Merge branch 'svn-trunk'

qla2x00t-32gbit/qla_attr.c

@@ -2816,6 +2816,8 @@ qla2x00_reset_host_stats(struct Scsi_Host *shost)
 	vha->qla_stats.jiffies_at_last_reset = get_jiffies_64();
 
 	if (IS_FWI2_CAPABLE(ha)) {
+		int rval;
+
 		stats = dma_alloc_coherent(&ha->pdev->dev,
 		    sizeof(*stats), &stats_dma, GFP_KERNEL);
 		if (!stats) {
@@ -2825,7 +2827,8 @@ qla2x00_reset_host_stats(struct Scsi_Host *shost)
 		}
 
 		/* reset firmware statistics */
-		qla24xx_get_isp_stats(base_vha, stats, stats_dma, BIT_0);
+		rval = qla24xx_get_isp_stats(base_vha, stats, stats_dma, BIT_0);
+		WARN_ONCE(rval != QLA_SUCCESS, "rval = %d\n", rval);
 
 		dma_free_coherent(&ha->pdev->dev, sizeof(*stats),
 		    stats, stats_dma);

scst/src/scst_copy_mgr.c

@@ -578,7 +578,7 @@ static void scst_cm_advance_seg_descr(struct scst_cmd *ec_cmd)
 static void scst_cm_prepare_final_sense(struct scst_cmd *ec_cmd)
 {
 	struct scst_cm_ec_cmd_priv *priv = ec_cmd->cmd_data_descriptors;
-	uint8_t *fsense = NULL;
+	uint8_t add_sense_len, *fsense = NULL;
 	int d_sense = scst_get_cmd_dev_d_sense(ec_cmd);
 	bool copy_sense = false;
 	int sense_to_copy = ec_cmd->sense_valid_len;
@@ -665,7 +665,7 @@ static void scst_cm_prepare_final_sense(struct scst_cmd *ec_cmd)
 		/* Descriptor format */
 		fsense[0] = 0x72;
 		fsense[1] = COPY_ABORTED;
-		fsense[7] = 12; /* additional Sense Length */
+		add_sense_len = 12;
 
 		fsense[8] = 1; /* Command specific descriptor */
 		fsense[9] = 0xA;
@@ -676,7 +676,7 @@ static void scst_cm_prepare_final_sense(struct scst_cmd *ec_cmd)
 		/* Fixed format */
 		fsense[0] = 0x70;
 		fsense[2] = COPY_ABORTED;
-		fsense[7] = 0x0a; /* additional Sense Length */
+		add_sense_len = 0x0a;
 
 		put_unaligned_be16(priv->cm_cur_seg_descr, &fsense[10]);
 
@@ -691,15 +691,17 @@ static void scst_cm_prepare_final_sense(struct scst_cmd *ec_cmd)
 
 		if (copy_sense) {
 			TRACE_DBG("Copying %db of old sense", sense_to_copy);
-			fsense[7] += 1 + sense_to_copy;
+			add_sense_len += 1 + sense_to_copy;
 			fsense[17] = ec_cmd->status;
 			memcpy(&fsense[18], ec_cmd->sense, sense_to_copy);
 		}
 
-		sense_len = fsense[7] + 8;
+		sense_len = add_sense_len + 8;
 		TRACE_DBG("New sense len %d", sense_len);
 	}
 
+	fsense[7] = add_sense_len; /* additional Sense Length */
+
 	ec_cmd->status = SAM_STAT_CHECK_CONDITION;
 	if (ec_cmd->sense != NULL) {
 		memcpy(ec_cmd->sense, fsense, sense_len);

scst/src/scst_dlm.c

@@ -426,9 +426,9 @@ static void scst_copy_to_dlm(struct scst_device *dev, dlm_lockspace_t *ls)
 	struct pr_lvb *lvb = (void *)pr_dlm->lvb;
 	struct pr_reg_lvb *reg_lvb;
 	struct scst_dev_registrant *reg;
-	int i, tid_size;
+	int i;
 	char reg_name[32];
-	uint32_t nr_registrants;
+	uint32_t nr_registrants, tid_size;
 
 	lockdep_assert_held(&pr_dlm->ls_mutex);
 

scst/src/scst_pres.c

@@ -84,7 +84,7 @@ static inline void scst_assert_pr_mutex_held(struct scst_device *dev)
 }
 #endif
 
-int scst_tid_size(const uint8_t *tid)
+uint32_t scst_tid_size(const uint8_t *tid)
 {
 	sBUG_ON(tid == NULL);
 
@@ -94,16 +94,18 @@ int scst_tid_size(const uint8_t *tid)
 		return TID_COMMON_SIZE;
 }
 
-/* Secures tid by setting 0 in the last byte of NULL-terminated tid's */
-static inline void tid_secure(uint8_t *tid)
+/* Secures transport ID by setting 0 in the last byte of ASCII transport IDs */
+static bool tid_secure(uint8_t *tid, unsigned int buf_size)
 {
 	if ((tid[0] & 0x0f) == SCSI_TRANSPORTID_PROTOCOLID_ISCSI) {
-		int size = scst_tid_size(tid);
+		const uint32_t size = scst_tid_size(tid);
 
+		if (size > buf_size)
+			return false;
 		tid[size - 1] = '\0';
 	}
 
-	return;
+	return true;
 }
 
 /* Returns false if tid's are not equal, true otherwise */
@@ -122,8 +124,8 @@ bool tid_equal(const uint8_t *tid_a, const uint8_t *tid_b)
 	if ((tid_a[0] & 0x0f) == SCSI_TRANSPORTID_PROTOCOLID_ISCSI) {
 		const uint8_t tid_a_fmt = tid_a[0] & 0xc0;
 		const uint8_t tid_b_fmt = tid_b[0] & 0xc0;
-		int tid_a_len, tid_a_max = scst_tid_size(tid_a) - 4;
-		int tid_b_len, tid_b_max = scst_tid_size(tid_b) - 4;
+		uint32_t tid_a_len, tid_a_max = scst_tid_size(tid_a) - 4;
+		uint32_t tid_b_len, tid_b_max = scst_tid_size(tid_b) - 4;
 		int i;
 
 		tid_a += 4;
@@ -140,7 +142,6 @@ bool tid_equal(const uint8_t *tid_a, const uint8_t *tid_b)
 				tid_a_len = p - tid_a;
 
 				sBUG_ON(tid_a_len > tid_a_max);
-				sBUG_ON(tid_a_len < 0);
 			} else
 				tid_a_len = strnlen(tid_a, tid_a_max);
 		} else
@@ -157,7 +158,6 @@ bool tid_equal(const uint8_t *tid_a, const uint8_t *tid_b)
 				tid_b_len = p - tid_b;
 
 				sBUG_ON(tid_b_len > tid_b_max);
-				sBUG_ON(tid_b_len < 0);
 			} else
 				tid_b_len = strnlen(tid_b, tid_b_max);
 		} else
@@ -795,7 +795,7 @@ static int scst_pr_do_load_device_file(struct scst_device *dev,
 		tid = &buf[pos];
 		pos += scst_tid_size(tid);
 
-		key = get_unaligned((__be64 *)&buf[pos]);
+		key = get_unaligned_be64(&buf[pos]);
 		pos += sizeof(key);
 
 		rel_tgt_id = get_unaligned((uint16_t *)&buf[pos]);
@@ -953,7 +953,7 @@ void scst_pr_sync_device_file(struct scst_device *dev)
 	list_for_each_entry(reg, &dev->dev_registrants_list,
 			    dev_registrants_list_entry) {
 		uint8_t is_holder = 0;
-		int size;
+		uint32_t size;
 
 		is_holder = (dev->pr_holder == reg);
 
@@ -1291,11 +1291,10 @@ static int scst_pr_register_with_spec_i_pt(struct scst_cmd *cmd,
 	__be64 action_key;
 	struct scst_device *dev = cmd->dev;
 	struct scst_dev_registrant *reg;
-	uint8_t *transport_id;
 
 	scst_assert_pr_mutex_held(cmd->dev);
 
-	action_key = get_unaligned((__be64 *)&buffer[8]);
+	action_key = get_unaligned_be64(&buffer[8]);
 
 	ext_size = get_unaligned_be32(&buffer[24]);
 	if ((ext_size + 28) > buffer_size) {
@@ -1309,25 +1308,25 @@ static int scst_pr_register_with_spec_i_pt(struct scst_cmd *cmd,
 
 	offset = 0;
 	while (offset < ext_size) {
-		transport_id = &buffer[28 + offset];
+		uint8_t *const transport_id = &buffer[28 + offset];
+		const uint32_t tid_size = scst_tid_size(transport_id);
 
-		if ((offset + scst_tid_size(transport_id)) > ext_size) {
+		if (offset + tid_size > ext_size) {
 			TRACE_PR("Invalid transport_id size %d (max %d)",
-				scst_tid_size(transport_id), ext_size - offset);
+				tid_size, ext_size - offset);
 			scst_set_invalid_field_in_parm_list(cmd, 24, 0);
 			res = -EINVAL;
 			goto out;
 		}
-		tid_secure(transport_id);
-		offset += scst_tid_size(transport_id);
+		WARN_ON_ONCE(!tid_secure(transport_id, tid_size));
+		offset += tid_size;
 	}
 
 	offset = 0;
 	while (offset < ext_size) {
+		uint8_t *transport_id = &buffer[28 + offset];
 		struct scst_tgt_dev *t;
 
-		transport_id = &buffer[28 + offset];
-
 		TRACE_PR("rel_tgt_id %d, transport_id %s", rel_tgt_id,
 			debug_transport_id_to_initiator_name(transport_id));
 
@@ -1506,7 +1505,7 @@ static int scst_pr_register_on_tgt_id(struct scst_cmd *cmd,
 		__be64 action_key;
 		struct scst_dev_registrant *reg;
 
-		action_key = get_unaligned((__be64 *)&buffer[8]);
+		action_key = get_unaligned_be64(&buffer[8]);
 
 		reg = scst_pr_add_registrant(cmd->dev, cmd->sess->transport_id,
 			rel_tgt_id, action_key, false);
@@ -1681,8 +1680,8 @@ void scst_pr_register(struct scst_cmd *cmd, uint8_t *buffer, int buffer_size)
 	aptpl = buffer[20] & 0x01;
 	spec_i_pt = (buffer[20] >> 3) & 0x01;
 	all_tg_pt = (buffer[20] >> 2) & 0x01;
-	key = get_unaligned((__be64 *)&buffer[0]);
-	action_key = get_unaligned((__be64 *)&buffer[8]);
+	key = get_unaligned_be64(&buffer[0]);
+	action_key = get_unaligned_be64(&buffer[8]);
 
 	if (spec_i_pt == 0 && buffer_size != 24) {
 		TRACE_PR("Invalid buffer size %d", buffer_size);
@@ -1768,7 +1767,7 @@ void scst_pr_register_and_ignore(struct scst_cmd *cmd, uint8_t *buffer,
 
 	aptpl = buffer[20] & 0x01;
 	all_tg_pt = (buffer[20] >> 2) & 0x01;
-	action_key = get_unaligned((__be64 *)&buffer[8]);
+	action_key = get_unaligned_be64(&buffer[8]);
 
 	if (buffer_size != 24) {
 		TRACE_PR("Invalid buffer size %d", buffer_size);
@@ -1839,8 +1838,8 @@ void scst_pr_register_and_move(struct scst_cmd *cmd, uint8_t *buffer,
 	scst_assert_pr_mutex_held(cmd->dev);
 
 	aptpl = buffer[17] & 0x01;
-	key = get_unaligned((__be64 *)&buffer[0]);
-	action_key = get_unaligned((__be64 *)&buffer[8]);
+	key = get_unaligned_be64(&buffer[0]);
+	action_key = get_unaligned_be64(&buffer[8]);
 	unreg = (buffer[17] >> 1) & 0x01;
 	tid_buffer_size = get_unaligned_be32(&buffer[20]);
 
@@ -1908,7 +1907,13 @@ void scst_pr_register_and_move(struct scst_cmd *cmd, uint8_t *buffer,
 		goto out;
 	}
 
-	tid_secure(transport_id_move);
+	if (!tid_secure(transport_id_move, buffer_size - 24)) {
+		TRACE_PR("Transport ID length %d exceeds buffer size %d",
+			 scst_tid_size(transport_id_move), buffer_size - 24);
+		scst_set_cmd_error(cmd,
+			SCST_LOAD_SENSE(scst_sense_invalid_field_in_parm_list));
+		goto out;
+	}
 
 	if (dev->pr_type == TYPE_WRITE_EXCLUSIVE_ALL_REG ||
 	    dev->pr_type == TYPE_EXCLUSIVE_ACCESS_ALL_REG) {
@@ -1975,7 +1980,7 @@ void scst_pr_reserve(struct scst_cmd *cmd, uint8_t *buffer, int buffer_size)
 
 	scst_assert_pr_mutex_held(dev);
 
-	key = get_unaligned((__be64 *)&buffer[0]);
+	key = get_unaligned_be64(&buffer[0]);
 	scope = cmd->cdb[2] >> 4;
 	type = cmd->cdb[2] & 0x0f;
 
@@ -2064,7 +2069,7 @@ void scst_pr_release(struct scst_cmd *cmd, uint8_t *buffer, int buffer_size)
 
 	scst_assert_pr_mutex_held(dev);
 
-	key = get_unaligned((__be64 *)&buffer[0]);
+	key = get_unaligned_be64(&buffer[0]);
 	scope = cmd->cdb[2] >> 4;
 	type = cmd->cdb[2] & 0x0f;
 
@@ -2141,7 +2146,7 @@ void scst_pr_clear(struct scst_cmd *cmd, uint8_t *buffer, int buffer_size)
 
 	scst_assert_pr_mutex_held(dev);
 
-	key = get_unaligned((__be64 *)&buffer[0]);
+	key = get_unaligned_be64(&buffer[0]);
 
 	if (buffer_size != 24) {
 		TRACE_PR("Invalid buffer size %d", buffer_size);
@@ -2202,8 +2207,8 @@ static void scst_pr_do_preempt(struct scst_cmd *cmd, uint8_t *buffer,
 		goto out;
 	}
 
-	key = get_unaligned((__be64 *)&buffer[0]);
-	action_key = get_unaligned((__be64 *)&buffer[8]);
+	key = get_unaligned_be64(&buffer[0]);
+	action_key = get_unaligned_be64(&buffer[8]);
 	scope = cmd->cdb[2] >> 4;
 	type = cmd->cdb[2] & 0x0f;
 
@@ -2593,8 +2598,7 @@ void scst_pr_read_keys(struct scst_cmd *cmd, uint8_t *buffer, int buffer_size)
 
 			WARN_ON(reg->key == 0);
 
-			put_unaligned(reg->key,
-				(__be64 *)&buffer[offset]);
+			put_unaligned_be64(reg->key, &buffer[offset]);
 
 			offset += 8;
 		}
@@ -2651,7 +2655,7 @@ void scst_pr_read_reservation(struct scst_cmd *cmd, uint8_t *buffer,
 		b[6] = 0;
 		b[7] = 0x10;
 
-		put_unaligned(key, (__be64 *)&b[8]);
+		put_unaligned_be64(key, &b[8]);
 		b[21] = dev->pr_scope << 4 | dev->pr_type;
 
 		size = 24;
@@ -2733,16 +2737,13 @@ void scst_pr_read_full_status(struct scst_cmd *cmd, uint8_t *buffer,
 
 	list_for_each_entry(reg, &dev->dev_registrants_list,
 				dev_registrants_list_entry) {
-		int ts;
-		int rec_len;
-
-		ts = scst_tid_size(reg->transport_id);
-		rec_len = 24 + ts;
+		const uint32_t ts = scst_tid_size(reg->transport_id);
+		const uint32_t rec_len = 24 + ts;
 
 		if (size_max - size > rec_len) {
 			memset(&buffer[offset], 0, rec_len);
 
-			put_unaligned(reg->key, (__be64 *)(&buffer[offset]));
+			put_unaligned_be64(reg->key, &buffer[offset]);
 
 			if (dev->pr_is_set && scst_pr_is_holder(dev, reg)) {
 				buffer[offset + 12] = 1;

scst/src/scst_pres.h

@@ -130,7 +130,7 @@ void scst_pr_report_caps(struct scst_cmd *cmd, uint8_t *buffer, int buffer_size)
 void scst_pr_read_full_status(struct scst_cmd *cmd, uint8_t *buffer,
 	int buffer_size);
 
-int scst_tid_size(const uint8_t *tid);
+uint32_t scst_tid_size(const uint8_t *tid);
 bool tid_equal(const uint8_t *tid_a, const uint8_t *tid_b);
 
 struct scst_dev_registrant *scst_pr_find_reg(struct scst_device *dev,

usr/fileio/fileio.c

@@ -200,10 +200,12 @@ out:
 
 static void *align_alloc(size_t size)
 {
-	static uint32_t page_size;
+	static long page_size;
 
-	if (page_size == 0)
+	if (page_size == 0) {
 		page_size = sysconf(_SC_PAGESIZE);
+		assert(page_size > 0);
+	}
 
 	TRACE_MEM("Request to alloc %zdKB", size / 1024);
 	return memalign(page_size, size);