--- /dev/null
+From 6f54c361329dbb67dac9de174e938992651d12d7 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 15 Jan 2013 14:44:41 +0100
+Subject: ALSA: hda/hdmi - Work around "alsactl restore" errors
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 6f54c361329dbb67dac9de174e938992651d12d7 upstream.
+
+When "alsactl restore" is performed on HDMI codecs, it tries to
+restore the channel map value since the channel map controls are
+writable. But hdmi_chmap_ctl_put() returns -EBADFD when no PCM stream
+is assigned yet, and this results in an error message from alsactl.
+Although the error is harmless, it's certainly ugly and can be
+regarded as a regression.
+
+As a workaround, this patch changes the return code in such a case to
+be zero for making others happy. (A slight excuse is: when the chmap
+is changed through the proper alsa-lib API, the PCM status is checked
+there anyway, so we don't have to be too strict in the kernel side.)
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1499,7 +1499,7 @@ static int hdmi_chmap_ctl_put(struct snd
+ ctl_idx = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id);
+ substream = snd_pcm_chmap_substream(info, ctl_idx);
+ if (!substream || !substream->runtime)
+- return -EBADFD;
++ return 0; /* just for avoiding error from alsactl restore */
+ switch (substream->runtime->status->state) {
+ case SNDRV_PCM_STATE_OPEN:
+ case SNDRV_PCM_STATE_SETUP:
--- /dev/null
+From 02522463c84748b3b8ad770f9424bcfa70a5b4c4 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Wed, 9 Jan 2013 11:08:10 +0000
+Subject: arm64: mm: only wrprotect clean ptes if they are present
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 02522463c84748b3b8ad770f9424bcfa70a5b4c4 upstream.
+
+Marking non-present ptes as read-only can corrupt file ptes, breaking
+things like swap and file mappings.
+
+This patch ensures that we only manipulate user pte bits when the pte
+is marked present.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/include/asm/pgtable.h | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -132,9 +132,8 @@ extern struct page *empty_zero_page;
+ #define pte_write(pte) (!(pte_val(pte) & PTE_RDONLY))
+ #define pte_exec(pte) (!(pte_val(pte) & PTE_UXN))
+
+-#define pte_present_exec_user(pte) \
+- ((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == \
+- (PTE_VALID | PTE_USER))
++#define pte_present_user(pte) \
++ ((pte_val(pte) & (PTE_VALID | PTE_USER)) == (PTE_VALID | PTE_USER))
+
+ #define PTE_BIT_FUNC(fn,op) \
+ static inline pte_t pte_##fn(pte_t pte) { pte_val(pte) op; return pte; }
+@@ -157,10 +156,13 @@ extern void __sync_icache_dcache(pte_t p
+ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
+ pte_t *ptep, pte_t pte)
+ {
+- if (pte_present_exec_user(pte))
+- __sync_icache_dcache(pte, addr);
+- if (!pte_dirty(pte))
+- pte = pte_wrprotect(pte);
++ if (pte_present_user(pte)) {
++ if (pte_exec(pte))
++ __sync_icache_dcache(pte, addr);
++ if (!pte_dirty(pte))
++ pte = pte_wrprotect(pte);
++ }
++
+ set_pte(ptep, pte);
+ }
+
--- /dev/null
+From 4adf07fba3bd64472921a01aae0e116f9f948b77 Mon Sep 17 00:00:00 2001
+From: Luciano Coelho <coelho@ti.com>
+Date: Tue, 15 Jan 2013 10:43:43 +0200
+Subject: firmware: make sure the fw file size is not 0
+
+From: Luciano Coelho <coelho@ti.com>
+
+commit 4adf07fba3bd64472921a01aae0e116f9f948b77 upstream.
+
+If the requested firmware file size is 0 bytes in the filesytem, we
+will try to vmalloc(0), which causes a warning:
+
+ vmalloc: allocation failure: 0 bytes
+ kworker/1:1: page allocation failure: order:0, mode:0xd2
+ __vmalloc_node_range+0x164/0x208
+ __vmalloc_node+0x4c/0x58
+ vmalloc+0x38/0x44
+ _request_firmware_load+0x220/0x6b0
+ request_firmware+0x64/0xc8
+ wl18xx_setup+0xb4/0x570 [wl18xx]
+ wlcore_nvs_cb+0x64/0x9f8 [wlcore]
+ request_firmware_work_func+0x94/0x100
+ process_one_work+0x1d0/0x750
+ worker_thread+0x184/0x4ac
+ kthread+0xb4/0xc0
+
+To fix this, check whether the file size is less than or equal to zero
+in fw_read_file_contents().
+
+Signed-off-by: Luciano Coelho <coelho@ti.com>
+Acked-by: Ming Lei <ming.lei@canonical.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/firmware_class.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -295,7 +295,7 @@ static bool fw_read_file_contents(struct
+ char *buf;
+
+ size = fw_file_size(file);
+- if (size < 0)
++ if (size <= 0)
+ return false;
+ buf = vmalloc(size);
+ if (!buf)
--- /dev/null
+alsa-hda-hdmi-work-around-alsactl-restore-errors.patch
+sh-fix-fdpic-binary-loader.patch
+firmware-make-sure-the-fw-file-size-is-not-0.patch
+arm64-mm-only-wrprotect-clean-ptes-if-they-are-present.patch
+target-use-correct-sense-code-for-lun-communication-failure.patch
+tcm_fc-do-not-indicate-retry-capability-to-initiators.patch
+tcm_fc-do-not-report-target-role-when-target-is-not-defined.patch
+target-fix-missing-cmd_t_active-bit-regression-for-pending-writes.patch
+target-fix-use-after-free-in-lun-reset-handling.patch
+target-release-se_cmd-when-lun-lookup-fails-for-tmr.patch
--- /dev/null
+From 4a71997a3279a339e7336ea5d0cd27282e2dea44 Mon Sep 17 00:00:00 2001
+From: Thomas Schwinge <thomas@codesourcery.com>
+Date: Fri, 16 Nov 2012 10:46:20 +0100
+Subject: sh: Fix FDPIC binary loader
+
+From: Thomas Schwinge <thomas@codesourcery.com>
+
+commit 4a71997a3279a339e7336ea5d0cd27282e2dea44 upstream.
+
+Ensure that the aux table is properly initialized, even when optional features
+are missing. Without this, the FDPIC loader did not work. This was meant to
+be included in commit d5ab780305bb6d60a7b5a74f18cf84eb6ad153b1.
+
+Signed-off-by: Thomas Schwinge <thomas@codesourcery.com>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sh/include/asm/elf.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/sh/include/asm/elf.h
++++ b/arch/sh/include/asm/elf.h
+@@ -203,9 +203,9 @@ extern void __kernel_vsyscall;
+ if (vdso_enabled) \
+ NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \
+ else \
+- NEW_AUX_ENT(AT_IGNORE, 0);
++ NEW_AUX_ENT(AT_IGNORE, 0)
+ #else
+-#define VSYSCALL_AUX_ENT
++#define VSYSCALL_AUX_ENT NEW_AUX_ENT(AT_IGNORE, 0)
+ #endif /* CONFIG_VSYSCALL */
+
+ #ifdef CONFIG_SH_FPU
--- /dev/null
+From e627c615553a356f6f70215ebb3933c6e057553e Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Wed, 2 Jan 2013 12:47:57 -0800
+Subject: target: Fix missing CMD_T_ACTIVE bit regression for pending WRITEs
+
+From: Roland Dreier <roland@purestorage.com>
+
+commit e627c615553a356f6f70215ebb3933c6e057553e upstream.
+
+This patch fixes a regression bug introduced during v3.6.x code with
+the following commit to drop transport_add_cmd_to_queue(), which
+originally re-set CMD_T_ACTIVE during pending WRITE I/O submission:
+
+commit af8772926f019b7bddd7477b8de5f3b0f12bad21
+Author: Christoph Hellwig <hch@infradead.org>
+Date: Sun Jul 8 15:58:49 2012 -0400
+
+ target: replace the processing thread with a TMR work queue
+
+The following sequence happens for write commands (or any other
+commands with a data out phase):
+
+ - The transport calls target_submit_cmd(), which sets CMD_T_ACTIVE in
+ cmd->transport_state and sets cmd->t_state to TRANSPORT_NEW_CMD.
+ - Things go on transport_generic_new_cmd(), which notices that the
+ command needs to transfer data, so it sets cmd->t_state to
+ TRANSPORT_WRITE_PENDING and calls transport_cmd_check_stop().
+ - transport_cmd_check_stop() clears CMD_T_ACTIVE in cmd->transport_state
+ and returns in the normal case.
+ - Then we continue on to call ->se_tfo->write_pending().
+ - The data comes back from the initiator, and the transport calls
+ target_execute_cmd(), which sets cmd->t_state to TRANSPORT_PROCESSING
+ and calls into the backend to actually write the data.
+
+At this point, the backend might take a long time to complete the
+command, since it has to do real IO. If an abort request comes in for
+this command at this point, it will not wait for the command to finish
+since CMD_T_ACTIVE is not set. Then when the command does finally
+finish, we blow up with use-after-free.
+
+Avoid this by setting CMD_T_ACTIVE in target_execute_cmd() so that
+transport_wait_for_tasks() waits for the command to finish executing.
+This matches the behavior from before commit 1389533ef944 ("target:
+remove transport_generic_handle_data"), when data was signaled via
+transport_generic_handle_data(), which set CMD_T_ACTIVE because it
+called transport_add_cmd_to_queue().
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Reported-by: Martin Svec <martin.svec@zoner.cz>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1853,6 +1853,7 @@ void target_execute_cmd(struct se_cmd *c
+ }
+
+ cmd->t_state = TRANSPORT_PROCESSING;
++ cmd->transport_state |= CMD_T_ACTIVE;
+ spin_unlock_irq(&cmd->t_state_lock);
+
+ if (dev->dev_task_attr_type != SAM_TASK_ATTR_EMULATED)
--- /dev/null
+From 72b59d6ee8adaa51f70377db0a1917ed489bead8 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Wed, 2 Jan 2013 12:47:58 -0800
+Subject: target: Fix use-after-free in LUN RESET handling
+
+From: Roland Dreier <roland@purestorage.com>
+
+commit 72b59d6ee8adaa51f70377db0a1917ed489bead8 upstream.
+
+If a backend IO takes a really long then an initiator might abort a
+command, and then when it gives up on the abort, send a LUN reset too,
+all before we process any of the original command or the abort. (The
+abort will wait for the backend IO to complete too)
+
+When the backend IO final completes (or fails), the abort handling
+will proceed and queue up a "return aborted status" operation. Then,
+while that's still pending, the LUN reset might find the original
+command still on the LUN's list of commands and try to return aborted
+status again, which leads to a use-after free when the first
+se_tfo->queue_status call frees the command and then the second
+se_tfo->queue_status call runs.
+
+Fix this by removing a command from the LUN state_list when we first
+are about to queue aborted status; we shouldn't do anything
+LUN-related after we've started returning status, so this seems like
+the correct thing to do.
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -545,9 +545,6 @@ static void transport_lun_remove_cmd(str
+
+ void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
+ {
+- if (!(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
+- transport_lun_remove_cmd(cmd);
+-
+ if (transport_cmd_check_stop_to_fabric(cmd))
+ return;
+ if (remove)
+@@ -3090,6 +3087,8 @@ void transport_send_task_abort(struct se
+ }
+ cmd->scsi_status = SAM_STAT_TASK_ABORTED;
+
++ transport_lun_remove_cmd(cmd);
++
+ pr_debug("Setting SAM_STAT_TASK_ABORTED status for CDB: 0x%02x,"
+ " ITT: 0x%08x\n", cmd->t_task_cdb[0],
+ cmd->se_tfo->get_task_tag(cmd));
--- /dev/null
+From 5a3b6fc0092c5f8dee7820064ee54d2631d48573 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Wed, 2 Jan 2013 12:47:59 -0800
+Subject: target: Release se_cmd when LUN lookup fails for TMR
+
+From: Roland Dreier <roland@purestorage.com>
+
+commit 5a3b6fc0092c5f8dee7820064ee54d2631d48573 upstream.
+
+When transport_lookup_tmr_lun() fails and we return a task management
+response from target_complete_tmr_failure(), we need to call
+transport_cmd_check_stop_to_fabric() to release the last ref to the
+cmd after calling se_tfo->queue_tm_rsp(), or else we will never remove
+the failed TMR from the session command list (and we'll end up waiting
+forever when trying to tear down the session).
+
+(nab: Fix minor compile breakage)
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1613,6 +1613,8 @@ static void target_complete_tmr_failure(
+
+ se_cmd->se_tmr_req->response = TMR_LUN_DOES_NOT_EXIST;
+ se_cmd->se_tfo->queue_tm_rsp(se_cmd);
++
++ transport_cmd_check_stop_to_fabric(se_cmd);
+ }
+
+ /**
--- /dev/null
+From 18a9df42d53fabfa43b78be1104838cc8b9762e1 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Mon, 17 Dec 2012 09:53:32 +0100
+Subject: target: use correct sense code for LUN communication failure
+
+From: Hannes Reinecke <hare@suse.de>
+
+commit 18a9df42d53fabfa43b78be1104838cc8b9762e1 upstream.
+
+The ASC/ASCQ code for 'Logical Unit Communication failure' is
+0x08/0x00; 0x80/0x00 is vendor specific.
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Cc: Nicholas Bellinger <nab@risingtidesystems.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -3024,7 +3024,7 @@ int transport_send_check_condition_and_s
+ /* ILLEGAL REQUEST */
+ buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* LOGICAL UNIT COMMUNICATION FAILURE */
+- buffer[SPC_ASC_KEY_OFFSET] = 0x80;
++ buffer[SPC_ASC_KEY_OFFSET] = 0x08;
+ break;
+ }
+ /*
--- /dev/null
+From f2eeba214bcd0215b7f558cab6420e5fd153042b Mon Sep 17 00:00:00 2001
+From: Mark Rustad <mark.d.rustad@intel.com>
+Date: Fri, 21 Dec 2012 10:58:14 -0800
+Subject: tcm_fc: Do not indicate retry capability to initiators
+
+From: Mark Rustad <mark.d.rustad@intel.com>
+
+commit f2eeba214bcd0215b7f558cab6420e5fd153042b upstream.
+
+When generating a PRLI response to an initiator, clear the
+FCP_SPPF_RETRY bit in the response.
+
+Signed-off-by: Mark Rustad <mark.d.rustad@intel.com>
+Reviewed-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com>
+Acked by Robert Love <robert.w.love@intel.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/tcm_fc/tfc_sess.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/tcm_fc/tfc_sess.c
++++ b/drivers/target/tcm_fc/tfc_sess.c
+@@ -396,10 +396,10 @@ static int ft_prli_locked(struct fc_rpor
+
+ /*
+ * OR in our service parameters with other provider (initiator), if any.
+- * TBD XXX - indicate RETRY capability?
+ */
+ fill:
+ fcp_parm = ntohl(spp->spp_params);
++ fcp_parm &= ~FCP_SPPF_RETRY;
+ spp->spp_params = htonl(fcp_parm | FCP_SPPF_TARG_FCN);
+ return FC_SPP_RESP_ACK;
+ }
--- /dev/null
+From edec8dfefa1f372b2dd8197da555352e76a10c03 Mon Sep 17 00:00:00 2001
+From: Mark Rustad <mark.d.rustad@intel.com>
+Date: Fri, 21 Dec 2012 10:58:19 -0800
+Subject: tcm_fc: Do not report target role when target is not defined
+
+From: Mark Rustad <mark.d.rustad@intel.com>
+
+commit edec8dfefa1f372b2dd8197da555352e76a10c03 upstream.
+
+Clear the target role when no target is provided for
+the node performing a PRLI.
+
+Signed-off-by: Mark Rustad <mark.d.rustad@intel.com>
+Reviewed-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com>
+Acked by Robert Love <robert.w.love@intel.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/tcm_fc/tfc_sess.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/target/tcm_fc/tfc_sess.c
++++ b/drivers/target/tcm_fc/tfc_sess.c
+@@ -355,11 +355,11 @@ static int ft_prli_locked(struct fc_rpor
+
+ tport = ft_tport_create(rdata->local_port);
+ if (!tport)
+- return 0; /* not a target for this local port */
++ goto not_target; /* not a target for this local port */
+
+ acl = ft_acl_get(tport->tpg, rdata);
+ if (!acl)
+- return 0;
++ goto not_target; /* no target for this remote */
+
+ if (!rspp)
+ goto fill;
+@@ -402,6 +402,12 @@ fill:
+ fcp_parm &= ~FCP_SPPF_RETRY;
+ spp->spp_params = htonl(fcp_parm | FCP_SPPF_TARG_FCN);
+ return FC_SPP_RESP_ACK;
++
++not_target:
++ fcp_parm = ntohl(spp->spp_params);
++ fcp_parm &= ~FCP_SPPF_TARG_FCN;
++ spp->spp_params = htonl(fcp_parm);
++ return 0;
+ }
+
+ /**
projects / thirdparty / kernel / stable-queue.git / commitdiff
