--- /dev/null
+From d0cb50185ae942b03c4327be322055d622dc79f6 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Sun, 26 Jan 2020 09:29:34 -0500
+Subject: do_last(): fetch directory ->i_mode and ->i_uid before it's too late
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit d0cb50185ae942b03c4327be322055d622dc79f6 upstream.
+
+may_create_in_sticky() call is done when we already have dropped the
+reference to dir.
+
+Fixes: 30aba6656f61e (namei: allow restricted O_CREAT of FIFOs and regular files)
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namei.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -1011,7 +1011,8 @@ static int may_linkat(struct path *link)
+ * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
+ * should be allowed, or not, on files that already
+ * exist.
+- * @dir: the sticky parent directory
++ * @dir_mode: mode bits of directory
++ * @dir_uid: owner of directory
+ * @inode: the inode of the file to open
+ *
+ * Block an O_CREAT open of a FIFO (or a regular file) when:
+@@ -1027,18 +1028,18 @@ static int may_linkat(struct path *link)
+ *
+ * Returns 0 if the open is allowed, -ve on error.
+ */
+-static int may_create_in_sticky(struct dentry * const dir,
++static int may_create_in_sticky(umode_t dir_mode, kuid_t dir_uid,
+ struct inode * const inode)
+ {
+ if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
+ (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
+- likely(!(dir->d_inode->i_mode & S_ISVTX)) ||
+- uid_eq(inode->i_uid, dir->d_inode->i_uid) ||
++ likely(!(dir_mode & S_ISVTX)) ||
++ uid_eq(inode->i_uid, dir_uid) ||
+ uid_eq(current_fsuid(), inode->i_uid))
+ return 0;
+
+- if (likely(dir->d_inode->i_mode & 0002) ||
+- (dir->d_inode->i_mode & 0020 &&
++ if (likely(dir_mode & 0002) ||
++ (dir_mode & 0020 &&
+ ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
+ (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
+ return -EACCES;
+@@ -3259,6 +3260,8 @@ static int do_last(struct nameidata *nd,
+ int *opened)
+ {
+ struct dentry *dir = nd->path.dentry;
++ kuid_t dir_uid = dir->d_inode->i_uid;
++ umode_t dir_mode = dir->d_inode->i_mode;
+ int open_flag = op->open_flag;
+ bool will_truncate = (open_flag & O_TRUNC) != 0;
+ bool got_write = false;
+@@ -3401,7 +3404,7 @@ finish_open:
+ error = -EISDIR;
+ if (d_is_dir(nd->path.dentry))
+ goto out;
+- error = may_create_in_sticky(dir,
++ error = may_create_in_sticky(dir_mode, dir_uid,
+ d_backing_inode(nd->path.dentry));
+ if (unlikely(error))
+ goto out;
--- /dev/null
+From 7713e62c8623c54dac88d1fa724aa487a38c3efb Mon Sep 17 00:00:00 2001
+From: Gilles Buloz <gilles.buloz@kontron.com>
+Date: Wed, 27 Nov 2019 18:09:34 +0100
+Subject: hwmon: (nct7802) Fix voltage limits to wrong registers
+
+From: Gilles Buloz <gilles.buloz@kontron.com>
+
+commit 7713e62c8623c54dac88d1fa724aa487a38c3efb upstream.
+
+in0 thresholds are written to the in2 thresholds registers
+in2 thresholds to in3 thresholds
+in3 thresholds to in4 thresholds
+in4 thresholds to in0 thresholds
+
+Signed-off-by: Gilles Buloz <gilles.buloz@kontron.com>
+Link: https://lore.kernel.org/r/5de0f509.rc0oEvPOMjbfPW1w%gilles.buloz@kontron.com
+Fixes: 3434f3783580 ("hwmon: Driver for Nuvoton NCT7802Y")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/nct7802.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/nct7802.c
++++ b/drivers/hwmon/nct7802.c
+@@ -32,8 +32,8 @@
+ static const u8 REG_VOLTAGE[5] = { 0x09, 0x0a, 0x0c, 0x0d, 0x0e };
+
+ static const u8 REG_VOLTAGE_LIMIT_LSB[2][5] = {
+- { 0x40, 0x00, 0x42, 0x44, 0x46 },
+- { 0x3f, 0x00, 0x41, 0x43, 0x45 },
++ { 0x46, 0x00, 0x40, 0x42, 0x44 },
++ { 0x45, 0x00, 0x3f, 0x41, 0x43 },
+ };
+
+ static const u8 REG_VOLTAGE_LIMIT_MSB[5] = { 0x48, 0x00, 0x47, 0x47, 0x48 };
--- /dev/null
+From 04060db41178c7c244f2c7dcd913e7fd331de915 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Wed, 15 Jan 2020 20:47:37 -0800
+Subject: scsi: RDMA/isert: Fix a recently introduced regression related to logout
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 04060db41178c7c244f2c7dcd913e7fd331de915 upstream.
+
+iscsit_close_connection() calls isert_wait_conn(). Due to commit
+e9d3009cb936 both functions call target_wait_for_sess_cmds() although that
+last function should be called only once. Fix this by removing the
+target_wait_for_sess_cmds() call from isert_wait_conn() and by only calling
+isert_wait_conn() after target_wait_for_sess_cmds().
+
+Fixes: e9d3009cb936 ("scsi: target: iscsi: Wait for all commands to finish before freeing a session").
+Link: https://lore.kernel.org/r/20200116044737.19507-1-bvanassche@acm.org
+Reported-by: Rahul Kundu <rahul.kundu@chelsio.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Tested-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Acked-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 12 ------------
+ drivers/target/iscsi/iscsi_target.c | 6 +++---
+ 2 files changed, 3 insertions(+), 15 deletions(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -2555,17 +2555,6 @@ isert_wait4logout(struct isert_conn *ise
+ }
+ }
+
+-static void
+-isert_wait4cmds(struct iscsi_conn *conn)
+-{
+- isert_info("iscsi_conn %p\n", conn);
+-
+- if (conn->sess) {
+- target_sess_cmd_list_set_waiting(conn->sess->se_sess);
+- target_wait_for_sess_cmds(conn->sess->se_sess);
+- }
+-}
+-
+ /**
+ * isert_put_unsol_pending_cmds() - Drop commands waiting for
+ * unsolicitate dataout
+@@ -2613,7 +2602,6 @@ static void isert_wait_conn(struct iscsi
+
+ ib_drain_qp(isert_conn->qp);
+ isert_put_unsol_pending_cmds(conn);
+- isert_wait4cmds(conn);
+ isert_wait4logout(isert_conn);
+
+ queue_work(isert_release_wq, &isert_conn->release_work);
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4162,9 +4162,6 @@ int iscsit_close_connection(
+ iscsit_stop_nopin_response_timer(conn);
+ iscsit_stop_nopin_timer(conn);
+
+- if (conn->conn_transport->iscsit_wait_conn)
+- conn->conn_transport->iscsit_wait_conn(conn);
+-
+ /*
+ * During Connection recovery drop unacknowledged out of order
+ * commands for this connection, and prepare the other commands
+@@ -4250,6 +4247,9 @@ int iscsit_close_connection(
+ target_sess_cmd_list_set_waiting(sess->se_sess);
+ target_wait_for_sess_cmds(sess->se_sess);
+
++ if (conn->conn_transport->iscsit_wait_conn)
++ conn->conn_transport->iscsit_wait_conn(conn);
++
+ ahash_request_free(conn->conn_tx_hash);
+ if (conn->conn_rx_hash) {
+ struct crypto_ahash *tfm;
input-aiptek-fix-endpoint-sanity-check.patch
input-pegasus_notetaker-fix-endpoint-sanity-check.patch
input-sun4i-ts-add-a-check-for-devm_thermal_zone_of_sensor_register.patch
+hwmon-nct7802-fix-voltage-limits-to-wrong-registers.patch
+scsi-rdma-isert-fix-a-recently-introduced-regression-related-to-logout.patch
+tracing-xen-ordered-comparison-of-function-pointers.patch
+do_last-fetch-directory-i_mode-and-i_uid-before-it-s-too-late.patch
--- /dev/null
+From d0695e2351102affd8efae83989056bc4b275917 Mon Sep 17 00:00:00 2001
+From: Changbin Du <changbin.du@intel.com>
+Date: Sun, 12 Jan 2020 11:42:31 +0800
+Subject: tracing: xen: Ordered comparison of function pointers
+
+From: Changbin Du <changbin.du@gmail.com>
+
+commit d0695e2351102affd8efae83989056bc4b275917 upstream.
+
+Just as commit 0566e40ce7 ("tracing: initcall: Ordered comparison of
+function pointers"), this patch fixes another remaining one in xen.h
+found by clang-9.
+
+In file included from arch/x86/xen/trace.c:21:
+In file included from ./include/trace/events/xen.h:475:
+In file included from ./include/trace/define_trace.h:102:
+In file included from ./include/trace/trace_events.h:473:
+./include/trace/events/xen.h:69:7: warning: ordered comparison of function \
+pointers ('xen_mc_callback_fn_t' (aka 'void (*)(void *)') and 'xen_mc_callback_fn_t') [-Wordered-compare-function-pointers]
+ __field(xen_mc_callback_fn_t, fn)
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+./include/trace/trace_events.h:421:29: note: expanded from macro '__field'
+ ^
+./include/trace/trace_events.h:407:6: note: expanded from macro '__field_ext'
+ is_signed_type(type), filter_type); \
+ ^
+./include/linux/trace_events.h:554:44: note: expanded from macro 'is_signed_type'
+ ^
+
+Fixes: c796f213a6934 ("xen/trace: add multicall tracing")
+Signed-off-by: Changbin Du <changbin.du@gmail.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/trace/events/xen.h | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/include/trace/events/xen.h
++++ b/include/trace/events/xen.h
+@@ -63,7 +63,11 @@ TRACE_EVENT(xen_mc_callback,
+ TP_PROTO(xen_mc_callback_fn_t fn, void *data),
+ TP_ARGS(fn, data),
+ TP_STRUCT__entry(
+- __field(xen_mc_callback_fn_t, fn)
++ /*
++ * Use field_struct to avoid is_signed_type()
++ * comparison of a function pointer.
++ */
++ __field_struct(xen_mc_callback_fn_t, fn)
+ __field(void *, data)
+ ),
+ TP_fast_assign(
projects / thirdparty / kernel / stable-queue.git / commitdiff
