4.4-stable patches

added patches:
	genirq-track-whether-the-trigger-type-has-been-set.patch
	scsi-sg-don-t-return-bogus-sg_requests.patch

diff --git a/queue-4.4/genirq-track-whether-the-trigger-type-has-been-set.patch b/queue-4.4/genirq-track-whether-the-trigger-type-has-been-set.patch
new file mode 100644 (file)
index 0000000..3d85ed3
--- /dev/null
+++ b/queue-4.4/genirq-track-whether-the-trigger-type-has-been-set.patch
@@ -0,0 +1,105 @@
+From 4f8413a3a799c958f7a10a6310a451e6b8aef5ad Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Thu, 9 Nov 2017 14:17:59 +0000
+Subject: genirq: Track whether the trigger type has been set
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+commit 4f8413a3a799c958f7a10a6310a451e6b8aef5ad upstream.
+
+When requesting a shared interrupt, we assume that the firmware
+support code (DT or ACPI) has called irqd_set_trigger_type
+already, so that we can retrieve it and check that the requester
+is being reasonnable.
+
+Unfortunately, we still have non-DT, non-ACPI systems around,
+and these guys won't call irqd_set_trigger_type before requesting
+the interrupt. The consequence is that we fail the request that
+would have worked before.
+
+We can either chase all these use cases (boring), or address it
+in core code (easier). Let's have a per-irq_desc flag that
+indicates whether irqd_set_trigger_type has been called, and
+let's just check it when checking for a shared interrupt.
+If it hasn't been set, just take whatever the interrupt
+requester asks.
+
+Fixes: 382bd4de6182 ("genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs")
+Cc: stable@vger.kernel.org
+Reported-and-tested-by: Petr Cvek <petrcvekcz@gmail.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/irq.h |   11 ++++++++++-
+ kernel/irq/manage.c |   13 ++++++++++++-
+ 2 files changed, 22 insertions(+), 2 deletions(-)
+
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -191,6 +191,7 @@ struct irq_data {
+  * IRQD_IRQ_INPROGRESS                - In progress state of the interrupt
+  * IRQD_WAKEUP_ARMED          - Wakeup mode armed
+  * IRQD_FORWARDED_TO_VCPU     - The interrupt is forwarded to a VCPU
++ * IRQD_DEFAULT_TRIGGER_SET   - Expected trigger already been set
+  */
+ enum {
+       IRQD_TRIGGER_MASK               = 0xf,
+@@ -206,6 +207,7 @@ enum {
+       IRQD_IRQ_INPROGRESS             = (1 << 18),
+       IRQD_WAKEUP_ARMED               = (1 << 19),
+       IRQD_FORWARDED_TO_VCPU          = (1 << 20),
++      IRQD_DEFAULT_TRIGGER_SET        = (1 << 25),
+ };
+ 
+ #define __irqd_to_state(d)            ((d)->common->state_use_accessors)
+@@ -235,18 +237,25 @@ static inline void irqd_mark_affinity_wa
+       __irqd_to_state(d) |= IRQD_AFFINITY_SET;
+ }
+ 
++static inline bool irqd_trigger_type_was_set(struct irq_data *d)
++{
++      return __irqd_to_state(d) & IRQD_DEFAULT_TRIGGER_SET;
++}
++
+ static inline u32 irqd_get_trigger_type(struct irq_data *d)
+ {
+       return __irqd_to_state(d) & IRQD_TRIGGER_MASK;
+ }
+ 
+ /*
+- * Must only be called inside irq_chip.irq_set_type() functions.
++ * Must only be called inside irq_chip.irq_set_type() functions or
++ * from the DT/ACPI setup code.
+  */
+ static inline void irqd_set_trigger_type(struct irq_data *d, u32 type)
+ {
+       __irqd_to_state(d) &= ~IRQD_TRIGGER_MASK;
+       __irqd_to_state(d) |= type & IRQD_TRIGGER_MASK;
++      __irqd_to_state(d) |= IRQD_DEFAULT_TRIGGER_SET;
+ }
+ 
+ static inline bool irqd_is_level_type(struct irq_data *d)
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -1189,7 +1189,18 @@ __setup_irq(unsigned int irq, struct irq
+                * set the trigger type must match. Also all must
+                * agree on ONESHOT.
+                */
+-              unsigned int oldtype = irqd_get_trigger_type(&desc->irq_data);
++              unsigned int oldtype;
++
++              /*
++               * If nobody did set the configuration before, inherit
++               * the one provided by the requester.
++               */
++              if (irqd_trigger_type_was_set(&desc->irq_data)) {
++                      oldtype = irqd_get_trigger_type(&desc->irq_data);
++              } else {
++                      oldtype = new->flags & IRQF_TRIGGER_MASK;
++                      irqd_set_trigger_type(&desc->irq_data, oldtype);
++              }
+ 
+               if (!((old->flags & new->flags) & IRQF_SHARED) ||
+                   (oldtype != (new->flags & IRQF_TRIGGER_MASK)) ||

diff --git a/queue-4.4/scsi-sg-don-t-return-bogus-sg_requests.patch b/queue-4.4/scsi-sg-don-t-return-bogus-sg_requests.patch
new file mode 100644 (file)
index 0000000..731d441
--- /dev/null
+++ b/queue-4.4/scsi-sg-don-t-return-bogus-sg_requests.patch
@@ -0,0 +1,48 @@
+From 48ae8484e9fc324b4968d33c585e54bc98e44d61 Mon Sep 17 00:00:00 2001
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Date: Wed, 10 May 2017 09:53:40 +0200
+Subject: scsi: sg: don't return bogus Sg_requests
+
+From: Johannes Thumshirn <jthumshirn@suse.de>
+
+commit 48ae8484e9fc324b4968d33c585e54bc98e44d61 upstream.
+
+If the list search in sg_get_rq_mark() fails to find a valid request, we
+return a bogus element. This then can later lead to a GPF in
+sg_remove_scat().
+
+So don't return bogus Sg_requests in sg_get_rq_mark() but NULL in case
+the list search doesn't find a valid request.
+
+Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Doug Gilbert <dgilbert@interlog.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Acked-by: Doug Gilbert <dgilbert@interlog.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: Tony Battersby <tonyb@cybernetics.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sg.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -2074,11 +2074,12 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id)
+               if ((1 == resp->done) && (!resp->sg_io_owned) &&
+                   ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
+                       resp->done = 2; /* guard against other readers */
+-                      break;
++                      write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
++                      return resp;
+               }
+       }
+       write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
+-      return resp;
++      return NULL;
+ }
+ 
+ /* always adds to end of list */

diff --git a/queue-4.4/series b/queue-4.4/series
new file mode 100644 (file)
index 0000000..853dea4
--- /dev/null
+++ b/queue-4.4/series
@@ -0,0 +1,2 @@
+scsi-sg-don-t-return-bogus-sg_requests.patch
+genirq-track-whether-the-trigger-type-has-been-set.patch