--- /dev/null
+From 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 Mon Sep 17 00:00:00 2001
+From: John Soni Jose <sony.john-n@emulex.com>
+Date: Thu, 12 Feb 2015 06:45:47 +0530
+Subject: be2iscsi: Fix kernel panic when device initialization fails
+
+From: John Soni Jose <sony.john-n@emulex.com>
+
+commit 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 upstream.
+
+Kernel panic was happening as iscsi_host_remove() was called on
+a host which was not yet added.
+
+Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
+Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/be2iscsi/be_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -5684,9 +5684,9 @@ free_port:
+ hba_free:
+ if (phba->msix_enabled)
+ pci_disable_msix(phba->pcidev);
+- iscsi_host_remove(phba->shost);
+ pci_dev_put(phba->pcidev);
+ iscsi_host_free(phba->shost);
++ pci_set_drvdata(pcidev, NULL);
+ disable_pci:
+ pci_disable_device(pcidev);
+ return ret;
--- /dev/null
+From deeb8525f9bcea60f5e86521880c1161de7a5829 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Mon, 6 Apr 2015 17:57:44 -0400
+Subject: ioctx_alloc(): fix vma (and file) leak on failure
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit deeb8525f9bcea60f5e86521880c1161de7a5829 upstream.
+
+If we fail past the aio_setup_ring(), we need to destroy the
+mapping. We don't need to care about anybody having found ctx,
+or added requests to it, since the last failure exit is exactly
+the failure to make ctx visible to lookups.
+
+Reproducer (based on one by Joe Mario <jmario@redhat.com>):
+
+void count(char *p)
+{
+ char s[80];
+ printf("%s: ", p);
+ fflush(stdout);
+ sprintf(s, "/bin/cat /proc/%d/maps|/bin/fgrep -c '/[aio] (deleted)'", getpid());
+ system(s);
+}
+
+int main()
+{
+ io_context_t *ctx;
+ int created, limit, i, destroyed;
+ FILE *f;
+
+ count("before");
+ if ((f = fopen("/proc/sys/fs/aio-max-nr", "r")) == NULL)
+ perror("opening aio-max-nr");
+ else if (fscanf(f, "%d", &limit) != 1)
+ fprintf(stderr, "can't parse aio-max-nr\n");
+ else if ((ctx = calloc(limit, sizeof(io_context_t))) == NULL)
+ perror("allocating aio_context_t array");
+ else {
+ for (i = 0, created = 0; i < limit; i++) {
+ if (io_setup(1000, ctx + created) == 0)
+ created++;
+ }
+ for (i = 0, destroyed = 0; i < created; i++)
+ if (io_destroy(ctx[i]) == 0)
+ destroyed++;
+ printf("created %d, failed %d, destroyed %d\n",
+ created, limit - created, destroyed);
+ count("after");
+ }
+}
+
+Found-by: Joe Mario <jmario@redhat.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/aio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -719,6 +719,9 @@ static struct kioctx *ioctx_alloc(unsign
+ err_cleanup:
+ aio_nr_sub(ctx->max_reqs);
+ err_ctx:
++ atomic_set(&ctx->dead, 1);
++ if (ctx->mmap_size)
++ vm_munmap(ctx->mmap_base, ctx->mmap_size);
+ aio_free_ring(ctx);
+ err:
+ mutex_unlock(&ctx->ring_lock);
--- /dev/null
+From b815fc12d4dd2b5586184fb4f867caff05a810d4 Mon Sep 17 00:00:00 2001
+From: Mike Christie <michaelc@cs.wisc.edu>
+Date: Fri, 10 Apr 2015 02:47:27 -0500
+Subject: iscsi target: fix oops when adding reject pdu
+
+From: Mike Christie <michaelc@cs.wisc.edu>
+
+commit b815fc12d4dd2b5586184fb4f867caff05a810d4 upstream.
+
+This fixes a oops due to a double list add when adding a reject PDU for
+iscsit_allocate_iovecs allocation failures. The cmd has already been
+added to the conn_cmd_list in iscsit_setup_scsi_cmd, so this has us call
+iscsit_reject_cmd.
+
+Note that for ERL0 the reject PDU is not actually sent, so this patch
+is not completely tested. Just verified we do not oops. The problem is the
+add reject functions return -1 which is returned all the way up to
+iscsi_target_rx_thread which for ERL0 will drop the connection.
+
+Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1165,7 +1165,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn
+ * traditional iSCSI block I/O.
+ */
+ if (iscsit_allocate_iovecs(cmd) < 0) {
+- return iscsit_add_reject_cmd(cmd,
++ return iscsit_reject_cmd(cmd,
+ ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ }
+ immed_data = cmd->immediate_data;
--- /dev/null
+From 05b676ab42f624425d5f6519276e506b812fa058 Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Wed, 4 Mar 2015 05:55:21 -0800
+Subject: [media] media: s5p-mfc: fix mmap support for 64bit arch
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 05b676ab42f624425d5f6519276e506b812fa058 upstream.
+
+TASK_SIZE is depends on the systems architecture (32 or 64 bits) and it
+should not be used for defining offset boundary for mmaping buffers for
+CAPTURE and OUTPUT queues. This patch fixes support for MMAP calls on
+the CAPTURE queue on 64bit architectures (like ARM64).
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Kamil Debski <k.debski@samsung.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/s5p-mfc/s5p_mfc_common.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
+@@ -30,7 +30,7 @@
+
+ /* Offset base used to differentiate between CAPTURE and OUTPUT
+ * while mmaping */
+-#define DST_QUEUE_OFF_BASE (TASK_SIZE / 2)
++#define DST_QUEUE_OFF_BASE (1 << 30)
+
+ #define MFC_BANK1_ALLOC_CTX 0
+ #define MFC_BANK2_ALLOC_CTX 1
--- /dev/null
+From 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Wed, 8 Apr 2015 17:00:32 -0400
+Subject: ocfs2: _really_ sync the right range
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a upstream.
+
+"ocfs2 syncs the wrong range" had been broken; prior to it the
+code was doing the wrong thing in case of O_APPEND, all right,
+but _after_ it we were syncing the wrong range in 100% cases.
+*ppos, aka iocb->ki_pos is incremented prior to that point,
+so we are always doing sync on the area _after_ the one we'd
+written to.
+
+Spotted by Joseph Qi <joseph.qi@huawei.com> back in January;
+unfortunately, I'd missed his mail back then ;-/
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ocfs2/file.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -2391,10 +2391,14 @@ out_dio:
+ /* buffered aio wouldn't have proper lock coverage today */
+ BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
+
++ if (unlikely(written <= 0))
++ goto no_sync;
++
+ if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
+ ((file->f_flags & O_DIRECT) && !direct_io)) {
+- ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
+- *ppos + count - 1);
++ ret = filemap_fdatawrite_range(file->f_mapping,
++ iocb->ki_pos - written,
++ iocb->ki_pos - 1);
+ if (ret < 0)
+ written = ret;
+
+@@ -2407,10 +2411,12 @@ out_dio:
+ }
+
+ if (!ret)
+- ret = filemap_fdatawait_range(file->f_mapping, *ppos,
+- *ppos + count - 1);
++ ret = filemap_fdatawait_range(file->f_mapping,
++ iocb->ki_pos - written,
++ iocb->ki_pos - 1);
+ }
+
++no_sync:
+ /*
+ * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
+ * function pointer which is called when o_direct io completes so that
n_tty-fix-read-buffer-overwrite-when-no-newline.patch
cifs-smb2_clone_range-exit-on-unhandled-error.patch
cifs-fix-use-after-free-bug-in-find_writable_file.patch
+be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch
+ocfs2-_really_-sync-the-right-range.patch
+ioctx_alloc-fix-vma-and-file-leak-on-failure.patch
+iscsi-target-fix-oops-when-adding-reject-pdu.patch
+sh_veu-v4l2_dev-wasn-t-set.patch
+media-s5p-mfc-fix-mmap-support-for-64bit-arch.patch
--- /dev/null
+From ab3120300be067a2d41a027c41db0b2c662ab200 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Wed, 10 Dec 2014 12:35:34 -0300
+Subject: [media] sh_veu: v4l2_dev wasn't set
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit ab3120300be067a2d41a027c41db0b2c662ab200 upstream.
+
+The v4l2_dev field of struct video_device must be set correctly.
+This was never done for this driver, so no video nodes were created
+anymore.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/sh_veu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/sh_veu.c
++++ b/drivers/media/platform/sh_veu.c
+@@ -1183,6 +1183,7 @@ static int sh_veu_probe(struct platform_
+ }
+
+ *vdev = sh_veu_videodev;
++ vdev->v4l2_dev = &veu->v4l2_dev;
+ spin_lock_init(&veu->lock);
+ mutex_init(&veu->fop_lock);
+ vdev->lock = &veu->fop_lock;
projects / thirdparty / kernel / stable-queue.git / commitdiff
