--- /dev/null
+From 27ea4ebb63ff0d36020208be867265cbf1446ebd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 09:38:07 -0500
+Subject: block: recalculate segment count for multi-segment discards correctly
+
+From: David Jeffery <djeffery@redhat.com>
+
+[ Upstream commit a958937ff166fc60d1c3a721036f6ff41bfa2821 ]
+
+When a stacked block device inserts a request into another block device
+using blk_insert_cloned_request, the request's nr_phys_segments field gets
+recalculated by a call to blk_recalc_rq_segments in
+blk_cloned_rq_check_limits. But blk_recalc_rq_segments does not know how to
+handle multi-segment discards. For disk types which can handle
+multi-segment discards like nvme, this results in discard requests which
+claim a single segment when it should report several, triggering a warning
+in nvme and causing nvme to fail the discard from the invalid state.
+
+ WARNING: CPU: 5 PID: 191 at drivers/nvme/host/core.c:700 nvme_setup_discard+0x170/0x1e0 [nvme_core]
+ ...
+ nvme_setup_cmd+0x217/0x270 [nvme_core]
+ nvme_loop_queue_rq+0x51/0x1b0 [nvme_loop]
+ __blk_mq_try_issue_directly+0xe7/0x1b0
+ blk_mq_request_issue_directly+0x41/0x70
+ ? blk_account_io_start+0x40/0x50
+ dm_mq_queue_rq+0x200/0x3e0
+ blk_mq_dispatch_rq_list+0x10a/0x7d0
+ ? __sbitmap_queue_get+0x25/0x90
+ ? elv_rb_del+0x1f/0x30
+ ? deadline_remove_request+0x55/0xb0
+ ? dd_dispatch_request+0x181/0x210
+ __blk_mq_do_dispatch_sched+0x144/0x290
+ ? bio_attempt_discard_merge+0x134/0x1f0
+ __blk_mq_sched_dispatch_requests+0x129/0x180
+ blk_mq_sched_dispatch_requests+0x30/0x60
+ __blk_mq_run_hw_queue+0x47/0xe0
+ __blk_mq_delay_run_hw_queue+0x15b/0x170
+ blk_mq_sched_insert_requests+0x68/0xe0
+ blk_mq_flush_plug_list+0xf0/0x170
+ blk_finish_plug+0x36/0x50
+ xlog_cil_committed+0x19f/0x290 [xfs]
+ xlog_cil_process_committed+0x57/0x80 [xfs]
+ xlog_state_do_callback+0x1e0/0x2a0 [xfs]
+ xlog_ioend_work+0x2f/0x80 [xfs]
+ process_one_work+0x1b6/0x350
+ worker_thread+0x53/0x3e0
+ ? process_one_work+0x350/0x350
+ kthread+0x11b/0x140
+ ? __kthread_bind_mask+0x60/0x60
+ ret_from_fork+0x22/0x30
+
+This patch fixes blk_recalc_rq_segments to be aware of devices which can
+have multi-segment discards. It calculates the correct discard segment
+count by counting the number of bio as each discard bio is considered its
+own segment.
+
+Fixes: 1e739730c5b9 ("block: optionally merge discontiguous discard bios into a single request")
+Signed-off-by: David Jeffery <djeffery@redhat.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Laurence Oberman <loberman@redhat.com>
+Link: https://lore.kernel.org/r/20210211143807.GA115624@redhat
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 97b7c2821565..7cdd56696647 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -375,6 +375,14 @@ unsigned int blk_recalc_rq_segments(struct request *rq)
+ switch (bio_op(rq->bio)) {
+ case REQ_OP_DISCARD:
+ case REQ_OP_SECURE_ERASE:
++ if (queue_max_discard_segments(rq->q) > 1) {
++ struct bio *bio = rq->bio;
++
++ for_each_bio(bio)
++ nr_phys_segs++;
++ return nr_phys_segs;
++ }
++ return 1;
+ case REQ_OP_WRITE_ZEROES:
+ return 0;
+ case REQ_OP_WRITE_SAME:
+--
+2.30.1
+
--- /dev/null
+From b29b13459f80c4d6d9f18b1edb310646f3bfa48c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 10:21:19 +0000
+Subject: io_uring: fix provide_buffers sign extension
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit d81269fecb8ce16eb07efafc9ff5520b2a31c486 ]
+
+io_provide_buffers_prep()'s "p->len * p->nbufs" to sign extension
+problems. Not a huge problem as it's only used for access_ok() and
+increases the checked length, but better to keep typing right.
+
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Fixes: efe68c1ca8f49 ("io_uring: validate the full range of provided buffers for access")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Reviewed-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/562376a39509e260d8532186a06226e56eb1f594.1616149233.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 06e9c2181995..dde290eb7dd0 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -3996,6 +3996,7 @@ static int io_remove_buffers(struct io_kiocb *req, bool force_nonblock,
+ static int io_provide_buffers_prep(struct io_kiocb *req,
+ const struct io_uring_sqe *sqe)
+ {
++ unsigned long size;
+ struct io_provide_buf *p = &req->pbuf;
+ u64 tmp;
+
+@@ -4009,7 +4010,8 @@ static int io_provide_buffers_prep(struct io_kiocb *req,
+ p->addr = READ_ONCE(sqe->addr);
+ p->len = READ_ONCE(sqe->len);
+
+- if (!access_ok(u64_to_user_ptr(p->addr), (p->len * p->nbufs)))
++ size = (unsigned long)p->len * p->nbufs;
++ if (!access_ok(u64_to_user_ptr(p->addr), size))
+ return -EFAULT;
+
+ p->bgid = READ_ONCE(sqe->buf_group);
+--
+2.30.1
+
--- /dev/null
+From 022cd63bf761f0d4173da9498369b33225f8ae16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 17:11:43 +0200
+Subject: perf auxtrace: Fix auxtrace queue conflict
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit b410ed2a8572d41c68bd9208555610e4b07d0703 ]
+
+The only requirement of an auxtrace queue is that the buffers are in
+time order. That is achieved by making separate queues for separate
+perf buffer or AUX area buffer mmaps.
+
+That generally means a separate queue per cpu for per-cpu contexts, and
+a separate queue per thread for per-task contexts.
+
+When buffers are added to a queue, perf checks that the buffer cpu and
+thread id (tid) match the queue cpu and thread id.
+
+However, generally, that need not be true, and perf will queue buffers
+correctly anyway, so the check is not needed.
+
+In addition, the check gets erroneously hit when using sample mode to
+trace multiple threads.
+
+Consequently, fix that case by removing the check.
+
+Fixes: e502789302a6 ("perf auxtrace: Add helpers for queuing AUX area tracing data")
+Reported-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Link: http://lore.kernel.org/lkml/20210308151143.18338-1-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/auxtrace.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
+index 42a85c86421d..d8ada6a3c555 100644
+--- a/tools/perf/util/auxtrace.c
++++ b/tools/perf/util/auxtrace.c
+@@ -300,10 +300,6 @@ static int auxtrace_queues__queue_buffer(struct auxtrace_queues *queues,
+ queue->set = true;
+ queue->tid = buffer->tid;
+ queue->cpu = buffer->cpu;
+- } else if (buffer->cpu != queue->cpu || buffer->tid != queue->tid) {
+- pr_err("auxtrace queue conflict: cpu %d, tid %d vs cpu %d, tid %d\n",
+- queue->cpu, queue->tid, buffer->cpu, buffer->tid);
+- return -EINVAL;
+ }
+
+ buffer->buffer_nr = queues->next_buffer_nr++;
+--
+2.30.1
+
--- /dev/null
+From 79868f4698fd02629f62c86fabcf7fbefb4074c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Mar 2021 15:49:45 -0800
+Subject: perf synthetic events: Avoid write of uninitialized memory when
+ generating PERF_RECORD_MMAP* records
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 2a76f6de07906f0bb5f2a13fb02845db1695cc29 ]
+
+Account for alignment bytes in the zero-ing memset.
+
+Fixes: 1a853e36871b533c ("perf record: Allow specifying a pid to record")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lore.kernel.org/lkml/20210309234945.419254-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/synthetic-events.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
+index d9c624377da7..b4cf6dd57dd6 100644
+--- a/tools/perf/util/synthetic-events.c
++++ b/tools/perf/util/synthetic-events.c
+@@ -384,7 +384,7 @@ int perf_event__synthesize_mmap_events(struct perf_tool *tool,
+
+ while (!io.eof) {
+ static const char anonstr[] = "//anon";
+- size_t size;
++ size_t size, aligned_size;
+
+ /* ensure null termination since stack will be reused. */
+ event->mmap2.filename[0] = '\0';
+@@ -444,11 +444,12 @@ int perf_event__synthesize_mmap_events(struct perf_tool *tool,
+ }
+
+ size = strlen(event->mmap2.filename) + 1;
+- size = PERF_ALIGN(size, sizeof(u64));
++ aligned_size = PERF_ALIGN(size, sizeof(u64));
+ event->mmap2.len -= event->mmap.start;
+ event->mmap2.header.size = (sizeof(event->mmap2) -
+- (sizeof(event->mmap2.filename) - size));
+- memset(event->mmap2.filename + size, 0, machine->id_hdr_size);
++ (sizeof(event->mmap2.filename) - aligned_size));
++ memset(event->mmap2.filename + size, 0, machine->id_hdr_size +
++ (aligned_size - size));
+ event->mmap2.header.size += machine->id_hdr_size;
+ event->mmap2.pid = tgid;
+ event->mmap2.tid = pid;
+--
+2.30.1
+
--- /dev/null
+From fa2f4920db55fbd442e6f39e8617cca122111acb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Mar 2021 19:52:41 -0800
+Subject: scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 3401ecf7fc1b9458a19d42c0e26a228f18ac7dda ]
+
+When kzalloc() returns NULL, no error return code of mpt3sas_base_attach()
+is assigned. To fix this bug, r is assigned with -ENOMEM in this case.
+
+Link: https://lore.kernel.org/r/20210308035241.3288-1-baijiaju1990@gmail.com
+Fixes: c696f7b83ede ("scsi: mpt3sas: Implement device_remove_in_progress check in IOCTL path")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index bb940cbcbb5d..ac25ec5f9738 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -7358,14 +7358,18 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc)
+ ioc->pend_os_device_add_sz++;
+ ioc->pend_os_device_add = kzalloc(ioc->pend_os_device_add_sz,
+ GFP_KERNEL);
+- if (!ioc->pend_os_device_add)
++ if (!ioc->pend_os_device_add) {
++ r = -ENOMEM;
+ goto out_free_resources;
++ }
+
+ ioc->device_remove_in_progress_sz = ioc->pend_os_device_add_sz;
+ ioc->device_remove_in_progress =
+ kzalloc(ioc->device_remove_in_progress_sz, GFP_KERNEL);
+- if (!ioc->device_remove_in_progress)
++ if (!ioc->device_remove_in_progress) {
++ r = -ENOMEM;
+ goto out_free_resources;
++ }
+
+ ioc->fwfault_debug = mpt3sas_fwfault_debug;
+
+--
+2.30.1
+
--- /dev/null
+From a14cb484f25cea4ebbdcd0076c1454a8f7899a12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Mar 2021 19:30:24 -0800
+Subject: scsi: qedi: Fix error return code of qedi_alloc_global_queues()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit f69953837ca5d98aa983a138dc0b90a411e9c763 ]
+
+When kzalloc() returns NULL to qedi->global_queues[i], no error return code
+of qedi_alloc_global_queues() is assigned. To fix this bug, status is
+assigned with -ENOMEM in this case.
+
+Link: https://lore.kernel.org/r/20210308033024.27147-1-baijiaju1990@gmail.com
+Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Acked-by: Manish Rangankar <mrangankar@marvell.com>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedi/qedi_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index 47ad64b06623..69c5b5ee2169 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -1675,6 +1675,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
+ if (!qedi->global_queues[i]) {
+ QEDI_ERR(&qedi->dbg_ctx,
+ "Unable to allocation global queue %d.\n", i);
++ status = -ENOMEM;
+ goto mem_alloc_failure;
+ }
+
+--
+2.30.1
+
--- /dev/null
+From ca033279d1440d88203daef8eb9836e1f34282e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Mar 2021 16:23:53 -0700
+Subject: scsi: Revert "qla2xxx: Make sure that aborted commands are freed"
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 39c0c8553bfb5a3d108aa47f1256076d507605e3 ]
+
+Calling vha->hw->tgt.tgt_ops->free_cmd() from qlt_xmit_response() is wrong
+since the command for which a response is sent must remain valid until the
+SCSI target core calls .release_cmd(). It has been observed that the
+following scenario triggers a kernel crash:
+
+ - qlt_xmit_response() calls qlt_check_reserve_free_req()
+
+ - qlt_check_reserve_free_req() returns -EAGAIN
+
+ - qlt_xmit_response() calls vha->hw->tgt.tgt_ops->free_cmd(cmd)
+
+ - transport_handle_queue_full() tries to retransmit the response
+
+Fix this crash by reverting the patch that introduced it.
+
+Link: https://lore.kernel.org/r/20210320232359.941-2-bvanassche@acm.org
+Fixes: 0dcec41acb85 ("scsi: qla2xxx: Make sure that aborted commands are freed")
+Cc: Quinn Tran <qutran@marvell.com>
+Cc: Mike Christie <michael.christie@oracle.com>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 13 +++++--------
+ drivers/scsi/qla2xxx/tcm_qla2xxx.c | 4 ----
+ 2 files changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index a27a625839e6..dcae8f071c35 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -3222,8 +3222,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) ||
+ (cmd->sess && cmd->sess->deleted)) {
+ cmd->state = QLA_TGT_STATE_PROCESSED;
+- res = 0;
+- goto free;
++ return 0;
+ }
+
+ ql_dbg_qp(ql_dbg_tgt, qpair, 0xe018,
+@@ -3234,8 +3233,9 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+
+ res = qlt_pre_xmit_response(cmd, &prm, xmit_type, scsi_status,
+ &full_req_cnt);
+- if (unlikely(res != 0))
+- goto free;
++ if (unlikely(res != 0)) {
++ return res;
++ }
+
+ spin_lock_irqsave(qpair->qp_lock_ptr, flags);
+
+@@ -3255,8 +3255,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ vha->flags.online, qla2x00_reset_active(vha),
+ cmd->reset_count, qpair->chip_reset);
+ spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+- res = 0;
+- goto free;
++ return 0;
+ }
+
+ /* Does F/W have an IOCBs for this request */
+@@ -3359,8 +3358,6 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ qlt_unmap_sg(vha, cmd);
+ spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+
+-free:
+- vha->hw->tgt.tgt_ops->free_cmd(cmd);
+ return res;
+ }
+ EXPORT_SYMBOL(qlt_xmit_response);
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 61017acd3458..7405fab324c8 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -646,7 +646,6 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd)
+ {
+ struct qla_tgt_cmd *cmd = container_of(se_cmd,
+ struct qla_tgt_cmd, se_cmd);
+- struct scsi_qla_host *vha = cmd->vha;
+
+ if (cmd->aborted) {
+ /* Cmd can loop during Q-full. tcm_qla2xxx_aborted_task
+@@ -659,7 +658,6 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd)
+ cmd->se_cmd.transport_state,
+ cmd->se_cmd.t_state,
+ cmd->se_cmd.se_cmd_flags);
+- vha->hw->tgt.tgt_ops->free_cmd(cmd);
+ return 0;
+ }
+
+@@ -687,7 +685,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd)
+ {
+ struct qla_tgt_cmd *cmd = container_of(se_cmd,
+ struct qla_tgt_cmd, se_cmd);
+- struct scsi_qla_host *vha = cmd->vha;
+ int xmit_type = QLA_TGT_XMIT_STATUS;
+
+ if (cmd->aborted) {
+@@ -701,7 +698,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd)
+ cmd, kref_read(&cmd->se_cmd.cmd_kref),
+ cmd->se_cmd.transport_state, cmd->se_cmd.t_state,
+ cmd->se_cmd.se_cmd_flags);
+- vha->hw->tgt.tgt_ops->free_cmd(cmd);
+ return 0;
+ }
+ cmd->bufflen = se_cmd->data_length;
+--
+2.30.1
+
revert-netfilter-x_tables-update-remaining-dereferen.patch
acpi-scan-rearrange-memory-allocation-in-acpi_device.patch
acpi-scan-use-unique-number-for-instance_no.patch
+perf-auxtrace-fix-auxtrace-queue-conflict.patch
+perf-synthetic-events-avoid-write-of-uninitialized-m.patch
+io_uring-fix-provide_buffers-sign-extension.patch
+block-recalculate-segment-count-for-multi-segment-di.patch
+scsi-revert-qla2xxx-make-sure-that-aborted-commands-.patch
+scsi-qedi-fix-error-return-code-of-qedi_alloc_global.patch
+scsi-mpt3sas-fix-error-return-code-of-mpt3sas_base_a.patch