Skip to content

Commit edeee68

Browse files
torvaldstorvalds
committed
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley: "All fixes in drivers. The largest diffstat in ufs is caused by the doc update with the next being the qcom null pointer deref fix" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: ufs-qcom: Fix ESI null pointer dereference scsi: ufs: core: Rename ufshcd_wait_for_doorbell_clr() scsi: ufs: core: Fix the return value documentation scsi: ufs: core: Remove WARN_ON_ONCE() call from ufshcd_uic_cmd_compl() scsi: ufs: core: Fix IRQ lock inversion for the SCSI host lock scsi: qla4xxx: Prevent a potential error pointer dereference scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake scsi: fnic: Remove a useless struct mempool forward declaration
2 parents afd5877 + 6300d5c commit edeee68

File tree

5 files changed

+62
-58
lines changed

5 files changed

+62
-58
lines changed

‎drivers/scsi/fnic/fnic.h‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -323,8 +323,6 @@ enum fnic_state {
323323
FNIC_IN_ETH_TRANS_FC_MODE,
324324
};
325325

326-
struct mempool;
327-
328326
enum fnic_role_e {
329327
FNIC_ROLE_FCP_INITIATOR = 0,
330328
};

‎drivers/scsi/qla4xxx/ql4_os.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6606,6 +6606,8 @@ static struct iscsi_endpoint *qla4xxx_get_ep_fwdb(struct scsi_qla_host *ha,
66066606

66076607
ep = qla4xxx_ep_connect(ha->host, (struct sockaddr *)dst_addr, 0);
66086608
vfree(dst_addr);
6609+
if (IS_ERR(ep))
6610+
return NULL;
66096611
return ep;
66106612
}
66116613

‎drivers/ufs/core/ufshcd.c‎

Lines changed: 44 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1303,7 +1303,7 @@ static u32 ufshcd_pending_cmds(struct ufs_hba *hba)
13031303
*
13041304
* Return: 0 upon success; -EBUSY upon timeout.
13051305
*/
1306-
static int ufshcd_wait_for_doorbell_clr(struct ufs_hba *hba,
1306+
static int ufshcd_wait_for_pending_cmds(struct ufs_hba *hba,
13071307
u64 wait_timeout_us)
13081308
{
13091309
int ret = 0;
@@ -1431,7 +1431,7 @@ static int ufshcd_clock_scaling_prepare(struct ufs_hba *hba, u64 timeout_us)
14311431
down_write(&hba->clk_scaling_lock);
14321432

14331433
if (!hba->clk_scaling.is_allowed ||
1434-
ufshcd_wait_for_doorbell_clr(hba, timeout_us)) {
1434+
ufshcd_wait_for_pending_cmds(hba, timeout_us)) {
14351435
ret = -EBUSY;
14361436
up_write(&hba->clk_scaling_lock);
14371437
mutex_unlock(&hba->wb_mutex);
@@ -3199,7 +3199,8 @@ ufshcd_dev_cmd_completion(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
31993199
}
32003200

32013201
/*
3202-
* Return: 0 upon success; < 0 upon failure.
3202+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
3203+
* < 0 if another error occurred.
32033204
*/
32043205
static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba,
32053206
struct ufshcd_lrb *lrbp, int max_timeout)
@@ -3275,7 +3276,6 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba,
32753276
}
32763277
}
32773278

3278-
WARN_ONCE(err > 0, "Incorrect return value %d > 0\n", err);
32793279
return err;
32803280
}
32813281

@@ -3294,7 +3294,8 @@ static void ufshcd_dev_man_unlock(struct ufs_hba *hba)
32943294
}
32953295

32963296
/*
3297-
* Return: 0 upon success; < 0 upon failure.
3297+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
3298+
* < 0 if another error occurred.
32983299
*/
32993300
static int ufshcd_issue_dev_cmd(struct ufs_hba *hba, struct ufshcd_lrb *lrbp,
33003301
const u32 tag, int timeout)
@@ -3317,7 +3318,8 @@ static int ufshcd_issue_dev_cmd(struct ufs_hba *hba, struct ufshcd_lrb *lrbp,
33173318
* @cmd_type: specifies the type (NOP, Query...)
33183319
* @timeout: timeout in milliseconds
33193320
*
3320-
* Return: 0 upon success; < 0 upon failure.
3321+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
3322+
* < 0 if another error occurred.
33213323
*
33223324
* NOTE: Since there is only one available tag for device management commands,
33233325
* it is expected you hold the hba->dev_cmd.lock mutex.
@@ -3363,6 +3365,10 @@ static inline void ufshcd_init_query(struct ufs_hba *hba,
33633365
(*request)->upiu_req.selector = selector;
33643366
}
33653367

3368+
/*
3369+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
3370+
* < 0 if another error occurred.
3371+
*/
33663372
static int ufshcd_query_flag_retry(struct ufs_hba *hba,
33673373
enum query_opcode opcode, enum flag_idn idn, u8 index, bool *flag_res)
33683374
{
@@ -3383,7 +3389,6 @@ static int ufshcd_query_flag_retry(struct ufs_hba *hba,
33833389
dev_err(hba->dev,
33843390
"%s: query flag, opcode %d, idn %d, failed with error %d after %d retries\n",
33853391
__func__, opcode, idn, ret, retries);
3386-
WARN_ONCE(ret > 0, "Incorrect return value %d > 0\n", ret);
33873392
return ret;
33883393
}
33893394

@@ -3395,7 +3400,8 @@ static int ufshcd_query_flag_retry(struct ufs_hba *hba,
33953400
* @index: flag index to access
33963401
* @flag_res: the flag value after the query request completes
33973402
*
3398-
* Return: 0 for success; < 0 upon failure.
3403+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
3404+
* < 0 if another error occurred.
33993405
*/
34003406
int ufshcd_query_flag(struct ufs_hba *hba, enum query_opcode opcode,
34013407
enum flag_idn idn, u8 index, bool *flag_res)
@@ -3451,7 +3457,6 @@ int ufshcd_query_flag(struct ufs_hba *hba, enum query_opcode opcode,
34513457

34523458
out_unlock:
34533459
ufshcd_dev_man_unlock(hba);
3454-
WARN_ONCE(err > 0, "Incorrect return value %d > 0\n", err);
34553460
return err;
34563461
}
34573462

@@ -3464,8 +3469,9 @@ int ufshcd_query_flag(struct ufs_hba *hba, enum query_opcode opcode,
34643469
* @selector: selector field
34653470
* @attr_val: the attribute value after the query request completes
34663471
*
3467-
* Return: 0 upon success; < 0 upon failure.
3468-
*/
3472+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
3473+
* < 0 if another error occurred.
3474+
*/
34693475
int ufshcd_query_attr(struct ufs_hba *hba, enum query_opcode opcode,
34703476
enum attr_idn idn, u8 index, u8 selector, u32 *attr_val)
34713477
{
@@ -3513,7 +3519,6 @@ int ufshcd_query_attr(struct ufs_hba *hba, enum query_opcode opcode,
35133519

35143520
out_unlock:
35153521
ufshcd_dev_man_unlock(hba);
3516-
WARN_ONCE(err > 0, "Incorrect return value %d > 0\n", err);
35173522
return err;
35183523
}
35193524

@@ -3528,8 +3533,9 @@ int ufshcd_query_attr(struct ufs_hba *hba, enum query_opcode opcode,
35283533
* @attr_val: the attribute value after the query request
35293534
* completes
35303535
*
3531-
* Return: 0 for success; < 0 upon failure.
3532-
*/
3536+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
3537+
* < 0 if another error occurred.
3538+
*/
35333539
int ufshcd_query_attr_retry(struct ufs_hba *hba,
35343540
enum query_opcode opcode, enum attr_idn idn, u8 index, u8 selector,
35353541
u32 *attr_val)
@@ -3551,12 +3557,12 @@ int ufshcd_query_attr_retry(struct ufs_hba *hba,
35513557
dev_err(hba->dev,
35523558
"%s: query attribute, idn %d, failed with error %d after %d retries\n",
35533559
__func__, idn, ret, QUERY_REQ_RETRIES);
3554-
WARN_ONCE(ret > 0, "Incorrect return value %d > 0\n", ret);
35553560
return ret;
35563561
}
35573562

35583563
/*
3559-
* Return: 0 if successful; < 0 upon failure.
3564+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
3565+
* < 0 if another error occurred.
35603566
*/
35613567
static int __ufshcd_query_descriptor(struct ufs_hba *hba,
35623568
enum query_opcode opcode, enum desc_idn idn, u8 index,
@@ -3615,7 +3621,6 @@ static int __ufshcd_query_descriptor(struct ufs_hba *hba,
36153621
out_unlock:
36163622
hba->dev_cmd.query.descriptor = NULL;
36173623
ufshcd_dev_man_unlock(hba);
3618-
WARN_ONCE(err > 0, "Incorrect return value %d > 0\n", err);
36193624
return err;
36203625
}
36213626

@@ -3632,7 +3637,8 @@ static int __ufshcd_query_descriptor(struct ufs_hba *hba,
36323637
* The buf_len parameter will contain, on return, the length parameter
36333638
* received on the response.
36343639
*
3635-
* Return: 0 for success; < 0 upon failure.
3640+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
3641+
* < 0 if another error occurred.
36363642
*/
36373643
int ufshcd_query_descriptor_retry(struct ufs_hba *hba,
36383644
enum query_opcode opcode,
@@ -3650,7 +3656,6 @@ int ufshcd_query_descriptor_retry(struct ufs_hba *hba,
36503656
break;
36513657
}
36523658

3653-
WARN_ONCE(err > 0, "Incorrect return value %d > 0\n", err);
36543659
return err;
36553660
}
36563661

@@ -3663,7 +3668,8 @@ int ufshcd_query_descriptor_retry(struct ufs_hba *hba,
36633668
* @param_read_buf: pointer to buffer where parameter would be read
36643669
* @param_size: sizeof(param_read_buf)
36653670
*
3666-
* Return: 0 in case of success; < 0 upon failure.
3671+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
3672+
* < 0 if another error occurred.
36673673
*/
36683674
int ufshcd_read_desc_param(struct ufs_hba *hba,
36693675
enum desc_idn desc_id,
@@ -3730,7 +3736,6 @@ int ufshcd_read_desc_param(struct ufs_hba *hba,
37303736
out:
37313737
if (is_kmalloc)
37323738
kfree(desc_buf);
3733-
WARN_ONCE(ret > 0, "Incorrect return value %d > 0\n", ret);
37343739
return ret;
37353740
}
37363741

@@ -4781,7 +4786,8 @@ EXPORT_SYMBOL_GPL(ufshcd_config_pwr_mode);
47814786
*
47824787
* Set fDeviceInit flag and poll until device toggles it.
47834788
*
4784-
* Return: 0 upon success; < 0 upon failure.
4789+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
4790+
* < 0 if another error occurred.
47854791
*/
47864792
static int ufshcd_complete_dev_init(struct ufs_hba *hba)
47874793
{
@@ -5135,7 +5141,8 @@ static int ufshcd_link_startup(struct ufs_hba *hba)
51355141
* not respond with NOP IN UPIU within timeout of %NOP_OUT_TIMEOUT
51365142
* and we retry sending NOP OUT for %NOP_OUT_RETRIES iterations.
51375143
*
5138-
* Return: 0 upon success; < 0 upon failure.
5144+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
5145+
* < 0 if another error occurred.
51395146
*/
51405147
static int ufshcd_verify_dev_init(struct ufs_hba *hba)
51415148
{
@@ -5559,9 +5566,9 @@ static irqreturn_t ufshcd_uic_cmd_compl(struct ufs_hba *hba, u32 intr_status)
55595566
irqreturn_t retval = IRQ_NONE;
55605567
struct uic_command *cmd;
55615568

5562-
spin_lock(hba->host->host_lock);
5569+
guard(spinlock_irqsave)(hba->host->host_lock);
55635570
cmd = hba->active_uic_cmd;
5564-
if (WARN_ON_ONCE(!cmd))
5571+
if (!cmd)
55655572
goto unlock;
55665573

55675574
if (ufshcd_is_auto_hibern8_error(hba, intr_status))
@@ -5586,8 +5593,6 @@ static irqreturn_t ufshcd_uic_cmd_compl(struct ufs_hba *hba, u32 intr_status)
55865593
ufshcd_add_uic_command_trace(hba, cmd, UFS_CMD_COMP);
55875594

55885595
unlock:
5589-
spin_unlock(hba->host->host_lock);
5590-
55915596
return retval;
55925597
}
55935598

@@ -5869,7 +5874,8 @@ static inline int ufshcd_enable_ee(struct ufs_hba *hba, u16 mask)
58695874
* as the device is allowed to manage its own way of handling background
58705875
* operations.
58715876
*
5872-
* Return: zero on success, non-zero on failure.
5877+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
5878+
* < 0 if another error occurred.
58735879
*/
58745880
static int ufshcd_enable_auto_bkops(struct ufs_hba *hba)
58755881
{
@@ -5908,7 +5914,8 @@ static int ufshcd_enable_auto_bkops(struct ufs_hba *hba)
59085914
* host is idle so that BKOPS are managed effectively without any negative
59095915
* impacts.
59105916
*
5911-
* Return: zero on success, non-zero on failure.
5917+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
5918+
* < 0 if another error occurred.
59125919
*/
59135920
static int ufshcd_disable_auto_bkops(struct ufs_hba *hba)
59145921
{
@@ -6058,6 +6065,10 @@ static void ufshcd_bkops_exception_event_handler(struct ufs_hba *hba)
60586065
__func__, err);
60596066
}
60606067

6068+
/*
6069+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
6070+
* < 0 if another error occurred.
6071+
*/
60616072
int ufshcd_read_device_lvl_exception_id(struct ufs_hba *hba, u64 *exception_id)
60626073
{
60636074
struct utp_upiu_query_v4_0 *upiu_resp;
@@ -6920,7 +6931,7 @@ static irqreturn_t ufshcd_check_errors(struct ufs_hba *hba, u32 intr_status)
69206931
bool queue_eh_work = false;
69216932
irqreturn_t retval = IRQ_NONE;
69226933

6923-
spin_lock(hba->host->host_lock);
6934+
guard(spinlock_irqsave)(hba->host->host_lock);
69246935
hba->errors |= UFSHCD_ERROR_MASK & intr_status;
69256936

69266937
if (hba->errors & INT_FATAL_ERRORS) {
@@ -6979,7 +6990,7 @@ static irqreturn_t ufshcd_check_errors(struct ufs_hba *hba, u32 intr_status)
69796990
*/
69806991
hba->errors = 0;
69816992
hba->uic_error = 0;
6982-
spin_unlock(hba->host->host_lock);
6993+
69836994
return retval;
69846995
}
69856996

@@ -7454,7 +7465,8 @@ int ufshcd_exec_raw_upiu_cmd(struct ufs_hba *hba,
74547465
* @sg_list: Pointer to SG list when DATA IN/OUT UPIU is required in ARPMB operation
74557466
* @dir: DMA direction
74567467
*
7457-
* Return: zero on success, non-zero on failure.
7468+
* Return: 0 upon success; > 0 in case the UFS device reported an OCS error;
7469+
* < 0 if another error occurred.
74587470
*/
74597471
int ufshcd_advanced_rpmb_req_handler(struct ufs_hba *hba, struct utp_upiu_req *req_upiu,
74607472
struct utp_upiu_req *rsp_upiu, struct ufs_ehs *req_ehs,

‎drivers/ufs/host/ufs-qcom.c‎

Lines changed: 15 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -2070,17 +2070,6 @@ static irqreturn_t ufs_qcom_mcq_esi_handler(int irq, void *data)
20702070
return IRQ_HANDLED;
20712071
}
20722072

2073-
static void ufs_qcom_irq_free(struct ufs_qcom_irq *uqi)
2074-
{
2075-
for (struct ufs_qcom_irq *q = uqi; q->irq; q++)
2076-
devm_free_irq(q->hba->dev, q->irq, q->hba);
2077-
2078-
platform_device_msi_free_irqs_all(uqi->hba->dev);
2079-
devm_kfree(uqi->hba->dev, uqi);
2080-
}
2081-
2082-
DEFINE_FREE(ufs_qcom_irq, struct ufs_qcom_irq *, if (_T) ufs_qcom_irq_free(_T))
2083-
20842073
static int ufs_qcom_config_esi(struct ufs_hba *hba)
20852074
{
20862075
struct ufs_qcom_host *host = ufshcd_get_variant(hba);
@@ -2095,18 +2084,18 @@ static int ufs_qcom_config_esi(struct ufs_hba *hba)
20952084
*/
20962085
nr_irqs = hba->nr_hw_queues - hba->nr_queues[HCTX_TYPE_POLL];
20972086

2098-
struct ufs_qcom_irq *qi __free(ufs_qcom_irq) =
2099-
devm_kcalloc(hba->dev, nr_irqs, sizeof(*qi), GFP_KERNEL);
2100-
if (!qi)
2101-
return -ENOMEM;
2102-
/* Preset so __free() has a pointer to hba in all error paths */
2103-
qi[0].hba = hba;
2104-
21052087
ret = platform_device_msi_init_and_alloc_irqs(hba->dev, nr_irqs,
21062088
ufs_qcom_write_msi_msg);
21072089
if (ret) {
2108-
dev_err(hba->dev, "Failed to request Platform MSI %d\n", ret);
2109-
return ret;
2090+
dev_warn(hba->dev, "Platform MSI not supported or failed, continuing without ESI\n");
2091+
return ret; /* Continue without ESI */
2092+
}
2093+
2094+
struct ufs_qcom_irq *qi = devm_kcalloc(hba->dev, nr_irqs, sizeof(*qi), GFP_KERNEL);
2095+
2096+
if (!qi) {
2097+
platform_device_msi_free_irqs_all(hba->dev);
2098+
return -ENOMEM;
21102099
}
21112100

21122101
for (int idx = 0; idx < nr_irqs; idx++) {
@@ -2117,15 +2106,17 @@ static int ufs_qcom_config_esi(struct ufs_hba *hba)
21172106
ret = devm_request_irq(hba->dev, qi[idx].irq, ufs_qcom_mcq_esi_handler,
21182107
IRQF_SHARED, "qcom-mcq-esi", qi + idx);
21192108
if (ret) {
2120-
dev_err(hba->dev, "%s: Fail to request IRQ for %d, err = %d\n",
2109+
dev_err(hba->dev, "%s: Failed to request IRQ for %d, err = %d\n",
21212110
__func__, qi[idx].irq, ret);
2122-
qi[idx].irq = 0;
2111+
/* Free previously allocated IRQs */
2112+
for (int j = 0; j < idx; j++)
2113+
devm_free_irq(hba->dev, qi[j].irq, qi + j);
2114+
platform_device_msi_free_irqs_all(hba->dev);
2115+
devm_kfree(hba->dev, qi);
21232116
return ret;
21242117
}
21252118
}
21262119

2127-
retain_and_null_ptr(qi);
2128-
21292120
if (host->hw_ver.major >= 6) {
21302121
ufshcd_rmwl(hba, ESI_VEC_MASK, FIELD_PREP(ESI_VEC_MASK, MAX_ESI_VEC - 1),
21312122
REG_UFS_CFG3);

‎drivers/ufs/host/ufshcd-pci.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -630,6 +630,7 @@ static const struct pci_device_id ufshcd_pci_tbl[] = {
630630
{ PCI_VDEVICE(INTEL, 0xA847), (kernel_ulong_t)&ufs_intel_mtl_hba_vops },
631631
{ PCI_VDEVICE(INTEL, 0x7747), (kernel_ulong_t)&ufs_intel_mtl_hba_vops },
632632
{ PCI_VDEVICE(INTEL, 0xE447), (kernel_ulong_t)&ufs_intel_mtl_hba_vops },
633+
{ PCI_VDEVICE(INTEL, 0x4D47), (kernel_ulong_t)&ufs_intel_mtl_hba_vops },
633634
{ } /* terminate list */
634635
};
635636

0 commit comments

Comments
 (0)