From 270b2de1a4aa1bb1dcbfbb3a79cc1c93e90fa5ed Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 6 Nov 2019 08:20:21 -0500 Subject: [PATCH] fixes for 4.9 Signed-off-by: Sasha Levin --- ...-dm365-fix-mcbsp-dma_slave_map-entry.patch | 37 ++++ ...imx7s-correct-gpt-s-ipg-clock-source.patch | 64 +++++++ ...ogicpd-torpedo-som-remove-twl_keypad.patch | 40 ++++ ...ment-handler-faults-under-memory-pre.patch | 110 +++++++++++ .../asoc-rockchip-i2s-fix-rpm-imbalance.patch | 39 ++++ ...-t-generate-kcontrols-without-read-f.patch | 39 ++++ ...deinfo-lock_sem-deadlock-when-reconn.patch | 180 ++++++++++++++++++ ...ark-exception-vectors-as-char-arrays.patch | 107 +++++++++++ ...fix-memory-leak-in-unittest_data_add.patch | 37 ++++ ...fix-memory-leak-in-compact_gfp_flags.patch | 45 +++++ ...off-by-one-bugs-in-ns2_pinmux_enable.patch | 42 ++++ ...00-regulator-variable-val-in-pfuze10.patch | 45 +++++ ...-fix-timeout-in-ti_abb_wait_txdone-t.patch | 80 ++++++++ ...-dependency-warning-related-to-53c70.patch | 42 ++++ ...a-handle-rtpg-sense-code-correctly-d.patch | 79 ++++++++ ...csi-sni_53c710-fix-compilation-error.patch | 40 ++++ ...get-core-do-not-overwrite-cdb-byte-1.patch | 61 ++++++ queue-4.9/series | 17 ++ 18 files changed, 1104 insertions(+) create mode 100644 queue-4.9/arm-davinci-dm365-fix-mcbsp-dma_slave_map-entry.patch create mode 100644 queue-4.9/arm-dts-imx7s-correct-gpt-s-ipg-clock-source.patch create mode 100644 queue-4.9/arm-dts-logicpd-torpedo-som-remove-twl_keypad.patch create mode 100644 queue-4.9/arm-mm-fix-alignment-handler-faults-under-memory-pre.patch create mode 100644 queue-4.9/asoc-rockchip-i2s-fix-rpm-imbalance.patch create mode 100644 queue-4.9/asoc-wm_adsp-don-t-generate-kcontrols-without-read-f.patch create mode 100644 queue-4.9/cifs-fix-cifsinodeinfo-lock_sem-deadlock-when-reconn.patch create mode 100644 queue-4.9/mips-bmips-mark-exception-vectors-as-char-arrays.patch create mode 100644 queue-4.9/of-unittest-fix-memory-leak-in-unittest_data_add.patch create mode 100644 queue-4.9/perf-kmem-fix-memory-leak-in-compact_gfp_flags.patch create mode 100644 queue-4.9/pinctrl-ns2-fix-off-by-one-bugs-in-ns2_pinmux_enable.patch create mode 100644 queue-4.9/regulator-pfuze100-regulator-variable-val-in-pfuze10.patch create mode 100644 queue-4.9/regulator-ti-abb-fix-timeout-in-ti_abb_wait_txdone-t.patch create mode 100644 queue-4.9/scsi-fix-kconfig-dependency-warning-related-to-53c70.patch create mode 100644 queue-4.9/scsi-scsi_dh_alua-handle-rtpg-sense-code-correctly-d.patch create mode 100644 queue-4.9/scsi-sni_53c710-fix-compilation-error.patch create mode 100644 queue-4.9/scsi-target-core-do-not-overwrite-cdb-byte-1.patch create mode 100644 queue-4.9/series diff --git a/queue-4.9/arm-davinci-dm365-fix-mcbsp-dma_slave_map-entry.patch b/queue-4.9/arm-davinci-dm365-fix-mcbsp-dma_slave_map-entry.patch new file mode 100644 index 00000000000..ecc3d6459f1 --- /dev/null +++ b/queue-4.9/arm-davinci-dm365-fix-mcbsp-dma_slave_map-entry.patch @@ -0,0 +1,37 @@ +From db27f926a9334de52b16c837d71228854b475193 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 13:22:02 +0300 +Subject: ARM: davinci: dm365: Fix McBSP dma_slave_map entry + +From: Peter Ujfalusi + +[ Upstream commit 564b6bb9d42d31fc80c006658cf38940a9b99616 ] + +dm365 have only single McBSP, so the device name is without .0 + +Fixes: 0c750e1fe481d ("ARM: davinci: dm365: Add dma_slave_map to edma") +Signed-off-by: Peter Ujfalusi +Signed-off-by: Sekhar Nori +Signed-off-by: Sasha Levin +--- + arch/arm/mach-davinci/dm365.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-davinci/dm365.c b/arch/arm/mach-davinci/dm365.c +index ef3add9992631..8db549c56914d 100644 +--- a/arch/arm/mach-davinci/dm365.c ++++ b/arch/arm/mach-davinci/dm365.c +@@ -864,8 +864,8 @@ static s8 dm365_queue_priority_mapping[][2] = { + }; + + static const struct dma_slave_map dm365_edma_map[] = { +- { "davinci-mcbsp.0", "tx", EDMA_FILTER_PARAM(0, 2) }, +- { "davinci-mcbsp.0", "rx", EDMA_FILTER_PARAM(0, 3) }, ++ { "davinci-mcbsp", "tx", EDMA_FILTER_PARAM(0, 2) }, ++ { "davinci-mcbsp", "rx", EDMA_FILTER_PARAM(0, 3) }, + { "davinci_voicecodec", "tx", EDMA_FILTER_PARAM(0, 2) }, + { "davinci_voicecodec", "rx", EDMA_FILTER_PARAM(0, 3) }, + { "spi_davinci.2", "tx", EDMA_FILTER_PARAM(0, 10) }, +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-imx7s-correct-gpt-s-ipg-clock-source.patch b/queue-4.9/arm-dts-imx7s-correct-gpt-s-ipg-clock-source.patch new file mode 100644 index 00000000000..a9108b8f7f9 --- /dev/null +++ b/queue-4.9/arm-dts-imx7s-correct-gpt-s-ipg-clock-source.patch @@ -0,0 +1,64 @@ +From 85b1cab136603a6094edacbda9c44e36f1cbc26d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2019 08:43:42 +0800 +Subject: ARM: dts: imx7s: Correct GPT's ipg clock source + +From: Anson Huang + +[ Upstream commit 252b9e21bcf46b0d16f733f2e42b21fdc60addee ] + +i.MX7S/D's GPT ipg clock should be from GPT clock root and +controlled by CCM's GPT CCGR, using correct clock source for +GPT ipg clock instead of IMX7D_CLK_DUMMY. + +Fixes: 3ef79ca6bd1d ("ARM: dts: imx7d: use imx7s.dtsi as base device tree") +Signed-off-by: Anson Huang +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx7s.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi +index edc5ddeb851a7..0a7ea1a765f99 100644 +--- a/arch/arm/boot/dts/imx7s.dtsi ++++ b/arch/arm/boot/dts/imx7s.dtsi +@@ -437,7 +437,7 @@ + compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; + reg = <0x302d0000 0x10000>; + interrupts = ; +- clocks = <&clks IMX7D_CLK_DUMMY>, ++ clocks = <&clks IMX7D_GPT1_ROOT_CLK>, + <&clks IMX7D_GPT1_ROOT_CLK>; + clock-names = "ipg", "per"; + }; +@@ -446,7 +446,7 @@ + compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; + reg = <0x302e0000 0x10000>; + interrupts = ; +- clocks = <&clks IMX7D_CLK_DUMMY>, ++ clocks = <&clks IMX7D_GPT2_ROOT_CLK>, + <&clks IMX7D_GPT2_ROOT_CLK>; + clock-names = "ipg", "per"; + status = "disabled"; +@@ -456,7 +456,7 @@ + compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; + reg = <0x302f0000 0x10000>; + interrupts = ; +- clocks = <&clks IMX7D_CLK_DUMMY>, ++ clocks = <&clks IMX7D_GPT3_ROOT_CLK>, + <&clks IMX7D_GPT3_ROOT_CLK>; + clock-names = "ipg", "per"; + status = "disabled"; +@@ -466,7 +466,7 @@ + compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; + reg = <0x30300000 0x10000>; + interrupts = ; +- clocks = <&clks IMX7D_CLK_DUMMY>, ++ clocks = <&clks IMX7D_GPT4_ROOT_CLK>, + <&clks IMX7D_GPT4_ROOT_CLK>; + clock-names = "ipg", "per"; + status = "disabled"; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-logicpd-torpedo-som-remove-twl_keypad.patch b/queue-4.9/arm-dts-logicpd-torpedo-som-remove-twl_keypad.patch new file mode 100644 index 00000000000..9b1e8b81347 --- /dev/null +++ b/queue-4.9/arm-dts-logicpd-torpedo-som-remove-twl_keypad.patch @@ -0,0 +1,40 @@ +From 40389d5388bdcddff75ca4b580100f9b9841d257 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 17:58:12 -0500 +Subject: ARM: dts: logicpd-torpedo-som: Remove twl_keypad + +From: Adam Ford + +[ Upstream commit 6b512b0ee091edcb8e46218894e4c917d919d3dc ] + +The TWL4030 used on the Logit PD Torpedo SOM does not have the +keypad pins routed. This patch disables the twl_keypad driver +to remove some splat during boot: + +twl4030_keypad 48070000.i2c:twl@48:keypad: missing or malformed property linux,keymap: -22 +twl4030_keypad 48070000.i2c:twl@48:keypad: Failed to build keymap +twl4030_keypad: probe of 48070000.i2c:twl@48:keypad failed with error -22 + +Signed-off-by: Adam Ford +[tony@atomide.com: removed error time stamps] +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/logicpd-torpedo-som.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +index ceb49d15d243c..20ee7ca8c6534 100644 +--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi ++++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +@@ -266,3 +266,7 @@ + &twl_gpio { + ti,use-leds; + }; ++ ++&twl_keypad { ++ status = "disabled"; ++}; +-- +2.20.1 + diff --git a/queue-4.9/arm-mm-fix-alignment-handler-faults-under-memory-pre.patch b/queue-4.9/arm-mm-fix-alignment-handler-faults-under-memory-pre.patch new file mode 100644 index 00000000000..b9cec9909aa --- /dev/null +++ b/queue-4.9/arm-mm-fix-alignment-handler-faults-under-memory-pre.patch @@ -0,0 +1,110 @@ +From 58f237544ba0db352903bd82021e97f19a258cd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Aug 2019 17:01:58 +0100 +Subject: ARM: mm: fix alignment handler faults under memory pressure + +From: Russell King + +[ Upstream commit 67e15fa5b487adb9b78a92789eeff2d6ec8f5cee ] + +When the system has high memory pressure, the page containing the +instruction may be paged out. Using probe_kernel_address() means that +if the page is swapped out, the resulting page fault will not be +handled because page faults are disabled by this function. + +Use get_user() to read the instruction instead. + +Reported-by: Jing Xiangfeng +Fixes: b255188f90e2 ("ARM: fix scheduling while atomic warning in alignment handling code") +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/mm/alignment.c | 44 +++++++++++++++++++++++++++++++++-------- + 1 file changed, 36 insertions(+), 8 deletions(-) + +diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c +index 7d5f4c736a16b..cd18eda014c24 100644 +--- a/arch/arm/mm/alignment.c ++++ b/arch/arm/mm/alignment.c +@@ -767,6 +767,36 @@ do_alignment_t32_to_handler(unsigned long *pinstr, struct pt_regs *regs, + return NULL; + } + ++static int alignment_get_arm(struct pt_regs *regs, u32 *ip, unsigned long *inst) ++{ ++ u32 instr = 0; ++ int fault; ++ ++ if (user_mode(regs)) ++ fault = get_user(instr, ip); ++ else ++ fault = probe_kernel_address(ip, instr); ++ ++ *inst = __mem_to_opcode_arm(instr); ++ ++ return fault; ++} ++ ++static int alignment_get_thumb(struct pt_regs *regs, u16 *ip, u16 *inst) ++{ ++ u16 instr = 0; ++ int fault; ++ ++ if (user_mode(regs)) ++ fault = get_user(instr, ip); ++ else ++ fault = probe_kernel_address(ip, instr); ++ ++ *inst = __mem_to_opcode_thumb16(instr); ++ ++ return fault; ++} ++ + static int + do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) + { +@@ -774,10 +804,10 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) + unsigned long instr = 0, instrptr; + int (*handler)(unsigned long addr, unsigned long instr, struct pt_regs *regs); + unsigned int type; +- unsigned int fault; + u16 tinstr = 0; + int isize = 4; + int thumb2_32b = 0; ++ int fault; + + if (interrupts_enabled(regs)) + local_irq_enable(); +@@ -786,15 +816,14 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) + + if (thumb_mode(regs)) { + u16 *ptr = (u16 *)(instrptr & ~1); +- fault = probe_kernel_address(ptr, tinstr); +- tinstr = __mem_to_opcode_thumb16(tinstr); ++ ++ fault = alignment_get_thumb(regs, ptr, &tinstr); + if (!fault) { + if (cpu_architecture() >= CPU_ARCH_ARMv7 && + IS_T32(tinstr)) { + /* Thumb-2 32-bit */ +- u16 tinst2 = 0; +- fault = probe_kernel_address(ptr + 1, tinst2); +- tinst2 = __mem_to_opcode_thumb16(tinst2); ++ u16 tinst2; ++ fault = alignment_get_thumb(regs, ptr + 1, &tinst2); + instr = __opcode_thumb32_compose(tinstr, tinst2); + thumb2_32b = 1; + } else { +@@ -803,8 +832,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) + } + } + } else { +- fault = probe_kernel_address((void *)instrptr, instr); +- instr = __mem_to_opcode_arm(instr); ++ fault = alignment_get_arm(regs, (void *)instrptr, &instr); + } + + if (fault) { +-- +2.20.1 + diff --git a/queue-4.9/asoc-rockchip-i2s-fix-rpm-imbalance.patch b/queue-4.9/asoc-rockchip-i2s-fix-rpm-imbalance.patch new file mode 100644 index 00000000000..79385231912 --- /dev/null +++ b/queue-4.9/asoc-rockchip-i2s-fix-rpm-imbalance.patch @@ -0,0 +1,39 @@ +From aea283b061421fa002b0f07e47f2792bc96bf9f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 16:30:37 +0100 +Subject: ASoc: rockchip: i2s: Fix RPM imbalance + +From: Robin Murphy + +[ Upstream commit b1e620e7d32f5aad5353cc3cfc13ed99fea65d3a ] + +If rockchip_pcm_platform_register() fails, e.g. upon deferring to wait +for an absent DMA channel, we return without disabling RPM, which makes +subsequent re-probe attempts scream with errors about the unbalanced +enable. Don't do that. + +Fixes: ebb75c0bdba2 ("ASoC: rockchip: i2s: Adjust devm usage") +Signed-off-by: Robin Murphy +Link: https://lore.kernel.org/r/bcb12a849a05437fb18372bc7536c649b94bdf07.1570029862.git.robin.murphy@arm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/rockchip/rockchip_i2s.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c +index 08bfee447a365..94b6f9c7dd6bb 100644 +--- a/sound/soc/rockchip/rockchip_i2s.c ++++ b/sound/soc/rockchip/rockchip_i2s.c +@@ -649,7 +649,7 @@ static int rockchip_i2s_probe(struct platform_device *pdev) + ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0); + if (ret) { + dev_err(&pdev->dev, "Could not register PCM\n"); +- return ret; ++ goto err_suspend; + } + + return 0; +-- +2.20.1 + diff --git a/queue-4.9/asoc-wm_adsp-don-t-generate-kcontrols-without-read-f.patch b/queue-4.9/asoc-wm_adsp-don-t-generate-kcontrols-without-read-f.patch new file mode 100644 index 00000000000..6a1e0fe23e2 --- /dev/null +++ b/queue-4.9/asoc-wm_adsp-don-t-generate-kcontrols-without-read-f.patch @@ -0,0 +1,39 @@ +From 25052b4b823d1532b3cfd48fbee53bfa1816a7c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 09:42:40 +0100 +Subject: ASoC: wm_adsp: Don't generate kcontrols without READ flags + +From: Stuart Henderson + +[ Upstream commit 3ae7359c0e39f42a96284d6798fc669acff38140 ] + +User space always expects to be able to read ALSA controls, so ensure +no kcontrols are generated without an appropriate READ flag. In the case +of a read of such a control zeros will be returned. + +Signed-off-by: Stuart Henderson +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20191002084240.21589-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm_adsp.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index c03c9da076c2d..28eb55bc46634 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -948,8 +948,7 @@ static unsigned int wmfw_convert_flags(unsigned int in, unsigned int len) + } + + if (in) { +- if (in & WMFW_CTL_FLAG_READABLE) +- out |= rd; ++ out |= rd; + if (in & WMFW_CTL_FLAG_WRITEABLE) + out |= wr; + if (in & WMFW_CTL_FLAG_VOLATILE) +-- +2.20.1 + diff --git a/queue-4.9/cifs-fix-cifsinodeinfo-lock_sem-deadlock-when-reconn.patch b/queue-4.9/cifs-fix-cifsinodeinfo-lock_sem-deadlock-when-reconn.patch new file mode 100644 index 00000000000..a8371f8752e --- /dev/null +++ b/queue-4.9/cifs-fix-cifsinodeinfo-lock_sem-deadlock-when-reconn.patch @@ -0,0 +1,180 @@ +From 1fbeeb611124296f56ffd73000391e69018f8ed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2019 05:02:33 -0400 +Subject: cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs + +From: Dave Wysochanski + +[ Upstream commit d46b0da7a33dd8c99d969834f682267a45444ab3 ] + +There's a deadlock that is possible and can easily be seen with +a test where multiple readers open/read/close of the same file +and a disruption occurs causing reconnect. The deadlock is due +a reader thread inside cifs_strict_readv calling down_read and +obtaining lock_sem, and then after reconnect inside +cifs_reopen_file calling down_read a second time. If in +between the two down_read calls, a down_write comes from +another process, deadlock occurs. + + CPU0 CPU1 + ---- ---- +cifs_strict_readv() + down_read(&cifsi->lock_sem); + _cifsFileInfo_put + OR + cifs_new_fileinfo + down_write(&cifsi->lock_sem); +cifs_reopen_file() + down_read(&cifsi->lock_sem); + +Fix the above by changing all down_write(lock_sem) calls to +down_write_trylock(lock_sem)/msleep() loop, which in turn +makes the second down_read call benign since it will never +block behind the writer while holding lock_sem. + +Signed-off-by: Dave Wysochanski +Suggested-by: Ronnie Sahlberg +Reviewed--by: Ronnie Sahlberg +Reviewed-by: Pavel Shilovsky +Signed-off-by: Sasha Levin +--- + fs/cifs/cifsglob.h | 5 +++++ + fs/cifs/cifsproto.h | 1 + + fs/cifs/file.c | 23 +++++++++++++++-------- + fs/cifs/smb2file.c | 2 +- + 4 files changed, 22 insertions(+), 9 deletions(-) + +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 5367b684c1f74..7ae21ad420fbf 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -1178,6 +1178,11 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file); + struct cifsInodeInfo { + bool can_cache_brlcks; + struct list_head llist; /* locks helb by this inode */ ++ /* ++ * NOTE: Some code paths call down_read(lock_sem) twice, so ++ * we must always use use cifs_down_write() instead of down_write() ++ * for this semaphore to avoid deadlocks. ++ */ + struct rw_semaphore lock_sem; /* protect the fields above */ + /* BB add in lists for dirty pages i.e. write caching info for oplock */ + struct list_head openFileList; +diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h +index cd8025a249bba..cdf244df91c25 100644 +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -138,6 +138,7 @@ extern int cifs_unlock_range(struct cifsFileInfo *cfile, + struct file_lock *flock, const unsigned int xid); + extern int cifs_push_mandatory_locks(struct cifsFileInfo *cfile); + ++extern void cifs_down_write(struct rw_semaphore *sem); + extern struct cifsFileInfo *cifs_new_fileinfo(struct cifs_fid *fid, + struct file *file, + struct tcon_link *tlink, +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 3504ef015493b..1c3f262d9c4d4 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -280,6 +280,13 @@ cifs_has_mand_locks(struct cifsInodeInfo *cinode) + return has_locks; + } + ++void ++cifs_down_write(struct rw_semaphore *sem) ++{ ++ while (!down_write_trylock(sem)) ++ msleep(10); ++} ++ + struct cifsFileInfo * + cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + struct tcon_link *tlink, __u32 oplock) +@@ -305,7 +312,7 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + INIT_LIST_HEAD(&fdlocks->locks); + fdlocks->cfile = cfile; + cfile->llist = fdlocks; +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + list_add(&fdlocks->llist, &cinode->llist); + up_write(&cinode->lock_sem); + +@@ -457,7 +464,7 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler) + * Delete any outstanding lock records. We'll lose them when the file + * is closed anyway. + */ +- down_write(&cifsi->lock_sem); ++ cifs_down_write(&cifsi->lock_sem); + list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) { + list_del(&li->llist); + cifs_del_lock_waiters(li); +@@ -1011,7 +1018,7 @@ static void + cifs_lock_add(struct cifsFileInfo *cfile, struct cifsLockInfo *lock) + { + struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry)); +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + list_add_tail(&lock->llist, &cfile->llist->locks); + up_write(&cinode->lock_sem); + } +@@ -1033,7 +1040,7 @@ cifs_lock_add_if(struct cifsFileInfo *cfile, struct cifsLockInfo *lock, + + try_again: + exist = false; +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + + exist = cifs_find_lock_conflict(cfile, lock->offset, lock->length, + lock->type, &conf_lock, CIFS_LOCK_OP); +@@ -1055,7 +1062,7 @@ cifs_lock_add_if(struct cifsFileInfo *cfile, struct cifsLockInfo *lock, + (lock->blist.next == &lock->blist)); + if (!rc) + goto try_again; +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + list_del_init(&lock->blist); + } + +@@ -1108,7 +1115,7 @@ cifs_posix_lock_set(struct file *file, struct file_lock *flock) + return rc; + + try_again: +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + if (!cinode->can_cache_brlcks) { + up_write(&cinode->lock_sem); + return rc; +@@ -1312,7 +1319,7 @@ cifs_push_locks(struct cifsFileInfo *cfile) + int rc = 0; + + /* we are going to update can_cache_brlcks here - need a write access */ +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + if (!cinode->can_cache_brlcks) { + up_write(&cinode->lock_sem); + return rc; +@@ -1501,7 +1508,7 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, + if (!buf) + return -ENOMEM; + +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + for (i = 0; i < 2; i++) { + cur = buf; + num = 0; +diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c +index dee5250701deb..41f1a5dd33a53 100644 +--- a/fs/cifs/smb2file.c ++++ b/fs/cifs/smb2file.c +@@ -138,7 +138,7 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, + + cur = buf; + +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + list_for_each_entry_safe(li, tmp, &cfile->llist->locks, llist) { + if (flock->fl_start > li->offset || + (flock->fl_start + length) < +-- +2.20.1 + diff --git a/queue-4.9/mips-bmips-mark-exception-vectors-as-char-arrays.patch b/queue-4.9/mips-bmips-mark-exception-vectors-as-char-arrays.patch new file mode 100644 index 00000000000..67e8bffc3b7 --- /dev/null +++ b/queue-4.9/mips-bmips-mark-exception-vectors-as-char-arrays.patch @@ -0,0 +1,107 @@ +From 695235aaa1deedee0b2c79c6462297ff633074b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2019 21:11:00 +0200 +Subject: MIPS: bmips: mark exception vectors as char arrays + +From: Jonas Gorski + +[ Upstream commit e4f5cb1a9b27c0f94ef4f5a0178a3fde2d3d0e9e ] + +The vectors span more than one byte, so mark them as arrays. + +Fixes the following build error when building when using GCC 8.3: + +In file included from ./include/linux/string.h:19, + from ./include/linux/bitmap.h:9, + from ./include/linux/cpumask.h:12, + from ./arch/mips/include/asm/processor.h:15, + from ./arch/mips/include/asm/thread_info.h:16, + from ./include/linux/thread_info.h:38, + from ./include/asm-generic/preempt.h:5, + from ./arch/mips/include/generated/asm/preempt.h:1, + from ./include/linux/preempt.h:81, + from ./include/linux/spinlock.h:51, + from ./include/linux/mmzone.h:8, + from ./include/linux/bootmem.h:8, + from arch/mips/bcm63xx/prom.c:10: +arch/mips/bcm63xx/prom.c: In function 'prom_init': +./arch/mips/include/asm/string.h:162:11: error: '__builtin_memcpy' forming offset [2, 32] is out of the bounds [0, 1] of object 'bmips_smp_movevec' with type 'char' [-Werror=array-bounds] + __ret = __builtin_memcpy((dst), (src), __len); \ + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +arch/mips/bcm63xx/prom.c:97:3: note: in expansion of macro 'memcpy' + memcpy((void *)0xa0000200, &bmips_smp_movevec, 0x20); + ^~~~~~ +In file included from arch/mips/bcm63xx/prom.c:14: +./arch/mips/include/asm/bmips.h:80:13: note: 'bmips_smp_movevec' declared here + extern char bmips_smp_movevec; + +Fixes: 18a1eef92dcd ("MIPS: BMIPS: Introduce bmips.h") +Signed-off-by: Jonas Gorski +Reviewed-by: Florian Fainelli +Signed-off-by: Paul Burton +Cc: linux-mips@vger.kernel.org +Cc: Ralf Baechle +Cc: James Hogan +Signed-off-by: Sasha Levin +--- + arch/mips/bcm63xx/prom.c | 2 +- + arch/mips/include/asm/bmips.h | 10 +++++----- + arch/mips/kernel/smp-bmips.c | 8 ++++---- + 3 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/mips/bcm63xx/prom.c b/arch/mips/bcm63xx/prom.c +index 7019e2967009e..bbbf8057565b2 100644 +--- a/arch/mips/bcm63xx/prom.c ++++ b/arch/mips/bcm63xx/prom.c +@@ -84,7 +84,7 @@ void __init prom_init(void) + * Here we will start up CPU1 in the background and ask it to + * reconfigure itself then go back to sleep. + */ +- memcpy((void *)0xa0000200, &bmips_smp_movevec, 0x20); ++ memcpy((void *)0xa0000200, bmips_smp_movevec, 0x20); + __sync(); + set_c0_cause(C_SW0); + cpumask_set_cpu(1, &bmips_booted_mask); +diff --git a/arch/mips/include/asm/bmips.h b/arch/mips/include/asm/bmips.h +index a92aee7b977ac..23f55af7d6bad 100644 +--- a/arch/mips/include/asm/bmips.h ++++ b/arch/mips/include/asm/bmips.h +@@ -75,11 +75,11 @@ static inline int register_bmips_smp_ops(void) + #endif + } + +-extern char bmips_reset_nmi_vec; +-extern char bmips_reset_nmi_vec_end; +-extern char bmips_smp_movevec; +-extern char bmips_smp_int_vec; +-extern char bmips_smp_int_vec_end; ++extern char bmips_reset_nmi_vec[]; ++extern char bmips_reset_nmi_vec_end[]; ++extern char bmips_smp_movevec[]; ++extern char bmips_smp_int_vec[]; ++extern char bmips_smp_int_vec_end[]; + + extern int bmips_smp_enabled; + extern int bmips_cpu_offset; +diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c +index d4a293b68249b..416d53f587e7c 100644 +--- a/arch/mips/kernel/smp-bmips.c ++++ b/arch/mips/kernel/smp-bmips.c +@@ -453,10 +453,10 @@ static void bmips_wr_vec(unsigned long dst, char *start, char *end) + + static inline void bmips_nmi_handler_setup(void) + { +- bmips_wr_vec(BMIPS_NMI_RESET_VEC, &bmips_reset_nmi_vec, +- &bmips_reset_nmi_vec_end); +- bmips_wr_vec(BMIPS_WARM_RESTART_VEC, &bmips_smp_int_vec, +- &bmips_smp_int_vec_end); ++ bmips_wr_vec(BMIPS_NMI_RESET_VEC, bmips_reset_nmi_vec, ++ bmips_reset_nmi_vec_end); ++ bmips_wr_vec(BMIPS_WARM_RESTART_VEC, bmips_smp_int_vec, ++ bmips_smp_int_vec_end); + } + + struct reset_vec_info { +-- +2.20.1 + diff --git a/queue-4.9/of-unittest-fix-memory-leak-in-unittest_data_add.patch b/queue-4.9/of-unittest-fix-memory-leak-in-unittest_data_add.patch new file mode 100644 index 00000000000..3288d329d2d --- /dev/null +++ b/queue-4.9/of-unittest-fix-memory-leak-in-unittest_data_add.patch @@ -0,0 +1,37 @@ +From 14c92c5d5a2d810ddb0fce155f38e4efe519f634 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Oct 2019 13:58:43 -0500 +Subject: of: unittest: fix memory leak in unittest_data_add + +From: Navid Emamdoost + +[ Upstream commit e13de8fe0d6a51341671bbe384826d527afe8d44 ] + +In unittest_data_add, a copy buffer is created via kmemdup. This buffer +is leaked if of_fdt_unflatten_tree fails. The release for the +unittest_data buffer is added. + +Fixes: b951f9dc7f25 ("Enabling OF selftest to run without machine's devicetree") +Signed-off-by: Navid Emamdoost +Reviewed-by: Frank Rowand +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/unittest.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 0a1ebbbd3f163..92530525e3556 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -933,6 +933,7 @@ static int __init unittest_data_add(void) + of_fdt_unflatten_tree(unittest_data, NULL, &unittest_data_node); + if (!unittest_data_node) { + pr_warn("%s: No tree to attach; not running tests\n", __func__); ++ kfree(unittest_data); + return -ENODATA; + } + of_node_set_flag(unittest_data_node, OF_DETACHED); +-- +2.20.1 + diff --git a/queue-4.9/perf-kmem-fix-memory-leak-in-compact_gfp_flags.patch b/queue-4.9/perf-kmem-fix-memory-leak-in-compact_gfp_flags.patch new file mode 100644 index 00000000000..ba0dfbbafbb --- /dev/null +++ b/queue-4.9/perf-kmem-fix-memory-leak-in-compact_gfp_flags.patch @@ -0,0 +1,45 @@ +From be50a7fd802959db638a6dc8424343e02347b4d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2019 16:38:45 +0800 +Subject: perf kmem: Fix memory leak in compact_gfp_flags() + +From: Yunfeng Ye + +[ Upstream commit 1abecfcaa7bba21c9985e0136fa49836164dd8fd ] + +The memory @orig_flags is allocated by strdup(), it is freed on the +normal path, but leak to free on the error path. + +Fix this by adding free(orig_flags) on the error path. + +Fixes: 0e11115644b3 ("perf kmem: Print gfp flags in human readable string") +Signed-off-by: Yunfeng Ye +Cc: Alexander Shishkin +Cc: Feilong Lin +Cc: Hu Shiyuan +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/f9e9f458-96f3-4a97-a1d5-9feec2420e07@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-kmem.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/perf/builtin-kmem.c b/tools/perf/builtin-kmem.c +index d426dcb18ce9a..496a4ca116671 100644 +--- a/tools/perf/builtin-kmem.c ++++ b/tools/perf/builtin-kmem.c +@@ -674,6 +674,7 @@ static char *compact_gfp_flags(char *gfp_flags) + new = realloc(new_flags, len + strlen(cpt) + 2); + if (new == NULL) { + free(new_flags); ++ free(orig_flags); + return NULL; + } + +-- +2.20.1 + diff --git a/queue-4.9/pinctrl-ns2-fix-off-by-one-bugs-in-ns2_pinmux_enable.patch b/queue-4.9/pinctrl-ns2-fix-off-by-one-bugs-in-ns2_pinmux_enable.patch new file mode 100644 index 00000000000..a3904d899ac --- /dev/null +++ b/queue-4.9/pinctrl-ns2-fix-off-by-one-bugs-in-ns2_pinmux_enable.patch @@ -0,0 +1,42 @@ +From 89b4c5280cae223d491ad420cf10e4e229075a23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2019 11:14:26 +0300 +Subject: pinctrl: ns2: Fix off by one bugs in ns2_pinmux_enable() + +From: Dan Carpenter + +[ Upstream commit 39b65fbb813089e366b376bd8acc300b6fd646dc ] + +The pinctrl->functions[] array has pinctrl->num_functions elements and +the pinctrl->groups[] array is the same way. These are set in +ns2_pinmux_probe(). So the > comparisons should be >= so that we don't +read one element beyond the end of the array. + +Fixes: b5aa1006e4a9 ("pinctrl: ns2: add pinmux driver support for Broadcom NS2 SoC") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20190926081426.GB2332@mwanda +Acked-by: Scott Branden +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/bcm/pinctrl-ns2-mux.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/bcm/pinctrl-ns2-mux.c b/drivers/pinctrl/bcm/pinctrl-ns2-mux.c +index 13a4c27741572..6adfb379ac7e6 100644 +--- a/drivers/pinctrl/bcm/pinctrl-ns2-mux.c ++++ b/drivers/pinctrl/bcm/pinctrl-ns2-mux.c +@@ -640,8 +640,8 @@ static int ns2_pinmux_enable(struct pinctrl_dev *pctrl_dev, + const struct ns2_pin_function *func; + const struct ns2_pin_group *grp; + +- if (grp_select > pinctrl->num_groups || +- func_select > pinctrl->num_functions) ++ if (grp_select >= pinctrl->num_groups || ++ func_select >= pinctrl->num_functions) + return -EINVAL; + + func = &pinctrl->functions[func_select]; +-- +2.20.1 + diff --git a/queue-4.9/regulator-pfuze100-regulator-variable-val-in-pfuze10.patch b/queue-4.9/regulator-pfuze100-regulator-variable-val-in-pfuze10.patch new file mode 100644 index 00000000000..0b26b2671ae --- /dev/null +++ b/queue-4.9/regulator-pfuze100-regulator-variable-val-in-pfuze10.patch @@ -0,0 +1,45 @@ +From 381b8bf887aecf39fea5744da9351cd64ea84d0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Sep 2019 10:09:57 -0700 +Subject: regulator: pfuze100-regulator: Variable "val" in + pfuze100_regulator_probe() could be uninitialized + +From: Yizhuo + +[ Upstream commit 1252b283141f03c3dffd139292c862cae10e174d ] + +In function pfuze100_regulator_probe(), variable "val" could be +initialized if regmap_read() fails. However, "val" is used to +decide the control flow later in the if statement, which is +potentially unsafe. + +Signed-off-by: Yizhuo +Link: https://lore.kernel.org/r/20190929170957.14775-1-yzhai003@ucr.edu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/pfuze100-regulator.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c +index 86b348740fcdc..ffb1f61d2c752 100644 +--- a/drivers/regulator/pfuze100-regulator.c ++++ b/drivers/regulator/pfuze100-regulator.c +@@ -608,7 +608,13 @@ static int pfuze100_regulator_probe(struct i2c_client *client, + + /* SW2~SW4 high bit check and modify the voltage value table */ + if (i >= sw_check_start && i <= sw_check_end) { +- regmap_read(pfuze_chip->regmap, desc->vsel_reg, &val); ++ ret = regmap_read(pfuze_chip->regmap, ++ desc->vsel_reg, &val); ++ if (ret) { ++ dev_err(&client->dev, "Fails to read from the register.\n"); ++ return ret; ++ } ++ + if (val & sw_hi) { + if (pfuze_chip->chip_id == PFUZE3000) { + desc->volt_table = pfuze3000_sw2hi; +-- +2.20.1 + diff --git a/queue-4.9/regulator-ti-abb-fix-timeout-in-ti_abb_wait_txdone-t.patch b/queue-4.9/regulator-ti-abb-fix-timeout-in-ti_abb_wait_txdone-t.patch new file mode 100644 index 00000000000..ceb3b275073 --- /dev/null +++ b/queue-4.9/regulator-ti-abb-fix-timeout-in-ti_abb_wait_txdone-t.patch @@ -0,0 +1,80 @@ +From 8313c91088e287b42946663a831957cdbaea2da3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Sep 2019 17:58:48 +0800 +Subject: regulator: ti-abb: Fix timeout in + ti_abb_wait_txdone/ti_abb_clear_all_txdone + +From: Axel Lin + +[ Upstream commit f64db548799e0330897c3203680c2ee795ade518 ] + +ti_abb_wait_txdone() may return -ETIMEDOUT when ti_abb_check_txdone() +returns true in the latest iteration of the while loop because the timeout +value is abb->settling_time + 1. Similarly, ti_abb_clear_all_txdone() may +return -ETIMEDOUT when ti_abb_check_txdone() returns false in the latest +iteration of the while loop. Fix it. + +Signed-off-by: Axel Lin +Acked-by: Nishanth Menon +Link: https://lore.kernel.org/r/20190929095848.21960-1-axel.lin@ingics.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/ti-abb-regulator.c | 26 ++++++++------------------ + 1 file changed, 8 insertions(+), 18 deletions(-) + +diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c +index d2f9942987535..6d17357b3a248 100644 +--- a/drivers/regulator/ti-abb-regulator.c ++++ b/drivers/regulator/ti-abb-regulator.c +@@ -173,19 +173,14 @@ static int ti_abb_wait_txdone(struct device *dev, struct ti_abb *abb) + while (timeout++ <= abb->settling_time) { + status = ti_abb_check_txdone(abb); + if (status) +- break; ++ return 0; + + udelay(1); + } + +- if (timeout > abb->settling_time) { +- dev_warn_ratelimited(dev, +- "%s:TRANXDONE timeout(%duS) int=0x%08x\n", +- __func__, timeout, readl(abb->int_base)); +- return -ETIMEDOUT; +- } +- +- return 0; ++ dev_warn_ratelimited(dev, "%s:TRANXDONE timeout(%duS) int=0x%08x\n", ++ __func__, timeout, readl(abb->int_base)); ++ return -ETIMEDOUT; + } + + /** +@@ -205,19 +200,14 @@ static int ti_abb_clear_all_txdone(struct device *dev, const struct ti_abb *abb) + + status = ti_abb_check_txdone(abb); + if (!status) +- break; ++ return 0; + + udelay(1); + } + +- if (timeout > abb->settling_time) { +- dev_warn_ratelimited(dev, +- "%s:TRANXDONE timeout(%duS) int=0x%08x\n", +- __func__, timeout, readl(abb->int_base)); +- return -ETIMEDOUT; +- } +- +- return 0; ++ dev_warn_ratelimited(dev, "%s:TRANXDONE timeout(%duS) int=0x%08x\n", ++ __func__, timeout, readl(abb->int_base)); ++ return -ETIMEDOUT; + } + + /** +-- +2.20.1 + diff --git a/queue-4.9/scsi-fix-kconfig-dependency-warning-related-to-53c70.patch b/queue-4.9/scsi-fix-kconfig-dependency-warning-related-to-53c70.patch new file mode 100644 index 00000000000..11d28d27845 --- /dev/null +++ b/queue-4.9/scsi-fix-kconfig-dependency-warning-related-to-53c70.patch @@ -0,0 +1,42 @@ +From 43fc9eb8d8efb1143e4ba7cfba48ff080fde1cbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 17:11:28 +0200 +Subject: scsi: fix kconfig dependency warning related to 53C700_LE_ON_BE + +From: Thomas Bogendoerfer + +[ Upstream commit 8cbf0c173aa096dda526d1ccd66fc751c31da346 ] + +When building a kernel with SCSI_SNI_53C710 enabled, Kconfig warns: + +WARNING: unmet direct dependencies detected for 53C700_LE_ON_BE + Depends on [n]: SCSI_LOWLEVEL [=y] && SCSI [=y] && SCSI_LASI700 [=n] + Selected by [y]: + - SCSI_SNI_53C710 [=y] && SCSI_LOWLEVEL [=y] && SNI_RM [=y] && SCSI [=y] + +Add the missing depends SCSI_SNI_53C710 to 53C700_LE_ON_BE to fix it. + +Link: https://lore.kernel.org/r/20191009151128.32411-1-tbogendoerfer@suse.de +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig +index 17b1574920fd6..941e3f25b4a9f 100644 +--- a/drivers/scsi/Kconfig ++++ b/drivers/scsi/Kconfig +@@ -986,7 +986,7 @@ config SCSI_SNI_53C710 + + config 53C700_LE_ON_BE + bool +- depends on SCSI_LASI700 ++ depends on SCSI_LASI700 || SCSI_SNI_53C710 + default y + + config SCSI_STEX +-- +2.20.1 + diff --git a/queue-4.9/scsi-scsi_dh_alua-handle-rtpg-sense-code-correctly-d.patch b/queue-4.9/scsi-scsi_dh_alua-handle-rtpg-sense-code-correctly-d.patch new file mode 100644 index 00000000000..3149e6a272c --- /dev/null +++ b/queue-4.9/scsi-scsi_dh_alua-handle-rtpg-sense-code-correctly-d.patch @@ -0,0 +1,79 @@ +From 2049547f5d7bf602b428dcdb48a9785b27c637d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2019 15:57:01 +0200 +Subject: scsi: scsi_dh_alua: handle RTPG sense code correctly during state + transitions + +From: Hannes Reinecke + +[ Upstream commit b6ce6fb121a655aefe41dccc077141c102145a37 ] + +Some arrays are not capable of returning RTPG data during state +transitioning, but rather return an 'LUN not accessible, asymmetric access +state transition' sense code. In these cases we can set the state to +'transitioning' directly and don't need to evaluate the RTPG data (which we +won't have anyway). + +Link: https://lore.kernel.org/r/20191007135701.32389-1-hare@suse.de +Reviewed-by: Laurence Oberman +Reviewed-by: Ewan D. Milne +Reviewed-by: Bart Van Assche +Signed-off-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index 98787588247bf..60c288526355a 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -527,6 +527,7 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + unsigned int tpg_desc_tbl_off; + unsigned char orig_transition_tmo; + unsigned long flags; ++ bool transitioning_sense = false; + + if (!pg->expiry) { + unsigned long transition_tmo = ALUA_FAILOVER_TIMEOUT * HZ; +@@ -571,13 +572,19 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + goto retry; + } + /* +- * Retry on ALUA state transition or if any +- * UNIT ATTENTION occurred. ++ * If the array returns with 'ALUA state transition' ++ * sense code here it cannot return RTPG data during ++ * transition. So set the state to 'transitioning' directly. + */ + if (sense_hdr.sense_key == NOT_READY && +- sense_hdr.asc == 0x04 && sense_hdr.ascq == 0x0a) +- err = SCSI_DH_RETRY; +- else if (sense_hdr.sense_key == UNIT_ATTENTION) ++ sense_hdr.asc == 0x04 && sense_hdr.ascq == 0x0a) { ++ transitioning_sense = true; ++ goto skip_rtpg; ++ } ++ /* ++ * Retry on any other UNIT ATTENTION occurred. ++ */ ++ if (sense_hdr.sense_key == UNIT_ATTENTION) + err = SCSI_DH_RETRY; + if (err == SCSI_DH_RETRY && + pg->expiry != 0 && time_before(jiffies, pg->expiry)) { +@@ -665,7 +672,11 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + off = 8 + (desc[7] * 4); + } + ++ skip_rtpg: + spin_lock_irqsave(&pg->lock, flags); ++ if (transitioning_sense) ++ pg->state = SCSI_ACCESS_STATE_TRANSITIONING; ++ + sdev_printk(KERN_INFO, sdev, + "%s: port group %02x state %c %s supports %c%c%c%c%c%c%c\n", + ALUA_DH_NAME, pg->group_id, print_alua_state(pg->state), +-- +2.20.1 + diff --git a/queue-4.9/scsi-sni_53c710-fix-compilation-error.patch b/queue-4.9/scsi-sni_53c710-fix-compilation-error.patch new file mode 100644 index 00000000000..88ad74fb047 --- /dev/null +++ b/queue-4.9/scsi-sni_53c710-fix-compilation-error.patch @@ -0,0 +1,40 @@ +From 15b173deb30c43de25dbea2cc3f4f235ef0dc38c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 17:11:18 +0200 +Subject: scsi: sni_53c710: fix compilation error + +From: Thomas Bogendoerfer + +[ Upstream commit 0ee6211408a8e939428f662833c7301394125b80 ] + +Drop out memory dev_printk() with wrong device pointer argument. + +[mkp: typo] + +Link: https://lore.kernel.org/r/20191009151118.32350-1-tbogendoerfer@suse.de +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sni_53c710.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c +index 76278072147e2..b0f5220ae23a8 100644 +--- a/drivers/scsi/sni_53c710.c ++++ b/drivers/scsi/sni_53c710.c +@@ -78,10 +78,8 @@ static int snirm710_probe(struct platform_device *dev) + + base = res->start; + hostdata = kzalloc(sizeof(*hostdata), GFP_KERNEL); +- if (!hostdata) { +- dev_printk(KERN_ERR, dev, "Failed to allocate host data\n"); ++ if (!hostdata) + return -ENOMEM; +- } + + hostdata->dev = &dev->dev; + dma_set_mask(&dev->dev, DMA_BIT_MASK(32)); +-- +2.20.1 + diff --git a/queue-4.9/scsi-target-core-do-not-overwrite-cdb-byte-1.patch b/queue-4.9/scsi-target-core-do-not-overwrite-cdb-byte-1.patch new file mode 100644 index 00000000000..ba41f6f1500 --- /dev/null +++ b/queue-4.9/scsi-target-core-do-not-overwrite-cdb-byte-1.patch @@ -0,0 +1,61 @@ +From 6f7c84e85d506df3756296c37436a5d19adda34b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2019 20:29:04 +0200 +Subject: scsi: target: core: Do not overwrite CDB byte 1 + +From: Bodo Stroesser + +[ Upstream commit 27e84243cb63601a10e366afe3e2d05bb03c1cb5 ] + +passthrough_parse_cdb() - used by TCMU and PSCSI - attepts to reset the LUN +field of SCSI-2 CDBs (bits 5,6,7 of byte 1). The current code is wrong as +for newer commands not having the LUN field it overwrites relevant command +bits (e.g. for SECURITY PROTOCOL IN / OUT). We think this code was +unnecessary from the beginning or at least it is no longer useful. So we +remove it entirely. + +Link: https://lore.kernel.org/r/12498eab-76fd-eaad-1316-c2827badb76a@ts.fujitsu.com +Signed-off-by: Bodo Stroesser +Reviewed-by: Bart Van Assche +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_device.c | 21 --------------------- + 1 file changed, 21 deletions(-) + +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index cc38a3509f78c..c3d576ed6f135 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -1046,27 +1046,6 @@ passthrough_parse_cdb(struct se_cmd *cmd, + { + unsigned char *cdb = cmd->t_task_cdb; + +- /* +- * Clear a lun set in the cdb if the initiator talking to use spoke +- * and old standards version, as we can't assume the underlying device +- * won't choke up on it. +- */ +- switch (cdb[0]) { +- case READ_10: /* SBC - RDProtect */ +- case READ_12: /* SBC - RDProtect */ +- case READ_16: /* SBC - RDProtect */ +- case SEND_DIAGNOSTIC: /* SPC - SELF-TEST Code */ +- case VERIFY: /* SBC - VRProtect */ +- case VERIFY_16: /* SBC - VRProtect */ +- case WRITE_VERIFY: /* SBC - VRProtect */ +- case WRITE_VERIFY_12: /* SBC - VRProtect */ +- case MAINTENANCE_IN: /* SPC - Parameter Data Format for SA RTPG */ +- break; +- default: +- cdb[1] &= 0x1f; /* clear logical unit number */ +- break; +- } +- + /* + * For REPORT LUNS we always need to emulate the response, for everything + * else, pass it up. +-- +2.20.1 + diff --git a/queue-4.9/series b/queue-4.9/series new file mode 100644 index 00000000000..f5a33de8fd8 --- /dev/null +++ b/queue-4.9/series @@ -0,0 +1,17 @@ +regulator-ti-abb-fix-timeout-in-ti_abb_wait_txdone-t.patch +regulator-pfuze100-regulator-variable-val-in-pfuze10.patch +asoc-wm_adsp-don-t-generate-kcontrols-without-read-f.patch +asoc-rockchip-i2s-fix-rpm-imbalance.patch +arm-dts-logicpd-torpedo-som-remove-twl_keypad.patch +pinctrl-ns2-fix-off-by-one-bugs-in-ns2_pinmux_enable.patch +arm-mm-fix-alignment-handler-faults-under-memory-pre.patch +scsi-scsi_dh_alua-handle-rtpg-sense-code-correctly-d.patch +scsi-sni_53c710-fix-compilation-error.patch +scsi-fix-kconfig-dependency-warning-related-to-53c70.patch +arm-dts-imx7s-correct-gpt-s-ipg-clock-source.patch +perf-kmem-fix-memory-leak-in-compact_gfp_flags.patch +arm-davinci-dm365-fix-mcbsp-dma_slave_map-entry.patch +scsi-target-core-do-not-overwrite-cdb-byte-1.patch +of-unittest-fix-memory-leak-in-unittest_data_add.patch +mips-bmips-mark-exception-vectors-as-char-arrays.patch +cifs-fix-cifsinodeinfo-lock_sem-deadlock-when-reconn.patch -- 2.47.2