summaryrefslogtreecommitdiff
path: root/drivers/block/cciss.c
AgeCommit message (Collapse)Author
2013-10-13cciss: fix info leak in cciss_ioctl32_passthru()Dan Carpenter
commit 58f09e00ae095e46ef9edfcf3a5fd9ccdfad065e upstream. The arg64 struct has a hole after ->buf_size which isn't cleared. Or if any of the calls to copy_from_user() fail then that would cause an information leak as well. This was assigned CVE-2013-2147. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-06-20cciss: fix broken mutex usage in ioctlStephen M. Cameron
commit 03f47e888daf56c8e9046c674719a0bcc644eed5 upstream. If a new logical drive is added and the CCISS_REGNEWD ioctl is invoked (as is normal with the Array Configuration Utility) the process will hang as below. It attempts to acquire the same mutex twice, once in do_ioctl() and once in cciss_unlocked_open(). The BKL was recursive, the mutex isn't. Linux version 3.10.0-rc2 (scameron@localhost.localdomain) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-3) (GCC) ) #1 SMP Fri May 24 14:32:12 CDT 2013 [...] acu D 0000000000000001 0 3246 3191 0x00000080 Call Trace: schedule+0x29/0x70 schedule_preempt_disabled+0xe/0x10 __mutex_lock_slowpath+0x17b/0x220 mutex_lock+0x2b/0x50 cciss_unlocked_open+0x2f/0x110 [cciss] __blkdev_get+0xd3/0x470 blkdev_get+0x5c/0x1e0 register_disk+0x182/0x1a0 add_disk+0x17c/0x310 cciss_add_disk+0x13a/0x170 [cciss] cciss_update_drive_info+0x39b/0x480 [cciss] rebuild_lun_table+0x258/0x370 [cciss] cciss_ioctl+0x34f/0x470 [cciss] do_ioctl+0x49/0x70 [cciss] __blkdev_driver_ioctl+0x28/0x30 blkdev_ioctl+0x200/0x7b0 block_ioctl+0x3c/0x40 do_vfs_ioctl+0x89/0x350 SyS_ioctl+0xa1/0xb0 system_call_fastpath+0x16/0x1b This mutex usage was added into the ioctl path when the big kernel lock was removed. As it turns out, these paths are all thread safe anyway (or can easily be made so) and we don't want ioctl() to be single threaded in any case. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Mike Miller <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-01-14block: add and use scsi_blk_cmd_ioctlPaolo Bonzini
Introduce a wrapper around scsi_cmd_ioctl that takes a block device. The function will then be enhanced to detect partition block devices and, in that case, subject the ioctls to whitelisting. Cc: linux-scsi@vger.kernel.org Cc: Jens Axboe <axboe@kernel.dk> Cc: James Bottomley <JBottomley@parallels.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-11-28cciss: fix flush cache transfer lengthStephen M. Cameron
We weren't filling in the transfer length of the flush cache command (it transfers 4 bytes of zeroes). Firmware didn't seem to be bothered by this, but it should be fixed. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2011-11-28cciss: Add IRQF_SHARED back in for the non-MSI(X) interrupt handlerStephen M. Cameron
IRQF_SHARED is required for older controllers that don't support MSI(X) and which may end up sharing an interrupt. Also remove deprecated IRQF_DISABLED. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2011-11-16cciss: auto engage SCSI mid layer at driver load timeStephen M. Cameron
A long time ago, probably in 2002, one of the distros, or maybe more than one, loaded block drivers prior to loading the SCSI mid layer. This meant that the cciss driver, being a block driver, could not engage the SCSI mid layer at init time without panicking, and relied on being poked by a userland program after the system was up (and the SCSI mid layer was therefore present) to engage the SCSI mid layer. This is no longer the case, and cciss can safely rely on the SCSI mid layer being present at init time and engage the SCSI mid layer straight away. This means that users will see their tape drives and medium changers at driver load time without need for a script in /etc/rc.d that does this: for x in /proc/driver/cciss/cciss* do echo "engage scsi" > $x done However, if no tape drives or medium changers are detected, the SCSI mid layer will not be engaged. If a tape drive or medium change is later hot-added to the system it will then be necessary to use the above script or similar for the device(s) to be acceesible. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2011-11-11The Windows driver .inf disables ASPM on all cciss devices. Do the same.Matthew Garrett
Signed-off-by: Matthew Garrett <mjg@redhat.com> Cc: iss_storagedev@hp.com Acked-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2011-10-20cciss: add small delay when using PCI Power Management to reset for kumpMike Miller
The P600 requires a small delay when changing states. Otherwise we may think the board did not reset and we bail. This for kdump only and is particular to the P600. Cc: stable@kernel.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2011-08-08cciss: add transport mode attribute to sysJoe Handzik
Signed-off-by: Joseph Handzik <joseph.t.handzik@beardog.cce.hp.com> Acked-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-08-08cciss: Adds simple mode functionalityJoseph Handzik
Signed-off-by: Joseph Handzik <joseph.t.handzik@beardog.cce.hp.com> Acked-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: fix compile issueJens Axboe
drivers/block/cciss.c: In function ‘cciss_send_reset’: drivers/block/cciss.c:2515:2: error: implicit declaration of function ‘fill_cmd’ drivers/block/cciss.c: At top level: drivers/block/cciss.c:2531:12: error: conflicting types for ‘fill_cmd’ drivers/block/cciss.c:2534:1: note: an argument type that has a default promotion can’t match an empty parameter name list declaration drivers/block/cciss.c:2515:18: note: previous implicit declaration of ‘fill_cmd’ was here make[1]: *** [drivers/block/cciss.o] Error 1 make: *** [drivers/block/cciss.o] Error 2 Move fill_cmd() to above where it is first used. Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: add cciss_tape_cmds module paramterStephen M. Cameron
This is to allow number of commands reserved for use by SCSI tape drives and medium changers to be adjusted at driver load time via the kernel parameter cciss_tape_cmds, with a default value of 6, and a range of 2 - 16 inclusive. Previously, the driver limited the number of commands which could be queued to the SCSI half of the the driver to only 2. This is to fix the problem that if you had more than two tape drives, you couldn't, for example, erase or rewind them all at the same time. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: do not use bit 2 doorbell resetStephen M. Cameron
It causes NMIs which are undesirable at best, unsurvivable at worst. Prefer the soft reset instead. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: do not attempt PCI power management reset method if we know it won't ↵Stephen M. Cameron
work. Just go straight to the soft-reset method instead. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: remove superfluous sleeps around reset codeStephen M. Cameron
Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: do soft reset if hard reset is brokenStephen M. Cameron
on driver load, if reset_devices is set, and the hard reset attempts fail, try to bring up the controller to the point that a command can be sent, and send it a soft reset command, then after the reset undo whatever driver initialization was done to get it to the point to take a command, and re-do it after the reset. This is to get kdump to work on all the "non-resettable" controllers (except 64xx controllers which can't be reset due to the potentially shared cache module.) Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: use new doorbell-bit-5 reset methodStephen M. Cameron
The bit-2-doorbell reset method seemed to cause (survivable) NMIs on some systems and (unsurvivable) IOCK NMIs on some G7 servers. Firmware guys implemented a new doorbell method to alleviate these problems triggered by bit 5 of the doorbell register. We want to use it if it's available. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: increase timeouts for post-reset no-opsStephen M. Cameron
Just to reduce the messages about timeouts that appear. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: clarify messages around reset behaviorStephen M. Cameron
When waiting for the board to become "not ready" don't print a message saying "waiting for board to become ready" (possibly followed by a message saying "failed waiting for board to become not ready". Instead, it should be "waiting for board to reset" and "failed waiting for board to reset." Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> " Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: get rid of message related magic numbersStephen M. Cameron
Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: fix reply pool and block fetch table memory leaksStephen M. Cameron
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: factor out irq request codeStephen M. Cameron
Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: factor out scatterlist allocation functionsStephen M. Cameron
Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: factor out command pool allocation functionsStephen M. Cameron
Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-05-06cciss: do a better job of detecting controller reset failureStephen M. Cameron
Detect failure of controller reset by noticing if the 32 bytes of "driver version" we store on the hardware in the config table fail to get zeroed out. Previously we noticed if the controller did not transition to "simple mode", but this did not detect reset failure if the controller was already in simple mode prior to the reset attempt (e.g. due to module parameter hpsa_simple_mode=1). Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-03-12cciss: fix missed command status value CMD_UNABORTABLEStephen M. Cameron
and fix a nearby typo, "do" that should have been "due" Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-03-12cciss: remove unnecessary castsStephen M. Cameron
Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-03-12cciss: Mask off error bits of c->busaddr in cmd_special_free when calling ↵Stephen M. Cameron
pci_free_consistent Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-03-12cciss: Inform controller we are using 32-bit tags.Stephen M. Cameron
Controller will DMA only 32-bits of the tag per command on completion if it knows we are only using 32-bit tags. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-03-12cciss: hoist tag masking out of loopStephen M. Cameron
In process_nonindexed_cmd, hoist figuring of masked tag out of loop since it is the same throughout. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-03-11cciss: export resettable host attributeStephen M. Cameron
This attribute, requested by Redhat, allows kexec-tools to know whether the controller can honor the reset_devices kernel parameter and actually reset the controller. For kdump to work properly it is necessary that the reset_devices parameter be honored. This attribute enables kexec-tools to warn the user if they attempt to designate a non-resettable controller as the dump device. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-03-10block: remove per-queue pluggingJens Axboe
Code has been converted over to the new explicit on-stack plugging, and delay users have been converted to use the new API for that. So lets kill off the old plugging along with aops->sync_page(). Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-01-19cciss: make cciss_revalidate not loop through CISS_MAX_LUNS volumes ↵Stephen M. Cameron
unnecessarily. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-01-13Merge branch 'for-2.6.38/drivers' of git://git.kernel.dk/linux-2.6-blockLinus Torvalds
* 'for-2.6.38/drivers' of git://git.kernel.dk/linux-2.6-block: cciss: reinstate proper FIFO order of command queue list floppy: replace NO_GEOM macro with a function
2011-01-10cciss: reinstate proper FIFO order of command queue listJens Axboe
Commit 8a3173de inadvertently changed the ordering when switching to hlists. Change to regular list heads so we can use tail list adds, this improves performance. Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-12-20Fix build error in drivers/block/cciss.cLinus Torvalds
.. caused by a missing semi-colon, introduced in commit 0fc13c8995cd ("cciss: fix cciss_revalidate panic"). Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Reported-by: Thiago Farina <tfransosi@gmail.com> Cc: Jens Axboe <jaxboe@fusionio.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-12-17cciss: fix cciss_revalidate panicStephen M. Cameron
If you delete a logical drive, and then run BLKRRPART (e.g. via fdisk) on a logical drive which is "after" the deleted logical drive in the h->drv[] array, then cciss_revalidate panics because it will access the null pointer h->drv[x] when x hits the deleted drive. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Cc: stable@kernel.org Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-17cciss: fix build for PROC_FS disabledJens Axboe
The recent patch to fix the removal of a non-existing proc directory introduced this build problem for !CONFIG_PROC_FS: drivers/block/cciss.c:4929: error: 'proc_cciss' undeclared (first use in this function) Fix it by moving proc_cciss outside of the CONFIG_PROC_FS scope. Reported-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10Merge branch 'for-2.6.37/drivers' into for-linusJens Axboe
Conflicts: drivers/block/cciss.c Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10cciss: fix proc warning on attempt to remove non-existant directoryJens Axboe
Randy reports that he gets the following stack trace when removing the cciss module: [ 109.164277] Pid: 3463, comm: rmmod Not tainted 2.6.37-rc1 #7 [ 109.164280] Call Trace: [ 109.164292] [<ffffffff8107eb8d>] warn_slowpath_common+0xc6/0xf3 [ 109.164299] [<ffffffff8107ecaa>] warn_slowpath_fmt+0x5b/0x6b [ 109.164307] [<ffffffff8155175b>] ? _raw_spin_unlock+0x40/0x4b [ 109.164313] [<ffffffff8123dd1e>] remove_proc_entry+0x156/0x35e [ 109.164320] [<ffffffff812cd91b>] ? do_raw_spin_unlock+0xff/0x10f [ 109.164327] [<ffffffff8113823d>] ? trace_hardirqs_on+0x10/0x4a [ 109.164333] [<ffffffff8155162d>] ? _raw_spin_unlock_irq+0x4c/0x7b [ 109.164339] [<ffffffff8154d4d1>] ? wait_for_common+0x145/0x15e [ 109.164345] [<ffffffff81075337>] ? default_wake_function+0x0/0x22 [ 109.164357] [<ffffffffa0615a8f>] cciss_cleanup+0xa9/0xc7 [cciss] [ 109.164365] [<ffffffff810d3cb0>] sys_delete_module+0x2d6/0x368 [ 109.164371] [<ffffffff8155036b>] ? lockdep_sys_exit_thunk+0x35/0x67 [ 109.164377] [<ffffffff810fdfaf>] ? audit_syscall_entry+0x172/0x1a5 [ 109.164383] [<ffffffff815502f5>] ? trace_hardirqs_on_thunk+0x3a/0x3f [ 109.164389] [<ffffffff8100ea72>] system_call_fastpath+0x16/0x1b [ 109.164394] ---[ end trace 88e8568246ed0b1d ]--- which will happen if you don't actually have an HP CISS adapter, since it'll do an uncondional removal of a proc directory it never attempted to create in that case. Reported-by: Randy Dunlap <randy.dunlap@oracle.com> Tested-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-10-28cciss: remove overlapping PCI IDsMike Miller
This patch removes the controller overlap between cciss and hpsa. It was decided that no overlap should exist. All new controllers will use the hpsa SCSI based driver. Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-10-28block: cciss: fix information leak to userlandVasiliy Kulikov
Structure IOCTL_Command_struct is copied to userland with some padding fields at the end of the struct unitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-10-23cciss: remove controllers supported by hpsaStephen M. Cameron
We would prefer not to have any overlap between the two drivers. Remove the cciss_allow_hpsa option, as it it is no longer needed. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-10-23cciss: use usleep_range not msleep for small sleepsStephen M. Cameron
Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-10-23cciss: limit commands allocated on reset_devicesStephen M. Cameron
This is to conserve memory in a memory-limited kdump scenario Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-10-23cciss: Use kernel provided PCI state save and restore functionsStephen M. Cameron
and use the doorbell reset method if available (which doesn't lock up the controller if you properly save and restore all the PCI registers that you're supposed to.) Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-10-23cciss: fix board status waiting codeStephen M. Cameron
After a reset, we should first wait for the board to become "not ready", and then wait for it to become "ready", instead of immediately waiting for it to become "ready", and do this waiting *after* restoring PCI config space registers. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-10-22Merge branch 'for-2.6.37/drivers' of git://git.kernel.dk/linux-2.6-blockLinus Torvalds
* 'for-2.6.37/drivers' of git://git.kernel.dk/linux-2.6-block: (95 commits) cciss: fix PCI IDs for new Smart Array controllers drbd: add race-breaker to drbd_go_diskless drbd: use dynamic_dev_dbg to optionally log uuid changes dynamic_debug.h: Fix dynamic_dev_dbg() macro if CONFIG_DYNAMIC_DEBUG not set drbd: cleanup: change "<= 0" to "== 0" drbd: relax the grace period of the md_sync timer again drbd: add some more explicit drbd_md_sync drbd: drop wrong debug asserts, fix recently introduced race drbd: cleanup useless leftover warn/error printk's drbd: add explicit drbd_md_sync to drbd_resync_finished drbd: Do not log an ASSERT for P_OV_REQUEST packets while C_CONNECTED drbd: fix for possible deadlock on IO error during resync drbd: fix unlikely access after free and list corruption drbd: fix for spurious fullsync (uuids rotated too fast) drbd: allow for explicit resync-finished notifications drbd: preparation commit, using full state in receive_state() drbd: drbd_send_ack_dp must not rely on header information drbd: Fix regression in recv_bm_rle_bits (compressed bitmap) drbd: Fixed a stupid copy and paste error drbd: Allow larger values for c-fill-target. ... Fix up trivial conflict in drivers/block/ataflop.c due to BKL removal
2010-10-22Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bklLinus Torvalds
* 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl: block: autoconvert trivial BKL users to private mutex drivers: autoconvert trivial BKL users to private mutex ipmi: autoconvert trivial BKL users to private mutex mac: autoconvert trivial BKL users to private mutex mtd: autoconvert trivial BKL users to private mutex scsi: autoconvert trivial BKL users to private mutex Fix up trivial conflicts (due to addition of private mutex right next to deletion of a version string) in drivers/char/pcmcia/cm40[04]0_cs.c
2010-10-19cciss: fix PCI IDs for new Smart Array controllersMike Miller
cciss: fix PCI IDs for new controllers This patch fixes the botched up PCI IDs of new controllers. Please consider this patch for inclusion. Signed-off-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
generated by cgit v1.2.3 (git 2.0.4) at 2024-06-14 19:17:00 +0000