[PATCH] scsi: Fix a harmless double shift bug

2018-11-29 Thread Dan Carpenter
ble completions") Signed-off-by: Dan Carpenter --- include/scsi/scsi_cmnd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h index 3de905e205ce..d85e6befa26b 100644 --- a/include/scsi/scsi_cmnd.h +++ b/include/scsi/scsi_cm

[PATCH] scsi: bnx2fc: Fix NULL dereference in error handling

2018-10-31 Thread Dan Carpenter
If "interface" is NULL then we can't release it and trying to will only lead to an Oops. Fixes: aea71a024914 ("[SCSI] bnx2fc: Introduce interface structure for each vlan interface") Signed-off-by: Dan Carpenter --- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +- 1 file change

Re: [PATCH] scsi: lpfc: Uninitialized variable in lpfc_debugfs_nodelist_data()

2018-10-22 Thread Dan Carpenter
On Mon, Oct 22, 2018 at 08:25:49AM +0100, James Bottomley wrote: > On Mon, 2018-10-22 at 09:50 +0300, Dan Carpenter wrote: > > There was a merge problem and we accidentally removed the "nrport" > > initialization. > > > > Fixes: 77c5bf5647b5 ("Merge br

[PATCH] scsi: lpfc: Uninitialized variable in lpfc_debugfs_nodelist_data()

2018-10-22 Thread Dan Carpenter
There was a merge problem and we accidentally removed the "nrport" initialization. Fixes: 77c5bf5647b5 ("Merge branch 'misc' into for-next") Signed-off-by: Dan Carpenter --- drivers/scsi/lpfc/lpfc_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git

Re: [PATCH 3/3] scsi: myrs: prevent negatives in disable_enclosure_messages_store()

2018-10-20 Thread Dan Carpenter
On Fri, Oct 19, 2018 at 12:19:09PM +0300, Dan Carpenter wrote: > We only want the value to be zero or one. > > It's not a big deal, but say we passed set value to INT_MIN, then > disable_enclosure_messages_show() would return that 12 bytes of "buf" > are initialized bu

[bug report] scsi: myrb: Add Mylex RAID controller (block interface)

2018-10-19 Thread Dan Carpenter
sge_count = (u32)sg_dma_len(sgl); 1619 hw_sgl++; 1620 } 1621 } 1622 submit: 1623 spin_lock_irqsave(>queue_lock, flags); regards, dan carpenter

[PATCH 3/3] scsi: myrs: prevent negatives in disable_enclosure_messages_store()

2018-10-19 Thread Dan Carpenter
ak warning when that happens. Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") Signed-off-by: Dan Carpenter --- drivers/scsi/myrs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c index 07e5a3

[PATCH 2/3] scsi: myrs: Fix the processor absent message in processor_show()

2018-10-19 Thread Dan Carpenter
If both processors are absent then it's supposed to print that, but instead we print that just the second processor is absent. Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") Signed-off-by: Dan Carpenter --- drivers/scsi/myrs.c | 4 ++-- 1 file

[PATCH 1/3] scsi: myrs: Fix a logical vs bitwise bug

2018-10-19 Thread Dan Carpenter
The || was supposed to be |. The original code just sets ->result to 1. Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") Signed-off-by: Dan Carpenter --- drivers/scsi/myrs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/

[PATCH] scsi: qla2xxx: don't allow negative thresholds

2018-09-20 Thread Dan Carpenter
We shouldn't allow negative thresholds. I don't know what it would do but it can't be good. Fixes: 8b4673ba3a1b ("scsi: qla2xxx: Add support for ZIO6 interrupt threshold") Signed-off-by: Dan Carpenter diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_at

Re: [PATCH 4/6] qla2xxx_nvmet: Add FC-NVMe Target handling

2018-09-20 Thread Dan Carpenter
Hi Anil, I love your patch! Perhaps something to improve: url: https://github.com/0day-ci/linux/commits/Himanshu-Madhani/qla2xxx-Add-FC-NVMe-Target-support/20180916-090108 base: https://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git for-next smatch warnings:

[PATCH] scsi: qla2xxx: Fix an endian bug in fcpcmd_is_corrupted()

2018-09-08 Thread Dan Carpenter
We should first do the le16_to_cpu endian conversion and then apply the FCP_CMD_LENGTH_MASK mask. Fixes: 5f35509db179 ("qla2xxx: Terminate exchange if corrupted") Signed-off-by: Dan Carpenter --- I just happened to spot this when I was reviewing something unrelated. I don't have th

[bug report] Linux-2.6.12-rc2

2018-08-28 Thread Dan Carpenter
ags*/0, _data->sg_dmat) != 0) { 6461 goto error_exit; 6462 } regards, dan carpenter

[PATCH] scsi: aacraid: fix a signednes bug

2018-08-27 Thread Dan Carpenter
The problem is that ->reset_state is a u8 but it can be set to -1 or -2 in aac_tmf_callback() and the error handling in aac_eh_target_reset() relies on it to be signed. Fixes: 0d643ff3c353 ("scsi: aacraid: use aac_tmf_callback for reset fib") Signed-off-by: Dan Carpenter diff --

[PATCH] scsi: lpfc: remove an unnecessary NULL check

2018-08-23 Thread Dan Carpenter
Smatch complains about this code: drivers/scsi/lpfc/lpfc_scsi.c:1053 lpfc_get_scsi_buf_s4() warn: variable dereferenced before check 'lpfc_cmd' (see line 1039) Fortunately the NULL check isn't required so I have removed it. Signed-off-by: Dan Carpenter diff --git a/drivers/scsi/lpfc

[PATCH v2] scsi: aic94xx: fix an error code in aic94xx_init()

2018-08-08 Thread Dan Carpenter
We accidentally return success instead of -ENOMEM on this error path. Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver") Signed-off-by: Dan Carpenter --- v2: return -ENOMEM instead of -ENODEV diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_in

Re: [PATCH] scsi: aic94xx: fix an error code in aic94xx_init()

2018-08-08 Thread Dan Carpenter
On Wed, Aug 08, 2018 at 03:16:57PM +0100, John Garry wrote: > On 08/08/2018 12:56, Dan Carpenter wrote: > > We accidentally return success instead of -ENODEV on this error path. > > Sorry to nitpick, but - as I see - the only way for > sas_domain_attach_transport() to fail

[PATCH] scsi: aic94xx: fix an error code in aic94xx_init()

2018-08-08 Thread Dan Carpenter
We accidentally return success instead of -ENODEV on this error path. Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver") Signed-off-by: Dan Carpenter diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c index 80e5b283fd81..cb8191afc1dc 100644 ---

[bug report] scsi: qla2xxx: Migrate NVME N2N handling into state machine

2018-08-07 Thread Dan Carpenter
sp->free(sp); 2646 } 2647 e->u.iosb.sp = sp; Dereference without checking 2648 qla2x00_post_work(vha, e); 2649 } regards, dan carpenter

[bug report] scsi: libfc: Add lockdep annotations

2018-07-12 Thread Dan Carpenter
F_RES; 1859 goto reject; 1860 } regards, dan carpenter

[PATCH] scsi: qedi: tidy up a size caculation

2018-06-28 Thread Dan Carpenter
n't change runtime, but this is the more idiomatic way to do it and makes the static checker happy. Signed-off-by: Dan Carpenter diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c index cf274a79e77a..682f3ce31014 100644 --- a/drivers/scsi/qedi/qedi_main.c +++ b/drivers/scsi/q

Re: [PATCH 2/3] tcmu: track nl commands

2018-06-23 Thread Dan Carpenter
Hi Mike, Thank you for the patch! Perhaps something to improve: url: https://github.com/0day-ci/linux/commits/Mike-Christie/tcmu-fix-hung-netlink-requests-during-restarts/20180622-115832 smatch warnings: drivers/target/target_core_user.c:301 tcmu_genl_cmd_done() warn: KERN_* level not at

Re: qla2xxx and smatch warnings about uninitialized variables

2018-06-22 Thread Dan Carpenter
ings? > Or we could silence a lot of them by adding "qla8044_rd_reg_indirect 2" to the smatch_data/kernel.ignore_uninitialized_param file. regards, dan carpenter

[bug report] qedi: Add support for populating ethernet TLVs.

2018-06-22 Thread Dan Carpenter
;target[index].ipv6_addr.byte); 899 else 900 snprintf(tgt->ip_addr, IPV4_LEN, "%pI4\n", 901 block->target[index].ipv4_addr.byte); 902 } regards, dan carpenter

[bug report] csiostor:T5 Firmware fix and cleanup.

2018-06-20 Thread Dan Carpenter
goto bye; 2023 regards, dan carpenter

Re: [PATCH] scsi: qlogicpti: Fix an error handling path in 'qpti_sbus_probe()'

2018-05-10 Thread Dan Carpenter
m not 100% sure if correct. Looks good to me. Reviewed-by: Dan Carpenter <dan.carpen...@oracle.com> regards, dan carpenter

[bug report] scsi: qlogicfas: move bus_reset to host_reset

2018-05-03 Thread Dan Carpenter
reset() doesn't take NULL pointers, it's just going to crash. 268 269 return 0; 270 } regards, dan carpenter

[PATCH] scsi: megaraid: silence a static checker bug

2018-05-03 Thread Dan Carpenter
If we had more than 32 megaraid cards then it would cause memory corruption. That's not likely, of course, but it's handy to enforce it and make the static checker happy. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c

Re: [PATCH 03/39] proc: introduce proc_create_seq_private

2018-04-19 Thread Dan Carpenter
cwdev_iter), > + NULL); > if (!entry) > return -ENOENT; > return 0; regards, dan carpenter

[PATCH v2] scsi: cxgb4i: silence overflow warning in t4_uld_rx_handler()

2018-04-03 Thread Dan Carpenter
e so it's not going to overflow unless there is a firmware bug. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> --- v2: rebase, and re-write commit message diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c index 406e94312d4e..beb146b7c17c 100644 ---

Re: [PATCH] scsi: cxgb4i: potential array overflow in t4_uld_rx_handler()

2018-03-28 Thread Dan Carpenter
On Wed, Mar 28, 2018 at 09:14:25PM +0530, Varun Prakash wrote: > On Wed, Mar 21, 2018 at 09:12:00PM -0400, Martin K. Petersen wrote: > > > > Varun: Please look at this. Thanks! > > > > > What happened to this one? > > > > > > regards, > >

[PATCH] scsi: dpt_i2o: Use after free in I2ORESETCMD ioctl

2018-03-21 Thread Dan Carpenter
Here is another use after free if we reset the card. The adpt_hba_reset() function frees "pHba" on error. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c index 3c667b23a801..359e0acfbc7c 100644 --- a/driver

Re: [PATCH 1/2] scsi: dpt_i2o: use after free in adpt_release()

2018-03-20 Thread Dan Carpenter
Yeah. You're right. Thanks for catching that. regards, dan carpenter

[PATCH 1/2] scsi: dpt_i2o: use after free in adpt_release()

2018-03-19 Thread Dan Carpenter
The scsi_host_put() function frees "pHba" and then we dereference it on the next line when we do "scsi_host_put(pHba->host);". Fixes: 38e09e3bb056 ("scsi: dpt_i2o: stop using scsi_unregister") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff -

Re: [PATCH] scsi: cxgb4i: potential array overflow in t4_uld_rx_handler()

2018-03-15 Thread Dan Carpenter
What happened to this one? regards, dan carpenter On Wed, Nov 29, 2017 at 02:42:20PM +0300, Dan Carpenter wrote: > The story is that Smatch marks skb->data as untrusted and so it > complains about this code: > > drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:2111 t4_uld_rx_handler(

[bug report] scsi: lpfc: Add WQ Full Logic for NVME Target

2018-03-07 Thread Dan Carpenter
ctxp->oxid); 918 else 919 lpfc_nvmet_sol_fcp_issue_abort(phba, ctxp, ctxp->sid, 920 ctxp->oxid); 921 spin_unlock_irqrestore(>ctxlock, flags); 922 } regards, dan carpenter

Re: [0/8] target-iSCSI: Adjustments for several function implementations

2018-02-23 Thread Dan Carpenter
04e81ee95e155e9043132#n751 > > static inline struct crypto_tfm *crypto_shash_tfm(struct crypto_shash *tfm) > { > return >base; > } Yes. It's not a dereference, it's just doing pointer math to get the address. regards, dan carpenter

[PATCH 2/2] scsi: myrs: bitwise vs logical OR typo

2018-02-20 Thread Dan Carpenter
We accidentally used a logical || instead of a | so these bit masks are off. Fixes: 8a8606895947 ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c in

[PATCH 1/2] scsi: myrs: cleanup myrs_store_suppress_enclosure_messages()

2018-02-20 Thread Dan Carpenter
This code causes a static checker because we have an upper bound on "value" but not a lower bound. In other words "value" can be s32min-2. It's harmless but really it should just be bool. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/

[patch RESEND] atp870u: 64 bit bug in atp885_init()

2018-02-14 Thread Dan Carpenter
On 64 bit CPUs there is a memory corruption bug on probe(). It should be a u32 pointer instead of an unsigned long pointer or we write past the end of the setupdata[] array. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> Reviewed-by: Hannes Reinecke <h...@suse.com> --- I w

[bug report] scsi: myrs: Add Mylex RAID controller (SCSI interface)

2018-02-13 Thread Dan Carpenter
uf); 2244 if (status == DAC960_V2_NormalCompletion) { 2245 myrs_log_event(cs, cs->event_buf); 2246 cs->next_evseq++; And I guess this is where we set cs->next_evseq. 2247 interval = 1; 2248 } 2249 } regards, dan carpenter

[PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo()

2018-01-25 Thread Dan Carpenter
My static checker complains about an out of bounds read: drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo() error: buffer overflow 'hd->sel_timeout' 255 <= u32max. It's true that we probably should have a bounds check here. Signed-off-by: Dan Carpenter <dan.carpen...@o

[PATCH] [SCSI] sym53c8xx_2: iterator underflow in sym_getsync()

2018-01-25 Thread Dan Carpenter
We wanted to exit the loop with "div" set to zero, but instead, if we don't hit the break then "div" is -1 when we finish the loop. It leads to an array underflow a few lines later. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi

[PATCH] scsi: storvsc: missing error code in storvsc_probe()

2018-01-16 Thread Dan Carpenter
We should set the error code if fc_remote_port_add() fails. Fixes: daf0cd445a21 ("scsi: storvsc: Add support for FC rport.") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index 3b3d1d050cac..40f

[bug report] scsi: qla2xxx: Fix NULL pointer access for fcport structure

2018-01-09 Thread Dan Carpenter
^^^ But there is an unchecked NULL dereference here. 131 break; 132 case SRB_LOGOUT_CMD: regards, dan carpenter

[bug report] scsi: qla2xxx: Fix memory leak in dual/target mode

2017-12-14 Thread Dan Carpenter
qla25xx_free_rsp_que(vha, rsp); ^^^ 603 604 return ret; regards, dan carpenter regards, dan carpenter

[bug report] scsi: lpfc: Correct driver deregistrations with host nvme transport

2017-12-14 Thread Dan Carpenter
SY flag to prevent double completions. 971 * The nvme rport is getting unregistered and there is regards, dan carpenter

[bug report] scsi: arcmsr: Add a function to set date and time to firmware

2017-12-09 Thread Dan Carpenter
400 * days; 3682 if (secs < 0) { Not possible. 3683 days = days - 1; 3684 secs = secs + 86400; 3685 } 3686 j = days / 146097; regards, dan carpenter

[PATCH] scsi: cxgb4i: potential array overflow in t4_uld_rx_handler()

2017-11-29 Thread Dan Carpenter
arning message. Let's address it by adding a sanity check to make sure "opc" is within bounds. Fixes: bbc02c7e9d34 ("cxgb4: Add register, message, and FW definitions") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4

Re: [PATCH 0/3] scsi: arcmsr: add driver module parameter - msi_enable, msix_enable

2017-11-24 Thread Dan Carpenter
the question is we're adding an option called "msi_enable" which is used to disable MSI interrupts "if it does not work properly". Why is the current code not working properly? Is there a crash or a performance issue? What does the bug in the current code look like from a user perspective? Can you send us a dmesg from a failing system? regards, dan carpenter

Re: [PATCH 2/3] scsi: arcmsr: Add driver module parameter msix_enable

2017-11-23 Thread Dan Carpenter
tiful, but I can't actually apply this patch? Which tree is this written against? I'm using linux-next. regards, dan carpenter

Re: [PATCH 1/3] scsi: arcmsr: Add driver module parameter msi_enable

2017-11-23 Thread Dan Carpenter
nfo(>dev, for a start. I know that the other prints don't use this, but we could use it one time then slowly add more users until more are using dev_info() than pr_info() and then someone will decide to clean up the old users. regards, dan carpenter

[PATCH] scsi: lpfc: Use after free in lpfc_rq_buf_free()

2017-11-22 Thread Dan Carpenter
The error message dereferences "rqb_entry" so we need to print it first and then free the buffer. Fixes: 6c621a2229b0 ("scsi: lpfc: Separate NVMET RQ buffer posting from IO resources SGL/iocbq/context") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff

Re: [PATCH 4/4] qla2xxx_nvmet: Add FC-NVMe Target handling

2017-11-13 Thread Dan Carpenter
[ Ha ha. The kbuild-bot automatically inserts complimentary things that "I love your patch." In fact, I have not looked at your patch at all, I'm just forwarding this email from a robot after glancing at the code. - dan carpenter ] Hi Anil, I love your patch! Perhaps

[PATCH 2/2] tcmu: Add a missing unlock on an error path

2017-11-08 Thread Dan Carpenter
We added a new error path here but we forgot to drop the lock first before returning. Fixes: 0d44374c1aae ("tcmu: fix double se_cmd completion") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/target/target_core_user.c b/drivers/target/target_c

[PATCH 1/2] tcmu: Fix some memory corruption

2017-11-08 Thread Dan Carpenter
"udev->nl_reply_supported" is an int but on 64 bit arches we are writing 8 bytes of data to it so it corrupts four bytes beyond the end of the struct. Fixes: b849b4567549 ("target: Add netlink command reply supported option for each device") Signed-off-by: Dan Carpenter &l

[patch 2/2] scsi: mpt3sas: remove a stray KERN_INFO

2017-11-08 Thread Dan Carpenter
pr_info() has a KERN_INFO already so the second KERN_INFO isn't needed. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c index 3a9438a1704e..b258f210120a 100644 --- a/drivers/scsi/m

[PATCH 1/2] scsi: mpt3sas: cleanup _scsih_pcie_enumeration_event()

2017-11-08 Thread Dan Carpenter
NVMe PCIe device related events generated from firmware.") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c index 3a9438a1704e..93b45e618edb 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_scsih

Re: [bug report] scsi: mpt3sas: Added support for nvme encapsulated request message.

2017-11-08 Thread Dan Carpenter
a 4 byte array, but it's clearly not. You're saying it's supposed to be a single dword array but why??? Is there something special and mandatory stored in the first 4 bytes? Why can't it just be a zero size array? It would help if there were at least a comment or something. regards, dan carpenter

[PATCH] scsi: hpsa: remove an unecessary NULL check

2017-11-07 Thread Dan Carpenter
device->scsi3addr[] is an array, not a pointer, so it can't be NULL. I've removed the check. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c index 287e5eb0723f..b0aa5dc1d54c 100644 --- a/drivers/scsi/hpsa.c +++ b/drivers/sc

[bug report] scsi: mpt3sas: Added support for nvme encapsulated request message.

2017-11-07 Thread Dan Carpenter
e the specially allocated buffer of 1465 * contiguous memory. 1466 */ 1467 prp_page = (__le64 *)mpt3sas_base_get_pcie_sgl(ioc, smid); 1468 prp_page_phys = (__le64 *)mpt3sas_base_get_pcie_sgl_dma(ioc, smid); 1469 regards, dan carpenter

Re: integer overflow in aic7xxx (was [bug report] Linux-2.6.12-rc2)

2017-10-17 Thread Dan Carpenter
Argh... My script chose a stupid subject. Sorry for not catching that. regards, dan carpenter On Wed, Oct 18, 2017 at 12:52:49AM +0300, Dan Carpenter wrote: > Hey, > > This code is older than git is so it probably doesn't matter. But just > for laughs does anyone know what

[bug report] Linux-2.6.12-rc2

2017-10-17 Thread Dan Carpenter
data->init_level++; 4819 regards, dan carpenter

[PATCH] scsi: lpfc: Fix a precedence bug in lpfc_nvme_io_cmd_wqe_cmpl()

2017-10-12 Thread Dan Carpenter
The ! has higher precedence than the & operation. I've added parenthesis so this works as intended. Fixes: 952c303b329c ("scsi: lpfc: Ensure io aborts interlocked with the target.") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/lpfc/l

[PATCH] [SCSI] bfa: integer overflow in debugfs

2017-10-04 Thread Dan Carpenter
t;bna: integer overflow bug in debugfs"). Fixes: ab2a9ba189e8 ("[SCSI] bfa: add debugfs support") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/bfa/bfad_debugfs.c b/drivers/scsi/bfa/bfad_debugfs.c index 8dcd8c70c7ee..05f523971348 100644 --

[bug report] [SCSI] lpfc: NPIV: add NPIV support on top of SLI-3

2017-09-13 Thread Dan Carpenter
spin_unlock_irq(shost->host_lock); 6199 vport->fc_rscn_id_list[vport->fc_rscn_id_cnt++] = pcmd; ^^^^^^^ But here we don't check here. It feels like we should be checking on this path as well. 6200 /* Indicate we are done walking fc_rscn_id_list on this vport */ 6201 vport->fc_rscn_flush = 0; regards, dan carpenter

[PATCH] mpt3sas: Fix a double unlock in _transport_smp_handler()

2017-09-08 Thread Dan Carpenter
bsg-lib for SMP passthrough") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> --- I'm not totally sure about the .status thing. This is a static checker fix. diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index d3940c5d

Re: Buffer overflow in the mptctl_replace_fw() function in linux kernel MPT ioctl driver

2017-09-01 Thread Dan Carpenter
_total += size; But ->alloc_total is not used anywhere. I don't see a buffer overflow here. regards, dan carpenter

[PATCH v2] scsi: qla2xxx: Fix an integer overflow in sysfs code

2017-08-30 Thread Dan Carpenter
w region-based flash-part accesses.") Reported-by: shqking <shqk...@gmail.com> Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> --- v2: Add stable and the URL for bugzila diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c index 75c4b312645e..9ce28c4f9812

Re: [PATCH] scsi: qla2xxx: Fix an integer overflow in sysfs code

2017-08-30 Thread Dan Carpenter
On Wed, Aug 30, 2017 at 08:28:52PM +0800, shqking wrote: > Hi, > > Glad to see it is fixed. > > Can I apply for a CVE ID for this bug? > We don't handle that on this list. You'd need to ask on oss-secur...@lists.openwall.com. regards, dan carpenter

[PATCH] scsi: qla2xxx: Fix an integer overflow in sysfs code

2017-08-30 Thread Dan Carpenter
rs. So we would get memory corruption and likely a crash when we call ha->isp_ops->write_optrom() and ->read_optrom(). Only root can trigger this bug. Fixes: b7cc176c9eb3 ("[SCSI] qla2xxx: Allow region-based flash-part accesses.") Reported-by: shqking <shqk...@gmail.com

[PATCH] scsi: qedi: off by one in qedi_get_cmd_from_tid()

2017-08-25 Thread Dan Carpenter
The > here should be >= or we end up reading one element beyond the end of the qedi->itt_map[] array. The qedi->itt_map[] array is allocated in qedi_alloc_itt(). Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.") Signed-off-by: Dan

[bug report] scsi: qla2xxx: Cleanup NPIV host in target mode during config teardown

2017-08-24 Thread Dan Carpenter
mutex_lock(_tgt_mutex); 1553 list_del(>vha_tgt.qla_tgt->tgt_list_entry);\ The patch adds a new dereference. 1554 mutex_unlock(_tgt_mutex); 1555 regards, dan carpenter

[bug report] scsi: lpfc: Fix handling of FCP and NVME FC4 types in Pt2Pt topology

2017-08-24 Thread Dan Carpenter
^ We added a new unchecked dereference. 2011 spin_unlock_irq(shost->host_lock); 2012 regards, dan carpenter

[PATCH] scsi: hpsa: fix the device_id in hpsa_update_device_info()

2017-08-17 Thread Dan Carpenter
The parentheses are in the wrong place so we specify the length as "sizeof(this_device->device_id) < 0" which is zero. Fixes: 988b87edd231 ("scsi: hpsa: Ignore errors for unsupported LV_DEVICE_ID VPD page") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com>

[PATCH] scsi: sg: off by one in sg_ioctl()

2017-08-17 Thread Dan Carpenter
If "val" is SG_MAX_QUEUE then we are one element beyond the end of the "rinfo" array so the > should be >=. Fixes: 109bade9c625 ("scsi: sg: use standard lists for sg_requests") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/d

[PATCH] scsi: osst: silence underflow warning in osst_verify_frame()

2017-08-04 Thread Dan Carpenter
{ If i is negative then it's less than OS_FM_TAB_MAX so we read before the start of the STp->header_cache->dat_fm_tab.fm_tab_ent[] array. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> --- There is a second static checker warning that I didn't know how to address: drivers/scs

[PATCH] tcmu: Oops in unmap_thread_fn()

2017-08-01 Thread Dan Carpenter
Calling list_del() on the iterator pointer in list_for_each_entry() will cause an oops. We need to user the _safe() version for that. Fixes: c73d02f63c16 ("tcmu: Add fifo type waiter list support to avoid starvation") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff

Re: [PATCH 2/2] scsi: aacraid: Off by one NUL terminator

2017-07-27 Thread Dan Carpenter
It would be simple enough to write it like you say, but it probably should be done by someone who is able to test it. regards, dan carpenter

[PATCH 2/2] scsi: aacraid: Off by one NUL terminator

2017-07-25 Thread Dan Carpenter
pport"). The relevant section is "Also fix up a name truncation problem". Can someone review this code and figure out the right thing to do? Fixes: b836439faf04 ("aacraid: 4KB sector support") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/

[PATCH 1/2] scsi: aacraid: reading out of bounds

2017-07-25 Thread Dan Carpenter
"qd.id" comes directly from the copy_from_user() on the line before so we should verify that it's within bounds. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> --- This bug predates git. diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c in

Re: [bug report] scsi: sg: fix SG_DXFER_FROM_DEV transfers

2017-07-14 Thread Dan Carpenter
On Fri, Jul 14, 2017 at 11:01:11AM +0200, Johannes Thumshirn wrote: > On Fri, Jul 14, 2017 at 10:46:03AM +0300, Dan Carpenter wrote: > >761 case SG_DXFER_FROM_DEV: > >762 if (hp->dxfer_len < 0) > > ^^^

[bug report] scsi: sg: fix SG_DXFER_FROM_DEV transfers

2017-07-14 Thread Dan Carpenter
xfer_len and I noticed that the documentation for hp->resid is wrong. It says: int resid; /* [o] dxfer_len - actual_transferred */ My guess is that resid stands for Response ID but I'm not positive. regards, dan carpenter

[PATCH] scsi: qedi: Fix return code in qedi_ep_connect()

2017-07-12 Thread Dan Carpenter
We shouldn't be writing over the "ret" variable. It means we return ERR_PTR(0) which is NULL and it results in a NULL dereference in the caller. Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.") Signed-off-by: Dan Carpenter <dan.carp

[PATCH] scsi: libfc: pass an error pointer to fc_disc_error()

2017-07-12 Thread Dan Carpenter
an error pointer. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c index fd501f8dbb11..8660f923ace0 100644 --- a/drivers/scsi/libfc/fc_disc.c +++ b/drivers/scsi/libfc/fc_disc.c @@ -573,7 +573,7 @@ stati

[PATCH] scsi: qla2xxx: Off by one in qlt_ctio_to_cmd()

2017-07-10 Thread Dan Carpenter
There are "req->num_outstanding_cmds" elements in the req->outstanding_cmds[] array so the > here should be >=. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c index 6e479

Re: [patch] scsi: qedi: silence sprintf() overflow warning

2017-07-07 Thread Dan Carpenter
On Tue, Feb 07, 2017 at 02:27:09PM +0100, walter harms wrote: > > > Am 07.02.2017 14:01, schrieb Dan Carpenter: > > The problem here is this: > > > > sprintf(host_buf, "qedi_ofld%d", qedi->shost->host_no); > > > > host_buf is 16 charac

[PATCH 2/2] scsi: lpfc: don't double count abort errors

2017-06-30 Thread Dan Carpenter
If lpfc_nvmet_unsol_fcp_issue_abort() fails then we accidentally increment "tgtp->xmt_abort_rsp_error" and then two lines later we increment it a second time. Fixes: 547077a44b3b ("scsi: lpfc: Adding additional stats counters for nvme.") Signed-off-by: Dan Carpenter &l

[PATCH 1/2] scsi: lpfc: spin_lock_irq() is not nestable

2017-06-30 Thread Dan Carpenter
We're calling spin_lock_irq() multiple times, the problem is that on the first spin_unlock_irq() then we will re-enable IRQs and we don't want that. Fixes: 966bb5b71196 ("scsi: lpfc: Break up IO ctx list into a separate get and put list") Signed-off-by: Dan Carpenter <dan.carpen.

[PATCH] cxlflash: return -EFAULT if copy_from_user() fails

2017-06-30 Thread Dan Carpenter
The copy_from/to_user() functions return the number of bytes remaining to be copied but we had intended to return -EFAULT here. Fixes: bc88ac47d5cb ("scsi: cxlflash: Support AFU debug") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/cxlflash/

Re: [PATCH] scsi: hisi_sas: silence a static checker warning

2017-06-23 Thread Dan Carpenter
On Fri, Jun 23, 2017 at 04:25:27PM +0100, John Garry wrote: > On 23/06/2017 16:15, Dan Carpenter wrote: > > phy->phy_type is a u64. We only ever use the first two bits so it's a > > bit over kill perhaps. > > Hi Dan, > > Right, u64 is unneeded and u32 would

[PATCH] scsi: hisi_sas: silence a static checker warning

2017-06-23 Thread Dan Carpenter
nintentionally clear the high 32 bits as well. Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h index 4fc23087a939..b23245aeab74 100644 --- a/drivers/scsi/hisi_sas/hisi_sas.h +++ b/drivers/scsi/hisi_sas

[PATCH] bnx2i: missing error code in bnx2i_ep_connect()

2017-06-23 Thread Dan Carpenter
If bnx2i_map_ep_dbell_regs() then we accidentally return NULL instead of an error pointer. It results in a NULL dereference in iscsi_if_ep_connect(). Fixes: cf4e6363859d ("[SCSI] bnx2i: Add bnx2i iSCSI driver.") Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --gi

Re: [PATCH RESEND] Eliminate extra 'out_free' label from fcoe_init function

2017-06-02 Thread Dan Carpenter
> + mutex_unlock(_config_mutex); > > + > > if (rc) > > - goto out_free; > > + goto out_destroy; > > > > - mutex_unlock(_config_mutex); > > return 0; > > > if you do that, why not > if (!rc) return 0; Gar... No. Please don't get creative with the last if statement. regards, dan carpenter

Re: [PATCH RESEND] Eliminate extra 'out_free' label from fcoe_init function

2017-06-02 Thread Dan Carpenter
I'm fine with this version... regards, dan carpenter

Re: [PATCH] Remove an extra out label in _fcoe_create function

2017-06-02 Thread Dan Carpenter
^ This is the same as "return 0;" and I guess it's supposed to be a success return? But it would look more clear if we changed it to return a literal instead of rc. 2297 } 2298 2299 out_nodev: 2300 rtnl_unlock(); regards, dan carpenter

Re: [PATCH] Eliminate extra 'out_free' label from fcoe_init function

2017-06-01 Thread Dan Carpenter
s to spaghetti code and it's confusing. Please never do this again. The original is correct and the new code is bad rubbish code. regards, dan carpenter

Re: [PATCH] scsi: lpfc: fix spelling mistake "entrys" -> "entries"

2017-06-01 Thread Dan Carpenter
On Fri, May 26, 2017 at 11:11:37AM +0100, Colin King wrote: > From: Colin Ian King <colin.k...@canonical.com> > > Trivial fix to spelling mistake in debugfs message > Are you using a tool to find all these spelling mistakes? regards, dan carpenter

Re: [PATCH] scsi: qla4xxx: check for null return from iscsi_lookup_endpoint

2017-05-08 Thread Dan Carpenter
This should be CC'd to qlogic-storage-upstr...@qlogic.com as well. regards, dan carpenter On Sun, May 07, 2017 at 10:30:20PM +0100, Colin King wrote: > From: Colin Ian King <colin.k...@canonical.com> > > iscsi_lookup_endpoint can potentially return null and in 9 out of

[bug report] scsi: cxlflash: Add hardware queues attribute

2017-05-04 Thread Dan Carpenter
NMAP_THREE, k); 721 722 if (cfg->afu) But the existing code assumed it could be NULL. Presumably it can't? 723 stop_afu(cfg); 724 regards, dan carpenter

  1   2   3   4   5   >