Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1553201 > unrolled thread

[PATCH 4.9 000/116] 4.9.2-stable review

Started byGreg Kroah-Hartman <gregkh@linuxfoundation.org>
First post2017-01-06 23:00 +0100
Last post2017-01-07 17:20 +0100
Articles 20 on this page of 108 — 9 participants

Back to article view | Back to linux.kernel


Contents

  [PATCH 4.9 000/116] 4.9.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:00 +0100
    [PATCH 4.9 022/116] docs: sphinx-extensions: make rstFlatTable work with docutils 0.13 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:00 +0100
    [PATCH 4.9 029/116] ACPI / video: Add force_native quirk for HP Pavilion dv6 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:00 +0100
    [PATCH 4.9 049/116] drm/amdgpu: fix init save/restore list in gfx_v8.0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:00 +0100
    [PATCH 4.9 002/116] ath10k: fix soft lockup during firmware crash/hw-restart Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:00 +0100
    [PATCH 4.9 078/116] platform/x86: asus-nb-wmi.c: Add X45U quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 053/116] block: protect iterate_bdevs() against concurrent close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 040/116] drm/nouveau/i2c/gk110b,gm10x: use the correct implementation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 076/116] vsock/virtio: fix src/dst cid format Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 084/116] IB/rxe: Fix a memory leak in rxe_qp_cleanup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 039/116] drm/nouveau/ttm: wait for bo fence to signal before unmapping vmas Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 110/116] net: mvpp2: fix dma unmapping of TX buffers for fragments Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 050/116] drivers/gpu/drm/ast: Fix infinite loop if read fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 103/116] powerpc/ps3: Fix system hang with GCC 5 builds Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 099/116] pNFS: Clear NFS_LAYOUT_RETURN_REQUESTED when invalidating the layout stateid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 081/116] IB/mad: Fix an array index check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 080/116] fgraph: Handle a case where a tracer ignores set_graph_notrace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 090/116] [media] v4l: tvp5150: Add missing break in set control handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 051/116] mei: request async autosuspend at the end of enumeration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 097/116] pNFS: On error, do not send LAYOUTGET until the LAYOUTRETURN has completed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 096/116] nfs_write_end(): fix handling of short copies Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 077/116] ftrace/x86_32: Set ftrace_stub to weak to prevent gcc from using short jumps to it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 089/116] [media] media: solo6x10: fix lockup by avoiding delayed register write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 107/116] target/user: Fix use-after-free of tcmu_cmds if they are expired Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 072/116] KVM: PPC: Book3S HV: Save/restore XER in checkpointed register state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 037/116] drm/nouveau/bios: require checksum to match for fast acpi shadow method Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 108/116] kconfig/nconf: Fix hang when editing symbol with a long prompt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 098/116] pNFS: Dont clear the layout stateid if a layout return is outstanding Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 070/116] md/raid5: limit request size according to implementation limits Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 109/116] sg_write()/bsg_write() is not fit to be called under KERNEL_DS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:10 +0100
    [PATCH 4.9 116/116] drm/i915: Fix setting of boost freq tunable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:20 +0100
    [PATCH 4.9 101/116] SUNRPC: fix refcounting problems with auth_gss messages. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:30 +0100
    [PATCH 4.9 074/116] kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:30 +0100
    [PATCH 4.9 105/116] of, numa: Return NUMA_NO_NODE from disable of_node_to_nid() if nid not possible. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:30 +0100
    [PATCH 4.9 102/116] powerpc/64e: Convert cmpi to cmpwi in head_64.S Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:30 +0100
    [PATCH 4.9 079/116] x86/smpboot: Make logical package management more robust Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:30 +0100
    [PATCH 4.9 115/116] drm/i915: skip the first 4k of stolen memory on everything >= gen8 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:30 +0100
    [PATCH 4.9 069/116] sc16is7xx: Drop bogus use of IRQF_ONESHOT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:30 +0100
    [PATCH 4.9 104/116] powerpc/boot: Request no dynamic linker for boot wrapper Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:30 +0100
    [PATCH 4.9 106/116] libnvdimm, pfn: fix align attribute Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:30 +0100
    [PATCH 4.9 071/116] scsi: aacraid: remove wildcard for series 9 controllers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:30 +0100
    [PATCH 4.9 075/116] fsnotify: Fix possible use-after-free in inode iteration on umount Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:30 +0100
    [PATCH 4.9 100/116] pNFS: Fix a deadlock between read resends and layoutreturn Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:30 +0100
    [PATCH 4.9 082/116] IPoIB: Avoid reading an uninitialized member variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 068/116] latent_entropy: fix ARM build error on earlier gcc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 073/116] KVM: PPC: Book3S HV: Dont lose hardware R/C bit updates in H_PROTECT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 091/116] Input: drv260x - fix input devices parent assignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 088/116] [media] s5p-mfc: fix failure path of s5p_mfc_alloc_memdev() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 093/116] i40iw: Use correct src address in memcpy to rdma stats counters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 035/116] drm/nouveau/gr: fallback to legacy paths during firmware lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 086/116] [media] mn88472: fix chip id check on probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 087/116] [media] mn88473: fix chip id check on probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 095/116] libceph: verify authorize reply on connect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 067/116] arm64: KVM: pmu: Reset PMSELR_EL0.SEL to a sane value before entering the guest Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 038/116] drm/nouveau/ltc: protect clearing of comptags with mutex Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 092/116] bad_inode: add missing i_op initializers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 036/116] drm/nouveau/kms: lvds panel strap moved again on maxwell Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 085/116] IB/cma: Fix a race condition in iboe_addr_get_sgid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 094/116] PCI: Check for PME in targeted sleep state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 031/116] drm/amdgpu: add additional pci revision to dpm workaround Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 083/116] IB/multicast: Check ib_find_pkey() return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:40 +0100
    [PATCH 4.9 066/116] s390/kexec: use node 0 when re-adding crash kernel memory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 060/116] scsi: zfcp: do not trace pure benign residual HBA responses at default level Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 063/116] ARC: mm: arc700: Dont assume 2 colours for aliasing VIPT dcache Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 048/116] drm/amdgpu: fix enable_cp_power_gating in gfx_v8.0. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 059/116] scsi: zfcp: fix use-after-"free" in FC ingress path after TMF Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 054/116] vt: fix Scroll Lock LED trigger name Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 052/116] mei: me: add lewisburg device ids Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 064/116] firmware: fix usermode helper fallback loading Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 009/116] ath9k: fix ath9k_hw_gpio_get() to return 0 or 1 on success Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 065/116] s390/vmlogrdr: fix IUCV buffer allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 034/116] drm/amd/amdgpu: enable GUI idle INT after enabling CGCG Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 055/116] stm class: Fix device leak in open error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 062/116] scsi: avoid a permanent stop of the scsi devices request queue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 058/116] iscsi-target: Return error if unable to add network portal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 057/116] scsi: megaraid_sas: Do not set MPI2_TYPE_CUDA for JBOD FP path for FW which does not support JBOD sequence map Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 061/116] scsi: zfcp: fix rport unblock race with LUN recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 046/116] drm/gma500: Add compat ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 056/116] scsi: megaraid_sas: For SRIOV enabled firmware, ensure VF driver waits for 30secs before reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 008/116] cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 005/116] perf annotate: Dont throw error for zero length symbols Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-06 23:50 +0100
    [PATCH 4.9 026/116] staging: comedi: ni_mio_common: fix M Series ni_ai_insn_read() data mask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-07 00:00 +0100
    [PATCH 4.9 011/116] ath9k: do not return early to fix rcu unlocking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-07 00:00 +0100
    [PATCH 4.9 019/116] arm64: tegra: Add VDD_GPU regulator to Jetson TX1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-07 00:00 +0100
    [PATCH 4.9 012/116] Revert "mmc: sdhci: Reset cmd and data circuits after tuning failure" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-07 00:00 +0100
    [PATCH 4.9 030/116] drm/amdgpu/si: load the proper firmware on 0x87 oland boards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-07 00:00 +0100
    [PATCH 4.9 025/116] staging: lustre: ldlm: pl_recalc time handling is wrong Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-07 00:00 +0100
    [PATCH 4.9 023/116] hv: acquire vmbus_connection.channel_mutex in vmbus_free_channels() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-07 00:00 +0100
    [PATCH 4.9 024/116] staging/lustre/osc: Revert erroneous list_for_each_entry_safe use Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-07 00:00 +0100
    [PATCH 4.9 003/116] rtlwifi: Fix enter/exit power_save Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-07 00:00 +0100
      Re: [PATCH 4.9 003/116] rtlwifi: Fix enter/exit power_save Dmitry Osipenko <digetx@gmail.com> - 2017-01-10 18:50 +0100
        Re: [PATCH 4.9 003/116] rtlwifi: Fix enter/exit power_save Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 21:50 +0100
          Re: [PATCH 4.9 003/116] rtlwifi: Fix enter/exit power_save lkml@pengaru.com - 2017-01-10 22:30 +0100
            Re: [PATCH 4.9 003/116] rtlwifi: Fix enter/exit power_save Willy Tarreau <w@1wt.eu> - 2017-01-10 23:00 +0100
              Re: [PATCH 4.9 003/116] rtlwifi: Fix enter/exit power_save Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-12 08:40 +0100
                Re: [PATCH 4.9 003/116] rtlwifi: Fix enter/exit power_save Dmitry Osipenko <digetx@gmail.com> - 2017-01-12 09:50 +0100
                Re: [PATCH 4.9 003/116] rtlwifi: Fix enter/exit power_save Kalle Valo <kvalo@codeaurora.org> - 2017-01-13 07:50 +0100
                  Re: [PATCH 4.9 003/116] rtlwifi: Fix enter/exit power_save Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 12:00 +0100
          Re: [PATCH 4.9 003/116] rtlwifi: Fix enter/exit power_save Larry Finger <Larry.Finger@lwfinger.net> - 2017-01-11 03:00 +0100
        Re: [PATCH 4.9 003/116] rtlwifi: Fix enter/exit power_save Larry Finger <Larry.Finger@lwfinger.net> - 2017-01-11 03:00 +0100
          Re: [PATCH 4.9 003/116] rtlwifi: Fix enter/exit power_save Dmitry Osipenko <digetx@gmail.com> - 2017-01-12 09:50 +0100
    Re: [PATCH 4.9 000/116] 4.9.2-stable review Shuah Khan <shuah.kh@samsung.com> - 2017-01-07 03:10 +0100
      Re: [PATCH 4.9 000/116] 4.9.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-07 14:20 +0100
    Re: [PATCH 4.9 000/116] 4.9.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-07 14:30 +0100
      Re: [PATCH 4.9 000/116] 4.9.2-stable review Kevin Hilman <khilman@baylibre.com> - 2017-01-09 19:20 +0100
        Re: [PATCH 4.9 000/116] 4.9.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 11:20 +0100
    Re: [PATCH 4.9 000/116] 4.9.2-stable review Guenter Roeck <linux@roeck-us.net> - 2017-01-07 17:10 +0100
      Re: [PATCH 4.9 000/116] 4.9.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-07 17:20 +0100

Page 4 of 6 — ← Prev page 1 2 3 [4] 5 6  Next page →


#1553382 — [PATCH 4.9 083/116] IB/multicast: Check ib_find_pkey() return value

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:40 +0100
Subject[PATCH 4.9 083/116] IB/multicast: Check ib_find_pkey() return value
Message-ID<sWLl1-8sx-75@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bart Van Assche <bart.vanassche@sandisk.com>

commit d3a2418ee36a59bc02e9d454723f3175dcf4bfd9 upstream.

This patch avoids that Coverity complains about not checking the
ib_find_pkey() return value.

Fixes: commit 547af76521b3 ("IB/multicast: Report errors on multicast groups if P_key changes")
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/core/multicast.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/infiniband/core/multicast.c
+++ b/drivers/infiniband/core/multicast.c
@@ -518,8 +518,11 @@ static void join_handler(int status, str
 		process_join_error(group, status);
 	else {
 		int mgids_changed, is_mgid0;
-		ib_find_pkey(group->port->dev->device, group->port->port_num,
-			     be16_to_cpu(rec->pkey), &pkey_index);
+
+		if (ib_find_pkey(group->port->dev->device,
+				 group->port->port_num, be16_to_cpu(rec->pkey),
+				 &pkey_index))
+			pkey_index = MCAST_INVALID_PKEY_INDEX;
 
 		spin_lock_irq(&group->port->lock);
 		if (group->state == MCAST_BUSY &&

[toc] | [prev] | [next] | [standalone]


#1553383 — [PATCH 4.9 066/116] s390/kexec: use node 0 when re-adding crash kernel memory

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 066/116] s390/kexec: use node 0 when re-adding crash kernel memory
Message-ID<sWLuF-4T-1@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Heiko Carstens <heiko.carstens@de.ibm.com>

commit 9f88eb4df728aebcd2ddd154d99f1d75b428b897 upstream.

When re-adding crash kernel memory within setup_resources() the
function memblock_add() is used. That function will add memory by
default to node "MAX_NUMNODES" instead of node 0, like the memory
detection code does. In case of !NUMA this will trigger this warning
when the kernel generates the vmemmap:

Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead
WARNING: CPU: 0 PID: 0 at mm/memblock.c:1261 memblock_virt_alloc_internal+0x76/0x220
CPU: 0 PID: 0 Comm: swapper Not tainted 4.9.0-rc6 #16
Call Trace:
 [<0000000000d0b2e8>] memblock_virt_alloc_try_nid+0x88/0xc8
 [<000000000083c8ea>] __earlyonly_bootmem_alloc.constprop.1+0x42/0x50
 [<000000000083e7f4>] vmemmap_populate+0x1ac/0x1e0
 [<0000000000840136>] sparse_mem_map_populate+0x46/0x68
 [<0000000000d0c59c>] sparse_init+0x184/0x238
 [<0000000000cf45f6>] paging_init+0xbe/0xf8
 [<0000000000cf1d4a>] setup_arch+0xa02/0xae0
 [<0000000000ced75a>] start_kernel+0x72/0x450
 [<0000000000100020>] _stext+0x20/0x80

If NUMA is selected numa_setup_memory() will fix the node assignments
before the vmemmap will be populated; so this warning will only appear
if NUMA is not selected.

To fix this simply use memblock_add_node() and re-add crash kernel
memory explicitly to node 0.

Reported-and-tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
Fixes: 4e042af463f8 ("s390/kexec: fix crash on resize of reserved memory")
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/kernel/setup.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -445,7 +445,7 @@ static void __init setup_resources(void)
 	 * part of the System RAM resource.
 	 */
 	if (crashk_res.end) {
-		memblock_add(crashk_res.start, resource_size(&crashk_res));
+		memblock_add_node(crashk_res.start, resource_size(&crashk_res), 0);
 		memblock_reserve(crashk_res.start, resource_size(&crashk_res));
 		insert_resource(&iomem_resource, &crashk_res);
 	}

[toc] | [prev] | [next] | [standalone]


#1553384 — [PATCH 4.9 060/116] scsi: zfcp: do not trace pure benign residual HBA responses at default level

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 060/116] scsi: zfcp: do not trace pure benign residual HBA responses at default level
Message-ID<sWLuF-4T-3@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Steffen Maier <maier@linux.vnet.ibm.com>

commit 56d23ed7adf3974f10e91b643bd230e9c65b5f79 upstream.

Since quite a while, Linux issues enough SCSI commands per scsi_device
which successfully return with FCP_RESID_UNDER, FSF_FCP_RSP_AVAILABLE,
and SAM_STAT_GOOD.  This floods the HBA trace area and we cannot see
other and important HBA trace records long enough.

Therefore, do not trace HBA response errors for pure benign residual
under counts at the default trace level.

This excludes benign residual under count combined with other validity
bits set in FCP_RSP_IU, such as FCP_SNS_LEN_VAL.  For all those other
cases, we still do want to see both the HBA record and the corresponding
SCSI record by default.

Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
Fixes: a54ca0f62f95 ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.")
Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/scsi/zfcp_dbf.h |   30 ++++++++++++++++++++++++++++--
 drivers/s390/scsi/zfcp_fsf.h |    3 ++-
 2 files changed, 30 insertions(+), 3 deletions(-)

--- a/drivers/s390/scsi/zfcp_dbf.h
+++ b/drivers/s390/scsi/zfcp_dbf.h
@@ -2,7 +2,7 @@
  * zfcp device driver
  * debug feature declarations
  *
- * Copyright IBM Corp. 2008, 2015
+ * Copyright IBM Corp. 2008, 2016
  */
 
 #ifndef ZFCP_DBF_H
@@ -283,6 +283,30 @@ struct zfcp_dbf {
 	struct zfcp_dbf_scsi		scsi_buf;
 };
 
+/**
+ * zfcp_dbf_hba_fsf_resp_suppress - true if we should not trace by default
+ * @req: request that has been completed
+ *
+ * Returns true if FCP response with only benign residual under count.
+ */
+static inline
+bool zfcp_dbf_hba_fsf_resp_suppress(struct zfcp_fsf_req *req)
+{
+	struct fsf_qtcb *qtcb = req->qtcb;
+	u32 fsf_stat = qtcb->header.fsf_status;
+	struct fcp_resp *fcp_rsp;
+	u8 rsp_flags, fr_status;
+
+	if (qtcb->prefix.qtcb_type != FSF_IO_COMMAND)
+		return false; /* not an FCP response */
+	fcp_rsp = (struct fcp_resp *)&qtcb->bottom.io.fcp_rsp;
+	rsp_flags = fcp_rsp->fr_flags;
+	fr_status = fcp_rsp->fr_status;
+	return (fsf_stat == FSF_FCP_RSP_AVAILABLE) &&
+		(rsp_flags == FCP_RESID_UNDER) &&
+		(fr_status == SAM_STAT_GOOD);
+}
+
 static inline
 void zfcp_dbf_hba_fsf_resp(char *tag, int level, struct zfcp_fsf_req *req)
 {
@@ -304,7 +328,9 @@ void zfcp_dbf_hba_fsf_response(struct zf
 		zfcp_dbf_hba_fsf_resp("fs_perr", 1, req);
 
 	} else if (qtcb->header.fsf_status != FSF_GOOD) {
-		zfcp_dbf_hba_fsf_resp("fs_ferr", 1, req);
+		zfcp_dbf_hba_fsf_resp("fs_ferr",
+				      zfcp_dbf_hba_fsf_resp_suppress(req)
+				      ? 5 : 1, req);
 
 	} else if ((req->fsf_command == FSF_QTCB_OPEN_PORT_WITH_DID) ||
 		   (req->fsf_command == FSF_QTCB_OPEN_LUN)) {
--- a/drivers/s390/scsi/zfcp_fsf.h
+++ b/drivers/s390/scsi/zfcp_fsf.h
@@ -3,7 +3,7 @@
  *
  * Interface to the FSF support functions.
  *
- * Copyright IBM Corp. 2002, 2015
+ * Copyright IBM Corp. 2002, 2016
  */
 
 #ifndef FSF_H
@@ -78,6 +78,7 @@
 #define FSF_APP_TAG_CHECK_FAILURE		0x00000082
 #define FSF_REF_TAG_CHECK_FAILURE		0x00000083
 #define FSF_ADAPTER_STATUS_AVAILABLE		0x000000AD
+#define FSF_FCP_RSP_AVAILABLE			0x000000AF
 #define FSF_UNKNOWN_COMMAND			0x000000E2
 #define FSF_UNKNOWN_OP_SUBTYPE                  0x000000E3
 #define FSF_INVALID_COMMAND_OPTION              0x000000E5

[toc] | [prev] | [next] | [standalone]


#1553385 — [PATCH 4.9 063/116] ARC: mm: arc700: Dont assume 2 colours for aliasing VIPT dcache

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 063/116] ARC: mm: arc700: Dont assume 2 colours for aliasing VIPT dcache
Message-ID<sWLuF-4T-5@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vineet Gupta <vgupta@synopsys.com>

commit 08fe007968b2b45e831daf74899f79a54d73f773 upstream.

An ARC700 customer reported linux boot crashes when upgrading to bigger
L1 dcache (64K from 32K). Turns out they had an aliasing VIPT config and
current code only assumed 2 colours, while theirs had 4. So default to 4
colours and complain if there are fewer. Ideally this needs to be a
Kconfig option, but heck that's too much of hassle for a single user.

Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arc/include/asm/cacheflush.h |    6 ++++--
 arch/arc/mm/cache.c               |   11 ++++++++---
 2 files changed, 12 insertions(+), 5 deletions(-)

--- a/arch/arc/include/asm/cacheflush.h
+++ b/arch/arc/include/asm/cacheflush.h
@@ -85,6 +85,10 @@ void flush_anon_page(struct vm_area_stru
  */
 #define PG_dc_clean	PG_arch_1
 
+#define CACHE_COLORS_NUM	4
+#define CACHE_COLORS_MSK	(CACHE_COLORS_NUM - 1)
+#define CACHE_COLOR(addr)	(((unsigned long)(addr) >> (PAGE_SHIFT)) & CACHE_COLORS_MSK)
+
 /*
  * Simple wrapper over config option
  * Bootup code ensures that hardware matches kernel configuration
@@ -94,8 +98,6 @@ static inline int cache_is_vipt_aliasing
 	return IS_ENABLED(CONFIG_ARC_CACHE_VIPT_ALIASING);
 }
 
-#define CACHE_COLOR(addr)	(((unsigned long)(addr) >> (PAGE_SHIFT)) & 1)
-
 /*
  * checks if two addresses (after page aligning) index into same cache set
  */
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -979,11 +979,16 @@ void arc_cache_init(void)
 		/* check for D-Cache aliasing on ARCompact: ARCv2 has PIPT */
 		if (is_isa_arcompact()) {
 			int handled = IS_ENABLED(CONFIG_ARC_CACHE_VIPT_ALIASING);
+			int num_colors = dc->sz_k/dc->assoc/TO_KB(PAGE_SIZE);
 
-			if (dc->alias && !handled)
-				panic("Enable CONFIG_ARC_CACHE_VIPT_ALIASING\n");
-			else if (!dc->alias && handled)
+			if (dc->alias) {
+				if (!handled)
+					panic("Enable CONFIG_ARC_CACHE_VIPT_ALIASING\n");
+				if (CACHE_COLORS_NUM != num_colors)
+					panic("CACHE_COLORS_NUM not optimized for config\n");
+			} else if (!dc->alias && handled) {
 				panic("Disable CONFIG_ARC_CACHE_VIPT_ALIASING\n");
+			}
 		}
 	}
 

[toc] | [prev] | [next] | [standalone]


#1553387 — [PATCH 4.9 048/116] drm/amdgpu: fix enable_cp_power_gating in gfx_v8.0.

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 048/116] drm/amdgpu: fix enable_cp_power_gating in gfx_v8.0.
Message-ID<sWLuF-4T-7@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rex Zhu <Rex.Zhu@amd.com>

commit eb584241226958d45aa1f07f4f6a6ea9da98b29e upstream.

the CP_PG_DISABLE bit was reversed.

Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -3994,7 +3994,7 @@ static void cz_enable_sck_slow_down_on_p
 
 static void cz_enable_cp_power_gating(struct amdgpu_device *adev, bool enable)
 {
-	WREG32_FIELD(RLC_PG_CNTL, CP_PG_DISABLE, enable ? 1 : 0);
+	WREG32_FIELD(RLC_PG_CNTL, CP_PG_DISABLE, enable ? 0 : 1);
 }
 
 static void gfx_v8_0_init_pg(struct amdgpu_device *adev)

[toc] | [prev] | [next] | [standalone]


#1553388 — [PATCH 4.9 059/116] scsi: zfcp: fix use-after-"free" in FC ingress path after TMF

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 059/116] scsi: zfcp: fix use-after-"free" in FC ingress path after TMF
Message-ID<sWLuF-4T-9@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Benjamin Block <bblock@linux.vnet.ibm.com>

commit dac37e15b7d511e026a9313c8c46794c144103cd upstream.

When SCSI EH invokes zFCP's callbacks for eh_device_reset_handler() and
eh_target_reset_handler(), it expects us to relent the ownership over
the given scsi_cmnd and all other scsi_cmnds within the same scope - LUN
or target - when returning with SUCCESS from the callback ('release'
them).  SCSI EH can then reuse those commands.

We did not follow this rule to release commands upon SUCCESS; and if
later a reply arrived for one of those supposed to be released commands,
we would still make use of the scsi_cmnd in our ingress tasklet. This
will at least result in undefined behavior or a kernel panic because of
a wrong kernel pointer dereference.

To fix this, we NULLify all pointers to scsi_cmnds (struct zfcp_fsf_req
*)->data in the matching scope if a TMF was successful. This is done
under the locks (struct zfcp_adapter *)->abort_lock and (struct
zfcp_reqlist *)->lock to prevent the requests from being removed from
the request-hashtable, and the ingress tasklet from making use of the
scsi_cmnd-pointer in zfcp_fsf_fcp_cmnd_handler().

For cases where a reply arrives during SCSI EH, but before we get a
chance to NULLify the pointer - but before we return from the callback
-, we assume that the code is protected from races via the CAS operation
in blk_complete_request() that is called in scsi_done().

The following stacktrace shows an example for a crash resulting from the
previous behavior:

Unable to handle kernel pointer dereference at virtual kernel address fffffee17a672000
Oops: 0038 [#1] SMP
CPU: 2 PID: 0 Comm: swapper/2 Not tainted
task: 00000003f7ff5be0 ti: 00000003f3d38000 task.ti: 00000003f3d38000
Krnl PSW : 0404d00180000000 00000000001156b0 (smp_vcpu_scheduled+0x18/0x40)
           R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 EA:3
Krnl GPRS: 000000200000007e 0000000000000000 fffffee17a671fd8 0000000300000015
           ffffffff80000000 00000000005dfde8 07000003f7f80e00 000000004fa4e800
           000000036ce8d8f8 000000036ce8d9c0 00000003ece8fe00 ffffffff969c9e93
           00000003fffffffd 000000036ce8da10 00000000003bf134 00000003f3b07918
Krnl Code: 00000000001156a2: a7190000        lghi    %r1,0
           00000000001156a6: a7380015        lhi    %r3,21
          #00000000001156aa: e32050000008    ag    %r2,0(%r5)
          >00000000001156b0: 482022b0        lh    %r2,688(%r2)
           00000000001156b4: ae123000        sigp    %r1,%r2,0(%r3)
           00000000001156b8: b2220020        ipm    %r2
           00000000001156bc: 8820001c        srl    %r2,28
           00000000001156c0: c02700000001    xilf    %r2,1
Call Trace:
([<0000000000000000>] 0x0)
 [<000003ff807bdb8e>] zfcp_fsf_fcp_cmnd_handler+0x3de/0x490 [zfcp]
 [<000003ff807be30a>] zfcp_fsf_req_complete+0x252/0x800 [zfcp]
 [<000003ff807c0a48>] zfcp_fsf_reqid_check+0xe8/0x190 [zfcp]
 [<000003ff807c194e>] zfcp_qdio_int_resp+0x66/0x188 [zfcp]
 [<000003ff80440c64>] qdio_kick_handler+0xdc/0x310 [qdio]
 [<000003ff804463d0>] __tiqdio_inbound_processing+0xf8/0xcd8 [qdio]
 [<0000000000141fd4>] tasklet_action+0x9c/0x170
 [<0000000000141550>] __do_softirq+0xe8/0x258
 [<000000000010ce0a>] do_softirq+0xba/0xc0
 [<000000000014187c>] irq_exit+0xc4/0xe8
 [<000000000046b526>] do_IRQ+0x146/0x1d8
 [<00000000005d6a3c>] io_return+0x0/0x8
 [<00000000005d6422>] vtime_stop_cpu+0x4a/0xa0
([<0000000000000000>] 0x0)
 [<0000000000103d8a>] arch_cpu_idle+0xa2/0xb0
 [<0000000000197f94>] cpu_startup_entry+0x13c/0x1f8
 [<0000000000114782>] smp_start_secondary+0xda/0xe8
 [<00000000005d6efe>] restart_int_handler+0x56/0x6c
 [<0000000000000000>] 0x0
Last Breaking-Event-Address:
 [<00000000003bf12e>] arch_spin_lock_wait+0x56/0xb0

Suggested-by: Steffen Maier <maier@linux.vnet.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Fixes: ea127f9754 ("[PATCH] s390 (7/7): zfcp host adapter.") (tglx/history.git)
Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/scsi/zfcp_dbf.h     |   11 +++++++
 drivers/s390/scsi/zfcp_reqlist.h |   30 +++++++++++++++++++-
 drivers/s390/scsi/zfcp_scsi.c    |   57 +++++++++++++++++++++++++++++++++++++--
 3 files changed, 95 insertions(+), 3 deletions(-)

--- a/drivers/s390/scsi/zfcp_dbf.h
+++ b/drivers/s390/scsi/zfcp_dbf.h
@@ -388,4 +388,15 @@ void zfcp_dbf_scsi_devreset(char *tag, s
 	_zfcp_dbf_scsi(tmp_tag, 1, scmnd, NULL);
 }
 
+/**
+ * zfcp_dbf_scsi_nullcmnd() - trace NULLify of SCSI command in dev/tgt-reset.
+ * @scmnd: SCSI command that was NULLified.
+ * @fsf_req: request that owned @scmnd.
+ */
+static inline void zfcp_dbf_scsi_nullcmnd(struct scsi_cmnd *scmnd,
+					  struct zfcp_fsf_req *fsf_req)
+{
+	_zfcp_dbf_scsi("scfc__1", 3, scmnd, fsf_req);
+}
+
 #endif /* ZFCP_DBF_H */
--- a/drivers/s390/scsi/zfcp_reqlist.h
+++ b/drivers/s390/scsi/zfcp_reqlist.h
@@ -4,7 +4,7 @@
  * Data structure and helper functions for tracking pending FSF
  * requests.
  *
- * Copyright IBM Corp. 2009
+ * Copyright IBM Corp. 2009, 2016
  */
 
 #ifndef ZFCP_REQLIST_H
@@ -180,4 +180,32 @@ static inline void zfcp_reqlist_move(str
 	spin_unlock_irqrestore(&rl->lock, flags);
 }
 
+/**
+ * zfcp_reqlist_apply_for_all() - apply a function to every request.
+ * @rl: the requestlist that contains the target requests.
+ * @f: the function to apply to each request; the first parameter of the
+ *     function will be the target-request; the second parameter is the same
+ *     pointer as given with the argument @data.
+ * @data: freely chosen argument; passed through to @f as second parameter.
+ *
+ * Uses :c:macro:`list_for_each_entry` to iterate over the lists in the hash-
+ * table (not a 'safe' variant, so don't modify the list).
+ *
+ * Holds @rl->lock over the entire request-iteration.
+ */
+static inline void
+zfcp_reqlist_apply_for_all(struct zfcp_reqlist *rl,
+			   void (*f)(struct zfcp_fsf_req *, void *), void *data)
+{
+	struct zfcp_fsf_req *req;
+	unsigned long flags;
+	unsigned int i;
+
+	spin_lock_irqsave(&rl->lock, flags);
+	for (i = 0; i < ZFCP_REQ_LIST_BUCKETS; i++)
+		list_for_each_entry(req, &rl->buckets[i], list)
+			f(req, data);
+	spin_unlock_irqrestore(&rl->lock, flags);
+}
+
 #endif /* ZFCP_REQLIST_H */
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -3,7 +3,7 @@
  *
  * Interface to Linux SCSI midlayer.
  *
- * Copyright IBM Corp. 2002, 2015
+ * Copyright IBM Corp. 2002, 2016
  */
 
 #define KMSG_COMPONENT "zfcp"
@@ -209,6 +209,57 @@ static int zfcp_scsi_eh_abort_handler(st
 	return retval;
 }
 
+struct zfcp_scsi_req_filter {
+	u8 tmf_scope;
+	u32 lun_handle;
+	u32 port_handle;
+};
+
+static void zfcp_scsi_forget_cmnd(struct zfcp_fsf_req *old_req, void *data)
+{
+	struct zfcp_scsi_req_filter *filter =
+		(struct zfcp_scsi_req_filter *)data;
+
+	/* already aborted - prevent side-effects - or not a SCSI command */
+	if (old_req->data == NULL || old_req->fsf_command != FSF_QTCB_FCP_CMND)
+		return;
+
+	/* (tmf_scope == FCP_TMF_TGT_RESET || tmf_scope == FCP_TMF_LUN_RESET) */
+	if (old_req->qtcb->header.port_handle != filter->port_handle)
+		return;
+
+	if (filter->tmf_scope == FCP_TMF_LUN_RESET &&
+	    old_req->qtcb->header.lun_handle != filter->lun_handle)
+		return;
+
+	zfcp_dbf_scsi_nullcmnd((struct scsi_cmnd *)old_req->data, old_req);
+	old_req->data = NULL;
+}
+
+static void zfcp_scsi_forget_cmnds(struct zfcp_scsi_dev *zsdev, u8 tm_flags)
+{
+	struct zfcp_adapter *adapter = zsdev->port->adapter;
+	struct zfcp_scsi_req_filter filter = {
+		.tmf_scope = FCP_TMF_TGT_RESET,
+		.port_handle = zsdev->port->handle,
+	};
+	unsigned long flags;
+
+	if (tm_flags == FCP_TMF_LUN_RESET) {
+		filter.tmf_scope = FCP_TMF_LUN_RESET;
+		filter.lun_handle = zsdev->lun_handle;
+	}
+
+	/*
+	 * abort_lock secures against other processings - in the abort-function
+	 * and normal cmnd-handler - of (struct zfcp_fsf_req *)->data
+	 */
+	write_lock_irqsave(&adapter->abort_lock, flags);
+	zfcp_reqlist_apply_for_all(adapter->req_list, zfcp_scsi_forget_cmnd,
+				   &filter);
+	write_unlock_irqrestore(&adapter->abort_lock, flags);
+}
+
 static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags)
 {
 	struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(scpnt->device);
@@ -241,8 +292,10 @@ static int zfcp_task_mgmt_function(struc
 	if (fsf_req->status & ZFCP_STATUS_FSFREQ_TMFUNCFAILED) {
 		zfcp_dbf_scsi_devreset("fail", scpnt, tm_flags);
 		retval = FAILED;
-	} else
+	} else {
 		zfcp_dbf_scsi_devreset("okay", scpnt, tm_flags);
+		zfcp_scsi_forget_cmnds(zfcp_sdev, tm_flags);
+	}
 
 	zfcp_fsf_req_free(fsf_req);
 	return retval;

[toc] | [prev] | [next] | [standalone]


#1553391 — [PATCH 4.9 054/116] vt: fix Scroll Lock LED trigger name

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 054/116] vt: fix Scroll Lock LED trigger name
Message-ID<sWLuF-4T-11@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Maciej S. Szmigiero <mail@maciej.szmigiero.name>

commit 31b5929d533f5183972cf57a7844b456ed996f3c upstream.

There is a disagreement between drivers/tty/vt/keyboard.c and
drivers/input/input-leds.c with regard to what is a Scroll Lock LED
trigger name: input calls it "kbd-scrolllock", but vt calls it
"kbd-scrollock" (two l's).
This prevents Scroll Lock LED trigger from binding to this LED by default.

Since it is a scroLL Lock LED, this interface was introduced only about a
year ago and in an Internet search people seem to reference this trigger
only to set it to this LED let's simply rename it to "kbd-scrolllock".

Also, it looks like this was supposed to be changed before this code was
merged: https://lkml.org/lkml/2015/6/9/697 but it was done only on
the input side.

Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/vt/keyboard.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -982,7 +982,7 @@ static void kbd_led_trigger_activate(str
 	KBD_LED_TRIGGER((_led_bit) + 8, _name)
 
 static struct kbd_led_trigger kbd_led_triggers[] = {
-	KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrollock"),
+	KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrolllock"),
 	KBD_LED_TRIGGER(VC_NUMLOCK,   "kbd-numlock"),
 	KBD_LED_TRIGGER(VC_CAPSLOCK,  "kbd-capslock"),
 	KBD_LED_TRIGGER(VC_KANALOCK,  "kbd-kanalock"),

[toc] | [prev] | [next] | [standalone]


#1553394 — [PATCH 4.9 052/116] mei: me: add lewisburg device ids

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 052/116] mei: me: add lewisburg device ids
Message-ID<sWLuG-4T-23@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tomas Winkler <tomas.winkler@intel.com>

commit 9ff2007bea1f1bfc53ac0bc7ccf8200bb275fd52 upstream.

Add MEI Lewisburg PCH IDs for Purley based workstations.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/misc/mei/hw-me-regs.h |    2 ++
 drivers/misc/mei/pci-me.c     |    1 +
 2 files changed, 3 insertions(+)

--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -122,6 +122,8 @@
 #define MEI_DEV_ID_SPT_H      0xA13A  /* Sunrise Point H */
 #define MEI_DEV_ID_SPT_H_2    0xA13B  /* Sunrise Point H 2 */
 
+#define MEI_DEV_ID_LBG        0xA1BA  /* Lewisburg (SPT) */
+
 #define MEI_DEV_ID_BXT_M      0x1A9A  /* Broxton M */
 #define MEI_DEV_ID_APL_I      0x5A9A  /* Apollo Lake I */
 
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -87,6 +87,7 @@ static const struct pci_device_id mei_me
 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)},
+	{MEI_PCI_DEVICE(MEI_DEV_ID_LBG, mei_me_pch8_cfg)},
 
 	{MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},

[toc] | [prev] | [next] | [standalone]


#1553395 — [PATCH 4.9 064/116] firmware: fix usermode helper fallback loading

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 064/116] firmware: fix usermode helper fallback loading
Message-ID<sWLuG-4T-31@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yves-Alexis Perez <corsac@corsac.net>

commit 2e700f8d85975f516ccaad821278c1fe66b2cc98 upstream.

When you use the firmware usermode helper fallback with a timeout value set to a
value greater than INT_MAX (2147483647) a cast overflow issue causes the
timeout value to go negative and breaks all usermode helper loading. This
regression was introduced through commit 68ff2a00dbf5 ("firmware_loader:
handle timeout via wait_for_completion_interruptible_timeout()") on kernel
v4.0.

The firmware_class drivers relies on the firmware usermode helper
fallback as a mechanism to look for firmware if the direct filesystem
search failed only if:

  a) You've enabled CONFIG_FW_LOADER_USER_HELPER_FALLBACK (not many distros):

  Then all of these callers will rely on the fallback mechanism in case
  the firmware is not found through an initial direct filesystem lookup:

  o request_firmware()
  o request_firmware_into_buf()
  o request_firmware_nowait()

  b) If you've only enabled CONFIG_FW_LOADER_USER_HELPER (most distros):

  Then only callers using request_firmware_nowait() with the second
  argument set to false, this explicitly is requesting the UMH firmware
  fallback to be relied on in case the first filesystem lookup fails.

  Using Coccinelle SmPL grammar we have identified only two drivers
  explicitly requesting the UMH firmware fallback mechanism:

  - drivers/firmware/dell_rbu.c
  - drivers/leds/leds-lp55xx-common.c

Since most distributions only enable CONFIG_FW_LOADER_USER_HELPER the
biggest impact of this regression are users of the dell_rbu and
leds-lp55xx-common device driver which required the UMH to find their
respective needed firmwares.

The default timeout for the UMH is set to 60 seconds always, as of
commit 68ff2a00dbf5 ("firmware_loader: handle timeout via
wait_for_completion_interruptible_timeout()") the timeout was bumped
to MAX_JIFFY_OFFSET ((LONG_MAX >> 1)-1). Additionally the MAX_JIFFY_OFFSET
value was also used if the timeout was configured by a user to 0.

The following works:

echo 2147483647 > /sys/class/firmware/timeout

But both of the following set the timeout to MAX_JIFFY_OFFSET even if
we display 0 back to userspace:

echo 2147483648 > /sys/class/firmware/timeout
cat /sys/class/firmware/timeout

0

echo 0> /sys/class/firmware/timeout
cat /sys/class/firmware/timeout

0

A max value of INT_MAX (2147483647) seconds is therefore implicit due to the
another cast with simple_strtol().

This fixes the secondary cast (the first one is simple_strtol() but its an
issue only by forcing an implicit limit) by re-using the timeout variable and
only setting retval in appropriate cases.

Lastly worth noting systemd had ripped out the UMH firmware fallback
mechanism from udev since udev 2014 via commit be2ea723b1d023b3d
("udev: remove userspace firmware loading support"), so as of systemd v217.

Signed-off-by: Yves-Alexis Perez <corsac@corsac.net>
Fixes: 68ff2a00dbf5 "firmware_loader: handle timeout via wait_for_completion_interruptible_timeout()"
Cc: Luis R. Rodriguez <mcgrof@kernel.org>
Cc: Ming Lei <ming.lei@canonical.com>
Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Luis R. Rodriguez <mcgrof@kernel.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
[mcgrof@kernel.org: gave commit log a whole lot of love]
Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/base/firmware_class.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -955,13 +955,14 @@ static int _request_firmware_load(struct
 		timeout = MAX_JIFFY_OFFSET;
 	}
 
-	retval = wait_for_completion_interruptible_timeout(&buf->completion,
+	timeout = wait_for_completion_interruptible_timeout(&buf->completion,
 			timeout);
-	if (retval == -ERESTARTSYS || !retval) {
+	if (timeout == -ERESTARTSYS || !timeout) {
+		retval = timeout;
 		mutex_lock(&fw_lock);
 		fw_load_abort(fw_priv);
 		mutex_unlock(&fw_lock);
-	} else if (retval > 0) {
+	} else if (timeout > 0) {
 		retval = 0;
 	}
 

[toc] | [prev] | [next] | [standalone]


#1553396 — [PATCH 4.9 009/116] ath9k: fix ath9k_hw_gpio_get() to return 0 or 1 on success

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 009/116] ath9k: fix ath9k_hw_gpio_get() to return 0 or 1 on success
Message-ID<sWLuG-4T-25@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matthias Schiffer <mschiffer@universe-factory.net>

commit 91851cc7a939039bd401adb6ca3da4402bec1d0c upstream.

Commit b2d70d4944c1 ("ath9k: make GPIO API to support both of WMAC and
SOC") refactored ath9k_hw_gpio_get() to support both WMAC and SOC GPIOs,
changing the return on success from 1 to BIT(gpio). This broke some callers
like ath_is_rfkill_set(). This doesn't fix any known bug in mainline at the
moment, but should be fixed anyway.

Instead of fixing all callers, change ath9k_hw_gpio_get() back to only
return 0 or 1.

Fixes: b2d70d4944c1 ("ath9k: make GPIO API to support both of WMAC and SOC")
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
[kvalo@qca.qualcomm.com: mention that doesn't fix any known bug]
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/ath/ath9k/hw.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2792,7 +2792,7 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah,
 		WARN_ON(1);
 	}
 
-	return val;
+	return !!val;
 }
 EXPORT_SYMBOL(ath9k_hw_gpio_get);
 

[toc] | [prev] | [next] | [standalone]


#1553397 — [PATCH 4.9 065/116] s390/vmlogrdr: fix IUCV buffer allocation

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 065/116] s390/vmlogrdr: fix IUCV buffer allocation
Message-ID<sWLuG-4T-33@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gerald Schaefer <gerald.schaefer@de.ibm.com>

commit 5457e03de918f7a3e294eb9d26a608ab8a579976 upstream.

The buffer for iucv_message_receive() needs to be below 2 GB. In
__iucv_message_receive(), the buffer address is casted to an u32, which
would result in either memory corruption or an addressing exception when
using addresses >= 2 GB.

Fix this by using GFP_DMA for the buffer allocation.

Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/char/vmlogrdr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/s390/char/vmlogrdr.c
+++ b/drivers/s390/char/vmlogrdr.c
@@ -870,7 +870,7 @@ static int __init vmlogrdr_init(void)
 		goto cleanup;
 
 	for (i=0; i < MAXMINOR; ++i ) {
-		sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL);
+		sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
 		if (!sys_ser[i].buffer) {
 			rc = -ENOMEM;
 			break;

[toc] | [prev] | [next] | [standalone]


#1553399 — [PATCH 4.9 034/116] drm/amd/amdgpu: enable GUI idle INT after enabling CGCG

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 034/116] drm/amd/amdgpu: enable GUI idle INT after enabling CGCG
Message-ID<sWLuG-4T-37@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arindam Nath <arindam.nath@amd.com>

commit dd31ae9ac933636c3712b7dd0f6152c1d71f81fe upstream.

GUI idle interrupts should be enabled only after we
have enabled coarse grain clock gating (CGCG). This
prevents GFX engine generating idle interrupt even
though CGCG is not completely enabled.

Most of the time this goes un-noticed, but on some
Stoney ASICs this results in GFX engine hang after
system resumes from suspend. The issue is not
particular to Stoney though and could have occured
on any ASIC. The patch fixes this issue.

Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reported-by: Sunil Uttarwar <Sunil.Uttarwar1@amd.com>
Signed-off-by: Arindam Nath <arindam.nath@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c |   18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -5891,29 +5891,24 @@ static void gfx_v8_0_update_coarse_grain
 	adev->gfx.rlc.funcs->enter_safe_mode(adev);
 
 	if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGCG)) {
-		/* 1 enable cntx_empty_int_enable/cntx_busy_int_enable/
-		 * Cmp_busy/GFX_Idle interrupts
-		 */
-		gfx_v8_0_enable_gui_idle_interrupt(adev, true);
-
 		temp1 = data1 =	RREG32(mmRLC_CGTT_MGCG_OVERRIDE);
 		data1 &= ~RLC_CGTT_MGCG_OVERRIDE__CGCG_MASK;
 		if (temp1 != data1)
 			WREG32(mmRLC_CGTT_MGCG_OVERRIDE, data1);
 
-		/* 2 wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle */
+		/* : wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle */
 		gfx_v8_0_wait_for_rlc_serdes(adev);
 
-		/* 3 - clear cgcg override */
+		/* 2 - clear cgcg override */
 		gfx_v8_0_send_serdes_cmd(adev, BPM_REG_CGCG_OVERRIDE, CLE_BPM_SERDES_CMD);
 
 		/* wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle */
 		gfx_v8_0_wait_for_rlc_serdes(adev);
 
-		/* 4 - write cmd to set CGLS */
+		/* 3 - write cmd to set CGLS */
 		gfx_v8_0_send_serdes_cmd(adev, BPM_REG_CGLS_EN, SET_BPM_SERDES_CMD);
 
-		/* 5 - enable cgcg */
+		/* 4 - enable cgcg */
 		data |= RLC_CGCG_CGLS_CTRL__CGCG_EN_MASK;
 
 		if (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGLS) {
@@ -5931,6 +5926,11 @@ static void gfx_v8_0_update_coarse_grain
 
 		if (temp != data)
 			WREG32(mmRLC_CGCG_CGLS_CTRL, data);
+
+		/* 5 enable cntx_empty_int_enable/cntx_busy_int_enable/
+		 * Cmp_busy/GFX_Idle interrupts
+		 */
+		gfx_v8_0_enable_gui_idle_interrupt(adev, true);
 	} else {
 		/* disable cntx_empty_int_enable & GFX Idle interrupt */
 		gfx_v8_0_enable_gui_idle_interrupt(adev, false);

[toc] | [prev] | [next] | [standalone]


#1553400 — [PATCH 4.9 055/116] stm class: Fix device leak in open error path

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 055/116] stm class: Fix device leak in open error path
Message-ID<sWLuG-4T-47@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit a0ebf519b8a2666438d999c62995618c710573e5 upstream.

Make sure to drop the reference taken by class_find_device() also on
allocation errors in open().

Signed-off-by: Johan Hovold <johan@kernel.org>
Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for...")
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwtracing/stm/core.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -361,7 +361,7 @@ static int stm_char_open(struct inode *i
 	struct stm_file *stmf;
 	struct device *dev;
 	unsigned int major = imajor(inode);
-	int err = -ENODEV;
+	int err = -ENOMEM;
 
 	dev = class_find_device(&stm_class, NULL, &major, major_match);
 	if (!dev)
@@ -369,8 +369,9 @@ static int stm_char_open(struct inode *i
 
 	stmf = kzalloc(sizeof(*stmf), GFP_KERNEL);
 	if (!stmf)
-		return -ENOMEM;
+		goto err_put_device;
 
+	err = -ENODEV;
 	stm_output_init(&stmf->output);
 	stmf->stm = to_stm_device(dev);
 
@@ -382,9 +383,10 @@ static int stm_char_open(struct inode *i
 	return nonseekable_open(inode, file);
 
 err_free:
+	kfree(stmf);
+err_put_device:
 	/* matches class_find_device() above */
 	put_device(dev);
-	kfree(stmf);
 
 	return err;
 }

[toc] | [prev] | [next] | [standalone]


#1553403 — [PATCH 4.9 062/116] scsi: avoid a permanent stop of the scsi devices request queue

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 062/116] scsi: avoid a permanent stop of the scsi devices request queue
Message-ID<sWLuG-4T-45@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wei Fang <fangwei1@huawei.com>

commit d2a145252c52792bc59e4767b486b26c430af4bb upstream.

A race between scanning and fc_remote_port_delete() may result in a
permanent stop if the device gets blocked before scsi_sysfs_add_sdev()
and unblocked after.  The reason is that blocking a device sets both the
SDEV_BLOCKED state and the QUEUE_FLAG_STOPPED.  However,
scsi_sysfs_add_sdev() unconditionally sets SDEV_RUNNING which causes the
device to be ignored by scsi_target_unblock() and thus never have its
QUEUE_FLAG_STOPPED cleared leading to a device which is apparently
running but has a stopped queue.

We actually have two places where SDEV_RUNNING is set: once in
scsi_add_lun() which respects the blocked flag and once in
scsi_sysfs_add_sdev() which doesn't.  Since the second set is entirely
spurious, simply remove it to fix the problem.

Reported-by: Zengxi Chen <chenzengxi@huawei.com>
Signed-off-by: Wei Fang <fangwei1@huawei.com>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/scsi_sysfs.c |    4 ----
 1 file changed, 4 deletions(-)

--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1204,10 +1204,6 @@ int scsi_sysfs_add_sdev(struct scsi_devi
 	struct request_queue *rq = sdev->request_queue;
 	struct scsi_target *starget = sdev->sdev_target;
 
-	error = scsi_device_set_state(sdev, SDEV_RUNNING);
-	if (error)
-		return error;
-
 	error = scsi_target_add(starget);
 	if (error)
 		return error;

[toc] | [prev] | [next] | [standalone]


#1553405 — [PATCH 4.9 058/116] iscsi-target: Return error if unable to add network portal

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 058/116] iscsi-target: Return error if unable to add network portal
Message-ID<sWLuH-4T-51@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Varun Prakash <varun@chelsio.com>

commit 83337e544323a8bd7492994d64af339175ac7107 upstream.

If iscsit_tpg_add_network_portal() fails then
return error code instead of 0 to user space.

If iscsi-target returns 0 then user space keeps
on retrying same command infinitely, targetcli or
echo hangs till command completes with non zero
return value. In some cases it is possible that
add network portal command never completes with
success even after retrying multiple times,
for example - cxgbit_setup_np() always returns
-EINVAL if portal IP does not belong to Chelsio
adapter interface.

Signed-off-by: Varun Prakash <varun@chelsio.com>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
[ bvanassche: Added "Fixes:" and "Cc: stable" tags ]
Fixes: commit d4b3fa4b0881 ("iscsi-target: Make iscsi_tpg_np driver show/store use generic code")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/target/iscsi/iscsi_target_configfs.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -100,8 +100,10 @@ static ssize_t lio_target_np_driver_stor
 
 		tpg_np_new = iscsit_tpg_add_network_portal(tpg,
 					&np->np_sockaddr, tpg_np, type);
-		if (IS_ERR(tpg_np_new))
+		if (IS_ERR(tpg_np_new)) {
+			rc = PTR_ERR(tpg_np_new);
 			goto out;
+		}
 	} else {
 		tpg_np_new = iscsit_tpg_locate_child_np(tpg_np, type);
 		if (tpg_np_new) {

[toc] | [prev] | [next] | [standalone]


#1553407 — [PATCH 4.9 057/116] scsi: megaraid_sas: Do not set MPI2_TYPE_CUDA for JBOD FP path for FW which does not support JBOD sequence map

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 057/116] scsi: megaraid_sas: Do not set MPI2_TYPE_CUDA for JBOD FP path for FW which does not support JBOD sequence map
Message-ID<sWLuH-4T-69@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kashyap Desai <kashyap.desai@broadcom.com>

commit d5573584429254a14708cf8375c47092b5edaf2c upstream.

Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/megaraid/megaraid_sas_fusion.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -2000,6 +2000,8 @@ megasas_build_syspd_fusion(struct megasa
 		io_request->DevHandle = pd_sync->seq[pd_index].devHandle;
 		pRAID_Context->regLockFlags |=
 			(MR_RL_FLAGS_SEQ_NUM_ENABLE|MR_RL_FLAGS_GRANT_DESTINATION_CUDA);
+		pRAID_Context->Type = MPI2_TYPE_CUDA;
+		pRAID_Context->nseg = 0x1;
 	} else if (fusion->fast_path_io) {
 		pRAID_Context->VirtualDiskTgtId = cpu_to_le16(device_id);
 		pRAID_Context->configSeqNum = 0;
@@ -2035,12 +2037,10 @@ megasas_build_syspd_fusion(struct megasa
 		pRAID_Context->timeoutValue =
 			cpu_to_le16((os_timeout_value > timeout_limit) ?
 			timeout_limit : os_timeout_value);
-		if (fusion->adapter_type == INVADER_SERIES) {
-			pRAID_Context->Type = MPI2_TYPE_CUDA;
-			pRAID_Context->nseg = 0x1;
+		if (fusion->adapter_type == INVADER_SERIES)
 			io_request->IoFlags |=
 				cpu_to_le16(MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH);
-		}
+
 		cmd->request_desc->SCSIIO.RequestFlags =
 			(MPI2_REQ_DESCRIPT_FLAGS_FP_IO <<
 				MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);

[toc] | [prev] | [next] | [standalone]


#1553409 — [PATCH 4.9 061/116] scsi: zfcp: fix rport unblock race with LUN recovery

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 061/116] scsi: zfcp: fix rport unblock race with LUN recovery
Message-ID<sWLuH-4T-53@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Steffen Maier <maier@linux.vnet.ibm.com>

commit 6f2ce1c6af37191640ee3ff6e8fc39ea10352f4c upstream.

It is unavoidable that zfcp_scsi_queuecommand() has to finish requests
with DID_IMM_RETRY (like fc_remote_port_chkready()) during the time
window when zfcp detected an unavailable rport but
fc_remote_port_delete(), which is asynchronous via
zfcp_scsi_schedule_rport_block(), has not yet blocked the rport.

However, for the case when the rport becomes available again, we should
prevent unblocking the rport too early.  In contrast to other FCP LLDDs,
zfcp has to open each LUN with the FCP channel hardware before it can
send I/O to a LUN.  So if a port already has LUNs attached and we
unblock the rport just after port recovery, recoveries of LUNs behind
this port can still be pending which in turn force
zfcp_scsi_queuecommand() to unnecessarily finish requests with
DID_IMM_RETRY.

This also opens a time window with unblocked rport (until the followup
LUN reopen recovery has finished).  If a scsi_cmnd timeout occurs during
this time window fc_timed_out() cannot work as desired and such command
would indeed time out and trigger scsi_eh. This prevents a clean and
timely path failover.  This should not happen if the path issue can be
recovered on FC transport layer such as path issues involving RSCNs.

Fix this by only calling zfcp_scsi_schedule_rport_register(), to
asynchronously trigger fc_remote_port_add(), after all LUN recoveries as
children of the rport have finished and no new recoveries of equal or
higher order were triggered meanwhile.  Finished intentionally includes
any recovery result no matter if successful or failed (still unblock
rport so other successful LUNs work).  For simplicity, we check after
each finished LUN recovery if there is another LUN recovery pending on
the same port and then do nothing.  We handle the special case of a
successful recovery of a port without LUN children the same way without
changing this case's semantics.

For debugging we introduce 2 new trace records written if the rport
unblock attempt was aborted due to still unfinished or freshly triggered
recovery. The records are only written above the default trace level.

Benjamin noticed the important special case of new recovery that can be
triggered between having given up the erp_lock and before calling
zfcp_erp_action_cleanup() within zfcp_erp_strategy().  We must avoid the
following sequence:

ERP thread                 rport_work      other context
-------------------------  --------------  --------------------------------
port is unblocked, rport still blocked,
 due to pending/running ERP action,
 so ((port->status & ...UNBLOCK) != 0)
 and (port->rport == NULL)
unlock ERP
zfcp_erp_action_cleanup()
case ZFCP_ERP_ACTION_REOPEN_LUN:
zfcp_erp_try_rport_unblock()
((status & ...UNBLOCK) != 0) [OLD!]
                                           zfcp_erp_port_reopen()
                                           lock ERP
                                           zfcp_erp_port_block()
                                           port->status clear ...UNBLOCK
                                           unlock ERP
                                           zfcp_scsi_schedule_rport_block()
                                           port->rport_task = RPORT_DEL
                                           queue_work(rport_work)
                           zfcp_scsi_rport_work()
                           (port->rport_task != RPORT_ADD)
                           port->rport_task = RPORT_NONE
                           zfcp_scsi_rport_block()
                           if (!port->rport) return
zfcp_scsi_schedule_rport_register()
port->rport_task = RPORT_ADD
queue_work(rport_work)
                           zfcp_scsi_rport_work()
                           (port->rport_task == RPORT_ADD)
                           port->rport_task = RPORT_NONE
                           zfcp_scsi_rport_register()
                           (port->rport == NULL)
                           rport = fc_remote_port_add()
                           port->rport = rport;

Now the rport was erroneously unblocked while the zfcp_port is blocked.
This is another situation we want to avoid due to scsi_eh
potential. This state would at least remain until the new recovery from
the other context finished successfully, or potentially forever if it
failed.  In order to close this race, we take the erp_lock inside
zfcp_erp_try_rport_unblock() when checking the status of zfcp_port or
LUN.  With that, the possible corresponding rport state sequences would
be: (unblock[ERP thread],block[other context]) if the ERP thread gets
erp_lock first and still sees ((port->status & ...UNBLOCK) != 0),
(block[other context],NOP[ERP thread]) if the ERP thread gets erp_lock
after the other context has already cleard ...UNBLOCK from port->status.

Since checking fields of struct erp_action is unsafe because they could
have been overwritten (re-used for new recovery) meanwhile, we only
check status of zfcp_port and LUN since these are only changed under
erp_lock elsewhere. Regarding the check of the proper status flags (port
or port_forced are similar to the shown adapter recovery):

[zfcp_erp_adapter_shutdown()]
zfcp_erp_adapter_reopen()
 zfcp_erp_adapter_block()
  * clear UNBLOCK ---------------------------------------+
 zfcp_scsi_schedule_rports_block()                       |
 write_lock_irqsave(&adapter->erp_lock, flags);-------+  |
 zfcp_erp_action_enqueue()                            |  |
  zfcp_erp_setup_act()                                |  |
   * set ERP_INUSE -----------------------------------|--|--+
 write_unlock_irqrestore(&adapter->erp_lock, flags);--+  |  |
.context-switch.                                         |  |
zfcp_erp_thread()                                        |  |
 zfcp_erp_strategy()                                     |  |
  write_lock_irqsave(&adapter->erp_lock, flags);------+  |  |
  ...                                                 |  |  |
  zfcp_erp_strategy_check_target()                    |  |  |
   zfcp_erp_strategy_check_adapter()                  |  |  |
    zfcp_erp_adapter_unblock()                        |  |  |
     * set UNBLOCK -----------------------------------|--+  |
  zfcp_erp_action_dequeue()                           |     |
   * clear ERP_INUSE ---------------------------------|-----+
  ...                                                 |
  write_unlock_irqrestore(&adapter->erp_lock, flags);-+

Hence, we should check for both UNBLOCK and ERP_INUSE because they are
interleaved.  Also we need to explicitly check ERP_FAILED for the link
down case which currently does not clear the UNBLOCK flag in
zfcp_fsf_link_down_info_eval().

Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
Fixes: 8830271c4819 ("[SCSI] zfcp: Dont fail SCSI commands when transitioning to blocked fc_rport")
Fixes: a2fa0aede07c ("[SCSI] zfcp: Block FC transport rports early on errors")
Fixes: 5f852be9e11d ("[SCSI] zfcp: Fix deadlock between zfcp ERP and SCSI")
Fixes: 338151e06608 ("[SCSI] zfcp: make use of fc_remote_port_delete when target port is unavailable")
Fixes: 3859f6a248cb ("[PATCH] zfcp: add rports to enable scsi_add_device to work again")
Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/scsi/zfcp_dbf.c  |   17 +++++++++--
 drivers/s390/scsi/zfcp_erp.c  |   61 ++++++++++++++++++++++++++++++++++++++++--
 drivers/s390/scsi/zfcp_ext.h  |    4 ++
 drivers/s390/scsi/zfcp_scsi.c |    4 --
 4 files changed, 77 insertions(+), 9 deletions(-)

--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -289,11 +289,12 @@ void zfcp_dbf_rec_trig(char *tag, struct
 
 
 /**
- * zfcp_dbf_rec_run - trace event related to running recovery
+ * zfcp_dbf_rec_run_lvl - trace event related to running recovery
+ * @level: trace level to be used for event
  * @tag: identifier for event
  * @erp: erp_action running
  */
-void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
+void zfcp_dbf_rec_run_lvl(int level, char *tag, struct zfcp_erp_action *erp)
 {
 	struct zfcp_dbf *dbf = erp->adapter->dbf;
 	struct zfcp_dbf_rec *rec = &dbf->rec_buf;
@@ -319,11 +320,21 @@ void zfcp_dbf_rec_run(char *tag, struct
 	else
 		rec->u.run.rec_count = atomic_read(&erp->adapter->erp_counter);
 
-	debug_event(dbf->rec, 1, rec, sizeof(*rec));
+	debug_event(dbf->rec, level, rec, sizeof(*rec));
 	spin_unlock_irqrestore(&dbf->rec_lock, flags);
 }
 
 /**
+ * zfcp_dbf_rec_run - trace event related to running recovery
+ * @tag: identifier for event
+ * @erp: erp_action running
+ */
+void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
+{
+	zfcp_dbf_rec_run_lvl(1, tag, erp);
+}
+
+/**
  * zfcp_dbf_rec_run_wka - trace wka port event with info like running recovery
  * @tag: identifier for event
  * @wka_port: well known address port
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -3,7 +3,7 @@
  *
  * Error Recovery Procedures (ERP).
  *
- * Copyright IBM Corp. 2002, 2015
+ * Copyright IBM Corp. 2002, 2016
  */
 
 #define KMSG_COMPONENT "zfcp"
@@ -1204,6 +1204,62 @@ static void zfcp_erp_action_dequeue(stru
 	}
 }
 
+/**
+ * zfcp_erp_try_rport_unblock - unblock rport if no more/new recovery
+ * @port: zfcp_port whose fc_rport we should try to unblock
+ */
+static void zfcp_erp_try_rport_unblock(struct zfcp_port *port)
+{
+	unsigned long flags;
+	struct zfcp_adapter *adapter = port->adapter;
+	int port_status;
+	struct Scsi_Host *shost = adapter->scsi_host;
+	struct scsi_device *sdev;
+
+	write_lock_irqsave(&adapter->erp_lock, flags);
+	port_status = atomic_read(&port->status);
+	if ((port_status & ZFCP_STATUS_COMMON_UNBLOCKED)    == 0 ||
+	    (port_status & (ZFCP_STATUS_COMMON_ERP_INUSE |
+			    ZFCP_STATUS_COMMON_ERP_FAILED)) != 0) {
+		/* new ERP of severity >= port triggered elsewhere meanwhile or
+		 * local link down (adapter erp_failed but not clear unblock)
+		 */
+		zfcp_dbf_rec_run_lvl(4, "ertru_p", &port->erp_action);
+		write_unlock_irqrestore(&adapter->erp_lock, flags);
+		return;
+	}
+	spin_lock(shost->host_lock);
+	__shost_for_each_device(sdev, shost) {
+		struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
+		int lun_status;
+
+		if (zsdev->port != port)
+			continue;
+		/* LUN under port of interest */
+		lun_status = atomic_read(&zsdev->status);
+		if ((lun_status & ZFCP_STATUS_COMMON_ERP_FAILED) != 0)
+			continue; /* unblock rport despite failed LUNs */
+		/* LUN recovery not given up yet [maybe follow-up pending] */
+		if ((lun_status & ZFCP_STATUS_COMMON_UNBLOCKED) == 0 ||
+		    (lun_status & ZFCP_STATUS_COMMON_ERP_INUSE) != 0) {
+			/* LUN blocked:
+			 * not yet unblocked [LUN recovery pending]
+			 * or meanwhile blocked [new LUN recovery triggered]
+			 */
+			zfcp_dbf_rec_run_lvl(4, "ertru_l", &zsdev->erp_action);
+			spin_unlock(shost->host_lock);
+			write_unlock_irqrestore(&adapter->erp_lock, flags);
+			return;
+		}
+	}
+	/* now port has no child or all children have completed recovery,
+	 * and no ERP of severity >= port was meanwhile triggered elsewhere
+	 */
+	zfcp_scsi_schedule_rport_register(port);
+	spin_unlock(shost->host_lock);
+	write_unlock_irqrestore(&adapter->erp_lock, flags);
+}
+
 static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
 {
 	struct zfcp_adapter *adapter = act->adapter;
@@ -1214,6 +1270,7 @@ static void zfcp_erp_action_cleanup(stru
 	case ZFCP_ERP_ACTION_REOPEN_LUN:
 		if (!(act->status & ZFCP_STATUS_ERP_NO_REF))
 			scsi_device_put(sdev);
+		zfcp_erp_try_rport_unblock(port);
 		break;
 
 	case ZFCP_ERP_ACTION_REOPEN_PORT:
@@ -1224,7 +1281,7 @@ static void zfcp_erp_action_cleanup(stru
 		 */
 		if (act->step != ZFCP_ERP_STEP_UNINITIALIZED)
 			if (result == ZFCP_ERP_SUCCEEDED)
-				zfcp_scsi_schedule_rport_register(port);
+				zfcp_erp_try_rport_unblock(port);
 		/* fall through */
 	case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
 		put_device(&port->dev);
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -3,7 +3,7 @@
  *
  * External function declarations.
  *
- * Copyright IBM Corp. 2002, 2015
+ * Copyright IBM Corp. 2002, 2016
  */
 
 #ifndef ZFCP_EXT_H
@@ -35,6 +35,8 @@ extern void zfcp_dbf_adapter_unregister(
 extern void zfcp_dbf_rec_trig(char *, struct zfcp_adapter *,
 			      struct zfcp_port *, struct scsi_device *, u8, u8);
 extern void zfcp_dbf_rec_run(char *, struct zfcp_erp_action *);
+extern void zfcp_dbf_rec_run_lvl(int level, char *tag,
+				 struct zfcp_erp_action *erp);
 extern void zfcp_dbf_rec_run_wka(char *, struct zfcp_fc_wka_port *, u64);
 extern void zfcp_dbf_hba_fsf_uss(char *, struct zfcp_fsf_req *);
 extern void zfcp_dbf_hba_fsf_res(char *, int, struct zfcp_fsf_req *);
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -88,9 +88,7 @@ int zfcp_scsi_queuecommand(struct Scsi_H
 	}
 
 	if (unlikely(!(status & ZFCP_STATUS_COMMON_UNBLOCKED))) {
-		/* This could be either
-		 * open LUN pending: this is temporary, will result in
-		 *	open LUN or ERP_FAILED, so retry command
+		/* This could be
 		 * call to rport_delete pending: mimic retry from
 		 * 	fc_remote_port_chkready until rport is BLOCKED
 		 */

[toc] | [prev] | [next] | [standalone]


#1553410 — [PATCH 4.9 046/116] drm/gma500: Add compat ioctl

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 046/116] drm/gma500: Add compat ioctl
Message-ID<sWLuH-4T-55@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

commit 0a97c81a9717431e6c57ea845b59c3c345edce67 upstream.

Hook up drm_compat_ioctl to support 32-bit userspace on 64-bit kernels.
It turns out that N2600 and N2800 comes with 64-bit enabled. We
previously assumed there where no such systems out there.

Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: http://patchwork.freedesktop.org/patch/msgid/20161101144315.2955-1-patrik.r.jakobsson@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/gma500/psb_drv.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/gpu/drm/gma500/psb_drv.c
+++ b/drivers/gpu/drm/gma500/psb_drv.c
@@ -473,6 +473,9 @@ static const struct file_operations psb_
 	.open = drm_open,
 	.release = drm_release,
 	.unlocked_ioctl = psb_unlocked_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = drm_compat_ioctl,
+#endif
 	.mmap = drm_gem_mmap,
 	.poll = drm_poll,
 	.read = drm_read,

[toc] | [prev] | [next] | [standalone]


#1553413 — [PATCH 4.9 056/116] scsi: megaraid_sas: For SRIOV enabled firmware, ensure VF driver waits for 30secs before reset

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 056/116] scsi: megaraid_sas: For SRIOV enabled firmware, ensure VF driver waits for 30secs before reset
Message-ID<sWLuH-4T-67@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kashyap Desai <kashyap.desai@broadcom.com>

commit 18e1c7f68a5814442abad849abe6eacbf02ffd7c upstream.

For SRIOV enabled firmware, if there is a OCR(online controller reset)
possibility driver set the convert flag to 1, which is not happening if
there are outstanding commands even after 180 seconds.  As driver does
not set convert flag to 1 and still making the OCR to run, VF(Virtual
function) driver is directly writing on to the register instead of
waiting for 30 seconds. Setting convert flag to 1 will cause VF driver
will wait for 30 secs before going for reset.

Signed-off-by: Kiran Kumar Kasturi <kiran-kumar.kasturi@broadcom.com>
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/megaraid/megaraid_sas_fusion.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -2823,6 +2823,7 @@ int megasas_wait_for_outstanding_fusion(
 		dev_err(&instance->pdev->dev, "pending commands remain after waiting, "
 		       "will reset adapter scsi%d.\n",
 		       instance->host->host_no);
+		*convert = 1;
 		retval = 1;
 	}
 out:

[toc] | [prev] | [next] | [standalone]


#1553416 — [PATCH 4.9 008/116] cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-01-06 23:50 +0100
Subject[PATCH 4.9 008/116] cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts
Message-ID<sWLuH-4T-61@gated-at.bofh.it>
In reply to#1553201
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Berg <johannes.berg@intel.com>

commit e6f462df9acd2a3295e5d34eb29e2823220cf129 upstream.

When mac80211 abandons an association attempt, it may free
all the data structures, but inform cfg80211 and userspace
about it only by sending the deauth frame it received, in
which case cfg80211 has no link to the BSS struct that was
used and will not cfg80211_unhold_bss() it.

Fix this by providing a way to inform cfg80211 of this with
the BSS entry passed, so that it can clean up properly, and
use this ability in the appropriate places in mac80211.

This isn't ideal: some code is more or less duplicated and
tracing is missing. However, it's a fairly small change and
it's thus easier to backport - cleanups can come later.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/net/cfg80211.h |   11 +++++++++++
 net/mac80211/mlme.c    |   21 ++++++++++++---------
 net/wireless/core.h    |    1 +
 net/wireless/mlme.c    |   12 ++++++++++++
 net/wireless/sme.c     |   14 ++++++++++++++
 5 files changed, 50 insertions(+), 9 deletions(-)

--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4584,6 +4584,17 @@ void cfg80211_rx_assoc_resp(struct net_d
 void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss);
 
 /**
+ * cfg80211_abandon_assoc - notify cfg80211 of abandoned association attempt
+ * @dev: network device
+ * @bss: The BSS entry with which association was abandoned.
+ *
+ * Call this whenever - for reasons reported through other API, like deauth RX,
+ * an association attempt was abandoned.
+ * This function may sleep. The caller must hold the corresponding wdev's mutex.
+ */
+void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss);
+
+/**
  * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame
  * @dev: network device
  * @buf: 802.11 frame (header + body)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2510,7 +2510,7 @@ static void ieee80211_destroy_auth_data(
 }
 
 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
-					 bool assoc)
+					 bool assoc, bool abandon)
 {
 	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
 
@@ -2533,6 +2533,9 @@ static void ieee80211_destroy_assoc_data
 		mutex_lock(&sdata->local->mtx);
 		ieee80211_vif_release_channel(sdata);
 		mutex_unlock(&sdata->local->mtx);
+
+		if (abandon)
+			cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
 	}
 
 	kfree(assoc_data);
@@ -2762,7 +2765,7 @@ static void ieee80211_rx_mgmt_deauth(str
 			   bssid, reason_code,
 			   ieee80211_get_reason_code_string(reason_code));
 
-		ieee80211_destroy_assoc_data(sdata, false);
+		ieee80211_destroy_assoc_data(sdata, false, true);
 
 		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
 		return;
@@ -3167,14 +3170,14 @@ static void ieee80211_rx_mgmt_assoc_resp
 	if (status_code != WLAN_STATUS_SUCCESS) {
 		sdata_info(sdata, "%pM denied association (code=%d)\n",
 			   mgmt->sa, status_code);
-		ieee80211_destroy_assoc_data(sdata, false);
+		ieee80211_destroy_assoc_data(sdata, false, false);
 		event.u.mlme.status = MLME_DENIED;
 		event.u.mlme.reason = status_code;
 		drv_event_callback(sdata->local, sdata, &event);
 	} else {
 		if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
 			/* oops -- internal error -- send timeout for now */
-			ieee80211_destroy_assoc_data(sdata, false);
+			ieee80211_destroy_assoc_data(sdata, false, false);
 			cfg80211_assoc_timeout(sdata->dev, bss);
 			return;
 		}
@@ -3187,7 +3190,7 @@ static void ieee80211_rx_mgmt_assoc_resp
 		 * recalc after assoc_data is NULL but before associated
 		 * is set can cause the interface to go idle
 		 */
-		ieee80211_destroy_assoc_data(sdata, true);
+		ieee80211_destroy_assoc_data(sdata, true, false);
 
 		/* get uapsd queues configuration */
 		uapsd_queues = 0;
@@ -3886,7 +3889,7 @@ void ieee80211_sta_work(struct ieee80211
 				.u.mlme.status = MLME_TIMEOUT,
 			};
 
-			ieee80211_destroy_assoc_data(sdata, false);
+			ieee80211_destroy_assoc_data(sdata, false, false);
 			cfg80211_assoc_timeout(sdata->dev, bss);
 			drv_event_callback(sdata->local, sdata, &event);
 		}
@@ -4025,7 +4028,7 @@ void ieee80211_mgd_quiesce(struct ieee80
 					       WLAN_REASON_DEAUTH_LEAVING,
 					       false, frame_buf);
 		if (ifmgd->assoc_data)
-			ieee80211_destroy_assoc_data(sdata, false);
+			ieee80211_destroy_assoc_data(sdata, false, true);
 		if (ifmgd->auth_data)
 			ieee80211_destroy_auth_data(sdata, false);
 		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
@@ -4907,7 +4910,7 @@ int ieee80211_mgd_deauth(struct ieee8021
 					       IEEE80211_STYPE_DEAUTH,
 					       req->reason_code, tx,
 					       frame_buf);
-		ieee80211_destroy_assoc_data(sdata, false);
+		ieee80211_destroy_assoc_data(sdata, false, true);
 		ieee80211_report_disconnect(sdata, frame_buf,
 					    sizeof(frame_buf), true,
 					    req->reason_code);
@@ -4982,7 +4985,7 @@ void ieee80211_mgd_stop(struct ieee80211
 	sdata_lock(sdata);
 	if (ifmgd->assoc_data) {
 		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
-		ieee80211_destroy_assoc_data(sdata, false);
+		ieee80211_destroy_assoc_data(sdata, false, false);
 		cfg80211_assoc_timeout(sdata->dev, bss);
 	}
 	if (ifmgd->auth_data)
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -410,6 +410,7 @@ void cfg80211_sme_disassoc(struct wirele
 void cfg80211_sme_deauth(struct wireless_dev *wdev);
 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev);
 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev);
+void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev);
 
 /* internal helpers */
 bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher);
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -149,6 +149,18 @@ void cfg80211_assoc_timeout(struct net_d
 }
 EXPORT_SYMBOL(cfg80211_assoc_timeout);
 
+void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)
+{
+	struct wireless_dev *wdev = dev->ieee80211_ptr;
+	struct wiphy *wiphy = wdev->wiphy;
+
+	cfg80211_sme_abandon_assoc(wdev);
+
+	cfg80211_unhold_bss(bss_from_pub(bss));
+	cfg80211_put_bss(wiphy, bss);
+}
+EXPORT_SYMBOL(cfg80211_abandon_assoc);
+
 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 {
 	struct wireless_dev *wdev = dev->ieee80211_ptr;
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -39,6 +39,7 @@ struct cfg80211_conn {
 		CFG80211_CONN_ASSOCIATING,
 		CFG80211_CONN_ASSOC_FAILED,
 		CFG80211_CONN_DEAUTH,
+		CFG80211_CONN_ABANDON,
 		CFG80211_CONN_CONNECTED,
 	} state;
 	u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
@@ -206,6 +207,8 @@ static int cfg80211_conn_do_work(struct
 		cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
 				     NULL, 0,
 				     WLAN_REASON_DEAUTH_LEAVING, false);
+		/* fall through */
+	case CFG80211_CONN_ABANDON:
 		/* free directly, disconnected event already sent */
 		cfg80211_sme_free(wdev);
 		return 0;
@@ -423,6 +426,17 @@ void cfg80211_sme_assoc_timeout(struct w
 	schedule_work(&rdev->conn_work);
 }
 
+void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev)
+{
+	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
+
+	if (!wdev->conn)
+		return;
+
+	wdev->conn->state = CFG80211_CONN_ABANDON;
+	schedule_work(&rdev->conn_work);
+}
+
 static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev,
 				     const u8 *ies, size_t ies_len,
 				     const u8 **out_ies, size_t *out_ies_len)

[toc] | [prev] | [next] | [standalone]


Page 4 of 6 — ← Prev page 1 2 3 [4] 5 6  Next page →

Back to top | Article view | linux.kernel


csiph-web