1. 25 Nov, 2016 1 commit
    • Mauricio Faria de Oliveira's avatar
      scsi: lpfc: fix oops/BUG in lpfc_sli_ringtxcmpl_put() · 2319f847
      Mauricio Faria de Oliveira authored
      The BUG_ON() recently introduced in lpfc_sli_ringtxcmpl_put() is hit in
      the lpfc_els_abort() > lpfc_sli_issue_abort_iotag() >
      lpfc_sli_abort_iotag_issue() function path [similar names], due to
      'piocb->vport == NULL':
      
      	BUG_ON(!piocb || !piocb->vport);
      
      This happens because lpfc_sli_abort_iotag_issue() doesn't set the
      'abtsiocbp->vport' pointer -- but this is not the problem.
      
      Previously, lpfc_sli_ringtxcmpl_put() accessed 'piocb->vport' only if
      'piocb->iocb.ulpCommand' is neither CMD_ABORT_XRI_CN nor
      CMD_CLOSE_XRI_CN, which are the only possible values for
      lpfc_sli_abort_iotag_issue():
      
          lpfc_sli_ringtxcmpl_put():
      
              if ((unlikely(pring->ringno == LPFC_ELS_RING)) &&
                 (piocb->iocb.ulpCommand != CMD_ABORT_XRI_CN) &&
                 (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN) &&
                  (!(piocb->vport->load_flag & FC_UNLOADING)))
      
          lpfc_sli_abort_iotag_issue():
      
              if (phba->link_state >= LPFC_LINK_UP)
                      iabt->ulpCommand = CMD_ABORT_XRI_CN;
              else
                      iabt->ulpCommand = CMD_CLOSE_XRI_CN;
      
      So, this function path would not have hit this possible NULL pointer
      dereference before.
      
      In order to fix this regression, move the second part of the BUG_ON()
      check prior to the pointer dereference that it does check for.
      
      For reference, this is the stack trace observed. The problem happened
      because an unsolicited event was received - a PLOGI was received after
      our PLOGI was issued but not yet complete, so the discovery state
      machine goes on to sw-abort our PLOGI.
      
          kernel BUG at drivers/scsi/lpfc/lpfc_sli.c:1326!
          Oops: Exception in kernel mode, sig: 5 [#1]
          <...>
          NIP [...] lpfc_sli_ringtxcmpl_put+0x1c/0xf0 [lpfc]
          LR  [...] __lpfc_sli_issue_iocb_s4+0x188/0x200 [lpfc]
          Call Trace:
          [...] [...] __lpfc_sli_issue_iocb_s4+0xb0/0x200 [lpfc] (unreliable)
          [...] [...] lpfc_sli_issue_abort_iotag+0x2b4/0x350 [lpfc]
          [...] [...] lpfc_els_abort+0x1a8/0x4a0 [lpfc]
          [...] [...] lpfc_rcv_plogi+0x6d4/0x700 [lpfc]
          [...] [...] lpfc_rcv_plogi_plogi_issue+0xd8/0x1d0 [lpfc]
          [...] [...] lpfc_disc_state_machine+0xc0/0x2b0 [lpfc]
          [...] [...] lpfc_els_unsol_buffer+0xcc0/0x26c0 [lpfc]
          [...] [...] lpfc_els_unsol_event+0xa8/0x220 [lpfc]
          [...] [...] lpfc_complete_unsol_iocb+0xb8/0x138 [lpfc]
          [...] [...] lpfc_sli4_handle_received_buffer+0x6a0/0xec0 [lpfc]
          [...] [...] lpfc_sli_handle_slow_ring_event_s4+0x1c4/0x240 [lpfc]
          [...] [...] lpfc_sli_handle_slow_ring_event+0x24/0x40 [lpfc]
          [...] [...] lpfc_do_work+0xd88/0x1970 [lpfc]
          [...] [...] kthread+0x108/0x130
          [...] [...] ret_from_kernel_thread+0x5c/0xbc
          <...>
      
      Cc: stable@vger.kernel.org # v4.8
      Fixes: 22466da5 ("lpfc: Fix possible NULL pointer dereference")
      Reported-by: default avatarHarsha Thyagaraja <hathyaga@in.ibm.com>
      Signed-off-by: default avatarMauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
      Reviewed-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      2319f847
  2. 22 Nov, 2016 3 commits
  3. 18 Nov, 2016 1 commit
  4. 14 Nov, 2016 1 commit
    • Mauricio Faria de Oliveira's avatar
      scsi: qla2xxx: do not abort all commands in the adapter during EEH recovery · c733ab35
      Mauricio Faria de Oliveira authored
      The previous commit 1535aa75 ("qla2xxx: fix invalid DMA access after
      command aborts in PCI device remove") introduced a regression during an
      EEH recovery, since the change to the qla2x00_abort_all_cmds() function
      calls qla2xxx_eh_abort(), which verifies the EEH recovery condition but
      handles it heavy-handed. (commit a465537a "qla2xxx: Disable the
      adapter and skip error recovery in case of register disconnect.")
      
      This problem warrants a more general/optimistic solution right into
      qla2xxx_eh_abort() (eg in case a real command abort arrives during EEH
      recovery, or if it takes long enough to trigger command aborts); but
      it's still worth to add a check to ensure the code added by the previous
      commit is correct and contained within its owner function.
      
      This commit just adds a 'if (!ha->flags.eeh_busy)' check around it.
      (ahem; a trivial fix for this -rc series; sorry for this oversight.)
      
      With it applied, both PCI device remove and EEH recovery works fine.
      
      Fixes: 1535aa75 ("scsi: qla2xxx: fix invalid DMA access after command aborts in PCI device remove")
      Signed-off-by: default avatarMauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
      Acked-by: default avatarHimanshu Madhani <himanshu.madhani@cavium.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      c733ab35
  5. 12 Nov, 2016 1 commit
    • Andrey Grodzovsky's avatar
      scsi: mpt3sas: Fix secure erase premature termination · 18f6084a
      Andrey Grodzovsky authored
      This is a work around for a bug with LSI Fusion MPT SAS2 when perfoming
      secure erase. Due to the very long time the operation takes, commands
      issued during the erase will time out and will trigger execution of the
      abort hook. Even though the abort hook is called for the specific
      command which timed out, this leads to entire device halt
      (scsi_state terminated) and premature termination of the secure erase.
      
      Set device state to busy while ATA passthrough commands are in progress.
      
      [mkp: hand applied to 4.9/scsi-fixes, tweaked patch description]
      Signed-off-by: default avatarAndrey Grodzovsky <andrey2805@gmail.com>
      Acked-by: default avatarSreekanth Reddy <Sreekanth.Reddy@broadcom.com>
      Cc: <linux-scsi@vger.kernel.org>
      Cc: Sathya Prakash <sathya.prakash@broadcom.com>
      Cc: Chaitra P B <chaitra.basappa@broadcom.com>
      Cc: Suganath Prabu Subramani <suganath-prabu.subramani@broadcom.com>
      Cc: Sreekanth Reddy <Sreekanth.Reddy@broadcom.com>
      Cc: Hannes Reinecke <hare@suse.de>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      18f6084a
  6. 09 Nov, 2016 4 commits
  7. 01 Nov, 2016 5 commits
    • Bill Kuzeja's avatar
      scsi: qla2xxx: Fix scsi scan hang triggered if adapter fails during init · a5dd506e
      Bill Kuzeja authored
      A system can get hung task timeouts if a qlogic board fails during
      initialization (if the board breaks again or fails the init). The hang
      involves the scsi scan.
      
      In a nutshell, since commit beb9e315 ("qla2xxx: Prevent removal and
      board_disable race"):
      
      ...it is possible to have freed ha (base_vha->hw) early by a call to
      qla2x00_remove_one when pdev->enable_cnt equals zero:
      
             if (!atomic_read(&pdev->enable_cnt)) {
                     scsi_host_put(base_vha->host);
                     kfree(ha);
                     pci_set_drvdata(pdev, NULL);
                     return;
      
      Almost always, the scsi_host_put above frees the vha structure
      (attached to the end of the Scsi_Host we're putting) since it's the last
      put, and life is good.  However, if we are entering this routine because
      the adapter has broken sometime during initialization AND a scsi scan is
      already in progress (and has done its own scsi_host_get), vha will not
      be freed. What's worse, the scsi scan will access the freed ha structure
      through qla2xxx_scan_finished:
      
              if (time > vha->hw->loop_reset_delay * HZ)
                      return 1;
      
      The scsi scan keeps checking to see if a scan is complete by calling
      qla2xxx_scan_finished. There is a timeout value that limits the length
      of time a scan can take (hw->loop_reset_delay, usually set to 5
      seconds), but this definition is in the data structure (hw) that can get
      freed early.
      
      This can yield unpredictable results, the worst of which is that the
      scsi scan can hang indefinitely. This happens when the freed structure
      gets reused and loop_reset_delay gets overwritten with garbage, which
      the scan obliviously uses as its timeout value.
      
      The fix for this is simple: at the top of qla2xxx_scan_finished, check
      for the UNLOADING bit in the vha structure (_vha is not freed at this
      point).  If UNLOADING is set, we exit the scan for this adapter
      immediately. After this last reference to the ha structure, we'll exit
      the scan for this adapter, and continue on.
      
      This problem is hard to hit, but I have run into it doing negative
      testing many times now (with a test specifically designed to bring it
      out), so I can verify that this fix works. My testing has been against a
      RHEL7 driver variant, but the bug and patch are equally relevant to to
      the upstream driver.
      
      Fixes: beb9e315 ("qla2xxx: Prevent removal and board_disable race")
      Cc: <stable@vger.kernel.org> # v3.18+
      Signed-off-by: default avatarBill Kuzeja <william.kuzeja@stratus.com>
      Acked-by: default avatarHimanshu Madhani <himanshu.madhani@cavium.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      a5dd506e
    • Bart Van Assche's avatar
      scsi: scsi_dh_alua: Fix a reference counting bug · df3d422c
      Bart Van Assche authored
      The code at the end of alua_rtpg_work() is as follows:
      
      	scsi_device_put(sdev);
      	kref_put(&pg->kref, release_port_group);
      
      In other words, alua_rtpg_queue() must hold an sdev reference and a pg
      reference before queueing rtpg work. If no rtpg work is queued no
      additional references should be held when alua_rtpg_queue() returns. If
      no rtpg work is queued, ensure that alua_rtpg_queue() only gives up the
      sdev reference if that reference was obtained by the same
      alua_rtpg_queue() call.
      Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
      Reported-by: default avatarTang Junhui <tang.junhui@zte.com.cn>
      Cc: Hannes Reinecke <hare@suse.com>
      Cc: Tang Junhui <tang.junhui@zte.com.cn>
      Cc: <stable@vger.kernel.org>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      df3d422c
    • David Jeffery's avatar
      scsi: vmw_pvscsi: return SUCCESS for successful command aborts · aac173e9
      David Jeffery authored
      The vmw_pvscsi driver reports most successful aborts as FAILED to the
      scsi error handler.  This is do to a misunderstanding of how
      completion_done() works and its interaction with a successful wait using
      wait_for_completion_timeout().  The vmw_pvscsi driver is expecting
      completion_done() to always return true if complete() has been called on
      the completion structure.  But completion_done() returns true after
      complete() has been called only if no function like
      wait_for_completion_timeout() has seen the completion and cleared it as
      part of successfully waiting for the completion.
      
      Instead of using completion_done(), vmw_pvscsi should just use the
      return value from wait_for_completion_timeout() to know if the wait
      timed out or not.
      
      [mkp: bumped driver version per request]
      Signed-off-by: default avatarDavid Jeffery <djeffery@redhat.com>
      Reviewed-by: default avatarLaurence Oberman <loberman@redhat.com>
      Reviewed-by: default avatarEwan D. Milne <emilne@redhat.com>
      Acked-by: default avatarJim Gill <jgill@vmware.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      aac173e9
    • Sreekanth Reddy's avatar
      scsi: mpt3sas: Fix for block device of raid exists even after deleting raid disk · 6d3a56ed
      Sreekanth Reddy authored
      While merging mpt3sas & mpt2sas code, we added the is_warpdrive check
      condition on the wrong line
      
      ---------------------------------------------------------------------------
       scsih_target_alloc(struct scsi_target *starget)
                              sas_target_priv_data->handle = raid_device->handle;
                              sas_target_priv_data->sas_address = raid_device->wwid;
                              sas_target_priv_data->flags |= MPT_TARGET_FLAGS_VOLUME;
      -                       raid_device->starget = starget;
      +                       sas_target_priv_data->raid_device = raid_device;
      +                       if (ioc->is_warpdrive)
      +                               raid_device->starget = starget;
                      }
                      spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
                      return 0;
      ------------------------------------------------------------------------------
      
      That check should be for the line sas_target_priv_data->raid_device =
      raid_device;
      
      Due to above hunk, we are not initializing raid_device's starget for
      raid volumes, and so during raid disk deletion driver is not calling
      scsi_remove_target() API as driver observes starget field of
      raid_device's structure as NULL.
      Signed-off-by: default avatarSreekanth Reddy <Sreekanth.Reddy@broadcom.com>
      Cc: <stable@vger.kernel.org> # v4.4+
      Fixes: 7786ab6a ("mpt3sas: Ported WarpDrive product SSS6200 support")
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      6d3a56ed
    • tang.junhui's avatar
      scsi: scsi_dh_alua: fix missing kref_put() in alua_rtpg_work() · 1fdd1427
      tang.junhui authored
      Reference count of pg leaks in alua_rtpg_work() since kref_put() is not
      called to decrease the reference count of pg when the condition
      pg->rtpg_sdev==NULL satisfied (actually it is easy to satisfy), it would
      cause memory of pg leakage.
      Signed-off-by: default avatartang.junhui <tang.junhui@zte.com.cn>
      Cc: <stable@vger.kernel.org>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      1fdd1427
  8. 27 Oct, 2016 2 commits
  9. 25 Oct, 2016 1 commit
  10. 17 Oct, 2016 3 commits
    • Arnd Bergmann's avatar
      scsi: NCR5380: no longer mark irq probing as __init · 77f18a87
      Arnd Bergmann authored
      The g_NCR5380 has been converted to more regular probing, which
      means its probe function can now be invoked after the __init section
      is discarded, as pointed out by this kbuild warning:
      
      WARNING: drivers/scsi/built-in.o(.text+0x3a105): Section mismatch in reference from the function generic_NCR5380_isa_match() to the function .init.text:probe_intr()
      WARNING: drivers/scsi/built-in.o(.text+0x3a145): Section mismatch in reference from the function generic_NCR5380_isa_match() to the variable .init.data:probe_irq
      
      To make sure this works correctly in all cases, let's remove
      the __init and __initdata annotations.
      
      Fixes: a8cfbcae ("scsi: g_NCR5380: Stop using scsi_module.c")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      77f18a87
    • Jitendra Bhivare's avatar
      scsi: be2iscsi: Replace _bh with _irqsave/irqrestore · 7d2c0d64
      Jitendra Bhivare authored
      [ 3843.132217] WARNING: CPU: 20 PID: 1227 at kernel/softirq.c:150 __local_bh_enable_ip+0x6b/0x90
      [ 3843.142815] Modules linked in:
      ...
      [ 3843.294328] CPU: 20 PID: 1227 Comm: kworker/20:1H Tainted: G            E   4.8.0-rc1+ #3
      [ 3843.304944] Hardware name: Dell Inc. PowerEdge R720/0X6H47, BIOS 1.4.8 10/25/2012
      [ 3843.314798] Workqueue: kblockd blk_timeout_work
      [ 3843.321350]  0000000000000086 00000000a32f4533 ffff8802216d7bd8 ffffffff8135c3cf
      [ 3843.331146]  0000000000000000 0000000000000000 ffff8802216d7c18 ffffffff8108d661
      [ 3843.340918]  00000096216d7c50 0000000000000200 ffff8802d07cc828 ffff8801b3632550
      [ 3843.350687] Call Trace:
      [ 3843.354866]  [<ffffffff8135c3cf>] dump_stack+0x63/0x84
      [ 3843.362061]  [<ffffffff8108d661>] __warn+0xd1/0xf0
      [ 3843.368851]  [<ffffffff8108d79d>] warn_slowpath_null+0x1d/0x20
      [ 3843.376791]  [<ffffffff810930eb>] __local_bh_enable_ip+0x6b/0x90
      [ 3843.384903]  [<ffffffff816fe7be>] _raw_spin_unlock_bh+0x1e/0x20
      [ 3843.392940]  [<ffffffffa085f710>] beiscsi_alloc_pdu+0x2f0/0x6e0 [be2iscsi]
      [ 3843.402076]  [<ffffffffa06bc358>] __iscsi_conn_send_pdu+0xf8/0x370 [libiscsi]
      [ 3843.411549]  [<ffffffffa06bc6fe>] iscsi_send_nopout+0xbe/0x110 [libiscsi]
      [ 3843.420639]  [<ffffffffa06bd98b>] iscsi_eh_cmd_timed_out+0x29b/0x2b0 [libiscsi]
      [ 3843.430339]  [<ffffffff814cd1de>] scsi_times_out+0x5e/0x250
      [ 3843.438119]  [<ffffffff813374af>] blk_rq_timed_out+0x1f/0x60
      [ 3843.446009]  [<ffffffff8133759d>] blk_timeout_work+0xad/0x150
      [ 3843.454010]  [<ffffffff810a6642>] process_one_work+0x152/0x400
      [ 3843.462114]  [<ffffffff810a6f35>] worker_thread+0x125/0x4b0
      [ 3843.469961]  [<ffffffff810a6e10>] ? rescuer_thread+0x380/0x380
      [ 3843.478116]  [<ffffffff810aca28>] kthread+0xd8/0xf0
      [ 3843.485212]  [<ffffffff816fedff>] ret_from_fork+0x1f/0x40
      [ 3843.492908]  [<ffffffff810ac950>] ? kthread_park+0x60/0x60
      [ 3843.500715] ---[ end trace 57ec0a1d8f0dd3a0 ]---
      [ 3852.328667] NMI watchdog: Watchdog detected hard LOCKUP on cpu 1Kernel panic - not syncing: Hard LOCKUP
      
      blk_timeout_work takes queue_lock spin_lock with interrupts disabled
      before invoking iscsi_eh_cmd_timed_out. This causes a WARN_ON_ONCE in
      spin_unlock_bh for wrb_lock/io_sgl_lock/mgmt_sgl_lock.
      
      CPU was kept busy in lot of bottom half work with interrupts disabled
      thus causing hard lock up.
      Signed-off-by: default avatarJitendra Bhivare <jitendra.bhivare@broadcom.com>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.com>
      Reviewed-by: default avatarChris Leech <cleech@redhat.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      7d2c0d64
    • Jitendra Bhivare's avatar
      scsi: libiscsi: Fix locking in __iscsi_conn_send_pdu · 4fa50799
      Jitendra Bhivare authored
      The code at free_task label in __iscsi_conn_send_pdu can get executed
      from blk_timeout_work which takes queue_lock using spin_lock_irq.
      back_lock taken with spin_unlock_bh will cause WARN_ON_ONCE.  The code
      gets executed either with bottom half or IRQ disabled hence using
      spin_lock/spin_unlock for back_lock is safe.
      Signed-off-by: default avatarJitendra Bhivare <jitendra.bhivare@broadcom.com>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.com>
      Reviewed-by: default avatarChris Leech <cleech@redhat.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      4fa50799
  11. 14 Oct, 2016 2 commits
    • Brian King's avatar
      scsi: ipr: Fix async error WARN_ON · 8a4236a2
      Brian King authored
      Commit afc3f83c ("scsi: ipr: Add asynchronous error notification")
      introduced the warn on shown below. To fix this, rather than attempting
      to send the KOBJ_CHANGE uevent from interrupt context, which is what is
      causing the WARN_ON, just wake the ipr worker thread which will send a
      KOBJ_CHANGE uevent.
      
      [  142.278120] WARNING: CPU: 15 PID: 0 at kernel/softirq.c:161 __local_bh_enable_ip+0x7c/0xd0
      [  142.278124] Modules linked in: ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ses enclosure scsi_transport_sas sg pseries_rng nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sr_mod sd_mod cdrom ipr libata ibmvscsi scsi_transport_srp ibmveth dm_mirror dm_region_hash dm_log dm_mod
      [  142.278208] CPU: 15 PID: 0 Comm: swapper/15 Not tainted 4.8.0.ipr+ #21
      [  142.278213] task: c00000010cf24480 task.stack: c00000010cfec000
      [  142.278217] NIP: c0000000000c0c7c LR: c000000000881778 CTR: c0000000003c5bf0
      [  142.278221] REGS: c00000010cfef080 TRAP: 0700   Not tainted  (4.8.0.ipr+)
      [  142.278224] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE>  CR: 28008022  XER: 2000000f
      [  142.278236] CFAR: c0000000000c0c20 SOFTE: 0
      GPR00: c000000000706c78 c00000010cfef300 c000000000f91d00 c000000000706c78
      GPR04: 0000000000000200 c000000000f7bc80 0000000000000000 00000000024000c0
      GPR08: 0000000000000000 0000000000000001 c000000000ee1d00 c000000000a9bdd0
      GPR12: c0000000003c5bf0 c00000000eb22d00 c000000100ca3880 c00000020ed38400
      GPR16: 0000000000000000 0000000000000000 c000000100940508 0000000000000000
      GPR20: 0000000000000000 0000000000000000 0000000000000000 00000000024000c0
      GPR24: c0000000004588e0 c00000010863bd00 c00000010863bd00 c0000000013773f8
      GPR28: c000000000f7bc80 0000000000000000 ffffffffffffffff c000000000f7bcd8
      [  142.278290] NIP [c0000000000c0c7c] __local_bh_enable_ip+0x7c/0xd0
      [  142.278296] LR [c000000000881778] _raw_spin_unlock_bh+0x38/0x60
      [  142.278299] Call Trace:
      [  142.278303] [c00000010cfef300] [c000000000f7bc80] init_net+0x0/0x1900 (unreliable)
      [  142.278310] [c00000010cfef320] [c000000000706c78] peernet2id+0x58/0x80
      [  142.278316] [c00000010cfef370] [c00000000075caec] netlink_broadcast_filtered+0x30c/0x550
      [  142.278323] [c00000010cfef430] [c000000000459078] kobject_uevent_env+0x588/0x780
      [  142.278331] [c00000010cfef510] [d000000003163a6c] ipr_process_error+0x11c/0x240 [ipr]
      [  142.278337] [c00000010cfef5c0] [d000000003152298] ipr_fail_all_ops+0x108/0x220 [ipr]
      [  142.278343] [c00000010cfef670] [d0000000031643f8] ipr_reset_restore_cfg_space+0xa8/0x240 [ipr]
      [  142.278350] [c00000010cfef6f0] [d000000003158a00] ipr_reset_ioa_job+0x80/0xe0 [ipr]
      [  142.278356] [c00000010cfef720] [d000000003153f78] ipr_reset_timer_done+0xa8/0xe0 [ipr]
      [  142.278363] [c00000010cfef770] [c000000000149c88] call_timer_fn+0x58/0x1c0
      [  142.278368] [c00000010cfef800] [c000000000149f60] expire_timers+0x140/0x200
      [  142.278373] [c00000010cfef870] [c00000000014a0e8] run_timer_softirq+0xc8/0x230
      [  142.278379] [c00000010cfef900] [c0000000000c0844] __do_softirq+0x164/0x3c0
      [  142.278384] [c00000010cfef9f0] [c0000000000c0f18] irq_exit+0x1a8/0x1c0
      [  142.278389] [c00000010cfefa20] [c000000000020b54] timer_interrupt+0xa4/0xe0
      [  142.278394] [c00000010cfefa50] [c000000000002414] decrementer_common+0x114/0x180
      Signed-off-by: default avatarBrian King <brking@linux.vnet.ibm.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      8a4236a2
    • Dan Carpenter's avatar
      scsi: zfcp: spin_lock_irqsave() is not nestable · e7cb08e8
      Dan Carpenter authored
      We accidentally overwrite the original saved value of "flags" so that we
      can't re-enable IRQs at the end of the function.  Presumably this
      function is mostly called with IRQs disabled or it would be obvious in
      testing.
      
      Fixes: aceeffbb ("zfcp: trace full payload of all SAN records (req,resp,iels)")
      Cc: <stable@vger.kernel.org> #2.6.38+
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarSteffen Maier <maier@linux.vnet.ibm.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      e7cb08e8
  12. 11 Oct, 2016 12 commits
    • Ming Lei's avatar
      scsi: Remove one useless stack variable · 03eb6b8d
      Ming Lei authored
      The local variable of 'devname' in scsi_report_lun_scan() isn't used any
      more, so remove it.
      
      Cc: Christoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarMing Lei <tom.leiming@gmail.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      03eb6b8d
    • Ming Lei's avatar
      scsi: Fix use-after-free · bcd8f2e9
      Ming Lei authored
      This patch fixes one use-after-free report[1] by KASAN.
      
      In __scsi_scan_target(), when a type 31 device is probed,
      SCSI_SCAN_TARGET_PRESENT is returned and the target will be scanned
      again.
      
      Inside the following scsi_report_lun_scan(), one new scsi_device
      instance is allocated, and scsi_probe_and_add_lun() is called again to
      probe the target and still see type 31 device, finally
      __scsi_remove_device() is called to remove & free the device at the end
      of scsi_probe_and_add_lun(), so cause use-after-free in
      scsi_report_lun_scan().
      
      And the following SCSI log can be observed:
      
      	scsi 0:0:2:0: scsi scan: INQUIRY pass 1 length 36
      	scsi 0:0:2:0: scsi scan: INQUIRY successful with code 0x0
      	scsi 0:0:2:0: scsi scan: peripheral device type of 31, no device added
      	scsi 0:0:2:0: scsi scan: Sending REPORT LUNS to (try 0)
      	scsi 0:0:2:0: scsi scan: REPORT LUNS successful (try 0) result 0x0
      	scsi 0:0:2:0: scsi scan: REPORT LUN scan
      	scsi 0:0:2:0: scsi scan: INQUIRY pass 1 length 36
      	scsi 0:0:2:0: scsi scan: INQUIRY successful with code 0x0
      	scsi 0:0:2:0: scsi scan: peripheral device type of 31, no device added
      	BUG: KASAN: use-after-free in __scsi_scan_target+0xbf8/0xe40 at addr ffff88007b44a104
      
      This patch fixes the issue by moving the putting reference at
      the end of scsi_report_lun_scan().
      
      [1] KASAN report
      ==================================================================
      [    3.274597] PM: Adding info for serio:serio1
      [    3.275127] BUG: KASAN: use-after-free in __scsi_scan_target+0xd87/0xdf0 at addr ffff880254d8c304
      [    3.275653] Read of size 4 by task kworker/u10:0/27
      [    3.275903] CPU: 3 PID: 27 Comm: kworker/u10:0 Not tainted 4.8.0 #2121
      [    3.276258] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      [    3.276797] Workqueue: events_unbound async_run_entry_fn
      [    3.277083]  ffff880254d8c380 ffff880259a37870 ffffffff94bbc6c1 ffff880078402d80
      [    3.277532]  ffff880254d8bb80 ffff880259a37898 ffffffff9459fec1 ffff880259a37930
      [    3.277989]  ffff880254d8bb80 ffff880078402d80 ffff880259a37920 ffffffff945a0165
      [    3.278436] Call Trace:
      [    3.278528]  [<ffffffff94bbc6c1>] dump_stack+0x65/0x84
      [    3.278797]  [<ffffffff9459fec1>] kasan_object_err+0x21/0x70
      [    3.279063] device: 'psaux': device_add
      [    3.279616]  [<ffffffff945a0165>] kasan_report_error+0x205/0x500
      [    3.279651] PM: Adding info for No Bus:psaux
      [    3.280202]  [<ffffffff944ecd22>] ? kfree_const+0x22/0x30
      [    3.280486]  [<ffffffff94bc2dc9>] ? kobject_release+0x119/0x370
      [    3.280805]  [<ffffffff945a0543>] __asan_report_load4_noabort+0x43/0x50
      [    3.281170]  [<ffffffff9507e1f7>] ? __scsi_scan_target+0xd87/0xdf0
      [    3.281506]  [<ffffffff9507e1f7>] __scsi_scan_target+0xd87/0xdf0
      [    3.281848]  [<ffffffff9507d470>] ? scsi_add_device+0x30/0x30
      [    3.282156]  [<ffffffff94f7f660>] ? pm_runtime_autosuspend_expiration+0x60/0x60
      [    3.282570]  [<ffffffff956ddb07>] ? _raw_spin_lock+0x17/0x40
      [    3.282880]  [<ffffffff9507e505>] scsi_scan_channel+0x105/0x160
      [    3.283200]  [<ffffffff9507e8a2>] scsi_scan_host_selected+0x212/0x2f0
      [    3.283563]  [<ffffffff9507eb3c>] do_scsi_scan_host+0x1bc/0x250
      [    3.283882]  [<ffffffff9507efc1>] do_scan_async+0x41/0x450
      [    3.284173]  [<ffffffff941c1fee>] async_run_entry_fn+0xfe/0x610
      [    3.284492]  [<ffffffff941a8954>] ? pwq_dec_nr_in_flight+0x124/0x2a0
      [    3.284876]  [<ffffffff941d1770>] ? preempt_count_add+0x130/0x160
      [    3.285207]  [<ffffffff941a9a84>] process_one_work+0x544/0x12d0
      [    3.285526]  [<ffffffff941aa8e9>] worker_thread+0xd9/0x12f0
      [    3.285844]  [<ffffffff941aa810>] ? process_one_work+0x12d0/0x12d0
      [    3.286182]  [<ffffffff941bb365>] kthread+0x1c5/0x260
      [    3.286443]  [<ffffffff940855cd>] ? __switch_to+0x88d/0x1430
      [    3.286745]  [<ffffffff941bb1a0>] ? kthread_worker_fn+0x5a0/0x5a0
      [    3.287085]  [<ffffffff956dde9f>] ret_from_fork+0x1f/0x40
      [    3.287368]  [<ffffffff941bb1a0>] ? kthread_worker_fn+0x5a0/0x5a0
      [    3.287697] Object at ffff880254d8bb80, in cache kmalloc-2048 size: 2048
      [    3.288064] Allocated:
      [    3.288147] PID = 27
      [    3.288218]  [<ffffffff940b27ab>] save_stack_trace+0x2b/0x50
      [    3.288531]  [<ffffffff9459f246>] save_stack+0x46/0xd0
      [    3.288806]  [<ffffffff9459f4bd>] kasan_kmalloc+0xad/0xe0
      [    3.289098]  [<ffffffff9459c07e>] __kmalloc+0x13e/0x250
      [    3.289378]  [<ffffffff95078e5a>] scsi_alloc_sdev+0xea/0xcf0
      [    3.289701]  [<ffffffff9507de76>] __scsi_scan_target+0xa06/0xdf0
      [    3.290034]  [<ffffffff9507e505>] scsi_scan_channel+0x105/0x160
      [    3.290362]  [<ffffffff9507e8a2>] scsi_scan_host_selected+0x212/0x2f0
      [    3.290724]  [<ffffffff9507eb3c>] do_scsi_scan_host+0x1bc/0x250
      [    3.291055]  [<ffffffff9507efc1>] do_scan_async+0x41/0x450
      [    3.291354]  [<ffffffff941c1fee>] async_run_entry_fn+0xfe/0x610
      [    3.291695]  [<ffffffff941a9a84>] process_one_work+0x544/0x12d0
      [    3.292022]  [<ffffffff941aa8e9>] worker_thread+0xd9/0x12f0
      [    3.292325]  [<ffffffff941bb365>] kthread+0x1c5/0x260
      [    3.292594]  [<ffffffff956dde9f>] ret_from_fork+0x1f/0x40
      [    3.292886] Freed:
      [    3.292945] PID = 27
      [    3.293016]  [<ffffffff940b27ab>] save_stack_trace+0x2b/0x50
      [    3.293327]  [<ffffffff9459f246>] save_stack+0x46/0xd0
      [    3.293600]  [<ffffffff9459fa61>] kasan_slab_free+0x71/0xb0
      [    3.293916]  [<ffffffff9459bac2>] kfree+0xa2/0x1f0
      [    3.294168]  [<ffffffff9508158a>] scsi_device_dev_release_usercontext+0x50a/0x730
      [    3.294598]  [<ffffffff941ace9a>] execute_in_process_context+0xda/0x130
      [    3.294974]  [<ffffffff9508107c>] scsi_device_dev_release+0x1c/0x20
      [    3.295322]  [<ffffffff94f566f6>] device_release+0x76/0x1e0
      [    3.295626]  [<ffffffff94bc2db7>] kobject_release+0x107/0x370
      [    3.295942]  [<ffffffff94bc29ce>] kobject_put+0x4e/0xa0
      [    3.296222]  [<ffffffff94f56e17>] put_device+0x17/0x20
      [    3.296497]  [<ffffffff9505201c>] scsi_device_put+0x7c/0xa0
      [    3.296801]  [<ffffffff9507e1bc>] __scsi_scan_target+0xd4c/0xdf0
      [    3.297132]  [<ffffffff9507e505>] scsi_scan_channel+0x105/0x160
      [    3.297458]  [<ffffffff9507e8a2>] scsi_scan_host_selected+0x212/0x2f0
      [    3.297829]  [<ffffffff9507eb3c>] do_scsi_scan_host+0x1bc/0x250
      [    3.298156]  [<ffffffff9507efc1>] do_scan_async+0x41/0x450
      [    3.298453]  [<ffffffff941c1fee>] async_run_entry_fn+0xfe/0x610
      [    3.298777]  [<ffffffff941a9a84>] process_one_work+0x544/0x12d0
      [    3.299105]  [<ffffffff941aa8e9>] worker_thread+0xd9/0x12f0
      [    3.299408]  [<ffffffff941bb365>] kthread+0x1c5/0x260
      [    3.299676]  [<ffffffff956dde9f>] ret_from_fork+0x1f/0x40
      [    3.299967] Memory state around the buggy address:
      [    3.300209]  ffff880254d8c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [    3.300608]  ffff880254d8c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [    3.300986] >ffff880254d8c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [    3.301408]                    ^
      [    3.301550]  ffff880254d8c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [    3.301987]  ffff880254d8c400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [    3.302396]
      ==================================================================
      
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMing Lei <tom.leiming@gmail.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      bcd8f2e9
    • Xose Vazquez Perez's avatar
      scsi: Replace wrong device handler name for CLARiiON arrays · 0ba43a81
      Xose Vazquez Perez authored
      At drivers/scsi/device_handler/scsi_dh_emc.c it was defined as:
      
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Hannes Reinecke <hare@suse.de>
      Cc: Christophe Varoqui <christophe.varoqui@opensvc.com>
      Cc: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
      Cc: Martin K. Petersen <martin.petersen@oracle.com>
      Cc: SCSI ML <linux-scsi@vger.kernel.org>
      Cc: device-mapper development <dm-devel@redhat.com>
      Signed-off-by: default avatarXose Vazquez Perez <xose.vazquez@gmail.com>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      0ba43a81
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · f29135b5
      Linus Torvalds authored
      Pull btrfs updates from Chris Mason:
       "This is a big variety of fixes and cleanups.
      
        Liu Bo continues to fixup fuzzer related problems, and some of Josef's
        cleanups are prep for his bigger extent buffer changes (slated for
        v4.10)"
      
      * 'for-linus-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: (39 commits)
        Revert "btrfs: let btrfs_delete_unused_bgs() to clean relocated bgs"
        Btrfs: remove unnecessary btrfs_mark_buffer_dirty in split_leaf
        Btrfs: don't BUG() during drop snapshot
        btrfs: fix btrfs_no_printk stub helper
        Btrfs: memset to avoid stale content in btree leaf
        btrfs: parent_start initialization cleanup
        btrfs: Remove already completed TODO comment
        btrfs: Do not reassign count in btrfs_run_delayed_refs
        btrfs: fix a possible umount deadlock
        Btrfs: fix memory leak in do_walk_down
        btrfs: btrfs_debug should consume fs_info when DEBUG is not defined
        btrfs: convert send's verbose_printk to btrfs_debug
        btrfs: convert pr_* to btrfs_* where possible
        btrfs: convert printk(KERN_* to use pr_* calls
        btrfs: unsplit printed strings
        btrfs: clean the old superblocks before freeing the device
        Btrfs: kill BUG_ON in run_delayed_tree_ref
        Btrfs: don't leak reloc root nodes on error
        btrfs: squash lines for simple wrapper functions
        Btrfs: improve check_node to avoid reading corrupted nodes
        ...
      f29135b5
    • Linus Torvalds's avatar
      Merge tag 'upstream-4.9-rc1' of git://git.infradead.org/linux-ubifs · 4c609922
      Linus Torvalds authored
      Pull UBI/UBIFS updates from Richard Weinberger:
       "This pull request contains:
      
         - Fixes for both UBI and UBIFS
         - overlayfs support (O_TMPFILE, RENAME_WHITEOUT/EXCHANGE)
         - Code refactoring for the upcoming MLC support"
      
      [ Ugh, we just got rid of the "rename2()" naming for the extended rename
        functionality. And this re-introduces it in ubifs with the cross-
        renaming and whiteout support.
      
        But rather than do any re-organizations in the merge itself, the
        naming can be cleaned up later ]
      
      * tag 'upstream-4.9-rc1' of git://git.infradead.org/linux-ubifs: (27 commits)
        UBIFS: improve function-level documentation
        ubifs: fix host xattr_len when changing xattr
        ubifs: Use move variable in ubifs_rename()
        ubifs: Implement RENAME_EXCHANGE
        ubifs: Implement RENAME_WHITEOUT
        ubifs: Implement O_TMPFILE
        ubi: Fix Fastmap's update_vol()
        ubi: Fix races around ubi_refill_pools()
        ubi: Deal with interrupted erasures in WL
        UBI: introduce the VID buffer concept
        UBI: hide EBA internals
        UBI: provide an helper to query LEB information
        UBI: provide an helper to check whether a LEB is mapped or not
        UBI: add an helper to check lnum validity
        UBI: simplify LEB write and atomic LEB change code
        UBI: simplify recover_peb() code
        UBI: move the global ech and vidh variables into struct ubi_attach_info
        UBI: provide helpers to allocate and free aeb elements
        UBI: fastmap: use ubi_io_{read, write}_data() instead of ubi_io_{read, write}()
        UBI: fastmap: use ubi_rb_for_each_entry() in unmap_peb()
        ...
      4c609922
    • Al Viro's avatar
      Fix off-by-one in __pipe_get_pages() · 1689c73a
      Al Viro authored
      it actually worked only when requested area ended on the page boundary...
      Reported-by: default avatarMarco Grassi <marco.gra@gmail.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1689c73a
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 6b5e09a7
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Netfilter list handling fix, from Linus.
      
       2) RXRPC/AFS bug fixes from David Howells (oops on call to serviceless
          endpoints, build warnings, missing notifications, etc.) From David
          Howells.
      
       3) Kernel log message missing newlines, from Colin Ian King.
      
       4) Don't enter direct reclaim in netlink dumps, the idea is to use a
          high order allocation first and fallback quickly to a 0-order
          allocation if such a high-order one cannot be done cheaply and
          without reclaim. From Eric Dumazet.
      
       5) Fix firmware download errors in btusb bluetooth driver, from Ethan
          Hsieh.
      
       6) Missing Kconfig deps for QCOM_EMAC, from Geert Uytterhoeven.
      
       7) Fix MDIO_XGENE dup Kconfig entry. From Laura Abbott.
      
       8) Constrain ipv6 rtr_solicits sysctl values properly, from Maciej
          Żenczykowski.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (65 commits)
        netfilter: Fix slab corruption.
        be2net: Enable VF link state setting for BE3
        be2net: Fix TX stats for TSO packets
        be2net: Update Copyright string in be_hw.h
        be2net: NCSI FW section should be properly updated with ethtool for BE3
        be2net: Provide an alternate way to read pf_num for BEx chips
        wan/fsl_ucc_hdlc: Fix size used in dma_free_coherent()
        net: macb: NULL out phydev after removing mdio bus
        xen-netback: make sure that hashes are not send to unaware frontends
        Fixing a bug in team driver due to incorrect 'unsigned int' to 'int' conversion
        MAINTAINERS: add myself as a maintainer of xen-netback
        ipv6 addrconf: disallow rtr_solicits < -1
        Bluetooth: btusb: Fix atheros firmware download error
        drivers: net: phy: Correct duplicate MDIO_XGENE entry
        ethernet: qualcomm: QCOM_EMAC should depend on HAS_DMA and HAS_IOMEM
        net: ethernet: mediatek: remove hwlro property in the device tree
        net: ethernet: mediatek: get hw lro capability by the chip id instead of by the dtsi
        net: ethernet: mediatek: get the chip id by ETHDMASYS registers
        net: bgmac: Fix errant feature flag check
        netlink: do not enter direct reclaim from netlink_dump()
        ...
      6b5e09a7
    • Linus Torvalds's avatar
      netfilter: Fix slab corruption. · bd3769bf
      Linus Torvalds authored
      Use the correct pattern for singly linked list insertion and
      deletion.  We can also calculate the list head outside of the
      mutex.
      
      Fixes: e3b37f11 ("netfilter: replace list_head with single linked list")
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Reviewed-by: default avatarAaron Conole <aconole@bytheb.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      
      net/netfilter/core.c | 108 ++++++++++++++++-----------------------------------
       1 file changed, 33 insertions(+), 75 deletions(-)
      bd3769bf
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 101105b1
      Linus Torvalds authored
      Pull more vfs updates from Al Viro:
       ">rename2() work from Miklos + current_time() from Deepa"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        fs: Replace current_fs_time() with current_time()
        fs: Replace CURRENT_TIME_SEC with current_time() for inode timestamps
        fs: Replace CURRENT_TIME with current_time() for inode timestamps
        fs: proc: Delete inode time initializations in proc_alloc_inode()
        vfs: Add current_time() api
        vfs: add note about i_op->rename changes to porting
        fs: rename "rename2" i_op to "rename"
        vfs: remove unused i_op->rename
        fs: make remaining filesystems use .rename2
        libfs: support RENAME_NOREPLACE in simple_rename()
        fs: support RENAME_NOREPLACE for local filesystems
        ncpfs: fix unused variable warning
      101105b1
    • Al Viro's avatar
      3873691e
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20161008' of git://git.infradead.org/linux-mtd · 35ff96df
      Linus Torvalds authored
      Pull MTD updates from Brian Norris:
       "I've not been very active this cycle, so these are mostly from Boris,
        for the NAND flash subsystem.
      
        NAND:
      
         - Add the infrastructure to automate NAND timings configuration
      
         - Provide a generic DT property to maximize ECC strength
      
         - Some refactoring in the core bad block table handling, to help with
           improving some of the logic in error cases.
      
         - Minor cleanups and fixes
      
        MTD:
      
         - Add APIs for handling page pairing; this is necessary for reliably
           supporting MLC and TLC NAND flash, where paired-page disturbance
           affects reliability. Upper layers (e.g., UBI) should make use of
           these in the near future"
      
      * tag 'for-linus-20161008' of git://git.infradead.org/linux-mtd: (35 commits)
        mtd: nand: fix trivial spelling error
        mtdpart: Propagate _get/put_device()
        mtd: nand: Provide nand_cleanup() function to free NAND related resources
        mtd: Kill the OF_MTD Kconfig option
        mtd: nand: mxc: Test CONFIG_OF instead of CONFIG_OF_MTD
        mtd: nand: Fix nand_command_lp() for 8bits opcodes
        mtd: nand: sunxi: Support ECC maximization
        mtd: nand: Support maximizing ECC when using software BCH
        mtd: nand: Add an option to maximize the ECC strength
        mtd: nand: mxc: Add timing setup for v2 controllers
        mtd: nand: mxc: implement onfi get/set features
        mtd: nand: sunxi: switch from manual to automated timing config
        mtd: nand: automate NAND timings selection
        mtd: nand: Expose data interface for ONFI mode 0
        mtd: nand: Add function to convert ONFI mode to data_interface
        mtd: nand: convert ONFI mode into data interface
        mtd: nand: Introduce nand_data_interface
        mtd: nand: Create a NAND reset function
        mtd: nand: remove unnecessary 'extern' from function declarations
        MAINTAINERS: Add maintainer entry for Ingenic JZ4780 NAND driver
        ...
      35ff96df
    • Linus Torvalds's avatar
      Merge branch 'work.xattr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 97d21167
      Linus Torvalds authored
      Pull vfs xattr updates from Al Viro:
       "xattr stuff from Andreas
      
        This completes the switch to xattr_handler ->get()/->set() from
        ->getxattr/->setxattr/->removexattr"
      
      * 'work.xattr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        vfs: Remove {get,set,remove}xattr inode operations
        xattr: Stop calling {get,set,remove}xattr inode operations
        vfs: Check for the IOP_XATTR flag in listxattr
        xattr: Add __vfs_{get,set,remove}xattr helpers
        libfs: Use IOP_XATTR flag for empty directory handling
        vfs: Use IOP_XATTR flag for bad-inode handling
        vfs: Add IOP_XATTR inode operations flag
        vfs: Move xattr_resolve_name to the front of fs/xattr.c
        ecryptfs: Switch to generic xattr handlers
        sockfs: Get rid of getxattr iop
        sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names
        kernfs: Switch to generic xattr handlers
        hfs: Switch to generic xattr handlers
        jffs2: Remove jffs2_{get,set,remove}xattr macros
        xattr: Remove unnecessary NULL attribute name check
      97d21167
  13. 10 Oct, 2016 4 commits
    • Linus Torvalds's avatar
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · 30066ce6
      Linus Torvalds authored
      Pull crypto updates from Herbert Xu:
       "Here is the crypto update for 4.9:
      
        API:
         - The crypto engine code now supports hashes.
      
        Algorithms:
         - Allow keys >= 2048 bits in FIPS mode for RSA.
      
        Drivers:
         - Memory overwrite fix for vmx ghash.
         - Add support for building ARM sha1-neon in Thumb2 mode.
         - Reenable ARM ghash-ce code by adding import/export.
         - Reenable img-hash by adding import/export.
         - Add support for multiple cores in omap-aes.
         - Add little-endian support for sha1-powerpc.
         - Add Cavium HWRNG driver for ThunderX SoC"
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (137 commits)
        crypto: caam - treat SGT address pointer as u64
        crypto: ccp - Make syslog errors human-readable
        crypto: ccp - clean up data structure
        crypto: vmx - Ensure ghash-generic is enabled
        crypto: testmgr - add guard to dst buffer for ahash_export
        crypto: caam - Unmap region obtained by of_iomap
        crypto: sha1-powerpc - little-endian support
        crypto: gcm - Fix IV buffer size in crypto_gcm_setkey
        crypto: vmx - Fix memory corruption caused by p8_ghash
        crypto: ghash-generic - move common definitions to a new header file
        crypto: caam - fix sg dump
        hwrng: omap - Only fail if pm_runtime_get_sync returns < 0
        crypto: omap-sham - shrink the internal buffer size
        crypto: omap-sham - add support for export/import
        crypto: omap-sham - convert driver logic to use sgs for data xmit
        crypto: omap-sham - change the DMA threshold value to a define
        crypto: omap-sham - add support functions for sg based data handling
        crypto: omap-sham - rename sgl to sgl_tmp for deprecation
        crypto: omap-sham - align algorithms on word offset
        crypto: omap-sham - add context export/import stubs
        ...
      30066ce6
    • Linus Torvalds's avatar
      Merge tag 'dlm-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm · 6763afe4
      Linus Torvalds authored
      Pull dlm fix from David Teigland:
       "This includes a bug fix for a bad memory access during workqueue
        cleanup, which can happen while shutting down the dlm networking
        layer"
      
      * tag 'dlm-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm:
        dlm: free workqueues after the connections
      6763afe4
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-4.9-rc1' of git://github.com/ceph/ceph-client · 8dfb790b
      Linus Torvalds authored
      Pull Ceph updates from Ilya Dryomov:
       "The big ticket item here is support for rbd exclusive-lock feature,
        with maintenance operations offloaded to userspace (Douglas Fuller,
        Mike Christie and myself). Another block device bullet is a series
        fixing up layering error paths (myself).
      
        On the filesystem side, we've got patches that improve our handling of
        buffered vs dio write races (Neil Brown) and a few assorted fixes from
        Zheng. Also included a couple of random cleanups and a minor CRUSH
        update"
      
      * tag 'ceph-for-4.9-rc1' of git://github.com/ceph/ceph-client: (39 commits)
        crush: remove redundant local variable
        crush: don't normalize input of crush_ln iteratively
        libceph: ceph_build_auth() doesn't need ceph_auth_build_hello()
        libceph: use CEPH_AUTH_UNKNOWN in ceph_auth_build_hello()
        ceph: fix description for rsize and rasize mount options
        rbd: use kmalloc_array() in rbd_header_from_disk()
        ceph: use list_move instead of list_del/list_add
        ceph: handle CEPH_SESSION_REJECT message
        ceph: avoid accessing / when mounting a subpath
        ceph: fix mandatory flock check
        ceph: remove warning when ceph_releasepage() is called on dirty page
        ceph: ignore error from invalidate_inode_pages2_range() in direct write
        ceph: fix error handling of start_read()
        rbd: add rbd_obj_request_error() helper
        rbd: img_data requests don't own their page array
        rbd: don't call rbd_osd_req_format_read() for !img_data requests
        rbd: rework rbd_img_obj_exists_submit() error paths
        rbd: don't crash or leak on errors in rbd_img_obj_parent_read_full_callback()
        rbd: move bumping img_request refcount into rbd_obj_request_submit()
        rbd: mark the original request as done if stat request fails
        ...
      8dfb790b
    • Chris Mason's avatar
      Revert "btrfs: let btrfs_delete_unused_bgs() to clean relocated bgs" · 19c4d2f9
      Chris Mason authored
      This reverts commit 5d8eb6fe.
      
      When we remove devices, we free the device structures.  Delaying
      btfs_remove_chunk() ends up hitting a use-after-free on them.
      Signed-off-by: default avatarChris Mason <clm@fb.com>
      19c4d2f9