--- /dev/null
+From 1734fecea7b35bb11fd8211c7cd13223ebce75e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Apr 2020 20:53:57 +0200
+Subject: ASoC: Intel: atom: Take the drv->lock mutex before calling
+ sst_send_slot_map()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 81630dc042af998b9f58cd8e2c29dab9777ea176 ]
+
+sst_send_slot_map() uses sst_fill_and_send_cmd_unlocked() because in some
+places it is called with the drv->lock mutex already held.
+
+So it must always be called with the mutex locked. This commit adds missing
+locking in the sst_set_be_modules() code-path.
+
+Fixes: 24c8d14192cc ("ASoC: Intel: mrfld: add DSP core controls")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200402185359.3424-1-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/atom/sst-atom-controls.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/intel/atom/sst-atom-controls.c b/sound/soc/intel/atom/sst-atom-controls.c
+index b070d47547450..067cee92d333b 100644
+--- a/sound/soc/intel/atom/sst-atom-controls.c
++++ b/sound/soc/intel/atom/sst-atom-controls.c
+@@ -963,7 +963,9 @@ static int sst_set_be_modules(struct snd_soc_dapm_widget *w,
+ dev_dbg(c->dev, "Enter: widget=%s\n", w->name);
+
+ if (SND_SOC_DAPM_EVENT_ON(event)) {
++ mutex_lock(&drv->lock);
+ ret = sst_send_slot_map(drv);
++ mutex_unlock(&drv->lock);
+ if (ret)
+ return ret;
+ ret = sst_send_pipe_module_params(w, k);
+--
+2.20.1
+
--- /dev/null
+From a8891ddf5ae8ac220594781f089d185775245bac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Mar 2020 19:34:20 +0800
+Subject: ceph: don't skip updating wanted caps when cap is stale
+
+From: Yan, Zheng <zyan@redhat.com>
+
+[ Upstream commit 0aa971b6fd3f92afef6afe24ef78d9bb14471519 ]
+
+1. try_get_cap_refs() fails to get caps and finds that mds_wanted
+ does not include what it wants. It returns -ESTALE.
+2. ceph_get_caps() calls ceph_renew_caps(). ceph_renew_caps() finds
+ that inode has cap, so it calls ceph_check_caps().
+3. ceph_check_caps() finds that issued caps (without checking if it's
+ stale) already includes caps wanted by open file, so it skips
+ updating wanted caps.
+
+Above events can cause an infinite loop inside ceph_get_caps().
+
+Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/caps.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index aa4df4a022525..efdf81ea3b5f8 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1734,8 +1734,12 @@ retry_locked:
+ }
+
+ /* want more caps from mds? */
+- if (want & ~(cap->mds_wanted | cap->issued))
+- goto ack;
++ if (want & ~cap->mds_wanted) {
++ if (want & ~(cap->mds_wanted | cap->issued))
++ goto ack;
++ if (!__cap_is_valid(cap))
++ goto ack;
++ }
+
+ /* things we might delay */
+ if ((cap->issued & ~retain) == 0 &&
+--
+2.20.1
+
--- /dev/null
+From a56e2b13c55d1843d6c7096bc8e8a9c143a041a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Mar 2020 09:34:20 +0800
+Subject: ceph: return ceph_mdsc_do_request() errors from __get_parent()
+
+From: Qiujun Huang <hqjagain@gmail.com>
+
+[ Upstream commit c6d50296032f0b97473eb2e274dc7cc5d0173847 ]
+
+Return the error returned by ceph_mdsc_do_request(). Otherwise,
+r_target_inode ends up being NULL this ends up returning ENOENT
+regardless of the error.
+
+Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/export.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/ceph/export.c b/fs/ceph/export.c
+index fe02ae7f056a3..ff9e60daf086b 100644
+--- a/fs/ceph/export.c
++++ b/fs/ceph/export.c
+@@ -146,6 +146,11 @@ static struct dentry *__get_parent(struct super_block *sb,
+ }
+ req->r_num_caps = 1;
+ err = ceph_mdsc_do_request(mdsc, NULL, req);
++ if (err) {
++ ceph_mdsc_put_request(req);
++ return ERR_PTR(err);
++ }
++
+ inode = req->r_target_inode;
+ if (inode)
+ ihold(inode);
+--
+2.20.1
+
--- /dev/null
+From 7ddea8d447bbbd632025455af935f73f25b57eb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Apr 2020 14:34:13 -0700
+Subject: ipc/util.c: sysvipc_find_ipc() should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 89163f93c6f969da5811af5377cc10173583123b ]
+
+If seq_file .next function does not change position index, read after
+some lseek can generate unexpected output.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Waiman Long <longman@redhat.com>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Manfred Spraul <manfred@colorfullife.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: NeilBrown <neilb@suse.com>
+Cc: Peter Oberparleiter <oberpar@linux.ibm.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Link: http://lkml.kernel.org/r/b7a20945-e315-8bb0-21e6-3875c14a8494@virtuozzo.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ ipc/util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ipc/util.c b/ipc/util.c
+index 0f401d94b7c65..2724f9071ab39 100644
+--- a/ipc/util.c
++++ b/ipc/util.c
+@@ -756,13 +756,13 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos,
+ total++;
+ }
+
++ *new_pos = pos + 1;
+ if (total >= ids->in_use)
+ return NULL;
+
+ for (; pos < IPCMNI; pos++) {
+ ipc = idr_find(&ids->ipcs_idr, pos);
+ if (ipc != NULL) {
+- *new_pos = pos + 1;
+ rcu_read_lock();
+ ipc_lock_object(ipc);
+ return ipc;
+--
+2.20.1
+
--- /dev/null
+From 088b1e34f64b1358df85c0afbc577b26cea52ae1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Apr 2020 14:34:10 -0700
+Subject: kernel/gcov/fs.c: gcov_seq_next() should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit f4d74ef6220c1eda0875da30457bef5c7111ab06 ]
+
+If seq_file .next function does not change position index, read after
+some lseek can generate unexpected output.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Manfred Spraul <manfred@colorfullife.com>
+Cc: NeilBrown <neilb@suse.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Waiman Long <longman@redhat.com>
+Link: http://lkml.kernel.org/r/f65c6ee7-bd00-f910-2f8a-37cc67e4ff88@virtuozzo.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/gcov/fs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/gcov/fs.c b/kernel/gcov/fs.c
+index edf67c493a8e1..e473f6a1f6ca7 100644
+--- a/kernel/gcov/fs.c
++++ b/kernel/gcov/fs.c
+@@ -108,9 +108,9 @@ static void *gcov_seq_next(struct seq_file *seq, void *data, loff_t *pos)
+ {
+ struct gcov_iterator *iter = data;
+
++ (*pos)++;
+ if (gcov_iter_next(iter))
+ return NULL;
+- (*pos)++;
+
+ return iter;
+ }
+--
+2.20.1
+
--- /dev/null
+From c675b615deac2fddb5fa93f84820446edc201092 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 13:35:35 -0800
+Subject: pwm: bcm2835: Dynamically allocate base
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 2c25b07e5ec119cab609e41407a1fb3fa61442f5 ]
+
+The newer 2711 and 7211 chips have two PWM controllers and failure to
+dynamically allocate the PWM base would prevent the second PWM
+controller instance being probed for succeeding with an -EEXIST error
+from alloc_pwms().
+
+Fixes: e5a06dc5ac1f ("pwm: Add BCM2835 PWM driver")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-bcm2835.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pwm/pwm-bcm2835.c b/drivers/pwm/pwm-bcm2835.c
+index b4c7f956b6fa6..388a9fa5c1d24 100644
+--- a/drivers/pwm/pwm-bcm2835.c
++++ b/drivers/pwm/pwm-bcm2835.c
+@@ -160,6 +160,7 @@ static int bcm2835_pwm_probe(struct platform_device *pdev)
+
+ pc->chip.dev = &pdev->dev;
+ pc->chip.ops = &bcm2835_pwm_ops;
++ pc->chip.base = -1;
+ pc->chip.npwm = 2;
+
+ platform_set_drvdata(pdev, pc);
+--
+2.20.1
+
--- /dev/null
+From b2e65100ce2f8a75bf068a55dfdefb91fb8891ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Mar 2020 11:32:14 +0100
+Subject: pwm: rcar: Fix late Runtime PM enablement
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1451a3eed24b5fd6a604683f0b6995e0e7e16c79 ]
+
+Runtime PM should be enabled before calling pwmchip_add(), as PWM users
+can appear immediately after the PWM chip has been added.
+Likewise, Runtime PM should be disabled after the removal of the PWM
+chip.
+
+Fixes: ed6c1476bf7f16d5 ("pwm: Add support for R-Car PWM Timer")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-rcar.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pwm/pwm-rcar.c b/drivers/pwm/pwm-rcar.c
+index 6e99a63ffa290..df0723df1f997 100644
+--- a/drivers/pwm/pwm-rcar.c
++++ b/drivers/pwm/pwm-rcar.c
+@@ -232,24 +232,28 @@ static int rcar_pwm_probe(struct platform_device *pdev)
+ rcar_pwm->chip.base = -1;
+ rcar_pwm->chip.npwm = 1;
+
++ pm_runtime_enable(&pdev->dev);
++
+ ret = pwmchip_add(&rcar_pwm->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to register PWM chip: %d\n", ret);
++ pm_runtime_disable(&pdev->dev);
+ return ret;
+ }
+
+- pm_runtime_enable(&pdev->dev);
+-
+ return 0;
+ }
+
+ static int rcar_pwm_remove(struct platform_device *pdev)
+ {
+ struct rcar_pwm_chip *rcar_pwm = platform_get_drvdata(pdev);
++ int ret;
++
++ ret = pwmchip_remove(&rcar_pwm->chip);
+
+ pm_runtime_disable(&pdev->dev);
+
+- return pwmchip_remove(&rcar_pwm->chip);
++ return ret;
+ }
+
+ static const struct of_device_id rcar_pwm_of_table[] = {
+--
+2.20.1
+
--- /dev/null
+From 8781640c7f769d3fb27dc98d5d9c798eb57e4dd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Mar 2020 11:32:15 +0100
+Subject: pwm: renesas-tpu: Fix late Runtime PM enablement
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit d5a3c7a4536e1329a758e14340efd0e65252bd3d ]
+
+Runtime PM should be enabled before calling pwmchip_add(), as PWM users
+can appear immediately after the PWM chip has been added.
+Likewise, Runtime PM should always be disabled after the removal of the
+PWM chip, even if the latter failed.
+
+Fixes: 99b82abb0a35b073 ("pwm: Add Renesas TPU PWM driver")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-renesas-tpu.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pwm/pwm-renesas-tpu.c b/drivers/pwm/pwm-renesas-tpu.c
+index 075c1a764ba29..6247a956cc089 100644
+--- a/drivers/pwm/pwm-renesas-tpu.c
++++ b/drivers/pwm/pwm-renesas-tpu.c
+@@ -423,16 +423,17 @@ static int tpu_probe(struct platform_device *pdev)
+ tpu->chip.base = -1;
+ tpu->chip.npwm = TPU_CHANNEL_MAX;
+
++ pm_runtime_enable(&pdev->dev);
++
+ ret = pwmchip_add(&tpu->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to register PWM chip\n");
++ pm_runtime_disable(&pdev->dev);
+ return ret;
+ }
+
+ dev_info(&pdev->dev, "TPU PWM %d registered\n", tpu->pdev->id);
+
+- pm_runtime_enable(&pdev->dev);
+-
+ return 0;
+ }
+
+@@ -442,12 +443,10 @@ static int tpu_remove(struct platform_device *pdev)
+ int ret;
+
+ ret = pwmchip_remove(&tpu->chip);
+- if (ret)
+- return ret;
+
+ pm_runtime_disable(&pdev->dev);
+
+- return 0;
++ return ret;
+ }
+
+ #ifdef CONFIG_OF
+--
+2.20.1
+
--- /dev/null
+From 1ad6bd2ba4f8101dcb2bedc9d5ac6e7cd9a1a361 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Mar 2020 13:45:02 +0100
+Subject: s390/cio: avoid duplicated 'ADD' uevents
+
+From: Cornelia Huck <cohuck@redhat.com>
+
+[ Upstream commit 05ce3e53f375295c2940390b2b429e506e07655c ]
+
+The common I/O layer delays the ADD uevent for subchannels and
+delegates generating this uevent to the individual subchannel
+drivers. The io_subchannel driver will do so when the associated
+ccw_device has been registered -- but unconditionally, so more
+ADD uevents will be generated if a subchannel has been unbound
+from the io_subchannel driver and later rebound.
+
+To fix this, only generate the ADD event if uevents were still
+suppressed for the device.
+
+Fixes: fa1a8c23eb7d ("s390: cio: Delay uevents for subchannels")
+Message-Id: <20200327124503.9794-2-cohuck@redhat.com>
+Reported-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/device.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
+index 6aae684128021..2389a1dc6d300 100644
+--- a/drivers/s390/cio/device.c
++++ b/drivers/s390/cio/device.c
+@@ -872,8 +872,10 @@ static void io_subchannel_register(struct ccw_device *cdev)
+ * Now we know this subchannel will stay, we can throw
+ * our delayed uevent.
+ */
+- dev_set_uevent_suppress(&sch->dev, 0);
+- kobject_uevent(&sch->dev.kobj, KOBJ_ADD);
++ if (dev_get_uevent_suppress(&sch->dev)) {
++ dev_set_uevent_suppress(&sch->dev, 0);
++ kobject_uevent(&sch->dev.kobj, KOBJ_ADD);
++ }
+ /* make it known to the system */
+ ret = ccw_device_add(cdev);
+ if (ret) {
+@@ -1082,8 +1084,11 @@ static int io_subchannel_probe(struct subchannel *sch)
+ * Throw the delayed uevent for the subchannel, register
+ * the ccw_device and exit.
+ */
+- dev_set_uevent_suppress(&sch->dev, 0);
+- kobject_uevent(&sch->dev.kobj, KOBJ_ADD);
++ if (dev_get_uevent_suppress(&sch->dev)) {
++ /* should always be the case for the console */
++ dev_set_uevent_suppress(&sch->dev, 0);
++ kobject_uevent(&sch->dev.kobj, KOBJ_ADD);
++ }
+ cdev = sch_get_cdev(sch);
+ rc = ccw_device_add(cdev);
+ if (rc) {
+--
+2.20.1
+
--- /dev/null
+From 4b677289d57f17258c582f8714cca0cbfd4589a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2020 15:58:50 +0800
+Subject: scsi: iscsi: Report unbind session event when the target has been
+ removed
+
+From: Wu Bo <wubo40@huawei.com>
+
+[ Upstream commit 13e60d3ba287d96eeaf1deaadba51f71578119a3 ]
+
+If the daemon is restarted or crashes while logging out of a session, the
+unbind session event sent by the kernel is not processed and is lost. When
+the daemon starts again, the session can't be unbound because the daemon is
+waiting for the event message. However, the kernel has already logged out
+and the event will not be resent.
+
+When iscsid restart is complete, logout session reports error:
+
+Logging out of session [sid: 6, target: iqn.xxxxx, portal: xx.xx.xx.xx,3260]
+iscsiadm: Could not logout of [sid: 6, target: iscsiadm -m node iqn.xxxxx, portal: xx.xx.xx.xx,3260].
+iscsiadm: initiator reported error (9 - internal error)
+iscsiadm: Could not logout of all requested sessions
+
+Make sure the unbind event is emitted.
+
+[mkp: commit desc and applied by hand since patch was mangled]
+
+Link: https://lore.kernel.org/r/4eab1771-2cb3-8e79-b31c-923652340e99@huawei.com
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Wu Bo <wubo40@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_transport_iscsi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 20cf01d6ded7e..de10b461ec7ef 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2014,7 +2014,7 @@ static void __iscsi_unbind_session(struct work_struct *work)
+ if (session->target_id == ISCSI_MAX_TARGET) {
+ spin_unlock_irqrestore(&session->lock, flags);
+ mutex_unlock(&ihost->mutex);
+- return;
++ goto unbind_session_exit;
+ }
+
+ target_id = session->target_id;
+@@ -2026,6 +2026,8 @@ static void __iscsi_unbind_session(struct work_struct *work)
+ ida_simple_remove(&iscsi_sess_ida, target_id);
+
+ scsi_remove_target(&session->dev);
++
++unbind_session_exit:
+ iscsi_session_event(session, ISCSI_KEVENT_UNBIND_SESSION);
+ ISCSI_DBG_TRANS_SESSION(session, "Completed target removal\n");
+ }
+--
+2.20.1
+
--- /dev/null
+From 193ddd3189d84f20c592050f53b4b2bd71e225c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Mar 2020 11:12:53 -0700
+Subject: scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 38503943c89f0bafd9e3742f63f872301d44cbea ]
+
+The following kasan bug was called out:
+
+ BUG: KASAN: slab-out-of-bounds in lpfc_unreg_login+0x7c/0xc0 [lpfc]
+ Read of size 2 at addr ffff889fc7c50a22 by task lpfc_worker_3/6676
+ ...
+ Call Trace:
+ dump_stack+0x96/0xe0
+ ? lpfc_unreg_login+0x7c/0xc0 [lpfc]
+ print_address_description.constprop.6+0x1b/0x220
+ ? lpfc_unreg_login+0x7c/0xc0 [lpfc]
+ ? lpfc_unreg_login+0x7c/0xc0 [lpfc]
+ __kasan_report.cold.9+0x37/0x7c
+ ? lpfc_unreg_login+0x7c/0xc0 [lpfc]
+ kasan_report+0xe/0x20
+ lpfc_unreg_login+0x7c/0xc0 [lpfc]
+ lpfc_sli_def_mbox_cmpl+0x334/0x430 [lpfc]
+ ...
+
+When processing the completion of a "Reg Rpi" login mailbox command in
+lpfc_sli_def_mbox_cmpl, a call may be made to lpfc_unreg_login. The vpi is
+extracted from the completing mailbox context and passed as an input for
+the next. However, the vpi stored in the mailbox command context is an
+absolute vpi, which for SLI4 represents both base + offset. When used with
+a non-zero base component, (function id > 0) this results in an
+out-of-range access beyond the allocated phba->vpi_ids array.
+
+Fix by subtracting the function's base value to get an accurate vpi number.
+
+Link: https://lore.kernel.org/r/20200322181304.37655-2-jsmart2021@gmail.com
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 065fdc17bbfbb..7a94c2d352390 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -2186,6 +2186,8 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
+ !pmb->u.mb.mbxStatus) {
+ rpi = pmb->u.mb.un.varWords[0];
+ vpi = pmb->u.mb.un.varRegLogin.vpi;
++ if (phba->sli_rev == LPFC_SLI_REV4)
++ vpi -= phba->sli4_hba.max_cfg_param.vpi_base;
+ lpfc_unreg_login(phba, vpi, rpi, pmb);
+ pmb->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
+ rc = lpfc_sli_issue_mbox(phba, pmb, MBX_NOWAIT);
+--
+2.20.1
+
net-ipv4-avoid-unused-variable-warning-for-sysctl.patch
crypto-mxs-dcp-make-symbols-sha1_null_hash-and-sha256_null_hash-static.patch
vti4-removed-duplicate-log-message.patch
+scsi-lpfc-fix-kasan-slab-out-of-bounds-error-in-lpfc.patch
+ceph-return-ceph_mdsc_do_request-errors-from-__get_p.patch
+ceph-don-t-skip-updating-wanted-caps-when-cap-is-sta.patch
+pwm-rcar-fix-late-runtime-pm-enablement.patch
+scsi-iscsi-report-unbind-session-event-when-the-targ.patch
+asoc-intel-atom-take-the-drv-lock-mutex-before-calli.patch
+kernel-gcov-fs.c-gcov_seq_next-should-increase-posit.patch
+ipc-util.c-sysvipc_find_ipc-should-increase-position.patch
+s390-cio-avoid-duplicated-add-uevents.patch
+pwm-renesas-tpu-fix-late-runtime-pm-enablement.patch
+pwm-bcm2835-dynamically-allocate-base.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
