--- /dev/null
+From babf4770be0adc69e6d2de150f4040f175e24beb Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Wed, 10 Oct 2018 19:10:06 +0300
+Subject: ovl: fix error handling in ovl_verify_set_fh()
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit babf4770be0adc69e6d2de150f4040f175e24beb upstream.
+
+We hit a BUG on kfree of an ERR_PTR()...
+
+Reported-by: syzbot+ff03fe05c717b82502d0@syzkaller.appspotmail.com
+Fixes: 8b88a2e64036 ("ovl: verify upper root dir matches lower root dir")
+Cc: <stable@vger.kernel.org> # v4.13
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/overlayfs/namei.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/overlayfs/namei.c
++++ b/fs/overlayfs/namei.c
+@@ -368,8 +368,10 @@ int ovl_verify_origin(struct dentry *den
+
+ fh = ovl_encode_fh(origin, is_upper);
+ err = PTR_ERR(fh);
+- if (IS_ERR(fh))
++ if (IS_ERR(fh)) {
++ fh = NULL;
+ goto fail;
++ }
+
+ err = ovl_verify_origin_fh(dentry, fh);
+ if (set && err == -ENODATA)
--- /dev/null
+From 4c1458df9635c7e3ced155f594d2e7dfd7254e21 Mon Sep 17 00:00:00 2001
+From: Himanshu Madhani <himanshu.madhani@cavium.com>
+Date: Fri, 31 Aug 2018 11:24:27 -0700
+Subject: scsi: qla2xxx: Fix incorrect port speed being set for FC adapters
+
+From: Himanshu Madhani <himanshu.madhani@cavium.com>
+
+commit 4c1458df9635c7e3ced155f594d2e7dfd7254e21 upstream.
+
+Fixes: 6246b8a1d26c7c ("[SCSI] qla2xxx: Enhancements to support ISP83xx.")
+Fixes: 1bb395485160d2 ("qla2xxx: Correct iiDMA-update calling conventions.")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -3682,10 +3682,7 @@ qla2x00_set_idma_speed(scsi_qla_host_t *
+ mcp->mb[0] = MBC_PORT_PARAMS;
+ mcp->mb[1] = loop_id;
+ mcp->mb[2] = BIT_0;
+- if (IS_CNA_CAPABLE(vha->hw))
+- mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0);
+- else
+- mcp->mb[3] = port_speed & (BIT_2|BIT_1|BIT_0);
++ mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0);
+ mcp->mb[9] = vha->vp_idx;
+ mcp->out_mb = MBX_9|MBX_3|MBX_2|MBX_1|MBX_0;
+ mcp->in_mb = MBX_3|MBX_1|MBX_0;
--- /dev/null
+From b86ac8fd4b2f6ec2f9ca9194c56eac12d620096f Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Fri, 31 Aug 2018 11:24:26 -0700
+Subject: scsi: qla2xxx: Fix process response queue for ISP26XX and above
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit b86ac8fd4b2f6ec2f9ca9194c56eac12d620096f upstream.
+
+This patch improves performance for 16G and above adapter by removing
+additional call to process_response_queue().
+
+[mkp: typo]
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_init.c | 2 --
+ drivers/scsi/qla2xxx/qla_iocb.c | 17 -----------------
+ 2 files changed, 19 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -7591,7 +7591,6 @@ qla81xx_nvram_config(scsi_qla_host_t *vh
+ }
+ icb->firmware_options_2 &= cpu_to_le32(
+ ~(BIT_3 | BIT_2 | BIT_1 | BIT_0));
+- vha->flags.process_response_queue = 0;
+ if (ha->zio_mode != QLA_ZIO_DISABLED) {
+ ha->zio_mode = QLA_ZIO_MODE_6;
+
+@@ -7603,7 +7602,6 @@ qla81xx_nvram_config(scsi_qla_host_t *vh
+ icb->firmware_options_2 |= cpu_to_le32(
+ (uint32_t)ha->zio_mode);
+ icb->interrupt_delay_timer = cpu_to_le16(ha->zio_timer);
+- vha->flags.process_response_queue = 1;
+ }
+
+ /* enable RIDA Format2 */
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -1524,12 +1524,6 @@ qla24xx_start_scsi(srb_t *sp)
+
+ /* Set chip new ring index. */
+ WRT_REG_DWORD(req->req_q_in, req->ring_index);
+- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr);
+-
+- /* Manage unprocessed RIO/ZIO commands in response queue. */
+- if (vha->flags.process_response_queue &&
+- rsp->ring_ptr->signature != RESPONSE_PROCESSED)
+- qla24xx_process_response_queue(vha, rsp);
+
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ return QLA_SUCCESS;
+@@ -1723,12 +1717,6 @@ qla24xx_dif_start_scsi(srb_t *sp)
+
+ /* Set chip new ring index. */
+ WRT_REG_DWORD(req->req_q_in, req->ring_index);
+- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr);
+-
+- /* Manage unprocessed RIO/ZIO commands in response queue. */
+- if (vha->flags.process_response_queue &&
+- rsp->ring_ptr->signature != RESPONSE_PROCESSED)
+- qla24xx_process_response_queue(vha, rsp);
+
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+@@ -1878,11 +1866,6 @@ qla2xxx_start_scsi_mq(srb_t *sp)
+ /* Set chip new ring index. */
+ WRT_REG_DWORD(req->req_q_in, req->ring_index);
+
+- /* Manage unprocessed RIO/ZIO commands in response queue. */
+- if (vha->flags.process_response_queue &&
+- rsp->ring_ptr->signature != RESPONSE_PROCESSED)
+- qla24xx_process_response_queue(vha, rsp);
+-
+ spin_unlock_irqrestore(&qpair->qp_lock, flags);
+ return QLA_SUCCESS;
+
--- /dev/null
+From 5c6400536481d9ef44ef94e7bf2c7b8e81534db7 Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Wed, 26 Sep 2018 22:05:14 -0700
+Subject: scsi: qla2xxx: Fix re-using LoopID when handle is in use
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit 5c6400536481d9ef44ef94e7bf2c7b8e81534db7 upstream.
+
+This patch fixes issue where driver clears NPort ID map instead of marking
+handle in use. Once driver clears NPort ID from the database, it can reuse
+the same NPort ID resulting in a PLOGI failure.
+
+[mkp: fixed Himanshu's SoB]
+
+Fixes: a084fd68e1d2 ("scsi: qla2xxx: Fix re-login for Nport Handle in use")
+Cc: <stable@vger.kernel.org>
+Signed-of-by: Quinn Tran <quinn.tran@cavium.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Himanshu Madhani <hmadhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_init.c | 18 ++++--------------
+ drivers/scsi/qla2xxx/qla_target.c | 3 ++-
+ 2 files changed, 6 insertions(+), 15 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -1511,25 +1511,15 @@ qla24xx_handle_plogi_done_event(struct s
+ cid.b.rsvd_1 = 0;
+
+ ql_dbg(ql_dbg_disc, vha, 0x20ec,
+- "%s %d %8phC LoopID 0x%x in use post gnl\n",
++ "%s %d %8phC lid %#x in use with pid %06x post gnl\n",
+ __func__, __LINE__, ea->fcport->port_name,
+- ea->fcport->loop_id);
++ ea->fcport->loop_id, cid.b24);
+
+- if (IS_SW_RESV_ADDR(cid)) {
+- set_bit(ea->fcport->loop_id, vha->hw->loop_id_map);
+- ea->fcport->loop_id = FC_NO_LOOP_ID;
+- } else {
+- qla2x00_clear_loop_id(ea->fcport);
+- }
++ set_bit(ea->fcport->loop_id, vha->hw->loop_id_map);
++ ea->fcport->loop_id = FC_NO_LOOP_ID;
+ qla24xx_post_gnl_work(vha, ea->fcport);
+ break;
+ case MBS_PORT_ID_USED:
+- ql_dbg(ql_dbg_disc, vha, 0x20ed,
+- "%s %d %8phC NPortId %02x%02x%02x inuse post gidpn\n",
+- __func__, __LINE__, ea->fcport->port_name,
+- ea->fcport->d_id.b.domain, ea->fcport->d_id.b.area,
+- ea->fcport->d_id.b.al_pa);
+-
+ lid = ea->iop[1] & 0xffff;
+ qlt_find_sess_invalidate_other(vha,
+ wwn_to_u64(ea->fcport->port_name),
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1203,7 +1203,8 @@ void qlt_schedule_sess_for_deletion(stru
+ qla24xx_chk_fcp_state(sess);
+
+ ql_dbg(ql_dbg_tgt, sess->vha, 0xe001,
+- "Scheduling sess %p for deletion\n", sess);
++ "Scheduling sess %p for deletion %8phC\n",
++ sess, sess->port_name);
+
+ INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn);
+ queue_work(sess->vha->hw->wq, &sess->del_work);
--- /dev/null
+From 56d942de59ebfa2e970a6cd33299d1984710b6c0 Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Tue, 11 Sep 2018 10:18:22 -0700
+Subject: scsi: qla2xxx: Reject bsg request if chip is down.
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit 56d942de59ebfa2e970a6cd33299d1984710b6c0 upstream.
+
+Reject bsg request if chip is down. This prevent erroneous timeout.
+
+Fixes: d051a5aa1c23 ("[SCSI] qla2xxx: Add an "is reset active" helper.")
+Cc: stable@vger.kernel.org # 4.10
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_bsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -2492,7 +2492,7 @@ qla24xx_bsg_request(struct bsg_job *bsg_
+ vha = shost_priv(host);
+ }
+
+- if (qla2x00_reset_active(vha)) {
++ if (qla2x00_chip_is_down(vha)) {
+ ql_dbg(ql_dbg_user, vha, 0x709f,
+ "BSG: ISP abort active/needed -- cmd=%d.\n",
+ bsg_request->msgcode);
--- /dev/null
+From 7c388f91ec1a59b0ed815b07b90536e2d57e1e1f Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Tue, 11 Sep 2018 10:18:24 -0700
+Subject: scsi: qla2xxx: Remove stale debug trace message from tcm_qla2xxx
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit 7c388f91ec1a59b0ed815b07b90536e2d57e1e1f upstream.
+
+Remove stale debug trace.
+
+Fixes: 1eb42f965ced ("qla2xxx: Make trace flags more readable")
+Cc: stable@vger.kernel.org #4.10
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/tcm_qla2xxx.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -693,10 +693,6 @@ static int tcm_qla2xxx_queue_status(stru
+ cmd->sg_cnt = 0;
+ cmd->offset = 0;
+ cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
+- if (cmd->trc_flags & TRC_XMIT_STATUS) {
+- pr_crit("Multiple calls for status = %p.\n", cmd);
+- dump_stack();
+- }
+ cmd->trc_flags |= TRC_XMIT_STATUS;
+
+ if (se_cmd->data_direction == DMA_FROM_DEVICE) {
--- /dev/null
+From 1e4ac5d6fe0a4af17e4b6251b884485832bf75a3 Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Tue, 11 Sep 2018 10:18:21 -0700
+Subject: scsi: qla2xxx: shutdown chip if reset fail
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit 1e4ac5d6fe0a4af17e4b6251b884485832bf75a3 upstream.
+
+If chip unable to fully initialize, use full shutdown sequence to clear out
+any stale FW state.
+
+Fixes: e315cd28b9ef ("[SCSI] qla2xxx: Code changes for qla data structure refactoring")
+Cc: stable@vger.kernel.org #4.10
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -6077,7 +6077,7 @@ qla2x00_abort_isp(scsi_qla_host_t *vha)
+ * The next call disables the board
+ * completely.
+ */
+- ha->isp_ops->reset_adapter(vha);
++ qla2x00_abort_isp_cleanup(vha);
+ vha->flags.online = 0;
+ clear_bit(ISP_ABORT_RETRY,
+ &vha->dpc_flags);
9p-locks-fix-glock.client_id-leak-in-do_lock.patch
9p-clear-dangling-pointers-in-p9stat_free.patch
cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch
+ovl-fix-error-handling-in-ovl_verify_set_fh.patch
+scsi-qla2xxx-fix-incorrect-port-speed-being-set-for-fc-adapters.patch
+scsi-qla2xxx-fix-process-response-queue-for-isp26xx-and-above.patch
+scsi-qla2xxx-remove-stale-debug-trace-message-from-tcm_qla2xxx.patch
+scsi-qla2xxx-shutdown-chip-if-reset-fail.patch
+scsi-qla2xxx-reject-bsg-request-if-chip-is-down.patch
+scsi-qla2xxx-fix-re-using-loopid-when-handle-is-in-use.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
