--- /dev/null
+From c53e353def15a2b057bbb48de114941753c8e43a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 20:04:17 +0800
+Subject: iommu/vt-d: Avoid memory allocation in iommu_suspend()
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+[ Upstream commit 59df44bfb0ca4c3ee1f1c3c5d0ee8e314844799e ]
+
+The iommu_suspend() syscore suspend callback is invoked with IRQ disabled.
+Allocating memory with the GFP_KERNEL flag may re-enable IRQs during
+the suspend callback, which can cause intermittent suspend/hibernation
+problems with the following kernel traces:
+
+Calling iommu_suspend+0x0/0x1d0
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 15 at kernel/time/timekeeping.c:868 ktime_get+0x9b/0xb0
+...
+CPU: 0 PID: 15 Comm: rcu_preempt Tainted: G U E 6.3-intel #r1
+RIP: 0010:ktime_get+0x9b/0xb0
+...
+Call Trace:
+ <IRQ>
+ tick_sched_timer+0x22/0x90
+ ? __pfx_tick_sched_timer+0x10/0x10
+ __hrtimer_run_queues+0x111/0x2b0
+ hrtimer_interrupt+0xfa/0x230
+ __sysvec_apic_timer_interrupt+0x63/0x140
+ sysvec_apic_timer_interrupt+0x7b/0xa0
+ </IRQ>
+ <TASK>
+ asm_sysvec_apic_timer_interrupt+0x1f/0x30
+...
+------------[ cut here ]------------
+Interrupts enabled after iommu_suspend+0x0/0x1d0
+WARNING: CPU: 0 PID: 27420 at drivers/base/syscore.c:68 syscore_suspend+0x147/0x270
+CPU: 0 PID: 27420 Comm: rtcwake Tainted: G U W E 6.3-intel #r1
+RIP: 0010:syscore_suspend+0x147/0x270
+...
+Call Trace:
+ <TASK>
+ hibernation_snapshot+0x25b/0x670
+ hibernate+0xcd/0x390
+ state_store+0xcf/0xe0
+ kobj_attr_store+0x13/0x30
+ sysfs_kf_write+0x3f/0x50
+ kernfs_fop_write_iter+0x128/0x200
+ vfs_write+0x1fd/0x3c0
+ ksys_write+0x6f/0xf0
+ __x64_sys_write+0x1d/0x30
+ do_syscall_64+0x3b/0x90
+ entry_SYSCALL_64_after_hwframe+0x72/0xdc
+
+Given that only 4 words memory is needed, avoid the memory allocation in
+iommu_suspend().
+
+CC: stable@kernel.org
+Fixes: 33e07157105e ("iommu/vt-d: Avoid GFP_ATOMIC where it is not needed")
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Tested-by: Ooi, Chin Hao <chin.hao.ooi@intel.com>
+Link: https://lore.kernel.org/r/20230921093956.234692-1-rui.zhang@intel.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20230925120417.55977-2-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.c | 16 ----------------
+ include/linux/intel-iommu.h | 2 +-
+ 2 files changed, 1 insertion(+), 17 deletions(-)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 29538471c528e..b3aa6ce9d3d7d 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -3564,13 +3564,6 @@ static int iommu_suspend(void)
+ struct intel_iommu *iommu = NULL;
+ unsigned long flag;
+
+- for_each_active_iommu(iommu, drhd) {
+- iommu->iommu_state = kcalloc(MAX_SR_DMAR_REGS, sizeof(u32),
+- GFP_KERNEL);
+- if (!iommu->iommu_state)
+- goto nomem;
+- }
+-
+ iommu_flush_all();
+
+ for_each_active_iommu(iommu, drhd) {
+@@ -3590,12 +3583,6 @@ static int iommu_suspend(void)
+ raw_spin_unlock_irqrestore(&iommu->register_lock, flag);
+ }
+ return 0;
+-
+-nomem:
+- for_each_active_iommu(iommu, drhd)
+- kfree(iommu->iommu_state);
+-
+- return -ENOMEM;
+ }
+
+ static void iommu_resume(void)
+@@ -3627,9 +3614,6 @@ static void iommu_resume(void)
+
+ raw_spin_unlock_irqrestore(&iommu->register_lock, flag);
+ }
+-
+- for_each_active_iommu(iommu, drhd)
+- kfree(iommu->iommu_state);
+ }
+
+ static struct syscore_ops iommu_syscore_ops = {
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index 0cf00786a164f..e00857c4efc28 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -604,7 +604,7 @@ struct intel_iommu {
+ struct iopf_queue *iopf_queue;
+ unsigned char iopfq_name[16];
+ struct q_inval *qi; /* Queued invalidation info */
+- u32 *iommu_state; /* Store iommu states between suspend and resume.*/
++ u32 iommu_state[MAX_SR_DMAR_REGS]; /* Store iommu states between suspend and resume.*/
+
+ #ifdef CONFIG_IRQ_REMAP
+ struct ir_table *ir_table; /* Interrupt remapping info */
+--
+2.40.1
+
--- /dev/null
+From 808e018385063b45c65b374dd88b254df5a114cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Sep 2023 11:35:39 +0200
+Subject: of: overlay: Reorder struct fragment fields kerneldoc
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 5d007ffdf6025fe83e497c44ed7c8aa8f150c4d1 ]
+
+The fields of the fragment structure were reordered, but the kerneldoc
+was not updated.
+
+Fixes: 81225ea682f45629 ("of: overlay: reorder fields in struct fragment")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/cfa36d2bb95e3c399c415dbf58057302c70ef375.1695893695.git.geert+renesas@glider.be
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/overlay.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
+index ee7f3659b353c..cea5ad907235e 100644
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -45,8 +45,8 @@ struct target {
+
+ /**
+ * struct fragment - info about fragment nodes in overlay expanded device tree
+- * @target: target of the overlay operation
+ * @overlay: pointer to the __overlay__ node
++ * @target: target of the overlay operation
+ */
+ struct fragment {
+ struct device_node *overlay;
+--
+2.40.1
+
--- /dev/null
+From b41feb81f982d1dc109bd2e75b6854efc5523825 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 11:22:32 +0800
+Subject: perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7
+
+From: Jing Zhang <renyu.zj@linux.alibaba.com>
+
+[ Upstream commit 7f949f6f54ff593123ab95b6247bfa4542a65580 ]
+
+The register por_dt_pmovsr Bits[7:0] indicates overflow from counters 7
+to 0. But in arm_cmn_handle_irq(), only handled the overflow status of
+Bits[3:0] which results in unhandled overflow status of counters 4 to 7.
+
+So let the overflow status of DTC counters 4 to 7 to be handled.
+
+Fixes: 0ba64770a2f2 ("perf: Add Arm CMN-600 PMU driver")
+Signed-off-by: Jing Zhang <renyu.zj@linux.alibaba.com>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/1695612152-123633-1-git-send-email-renyu.zj@linux.alibaba.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index 40945343c4cc1..e2a055ba0b7a8 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -1177,7 +1177,7 @@ static irqreturn_t arm_cmn_handle_irq(int irq, void *dev_id)
+ u64 delta;
+ int i;
+
+- for (i = 0; i < CMN_DTM_NUM_COUNTERS; i++) {
++ for (i = 0; i < CMN_DT_NUM_COUNTERS; i++) {
+ if (status & (1U << i)) {
+ ret = IRQ_HANDLED;
+ if (WARN_ON(!dtc->counters[i]))
+--
+2.40.1
+
--- /dev/null
+From 48a42607afe1b0159e2fe753a62186af305faf3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 13:16:24 +0200
+Subject: platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent
+ section mismatch warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 5b44abbc39ca15df80d0da4756078c98c831090f ]
+
+As described in the added code comment, a reference to .exit.text is ok
+for drivers registered via module_platform_driver_probe(). Make this
+explicit to prevent a section mismatch warning:
+
+ WARNING: modpost: drivers/platform/x86/hp/hp-wmi: section mismatch in reference: hp_wmi_driver+0x8 (section: .data) -> hp_wmi_bios_remove (section: .exit.text)
+
+Fixes: c165b80cfecc ("hp-wmi: fix handling of platform device")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20231004111624.2667753-1-u.kleine-koenig@pengutronix.de
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/hp/hp-wmi.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
+index 8c845d263429f..be99a78e1bb8d 100644
+--- a/drivers/platform/x86/hp/hp-wmi.c
++++ b/drivers/platform/x86/hp/hp-wmi.c
+@@ -1076,7 +1076,13 @@ static const struct dev_pm_ops hp_wmi_pm_ops = {
+ .restore = hp_wmi_resume_handler,
+ };
+
+-static struct platform_driver hp_wmi_driver = {
++/*
++ * hp_wmi_bios_remove() lives in .exit.text. For drivers registered via
++ * module_platform_driver_probe() this is ok because they cannot get unbound at
++ * runtime. So mark the driver struct with __refdata to prevent modpost
++ * triggering a section mismatch warning.
++ */
++static struct platform_driver hp_wmi_driver __refdata = {
+ .driver = {
+ .name = "hp-wmi",
+ .pm = &hp_wmi_pm_ops,
+--
+2.40.1
+
--- /dev/null
+From 223eccebc3ba7454c9b3a950ae12676728bf07f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 16:28:18 +0200
+Subject: platform/x86: think-lmi: Fix reference leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 528ab3e605cabf2f9c9bd5944d3bfe15f6e94f81 ]
+
+If a duplicate attribute is found using kset_find_obj(), a reference
+to that attribute is returned which needs to be disposed accordingly
+using kobject_put(). Move the setting name validation into a separate
+function to allow for this change without having to duplicate the
+cleanup code for this setting.
+As a side note, a very similar bug was fixed in
+commit 7295a996fdab ("platform/x86: dell-sysman: Fix reference leak"),
+so it seems that the bug was copied from that driver.
+
+Compile-tested only.
+
+Fixes: 1bcad8e510b2 ("platform/x86: think-lmi: Fix issues with duplicate attributes")
+Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20230925142819.74525-2-W_Armin@gmx.de
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/think-lmi.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
+index 76f0d04e17f30..154b1b26d03f8 100644
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -787,6 +787,24 @@ static void tlmi_release_attr(void)
+ kset_unregister(tlmi_priv.authentication_kset);
+ }
+
++static int tlmi_validate_setting_name(struct kset *attribute_kset, char *name)
++{
++ struct kobject *duplicate;
++
++ if (!strcmp(name, "Reserved"))
++ return -EINVAL;
++
++ duplicate = kset_find_obj(attribute_kset, name);
++ if (duplicate) {
++ pr_debug("Duplicate attribute name found - %s\n", name);
++ /* kset_find_obj() returns a reference */
++ kobject_put(duplicate);
++ return -EBUSY;
++ }
++
++ return 0;
++}
++
+ static int tlmi_sysfs_init(void)
+ {
+ int i, ret;
+@@ -815,10 +833,8 @@ static int tlmi_sysfs_init(void)
+ continue;
+
+ /* check for duplicate or reserved values */
+- if (kset_find_obj(tlmi_priv.attribute_kset, tlmi_priv.setting[i]->display_name) ||
+- !strcmp(tlmi_priv.setting[i]->display_name, "Reserved")) {
+- pr_debug("duplicate or reserved attribute name found - %s\n",
+- tlmi_priv.setting[i]->display_name);
++ if (tlmi_validate_setting_name(tlmi_priv.attribute_kset,
++ tlmi_priv.setting[i]->display_name) < 0) {
+ kfree(tlmi_priv.setting[i]->possible_values);
+ kfree(tlmi_priv.setting[i]);
+ tlmi_priv.setting[i] = NULL;
+--
+2.40.1
+
--- /dev/null
+From faa3b9080ccc7e516ba151664cb007666f2fdd85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Sep 2023 15:40:48 +0300
+Subject: RDMA/cxgb4: Check skb value for failure to allocate
+
+From: Artem Chernyshev <artem.chernyshev@red-soft.ru>
+
+[ Upstream commit 8fb8a82086f5bda6893ea6557c5a458e4549c6d7 ]
+
+get_skb() can fail to allocate skb, so check it.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 5be78ee924ae ("RDMA/cxgb4: Fix LE hash collision bug for active open connection")
+Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
+Link: https://lore.kernel.org/r/20230905124048.284165-1-artem.chernyshev@red-soft.ru
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index a3e4913904b75..f159cbb6bb3ea 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -1965,6 +1965,9 @@ static int send_fw_act_open_req(struct c4iw_ep *ep, unsigned int atid)
+ int win;
+
+ skb = get_skb(NULL, sizeof(*req), GFP_KERNEL);
++ if (!skb)
++ return -ENOMEM;
++
+ req = __skb_put_zero(skb, sizeof(*req));
+ req->op_compl = htonl(WR_OP_V(FW_OFLD_CONNECTION_WR));
+ req->len16_pkd = htonl(FW_WR_LEN16_V(DIV_ROUND_UP(sizeof(*req), 16)));
+--
+2.40.1
+
--- /dev/null
+From 75d15d19c2572b5d7c633452ec3f135df37e8259 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Aug 2023 13:57:27 -0700
+Subject: RDMA/srp: Do not call scsi_done() from srp_abort()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit e193b7955dfad68035b983a0011f4ef3590c85eb ]
+
+After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler
+callback, it performs one of the following actions:
+* Call scsi_queue_insert().
+* Call scsi_finish_command().
+* Call scsi_eh_scmd_add().
+Hence, SCSI abort handlers must not call scsi_done(). Otherwise all
+the above actions would trigger a use-after-free. Hence remove the
+scsi_done() call from srp_abort(). Keep the srp_free_req() call
+before returning SUCCESS because we may not see the command again if
+SUCCESS is returned.
+
+Cc: Bob Pearson <rpearsonhpe@gmail.com>
+Cc: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Fixes: d8536670916a ("IB/srp: Avoid having aborted requests hang")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20230823205727.505681-1-bvanassche@acm.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index df7c740e26338..2938d7040f907 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2783,7 +2783,6 @@ static int srp_abort(struct scsi_cmnd *scmnd)
+ u32 tag;
+ u16 ch_idx;
+ struct srp_rdma_ch *ch;
+- int ret;
+
+ shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
+
+@@ -2797,19 +2796,14 @@ static int srp_abort(struct scsi_cmnd *scmnd)
+ shost_printk(KERN_ERR, target->scsi_host,
+ "Sending SRP abort for tag %#x\n", tag);
+ if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun,
+- SRP_TSK_ABORT_TASK, NULL) == 0)
+- ret = SUCCESS;
+- else if (target->rport->state == SRP_RPORT_LOST)
+- ret = FAST_IO_FAIL;
+- else
+- ret = FAILED;
+- if (ret == SUCCESS) {
++ SRP_TSK_ABORT_TASK, NULL) == 0) {
+ srp_free_req(ch, req, scmnd, 0);
+- scmnd->result = DID_ABORT << 16;
+- scsi_done(scmnd);
++ return SUCCESS;
+ }
++ if (target->rport->state == SRP_RPORT_LOST)
++ return FAST_IO_FAIL;
+
+- return ret;
++ return FAILED;
+ }
+
+ static int srp_reset_device(struct scsi_cmnd *scmnd)
+--
+2.40.1
+
--- /dev/null
+From 36a1813b3160c512698fc6cc4a406859cc5c5d01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Oct 2021 13:27:57 -0700
+Subject: scsi: core: Rename scsi_mq_done() into scsi_done() and export it
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit a710eacb9d13cb5d9eb5341ebc6fc8f7b96f8c6f ]
+
+Since the removal of the legacy block layer there is only one completion
+function left in the SCSI core, namely scsi_mq_done(). Rename it into
+scsi_done(). Export that function to allow SCSI LLDs to call it directly.
+
+Link: https://lore.kernel.org/r/20211007202923.2174984-3-bvanassche@acm.org
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: e193b7955dfa ("RDMA/srp: Do not call scsi_done() from srp_abort()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_lib.c | 5 +++--
+ include/scsi/scsi_cmnd.h | 2 ++
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 7bdaa6b757cd4..3dbfd15e6fe79 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1576,7 +1576,7 @@ static blk_status_t scsi_prepare_cmd(struct request *req)
+ return scsi_cmd_to_driver(cmd)->init_command(cmd);
+ }
+
+-static void scsi_mq_done(struct scsi_cmnd *cmd)
++void scsi_done(struct scsi_cmnd *cmd)
+ {
+ switch (cmd->submitter) {
+ case SUBMITTED_BY_BLOCK_LAYER:
+@@ -1594,6 +1594,7 @@ static void scsi_mq_done(struct scsi_cmnd *cmd)
+ trace_scsi_dispatch_cmd_done(cmd);
+ blk_mq_complete_request(scsi_cmd_to_rq(cmd));
+ }
++EXPORT_SYMBOL(scsi_done);
+
+ static void scsi_mq_put_budget(struct request_queue *q, int budget_token)
+ {
+@@ -1694,7 +1695,7 @@ static blk_status_t scsi_queue_rq(struct blk_mq_hw_ctx *hctx,
+ scsi_set_resid(cmd, 0);
+ memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
+ cmd->submitter = SUBMITTED_BY_BLOCK_LAYER;
+- cmd->scsi_done = scsi_mq_done;
++ cmd->scsi_done = scsi_done;
+
+ blk_mq_start_request(req);
+ reason = scsi_dispatch_cmd(cmd);
+diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
+index 0823bad7b0c90..e1180771604d7 100644
+--- a/include/scsi/scsi_cmnd.h
++++ b/include/scsi/scsi_cmnd.h
+@@ -172,6 +172,8 @@ static inline struct scsi_driver *scsi_cmd_to_driver(struct scsi_cmnd *cmd)
+ return *(struct scsi_driver **)rq->rq_disk->private_data;
+ }
+
++void scsi_done(struct scsi_cmnd *cmd);
++
+ extern void scsi_finish_command(struct scsi_cmnd *cmd);
+
+ extern void *scsi_kmap_atomic_sg(struct scatterlist *sg, int sg_count,
+--
+2.40.1
+
--- /dev/null
+From ddd5d8cbd4e1f51f73857d43cf83a8145b0a5d72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Oct 2021 13:27:56 -0700
+Subject: scsi: core: Use a structure member to track the SCSI command
+ submitter
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit bf23e619039d360d503b7282d030daf2277a5d47 ]
+
+Conditional statements are faster than indirect calls. Use a structure
+member to track the SCSI command submitter such that later patches can call
+scsi_done(scmd) instead of scmd->scsi_done(scmd).
+
+The asymmetric behavior that scsi_send_eh_cmnd() sets the submission
+context to the SCSI error handler and that it does not restore the
+submission context to the SCSI core is retained.
+
+Link: https://lore.kernel.org/r/20211007202923.2174984-2-bvanassche@acm.org
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Ming Lei <ming.lei@redhat.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: e193b7955dfa ("RDMA/srp: Do not call scsi_done() from srp_abort()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_error.c | 17 ++++++-----------
+ drivers/scsi/scsi_lib.c | 10 ++++++++++
+ drivers/scsi/scsi_priv.h | 1 +
+ include/scsi/scsi_cmnd.h | 7 +++++++
+ 4 files changed, 24 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index dd9f5778f687d..18b99240a9062 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -50,8 +50,6 @@
+
+ #include <asm/unaligned.h>
+
+-static void scsi_eh_done(struct scsi_cmnd *scmd);
+-
+ /*
+ * These should *probably* be handled by the host itself.
+ * Since it is allowed to sleep, it probably should.
+@@ -542,7 +540,8 @@ enum scsi_disposition scsi_check_sense(struct scsi_cmnd *scmd)
+ /* handler does not care. Drop down to default handling */
+ }
+
+- if (scmd->cmnd[0] == TEST_UNIT_READY && scmd->scsi_done != scsi_eh_done)
++ if (scmd->cmnd[0] == TEST_UNIT_READY &&
++ scmd->submitter != SUBMITTED_BY_SCSI_ERROR_HANDLER)
+ /*
+ * nasty: for mid-layer issued TURs, we need to return the
+ * actual sense data without any recovery attempt. For eh
+@@ -804,7 +803,7 @@ static enum scsi_disposition scsi_eh_completed_normally(struct scsi_cmnd *scmd)
+ * scsi_eh_done - Completion function for error handling.
+ * @scmd: Cmd that is done.
+ */
+-static void scsi_eh_done(struct scsi_cmnd *scmd)
++void scsi_eh_done(struct scsi_cmnd *scmd)
+ {
+ struct completion *eh_action;
+
+@@ -1104,7 +1103,7 @@ static enum scsi_disposition scsi_send_eh_cmnd(struct scsi_cmnd *scmd,
+ shost->eh_action = &done;
+
+ scsi_log_send(scmd);
+- scmd->scsi_done = scsi_eh_done;
++ scmd->submitter = SUBMITTED_BY_SCSI_ERROR_HANDLER;
+
+ /*
+ * Lock sdev->state_mutex to avoid that scsi_device_quiesce() can
+@@ -1131,6 +1130,7 @@ static enum scsi_disposition scsi_send_eh_cmnd(struct scsi_cmnd *scmd,
+ if (rtn) {
+ if (timeleft > stall_for) {
+ scsi_eh_restore_cmnd(scmd, &ses);
++
+ timeleft -= stall_for;
+ msleep(jiffies_to_msecs(stall_for));
+ goto retry;
+@@ -2360,11 +2360,6 @@ void scsi_report_device_reset(struct Scsi_Host *shost, int channel, int target)
+ }
+ EXPORT_SYMBOL(scsi_report_device_reset);
+
+-static void
+-scsi_reset_provider_done_command(struct scsi_cmnd *scmd)
+-{
+-}
+-
+ /**
+ * scsi_ioctl_reset: explicitly reset a host/bus/target/device
+ * @dev: scsi_device to operate on
+@@ -2401,7 +2396,7 @@ scsi_ioctl_reset(struct scsi_device *dev, int __user *arg)
+ scsi_init_command(dev, scmd);
+ scmd->cmnd = scsi_req(rq)->cmd;
+
+- scmd->scsi_done = scsi_reset_provider_done_command;
++ scmd->submitter = SUBMITTED_BY_SCSI_RESET_IOCTL;
+ memset(&scmd->sdb, 0, sizeof(scmd->sdb));
+
+ scmd->cmd_len = 0;
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 5525e6ffee537..7bdaa6b757cd4 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1578,6 +1578,15 @@ static blk_status_t scsi_prepare_cmd(struct request *req)
+
+ static void scsi_mq_done(struct scsi_cmnd *cmd)
+ {
++ switch (cmd->submitter) {
++ case SUBMITTED_BY_BLOCK_LAYER:
++ break;
++ case SUBMITTED_BY_SCSI_ERROR_HANDLER:
++ return scsi_eh_done(cmd);
++ case SUBMITTED_BY_SCSI_RESET_IOCTL:
++ return;
++ }
++
+ if (unlikely(blk_should_fake_timeout(scsi_cmd_to_rq(cmd)->q)))
+ return;
+ if (unlikely(test_and_set_bit(SCMD_STATE_COMPLETE, &cmd->state)))
+@@ -1684,6 +1693,7 @@ static blk_status_t scsi_queue_rq(struct blk_mq_hw_ctx *hctx,
+
+ scsi_set_resid(cmd, 0);
+ memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
++ cmd->submitter = SUBMITTED_BY_BLOCK_LAYER;
+ cmd->scsi_done = scsi_mq_done;
+
+ blk_mq_start_request(req);
+diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
+index 6d9152031a403..b7f9631493522 100644
+--- a/drivers/scsi/scsi_priv.h
++++ b/drivers/scsi/scsi_priv.h
+@@ -84,6 +84,7 @@ void scsi_eh_ready_devs(struct Scsi_Host *shost,
+ int scsi_eh_get_sense(struct list_head *work_q,
+ struct list_head *done_q);
+ int scsi_noretry_cmd(struct scsi_cmnd *scmd);
++void scsi_eh_done(struct scsi_cmnd *scmd);
+
+ /* scsi_lib.c */
+ extern int scsi_maybe_unblock_host(struct scsi_device *sdev);
+diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
+index 685249233f2fe..0823bad7b0c90 100644
+--- a/include/scsi/scsi_cmnd.h
++++ b/include/scsi/scsi_cmnd.h
+@@ -65,6 +65,12 @@ struct scsi_pointer {
+ #define SCMD_STATE_COMPLETE 0
+ #define SCMD_STATE_INFLIGHT 1
+
++enum scsi_cmnd_submitter {
++ SUBMITTED_BY_BLOCK_LAYER = 0,
++ SUBMITTED_BY_SCSI_ERROR_HANDLER = 1,
++ SUBMITTED_BY_SCSI_RESET_IOCTL = 2,
++} __packed;
++
+ struct scsi_cmnd {
+ struct scsi_request req;
+ struct scsi_device *device;
+@@ -90,6 +96,7 @@ struct scsi_cmnd {
+ unsigned char prot_op;
+ unsigned char prot_type;
+ unsigned char prot_flags;
++ enum scsi_cmnd_submitter submitter;
+
+ unsigned short cmd_len;
+ enum dma_data_direction sc_data_direction;
+--
+2.40.1
+
--- /dev/null
+From 27c29769a01788d0976384196b620e9bc164283f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Oct 2021 13:28:00 -0700
+Subject: scsi: ib_srp: Call scsi_done() directly
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 5f9ae9eecb15ef00d89a5884add1117a8e634e7f ]
+
+Conditional statements are faster than indirect calls. Hence call
+scsi_done() directly.
+
+Link: https://lore.kernel.org/r/20211007202923.2174984-6-bvanassche@acm.org
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: e193b7955dfa ("RDMA/srp: Do not call scsi_done() from srp_abort()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 7701204fe5423..df7c740e26338 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -1266,7 +1266,7 @@ static void srp_finish_req(struct srp_rdma_ch *ch, struct srp_request *req,
+ if (scmnd) {
+ srp_free_req(ch, req, scmnd, 0);
+ scmnd->result = result;
+- scmnd->scsi_done(scmnd);
++ scsi_done(scmnd);
+ }
+ }
+
+@@ -1984,7 +1984,7 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp)
+ srp_free_req(ch, req, scmnd,
+ be32_to_cpu(rsp->req_lim_delta));
+
+- scmnd->scsi_done(scmnd);
++ scsi_done(scmnd);
+ }
+ }
+
+@@ -2236,7 +2236,7 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
+
+ err:
+ if (scmnd->result) {
+- scmnd->scsi_done(scmnd);
++ scsi_done(scmnd);
+ ret = 0;
+ } else {
+ ret = SCSI_MLQUEUE_HOST_BUSY;
+@@ -2806,7 +2806,7 @@ static int srp_abort(struct scsi_cmnd *scmnd)
+ if (ret == SUCCESS) {
+ srp_free_req(ch, req, scmnd, 0);
+ scmnd->result = DID_ABORT << 16;
+- scmnd->scsi_done(scmnd);
++ scsi_done(scmnd);
+ }
+
+ return ret;
+--
+2.40.1
+
--- /dev/null
+iommu-vt-d-avoid-memory-allocation-in-iommu_suspend.patch
+scsi-core-use-a-structure-member-to-track-the-scsi-c.patch
+scsi-core-rename-scsi_mq_done-into-scsi_done-and-exp.patch
+scsi-ib_srp-call-scsi_done-directly.patch
+rdma-srp-do-not-call-scsi_done-from-srp_abort.patch
+rdma-cxgb4-check-skb-value-for-failure-to-allocate.patch
+perf-arm-cmn-fix-the-unhandled-overflow-status-of-co.patch
+of-overlay-reorder-struct-fragment-fields-kerneldoc.patch
+platform-x86-think-lmi-fix-reference-leak.patch
+platform-x86-hp-wmi-mark-driver-struct-with-__refdat.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
