.  The fio utility also helped by reliably generating the error
scenario at about once per minute on a RPi 4 (64 bit OS).

Link: https://lore.kernel.org/r/20200813155738.109298-1-dgilbert@interlog.com
Reported-by: John Garry <john.garry@huawei.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-08-17 22:13:17 -04:00
Douglas Gilbert
fc13638ae9 scsi: scsi_debug: Implement tur_ms_to_ready parameter
The current driver responds to TEST UNIT READY (TUR) with a GOOD status
immediately after a scsi_debug device (LU) is created. This is unrealistic
as even SSDs take some time after power-on before accepting media access
commands.

Add the tur_ms_to_ready parameter whose unit is milliseconds (default 0)
and is the period before which a TUR (or any media access command) will set
the CHECK CONDITION status with a sense key of NOT READY and an additional
sense of "Logical unit is in process of becoming ready".  The period starts
when each scsi_debug device is created.

This patch was prompted by T10 proposal 20-061r2 which was accepted on
2020716. It adds that a TUR in the situation described in the previous
paragraph may set the INFO field (or descriptor) in the sense data to the
estimated number in milliseconds before a subsequent TUR will yield a GOOD
status. This patch follows that advice.

Link: https://lore.kernel.org/r/20200724155531.668144-1-dgilbert@interlog.com
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-07-29 00:03:52 -04:00
Douglas Gilbert
84905d34f1 scsi: scsi_debug: Fix request sense
The SCSI REQUEST SENSE command emulation was found to be broken.  It is a
quite complex command so try and make it do a subset of what it should
do. Remove the attempt to mimic SCSI-1 REQUEST SENSE (i.e. return the sense
data for the previous failed command). Add some reporting of "pollable"
sense data [see spc6r02: 5.12.2]. Keep the IEC mode page MRIE=6 TEST=1
predictive failure reporting.

Link: https://lore.kernel.org/r/20200723194819.545573-1-dgilbert@interlog.com
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-07-29 00:00:01 -04:00
Douglas Gilbert
30f67481a1 scsi: scsi_debug: Update documentation url and bump version
This driver maintains a version number which is cross-referenced in the
documentation (e.g. to indicate when features are added or changed) and
exposed through the responses to various SCSI commands. For example the
version number is use as the Product Revision number in standard SCSI
INQUIRY responses issued by this driver. The version date string is placed
in a vendor specific area in each standard SCSI INQUIRY response. This
patch bumps both.

Update the driver documentation URL that appears at the top of the driver
source file.

Link: https://lore.kernel.org/r/20200712182927.72044-3-dgilbert@interlog.com
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-07-13 23:49:47 -04:00
Douglas Gilbert
3a90a63d02 scsi: scsi_debug: every_nth triggered error injection
This patch simplifies, or at least makes more consistent, the way setting
the every_nth parameter injects errors. Here is a list of 'opts' flags and
in which cases they inject errors when abs(every_nth)%command_count == 0 is
reached:

  - OPT_RECOVERED_ERR: issued on READ(*)s, WRITE(*)s and
                       WRITE_SCATTEREDs
  - OPT_DIF_ERR:       issued on READ(*)s, WRITE(*)s and
                       WRITE_SCATTEREDs
  - OPT_DIX_ERR:       issued on READ(*)s, WRITE(*)s and
                       WRITE_SCATTEREDs
  - OPT_SHORT_TRANSFER: issued on READ(*)s
  - OPT_TRANSPORT_ERR: issued on all commands
  - OPT_CMD_ABORT:     issued on all commands

The other uses of every_nth were not modified.

Previously if, for example, OPT_SHORT_TRANSFER was armed then if
(abs(every_nth) % command_count == 0) occurred during a command that was
_not_ a READ, then no error injection occurred. This behaviour puzzled
several testers. Now a global "inject_pending" flag is set and the _next_
READ will get hit and that flag is cleared. OPT_RECOVERED_ERR, OPT_DIF_ERR
and OPT_DIX_ERR have similar behaviour. A downside of this is that there
might be a hang-over pending injection that gets triggered by a following
test.

Also expand the every_nth runtime parameter so that it can take hex value
(i.e. with a leading '0x') as well as a decimal value. Now both the 'opts'
and the 'every_nth' runtime parameters can take hexadecimal values.

Link: https://lore.kernel.org/r/20200712182927.72044-2-dgilbert@interlog.com
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-07-13 23:49:46 -04:00
John Garry
c10fa55f5e scsi: scsi_debug: Support hostwide tags
Many SCSI HBAs support a hostwide tagset, whereby each command submitted to
the HW from all submission queues must have a unique tag identifier.

Normally this unique tag will be in the range [0, max queue], where "max
queue" is the depth of each of the submission queues.

Add support for this hostwide tag feature, via module parameter
"host_max_queue". A non-zero value means that the feature is enabled. In
this case, the submission queues are not exposed to upper layer, i.e. from
blk-mq prespective, the device has a single hw queue. There are 2 reasons
for this:

 a. It is assumed that the host can support nr_hw_queues * can_queue
    commands, but this is not true for hostwide tags

 b. For nr_hw_queues != 0, the request tag is not unique over all HW
    queues, and some HBA drivers want to use this tag for the hostwide tag

However, like many SCSI HBA drivers today - megaraid sas being an example -
the full set of HW submission queues are still used in the LLDD driver. So
instead of using a complicated "reply_map" to create a per-CPU submission
queue mapping like megaraid_sas (as it depends on a PCI device + MSIs) -
use a simple algorithm:

    hwq = cpu % queue count

If the host_max_queue param is set non-zero, then the max queue depth is
fixed at this value also.

If and when hostwide shared tags are supported in blk-mq/scsi mid-layer,
then the policy to set nr_hw_queues = 0 for hostwide tags can be revised.

Link: https://lore.kernel.org/r/1594297400-24756-3-git-send-email-john.garry@huawei.com
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-07-13 23:42:48 -04:00
John Garry
c87bf24cfb scsi: scsi_debug: Add check for sdebug_max_queue during module init
sdebug_max_queue should not exceed SDEBUG_CANQUEUE, otherwise crashes like
this can be triggered by passing an out-of-range value:

Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0 - V1.16.01 03/15/2019
 pstate: 20400009 (nzCv daif +PAN -UAO BTYPE=--)
 pc : schedule_resp+0x2a4/0xa70 [scsi_debug]
 lr : schedule_resp+0x52c/0xa70 [scsi_debug]
 sp : ffff800022ab36f0
 x29: ffff800022ab36f0 x28: ffff0023a935a610
 x27: ffff800008e0a648 x26: 0000000000000003
 x25: ffff0023e84f3200 x24: 00000000003d0900
 x23: 0000000000000000 x22: 0000000000000000
 x21: ffff0023be60a320 x20: ffff0023be60b538
 x19: ffff800008e13000 x18: 0000000000000000
 x17: 0000000000000000 x16: 0000000000000000
 x15: 0000000000000000 x14: 0000000000000000
 x13: 0000000000000000 x12: 0000000000000000
 x11: 0000000000000000 x10: 0000000000000000
 x9 : 0000000000000001 x8 : 0000000000000000
 x7 : 0000000000000000 x6 : 00000000000000c1
 x5 : 0000020000200000 x4 : dead0000000000ff
 x3 : 0000000000000200 x2 : 0000000000000200
 x1 : ffff800008e13d88 x0 : 0000000000000000
 Call trace:
schedule_resp+0x2a4/0xa70 [scsi_debug]
scsi_debug_queuecommand+0x2c4/0x9e0 [scsi_debug]
scsi_queue_rq+0x698/0x840
__blk_mq_try_issue_directly+0x108/0x228
blk_mq_request_issue_directly+0x58/0x98
blk_mq_try_issue_list_directly+0x5c/0xf0
blk_mq_sched_insert_requests+0x18c/0x200
blk_mq_flush_plug_list+0x11c/0x190
blk_flush_plug_list+0xdc/0x110
blk_finish_plug+0x38/0x210
blkdev_direct_IO+0x450/0x4d8
generic_file_read_iter+0x84/0x180
blkdev_read_iter+0x3c/0x50
aio_read+0xc0/0x170
io_submit_one+0x5c8/0xc98
__arm64_sys_io_submit+0x1b0/0x258
el0_svc_common.constprop.3+0x68/0x170
do_el0_svc+0x24/0x90
el0_sync_handler+0x13c/0x1a8
el0_sync+0x158/0x180
 Code: 528847e0 72a001e0 6b00003f 540018cd (3941c340)

In addition, it should not be less than 1.

So add checks for these, and fail the module init for those cases.

[mkp: changed if condition to match error message]

Link: https://lore.kernel.org/r/1594297400-24756-2-git-send-email-john.garry@huawei.com
Fixes: c483739430 ("scsi_debug: add multiple queue support")
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-07-13 23:42:31 -04:00
Douglas Gilbert
74595c044c scsi: scsi_debug: Fix in_use bitmap corruption
Heavy testing indicates the irqsave() spinlock around the __set_bit() is
insufficient to stop following clear_bit() calls being rarely applied
out-of-order. Also the nearby failed kzalloc() path leading to
SCSI_MLQUEUE_HOST_BUSY does not properly undo the in_use bitmap and
num_in_q, fix.

Link: https://lore.kernel.org/r/20200702145355.522283-1-dgilbert@interlog.com
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-07-02 23:49:54 -04:00
Douglas Gilbert
b6ff8ca733 scsi: scsi_debug: Parser tables and code interaction
This patch is in response to a static analyser report from Dan Carpenter
titled: "[bug report] scsi: scsi_debug: Add per_host_store option".  This
code may not clear the static analyzer reports, but may shed light on why
they occur. Amongst other things this driver has a table driven SCSI
command parser which also involves some C code. There are some invariants
between the table entries and the corresponding C code (i.e. the resp_*()
functions) that, if broken, may lead to a NULL dereference.  And the report
is valid, at least in the case of the PRE-FETCH command.  Alas, that is not
one of the cases that the static analyzer reported.

In this particular corner case: when the fake_rw flag is set and the table
entry for a "store"-accessing command does not have the required F_FAKE_RW
flag set, do the following. Call BUG_ON() in the devip2sip() very close to
a comment block explaining why it was called and how to fix it.
checkpatch.pl complains about the BUG_ON() but there is no reasonable
remedial action that can be taken at run time.

This change allows the code reported by the static analyzer to be
simplified. Comments were also added to the table flags (e.g.  F_FAKE_RW)
so developers who add commands might be more inclined to use them
(properly).

Link: https://lore.kernel.org/r/20200513013943.25285-1-dgilbert@interlog.com
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-05-19 22:25:52 -04:00
Dan Carpenter
47742bde28 scsi: scsi_debug: Fix an error handling bug in sdeb_zbc_model_str()
This test is checking the wrong variable.  It should be testing "res".
The "sdeb_zbc_model" variable is an enum (unsigned in this situation)
and we never assign negative values to it.

[mkp: fixed commit desc issue reported by Doug]

Link: https://lore.kernel.org/r/20200509100408.GA5555@mwanda
Fixes: 9267e0eb41 ("scsi: scsi_debug: Add ZBC module parameter")
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-05-11 23:21:27 -04:00
Damien Le Moal
108e36f0d8 scsi: scsi_debug: Disallow zone sizes that are not powers of 2
Allowing a non-power-of-2 zone size forces the use of direct division
operations of 64-bit sector values to obtain a zone number or number of
zones. Doing so without using do_div() leads to compilation errors on
32-bit architectures.

Devices with a zone size that is not a power of 2 do not exist today so
allowing their emulation is of limited interest as the sd driver will not
support them anyway. To fix this compilation error, instead of using
do_div() for sector values divisions, simply disallow zone size values that
are not a power of 2.

[mkp: commit desc]

Link: https://lore.kernel.org/r/20200507023526.221574-1-damien.lemoal@wdc.com
Fixes: 98e0a68986 ("scsi: scsi_debug: Add zone_size_mb module parameter")
Fixes: f0d1cf9378 ("scsi: scsi_debug: Add ZBC zone commands")
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-05-07 20:45:02 -04:00
Damien Le Moal
64e14ece07 scsi: scsi_debug: Implement ZBC host-aware emulation
Implement ZBC host-aware device model emulation. The main changes from the
host-managed emulation are the device type (TYPE_DISK is used), relaxation
of access checks for read and write operations and different handling of a
sequential write preferred zone write pointer as mandated by the ZBC r05
specifications.

To facilitate the implementation and avoid a lot of "if" statement, the
zmodel field is added to the device information and the z_type field to the
zone state data structure.

Link: https://lore.kernel.org/r/20200422104221.378203-8-damien.lemoal@wdc.com
Tested-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-05-05 00:37:34 -04:00