]> Pileus Git - ~andy/linux/blobdiff - drivers/scsi/scsi_lib.c
[PATCH] dvb: Fix integer overflow bug
[~andy/linux] / drivers / scsi / scsi_lib.c
index 77f2d444f7e0c7b6d297db390fcc2561d14ec36b..e40c8b66da40fe80ab6a1167ed29b1e9e62fa3d9 100644 (file)
@@ -98,6 +98,28 @@ int scsi_insert_special_req(struct scsi_request *sreq, int at_head)
 
 static void scsi_run_queue(struct request_queue *q);
 
+/*
+ * Function:   scsi_unprep_request()
+ *
+ * Purpose:    Remove all preparation done for a request, including its
+ *             associated scsi_cmnd, so that it can be requeued.
+ *
+ * Arguments:  req     - request to unprepare
+ *
+ * Lock status:        Assumed that no locks are held upon entry.
+ *
+ * Returns:    Nothing.
+ */
+static void scsi_unprep_request(struct request *req)
+{
+       struct scsi_cmnd *cmd = req->special;
+
+       req->flags &= ~REQ_DONTPREP;
+       req->special = (req->flags & REQ_SPECIAL) ? cmd->sc_request : NULL;
+
+       scsi_put_command(cmd);
+}
+
 /*
  * Function:    scsi_queue_insert()
  *
@@ -339,7 +361,7 @@ int scsi_execute_req(struct scsi_device *sdev, const unsigned char *cmd,
        int result;
        
        if (sshdr) {
-               sense = kmalloc(SCSI_SENSE_BUFFERSIZE, GFP_KERNEL);
+               sense = kmalloc(SCSI_SENSE_BUFFERSIZE, GFP_NOIO);
                if (!sense)
                        return DRIVER_ERROR << 24;
                memset(sense, 0, SCSI_SENSE_BUFFERSIZE);
@@ -424,7 +446,7 @@ void scsi_device_unbusy(struct scsi_device *sdev)
 
        spin_lock_irqsave(shost->host_lock, flags);
        shost->host_busy--;
-       if (unlikely((shost->shost_state == SHOST_RECOVERY) &&
+       if (unlikely(scsi_host_in_recovery(shost) &&
                     shost->host_failed))
                scsi_eh_wakeup(shost);
        spin_unlock(shost->host_lock);
@@ -552,15 +574,16 @@ static void scsi_run_queue(struct request_queue *q)
  *             I/O errors in the middle of the request, in which case
  *             we need to request the blocks that come after the bad
  *             sector.
+ * Notes:      Upon return, cmd is a stale pointer.
  */
 static void scsi_requeue_command(struct request_queue *q, struct scsi_cmnd *cmd)
 {
+       struct request *req = cmd->request;
        unsigned long flags;
 
-       cmd->request->flags &= ~REQ_DONTPREP;
-
+       scsi_unprep_request(req);
        spin_lock_irqsave(q->queue_lock, flags);
-       blk_requeue_request(q, cmd->request);
+       blk_requeue_request(q, req);
        spin_unlock_irqrestore(q->queue_lock, flags);
 
        scsi_run_queue(q);
@@ -595,13 +618,14 @@ void scsi_run_host_queues(struct Scsi_Host *shost)
  *
  * Lock status: Assumed that lock is not held upon entry.
  *
- * Returns:     cmd if requeue done or required, NULL otherwise
+ * Returns:     cmd if requeue required, NULL otherwise.
  *
  * Notes:       This is called for block device requests in order to
  *              mark some number of sectors as complete.
  * 
  *             We are guaranteeing that the request queue will be goosed
  *             at some point during this call.
+ * Notes:      If cmd was requeued, upon return it will be a stale pointer.
  */
 static struct scsi_cmnd *scsi_end_request(struct scsi_cmnd *cmd, int uptodate,
                                          int bytes, int requeue)
@@ -624,14 +648,15 @@ static struct scsi_cmnd *scsi_end_request(struct scsi_cmnd *cmd, int uptodate,
                if (!uptodate && blk_noretry_request(req))
                        end_that_request_chunk(req, 0, leftover);
                else {
-                       if (requeue)
+                       if (requeue) {
                                /*
                                 * Bleah.  Leftovers again.  Stick the
                                 * leftovers in the front of the
                                 * queue, and goose the queue again.
                                 */
                                scsi_requeue_command(q, cmd);
-
+                               cmd = NULL;
+                       }
                        return cmd;
                }
        }
@@ -652,7 +677,7 @@ static struct scsi_cmnd *scsi_end_request(struct scsi_cmnd *cmd, int uptodate,
        return NULL;
 }
 
-static struct scatterlist *scsi_alloc_sgtable(struct scsi_cmnd *cmd, int gfp_mask)
+static struct scatterlist *scsi_alloc_sgtable(struct scsi_cmnd *cmd, gfp_t gfp_mask)
 {
        struct scsi_host_sg_pool *sgp;
        struct scatterlist *sgl;
@@ -857,15 +882,13 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes,
                 * requeueing right here - we will requeue down below
                 * when we handle the bad sectors.
                 */
-               cmd = scsi_end_request(cmd, 1, good_bytes, result == 0);
 
                /*
-                * If the command completed without error, then either finish off the
-                * rest of the command, or start a new one.
+                * If the command completed without error, then either
+                * finish off the rest of the command, or start a new one.
                 */
-               if (result == 0 || cmd == NULL ) {
+               if (scsi_end_request(cmd, 1, good_bytes, result == 0) == NULL)
                        return;
-               }
        }
        /*
         * Now, if we were good little boys and girls, Santa left us a request
@@ -880,7 +903,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes,
                                 * and quietly refuse further access.
                                 */
                                cmd->device->changed = 1;
-                               cmd = scsi_end_request(cmd, 0,
+                               scsi_end_request(cmd, 0,
                                                this_count, 1);
                                return;
                        } else {
@@ -914,7 +937,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes,
                                scsi_requeue_command(q, cmd);
                                result = 0;
                        } else {
-                               cmd = scsi_end_request(cmd, 0, this_count, 1);
+                               scsi_end_request(cmd, 0, this_count, 1);
                                return;
                        }
                        break;
@@ -928,20 +951,18 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes,
                                return;
                        }
                        if (!(req->flags & REQ_QUIET))
-                               dev_printk(KERN_INFO,
-                                          &cmd->device->sdev_gendev,
+                               scmd_printk(KERN_INFO, cmd,
                                           "Device not ready.\n");
-                       cmd = scsi_end_request(cmd, 0, this_count, 1);
+                       scsi_end_request(cmd, 0, this_count, 1);
                        return;
                case VOLUME_OVERFLOW:
                        if (!(req->flags & REQ_QUIET)) {
-                               dev_printk(KERN_INFO,
-                                          &cmd->device->sdev_gendev,
+                               scmd_printk(KERN_INFO, cmd,
                                           "Volume overflow, CDB: ");
                                __scsi_print_command(cmd->data_cmnd);
                                scsi_print_sense("", cmd);
                        }
-                       cmd = scsi_end_request(cmd, 0, block_bytes, 1);
+                       scsi_end_request(cmd, 0, block_bytes, 1);
                        return;
                default:
                        break;
@@ -958,7 +979,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes,
        }
        if (result) {
                if (!(req->flags & REQ_QUIET)) {
-                       dev_printk(KERN_INFO, &cmd->device->sdev_gendev,
+                       scmd_printk(KERN_INFO, cmd,
                                   "SCSI error: return code = 0x%x\n", result);
 
                        if (driver_byte(result) & DRIVER_SENSE)
@@ -972,7 +993,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes,
                block_bytes = req->hard_cur_sectors << 9;
                if (!block_bytes)
                        block_bytes = req->data_len;
-               cmd = scsi_end_request(cmd, 0, block_bytes, 1);
+               scsi_end_request(cmd, 0, block_bytes, 1);
        }
 }
 EXPORT_SYMBOL(scsi_io_completion);
@@ -1016,8 +1037,10 @@ static int scsi_init_io(struct scsi_cmnd *cmd)
         * if sg table allocation fails, requeue request later.
         */
        sgpnt = scsi_alloc_sgtable(cmd, GFP_ATOMIC);
-       if (unlikely(!sgpnt))
+       if (unlikely(!sgpnt)) {
+               scsi_unprep_request(req);
                return BLKPREP_DEFER;
+       }
 
        cmd->request_buffer = (char *) sgpnt;
        cmd->request_bufflen = req->nr_sectors << 9;
@@ -1116,9 +1139,9 @@ static int scsi_prep_fn(struct request_queue *q, struct request *req)
         * online before trying any recovery commands
         */
        if (unlikely(!scsi_device_online(sdev))) {
-               printk(KERN_ERR "scsi%d (%d:%d): rejecting I/O to offline device\n",
-                      sdev->host->host_no, sdev->id, sdev->lun);
-               return BLKPREP_KILL;
+               sdev_printk(KERN_ERR, sdev,
+                           "rejecting I/O to offline device\n");
+               goto kill;
        }
        if (unlikely(sdev->sdev_state != SDEV_RUNNING)) {
                /* OK, we're not in a running state don't prep
@@ -1126,9 +1149,9 @@ static int scsi_prep_fn(struct request_queue *q, struct request *req)
                if (sdev->sdev_state == SDEV_DEL) {
                        /* Device is fully deleted, no commands
                         * at all allowed down */
-                       printk(KERN_ERR "scsi%d (%d:%d): rejecting I/O to dead device\n",
-                              sdev->host->host_no, sdev->id, sdev->lun);
-                       return BLKPREP_KILL;
+                       sdev_printk(KERN_ERR, sdev,
+                                   "rejecting I/O to dead device\n");
+                       goto kill;
                }
                /* OK, we only allow special commands (i.e. not
                 * user initiated ones */
@@ -1160,11 +1183,11 @@ static int scsi_prep_fn(struct request_queue *q, struct request *req)
                if(unlikely(specials_only) && !(req->flags & REQ_SPECIAL)) {
                        if(specials_only == SDEV_QUIESCE ||
                                        specials_only == SDEV_BLOCK)
-                               return BLKPREP_DEFER;
+                               goto defer;
                        
-                       printk(KERN_ERR "scsi%d (%d:%d): rejecting I/O to device being removed\n",
-                              sdev->host->host_no, sdev->id, sdev->lun);
-                       return BLKPREP_KILL;
+                       sdev_printk(KERN_ERR, sdev,
+                                   "rejecting I/O to device being removed\n");
+                       goto kill;
                }
                        
                        
@@ -1182,7 +1205,7 @@ static int scsi_prep_fn(struct request_queue *q, struct request *req)
                cmd->tag = req->tag;
        } else {
                blk_dump_rq_flags(req, "SCSI bad req");
-               return BLKPREP_KILL;
+               goto kill;
        }
        
        /* note the overloading of req->special.  When the tag
@@ -1220,8 +1243,13 @@ static int scsi_prep_fn(struct request_queue *q, struct request *req)
                 * required).
                 */
                ret = scsi_init_io(cmd);
-               if (ret)        /* BLKPREP_KILL return also releases the command */
-                       return ret;
+               switch(ret) {
+                       /* For BLKPREP_KILL/DEFER the cmd was released */
+               case BLKPREP_KILL:
+                       goto kill;
+               case BLKPREP_DEFER:
+                       goto defer;
+               }
                
                /*
                 * Initialize the actual SCSI command for this request.
@@ -1231,10 +1259,11 @@ static int scsi_prep_fn(struct request_queue *q, struct request *req)
                        if (unlikely(!drv->init_command(cmd))) {
                                scsi_release_buffers(cmd);
                                scsi_put_command(cmd);
-                               return BLKPREP_KILL;
+                               goto kill;
                        }
                } else {
                        memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd));
+                       cmd->cmd_len = req->cmd_len;
                        if (rq_data_dir(req) == WRITE)
                                cmd->sc_data_direction = DMA_TO_DEVICE;
                        else if (req->data_len)
@@ -1262,6 +1291,9 @@ static int scsi_prep_fn(struct request_queue *q, struct request *req)
        if (sdev->device_busy == 0)
                blk_plug_device(q);
        return BLKPREP_DEFER;
+ kill:
+       req->errors = DID_NO_CONNECT << 16;
+       return BLKPREP_KILL;
 }
 
 /*
@@ -1281,9 +1313,8 @@ static inline int scsi_dev_queue_ready(struct request_queue *q,
                 */
                if (--sdev->device_blocked == 0) {
                        SCSI_LOG_MLQUEUE(3,
-                               printk("scsi%d (%d:%d) unblocking device at"
-                                      " zero depth\n", sdev->host->host_no,
-                                      sdev->id, sdev->lun));
+                                  sdev_printk(KERN_INFO, sdev,
+                                  "unblocking device at zero depth\n"));
                } else {
                        blk_plug_device(q);
                        return 0;
@@ -1306,7 +1337,7 @@ static inline int scsi_host_queue_ready(struct request_queue *q,
                                   struct Scsi_Host *shost,
                                   struct scsi_device *sdev)
 {
-       if (shost->shost_state == SHOST_RECOVERY)
+       if (scsi_host_in_recovery(shost))
                return 0;
        if (shost->host_busy == 0 && shost->host_blocked) {
                /*
@@ -1336,19 +1367,24 @@ static inline int scsi_host_queue_ready(struct request_queue *q,
 }
 
 /*
- * Kill requests for a dead device
+ * Kill a request for a dead device
  */
-static void scsi_kill_requests(request_queue_t *q)
+static void scsi_kill_request(struct request *req, request_queue_t *q)
 {
-       struct request *req;
+       struct scsi_cmnd *cmd = req->special;
+
+       blkdev_dequeue_request(req);
 
-       while ((req = elv_next_request(q)) != NULL) {
-               blkdev_dequeue_request(req);
-               req->flags |= REQ_QUIET;
-               while (end_that_request_first(req, 0, req->nr_sectors))
-                       ;
-               end_that_request_last(req);
+       if (unlikely(cmd == NULL)) {
+               printk(KERN_CRIT "impossible request in %s.\n",
+                                __FUNCTION__);
+               BUG();
        }
+
+       scsi_init_cmd_errh(cmd);
+       cmd->result = DID_NO_CONNECT << 16;
+       atomic_inc(&cmd->device->iorequest_cnt);
+       __scsi_done(cmd);
 }
 
 /*
@@ -1371,7 +1407,8 @@ static void scsi_request_fn(struct request_queue *q)
 
        if (!sdev) {
                printk("scsi: killing requests for dead queue\n");
-               scsi_kill_requests(q);
+               while ((req = elv_next_request(q)) != NULL)
+                       scsi_kill_request(req, q);
                return;
        }
 
@@ -1396,13 +1433,9 @@ static void scsi_request_fn(struct request_queue *q)
                        break;
 
                if (unlikely(!scsi_device_online(sdev))) {
-                       printk(KERN_ERR "scsi%d (%d:%d): rejecting I/O to offline device\n",
-                              sdev->host->host_no, sdev->id, sdev->lun);
-                       blkdev_dequeue_request(req);
-                       req->flags |= REQ_QUIET;
-                       while (end_that_request_first(req, 0, req->nr_sectors))
-                               ;
-                       end_that_request_last(req);
+                       sdev_printk(KERN_ERR, sdev,
+                                   "rejecting I/O to offline device\n");
+                       scsi_kill_request(req, q);
                        continue;
                }
 
@@ -1415,6 +1448,14 @@ static void scsi_request_fn(struct request_queue *q)
                sdev->device_busy++;
 
                spin_unlock(q->queue_lock);
+               cmd = req->special;
+               if (unlikely(cmd == NULL)) {
+                       printk(KERN_CRIT "impossible request in %s.\n"
+                                        "please mail a stack trace to "
+                                        "linux-scsi@vger.kernel.org",
+                                        __FUNCTION__);
+                       BUG();
+               }
                spin_lock(shost->host_lock);
 
                if (!scsi_host_queue_ready(q, shost, sdev))
@@ -1433,15 +1474,6 @@ static void scsi_request_fn(struct request_queue *q)
                 */
                spin_unlock_irq(shost->host_lock);
 
-               cmd = req->special;
-               if (unlikely(cmd == NULL)) {
-                       printk(KERN_CRIT "impossible request in %s.\n"
-                                        "please mail a stack trace to "
-                                        "linux-scsi@vger.kernel.org",
-                                        __FUNCTION__);
-                       BUG();
-               }
-
                /*
                 * Finally, initialize any error handling parameters, and set up
                 * the timers for timeouts.
@@ -1858,10 +1890,10 @@ scsi_device_set_state(struct scsi_device *sdev, enum scsi_device_state state)
 
  illegal:
        SCSI_LOG_ERROR_RECOVERY(1, 
-                               dev_printk(KERN_ERR, &sdev->sdev_gendev,
-                                          "Illegal state transition %s->%s\n",
-                                          scsi_device_state_name(oldstate),
-                                          scsi_device_state_name(state))
+                               sdev_printk(KERN_ERR, sdev,
+                                           "Illegal state transition %s->%s\n",
+                                           scsi_device_state_name(oldstate),
+                                           scsi_device_state_name(state))
                                );
        return -EINVAL;
 }