From 28dd5bc27dc07a17230b0574e3c77cfdc95461cd Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 10 Apr 2012 11:58:21 -0700 Subject: [PATCH] 3.3-stable patches added patches: mfd-fix-section-mismatch-warning-for-da9052-spi.patch mmc-atmel-mci-correct-data-timeout-computation.patch mmc-sdhci-dove-fix-compile-error-by-including-module.h.patch mmc-sdio-use-empty-system-suspend-resume-callbacks-at-the-bus-level.patch modpost-fix-modpost-license-checking-of-vmlinux.o.patch regmap-prevent-division-by-zero-in-rbtree_show.patch sysctl-fix-write-access-to-dmesg_restrict-kptr_restrict.patch tcm_fc-add-abort-flag-for-gracefully-handling-exchange-timeout.patch tcm_fc-do-not-free-tpg-structure-during-wq-allocation-failure.patch --- ...tion-mismatch-warning-for-da9052-spi.patch | 48 ++++++++++ ...mci-correct-data-timeout-computation.patch | 40 ++++++++ ...-compile-error-by-including-module.h.patch | 33 +++++++ ...nd-resume-callbacks-at-the-bus-level.patch | 75 +++++++++++++++ ...odpost-license-checking-of-vmlinux.o.patch | 70 ++++++++++++++ ...vent-division-by-zero-in-rbtree_show.patch | 45 +++++++++ queue-3.3/series | 9 ++ ...cess-to-dmesg_restrict-kptr_restrict.patch | 69 ++++++++++++++ ...gracefully-handling-exchange-timeout.patch | 95 +++++++++++++++++++ ...ructure-during-wq-allocation-failure.patch | 58 +++++++++++ 10 files changed, 542 insertions(+) create mode 100644 queue-3.3/mfd-fix-section-mismatch-warning-for-da9052-spi.patch create mode 100644 queue-3.3/mmc-atmel-mci-correct-data-timeout-computation.patch create mode 100644 queue-3.3/mmc-sdhci-dove-fix-compile-error-by-including-module.h.patch create mode 100644 queue-3.3/mmc-sdio-use-empty-system-suspend-resume-callbacks-at-the-bus-level.patch create mode 100644 queue-3.3/modpost-fix-modpost-license-checking-of-vmlinux.o.patch create mode 100644 queue-3.3/regmap-prevent-division-by-zero-in-rbtree_show.patch create mode 100644 queue-3.3/sysctl-fix-write-access-to-dmesg_restrict-kptr_restrict.patch create mode 100644 queue-3.3/tcm_fc-add-abort-flag-for-gracefully-handling-exchange-timeout.patch create mode 100644 queue-3.3/tcm_fc-do-not-free-tpg-structure-during-wq-allocation-failure.patch diff --git a/queue-3.3/mfd-fix-section-mismatch-warning-for-da9052-spi.patch b/queue-3.3/mfd-fix-section-mismatch-warning-for-da9052-spi.patch new file mode 100644 index 00000000000..ff75d255012 --- /dev/null +++ b/queue-3.3/mfd-fix-section-mismatch-warning-for-da9052-spi.patch @@ -0,0 +1,48 @@ +From e536b62095301271d974983044a011c29fcb2ea2 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Wed, 11 Jan 2012 17:27:16 +0800 +Subject: mfd: Fix section mismatch warning for da9052-spi + +From: Axel Lin + +commit e536b62095301271d974983044a011c29fcb2ea2 upstream. + +Add __devinit annotation for da9052_spi_probe to fix below build warning: + +WARNING: drivers/built-in.o(.text+0x349b4): Section mismatch in reference from the function da9052_spi_probe() to the function .devinit.text:da9052_device_init() +The function da9052_spi_probe() references +the function __devinit da9052_device_init(). +This is often because da9052_spi_probe lacks a __devinit +annotation or the annotation of da9052_device_init is wrong. + +Also add __devexit annotation for da9052_spi_remove because we have +__devexit_p around it in the remove callback. + +Signed-off-by: Axel Lin +Signed-off-by: Samuel Ortiz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/da9052-spi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mfd/da9052-spi.c ++++ b/drivers/mfd/da9052-spi.c +@@ -21,7 +21,7 @@ + + #include + +-static int da9052_spi_probe(struct spi_device *spi) ++static int __devinit da9052_spi_probe(struct spi_device *spi) + { + int ret; + const struct spi_device_id *id = spi_get_device_id(spi); +@@ -61,7 +61,7 @@ err: + return ret; + } + +-static int da9052_spi_remove(struct spi_device *spi) ++static int __devexit da9052_spi_remove(struct spi_device *spi) + { + struct da9052 *da9052 = dev_get_drvdata(&spi->dev); + diff --git a/queue-3.3/mmc-atmel-mci-correct-data-timeout-computation.patch b/queue-3.3/mmc-atmel-mci-correct-data-timeout-computation.patch new file mode 100644 index 00000000000..d1079e403fd --- /dev/null +++ b/queue-3.3/mmc-atmel-mci-correct-data-timeout-computation.patch @@ -0,0 +1,40 @@ +From 66292ad92c6d3f2f1c137a1c826b331ca8595dfd Mon Sep 17 00:00:00 2001 +From: Ludovic Desroches +Date: Wed, 28 Mar 2012 12:28:33 +0200 +Subject: mmc: atmel-mci: correct data timeout computation + +From: Ludovic Desroches + +commit 66292ad92c6d3f2f1c137a1c826b331ca8595dfd upstream. + +The HSMCI operates at a rate of up to Master Clock divided by two. +Moreover previous calculation can cause overflows and so wrong +timeouts. + +Signed-off-by: Ludovic Desroches +Acked-by: Nicolas Ferre +Signed-off-by: Chris Ball +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/atmel-mci.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -480,7 +480,14 @@ err: + static inline unsigned int atmci_ns_to_clocks(struct atmel_mci *host, + unsigned int ns) + { +- return (ns * (host->bus_hz / 1000000) + 999) / 1000; ++ /* ++ * It is easier here to use us instead of ns for the timeout, ++ * it prevents from overflows during calculation. ++ */ ++ unsigned int us = DIV_ROUND_UP(ns, 1000); ++ ++ /* Maximum clock frequency is host->bus_hz/2 */ ++ return us * (DIV_ROUND_UP(host->bus_hz, 2000000)); + } + + static void atmci_set_timeout(struct atmel_mci *host, diff --git a/queue-3.3/mmc-sdhci-dove-fix-compile-error-by-including-module.h.patch b/queue-3.3/mmc-sdhci-dove-fix-compile-error-by-including-module.h.patch new file mode 100644 index 00000000000..f7fb6ac428d --- /dev/null +++ b/queue-3.3/mmc-sdhci-dove-fix-compile-error-by-including-module.h.patch @@ -0,0 +1,33 @@ +From 8c2fc8e413ecc2c96b696e28d4eb1bc6cee8dc84 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Alf=20H=C3=B8gemark?= +Date: Wed, 4 Apr 2012 12:27:09 -0400 +Subject: mmc: sdhci-dove: Fix compile error by including module.h +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alf Høgemark + +commit 8c2fc8e413ecc2c96b696e28d4eb1bc6cee8dc84 upstream. + +This patch fixes a compile error in drivers/mmc/host/sdhci-dove.c +by including the linux/module.h file. + +Signed-off-by: Alf Høgemark +Signed-off-by: Chris Ball +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-dove.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mmc/host/sdhci-dove.c ++++ b/drivers/mmc/host/sdhci-dove.c +@@ -20,6 +20,7 @@ + */ + + #include ++#include + #include + + #include "sdhci-pltfm.h" diff --git a/queue-3.3/mmc-sdio-use-empty-system-suspend-resume-callbacks-at-the-bus-level.patch b/queue-3.3/mmc-sdio-use-empty-system-suspend-resume-callbacks-at-the-bus-level.patch new file mode 100644 index 00000000000..fe8c6df359e --- /dev/null +++ b/queue-3.3/mmc-sdio-use-empty-system-suspend-resume-callbacks-at-the-bus-level.patch @@ -0,0 +1,75 @@ +From e841a7c69b708eeaf784fd517978006e8319b03a Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Sun, 1 Apr 2012 00:34:58 -0400 +Subject: mmc: sdio: Use empty system suspend/resume callbacks at the bus level + +From: "Rafael J. Wysocki" + +commit e841a7c69b708eeaf784fd517978006e8319b03a upstream. + +Neil Brown reports that commit 35cd133c + + PM: Run the driver callback directly if the subsystem one is not there + +breaks suspend for his libertas wifi, because SDIO has a protocol +where the suspend method can return -ENOSYS and this means "There is +no point in suspending, just turn me off". Moreover, the suspend +methods provided by SDIO drivers are not supposed to be called by +the PM core or bus-level suspend routines (which aren't presend for +SDIO). Instead, when the SDIO core gets to suspend the device's +ancestor, it calls the device driver's suspend function, catches the +ENOSYS, and turns the device off. + +The commit above breaks the SDIO core's assumption that the device +drivers' callbacks won't be executed if it doesn't provide any +bus-level callbacks. If fact, however, this assumption has never +been really satisfied, because device class or device type suspend +might very well use the driver's callback even without that commit. + +The simplest way to address this problem is to make the SDIO core +tell the PM core to ignore driver callbacks, for example by providing +no-operation suspend/resume callbacks at the bus level for it, +which is implemented by this change. + +Reported-and-tested-by: Neil Brown +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Chris Ball +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/core/sdio_bus.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/mmc/core/sdio_bus.c ++++ b/drivers/mmc/core/sdio_bus.c +@@ -192,9 +192,15 @@ static int sdio_bus_remove(struct device + return ret; + } + +-#ifdef CONFIG_PM_RUNTIME ++#ifdef CONFIG_PM ++ ++static int pm_no_operation(struct device *dev) ++{ ++ return 0; ++} + + static const struct dev_pm_ops sdio_bus_pm_ops = { ++ SET_SYSTEM_SLEEP_PM_OPS(pm_no_operation, pm_no_operation) + SET_RUNTIME_PM_OPS( + pm_generic_runtime_suspend, + pm_generic_runtime_resume, +@@ -204,11 +210,11 @@ static const struct dev_pm_ops sdio_bus_ + + #define SDIO_PM_OPS_PTR (&sdio_bus_pm_ops) + +-#else /* !CONFIG_PM_RUNTIME */ ++#else /* !CONFIG_PM */ + + #define SDIO_PM_OPS_PTR NULL + +-#endif /* !CONFIG_PM_RUNTIME */ ++#endif /* !CONFIG_PM */ + + static struct bus_type sdio_bus_type = { + .name = "sdio", diff --git a/queue-3.3/modpost-fix-modpost-license-checking-of-vmlinux.o.patch b/queue-3.3/modpost-fix-modpost-license-checking-of-vmlinux.o.patch new file mode 100644 index 00000000000..2d6b688f554 --- /dev/null +++ b/queue-3.3/modpost-fix-modpost-license-checking-of-vmlinux.o.patch @@ -0,0 +1,70 @@ +From 258f742635360175564e9470eb060ff4d4b984e7 Mon Sep 17 00:00:00 2001 +From: Frank Rowand +Date: Mon, 9 Apr 2012 17:59:03 -0700 +Subject: modpost: Fix modpost license checking of vmlinux.o + +From: Frank Rowand + +commit 258f742635360175564e9470eb060ff4d4b984e7 upstream. + +Commit f02e8a6596b7 ("module: Sort exported symbols") sorts symbols +placing each of them in its own elf section. This sorting and merging +into the canonical sections are done by the linker. + +Unfortunately modpost to generate Module.symvers file parses vmlinux.o +(which is not linked yet) and all modules object files (which aren't +linked yet). These aren't sanitized by the linker yet. That breaks +modpost that can't detect license properly for modules. + +This patch makes modpost aware of the new exported symbols structure. + +[ This above is a slightly corrected version of the explanation of the + problem, copied from commit 62a2635610db ("modpost: Fix modpost's + license checking V3"). That commit fixed the problem for module + object files, but not for vmlinux.o. This patch fixes modpost for + vmlinux.o. ] + +Signed-off-by: Frank Rowand +Signed-off-by: Alessio Igor Bogani +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/mod/modpost.c | 7 +++++-- + scripts/mod/modpost.h | 1 + + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -132,8 +132,10 @@ static struct module *new_module(char *m + /* strip trailing .o */ + s = strrchr(p, '.'); + if (s != NULL) +- if (strcmp(s, ".o") == 0) ++ if (strcmp(s, ".o") == 0) { + *s = '\0'; ++ mod->is_dot_o = 1; ++ } + + /* add to list */ + mod->name = p; +@@ -587,7 +589,8 @@ static void handle_modversions(struct mo + unsigned int crc; + enum export export; + +- if (!is_vmlinux(mod->name) && strncmp(symname, "__ksymtab", 9) == 0) ++ if ((!is_vmlinux(mod->name) || mod->is_dot_o) && ++ strncmp(symname, "__ksymtab", 9) == 0) + export = export_from_secname(info, get_secindex(info, sym)); + else + export = export_from_sec(info, get_secindex(info, sym)); +--- a/scripts/mod/modpost.h ++++ b/scripts/mod/modpost.h +@@ -113,6 +113,7 @@ struct module { + int has_cleanup; + struct buffer dev_table_buf; + char srcversion[25]; ++ int is_dot_o; + }; + + struct elf_info { diff --git a/queue-3.3/regmap-prevent-division-by-zero-in-rbtree_show.patch b/queue-3.3/regmap-prevent-division-by-zero-in-rbtree_show.patch new file mode 100644 index 00000000000..acb53b119c5 --- /dev/null +++ b/queue-3.3/regmap-prevent-division-by-zero-in-rbtree_show.patch @@ -0,0 +1,45 @@ +From c04c1b9ee8f30c7a3a25e20e406247003f634ebe Mon Sep 17 00:00:00 2001 +From: Stephen Warren +Date: Wed, 4 Apr 2012 15:48:33 -0600 +Subject: regmap: prevent division by zero in rbtree_show + +From: Stephen Warren + +commit c04c1b9ee8f30c7a3a25e20e406247003f634ebe upstream. + +If there are no nodes in the cache, nodes will be 0, so calculating +"registers / nodes" will cause division by zero. + +Signed-off-by: Stephen Warren +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/regmap/regcache-rbtree.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/base/regmap/regcache-rbtree.c ++++ b/drivers/base/regmap/regcache-rbtree.c +@@ -137,6 +137,7 @@ static int rbtree_show(struct seq_file * + unsigned int base, top; + int nodes = 0; + int registers = 0; ++ int average; + + mutex_lock(&map->lock); + +@@ -151,8 +152,13 @@ static int rbtree_show(struct seq_file * + registers += top - base + 1; + } + ++ if (nodes) ++ average = registers / nodes; ++ else ++ average = 0; ++ + seq_printf(s, "%d nodes, %d registers, average %d registers\n", +- nodes, registers, registers / nodes); ++ nodes, registers, average); + + mutex_unlock(&map->lock); + diff --git a/queue-3.3/series b/queue-3.3/series index c14fa2c4b24..a3f1ac7d99a 100644 --- a/queue-3.3/series +++ b/queue-3.3/series @@ -51,3 +51,12 @@ x86-kgdb-fix-debug_rodata-limitation-using-text_poke.patch cifs-fix-vfs-lock-usage-for-oplocked-files.patch usb-ohci-at91-fix-vbus_pin_active_low-handling.patch arm-at91-usb-host-specify-and-handle-properly-vbus_pin_active_low.patch +mmc-sdio-use-empty-system-suspend-resume-callbacks-at-the-bus-level.patch +mmc-sdhci-dove-fix-compile-error-by-including-module.h.patch +mmc-atmel-mci-correct-data-timeout-computation.patch +tcm_fc-add-abort-flag-for-gracefully-handling-exchange-timeout.patch +tcm_fc-do-not-free-tpg-structure-during-wq-allocation-failure.patch +sysctl-fix-write-access-to-dmesg_restrict-kptr_restrict.patch +regmap-prevent-division-by-zero-in-rbtree_show.patch +modpost-fix-modpost-license-checking-of-vmlinux.o.patch +mfd-fix-section-mismatch-warning-for-da9052-spi.patch diff --git a/queue-3.3/sysctl-fix-write-access-to-dmesg_restrict-kptr_restrict.patch b/queue-3.3/sysctl-fix-write-access-to-dmesg_restrict-kptr_restrict.patch new file mode 100644 index 00000000000..af5aa67ac25 --- /dev/null +++ b/queue-3.3/sysctl-fix-write-access-to-dmesg_restrict-kptr_restrict.patch @@ -0,0 +1,69 @@ +From 620f6e8e855d6d447688a5f67a4e176944a084e8 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 4 Apr 2012 11:40:19 -0700 +Subject: sysctl: fix write access to dmesg_restrict/kptr_restrict + +From: Kees Cook + +commit 620f6e8e855d6d447688a5f67a4e176944a084e8 upstream. + +Commit bfdc0b4 adds code to restrict access to dmesg_restrict, +however, it incorrectly alters kptr_restrict rather than +dmesg_restrict. + +The original patch from Richard Weinberger +(https://lkml.org/lkml/2011/3/14/362) alters dmesg_restrict as +expected, and so the patch seems to have been misapplied. + +This adds the CAP_SYS_ADMIN check to both dmesg_restrict and +kptr_restrict, since both are sensitive. + +Reported-by: Phillip Lougher +Signed-off-by: Kees Cook +Acked-by: Serge Hallyn +Acked-by: Richard Weinberger +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sysctl.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -166,7 +166,7 @@ static int proc_taint(struct ctl_table * + #endif + + #ifdef CONFIG_PRINTK +-static int proc_dmesg_restrict(struct ctl_table *table, int write, ++static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos); + #endif + +@@ -713,7 +713,7 @@ static struct ctl_table kern_table[] = { + .data = &dmesg_restrict, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec_minmax, ++ .proc_handler = proc_dointvec_minmax_sysadmin, + .extra1 = &zero, + .extra2 = &one, + }, +@@ -722,7 +722,7 @@ static struct ctl_table kern_table[] = { + .data = &kptr_restrict, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dmesg_restrict, ++ .proc_handler = proc_dointvec_minmax_sysadmin, + .extra1 = &zero, + .extra2 = &two, + }, +@@ -2431,7 +2431,7 @@ static int proc_taint(struct ctl_table * + } + + #ifdef CONFIG_PRINTK +-static int proc_dmesg_restrict(struct ctl_table *table, int write, ++static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) + { + if (write && !capable(CAP_SYS_ADMIN)) diff --git a/queue-3.3/tcm_fc-add-abort-flag-for-gracefully-handling-exchange-timeout.patch b/queue-3.3/tcm_fc-add-abort-flag-for-gracefully-handling-exchange-timeout.patch new file mode 100644 index 00000000000..5b34fb4d947 --- /dev/null +++ b/queue-3.3/tcm_fc-add-abort-flag-for-gracefully-handling-exchange-timeout.patch @@ -0,0 +1,95 @@ +From e1c4038282c7586c3544542b37872c434669d3ac Mon Sep 17 00:00:00 2001 +From: Mark Rustad +Date: Tue, 3 Apr 2012 10:24:41 -0700 +Subject: tcm_fc: Add abort flag for gracefully handling exchange timeout + +From: Mark Rustad + +commit e1c4038282c7586c3544542b37872c434669d3ac upstream. + +Add abort flag and use it to terminate processing when an exchange +is timed out or is reset. The abort flag is used in place of the +transport_generic_free_cmd function call in the reset and timeout +cases, because calling that function in that context would free +memory that was in use. The aborted flag allows the lifetime to +be managed in a more normal way, while truncating the processing. + +This change eliminates a source of memory corruption which +manifested in a variety of ugly ways. + +(nab: Drop unused struct fc_exch *ep in ft_recv_seq) + +Signed-off-by: Mark Rustad +Acked-by: Kiran Patil +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/tcm_fc/tcm_fc.h | 1 + + drivers/target/tcm_fc/tfc_cmd.c | 10 ++++++++-- + drivers/target/tcm_fc/tfc_io.c | 2 ++ + 3 files changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/target/tcm_fc/tcm_fc.h ++++ b/drivers/target/tcm_fc/tcm_fc.h +@@ -124,6 +124,7 @@ struct ft_cmd { + /* Local sense buffer */ + unsigned char ft_sense_buffer[TRANSPORT_SENSE_BUFFER]; + u32 was_ddp_setup:1; /* Set only if ddp is setup */ ++ u32 aborted:1; /* Set if aborted by reset or timeout */ + struct scatterlist *sg; /* Set only if DDP is setup */ + u32 sg_cnt; /* No. of item in scatterlist */ + }; +--- a/drivers/target/tcm_fc/tfc_cmd.c ++++ b/drivers/target/tcm_fc/tfc_cmd.c +@@ -126,6 +126,8 @@ int ft_queue_status(struct se_cmd *se_cm + struct fc_exch *ep; + size_t len; + ++ if (cmd->aborted) ++ return 0; + ft_dump_cmd(cmd, __func__); + ep = fc_seq_exch(cmd->seq); + lport = ep->lp; +@@ -192,6 +194,8 @@ int ft_write_pending(struct se_cmd *se_c + + ft_dump_cmd(cmd, __func__); + ++ if (cmd->aborted) ++ return 0; + ep = fc_seq_exch(cmd->seq); + lport = ep->lp; + fp = fc_frame_alloc(lport, sizeof(*txrdy)); +@@ -262,10 +266,10 @@ static void ft_recv_seq(struct fc_seq *s + struct ft_cmd *cmd = arg; + struct fc_frame_header *fh; + +- if (IS_ERR(fp)) { ++ if (unlikely(IS_ERR(fp))) { + /* XXX need to find cmd if queued */ + cmd->seq = NULL; +- transport_generic_free_cmd(&cmd->se_cmd, 0); ++ cmd->aborted = true; + return; + } + +@@ -447,6 +451,8 @@ int ft_queue_tm_resp(struct se_cmd *se_c + struct se_tmr_req *tmr = se_cmd->se_tmr_req; + enum fcp_resp_rsp_codes code; + ++ if (cmd->aborted) ++ return 0; + switch (tmr->response) { + case TMR_FUNCTION_COMPLETE: + code = FCP_TMF_CMPL; +--- a/drivers/target/tcm_fc/tfc_io.c ++++ b/drivers/target/tcm_fc/tfc_io.c +@@ -81,6 +81,8 @@ int ft_queue_data_in(struct se_cmd *se_c + void *from; + void *to = NULL; + ++ if (cmd->aborted) ++ return 0; + ep = fc_seq_exch(cmd->seq); + lport = ep->lp; + cmd->seq = lport->tt.seq_start_next(cmd->seq); diff --git a/queue-3.3/tcm_fc-do-not-free-tpg-structure-during-wq-allocation-failure.patch b/queue-3.3/tcm_fc-do-not-free-tpg-structure-during-wq-allocation-failure.patch new file mode 100644 index 00000000000..c9861f00763 --- /dev/null +++ b/queue-3.3/tcm_fc-do-not-free-tpg-structure-during-wq-allocation-failure.patch @@ -0,0 +1,58 @@ +From 06383f10c49f507220594a455c6491ca6f8c94ab Mon Sep 17 00:00:00 2001 +From: Mark Rustad +Date: Tue, 3 Apr 2012 10:24:52 -0700 +Subject: tcm_fc: Do not free tpg structure during wq allocation failure + +From: Mark Rustad + +commit 06383f10c49f507220594a455c6491ca6f8c94ab upstream. + +Avoid freeing a registered tpg structure if an alloc_workqueue call +fails. This fixes a bug where the failure was leaking memory associated +with se_portal_group setup during the original core_tpg_register() call. + +Signed-off-by: Mark Rustad +Acked-by: Kiran Patil +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/tcm_fc/tfc_conf.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/target/tcm_fc/tfc_conf.c ++++ b/drivers/target/tcm_fc/tfc_conf.c +@@ -300,6 +300,7 @@ static struct se_portal_group *ft_add_tp + { + struct ft_lport_acl *lacl; + struct ft_tpg *tpg; ++ struct workqueue_struct *wq; + unsigned long index; + int ret; + +@@ -321,18 +322,20 @@ static struct se_portal_group *ft_add_tp + tpg->lport_acl = lacl; + INIT_LIST_HEAD(&tpg->lun_list); + +- ret = core_tpg_register(&ft_configfs->tf_ops, wwn, &tpg->se_tpg, +- tpg, TRANSPORT_TPG_TYPE_NORMAL); +- if (ret < 0) { ++ wq = alloc_workqueue("tcm_fc", 0, 1); ++ if (!wq) { + kfree(tpg); + return NULL; + } + +- tpg->workqueue = alloc_workqueue("tcm_fc", 0, 1); +- if (!tpg->workqueue) { ++ ret = core_tpg_register(&ft_configfs->tf_ops, wwn, &tpg->se_tpg, ++ tpg, TRANSPORT_TPG_TYPE_NORMAL); ++ if (ret < 0) { ++ destroy_workqueue(wq); + kfree(tpg); + return NULL; + } ++ tpg->workqueue = wq; + + mutex_lock(&ft_lport_lock); + list_add_tail(&tpg->list, &lacl->tpg_list); -- 2.47.3