From b21c4e7a2ae9f8d6c01c66e95b7658b0fe9ee66f Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 25 Apr 2020 19:30:21 -0400 Subject: [PATCH] Fixes for 4.4 Signed-off-by: Sasha Levin --- ...take-the-drv-lock-mutex-before-calli.patch | 43 ++++++++++++ ...updating-wanted-caps-when-cap-is-sta.patch | 49 ++++++++++++++ ..._mdsc_do_request-errors-from-__get_p.patch | 40 +++++++++++ ...pc_find_ipc-should-increase-position.patch | 52 +++++++++++++++ ...-gcov_seq_next-should-increase-posit.patch | 48 ++++++++++++++ ...wm-bcm2835-dynamically-allocate-base.patch | 42 ++++++++++++ ...-rcar-fix-late-runtime-pm-enablement.patch | 66 +++++++++++++++++++ ...s-tpu-fix-late-runtime-pm-enablement.patch | 63 ++++++++++++++++++ ...390-cio-avoid-duplicated-add-uevents.patch | 65 ++++++++++++++++++ ...t-unbind-session-event-when-the-targ.patch | 61 +++++++++++++++++ ...san-slab-out-of-bounds-error-in-lpfc.patch | 62 +++++++++++++++++ queue-4.4/series | 11 ++++ 12 files changed, 602 insertions(+) create mode 100644 queue-4.4/asoc-intel-atom-take-the-drv-lock-mutex-before-calli.patch create mode 100644 queue-4.4/ceph-don-t-skip-updating-wanted-caps-when-cap-is-sta.patch create mode 100644 queue-4.4/ceph-return-ceph_mdsc_do_request-errors-from-__get_p.patch create mode 100644 queue-4.4/ipc-util.c-sysvipc_find_ipc-should-increase-position.patch create mode 100644 queue-4.4/kernel-gcov-fs.c-gcov_seq_next-should-increase-posit.patch create mode 100644 queue-4.4/pwm-bcm2835-dynamically-allocate-base.patch create mode 100644 queue-4.4/pwm-rcar-fix-late-runtime-pm-enablement.patch create mode 100644 queue-4.4/pwm-renesas-tpu-fix-late-runtime-pm-enablement.patch create mode 100644 queue-4.4/s390-cio-avoid-duplicated-add-uevents.patch create mode 100644 queue-4.4/scsi-iscsi-report-unbind-session-event-when-the-targ.patch create mode 100644 queue-4.4/scsi-lpfc-fix-kasan-slab-out-of-bounds-error-in-lpfc.patch diff --git a/queue-4.4/asoc-intel-atom-take-the-drv-lock-mutex-before-calli.patch b/queue-4.4/asoc-intel-atom-take-the-drv-lock-mutex-before-calli.patch new file mode 100644 index 00000000000..b3765f7e444 --- /dev/null +++ b/queue-4.4/asoc-intel-atom-take-the-drv-lock-mutex-before-calli.patch @@ -0,0 +1,43 @@ +From 1734fecea7b35bb11fd8211c7cd13223ebce75e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Apr 2020 20:53:57 +0200 +Subject: ASoC: Intel: atom: Take the drv->lock mutex before calling + sst_send_slot_map() + +From: Hans de Goede + +[ Upstream commit 81630dc042af998b9f58cd8e2c29dab9777ea176 ] + +sst_send_slot_map() uses sst_fill_and_send_cmd_unlocked() because in some +places it is called with the drv->lock mutex already held. + +So it must always be called with the mutex locked. This commit adds missing +locking in the sst_set_be_modules() code-path. + +Fixes: 24c8d14192cc ("ASoC: Intel: mrfld: add DSP core controls") +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200402185359.3424-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/atom/sst-atom-controls.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/intel/atom/sst-atom-controls.c b/sound/soc/intel/atom/sst-atom-controls.c +index b070d47547450..067cee92d333b 100644 +--- a/sound/soc/intel/atom/sst-atom-controls.c ++++ b/sound/soc/intel/atom/sst-atom-controls.c +@@ -963,7 +963,9 @@ static int sst_set_be_modules(struct snd_soc_dapm_widget *w, + dev_dbg(c->dev, "Enter: widget=%s\n", w->name); + + if (SND_SOC_DAPM_EVENT_ON(event)) { ++ mutex_lock(&drv->lock); + ret = sst_send_slot_map(drv); ++ mutex_unlock(&drv->lock); + if (ret) + return ret; + ret = sst_send_pipe_module_params(w, k); +-- +2.20.1 + diff --git a/queue-4.4/ceph-don-t-skip-updating-wanted-caps-when-cap-is-sta.patch b/queue-4.4/ceph-don-t-skip-updating-wanted-caps-when-cap-is-sta.patch new file mode 100644 index 00000000000..bb6b3ac77fa --- /dev/null +++ b/queue-4.4/ceph-don-t-skip-updating-wanted-caps-when-cap-is-sta.patch @@ -0,0 +1,49 @@ +From a8891ddf5ae8ac220594781f089d185775245bac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Mar 2020 19:34:20 +0800 +Subject: ceph: don't skip updating wanted caps when cap is stale + +From: Yan, Zheng + +[ Upstream commit 0aa971b6fd3f92afef6afe24ef78d9bb14471519 ] + +1. try_get_cap_refs() fails to get caps and finds that mds_wanted + does not include what it wants. It returns -ESTALE. +2. ceph_get_caps() calls ceph_renew_caps(). ceph_renew_caps() finds + that inode has cap, so it calls ceph_check_caps(). +3. ceph_check_caps() finds that issued caps (without checking if it's + stale) already includes caps wanted by open file, so it skips + updating wanted caps. + +Above events can cause an infinite loop inside ceph_get_caps(). + +Signed-off-by: "Yan, Zheng" +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/caps.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c +index aa4df4a022525..efdf81ea3b5f8 100644 +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -1734,8 +1734,12 @@ retry_locked: + } + + /* want more caps from mds? */ +- if (want & ~(cap->mds_wanted | cap->issued)) +- goto ack; ++ if (want & ~cap->mds_wanted) { ++ if (want & ~(cap->mds_wanted | cap->issued)) ++ goto ack; ++ if (!__cap_is_valid(cap)) ++ goto ack; ++ } + + /* things we might delay */ + if ((cap->issued & ~retain) == 0 && +-- +2.20.1 + diff --git a/queue-4.4/ceph-return-ceph_mdsc_do_request-errors-from-__get_p.patch b/queue-4.4/ceph-return-ceph_mdsc_do_request-errors-from-__get_p.patch new file mode 100644 index 00000000000..8180b12d71b --- /dev/null +++ b/queue-4.4/ceph-return-ceph_mdsc_do_request-errors-from-__get_p.patch @@ -0,0 +1,40 @@ +From a56e2b13c55d1843d6c7096bc8e8a9c143a041a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Mar 2020 09:34:20 +0800 +Subject: ceph: return ceph_mdsc_do_request() errors from __get_parent() + +From: Qiujun Huang + +[ Upstream commit c6d50296032f0b97473eb2e274dc7cc5d0173847 ] + +Return the error returned by ceph_mdsc_do_request(). Otherwise, +r_target_inode ends up being NULL this ends up returning ENOENT +regardless of the error. + +Signed-off-by: Qiujun Huang +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/export.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/ceph/export.c b/fs/ceph/export.c +index fe02ae7f056a3..ff9e60daf086b 100644 +--- a/fs/ceph/export.c ++++ b/fs/ceph/export.c +@@ -146,6 +146,11 @@ static struct dentry *__get_parent(struct super_block *sb, + } + req->r_num_caps = 1; + err = ceph_mdsc_do_request(mdsc, NULL, req); ++ if (err) { ++ ceph_mdsc_put_request(req); ++ return ERR_PTR(err); ++ } ++ + inode = req->r_target_inode; + if (inode) + ihold(inode); +-- +2.20.1 + diff --git a/queue-4.4/ipc-util.c-sysvipc_find_ipc-should-increase-position.patch b/queue-4.4/ipc-util.c-sysvipc_find_ipc-should-increase-position.patch new file mode 100644 index 00000000000..3dc76277af8 --- /dev/null +++ b/queue-4.4/ipc-util.c-sysvipc_find_ipc-should-increase-position.patch @@ -0,0 +1,52 @@ +From 7ddea8d447bbbd632025455af935f73f25b57eb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Apr 2020 14:34:13 -0700 +Subject: ipc/util.c: sysvipc_find_ipc() should increase position index + +From: Vasily Averin + +[ Upstream commit 89163f93c6f969da5811af5377cc10173583123b ] + +If seq_file .next function does not change position index, read after +some lseek can generate unexpected output. + +https://bugzilla.kernel.org/show_bug.cgi?id=206283 +Signed-off-by: Vasily Averin +Signed-off-by: Andrew Morton +Acked-by: Waiman Long +Cc: Davidlohr Bueso +Cc: Manfred Spraul +Cc: Al Viro +Cc: Ingo Molnar +Cc: NeilBrown +Cc: Peter Oberparleiter +Cc: Steven Rostedt +Link: http://lkml.kernel.org/r/b7a20945-e315-8bb0-21e6-3875c14a8494@virtuozzo.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + ipc/util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ipc/util.c b/ipc/util.c +index 0f401d94b7c65..2724f9071ab39 100644 +--- a/ipc/util.c ++++ b/ipc/util.c +@@ -756,13 +756,13 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos, + total++; + } + ++ *new_pos = pos + 1; + if (total >= ids->in_use) + return NULL; + + for (; pos < IPCMNI; pos++) { + ipc = idr_find(&ids->ipcs_idr, pos); + if (ipc != NULL) { +- *new_pos = pos + 1; + rcu_read_lock(); + ipc_lock_object(ipc); + return ipc; +-- +2.20.1 + diff --git a/queue-4.4/kernel-gcov-fs.c-gcov_seq_next-should-increase-posit.patch b/queue-4.4/kernel-gcov-fs.c-gcov_seq_next-should-increase-posit.patch new file mode 100644 index 00000000000..1c221f16992 --- /dev/null +++ b/queue-4.4/kernel-gcov-fs.c-gcov_seq_next-should-increase-posit.patch @@ -0,0 +1,48 @@ +From 088b1e34f64b1358df85c0afbc577b26cea52ae1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Apr 2020 14:34:10 -0700 +Subject: kernel/gcov/fs.c: gcov_seq_next() should increase position index + +From: Vasily Averin + +[ Upstream commit f4d74ef6220c1eda0875da30457bef5c7111ab06 ] + +If seq_file .next function does not change position index, read after +some lseek can generate unexpected output. + +https://bugzilla.kernel.org/show_bug.cgi?id=206283 +Signed-off-by: Vasily Averin +Signed-off-by: Andrew Morton +Acked-by: Peter Oberparleiter +Cc: Al Viro +Cc: Davidlohr Bueso +Cc: Ingo Molnar +Cc: Manfred Spraul +Cc: NeilBrown +Cc: Steven Rostedt +Cc: Waiman Long +Link: http://lkml.kernel.org/r/f65c6ee7-bd00-f910-2f8a-37cc67e4ff88@virtuozzo.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + kernel/gcov/fs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/gcov/fs.c b/kernel/gcov/fs.c +index edf67c493a8e1..e473f6a1f6ca7 100644 +--- a/kernel/gcov/fs.c ++++ b/kernel/gcov/fs.c +@@ -108,9 +108,9 @@ static void *gcov_seq_next(struct seq_file *seq, void *data, loff_t *pos) + { + struct gcov_iterator *iter = data; + ++ (*pos)++; + if (gcov_iter_next(iter)) + return NULL; +- (*pos)++; + + return iter; + } +-- +2.20.1 + diff --git a/queue-4.4/pwm-bcm2835-dynamically-allocate-base.patch b/queue-4.4/pwm-bcm2835-dynamically-allocate-base.patch new file mode 100644 index 00000000000..8da35740ffb --- /dev/null +++ b/queue-4.4/pwm-bcm2835-dynamically-allocate-base.patch @@ -0,0 +1,42 @@ +From c675b615deac2fddb5fa93f84820446edc201092 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Feb 2020 13:35:35 -0800 +Subject: pwm: bcm2835: Dynamically allocate base +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Florian Fainelli + +[ Upstream commit 2c25b07e5ec119cab609e41407a1fb3fa61442f5 ] + +The newer 2711 and 7211 chips have two PWM controllers and failure to +dynamically allocate the PWM base would prevent the second PWM +controller instance being probed for succeeding with an -EEXIST error +from alloc_pwms(). + +Fixes: e5a06dc5ac1f ("pwm: Add BCM2835 PWM driver") +Signed-off-by: Florian Fainelli +Acked-by: Uwe Kleine-König +Reviewed-by: Nicolas Saenz Julienne +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-bcm2835.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pwm/pwm-bcm2835.c b/drivers/pwm/pwm-bcm2835.c +index b4c7f956b6fa6..388a9fa5c1d24 100644 +--- a/drivers/pwm/pwm-bcm2835.c ++++ b/drivers/pwm/pwm-bcm2835.c +@@ -160,6 +160,7 @@ static int bcm2835_pwm_probe(struct platform_device *pdev) + + pc->chip.dev = &pdev->dev; + pc->chip.ops = &bcm2835_pwm_ops; ++ pc->chip.base = -1; + pc->chip.npwm = 2; + + platform_set_drvdata(pdev, pc); +-- +2.20.1 + diff --git a/queue-4.4/pwm-rcar-fix-late-runtime-pm-enablement.patch b/queue-4.4/pwm-rcar-fix-late-runtime-pm-enablement.patch new file mode 100644 index 00000000000..7e378346db7 --- /dev/null +++ b/queue-4.4/pwm-rcar-fix-late-runtime-pm-enablement.patch @@ -0,0 +1,66 @@ +From b2e65100ce2f8a75bf068a55dfdefb91fb8891ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Mar 2020 11:32:14 +0100 +Subject: pwm: rcar: Fix late Runtime PM enablement +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 1451a3eed24b5fd6a604683f0b6995e0e7e16c79 ] + +Runtime PM should be enabled before calling pwmchip_add(), as PWM users +can appear immediately after the PWM chip has been added. +Likewise, Runtime PM should be disabled after the removal of the PWM +chip. + +Fixes: ed6c1476bf7f16d5 ("pwm: Add support for R-Car PWM Timer") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Uwe Kleine-König +Reviewed-by: Laurent Pinchart +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-rcar.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/pwm/pwm-rcar.c b/drivers/pwm/pwm-rcar.c +index 6e99a63ffa290..df0723df1f997 100644 +--- a/drivers/pwm/pwm-rcar.c ++++ b/drivers/pwm/pwm-rcar.c +@@ -232,24 +232,28 @@ static int rcar_pwm_probe(struct platform_device *pdev) + rcar_pwm->chip.base = -1; + rcar_pwm->chip.npwm = 1; + ++ pm_runtime_enable(&pdev->dev); ++ + ret = pwmchip_add(&rcar_pwm->chip); + if (ret < 0) { + dev_err(&pdev->dev, "failed to register PWM chip: %d\n", ret); ++ pm_runtime_disable(&pdev->dev); + return ret; + } + +- pm_runtime_enable(&pdev->dev); +- + return 0; + } + + static int rcar_pwm_remove(struct platform_device *pdev) + { + struct rcar_pwm_chip *rcar_pwm = platform_get_drvdata(pdev); ++ int ret; ++ ++ ret = pwmchip_remove(&rcar_pwm->chip); + + pm_runtime_disable(&pdev->dev); + +- return pwmchip_remove(&rcar_pwm->chip); ++ return ret; + } + + static const struct of_device_id rcar_pwm_of_table[] = { +-- +2.20.1 + diff --git a/queue-4.4/pwm-renesas-tpu-fix-late-runtime-pm-enablement.patch b/queue-4.4/pwm-renesas-tpu-fix-late-runtime-pm-enablement.patch new file mode 100644 index 00000000000..651ca1796bb --- /dev/null +++ b/queue-4.4/pwm-renesas-tpu-fix-late-runtime-pm-enablement.patch @@ -0,0 +1,63 @@ +From 8781640c7f769d3fb27dc98d5d9c798eb57e4dd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Mar 2020 11:32:15 +0100 +Subject: pwm: renesas-tpu: Fix late Runtime PM enablement + +From: Geert Uytterhoeven + +[ Upstream commit d5a3c7a4536e1329a758e14340efd0e65252bd3d ] + +Runtime PM should be enabled before calling pwmchip_add(), as PWM users +can appear immediately after the PWM chip has been added. +Likewise, Runtime PM should always be disabled after the removal of the +PWM chip, even if the latter failed. + +Fixes: 99b82abb0a35b073 ("pwm: Add Renesas TPU PWM driver") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-renesas-tpu.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/pwm/pwm-renesas-tpu.c b/drivers/pwm/pwm-renesas-tpu.c +index 075c1a764ba29..6247a956cc089 100644 +--- a/drivers/pwm/pwm-renesas-tpu.c ++++ b/drivers/pwm/pwm-renesas-tpu.c +@@ -423,16 +423,17 @@ static int tpu_probe(struct platform_device *pdev) + tpu->chip.base = -1; + tpu->chip.npwm = TPU_CHANNEL_MAX; + ++ pm_runtime_enable(&pdev->dev); ++ + ret = pwmchip_add(&tpu->chip); + if (ret < 0) { + dev_err(&pdev->dev, "failed to register PWM chip\n"); ++ pm_runtime_disable(&pdev->dev); + return ret; + } + + dev_info(&pdev->dev, "TPU PWM %d registered\n", tpu->pdev->id); + +- pm_runtime_enable(&pdev->dev); +- + return 0; + } + +@@ -442,12 +443,10 @@ static int tpu_remove(struct platform_device *pdev) + int ret; + + ret = pwmchip_remove(&tpu->chip); +- if (ret) +- return ret; + + pm_runtime_disable(&pdev->dev); + +- return 0; ++ return ret; + } + + #ifdef CONFIG_OF +-- +2.20.1 + diff --git a/queue-4.4/s390-cio-avoid-duplicated-add-uevents.patch b/queue-4.4/s390-cio-avoid-duplicated-add-uevents.patch new file mode 100644 index 00000000000..99b4071a011 --- /dev/null +++ b/queue-4.4/s390-cio-avoid-duplicated-add-uevents.patch @@ -0,0 +1,65 @@ +From 1ad6bd2ba4f8101dcb2bedc9d5ac6e7cd9a1a361 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Mar 2020 13:45:02 +0100 +Subject: s390/cio: avoid duplicated 'ADD' uevents + +From: Cornelia Huck + +[ Upstream commit 05ce3e53f375295c2940390b2b429e506e07655c ] + +The common I/O layer delays the ADD uevent for subchannels and +delegates generating this uevent to the individual subchannel +drivers. The io_subchannel driver will do so when the associated +ccw_device has been registered -- but unconditionally, so more +ADD uevents will be generated if a subchannel has been unbound +from the io_subchannel driver and later rebound. + +To fix this, only generate the ADD event if uevents were still +suppressed for the device. + +Fixes: fa1a8c23eb7d ("s390: cio: Delay uevents for subchannels") +Message-Id: <20200327124503.9794-2-cohuck@redhat.com> +Reported-by: Boris Fiuczynski +Reviewed-by: Peter Oberparleiter +Reviewed-by: Boris Fiuczynski +Signed-off-by: Cornelia Huck +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/device.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c +index 6aae684128021..2389a1dc6d300 100644 +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -872,8 +872,10 @@ static void io_subchannel_register(struct ccw_device *cdev) + * Now we know this subchannel will stay, we can throw + * our delayed uevent. + */ +- dev_set_uevent_suppress(&sch->dev, 0); +- kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ if (dev_get_uevent_suppress(&sch->dev)) { ++ dev_set_uevent_suppress(&sch->dev, 0); ++ kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ } + /* make it known to the system */ + ret = ccw_device_add(cdev); + if (ret) { +@@ -1082,8 +1084,11 @@ static int io_subchannel_probe(struct subchannel *sch) + * Throw the delayed uevent for the subchannel, register + * the ccw_device and exit. + */ +- dev_set_uevent_suppress(&sch->dev, 0); +- kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ if (dev_get_uevent_suppress(&sch->dev)) { ++ /* should always be the case for the console */ ++ dev_set_uevent_suppress(&sch->dev, 0); ++ kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ } + cdev = sch_get_cdev(sch); + rc = ccw_device_add(cdev); + if (rc) { +-- +2.20.1 + diff --git a/queue-4.4/scsi-iscsi-report-unbind-session-event-when-the-targ.patch b/queue-4.4/scsi-iscsi-report-unbind-session-event-when-the-targ.patch new file mode 100644 index 00000000000..f2800203775 --- /dev/null +++ b/queue-4.4/scsi-iscsi-report-unbind-session-event-when-the-targ.patch @@ -0,0 +1,61 @@ +From 4b677289d57f17258c582f8714cca0cbfd4589a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Mar 2020 15:58:50 +0800 +Subject: scsi: iscsi: Report unbind session event when the target has been + removed + +From: Wu Bo + +[ Upstream commit 13e60d3ba287d96eeaf1deaadba51f71578119a3 ] + +If the daemon is restarted or crashes while logging out of a session, the +unbind session event sent by the kernel is not processed and is lost. When +the daemon starts again, the session can't be unbound because the daemon is +waiting for the event message. However, the kernel has already logged out +and the event will not be resent. + +When iscsid restart is complete, logout session reports error: + +Logging out of session [sid: 6, target: iqn.xxxxx, portal: xx.xx.xx.xx,3260] +iscsiadm: Could not logout of [sid: 6, target: iscsiadm -m node iqn.xxxxx, portal: xx.xx.xx.xx,3260]. +iscsiadm: initiator reported error (9 - internal error) +iscsiadm: Could not logout of all requested sessions + +Make sure the unbind event is emitted. + +[mkp: commit desc and applied by hand since patch was mangled] + +Link: https://lore.kernel.org/r/4eab1771-2cb3-8e79-b31c-923652340e99@huawei.com +Reviewed-by: Lee Duncan +Signed-off-by: Wu Bo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 20cf01d6ded7e..de10b461ec7ef 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2014,7 +2014,7 @@ static void __iscsi_unbind_session(struct work_struct *work) + if (session->target_id == ISCSI_MAX_TARGET) { + spin_unlock_irqrestore(&session->lock, flags); + mutex_unlock(&ihost->mutex); +- return; ++ goto unbind_session_exit; + } + + target_id = session->target_id; +@@ -2026,6 +2026,8 @@ static void __iscsi_unbind_session(struct work_struct *work) + ida_simple_remove(&iscsi_sess_ida, target_id); + + scsi_remove_target(&session->dev); ++ ++unbind_session_exit: + iscsi_session_event(session, ISCSI_KEVENT_UNBIND_SESSION); + ISCSI_DBG_TRANS_SESSION(session, "Completed target removal\n"); + } +-- +2.20.1 + diff --git a/queue-4.4/scsi-lpfc-fix-kasan-slab-out-of-bounds-error-in-lpfc.patch b/queue-4.4/scsi-lpfc-fix-kasan-slab-out-of-bounds-error-in-lpfc.patch new file mode 100644 index 00000000000..2db982476a2 --- /dev/null +++ b/queue-4.4/scsi-lpfc-fix-kasan-slab-out-of-bounds-error-in-lpfc.patch @@ -0,0 +1,62 @@ +From 193ddd3189d84f20c592050f53b4b2bd71e225c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Mar 2020 11:12:53 -0700 +Subject: scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login + +From: James Smart + +[ Upstream commit 38503943c89f0bafd9e3742f63f872301d44cbea ] + +The following kasan bug was called out: + + BUG: KASAN: slab-out-of-bounds in lpfc_unreg_login+0x7c/0xc0 [lpfc] + Read of size 2 at addr ffff889fc7c50a22 by task lpfc_worker_3/6676 + ... + Call Trace: + dump_stack+0x96/0xe0 + ? lpfc_unreg_login+0x7c/0xc0 [lpfc] + print_address_description.constprop.6+0x1b/0x220 + ? lpfc_unreg_login+0x7c/0xc0 [lpfc] + ? lpfc_unreg_login+0x7c/0xc0 [lpfc] + __kasan_report.cold.9+0x37/0x7c + ? lpfc_unreg_login+0x7c/0xc0 [lpfc] + kasan_report+0xe/0x20 + lpfc_unreg_login+0x7c/0xc0 [lpfc] + lpfc_sli_def_mbox_cmpl+0x334/0x430 [lpfc] + ... + +When processing the completion of a "Reg Rpi" login mailbox command in +lpfc_sli_def_mbox_cmpl, a call may be made to lpfc_unreg_login. The vpi is +extracted from the completing mailbox context and passed as an input for +the next. However, the vpi stored in the mailbox command context is an +absolute vpi, which for SLI4 represents both base + offset. When used with +a non-zero base component, (function id > 0) this results in an +out-of-range access beyond the allocated phba->vpi_ids array. + +Fix by subtracting the function's base value to get an accurate vpi number. + +Link: https://lore.kernel.org/r/20200322181304.37655-2-jsmart2021@gmail.com +Signed-off-by: James Smart +Signed-off-by: Dick Kennedy +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 065fdc17bbfbb..7a94c2d352390 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -2186,6 +2186,8 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) + !pmb->u.mb.mbxStatus) { + rpi = pmb->u.mb.un.varWords[0]; + vpi = pmb->u.mb.un.varRegLogin.vpi; ++ if (phba->sli_rev == LPFC_SLI_REV4) ++ vpi -= phba->sli4_hba.max_cfg_param.vpi_base; + lpfc_unreg_login(phba, vpi, rpi, pmb); + pmb->mbox_cmpl = lpfc_sli_def_mbox_cmpl; + rc = lpfc_sli_issue_mbox(phba, pmb, MBX_NOWAIT); +-- +2.20.1 + diff --git a/queue-4.4/series b/queue-4.4/series index 5c61016f944..b73bec1cd8f 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -4,3 +4,14 @@ net-ipv4-emulate-read_once-on-hdrincl-bit-field-in-raw_sendmsg.patch net-ipv4-avoid-unused-variable-warning-for-sysctl.patch crypto-mxs-dcp-make-symbols-sha1_null_hash-and-sha256_null_hash-static.patch vti4-removed-duplicate-log-message.patch +scsi-lpfc-fix-kasan-slab-out-of-bounds-error-in-lpfc.patch +ceph-return-ceph_mdsc_do_request-errors-from-__get_p.patch +ceph-don-t-skip-updating-wanted-caps-when-cap-is-sta.patch +pwm-rcar-fix-late-runtime-pm-enablement.patch +scsi-iscsi-report-unbind-session-event-when-the-targ.patch +asoc-intel-atom-take-the-drv-lock-mutex-before-calli.patch +kernel-gcov-fs.c-gcov_seq_next-should-increase-posit.patch +ipc-util.c-sysvipc_find_ipc-should-increase-position.patch +s390-cio-avoid-duplicated-add-uevents.patch +pwm-renesas-tpu-fix-late-runtime-pm-enablement.patch +pwm-bcm2835-dynamically-allocate-base.patch -- 2.47.3