Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "This is a set of minor (and safe changes) that didn't make the initial
  pull request plus some bug fixes"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: qla2xxx: Mask off Scope bits in retry delay
  scsi: qla2xxx: Fix crash on qla2x00_mailbox_command
  scsi: aic7xxx: aic79xx: fix potential null pointer dereference on ahd
  scsi: mpt3sas: Add an I/O barrier
  scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails
  scsi: hpsa: disable device during shutdown
  scsi: sd_zbc: Fix sd_zbc_check_zone_size() error path
  scsi: aacraid: remove bogus GFP_DMA32 specifies

8 files changed, 32 insertions, 12 deletions

diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
index a2b3430072c7..25f6600d6c09 100644
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
@@ -845,7 +845,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
                                         rcode = -EINVAL;
                                         goto cleanup;
                                 }
-                                p = kmalloc(sg_count[i], GFP_KERNEL|GFP_DMA32);
+                                p = kmalloc(sg_count[i], GFP_KERNEL);
                                 if (!p) {
                                         dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
                                                 sg_count[i], i, usg->count));
@@ -886,7 +886,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
                                         rcode = -EINVAL;
                                         goto cleanup;
                                 }
-                                p = kmalloc(sg_count[i], GFP_KERNEL|GFP_DMA32);
+                                p = kmalloc(sg_count[i], GFP_KERNEL);
                                 if (!p) {
                                         dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
                                           sg_count[i], i, upsg->count));
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 67d292dcc607..2d82ec85753e 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -6112,10 +6112,6 @@ ahd_alloc(void *platform_arg, char *name)
         ahd->int_coalescing_stop_threshold =
             AHD_INT_COALESCING_STOP_THRESHOLD_DEFAULT;
 
-        if (ahd_platform_alloc(ahd, platform_arg) != 0) {
-                ahd_free(ahd);
-                ahd = NULL;
-        }
 #ifdef AHD_DEBUG
         if ((ahd_debug & AHD_SHOW_MEMORY) != 0) {
                 printk("%s: scb size = 0x%x, hscb size = 0x%x\n",
@@ -6123,6 +6119,10 @@ ahd_alloc(void *platform_arg, char *name)
                        (u_int)sizeof(struct hardware_scb));
         }
 #endif
+        if (ahd_platform_alloc(ahd, platform_arg) != 0) {
+                ahd_free(ahd);
+                ahd = NULL;
+        }
         return (ahd);
 }
 
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index af0e628ff396..15c7f3b6f35e 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -8871,7 +8871,7 @@ out:
         kfree(options);
 }
 
-static void hpsa_shutdown(struct pci_dev *pdev)
+static void __hpsa_shutdown(struct pci_dev *pdev)
 {
         struct ctlr_info *h;
 
@@ -8886,6 +8886,12 @@ static void hpsa_shutdown(struct pci_dev *pdev)
         hpsa_disable_interrupt_mode(h);         /* pci_init 2 */
 }
 
+static void hpsa_shutdown(struct pci_dev *pdev)
+{
+        __hpsa_shutdown(pdev);
+        pci_disable_device(pdev);
+}
+
 static void hpsa_free_device_info(struct ctlr_info *h)
 {
         int i;
@@ -8929,7 +8935,7 @@ static void hpsa_remove_one(struct pci_dev *pdev)
                 scsi_remove_host(h->scsi_host);         /* init_one 8 */
         /* includes hpsa_free_irqs - init_one 4 */
         /* includes hpsa_disable_interrupt_mode - pci_init 2 */
-        hpsa_shutdown(pdev);
+        __hpsa_shutdown(pdev);
 
         hpsa_free_device_info(h);               /* scan */
 
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index bf04fa90f433..569392d0d4c9 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -3348,6 +3348,7 @@ _base_mpi_ep_writeq(__u64 b, volatile void __iomem *addr,
         spin_lock_irqsave(writeq_lock, flags);
         writel((u32)(data_out), addr);
         writel((u32)(data_out >> 32), (addr + 4));
+        mmiowb();
         spin_unlock_irqrestore(writeq_lock, flags);
 }
 
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index fbbb328c64d5..7b675243bd16 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -5009,7 +5009,8 @@ qla2x00_iidma_fcport(scsi_qla_host_t *vha, fc_port_t *fcport)
                 return;
 
         if (fcport->fp_speed == PORT_SPEED_UNKNOWN ||
-            fcport->fp_speed > ha->link_data_rate)
+            fcport->fp_speed > ha->link_data_rate ||
+            !ha->flags.gpsc_supported)
                 return;
 
         rval = qla2x00_set_idma_speed(vha, fcport->loop_id, fcport->fp_speed,
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index d14d3911516d..9fa5a2557f2c 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -2494,8 +2494,12 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
                 ox_id = le16_to_cpu(sts24->ox_id);
                 par_sense_len = sizeof(sts24->data);
                 /* Valid values of the retry delay timer are 0x1-0xffef */
-                if (sts24->retry_delay > 0 && sts24->retry_delay < 0xfff1)
-                        retry_delay = sts24->retry_delay;
+                if (sts24->retry_delay > 0 && sts24->retry_delay < 0xfff1) {
+                        retry_delay = sts24->retry_delay & 0x3fff;
+                        ql_dbg(ql_dbg_io, sp->vha, 0x3033,
+                            "%s: scope=%#x retry_delay=%#x\n", __func__,
+                            sts24->retry_delay >> 14, retry_delay);
+                }
         } else {
                 if (scsi_status & SS_SENSE_LEN_VALID)
                         sense_len = le16_to_cpu(sts->req_sense_length);
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index d8a36c13aeda..7e875f575229 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -292,6 +292,14 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                         if (time_after(jiffies, wait_time))
                                 break;
 
+                        /*
+                         * Check if it's UNLOADING, cause we cannot poll in
+                         * this case, or else a NULL pointer dereference
+                         * is triggered.
+                         */
+                        if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags)))
+                                return QLA_FUNCTION_TIMEOUT;
+
                         /* Check for pending interrupts. */
                         qla2x00_poll(ha->rsp_q_map[0]);
 
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 76da8c3a6f09..a14fef11776e 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -442,7 +442,7 @@ static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp)
                         } else if (this_zone_blocks != zone_blocks &&
                                    (block + this_zone_blocks < sdkp->capacity
                                     || this_zone_blocks > zone_blocks)) {
-                                this_zone_blocks = 0;
+                                zone_blocks = 0;
                                 goto out;
                         }
                         block += this_zone_blocks;