summaryrefslogtreecommitdiffstats
path: root/kernel/drivers/message/fusion
diff options
context:
space:
mode:
Diffstat (limited to 'kernel/drivers/message/fusion')
-rw-r--r--kernel/drivers/message/fusion/mptbase.c24
-rw-r--r--kernel/drivers/message/fusion/mptbase.h1
-rw-r--r--kernel/drivers/message/fusion/mptctl.c13
-rw-r--r--kernel/drivers/message/fusion/mptsas.c5
4 files changed, 15 insertions, 28 deletions
diff --git a/kernel/drivers/message/fusion/mptbase.c b/kernel/drivers/message/fusion/mptbase.c
index 187f83629..5dcc0313c 100644
--- a/kernel/drivers/message/fusion/mptbase.c
+++ b/kernel/drivers/message/fusion/mptbase.c
@@ -59,10 +59,6 @@
#include <linux/delay.h>
#include <linux/interrupt.h> /* needed for in_interrupt() proto */
#include <linux/dma-mapping.h>
-#include <asm/io.h>
-#ifdef CONFIG_MTRR
-#include <asm/mtrr.h>
-#endif
#include <linux/kthread.h>
#include <scsi/scsi_host.h>
@@ -2820,13 +2816,6 @@ mpt_adapter_dispose(MPT_ADAPTER *ioc)
pci_disable_device(ioc->pcidev);
pci_release_selected_regions(ioc->pcidev, ioc->bars);
-#if defined(CONFIG_MTRR) && 0
- if (ioc->mtrr_reg > 0) {
- mtrr_del(ioc->mtrr_reg, 0, 0);
- dprintk(ioc, printk(MYIOC_s_INFO_FMT "MTRR region de-registered\n", ioc->name));
- }
-#endif
-
/* Zap the adapter lookup ptr! */
list_del(&ioc->list);
@@ -4512,19 +4501,6 @@ PrimeIocFifos(MPT_ADAPTER *ioc)
ioc->req_frames_low_dma = (u32) (alloc_dma & 0xFFFFFFFF);
-#if defined(CONFIG_MTRR) && 0
- /*
- * Enable Write Combining MTRR for IOC's memory region.
- * (at least as much as we can; "size and base must be
- * multiples of 4 kiB"
- */
- ioc->mtrr_reg = mtrr_add(ioc->req_frames_dma,
- sz,
- MTRR_TYPE_WRCOMB, 1);
- dprintk(ioc, printk(MYIOC_s_DEBUG_FMT "MTRR region registered (base:size=%08x:%x)\n",
- ioc->name, ioc->req_frames_dma, sz));
-#endif
-
for (i = 0; i < ioc->req_depth; i++) {
alloc_dma += ioc->req_sz;
mem += ioc->req_sz;
diff --git a/kernel/drivers/message/fusion/mptbase.h b/kernel/drivers/message/fusion/mptbase.h
index 8f14090b8..813d46311 100644
--- a/kernel/drivers/message/fusion/mptbase.h
+++ b/kernel/drivers/message/fusion/mptbase.h
@@ -671,7 +671,6 @@ typedef struct _MPT_ADAPTER
u8 *HostPageBuffer; /* SAS - host page buffer support */
u32 HostPageBuffer_sz;
dma_addr_t HostPageBuffer_dma;
- int mtrr_reg;
struct pci_dev *pcidev; /* struct pci_dev pointer */
int bars; /* bitmask of BAR's that must be configured */
int msi_enable;
diff --git a/kernel/drivers/message/fusion/mptctl.c b/kernel/drivers/message/fusion/mptctl.c
index 70bb7530b..02b5f69e1 100644
--- a/kernel/drivers/message/fusion/mptctl.c
+++ b/kernel/drivers/message/fusion/mptctl.c
@@ -1038,6 +1038,10 @@ kbuf_alloc_2_sgl(int bytes, u32 sgdir, int sge_offset, int *frags,
int i, buflist_ent;
int sg_spill = MAX_FRAGS_SPILL1;
int dir;
+
+ if (bytes < 0)
+ return NULL;
+
/* initialization */
*frags = 0;
*blp = NULL;
@@ -1859,6 +1863,15 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
}
spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
+ /* Basic sanity checks to prevent underflows or integer overflows */
+ if (karg.maxReplyBytes < 0 ||
+ karg.dataInSize < 0 ||
+ karg.dataOutSize < 0 ||
+ karg.dataSgeOffset < 0 ||
+ karg.maxSenseBytes < 0 ||
+ karg.dataSgeOffset > ioc->req_sz / 4)
+ return -EINVAL;
+
/* Verify that the final request frame will not be too large.
*/
sz = karg.dataSgeOffset * 4;
diff --git a/kernel/drivers/message/fusion/mptsas.c b/kernel/drivers/message/fusion/mptsas.c
index 5bdaae15a..7ebccfa80 100644
--- a/kernel/drivers/message/fusion/mptsas.c
+++ b/kernel/drivers/message/fusion/mptsas.c
@@ -1994,7 +1994,6 @@ static struct scsi_host_template mptsas_driver_template = {
.cmd_per_lun = 7,
.use_clustering = ENABLE_CLUSTERING,
.shost_attrs = mptscsih_host_attrs,
- .use_blk_tags = 1,
};
static int mptsas_get_linkerrors(struct sas_phy *phy)
@@ -4090,7 +4089,7 @@ mptsas_handle_queue_full_event(struct fw_event_work *fw_event)
continue;
}
depth = scsi_track_queue_full(sdev,
- current_depth - 1);
+ sdev->queue_depth - 1);
if (depth > 0)
sdev_printk(KERN_INFO, sdev,
"Queue depth reduced to (%d)\n",
@@ -4100,7 +4099,7 @@ mptsas_handle_queue_full_event(struct fw_event_work *fw_event)
"Tagged Command Queueing is being "
"disabled\n");
else if (depth == 0)
- sdev_printk(KERN_INFO, sdev,
+ sdev_printk(KERN_DEBUG, sdev,
"Queue depth not changed yet\n");
}
}