[PATCH hulk-4.19-next 03/10] DTS:DTS2019030103192 Description:{fromtree} scsi:hisi_sas: fix calls to dma_set_mask_and_coherent()

[PATCH hulk-4.19-next 03/10] DTS:DTS2019030103192 Description:{fromtree} scsi:hisi_sas: fix calls to dma_set_mask_and_coherent()

[chenxiang]

From: c00284940 <c00284940@huawei.com>

plinth inclusion
category: bugfix
bugzilla: NA
DTS: DTS2019030103192
CVE: NA

The change to use dma_set_mask_and_coherent() incorrectly made a second
call with the 32 bit DMA mask value when the call with the 64 bit DMA
mask value succeeded.  This resulted in FC connections failing due
to corrupted data buffers, and various other SCSI/FCP I/O errors.

Fixes: e4db40e ("scsi: hisi_sas: use dma_set_mask_and_coherent")
Cc: <stable@vger.kernel.org>
Suggested-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Hannes Reinecke <hare@suse.com>

Change-Id: I2d8b409b5b9675a8d7a17730cde342b2f7579c38
Signed-off-by: c00284940 <c00284940@huawei.com>
Reviewed-on: http://10.90.31.173:8080/4799
Tested-by: public TuringEE <turingee@huawei.com>
Reviewed-by: huangdaode 00314581 <huangdaode@hisilicon.com>
Reviewed-by: public TuringEE <turingee@huawei.com>
---
 drivers/scsi/hisi_sas/hisi_sas_main.c  |  8 ++++++--
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 15 +++++++--------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
index ff32799..a2a4c74 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
@@ -2556,6 +2556,7 @@ static struct Scsi_Host *hisi_sas_shost_alloc(struct platform_device *pdev,
 	struct Scsi_Host *shost;
 	struct hisi_hba *hisi_hba;
 	struct device *dev = &pdev->dev;
+	int error;
 
 	shost = scsi_host_alloc(hw->sht, sizeof(*hisi_hba));
 	if (!shost) {
@@ -2576,8 +2577,11 @@ static struct Scsi_Host *hisi_sas_shost_alloc(struct platform_device *pdev,
 	if (hisi_sas_get_fw_info(hisi_hba) < 0)
 		goto err_out;
 
-	if (dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)) &&
-	    dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32))) {
+	error = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
+	if (error)
+		error = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
+
+	if (error) {
 		dev_err(dev, "No usable DMA addressing method\n");
 		goto err_out;
 	}
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index b4bde32..24db55f 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -2903,14 +2903,13 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	if (rc)
 		goto err_out_disable_device;
 
-	if ((pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) != 0) ||
-	    (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) != 0)) {
-		if ((pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0) ||
-		   (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)) != 0)) {
-			dev_err(dev, "No usable DMA addressing method\n");
-			rc = -EIO;
-			goto err_out_regions;
-		}
+	rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
+	if (rc)
+		rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+	if (rc) {
+		dev_err(dev, "No usable DMA addressing method\n");
+		rc = -ENODEV;
+		goto err_out_regions;
 	}
 
 	shost = hisi_sas_shost_alloc_pci(pdev);
-- 
2.8.1

[PATCH hulk-4.19-next 08/10] DTS:DTS2018120709658 Description:scsi: sd: Fix a race between closing an sd device and sd I/O

[chenxiang]

From: c00284940 <c00284940@huawei.com>

plinth inclusion
category: bugfix
bugzilla: NA
DTS: DTS2018120709658
CVE: NA

The scsi_end_request() function calls scsi_cmd_to_driver() indirectly
and hence needs the disk->private_data pointer. Avoid that that pointer
is cleared before all affected I/O requests have finished. This patch
avoids that the following crash occurs:

Unable to handle kernel NULL pointer dereference at virtual address
0000000000000000
Call trace:
scsi_mq_uninit_cmd+0x1c/0x30
scsi_end_request+0x7c/0x1b8
scsi_io_completion+0x464/0x668
scsi_finish_command+0xbc/0x160
scsi_eh_flush_done_q+0x10c/0x170
sas_scsi_recover_host+0x84c/0xa98 [libsas]
scsi_error_handler+0x140/0x5b0
kthread+0x100/0x12c
ret_from_fork+0x10/0x18

Cc: Christoph Hellwig <hch@lst.de>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Johannes Thumshirn <jthumshirn@suse.de>
Cc: Jason Yan <yanaijie@huawei.com>
Cc: <stable@vger.kernel.org>
Reported-by: Jason Yan <yanaijie@huawei.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>

Change-Id: Ib761a1144492a507c7c3d4a09b817bb4f1285835
Signed-off-by: c00284940 <c00284940@huawei.com>
Reviewed-on: http://10.90.31.173:8080/5601
Tested-by: public TuringEE <turingee@huawei.com>
Reviewed-by: huangdaode 00314581 <huangdaode@hisilicon.com>
Reviewed-by: public TuringEE <turingee@huawei.com>
---
 drivers/scsi/sd.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index a02196b..eb37f7d 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1413,11 +1413,6 @@ static void sd_release(struct gendisk *disk, fmode_t mode)
 			scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW);
 	}
 
-	/*
-	 * XXX and what if there are packets in flight and this close()
-	 * XXX is followed by a "rmmod sd_mod"?
-	 */
-
 	scsi_disk_put(sdkp);
 }
 
@@ -3514,9 +3509,21 @@ static void scsi_disk_release(struct device *dev)
 {
 	struct scsi_disk *sdkp = to_scsi_disk(dev);
 	struct gendisk *disk = sdkp->disk;
-	
+	struct request_queue *q = disk->queue;
+
 	ida_free(&sd_index_ida, sdkp->index);
 
+	/*
+	 * Wait until all requests that are in progress have completed.
+	 * This is necessary to avoid that e.g. scsi_end_request() crashes
+	 * due to clearing the disk->private_data pointer. Wait from inside
+	 * scsi_disk_release() instead of from sd_release() to avoid that
+	 * freezing and unfreezing the request queue affects user space I/O
+	 * in case multiple processes open a /dev/sd... node concurrently.
+	 */
+	blk_mq_freeze_queue(q);
+	blk_mq_unfreeze_queue(q);
+
 	disk->private_data = NULL;
 	put_disk(disk);
 	put_device(&sdkp->device->sdev_gendev);
-- 
2.8.1

Re: [PATCH hulk-4.19-next 03/10] DTS:DTS2019030103192 Description:{fromtree} scsi:hisi_sas: fix calls to dma_set_mask_and_coherent()

[Greg KH]

On Mon, Apr 01, 2019 at 02:11:44PM +0800, chenxiang wrote:
> From: c00284940 <c00284940@huawei.com>

That is not a real name, sorry, which is what we need for any patch
submissions.

> 
> plinth inclusion
> category: bugfix
> bugzilla: NA
> DTS: DTS2019030103192
> CVE: NA
> 
> The change to use dma_set_mask_and_coherent() incorrectly made a second
> call with the 32 bit DMA mask value when the call with the 64 bit DMA
> mask value succeeded.  This resulted in FC connections failing due
> to corrupted data buffers, and various other SCSI/FCP I/O errors.
> 
> Fixes: e4db40e ("scsi: hisi_sas: use dma_set_mask_and_coherent")
> Cc: <stable@vger.kernel.org>
> Suggested-by: Ewan D. Milne <emilne@redhat.com>
> Signed-off-by: Hannes Reinecke <hare@suse.com>
> 
> Change-Id: I2d8b409b5b9675a8d7a17730cde342b2f7579c38

change-id is not allowed in kernel patches.

> Signed-off-by: c00284940 <c00284940@huawei.com>

Again, we need a real name.

> Reviewed-on: http://10.90.31.173:8080/4799

That's a really odd url :(

> Tested-by: public TuringEE <turingee@huawei.com>
> Reviewed-by: huangdaode 00314581 <huangdaode@hisilicon.com>
> Reviewed-by: public TuringEE <turingee@huawei.com>

Again, we need real names please.

thanks,
greg k-h

Re: [PATCH hulk-4.19-next 08/10] DTS:DTS2018120709658 Description:scsi: sd: Fix a race between closing an sd device and sd I/O

[Greg KH]

On Mon, Apr 01, 2019 at 02:11:49PM +0800, chenxiang wrote:
> From: c00284940 <c00284940@huawei.com>

Same goes for all of the previous comments on this patch as well.

thanks,

greg k-h

Re: [PATCH hulk-4.19-next 03/10] DTS:DTS2019030103192 Description:{fromtree} scsi:hisi_sas: fix calls to dma_set_mask_and_coherent()

[chenxiang (M)]

Sorry, i meant to backport some patches from mail list , and sent those 
patches to  internal branch  and not notice it adds some other receiver 
when git send-email.
Please ignore them.

在 2019/4/1 15:05, Greg KH 写道:
> On Mon, Apr 01, 2019 at 02:11:44PM +0800, chenxiang wrote:
>> From: c00284940 <c00284940@huawei.com>
> That is not a real name, sorry, which is what we need for any patch
> submissions.
>
>> plinth inclusion
>> category: bugfix
>> bugzilla: NA
>> DTS: DTS2019030103192
>> CVE: NA
>>
>> The change to use dma_set_mask_and_coherent() incorrectly made a second
>> call with the 32 bit DMA mask value when the call with the 64 bit DMA
>> mask value succeeded.  This resulted in FC connections failing due
>> to corrupted data buffers, and various other SCSI/FCP I/O errors.
>>
>> Fixes: e4db40e ("scsi: hisi_sas: use dma_set_mask_and_coherent")
>> Cc: <stable@vger.kernel.org>
>> Suggested-by: Ewan D. Milne <emilne@redhat.com>
>> Signed-off-by: Hannes Reinecke <hare@suse.com>
>>
>> Change-Id: I2d8b409b5b9675a8d7a17730cde342b2f7579c38
> change-id is not allowed in kernel patches.
>
>> Signed-off-by: c00284940 <c00284940@huawei.com>
> Again, we need a real name.
>
>> Reviewed-on: http://10.90.31.173:8080/4799
> That's a really odd url :(
>
>> Tested-by: public TuringEE <turingee@huawei.com>
>> Reviewed-by: huangdaode 00314581 <huangdaode@hisilicon.com>
>> Reviewed-by: public TuringEE <turingee@huawei.com>
> Again, we need real names please.
>
> thanks,
> greg k-h
>
> .
>

Re: [PATCH hulk-4.19-next 08/10] DTS:DTS2018120709658 Description:scsi: sd: Fix a race between closing an sd device and sd I/O

[chenxiang (M)]

Hi grep k-h, i meant to backport some patches from mail list , and sent 
those patches to  internal branch  and not notice it adds some other 
receiver automatically when git send-email.
Please ignore them.

在 2019/4/1 15:06, Greg KH 写道:
> On Mon, Apr 01, 2019 at 02:11:49PM +0800, chenxiang wrote:
>> From: c00284940 <c00284940@huawei.com>
> Same goes for all of the previous comments on this patch as well.
>
> thanks,
>
> greg k-h
>
> .
>