Permalink
Commits on Sep 2, 2016
  1. Makefile: add EXTRAVERSION for linux4sam 5.4

    Nicolas Ferre
    Nicolas Ferre committed Sep 2, 2016
    Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Commits on Sep 1, 2016
  1. Merge branch 'at91-4.4-trunk/dt' into linux-4.4-at91

    Nicolas Ferre
    Nicolas Ferre committed Sep 1, 2016
  2. ARM: at91/dt: Disable SPI on at91sam9x5ek to allow MCI1 to work.

    cristibirsan authored and Nicolas Ferre committed Sep 1, 2016
    The A13 hardware line is shared by SPI and MCI1 controller.This patch
    disables the SPI controller so that the MCI1 (the big MMC card slot) can
    be used.
    
    Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
    [nicolas.ferre@atmel.com: add little comment]
    Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
  3. ARM: at91: at91_dt_defconfig: update

    Nicolas Ferre
    Nicolas Ferre committed Aug 31, 2016
    Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
  4. tty/serial: atmel: add fractional baud rate support

    ldesroches committed Aug 24, 2016
    The USART device provides a fractional baud rate generator to get a more
    accurate baud rate. It can be used only when the USART is configured in
    'normal mode' and this feature is not available on AT91RM9200 SoC.
    
    Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Commits on Aug 25, 2016
  1. Merge tag 'v4.4.19' into linux-4.4-at91

    Nicolas Ferre
    Nicolas Ferre committed Aug 25, 2016
    This is the 4.4.19 stable release
  2. Merge tag 'v4.4.18' into linux-4.4-at91

    Nicolas Ferre
    Nicolas Ferre committed Aug 25, 2016
    This is the 4.4.18 stable release
Commits on Aug 20, 2016
  1. Linux 4.4.19

    gregkh committed Aug 20, 2016
  2. Documentation/module-signing.txt: Note need for version info if reusi…

    bwhacks authored and gregkh committed Apr 27, 2016
    …ng a key
    
    commit b8612e5 upstream.
    
    Signing a module should only make it trusted by the specific kernel it
    was built for, not anything else.  If a module signing key is used for
    multiple ABI-incompatible kernels, the modules need to include enough
    version information to distinguish them.
    
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  3. module: Invalidate signatures on force-loaded modules

    bwhacks authored and gregkh committed Apr 27, 2016
    commit bca014c upstream.
    
    Signing a module should only make it trusted by the specific kernel it
    was built for, not anything else.  Loading a signed module meant for a
    kernel with a different ABI could have interesting effects.
    Therefore, treat all signatures as invalid when a module is
    force-loaded.
    
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  4. dm flakey: error READ bios during the down_interval

    snitm authored and gregkh committed Jul 29, 2016
    commit 99f3c90 upstream.
    
    When the corrupt_bio_byte feature was introduced it caused READ bios to
    no longer be errored with -EIO during the down_interval.  This had to do
    with the complexity of needing to submit READs if the corrupt_bio_byte
    feature was used.
    
    Fix it so READ bios are properly errored with -EIO; doing so early in
    flakey_map() as long as there isn't a match for the corrupt_bio_byte
    feature.
    
    Fixes: a399879 ("dm flakey: add corrupt_bio_byte feature")
    Reported-by: Akira Hayakawa <ruby.wktk@gmail.com>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  5. rtc: s3c: Add s3c_rtc_{enable/disable}_clk in s3c_rtc_setfreq()

    Alim Akhtar authored and gregkh committed Jul 5, 2016
    commit 70c96df upstream.
    
    As per code flow s3c_rtc_setfreq() will get called with rtc clock disabled
    and in set_freq we perform h/w registers read/write, which results in a
    kernel crash on exynos7 platform while probing rtc driver.
    Below is code flow:
    s3c_rtc_probe()
        clk_prepare_enable(info->rtc_clk) // rtc clock enabled
        s3c_rtc_gettime() // will enable clk if not done, and disable it upon exit
        s3c_rtc_setfreq() //then this will be called with clk disabled
    
    This patch take cares of such issue by adding s3c_rtc_{enable/disable}_clk in
    s3c_rtc_setfreq().
    
    Fixes: 24e1455 ("drivers/rtc/rtc-s3c.c: delete duplicate clock control")
    Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
    Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
    Reviewed-by: Pankaj Dubey <pankaj.dubey@samsung.com>
    Tested-by: Pankaj Dubey <pankaj.dubey@samsung.com>
    Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  6. lpfc: fix oops in lpfc_sli4_scmd_to_wqidx_distr() from lpfc_send_task…

    Mauricio Faria de Oliveira authored and gregkh committed Jun 7, 2016
    …mgmt()
    
    commit 05a0587 upstream.
    
    The lpfc_sli4_scmd_to_wqidx_distr() function expects the scsi_cmnd
    'lpfc_cmd->pCmd' not to be null, and point to the midlayer command.
    
    That's not true in the .eh_(device|target|bus)_reset_handler path,
    because lpfc_send_taskmgmt() sends commands not from the midlayer, so
    does not set 'lpfc_cmd->pCmd'.
    
    That is true in the .queuecommand path because lpfc_queuecommand()
    stores the scsi_cmnd from midlayer in lpfc_cmd->pCmd; and lpfc_cmd is
    stored by lpfc_scsi_prep_cmnd() in piocbq->context1 -- which is passed
    to lpfc_sli4_scmd_to_wqidx_distr() as lpfc_cmd parameter.
    
    This problem can be hit on SCSI EH, and immediately with sg_reset.
    These 2 test-cases demonstrate the problem/fix with next-20160601.
    
    Test-case 1) sg_reset
    
        # strace sg_reset --device /dev/sdm
        <...>
        open("/dev/sdm", O_RDWR|O_NONBLOCK)     = 3
        ioctl(3, SG_SCSI_RESET, 0x3fffde6d0994 <unfinished ...>
        +++ killed by SIGSEGV +++
        Segmentation fault
    
        # dmesg
        Unable to handle kernel paging request for data at address 0x00000000
        Faulting instruction address: 0xd00000001c88442c
        Oops: Kernel access of bad area, sig: 11 [#1]
        <...>
        CPU: 104 PID: 16333 Comm: sg_reset Tainted: G        W       4.7.0-rc1-next-20160601-00004-g95b89dc #6
        <...>
        NIP [d00000001c88442c] lpfc_sli4_scmd_to_wqidx_distr+0xc/0xd0 [lpfc]
        LR [d00000001c826fe8] lpfc_sli_calc_ring.part.27+0x98/0xd0 [lpfc]
        Call Trace:
        [c000003c9ec876f0] [c000003c9ec87770] 0xc000003c9ec87770 (unreliable)
        [c000003c9ec87720] [d00000001c82e004] lpfc_sli_issue_iocb+0xd4/0x260 [lpfc]
        [c000003c9ec87780] [d00000001c831a3c] lpfc_sli_issue_iocb_wait+0x15c/0x5b0 [lpfc]
        [c000003c9ec87880] [d00000001c87f27c] lpfc_send_taskmgmt+0x24c/0x650 [lpfc]
        [c000003c9ec87950] [d00000001c87fd7c] lpfc_device_reset_handler+0x10c/0x200 [lpfc]
        [c000003c9ec87a10] [c000000000610694] scsi_try_bus_device_reset+0x44/0xc0
        [c000003c9ec87a40] [c0000000006113e8] scsi_ioctl_reset+0x198/0x2c0
        [c000003c9ec87bf0] [c00000000060fe5c] scsi_ioctl+0x13c/0x4b0
        [c000003c9ec87c80] [c0000000006629b0] sd_ioctl+0xf0/0x120
        [c000003c9ec87cd0] [c00000000046e4f8] blkdev_ioctl+0x248/0xb70
        [c000003c9ec87d30] [c0000000002a1f60] block_ioctl+0x70/0x90
        [c000003c9ec87d50] [c00000000026d334] do_vfs_ioctl+0xc4/0x890
        [c000003c9ec87de0] [c00000000026db60] SyS_ioctl+0x60/0xc0
        [c000003c9ec87e30] [c000000000009120] system_call+0x38/0x108
        Instruction dump:
        <...>
    
        With fix:
    
        # strace sg_reset --device /dev/sdm
        <...>
        open("/dev/sdm", O_RDWR|O_NONBLOCK)     = 3
        ioctl(3, SG_SCSI_RESET, 0x3fffe103c554) = 0
        close(3)                                = 0
        exit_group(0)                           = ?
        +++ exited with 0 +++
    
        # dmesg
        [  424.658649] lpfc 0006:01:00.4: 4:(0):0713 SCSI layer issued Device Reset (1, 0) return x2002
    
    Test-case 2) SCSI EH
    
        Using this debug patch to wire an SCSI EH trigger, for lpfc_scsi_cmd_iocb_cmpl():
        -       cmd->scsi_done(cmd);
        +       if ((phba->pport ? phba->pport->cfg_log_verbose : phba->cfg_log_verbose) == 0x32100000)
        +               printk(KERN_ALERT "lpfc: skip scsi_done()\n");
        +       else
        +               cmd->scsi_done(cmd);
    
        # echo 0x32100000 > /sys/class/scsi_host/host11/lpfc_log_verbose
    
        # dd if=/dev/sdm of=/dev/null iflag=direct &
        <...>
    
        After a while:
    
        # dmesg
        lpfc 0006:01:00.4: 4:(0):3053 lpfc_log_verbose changed from 0 (x0) to 839909376 (x32100000)
        lpfc: skip scsi_done()
        <...>
        Unable to handle kernel paging request for data at address 0x00000000
        Faulting instruction address: 0xd0000000199e448c
        Oops: Kernel access of bad area, sig: 11 [#1]
        <...>
        CPU: 96 PID: 28556 Comm: scsi_eh_11 Tainted: G        W       4.7.0-rc1-next-20160601-00004-g95b89dc #6
        <...>
        NIP [d0000000199e448c] lpfc_sli4_scmd_to_wqidx_distr+0xc/0xd0 [lpfc]
        LR [d000000019986fe8] lpfc_sli_calc_ring.part.27+0x98/0xd0 [lpfc]
        Call Trace:
        [c000000ff0d0b890] [c000000ff0d0b900] 0xc000000ff0d0b900 (unreliable)
        [c000000ff0d0b8c0] [d00000001998e004] lpfc_sli_issue_iocb+0xd4/0x260 [lpfc]
        [c000000ff0d0b920] [d000000019991a3c] lpfc_sli_issue_iocb_wait+0x15c/0x5b0 [lpfc]
        [c000000ff0d0ba20] [d0000000199df27c] lpfc_send_taskmgmt+0x24c/0x650 [lpfc]
        [c000000ff0d0baf0] [d0000000199dfd7c] lpfc_device_reset_handler+0x10c/0x200 [lpfc]
        [c000000ff0d0bbb0] [c000000000610694] scsi_try_bus_device_reset+0x44/0xc0
        [c000000ff0d0bbe0] [c0000000006126cc] scsi_eh_ready_devs+0x49c/0x9c0
        [c000000ff0d0bcb0] [c000000000614160] scsi_error_handler+0x580/0x680
        [c000000ff0d0bd80] [c0000000000ae848] kthread+0x108/0x130
        [c000000ff0d0be30] [c0000000000094a8] ret_from_kernel_thread+0x5c/0xb4
        Instruction dump:
        <...>
    
        With fix:
    
        # dmesg
        lpfc 0006:01:00.4: 4:(0):3053 lpfc_log_verbose changed from 0 (x0) to 839909376 (x32100000)
        lpfc: skip scsi_done()
        <...>
        lpfc 0006:01:00.4: 4:(0):0713 SCSI layer issued Device Reset (0, 0) return x2002
        <...>
        lpfc 0006:01:00.4: 4:(0):0723 SCSI layer issued Target Reset (1, 0) return x2002
        <...>
        lpfc 0006:01:00.4: 4:(0):0714 SCSI layer issued Bus Reset Data: x2002
        <...>
        lpfc 0006:01:00.4: 4:(0):3172 SCSI layer issued Host Reset Data:
        <...>
    
    Fixes: 8b0dff1 ("lpfc: Add support for using block multi-queue")
    Signed-off-by: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
    Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
    Acked-by: James Smart <james.smart@broadcom.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  7. ACPI / EC: Work around method reentrancy limit in ACPICA for _Qxx

    zetalog authored and gregkh committed Aug 3, 2016
    commit e1191bd upstream.
    
    A regression is caused by the following commit:
    
      Commit: 02b771b
      Subject: ACPI / EC: Fix an issue caused by the serialized _Qxx evaluations
    
    In this commit, using system workqueue causes that the maximum parallel
    executions of _Qxx can exceed 255. This violates the method reentrancy
    limit in ACPICA and generates the following error log:
    
      ACPI Error: Method reached maximum reentrancy limit (255) (20150818/dsmethod-341)
    
    This patch creates a seperate workqueue and limits the number of parallel
    _Qxx evaluations down to a configurable value (can be tuned against number
    of online CPUs).
    
    Since EC events are handled after driver probe, we can create the workqueue
    in acpi_ec_init().
    
    Fixes: 02b771b (ACPI / EC: Fix an issue caused by the serialized _Qxx evaluations)
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=135691
    Reported-and-tested-by: Helen Buus <ubuntu@hbuus.com>
    Signed-off-by: Lv Zheng <lv.zheng@intel.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  8. x86/platform/intel_mid_pci: Rework IRQ0 workaround

    andy-shev authored and gregkh committed Jun 13, 2016
    commit bb27570 upstream.
    
    On Intel Merrifield platform several PCI devices have a bogus configuration,
    i.e. the IRQ0 had been assigned to few of them. These are PCI root bridge,
    eMMC0, HS UART common registers, PWM, and HDMI. The actual interrupt line can
    be allocated to one device exclusively, in our case to eMMC0, the rest should
    cope without it and basically known drivers for them are not using interrupt
    line at all.
    
    Rework IRQ0 workaround, which was previously done to avoid conflict between
    eMMC0 and HS UART common registers, to behave differently based on the device
    in question, i.e. allocate interrupt line to eMMC0, but silently skip interrupt
    allocation for the rest except HS UART common registers which are not used
    anyway. With this rework IOSF MBI driver in particular would be used.
    
    Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Acked-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Bjorn Helgaas <bhelgaas@google.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Fixes: 39d9b77 ("x86/pci/intel_mid_pci: Work around for IRQ0 assignment")
    Link: http://lkml.kernel.org/r/1465842481-136852-1-git-send-email-andriy.shevchenko@linux.intel.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  9. PCI: Mark Atheros AR9485 and QCA9882 to avoid bus reset

    riptidewave93 authored and gregkh committed May 30, 2016
    commit 9ac0108 upstream.
    
    Similar to the AR93xx series, the AR94xx and the Qualcomm QCA988x also have
    the same quirk for the Bus Reset.
    
    Fixes: c3e59ee ("PCI: Mark Atheros AR93xx to avoid bus reset")
    Signed-off-by: Chris Blake <chrisrblake93@gmail.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  10. MIPS: hpet: Increase HPET_MIN_PROG_DELTA and decrease HPET_MIN_CYCLES

    chenhuacai authored and gregkh committed Jul 21, 2016
    commit 3ef0665 upstream.
    
    At first, we prefer to use mips clockevent device, so we decrease the
    rating of hpet clockevent device.
    
    For hpet, if HPET_MIN_PROG_DELTA (minimum delta of hpet programming) is
    too small and HPET_MIN_CYCLES (threshold of -ETIME checking) is too
    large, then hpet_next_event() can easily return -ETIME. After commit
    c6eb3f7 ("hrtimer: Get rid of hrtimer softirq") this will cause
    a RCU stall.
    
    So, HPET_MIN_PROG_DELTA must be sufficient that we don't re-trip the
    -ETIME check -- if we do, we will return -ETIME, forward the next event
    time, try to set it, return -ETIME again, and basically lock the system
    up. Meanwhile, HPET_MIN_CYCLES doesn't need to be too large, 16 cycles
    is enough.
    
    This solution is similar to commit f9eccf2 ("clocksource/drivers
    /vt8500: Increase the minimum delta").
    
    By the way, this patch ensures hpet count/compare to be 32-bit long.
    
    Signed-off-by: Huacai Chen <chenhc@lemote.com>
    Cc: John Crispin <john@phrozen.org>
    Cc: Steven J . Hill <Steven.Hill@imgtec.com>
    Cc: Fuxin Zhang <zhangfx@lemote.com>
    Cc: Zhangjin Wu <wuzhangjin@gmail.com>
    Cc: linux-mips@linux-mips.org
    Patchwork: https://patchwork.linux-mips.org/patch/13819/
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  11. MIPS: Don't register r4k sched clock when CPUFREQ enabled

    chenhuacai authored and gregkh committed Jul 22, 2016
    commit 07d6957 upstream.
    
    Don't register r4k sched clock when CPUFREQ enabled because sched clock
    need a constant frequency.
    
    Signed-off-by: Huacai Chen <chenhc@lemote.com>
    Cc: John Crispin <john@phrozen.org>
    Cc: Steven J . Hill <Steven.Hill@caviumnetworks.com>
    Cc: Fuxin Zhang <zhangfx@lemote.com>
    Cc: Zhangjin Wu <wuzhangjin@gmail.com>
    Cc: linux-mips@linux-mips.org
    Patchwork: https://patchwork.linux-mips.org/patch/13820/
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  12. MIPS: mm: Fix definition of R6 cache instruction

    mpredfearn authored and gregkh committed Jun 14, 2016
    commit 4f53989 upstream.
    
    Commit a168b8f ("MIPS: mm: Add MIPS R6 instruction encodings") added
    an incorrect definition of the redefined MIPSr6 cache instruction.
    
    Executing any kernel code including this instuction results in a
    reserved instruction exception and kernel panic.
    
    Fix the instruction definition.
    
    Fixes: a168b8f
    Signed-off-by: Matt Redfearn <matt.redfearn@imgtec.com>
    Cc: linux-mips@linux-mips.org
    Cc: linux-kernel@vger.kernel.org
    Patchwork: https://patchwork.linux-mips.org/patch/13663/
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  13. SUNRPC: Don't allocate a full sockaddr_storage for tracing

    trondmypd authored and gregkh committed Jun 24, 2016
    commit db1bb44 upstream.
    
    We're always tracing IPv4 or IPv6 addresses, so we can save a lot
    of space on the ringbuffer by allocating the correct sockaddr size.
    
    Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
    Fixes: 83a712e "sunrpc: add some tracepoints around ..."
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  14. Input: elan_i2c - properly wake up touchpad on ASUS laptops

    KT Liao authored and gregkh committed Jul 13, 2016
    commit 2de4fcc upstream.
    
    Some ASUS laptops were shipped with touchpads that require to be woken up
    first, before trying to switch them into absolute reporting mode, otherwise
    touchpad would fail to work while flooding the logs with:
    
    	elan_i2c i2c-ELAN1000:00: invalid report id data (1)
    
    Among affected devices are Asus E202SA, N552VW, X456UF, UX305CA, and
    others. We detect such devices by checking the IC type and product ID
    numbers and adjusting order of operations accordingly.
    
    Signed-off-by: KT Liao <kt.liao@emc.com.tw>
    Reported-by: Chris Chiu <chiu@endlessm.com>
    Reported-by: Vlad Glagolev <stealth@vaygr.net>
    Tested-by: Vlad Glagolev <stealth@vaygr.net>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  15. target: Fix ordered task CHECK_CONDITION early exception handling

    nablio3000 authored and gregkh committed Jun 14, 2016
    commit 410c29d upstream.
    
    If a Simple command is sent with a failure, target_setup_cmd_from_cdb
    returns with TCM_UNSUPPORTED_SCSI_OPCODE or TCM_INVALID_CDB_FIELD.
    
    So in the cases where target_setup_cmd_from_cdb returns an error, we
    never get far enough to call target_execute_cmd to increment simple_cmds.
    Since simple_cmds isn't incremented, the result of the failure from
    target_setup_cmd_from_cdb causes transport_generic_request_failure to
    decrement simple_cmds, due to call to transport_complete_task_attr.
    
    With this dev->simple_cmds or dev->dev_ordered_sync is now -1, not 0.
    So when a subsequent command with an Ordered Task is sent, it causes
    a hang, since dev->simple_cmds is at -1.
    
    Tested-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
    Signed-off-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
    Tested-by: Michael Cyr <mikecyr@linux.vnet.ibm.com>
    Signed-off-by: Michael Cyr <mikecyr@linux.vnet.ibm.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  16. target: Fix max_unmap_lba_count calc overflow

    mikechristie authored and gregkh committed Jun 3, 2016
    commit ea263c7 upstream.
    
    max_discard_sectors only 32bits, and some non scsi backend
    devices will set this to the max 0xffffffff, so we can end up
    overflowing during the max_unmap_lba_count calculation.
    
    This fixes a regression caused by my patch:
    
    commit 8a9ebe7
    Author: Mike Christie <mchristi@redhat.com>
    Date:   Mon Jan 18 14:09:27 2016 -0600
    
        target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors
    
    which can result in extra discards being sent to due the overflow
    causing max_unmap_lba_count to be smaller than what the backing
    device can actually support.
    
    Signed-off-by: Mike Christie <mchristi@redhat.com>
    Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  17. target: Fix race between iscsi-target connection shutdown + ABORT_TASK

    nablio3000 authored and gregkh committed Jun 2, 2016
    commit 064cdd2 upstream.
    
    This patch fixes a race in iscsit_release_commands_from_conn() ->
    iscsit_free_cmd() -> transport_generic_free_cmd() + wait_for_tasks=1,
    where CMD_T_FABRIC_STOP could end up being set after the final
    kref_put() is called from core_tmr_abort_task() context.
    
    This results in transport_generic_free_cmd() blocking indefinately
    on se_cmd->cmd_wait_comp, because the target_release_cmd_kref()
    check for CMD_T_FABRIC_STOP returns false.
    
    To address this bug, make iscsit_release_commands_from_conn()
    do list_splice and set CMD_T_FABRIC_STOP early while holding
    iscsi_conn->cmd_lock.  Also make iscsit_aborted_task() only
    remove iscsi_cmd_t if CMD_T_FABRIC_STOP has not already been
    set.
    
    Finally in target_release_cmd_kref(), only honor fabric_stop
    if CMD_T_ABORTED has been set.
    
    Cc: Mike Christie <mchristi@redhat.com>
    Cc: Quinn Tran <quinn.tran@qlogic.com>
    Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Hannes Reinecke <hare@suse.de>
    Tested-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18. target: Fix missing complete during ABORT_TASK + CMD_T_FABRIC_STOP

    nablio3000 authored and gregkh committed May 25, 2016
    commit 5e2c956 upstream.
    
    During transport_generic_free_cmd() with a concurrent TMR
    ABORT_TASK and shutdown CMD_T_FABRIC_STOP bit set, the
    caller will be blocked on se_cmd->cmd_wait_stop completion
    until the final kref_put() -> target_release_cmd_kref()
    has been invoked to call complete().
    
    However, when ABORT_TASK is completed with FUNCTION_COMPLETE
    in core_tmr_abort_task(), the aborted se_cmd will have already
    been removed from se_sess->sess_cmd_list via list_del_init().
    
    This results in target_release_cmd_kref() hitting the
    legacy list_empty() == true check, invoking ->release_cmd()
    but skipping complete() to wakeup se_cmd->cmd_wait_stop
    blocked earlier in transport_generic_free_cmd() code.
    
    To address this bug, it's safe to go ahead and drop the
    original list_empty() check so that fabric_stop invokes
    the complete() as expected, since list_del_init() can
    safely be used on a empty list.
    
    Cc: Mike Christie <mchristi@redhat.com>
    Cc: Quinn Tran <quinn.tran@qlogic.com>
    Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Hannes Reinecke <hare@suse.de>
    Tested-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  19. target: Fix ordered task target_setup_cmd_from_cdb exception hang

    nablio3000 authored and gregkh committed May 18, 2016
    commit dff0ca9 upstream.
    
    If a command with a Simple task attribute is failed due to a Unit
    Attention, then a subsequent command with an Ordered task attribute
    will hang forever.  The reason for this is that the Unit Attention
    status is checked for in target_setup_cmd_from_cdb, before the call
    to target_execute_cmd, which calls target_handle_task_attr, which
    in turn increments dev->simple_cmds.
    
    However, transport_generic_request_failure still calls
    transport_complete_task_attr, which will decrement dev->simple_cmds.
    In this case, simple_cmds is now -1.  So when a command with the
    Ordered task attribute is sent, target_handle_task_attr sees that
    dev->simple_cmds is not 0, so it decides it can't execute the
    command until all the (nonexistent) Simple commands have completed.
    
    Reported-by: Michael Cyr <mikecyr@linux.vnet.ibm.com>
    Tested-by: Michael Cyr <mikecyr@linux.vnet.ibm.com>
    Reported-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
    Tested-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  20. iscsi-target: Fix panic when adding second TCP connection to iSCSI se…

    vonnyfly authored and gregkh committed Jul 11, 2016
    …ssion
    
    commit 8abc718 upstream.
    
    In MC/S scenario, the conn->sess has been set NULL in
    iscsi_login_non_zero_tsih_s1 when the second connection comes here,
    then kernel panic.
    
    The conn->sess will be assigned in iscsi_login_non_zero_tsih_s2. So
    we should check whether it's NULL before calling.
    
    Signed-off-by: Feng Li <lifeng1519@gmail.com>
    Tested-by: Sumit Rai <sumit.rai@calsoftinc.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21. ubi: Fix race condition between ubi device creation and udev

    iharutyunov authored and gregkh committed Jul 22, 2016
    commit 714fb87 upstream.
    
    Install the UBI device object before we arm sysfs.
    Otherwise udev tries to read sysfs attributes before UBI is ready and
    udev rules will not match.
    
    Signed-off-by: Iosif Harutyunov <iharutyunov@sonicwall.com>
    [rw: massaged commit message]
    Signed-off-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22. ubi: Fix early logging

    richardweinberger authored and gregkh committed Jul 4, 2016
    commit bc743f3 upstream.
    
    We cannot use ubi_* logging functions before the UBI
    object is initialized.
    
    Fixes: 3260870 ("UBI: Extend UBI layer debug/messaging capabilities")
    Signed-off-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23. ubi: Make volume resize power cut aware

    richardweinberger authored and gregkh committed Jun 23, 2016
    commit 4946784 upstream.
    
    When the volume resize operation shrinks a volume,
    LEBs will be unmapped. Since unmapping will not erase these
    LEBs immediately we have to wait for that operation to finish.
    Otherwise in case of a power cut right after writing the new
    volume table the UBI attach process can find more LEBs than the
    volume table knows. This will render the UBI image unattachable.
    
    Fix this issue by waiting for erase to complete and write the new
    volume table afterward.
    
    Reported-by: Boris Brezillon <boris.brezillon@free-electrons.com>
    Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
    Signed-off-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  24. of: fix memory leak related to safe_name()

    Frank Rowand authored and gregkh committed Jun 16, 2016
    commit d9fc880 upstream.
    
    Fix a memory leak resulting from memory allocation in safe_name().
    This patch fixes all call sites of safe_name().
    
    Mathieu Malaterre reported the memory leak on boot:
    
    On my PowerMac device-tree would generate a duplicate name:
    
    [    0.023043] device-tree: Duplicate name in PowerPC,G4@0, renamed to "l2-cache#1"
    
    in this case a newly allocated name is generated by `safe_name`. However
    in this case it is never deallocated.
    
    The bug was found using kmemleak reported as:
    
    unreferenced object 0xdf532e60 (size 32):
      comm "swapper", pid 1, jiffies 4294892300 (age 1993.532s)
      hex dump (first 32 bytes):
        6c 32 2d 63 61 63 68 65 23 31 00 dd e4 dd 1e c2  l2-cache#1......
        ec d4 ba ce 04 ec cc de 8e 85 e9 ca c4 ec cc 9e  ................
      backtrace:
        [<c02d3350>] kvasprintf+0x64/0xc8
        [<c02d3400>] kasprintf+0x4c/0x5c
        [<c0453814>] safe_name.isra.1+0x80/0xc4
        [<c04545d8>] __of_attach_node_sysfs+0x6c/0x11c
        [<c075f21c>] of_core_init+0x8c/0xf8
        [<c0729594>] kernel_init_freeable+0xd4/0x208
        [<c00047e8>] kernel_init+0x24/0x11c
        [<c00158ec>] ret_from_kernel_thread+0x5c/0x64
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=120331
    
    Signed-off-by: Frank Rowand <frank.rowand@am.sony.com>
    Reported-by: mathieu.malaterre@gmail.com
    Tested-by: Mathieu Malaterre <mathieu.malaterre@gmail.com>
    Signed-off-by: Rob Herring <robh@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  25. IB/mlx4: Fix memory leak if QP creation failed

    Dotan Barak authored and gregkh committed Jun 22, 2016
    commit 5b420d9 upstream.
    
    When RC, UC, or RAW QPs are created, a qp object is allocated (kzalloc).
    If at a later point (in procedure create_qp_common) the qp creation fails,
    this qp object must be freed.
    
    Fixes: 1ffeb2e ("IB/mlx4: SR-IOV IB context objects and proxy/tunnel SQP support")
    Signed-off-by: Dotan Barak <dotanb@dev.mellanox.co.il>
    Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Doug Ledford <dledford@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  26. IB/mlx4: Fix error flow when sending mads under SRIOV

    yishaih authored and gregkh committed Jun 22, 2016
    commit a610060 upstream.
    
    Fix mad send error flow to prevent double freeing address handles,
    and leaking tx_ring entries when SRIOV is active.
    
    If ib_mad_post_send fails, the address handle pointer in the tx_ring entry
    must be set to NULL (or there will be a double-free) and tx_tail must be
    incremented (or there will be a leak of tx_ring entries).
    The tx_ring is handled the same way in the send-completion handler.
    
    Fixes: 37bfc7c ("IB/mlx4: SR-IOV multiplex and demultiplex MADs")
    Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
    Reviewed-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Doug Ledford <dledford@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>