]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.14-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 4 Dec 2014 23:56:54 +0000 (15:56 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 4 Dec 2014 23:56:54 +0000 (15:56 -0800)
added patches:
arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch
arm-8222-1-mvebu-enable-strex-backoff-delay.patch
arm-8226-1-cacheflush-get-rid-of-restarting-block.patch
bnx2fc-do-not-add-shared-skbs-to-the-fcoe_rx_list.patch
can-dev-avoid-calling-kfree_skb-from-interrupt-context.patch
input-synaptics-adjust-min-max-on-thinkpad-e540.patch
input-xpad-use-proper-endpoint-type.patch
iser-target-disable-tx-completion-interrupt-coalescing.patch
iser-target-handle-device_removal-event-on-network-portal-listener-correctly.patch
net-ping-handle-protocol-mismatching-scenario.patch
nfsd-correctly-define-v4.2-support-attributes.patch
nfsd-don-t-halt-scanning-the-drc-lru-list-when-there-s-an.patch
nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch
of-irq-drop-obsolete-interrupts-vs-interrupts-extended-text.patch
rt2x00-do-not-align-payload-on-modern-h-w.patch
scsi-add-intel-multi-flex-to-scsi-scan-blacklist.patch
spi-dw-fix-dynamic-speed-change.patch
srp-target-retry-when-qp-creation-fails-with-enomem.patch
target-don-t-call-tfo-write_pending-if-data_length-0.patch
target-iser-fix-a-wrong-dereference-in-case-discovery-session-is-over-iser.patch
vhost-scsi-take-configfs-group-dependency-during-vhost_scsi_set_endpoint.patch

22 files changed:
queue-3.14/arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch [new file with mode: 0644]
queue-3.14/arm-8222-1-mvebu-enable-strex-backoff-delay.patch [new file with mode: 0644]
queue-3.14/arm-8226-1-cacheflush-get-rid-of-restarting-block.patch [new file with mode: 0644]
queue-3.14/bnx2fc-do-not-add-shared-skbs-to-the-fcoe_rx_list.patch [new file with mode: 0644]
queue-3.14/can-dev-avoid-calling-kfree_skb-from-interrupt-context.patch [new file with mode: 0644]
queue-3.14/input-synaptics-adjust-min-max-on-thinkpad-e540.patch [new file with mode: 0644]
queue-3.14/input-xpad-use-proper-endpoint-type.patch [new file with mode: 0644]
queue-3.14/iser-target-disable-tx-completion-interrupt-coalescing.patch [new file with mode: 0644]
queue-3.14/iser-target-handle-device_removal-event-on-network-portal-listener-correctly.patch [new file with mode: 0644]
queue-3.14/net-ping-handle-protocol-mismatching-scenario.patch [new file with mode: 0644]
queue-3.14/nfsd-correctly-define-v4.2-support-attributes.patch [new file with mode: 0644]
queue-3.14/nfsd-don-t-halt-scanning-the-drc-lru-list-when-there-s-an.patch [new file with mode: 0644]
queue-3.14/nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch [new file with mode: 0644]
queue-3.14/of-irq-drop-obsolete-interrupts-vs-interrupts-extended-text.patch [new file with mode: 0644]
queue-3.14/rt2x00-do-not-align-payload-on-modern-h-w.patch [new file with mode: 0644]
queue-3.14/scsi-add-intel-multi-flex-to-scsi-scan-blacklist.patch [new file with mode: 0644]
queue-3.14/series
queue-3.14/spi-dw-fix-dynamic-speed-change.patch [new file with mode: 0644]
queue-3.14/srp-target-retry-when-qp-creation-fails-with-enomem.patch [new file with mode: 0644]
queue-3.14/target-don-t-call-tfo-write_pending-if-data_length-0.patch [new file with mode: 0644]
queue-3.14/target-iser-fix-a-wrong-dereference-in-case-discovery-session-is-over-iser.patch [new file with mode: 0644]
queue-3.14/vhost-scsi-take-configfs-group-dependency-during-vhost_scsi_set_endpoint.patch [new file with mode: 0644]

diff --git a/queue-3.14/arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch b/queue-3.14/arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch
new file mode 100644 (file)
index 0000000..bbb9804
--- /dev/null
@@ -0,0 +1,51 @@
+From ef59a20ba375aeb97b3150a118318884743452a8 Mon Sep 17 00:00:00 2001
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Date: Fri, 21 Nov 2014 15:29:00 +0100
+Subject: ARM: 8216/1: xscale: correct auxiliary register in suspend/resume
+
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+
+commit ef59a20ba375aeb97b3150a118318884743452a8 upstream.
+
+According to the manuals I have, XScale auxiliary register should be
+reached with opc_2 = 1 instead of crn = 1. cpu_xscale_proc_init
+correctly uses c1, c0, 1 arguments, but cpu_xscale_do_suspend and
+cpu_xscale_do_resume use c1, c1, 0. Correct suspend/resume functions to
+also use c1, c0, 1.
+
+The issue was primarily noticed thanks to qemu reporing "unsupported
+instruction" on the pxa suspend path. Confirmed in PXA210/250 and PXA255
+XScale Core manuals and in PXA270 and PXA320 Developers Guides.
+
+Harware tested by me on tosa (pxa255). Robert confirmed on pxa270 board.
+
+Tested-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/proc-xscale.S |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mm/proc-xscale.S
++++ b/arch/arm/mm/proc-xscale.S
+@@ -535,7 +535,7 @@ ENTRY(cpu_xscale_do_suspend)
+       mrc     p15, 0, r5, c15, c1, 0  @ CP access reg
+       mrc     p15, 0, r6, c13, c0, 0  @ PID
+       mrc     p15, 0, r7, c3, c0, 0   @ domain ID
+-      mrc     p15, 0, r8, c1, c1, 0   @ auxiliary control reg
++      mrc     p15, 0, r8, c1, c0, 1   @ auxiliary control reg
+       mrc     p15, 0, r9, c1, c0, 0   @ control reg
+       bic     r4, r4, #2              @ clear frequency change bit
+       stmia   r0, {r4 - r9}           @ store cp regs
+@@ -552,7 +552,7 @@ ENTRY(cpu_xscale_do_resume)
+       mcr     p15, 0, r6, c13, c0, 0  @ PID
+       mcr     p15, 0, r7, c3, c0, 0   @ domain ID
+       mcr     p15, 0, r1, c2, c0, 0   @ translation table base addr
+-      mcr     p15, 0, r8, c1, c1, 0   @ auxiliary control reg
++      mcr     p15, 0, r8, c1, c0, 1   @ auxiliary control reg
+       mov     r0, r9                  @ control register
+       b       cpu_resume_mmu
+ ENDPROC(cpu_xscale_do_resume)
diff --git a/queue-3.14/arm-8222-1-mvebu-enable-strex-backoff-delay.patch b/queue-3.14/arm-8222-1-mvebu-enable-strex-backoff-delay.patch
new file mode 100644 (file)
index 0000000..80d6251
--- /dev/null
@@ -0,0 +1,55 @@
+From 995ab5189d1d7264e79e665dfa032a19b3ac646e Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Tue, 25 Nov 2014 18:43:15 +0100
+Subject: ARM: 8222/1: mvebu: enable strex backoff delay
+
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+commit 995ab5189d1d7264e79e665dfa032a19b3ac646e upstream.
+
+Under extremely rare conditions, in an MPCore node consisting of at
+least 3 CPUs, two CPUs trying to perform a STREX to data on the same
+shared cache line can enter a livelock situation.
+
+This patch enables the HW mechanism that overcomes the bug. This fixes
+the incorrect setup of the STREX backoff delay bit due to a wrong
+description in the specification.
+
+Note that enabling the STREX backoff delay mechanism is done by
+leaving the bit *cleared*, while the bit was currently being set by
+the proc-v7.S code.
+
+[Thomas: adapt to latest mainline, slightly reword the commit log, add
+stable markers.]
+
+Fixes: de4901933f6d ("arm: mm: Add support for PJ4B cpu and init routines")
+
+Signed-off-by: Nadav Haklai <nadavh@marvell.com>
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Acked-by: Jason Cooper <jason@lakedaemon.net>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/proc-v7.S |    2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -211,7 +211,6 @@ __v7_pj4b_setup:
+ /* Auxiliary Debug Modes Control 1 Register */
+ #define PJ4B_STATIC_BP (1 << 2) /* Enable Static BP */
+ #define PJ4B_INTER_PARITY (1 << 8) /* Disable Internal Parity Handling */
+-#define PJ4B_BCK_OFF_STREX (1 << 5) /* Enable the back off of STREX instr */
+ #define PJ4B_CLEAN_LINE (1 << 16) /* Disable data transfer for clean line */
+ /* Auxiliary Debug Modes Control 2 Register */
+@@ -234,7 +233,6 @@ __v7_pj4b_setup:
+       /* Auxiliary Debug Modes Control 1 Register */
+       mrc     p15, 1, r0, c15, c1, 1
+       orr     r0, r0, #PJ4B_CLEAN_LINE
+-      orr     r0, r0, #PJ4B_BCK_OFF_STREX
+       orr     r0, r0, #PJ4B_INTER_PARITY
+       bic     r0, r0, #PJ4B_STATIC_BP
+       mcr     p15, 1, r0, c15, c1, 1
diff --git a/queue-3.14/arm-8226-1-cacheflush-get-rid-of-restarting-block.patch b/queue-3.14/arm-8226-1-cacheflush-get-rid-of-restarting-block.patch
new file mode 100644 (file)
index 0000000..7e51ead
--- /dev/null
@@ -0,0 +1,113 @@
+From 3f4aa45ceea5789a4aade536acc27f2e0d3da5e1 Mon Sep 17 00:00:00 2001
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+Date: Thu, 27 Nov 2014 11:39:04 +0100
+Subject: ARM: 8226/1: cacheflush: get rid of restarting block
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+commit 3f4aa45ceea5789a4aade536acc27f2e0d3da5e1 upstream.
+
+We cannot restart cacheflush safely if a process provides user-defined
+signal handler and signal is pending. In this case -EINTR is returned
+and it is expected that process re-invokes syscall. However, there are
+a few problems with that:
+ * looks like nobody bothers checking return value from cacheflush
+ * but if it did, we don't provide the restart address for that, so the
+   process has to use the same range again
+ * ...and again, what might lead to looping forever
+
+So, remove cacheflush restarting code and terminate cache flushing
+as early as fatal signal is pending.
+
+Reported-by: Chanho Min <chanho.min@lge.com>
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/thread_info.h |   11 -----------
+ arch/arm/kernel/traps.c            |   31 ++-----------------------------
+ 2 files changed, 2 insertions(+), 40 deletions(-)
+
+--- a/arch/arm/include/asm/thread_info.h
++++ b/arch/arm/include/asm/thread_info.h
+@@ -43,16 +43,6 @@ struct cpu_context_save {
+       __u32   extra[2];               /* Xscale 'acc' register, etc */
+ };
+-struct arm_restart_block {
+-      union {
+-              /* For user cache flushing */
+-              struct {
+-                      unsigned long start;
+-                      unsigned long end;
+-              } cache;
+-      };
+-};
+-
+ /*
+  * low level task data that entry.S needs immediate access to.
+  * __switch_to() assumes cpu_context follows immediately after cpu_domain.
+@@ -78,7 +68,6 @@ struct thread_info {
+       unsigned long           thumbee_state;  /* ThumbEE Handler Base register */
+ #endif
+       struct restart_block    restart_block;
+-      struct arm_restart_block        arm_restart_block;
+ };
+ #define INIT_THREAD_INFO(tsk)                                         \
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -510,8 +510,6 @@ static int bad_syscall(int n, struct pt_
+       return regs->ARM_r0;
+ }
+-static long do_cache_op_restart(struct restart_block *);
+-
+ static inline int
+ __do_cache_op(unsigned long start, unsigned long end)
+ {
+@@ -520,24 +518,8 @@ __do_cache_op(unsigned long start, unsig
+       do {
+               unsigned long chunk = min(PAGE_SIZE, end - start);
+-              if (signal_pending(current)) {
+-                      struct thread_info *ti = current_thread_info();
+-
+-                      ti->restart_block = (struct restart_block) {
+-                              .fn     = do_cache_op_restart,
+-                      };
+-
+-                      ti->arm_restart_block = (struct arm_restart_block) {
+-                              {
+-                                      .cache = {
+-                                              .start  = start,
+-                                              .end    = end,
+-                                      },
+-                              },
+-                      };
+-
+-                      return -ERESTART_RESTARTBLOCK;
+-              }
++              if (fatal_signal_pending(current))
++                      return 0;
+               ret = flush_cache_user_range(start, start + chunk);
+               if (ret)
+@@ -550,15 +532,6 @@ __do_cache_op(unsigned long start, unsig
+       return 0;
+ }
+-static long do_cache_op_restart(struct restart_block *unused)
+-{
+-      struct arm_restart_block *restart_block;
+-
+-      restart_block = &current_thread_info()->arm_restart_block;
+-      return __do_cache_op(restart_block->cache.start,
+-                           restart_block->cache.end);
+-}
+-
+ static inline int
+ do_cache_op(unsigned long start, unsigned long end, int flags)
+ {
diff --git a/queue-3.14/bnx2fc-do-not-add-shared-skbs-to-the-fcoe_rx_list.patch b/queue-3.14/bnx2fc-do-not-add-shared-skbs-to-the-fcoe_rx_list.patch
new file mode 100644 (file)
index 0000000..83d9046
--- /dev/null
@@ -0,0 +1,72 @@
+From 01a4cc4d0cd6a836c7b923760e8eb1cbb6a47258 Mon Sep 17 00:00:00 2001
+From: Maurizio Lombardi <mlombard@redhat.com>
+Date: Thu, 20 Nov 2014 11:17:33 +0100
+Subject: bnx2fc: do not add shared skbs to the fcoe_rx_list
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+commit 01a4cc4d0cd6a836c7b923760e8eb1cbb6a47258 upstream.
+
+In some cases, the fcoe_rx_list may contains multiple instances
+of the same skb (the so called "shared skbs").
+
+the bnx2fc_l2_rcv thread is a loop that extracts a skb from the list,
+modifies (and destroys) its content and then proceed to the next one.
+The problem is that if the skb is shared, the remaining instances will
+be corrupted.
+
+The solution is to use skb_share_check() before adding the skb to the
+fcoe_rx_list.
+
+[ 6286.808725] ------------[ cut here ]------------
+[ 6286.808729] WARNING: at include/scsi/fc_frame.h:173 bnx2fc_l2_rcv_thread+0x425/0x450 [bnx2fc]()
+[ 6286.808748] Modules linked in: bnx2x(-) mdio dm_service_time bnx2fc cnic uio fcoe libfcoe 8021q garp stp mrp libfc llc scsi_transport_fc scsi_tgt sg iTCO_wdt iTCO_vendor_support coretemp kvm_intel kvm crct10dif_pclmul crc32_pclmul crc32c_intel e1000e ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper ptp cryptd hpilo serio_raw hpwdt lpc_ich pps_core ipmi_si pcspkr mfd_core ipmi_msghandler shpchp pcc_cpufreq mperf nfsd auth_rpcgss nfs_acl lockd sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sd_mod crc_t10dif crct10dif_common mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit ata_piix drm_kms_helper ttm drm libata i2c_core hpsa dm_mirror dm_region_hash dm_log dm_mod [last unloaded: mdio]
+[ 6286.808750] CPU: 3 PID: 1304 Comm: bnx2fc_l2_threa Not tainted 3.10.0-121.el7.x86_64 #1
+[ 6286.808750] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013
+[ 6286.808752]  0000000000000000 000000000b36e715 ffff8800deba1e00 ffffffff815ec0ba
+[ 6286.808753]  ffff8800deba1e38 ffffffff8105dee1 ffffffffa05618c0 ffff8801e4c81888
+[ 6286.808754]  ffffe8ffff663868 ffff8801f402b180 ffff8801f56bc000 ffff8800deba1e48
+[ 6286.808754] Call Trace:
+[ 6286.808759]  [<ffffffff815ec0ba>] dump_stack+0x19/0x1b
+[ 6286.808762]  [<ffffffff8105dee1>] warn_slowpath_common+0x61/0x80
+[ 6286.808763]  [<ffffffff8105e00a>] warn_slowpath_null+0x1a/0x20
+[ 6286.808765]  [<ffffffffa054f415>] bnx2fc_l2_rcv_thread+0x425/0x450 [bnx2fc]
+[ 6286.808767]  [<ffffffffa054eff0>] ? bnx2fc_disable+0x90/0x90 [bnx2fc]
+[ 6286.808769]  [<ffffffff81085aef>] kthread+0xcf/0xe0
+[ 6286.808770]  [<ffffffff81085a20>] ? kthread_create_on_node+0x140/0x140
+[ 6286.808772]  [<ffffffff815fc76c>] ret_from_fork+0x7c/0xb0
+[ 6286.808773]  [<ffffffff81085a20>] ? kthread_create_on_node+0x140/0x140
+[ 6286.808774] ---[ end trace c6cdb939184ccb4e ]---
+
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Acked-by: Chad Dupuis <chad.dupuis@qlogic.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/bnx2fc/bnx2fc_fcoe.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+@@ -411,6 +411,7 @@ static int bnx2fc_rcv(struct sk_buff *sk
+       struct fc_frame_header *fh;
+       struct fcoe_rcv_info *fr;
+       struct fcoe_percpu_s *bg;
++      struct sk_buff *tmp_skb;
+       unsigned short oxid;
+       interface = container_of(ptype, struct bnx2fc_interface,
+@@ -423,6 +424,12 @@ static int bnx2fc_rcv(struct sk_buff *sk
+               goto err;
+       }
++      tmp_skb = skb_share_check(skb, GFP_ATOMIC);
++      if (!tmp_skb)
++              goto err;
++
++      skb = tmp_skb;
++
+       if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) {
+               printk(KERN_ERR PFX "bnx2fc_rcv: Wrong FC type frame\n");
+               goto err;
diff --git a/queue-3.14/can-dev-avoid-calling-kfree_skb-from-interrupt-context.patch b/queue-3.14/can-dev-avoid-calling-kfree_skb-from-interrupt-context.patch
new file mode 100644 (file)
index 0000000..af36ca9
--- /dev/null
@@ -0,0 +1,72 @@
+From 5247a589c24022ab34e780039cc8000c48f2035e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20K=C3=B6rper?= <thomas.koerper@esd.eu>
+Date: Fri, 31 Oct 2014 07:33:54 +0100
+Subject: can: dev: avoid calling kfree_skb() from interrupt context
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Thomas=20K=C3=B6rper?= <thomas.koerper@esd.eu>
+
+commit 5247a589c24022ab34e780039cc8000c48f2035e upstream.
+
+ikfree_skb() is Called in can_free_echo_skb(), which might be called from (TX
+Error) interrupt, which triggers the folloing warning:
+
+[ 1153.360705] ------------[ cut here ]------------
+[ 1153.360715] WARNING: CPU: 0 PID: 31 at net/core/skbuff.c:563 skb_release_head_state+0xb9/0xd0()
+[ 1153.360772] Call Trace:
+[ 1153.360778]  [<c167906f>] dump_stack+0x41/0x52
+[ 1153.360782]  [<c105bb7e>] warn_slowpath_common+0x7e/0xa0
+[ 1153.360784]  [<c158b909>] ? skb_release_head_state+0xb9/0xd0
+[ 1153.360786]  [<c158b909>] ? skb_release_head_state+0xb9/0xd0
+[ 1153.360788]  [<c105bc42>] warn_slowpath_null+0x22/0x30
+[ 1153.360791]  [<c158b909>] skb_release_head_state+0xb9/0xd0
+[ 1153.360793]  [<c158be90>] skb_release_all+0x10/0x30
+[ 1153.360795]  [<c158bf06>] kfree_skb+0x36/0x80
+[ 1153.360799]  [<f8486938>] ? can_free_echo_skb+0x28/0x40 [can_dev]
+[ 1153.360802]  [<f8486938>] can_free_echo_skb+0x28/0x40 [can_dev]
+[ 1153.360805]  [<f849a12c>] esd_pci402_interrupt+0x34c/0x57a [esd402]
+[ 1153.360809]  [<c10a75b5>] handle_irq_event_percpu+0x35/0x180
+[ 1153.360811]  [<c10a7623>] ? handle_irq_event_percpu+0xa3/0x180
+[ 1153.360813]  [<c10a7731>] handle_irq_event+0x31/0x50
+[ 1153.360816]  [<c10a9c7f>] handle_fasteoi_irq+0x6f/0x120
+[ 1153.360818]  [<c10a9c10>] ? handle_edge_irq+0x110/0x110
+[ 1153.360822]  [<c1011b61>] handle_irq+0x71/0x90
+[ 1153.360823]  <IRQ>  [<c168152c>] do_IRQ+0x3c/0xd0
+[ 1153.360829]  [<c1680b6c>] common_interrupt+0x2c/0x34
+[ 1153.360834]  [<c107d277>] ? finish_task_switch+0x47/0xf0
+[ 1153.360836]  [<c167c27b>] __schedule+0x35b/0x7e0
+[ 1153.360839]  [<c10a5334>] ? console_unlock+0x2c4/0x4d0
+[ 1153.360842]  [<c13df500>] ? n_tty_receive_buf_common+0x890/0x890
+[ 1153.360845]  [<c10707b6>] ? process_one_work+0x196/0x370
+[ 1153.360847]  [<c167c723>] schedule+0x23/0x60
+[ 1153.360849]  [<c1070de1>] worker_thread+0x161/0x460
+[ 1153.360852]  [<c1090fcf>] ? __wake_up_locked+0x1f/0x30
+[ 1153.360854]  [<c1070c80>] ? rescuer_thread+0x2f0/0x2f0
+[ 1153.360856]  [<c1074f01>] kthread+0xa1/0xc0
+[ 1153.360859]  [<c1680401>] ret_from_kernel_thread+0x21/0x30
+[ 1153.360861]  [<c1074e60>] ? kthread_create_on_node+0x110/0x110
+[ 1153.360863] ---[ end trace 5ff83639cbb74b35 ]---
+
+This patch replaces the kfree_skb() by dev_kfree_skb_any().
+
+Signed-off-by: Thomas Körper <thomas.koerper@esd.eu>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/dev.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -384,7 +384,7 @@ void can_free_echo_skb(struct net_device
+       BUG_ON(idx >= priv->echo_skb_max);
+       if (priv->echo_skb[idx]) {
+-              kfree_skb(priv->echo_skb[idx]);
++              dev_kfree_skb_any(priv->echo_skb[idx]);
+               priv->echo_skb[idx] = NULL;
+       }
+ }
diff --git a/queue-3.14/input-synaptics-adjust-min-max-on-thinkpad-e540.patch b/queue-3.14/input-synaptics-adjust-min-max-on-thinkpad-e540.patch
new file mode 100644 (file)
index 0000000..ec33a47
--- /dev/null
@@ -0,0 +1,40 @@
+From bce4f9e764c36bc35dd5c9cf9e057c09f422397d Mon Sep 17 00:00:00 2001
+From: Ben Sagal <bensagal@gmail.com>
+Date: Sun, 16 Nov 2014 17:23:40 -0800
+Subject: Input: synaptics - adjust min/max on Thinkpad E540
+
+From: Ben Sagal <bensagal@gmail.com>
+
+commit bce4f9e764c36bc35dd5c9cf9e057c09f422397d upstream.
+
+The LEN2006 Synaptics touchpad (as found in Thinkpad E540) returns wrong
+min max values.
+
+touchpad-edge-detector output:
+>  Touchpad SynPS/2 Synaptics TouchPad on /dev/input/event6
+>  Move one finger around the touchpad to detect the actual edges
+>  Kernel says:    x [1472..5674], y [1408..4684]
+>  Touchpad sends: x [1264..5675], y [1171..4688]
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88211
+Signed-off-by: Binyamin Sagal <bensagal@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -140,6 +140,10 @@ static const struct min_max_quirk min_ma
+               (const char * const []){"LEN2001", NULL},
+               1024, 5022, 2508, 4832
+       },
++      {
++              (const char * const []){"LEN2006", NULL},
++              1264, 5675, 1171, 4688
++      },
+       { }
+ };
diff --git a/queue-3.14/input-xpad-use-proper-endpoint-type.patch b/queue-3.14/input-xpad-use-proper-endpoint-type.patch
new file mode 100644 (file)
index 0000000..d295d1f
--- /dev/null
@@ -0,0 +1,50 @@
+From a1f9a4072655843fc03186acbad65990cc05dd2d Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Tue, 25 Nov 2014 00:38:17 -0800
+Subject: Input: xpad - use proper endpoint type
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit a1f9a4072655843fc03186acbad65990cc05dd2d upstream.
+
+The xpad wireless endpoint is not a bulk endpoint on my devices, but
+rather an interrupt one, so the USB core complains when it is submitted.
+I'm guessing that the author really did mean that this should be an
+interrupt urb, but as there are a zillion different xpad devices out
+there, let's cover out bases and handle both bulk and interrupt
+endpoints just as easily.
+
+Signed-off-by: "Pierre-Loup A. Griffais" <pgriffais@valvesoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/joystick/xpad.c |   16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -1003,9 +1003,19 @@ static int xpad_probe(struct usb_interfa
+               }
+               ep_irq_in = &intf->cur_altsetting->endpoint[1].desc;
+-              usb_fill_bulk_urb(xpad->bulk_out, udev,
+-                              usb_sndbulkpipe(udev, ep_irq_in->bEndpointAddress),
+-                              xpad->bdata, XPAD_PKT_LEN, xpad_bulk_out, xpad);
++              if (usb_endpoint_is_bulk_out(ep_irq_in)) {
++                      usb_fill_bulk_urb(xpad->bulk_out, udev,
++                                        usb_sndbulkpipe(udev,
++                                                        ep_irq_in->bEndpointAddress),
++                                        xpad->bdata, XPAD_PKT_LEN,
++                                        xpad_bulk_out, xpad);
++              } else {
++                      usb_fill_int_urb(xpad->bulk_out, udev,
++                                       usb_sndintpipe(udev,
++                                                      ep_irq_in->bEndpointAddress),
++                                       xpad->bdata, XPAD_PKT_LEN,
++                                       xpad_bulk_out, xpad, 0);
++              }
+               /*
+                * Submit the int URB immediately rather than waiting for open
diff --git a/queue-3.14/iser-target-disable-tx-completion-interrupt-coalescing.patch b/queue-3.14/iser-target-disable-tx-completion-interrupt-coalescing.patch
new file mode 100644 (file)
index 0000000..16d3ef0
--- /dev/null
@@ -0,0 +1,48 @@
+From 0d0f660d882c1c02748ced13966a2413aa5d6cc2 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Sun, 5 Oct 2014 02:13:03 -0700
+Subject: iser-target: Disable TX completion interrupt coalescing
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 0d0f660d882c1c02748ced13966a2413aa5d6cc2 upstream.
+
+This patch explicitly disables TX completion interrupt coalescing logic
+in isert_put_response() and isert_put_datain() that was originally added
+as an efficiency optimization in commit 95b60f07.
+
+It has been reported that this change can trigger ABORT_TASK timeouts
+under certain small block workloads, where disabling coalescing was
+required for stability.  According to Sagi, this doesn't impact
+overall performance, so go ahead and disable it for now.
+
+Reported-by: Moussa Ba <moussaba@micron.com>
+Reported-by: Sagi Grimberg <sagig@dev.mellanox.co.il>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -1953,7 +1953,7 @@ isert_put_response(struct iscsi_conn *co
+               isert_cmd->tx_desc.num_sge = 2;
+       }
+-      isert_init_send_wr(isert_conn, isert_cmd, send_wr, true);
++      isert_init_send_wr(isert_conn, isert_cmd, send_wr, false);
+       pr_debug("Posting SCSI Response IB_WR_SEND >>>>>>>>>>>>>>>>>>>>>>\n");
+@@ -2472,7 +2472,7 @@ isert_put_datain(struct iscsi_conn *conn
+                            &isert_cmd->tx_desc.iscsi_header);
+       isert_init_tx_hdrs(isert_conn, &isert_cmd->tx_desc);
+       isert_init_send_wr(isert_conn, isert_cmd,
+-                         &isert_cmd->tx_desc.send_wr, true);
++                         &isert_cmd->tx_desc.send_wr, false);
+       atomic_add(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
diff --git a/queue-3.14/iser-target-handle-device_removal-event-on-network-portal-listener-correctly.patch b/queue-3.14/iser-target-handle-device_removal-event-on-network-portal-listener-correctly.patch
new file mode 100644 (file)
index 0000000..9bcdac6
--- /dev/null
@@ -0,0 +1,96 @@
+From 3b726ae2de02a406cc91903f80132daee37b6f1b Mon Sep 17 00:00:00 2001
+From: Sagi Grimberg <sagig@dev.mellanox.co.il>
+Date: Tue, 28 Oct 2014 13:45:03 -0700
+Subject: iser-target: Handle DEVICE_REMOVAL event on network portal listener correctly
+
+From: Sagi Grimberg <sagig@dev.mellanox.co.il>
+
+commit 3b726ae2de02a406cc91903f80132daee37b6f1b upstream.
+
+In this case the cm_id->context is the isert_np, and the cm_id->qp
+is NULL, so use that to distinct the cases.
+
+Since we don't expect any other events on this cm_id we can
+just return -1 for explicit termination of the cm_id by the
+cma layer.
+
+Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c |   29 +++++++++++++++++++----------
+ 1 file changed, 19 insertions(+), 10 deletions(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -725,14 +725,25 @@ wake_up:
+       complete(&isert_conn->conn_wait);
+ }
+-static void
++static int
+ isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect)
+ {
+-      struct isert_conn *isert_conn = (struct isert_conn *)cma_id->context;
++      struct isert_conn *isert_conn;
++
++      if (!cma_id->qp) {
++              struct isert_np *isert_np = cma_id->context;
++
++              isert_np->np_cm_id = NULL;
++              return -1;
++      }
++
++      isert_conn = (struct isert_conn *)cma_id->context;
+       isert_conn->disconnect = disconnect;
+       INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work);
+       schedule_work(&isert_conn->conn_logout_work);
++
++      return 0;
+ }
+ static int
+@@ -747,6 +758,9 @@ isert_cma_handler(struct rdma_cm_id *cma
+       switch (event->event) {
+       case RDMA_CM_EVENT_CONNECT_REQUEST:
+               ret = isert_connect_request(cma_id, event);
++              if (ret)
++                      pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n",
++                              event->event, ret);
+               break;
+       case RDMA_CM_EVENT_ESTABLISHED:
+               isert_connected_handler(cma_id);
+@@ -756,7 +770,7 @@ isert_cma_handler(struct rdma_cm_id *cma
+       case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
+               disconnect = true;
+       case RDMA_CM_EVENT_TIMEWAIT_EXIT:  /* FALLTHRU */
+-              isert_disconnected_handler(cma_id, disconnect);
++              ret = isert_disconnected_handler(cma_id, disconnect);
+               break;
+       case RDMA_CM_EVENT_CONNECT_ERROR:
+       default:
+@@ -764,12 +778,6 @@ isert_cma_handler(struct rdma_cm_id *cma
+               break;
+       }
+-      if (ret != 0) {
+-              pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n",
+-                     event->event, ret);
+-              dump_stack();
+-      }
+-
+       return ret;
+ }
+@@ -2775,7 +2783,8 @@ isert_free_np(struct iscsi_np *np)
+ {
+       struct isert_np *isert_np = (struct isert_np *)np->np_context;
+-      rdma_destroy_id(isert_np->np_cm_id);
++      if (isert_np->np_cm_id)
++              rdma_destroy_id(isert_np->np_cm_id);
+       np->np_context = NULL;
+       kfree(isert_np);
diff --git a/queue-3.14/net-ping-handle-protocol-mismatching-scenario.patch b/queue-3.14/net-ping-handle-protocol-mismatching-scenario.patch
new file mode 100644 (file)
index 0000000..28fc31c
--- /dev/null
@@ -0,0 +1,41 @@
+From 91a0b603469069cdcce4d572b7525ffc9fd352a6 Mon Sep 17 00:00:00 2001
+From: Jane Zhou <a17711@motorola.com>
+Date: Mon, 24 Nov 2014 11:44:08 -0800
+Subject: net/ping: handle protocol mismatching scenario
+
+From: Jane Zhou <a17711@motorola.com>
+
+commit 91a0b603469069cdcce4d572b7525ffc9fd352a6 upstream.
+
+ping_lookup() may return a wrong sock if sk_buff's and sock's protocols
+dont' match. For example, sk_buff's protocol is ETH_P_IPV6, but sock's
+sk_family is AF_INET, in that case, if sk->sk_bound_dev_if is zero, a wrong
+sock will be returned.
+the fix is to "continue" the searching, if no matching, return NULL.
+
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
+Cc: James Morris <jmorris@namei.org>
+Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
+Cc: Patrick McHardy <kaber@trash.net>
+Cc: netdev@vger.kernel.org
+Signed-off-by: Jane Zhou <a17711@motorola.com>
+Signed-off-by: Yiwei Zhao <gbjc64@motorola.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/ping.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -217,6 +217,8 @@ static struct sock *ping_lookup(struct n
+                                            &ipv6_hdr(skb)->daddr))
+                               continue;
+ #endif
++              } else {
++                      continue;
+               }
+               if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif)
diff --git a/queue-3.14/nfsd-correctly-define-v4.2-support-attributes.patch b/queue-3.14/nfsd-correctly-define-v4.2-support-attributes.patch
new file mode 100644 (file)
index 0000000..f2db250
--- /dev/null
@@ -0,0 +1,41 @@
+From 6d0ba0432a5e10bc714ba9c5adc460e726e5fbb4 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Sat, 8 Nov 2014 13:11:03 +0100
+Subject: nfsd: correctly define v4.2 support attributes
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 6d0ba0432a5e10bc714ba9c5adc460e726e5fbb4 upstream.
+
+Even when security labels are disabled we support at least the same
+attributes as v4.1.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfsd.h |    9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/fs/nfsd/nfsd.h
++++ b/fs/nfsd/nfsd.h
+@@ -328,12 +328,15 @@ void             nfsd_lockd_shutdown(void);
+       (NFSD4_SUPPORTED_ATTRS_WORD2 | FATTR4_WORD2_SUPPATTR_EXCLCREAT)
+ #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
+-#define NFSD4_2_SUPPORTED_ATTRS_WORD2 \
+-      (NFSD4_1_SUPPORTED_ATTRS_WORD2 | FATTR4_WORD2_SECURITY_LABEL)
++#define NFSD4_2_SECURITY_ATTRS                FATTR4_WORD2_SECURITY_LABEL
+ #else
+-#define NFSD4_2_SUPPORTED_ATTRS_WORD2 0
++#define NFSD4_2_SECURITY_ATTRS                0
+ #endif
++#define NFSD4_2_SUPPORTED_ATTRS_WORD2 \
++      (NFSD4_1_SUPPORTED_ATTRS_WORD2 | \
++      NFSD4_2_SECURITY_ATTRS)
++
+ static inline u32 nfsd_suppattrs0(u32 minorversion)
+ {
+       return minorversion ? NFSD4_1_SUPPORTED_ATTRS_WORD0
diff --git a/queue-3.14/nfsd-don-t-halt-scanning-the-drc-lru-list-when-there-s-an.patch b/queue-3.14/nfsd-don-t-halt-scanning-the-drc-lru-list-when-there-s-an.patch
new file mode 100644 (file)
index 0000000..078782d
--- /dev/null
@@ -0,0 +1,60 @@
+From 1b19453d1c6abcfa7c312ba6c9f11a277568fc94 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@primarydata.com>
+Date: Thu, 5 Jun 2014 09:45:00 -0400
+Subject: nfsd: don't halt scanning the DRC LRU list when there's an
+ RC_INPROG entry
+
+From: Jeff Layton <jlayton@primarydata.com>
+
+commit 1b19453d1c6abcfa7c312ba6c9f11a277568fc94 upstream.
+
+Currently, the DRC cache pruner will stop scanning the list when it
+hits an entry that is RC_INPROG. It's possible however for a call to
+take a *very* long time. In that case, we don't want it to block other
+entries from being pruned if they are expired or we need to trim the
+cache to get back under the limit.
+
+Fix the DRC cache pruner to just ignore RC_INPROG entries.
+
+Signed-off-by: Jeff Layton <jlayton@primarydata.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Cc: Joseph Salisbury <joseph.salisbury@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfscache.c |   17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+--- a/fs/nfsd/nfscache.c
++++ b/fs/nfsd/nfscache.c
+@@ -224,13 +224,6 @@ hash_refile(struct svc_cacherep *rp)
+       hlist_add_head(&rp->c_hash, cache_hash + hash_32(rp->c_xid, maskbits));
+ }
+-static inline bool
+-nfsd_cache_entry_expired(struct svc_cacherep *rp)
+-{
+-      return rp->c_state != RC_INPROG &&
+-             time_after(jiffies, rp->c_timestamp + RC_EXPIRE);
+-}
+-
+ /*
+  * Walk the LRU list and prune off entries that are older than RC_EXPIRE.
+  * Also prune the oldest ones when the total exceeds the max number of entries.
+@@ -242,8 +235,14 @@ prune_cache_entries(void)
+       long freed = 0;
+       list_for_each_entry_safe(rp, tmp, &lru_head, c_lru) {
+-              if (!nfsd_cache_entry_expired(rp) &&
+-                  num_drc_entries <= max_drc_entries)
++              /*
++               * Don't free entries attached to calls that are still
++               * in-progress, but do keep scanning the list.
++               */
++              if (rp->c_state == RC_INPROG)
++                      continue;
++              if (num_drc_entries <= max_drc_entries &&
++                  time_before(jiffies, rp->c_timestamp + RC_EXPIRE))
+                       break;
+               nfsd_reply_cache_free_locked(rp);
+               freed++;
diff --git a/queue-3.14/nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch b/queue-3.14/nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch
new file mode 100644 (file)
index 0000000..bdecf30
--- /dev/null
@@ -0,0 +1,50 @@
+From c6c15e1ed303ffc47e696ea1c9a9df1761c1f603 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Wed, 19 Nov 2014 12:47:50 -0500
+Subject: nfsd: Fix slot wake up race in the nfsv4.1 callback code
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit c6c15e1ed303ffc47e696ea1c9a9df1761c1f603 upstream.
+
+The currect code for nfsd41_cb_get_slot() and nfsd4_cb_done() has no
+locking in order to guarantee atomicity, and so allows for races of
+the form.
+
+Task 1                                  Task 2
+======                                  ======
+if (test_and_set_bit(0) != 0) {
+                                        clear_bit(0)
+                                        rpc_wake_up_next(queue)
+        rpc_sleep_on(queue)
+        return false;
+}
+
+This patch breaks the race condition by adding a retest of the bit
+after the call to rpc_sleep_on().
+
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4callback.c |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -784,8 +784,12 @@ static bool nfsd41_cb_get_slot(struct nf
+ {
+       if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
+               rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
+-              dprintk("%s slot is busy\n", __func__);
+-              return false;
++              /* Race breaker */
++              if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
++                      dprintk("%s slot is busy\n", __func__);
++                      return false;
++              }
++              rpc_wake_up_queued_task(&clp->cl_cb_waitq, task);
+       }
+       return true;
+ }
diff --git a/queue-3.14/of-irq-drop-obsolete-interrupts-vs-interrupts-extended-text.patch b/queue-3.14/of-irq-drop-obsolete-interrupts-vs-interrupts-extended-text.patch
new file mode 100644 (file)
index 0000000..eecfb9e
--- /dev/null
@@ -0,0 +1,46 @@
+From 66865de4314caca30598244b86817e774c188afa Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Sat, 1 Nov 2014 17:35:31 -0600
+Subject: of/irq: Drop obsolete 'interrupts' vs 'interrupts-extended' text
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit 66865de4314caca30598244b86817e774c188afa upstream.
+
+a9ecdc0fdc54 ("of/irq: Fix lookup to use 'interrupts-extended' property
+first") updated the description to say that:
+
+  - Both 'interrupts' and 'interrupts-extended' may be present
+  - Software should prefer 'interrupts-extended'
+  - Software that doesn't comprehend 'interrupts-extended' may use
+    'interrupts'
+
+But there is still a paragraph at the end that prohibits having both and
+says 'interrupts' should be preferred.
+
+Remove the contradictory text.
+
+Fixes: a9ecdc0fdc54 ("of/irq: Fix lookup to use 'interrupts-extended' property first")
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Brian Norris <computersforpeace@gmail.com>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/interrupt-controller/interrupts.txt |    4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt
++++ b/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt
+@@ -30,10 +30,6 @@ should only be used when a device has mu
+   Example:
+       interrupts-extended = <&intc1 5 1>, <&intc2 1 0>;
+-A device node may contain either "interrupts" or "interrupts-extended", but not
+-both. If both properties are present, then the operating system should log an
+-error and use only the data in "interrupts".
+-
+ 2) Interrupt controller nodes
+ -----------------------------
diff --git a/queue-3.14/rt2x00-do-not-align-payload-on-modern-h-w.patch b/queue-3.14/rt2x00-do-not-align-payload-on-modern-h-w.patch
new file mode 100644 (file)
index 0000000..2542862
--- /dev/null
@@ -0,0 +1,117 @@
+From cfd9167af14eb4ec21517a32911d460083ee3d59 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 11 Nov 2014 14:28:47 +0100
+Subject: rt2x00: do not align payload on modern H/W
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit cfd9167af14eb4ec21517a32911d460083ee3d59 upstream.
+
+RT2800 and newer hardware require padding between header and payload if
+header length is not multiple of 4.
+
+For historical reasons we also align payload to to 4 bytes boundary, but
+such alignment is not needed on modern H/W.
+
+Patch fixes skb_under_panic problems reported from time to time:
+
+https://bugzilla.kernel.org/show_bug.cgi?id=84911
+https://bugzilla.kernel.org/show_bug.cgi?id=72471
+http://marc.info/?l=linux-wireless&m=139108549530402&w=2
+https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1087591
+
+Panic happened because we eat 4 bytes of skb headroom on each
+(re)transmission when sending frame without the payload and the header
+length not being multiple of 4 (i.e. QoS header has 26 bytes). On such
+case because paylad_aling=2 is bigger than header_align=0 we increase
+header_align by 4 bytes. To prevent that we could change the check to:
+
+       if (payload_length && payload_align > header_align)
+               header_align += 4;
+
+but not aligning payload at all is more effective and alignment is not
+really needed by H/W (that has been tested on OpenWrt project for few
+years now).
+
+Reported-and-tested-by: Antti S. Lankila <alankila@bel.fi>
+Debugged-by: Antti S. Lankila <alankila@bel.fi>
+Reported-by: Henrik Asp <solenskiner@gmail.com>
+Originally-From: Helmut Schaa <helmut.schaa@googlemail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2x00queue.c |   50 +++++++-----------------------
+ 1 file changed, 12 insertions(+), 38 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
+@@ -158,55 +158,29 @@ void rt2x00queue_align_frame(struct sk_b
+       skb_trim(skb, frame_length);
+ }
+-void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length)
++/*
++ * H/W needs L2 padding between the header and the paylod if header size
++ * is not 4 bytes aligned.
++ */
++void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int hdr_len)
+ {
+-      unsigned int payload_length = skb->len - header_length;
+-      unsigned int header_align = ALIGN_SIZE(skb, 0);
+-      unsigned int payload_align = ALIGN_SIZE(skb, header_length);
+-      unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0;
+-
+-      /*
+-       * Adjust the header alignment if the payload needs to be moved more
+-       * than the header.
+-       */
+-      if (payload_align > header_align)
+-              header_align += 4;
++      unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
+-      /* There is nothing to do if no alignment is needed */
+-      if (!header_align)
++      if (!l2pad)
+               return;
+-      /* Reserve the amount of space needed in front of the frame */
+-      skb_push(skb, header_align);
+-
+-      /*
+-       * Move the header.
+-       */
+-      memmove(skb->data, skb->data + header_align, header_length);
+-
+-      /* Move the payload, if present and if required */
+-      if (payload_length && payload_align)
+-              memmove(skb->data + header_length + l2pad,
+-                      skb->data + header_length + l2pad + payload_align,
+-                      payload_length);
+-
+-      /* Trim the skb to the correct size */
+-      skb_trim(skb, header_length + l2pad + payload_length);
++      skb_push(skb, l2pad);
++      memmove(skb->data, skb->data + l2pad, hdr_len);
+ }
+-void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length)
++void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int hdr_len)
+ {
+-      /*
+-       * L2 padding is only present if the skb contains more than just the
+-       * IEEE 802.11 header.
+-       */
+-      unsigned int l2pad = (skb->len > header_length) ?
+-                              L2PAD_SIZE(header_length) : 0;
++      unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
+       if (!l2pad)
+               return;
+-      memmove(skb->data + l2pad, skb->data, header_length);
++      memmove(skb->data + l2pad, skb->data, hdr_len);
+       skb_pull(skb, l2pad);
+ }
diff --git a/queue-3.14/scsi-add-intel-multi-flex-to-scsi-scan-blacklist.patch b/queue-3.14/scsi-add-intel-multi-flex-to-scsi-scan-blacklist.patch
new file mode 100644 (file)
index 0000000..981d121
--- /dev/null
@@ -0,0 +1,36 @@
+From 1899045510ff109980d9cc34e330fd8ca3631871 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20S=C3=BCnkenberg?=
+ <christian.suenkenberg@hfg-karlsruhe.de>
+Date: Tue, 18 Nov 2014 20:23:32 +0100
+Subject: scsi: add Intel Multi-Flex to scsi scan blacklist
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Christian=20S=C3=BCnkenberg?=
+
+commit 1899045510ff109980d9cc34e330fd8ca3631871 upstream.
+
+Intel Multi-Flex LUNs choke on REPORT SUPPORTED OPERATION CODES
+resulting in sd_mod hanging for several minutes on startup.
+The issue was introduced with WRITE SAME discovery heuristics.
+
+Fixes: 5db44863b6eb ("[SCSI] sd: Implement support for WRITE SAME")
+Signed-off-by: Christian Sünkenberg <christian.suenkenberg@hfg-karlsruhe.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_devinfo.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -202,6 +202,7 @@ static struct {
+       {"IOMEGA", "Io20S         *F", NULL, BLIST_KEY},
+       {"INSITE", "Floptical   F*8I", NULL, BLIST_KEY},
+       {"INSITE", "I325VM", NULL, BLIST_KEY},
++      {"Intel", "Multi-Flex", NULL, BLIST_NO_RSOC},
+       {"iRiver", "iFP Mass Driver", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
+       {"LASOUND", "CDX7405", "3.10", BLIST_MAX5LUN | BLIST_SINGLELUN},
+       {"MATSHITA", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
index 54132cc678035ea3b7c0214ba9cd5911e0ffa4f1..61f1072b950f828f06a710f5de30459b7cb150b2 100644 (file)
@@ -42,3 +42,24 @@ usb-xhci-rework-root-port-wake-bits-if-controller-isn-t-allowed-to-wakeup.patch
 can-esd_usb2-fix-memory-leak-on-disconnect.patch
 alsa-usb-audio-add-ctrl-message-delay-quirk-for.patch
 aio-fix-uncorrent-dirty-pages-accouting-when-truncating-aio-ring-buffer.patch
+of-irq-drop-obsolete-interrupts-vs-interrupts-extended-text.patch
+arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch
+arm-8222-1-mvebu-enable-strex-backoff-delay.patch
+arm-8226-1-cacheflush-get-rid-of-restarting-block.patch
+input-synaptics-adjust-min-max-on-thinkpad-e540.patch
+input-xpad-use-proper-endpoint-type.patch
+srp-target-retry-when-qp-creation-fails-with-enomem.patch
+target-don-t-call-tfo-write_pending-if-data_length-0.patch
+iser-target-handle-device_removal-event-on-network-portal-listener-correctly.patch
+target-iser-fix-a-wrong-dereference-in-case-discovery-session-is-over-iser.patch
+iser-target-disable-tx-completion-interrupt-coalescing.patch
+spi-dw-fix-dynamic-speed-change.patch
+vhost-scsi-take-configfs-group-dependency-during-vhost_scsi_set_endpoint.patch
+scsi-add-intel-multi-flex-to-scsi-scan-blacklist.patch
+can-dev-avoid-calling-kfree_skb-from-interrupt-context.patch
+rt2x00-do-not-align-payload-on-modern-h-w.patch
+nfsd-correctly-define-v4.2-support-attributes.patch
+nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch
+nfsd-don-t-halt-scanning-the-drc-lru-list-when-there-s-an.patch
+net-ping-handle-protocol-mismatching-scenario.patch
+bnx2fc-do-not-add-shared-skbs-to-the-fcoe_rx_list.patch
diff --git a/queue-3.14/spi-dw-fix-dynamic-speed-change.patch b/queue-3.14/spi-dw-fix-dynamic-speed-change.patch
new file mode 100644 (file)
index 0000000..ac9f546
--- /dev/null
@@ -0,0 +1,67 @@
+From 0a8727e69778683495058852f783eeda141a754e Mon Sep 17 00:00:00 2001
+From: Thor Thayer <tthayer@opensource.altera.com>
+Date: Thu, 6 Nov 2014 13:54:27 -0600
+Subject: spi: dw: Fix dynamic speed change.
+
+From: Thor Thayer <tthayer@opensource.altera.com>
+
+commit 0a8727e69778683495058852f783eeda141a754e upstream.
+
+An IOCTL call that calls spi_setup() and then dw_spi_setup() will
+overwrite the persisted last transfer speed. On each transfer, the
+SPI speed is compared to the last transfer speed to determine if the
+clock divider registers need to be updated (did the speed change?).
+This bug was observed with the spidev driver using spi-config to
+update the max transfer speed.
+
+This fix: Don't overwrite the persisted last transaction clock speed
+when updating the SPI parameters in dw_spi_setup(). On the next
+transaction, the new speed won't match the persisted last speed
+and the hardware registers will be updated.
+On initialization, the persisted last transaction clock
+speed will be 0 but will be updated after the first SPI
+transaction.
+
+Move zeroed clock divider check into clock change test because
+chip->clk_div is zero on startup and would cause a divide-by-zero
+error. The calculation was wrong as well (can't support odd #).
+
+Reported-by: Vlastimil Setka <setka@vsis.cz>
+Signed-off-by: Vlastimil Setka <setka@vsis.cz>
+Signed-off-by: Thor Thayer <tthayer@opensource.altera.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-dw.c |    6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -394,9 +394,6 @@ static void pump_transfers(unsigned long
+       chip = dws->cur_chip;
+       spi = message->spi;
+-      if (unlikely(!chip->clk_div))
+-              chip->clk_div = dws->max_freq / chip->speed_hz;
+-
+       if (message->state == ERROR_STATE) {
+               message->status = -EIO;
+               goto early_exit;
+@@ -437,7 +434,7 @@ static void pump_transfers(unsigned long
+       if (transfer->speed_hz) {
+               speed = chip->speed_hz;
+-              if (transfer->speed_hz != speed) {
++              if ((transfer->speed_hz != speed) || (!chip->clk_div)) {
+                       speed = transfer->speed_hz;
+                       if (speed > dws->max_freq) {
+                               printk(KERN_ERR "MRST SPI0: unsupported"
+@@ -659,7 +656,6 @@ static int dw_spi_setup(struct spi_devic
+               dev_err(&spi->dev, "No max speed HZ parameter\n");
+               return -EINVAL;
+       }
+-      chip->speed_hz = spi->max_speed_hz;
+       chip->tmode = 0; /* Tx & Rx */
+       /* Default SPI mode is SCPOL = 0, SCPH = 0 */
diff --git a/queue-3.14/srp-target-retry-when-qp-creation-fails-with-enomem.patch b/queue-3.14/srp-target-retry-when-qp-creation-fails-with-enomem.patch
new file mode 100644 (file)
index 0000000..19d8837
--- /dev/null
@@ -0,0 +1,48 @@
+From ab477c1ff5e0a744c072404bf7db51bfe1f05b6e Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Sun, 19 Oct 2014 18:05:33 +0300
+Subject: srp-target: Retry when QP creation fails with ENOMEM
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit ab477c1ff5e0a744c072404bf7db51bfe1f05b6e upstream.
+
+It is not guaranteed to that srp_sq_size is supported
+by the HCA. So if we failed to create the QP with ENOMEM,
+try with a smaller srp_sq_size. Keep it up until we hit
+MIN_SRPT_SQ_SIZE, then fail the connection.
+
+Reported-by: Mark Lehrer <lehrer@gmail.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2091,6 +2091,7 @@ static int srpt_create_ch_ib(struct srpt
+       if (!qp_init)
+               goto out;
++retry:
+       ch->cq = ib_create_cq(sdev->device, srpt_completion, NULL, ch,
+                             ch->rq_size + srp_sq_size, 0);
+       if (IS_ERR(ch->cq)) {
+@@ -2114,6 +2115,13 @@ static int srpt_create_ch_ib(struct srpt
+       ch->qp = ib_create_qp(sdev->pd, qp_init);
+       if (IS_ERR(ch->qp)) {
+               ret = PTR_ERR(ch->qp);
++              if (ret == -ENOMEM) {
++                      srp_sq_size /= 2;
++                      if (srp_sq_size >= MIN_SRPT_SQ_SIZE) {
++                              ib_destroy_cq(ch->cq);
++                              goto retry;
++                      }
++              }
+               printk(KERN_ERR "failed to create_qp ret= %d\n", ret);
+               goto err_destroy_cq;
+       }
diff --git a/queue-3.14/target-don-t-call-tfo-write_pending-if-data_length-0.patch b/queue-3.14/target-don-t-call-tfo-write_pending-if-data_length-0.patch
new file mode 100644 (file)
index 0000000..b5cabef
--- /dev/null
@@ -0,0 +1,35 @@
+From 885e7b0e181c14e4d0ddd26c688bad2b84c1ada9 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Tue, 14 Oct 2014 14:16:24 -0700
+Subject: target: Don't call TFO->write_pending if data_length == 0
+
+From: Roland Dreier <roland@purestorage.com>
+
+commit 885e7b0e181c14e4d0ddd26c688bad2b84c1ada9 upstream.
+
+If an initiator sends a zero-length command (e.g. TEST UNIT READY) but
+sets the transfer direction in the transport layer to indicate a
+data-out phase, we still shouldn't try to transfer data.  At best it's
+a NOP, and depending on the transport, we might crash on an
+uninitialized sg list.
+
+Reported-by: Craig Watson <craig.watson@vanguard-rugged.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2230,7 +2230,7 @@ transport_generic_new_cmd(struct se_cmd
+        * and let it call back once the write buffers are ready.
+        */
+       target_add_to_state_list(cmd);
+-      if (cmd->data_direction != DMA_TO_DEVICE) {
++      if (cmd->data_direction != DMA_TO_DEVICE || cmd->data_length == 0) {
+               target_execute_cmd(cmd);
+               return 0;
+       }
diff --git a/queue-3.14/target-iser-fix-a-wrong-dereference-in-case-discovery-session-is-over-iser.patch b/queue-3.14/target-iser-fix-a-wrong-dereference-in-case-discovery-session-is-over-iser.patch
new file mode 100644 (file)
index 0000000..595588f
--- /dev/null
@@ -0,0 +1,37 @@
+From e0546fc1ba66c90cb38a5764357366267d3e58e4 Mon Sep 17 00:00:00 2001
+From: Sagi Grimberg <sagig@mellanox.com>
+Date: Tue, 10 Jun 2014 13:41:41 +0300
+Subject: Target/iser: Fix a wrong dereference in case discovery session is over iser
+
+From: Sagi Grimberg <sagig@mellanox.com>
+
+commit e0546fc1ba66c90cb38a5764357366267d3e58e4 upstream.
+
+In case the discovery session is carried over iser, we can't
+access the assumed network portal since the default portal is
+used. In this case we don't really need to allocate the fastreg
+pool, just prepare to the text pdu that will follow.
+
+Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
+Reported-by: Alex Tabachnik <alext@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -985,7 +985,8 @@ isert_put_login_tx(struct iscsi_conn *co
+       }
+       if (!login->login_failed) {
+               if (login->login_complete) {
+-                      if (isert_conn->conn_device->use_fastreg) {
++                      if (!conn->sess->sess_ops->SessionType &&
++                          isert_conn->conn_device->use_fastreg) {
+                               ret = isert_conn_create_fastreg_pool(isert_conn);
+                               if (ret) {
+                                       pr_err("Conn: %p failed to create"
diff --git a/queue-3.14/vhost-scsi-take-configfs-group-dependency-during-vhost_scsi_set_endpoint.patch b/queue-3.14/vhost-scsi-take-configfs-group-dependency-during-vhost_scsi_set_endpoint.patch
new file mode 100644 (file)
index 0000000..e3746e7
--- /dev/null
@@ -0,0 +1,88 @@
+From ab8edab132829b26dd13db6caca3c242cce35dc1 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Wed, 8 Oct 2014 06:19:20 +0000
+Subject: vhost-scsi: Take configfs group dependency during VHOST_SCSI_SET_ENDPOINT
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit ab8edab132829b26dd13db6caca3c242cce35dc1 upstream.
+
+This patch addresses a bug where individual vhost-scsi configfs endpoint
+groups can be removed from below while active exports to QEMU userspace
+still exist, resulting in an OOPs.
+
+It adds a configfs_depend_item() in vhost_scsi_set_endpoint() to obtain
+an explicit dependency on se_tpg->tpg_group in order to prevent individual
+vhost-scsi WWPN endpoints from being released via normal configfs methods
+while an QEMU ioctl reference still exists.
+
+Also, add matching configfs_undepend_item() in vhost_scsi_clear_endpoint()
+to release the dependency, once QEMU's reference to the individual group
+at /sys/kernel/config/target/vhost/$WWPN/$TPGT is released.
+
+(Fix up vhost_scsi_clear_endpoint() error path - DanC)
+
+Cc: Michael S. Tsirkin <mst@redhat.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/vhost/scsi.c |   24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -1200,6 +1200,7 @@ static int
+ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
+                       struct vhost_scsi_target *t)
+ {
++      struct se_portal_group *se_tpg;
+       struct tcm_vhost_tport *tv_tport;
+       struct tcm_vhost_tpg *tpg;
+       struct tcm_vhost_tpg **vs_tpg;
+@@ -1247,6 +1248,21 @@ vhost_scsi_set_endpoint(struct vhost_scs
+                               ret = -EEXIST;
+                               goto out;
+                       }
++                      /*
++                       * In order to ensure individual vhost-scsi configfs
++                       * groups cannot be removed while in use by vhost ioctl,
++                       * go ahead and take an explicit se_tpg->tpg_group.cg_item
++                       * dependency now.
++                       */
++                      se_tpg = &tpg->se_tpg;
++                      ret = configfs_depend_item(se_tpg->se_tpg_tfo->tf_subsys,
++                                                 &se_tpg->tpg_group.cg_item);
++                      if (ret) {
++                              pr_warn("configfs_depend_item() failed: %d\n", ret);
++                              kfree(vs_tpg);
++                              mutex_unlock(&tpg->tv_tpg_mutex);
++                              goto out;
++                      }
+                       tpg->tv_tpg_vhost_count++;
+                       tpg->vhost_scsi = vs;
+                       vs_tpg[tpg->tport_tpgt] = tpg;
+@@ -1289,6 +1305,7 @@ static int
+ vhost_scsi_clear_endpoint(struct vhost_scsi *vs,
+                         struct vhost_scsi_target *t)
+ {
++      struct se_portal_group *se_tpg;
+       struct tcm_vhost_tport *tv_tport;
+       struct tcm_vhost_tpg *tpg;
+       struct vhost_virtqueue *vq;
+@@ -1337,6 +1354,13 @@ vhost_scsi_clear_endpoint(struct vhost_s
+               vs->vs_tpg[target] = NULL;
+               match = true;
+               mutex_unlock(&tpg->tv_tpg_mutex);
++              /*
++               * Release se_tpg->tpg_group.cg_item configfs dependency now
++               * to allow vhost-scsi WWPN se_tpg->tpg_group shutdown to occur.
++               */
++              se_tpg = &tpg->se_tpg;
++              configfs_undepend_item(se_tpg->se_tpg_tfo->tf_subsys,
++                                     &se_tpg->tpg_group.cg_item);
+       }
+       if (match) {
+               for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {