2726 Commits

Author	SHA1	Message	Date
Nathan Chancellor	ab94de8fcf	This is the 3.10.108 stable release ... -----BEGIN PGP SIGNATURE----- iQIcBAABAgAGBQJZ/kCIAAoJEE44bZycYXAvRXwQAIZY4bXFnlvl8qJZLd8GV6gT 8FErDT14eHKBXZUe1a4TFFJ4FU/dVWfPEPJf2k/aotqjwEysxy5MhOApun12ZbF4 nL6ahNemhNxdIRQFVKBw6HCLyqNwbeBSD3ycLd6FNio4Xxz+3UHO1hoVEbTPSGOf XD+100wsV3CHvoCnkmoGXH4PiD1zaNVPwJEh4Fu6yVJQPXDilszTNZgVv4oujhsZ zp7Si3SpttfojkOcWgyqrV7jg2ALZxagf4SZ0KbbpwM/5fKEpYtC3sDDE3HyvcVm CN0ApTIg7xnuaPsDMwHU9EGLVwlAZEAeiWtR2Byg1YoRQ7mEP9PfkP9xJv9YPxvP Ovy7CqezRFjjscVsvrWScFaVtsdYbnT9e5uw2N3yLimHEKy+37x333gLCpbr+/0c gsJMJMYTiq1MYUTpa+qf+rB0lQVo972+7FsjOs4ovdy+IJrpgMnKaL6U8drOns7t Nmyf1cZTC6YPELnEA8LiRCRsi26HHA6Tknu8Nu2/uOEjeYD0y9iVivptwDB2W35Q cECNGSJ85qCob73WDYB5ErGQCTwIm0PTdjzEvjCTxRooT164uhzfr0BdIWhIsdV5 uPNnkTYj3PkDlMGHhjVARI32In/VQyuf7hsugpVPn4/wKZV3jGJ/rMugAR2eSfTn TFrKUsUdH0DYPZKgIhh8 =wa9B -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEJDfLduVEy2qz2d/TmXOSYMtstxYFAlpqfQ0ACgkQmXOSYMts txZ98RAAjyab1BYfLJMVklDBqzIIWnBqniRPOCReTZ3f+4KDwFVPl5wVT89DHci/ ooIonHqI1BKKuYDIgTL7idK6vGTFo6bTpUT8FZvsjU0V3mFYySA4Yo9aC5G6nXW9 w/dkaOpX1jtkMTukiAqENryBDs7gYXZ0sbqxnq7pgrnnDepVUStZ7ncoWYdxOADG E6Mirskj5fE/MHsVAenYtVmJVFDlvj6P04MT5bGL9e5EIz5CP3ekOqasdsBWj6rE yg1JOaH6eOsgSCsP7M9dGxYglKH9nfkJHRnlU3HbXrRdSupTRvs8zC6u9W0DDI2g XlrDTIM2UAM1hhRFMhly41o+8zpGHTi8puLJsNYL6bRM33V678dNrnEr/xnzNGpR QwC38JWJYymGTkUtW7J1T/GVlWbsF17/fJ5EBG9hSHphrtSjP0nF1i1dAo/MI6hb IY+MxVzO3CTZ22Bwjg9DNz56V+RUg56xy//sHSz3GoI6kuFt4tYzwNmLf0Fkj5VJ lEI6vDYW/YTlWFFGdNaycvVwj+uETKepx0MIPx2Xt/mY3YNPwMUA2EBfjew+6709 cbTkn/XxcIZTzZmqKsZ/wZkDK7hKatdlxbcqI2tzidL03MfC3nK83L3YGrJnpbXd TU/kR3CWWFVgG574B24ssutT4nrYeHUBp+xGDcQSnwbmihig6NU= =pENk -----END PGP SIGNATURE----- Merge 3.10.108 into android-msm-bullhead-3.10-oreo-m5 Changes in 3.10.108: (141 commits) ipvs: SNAT packet replies only for NATed connections net: reduce skb_warn_bad_offload() noise net: skb_needs_check() accepts CHECKSUM_NONE for tx Staging: comedi: comedi_fops: Avoid orphaned proc entry udp: consistently apply ufo or fragmentation Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket tcp: introduce tcp_rto_delta_us() helper for xmit timer fix tcp: enable xmit timer fix by having TLP use time when RTO should fire tcp: fix xmit timer to only be reset if data ACKed/SACKed mm/page_alloc: Remove kernel address exposure in free_reserved_area() leak in O_DIRECT readv past the EOF usb: renesas_usbhs: fix the behavior of some usbhs_pkt_handle usb: renesas_usbhs: fix the sequence in xfer_work() usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet fs/exec.c: account for argv/envp pointers rxrpc: Fix several cases where a padded len isn't checked in ticket decode xfrm: policy: check policy direction value nl80211: check for the required netlink attributes presence ALSA: seq: Fix use-after-free at creating a port MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn' serial: ifx6x60: fix use-after-free on module unload KEYS: fix dereferencing NULL payload with nonzero length usb: chipidea: debug: check before accessing ci_role cpufreq: conservative: Allow down_threshold to take values from 1 to 10 powerpc/kprobes: Pause function_graph tracing during jprobes handling staging: comedi: fix clean-up of comedi_class in comedi_init() brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() vt: fix unchecked __put_user() in tioclinux ioctls crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD PM / Domains: Fix unsafe iteration over modified list of device links powerpc/64: Fix atomic64_inc_not_zero() to return an int powerpc: Fix emulation of mfocrf in emulate_step() powerpc/asm: Mark cr0 as clobbered in mftb() usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL MIPS: Actually decode JALX in `__compute_return_epc_for_insn' MIPS: Fix unaligned PC interpretation in `compute_return_epc' MIPS: math-emu: Prevent wrong ISA mode instruction emulation libata: array underflow in ata_find_dev() workqueue: restore WQ_UNBOUND/max_active==1 to be ordered ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize ext4: fix overflow caused by missing cast in ext4_resize_fs() media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl target: Avoid mappedlun symlink creation during lun shutdown fuse: initialize the flock flag in fuse_file on allocation scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path scsi: zfcp: fix missing trace records for early returns in TMF eh handlers scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction iommu/amd: Finish TLB flush in amd_iommu_unmap() direct-io: Prevent NULL pointer access in submit_page_section USB: serial: console: fix use-after-free after failed setup KEYS: don't let add_key() update an uninstantiated key FS-Cache: fix dereference of NULL user_key_payload ext4: keep existing extra fields when inode expands MIPS: Fix mips_atomic_set() retry condition KEYS: prevent creating a different user's keyrings KEYS: encrypted: fix dereference of NULL user_key_payload md/bitmap: disable bitmap_resize for file-backed bitmaps. lib/digsig: fix dereference of NULL user_key_payload netfilter: invoke synchronize_rcu after set the _hook_ to NULL md/raid10: submit bio directly to replacement disk md: fix super_offset endianness in super_1_rdev_size_change lib/cmdline.c: fix get_options() overflow while parsing ranges ext4: fix SEEK_HOLE net: prevent sign extension in dev_get_stats() kernel/extable.c: mark core_kernel_text notrace wext: handle NULL extra data in iwe_stream_add_point better netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets ext4: avoid deadlock when expanding inode size sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}() sctp: fix the check for _sctp_walk_params and _sctp_walk_errors sctp: fully initialize the IPv6 address in sctp_v6_to_addr() sctp: potential read out of bounds in sctp_ulpevent_type_enabled() tcp: disallow cwnd undo when switching congestion control netfilter: xt_TCPMSS: add more sanity tests on tcph->doff tcp: reset sk_rx_dst in tcp_disconnect() tcp: avoid setting cwnd to invalid ssthresh after cwnd reduction states tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 net/packet: check length in getsockopt() called with PACKET_HDRLEN net: Set sk_prot_creator when cloning sockets to the right proto net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev x86/io: Add "memory" clobber to insb/insw/insl/outsb/outsw/outsl kvm: async_pf: fix rcu_irq_enter() with irqs enabled net: ping: do not abuse udp_poll() scsi: qla2xxx: don't disable a not previously enabled PCI device drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve() net: xilinx_emaclite: fix receive buffer overflow serial: efm32: Fix parity management in 'efm32_uart_console_get_options()' x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init() mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode pvrusb2: reduce stack usage pvr2_eeprom_analyze() usb: r8a66597-hcd: select a different endpoint on timeout usb: r8a66597-hcd: decrease timeout drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR() net: phy: fix marvell phy status reading net: korina: Fix NAPI versus resources freeing xfrm: NULL dereference on allocation failure xfrm: Oops on error in pfkey_msg2xfrm_state() cpufreq: s3c2416: double free on driver init error path KVM: x86: zero base3 of unusable segments KEYS: Fix an error code in request_master_key() ipv6: avoid unregistering inet6_dev for loopback cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES cfg80211: Check if PMKID attribute is of expected size mm: fix overflow check in expand_upwards() crypto: caam - fix signals handling ir-core: fix gcc-7 warning on bool arithmetic udf: Fix deadlock between writeback and udf_setsize() perf annotate: Fix broken arrow at row 0 connecting jmp instruction to its target net/mlx4: Remove BUG_ON from ICM allocation routine ipv4: initialize fib_trie prior to register_netdev_notifier call. workqueue: implicit ordered attribute should be overridable packet: fix tp_reserve race in packet_set_ring staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read ALSA: core: Fix unexpected error at replacing user TLV ACPI / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal qlge: avoid memcpy buffer overflow ipv6: fix memory leak with multiple tables during netns destruction ipv6: fix typo in fib6_net_exit() ip6_gre: fix endianness errors in ip6gre_err crypto: AF_ALG - remove SGL terminator indicator when chaining scsi: qla2xxx: Fix an integer overflow in sysfs code tracing: Apply trace_clock changes to instance max buffer tracing: Erase irqsoff trace with empty write btrfs: prevent to set invalid default subvolid IB/ipoib: rtnl_unlock can not come after free_netdev team: fix memory leaks IB/qib: fix false-postive maybe-uninitialized warning KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options scsi: scsi_dh_emc: return success in clariion_std_inquiry() can: esd_usb2: Fix can_dlc value for received RTR, frames x86/apic: fix build breakage caused by incomplete backport to 3.10 Linux 3.10.108 Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>	2018-01-25 17:57:49 -07:00
Nathan Chancellor	8eef28437c	This is the 3.10.107 stable release ... -----BEGIN PGP SIGNATURE----- iQIcBAABAgAGBQJZUiosAAoJEE44bZycYXAvcHYP/1OKMYQB/3G7GfEhMXdlpV31 VjdzUg5X1JOE60anYNopvWQJgDFXMy9mTceUI3axDkfYb5iDFUpRBFEh70ggDL04 bGB/J4n2Linjkj35u+S5P3fK6qBfg9+VDpTfUYPZGB5YjOjmaD06E8InBF8iUuC3 6pkMtQKOptmKOc2hw84PsB3qm9ER2MMa92Lrs1rtcOihEqQMyKjkI/kzogs8XGje 5gMt31VweScZed3d7i1r9tl/DTmzGcpEyVpz/x8gI7Xwi69FeeLy6cWbhK0VOsLA u7ul9mDa77bUC/jpBzJmIkS8fhzaTyUw8NQbtol9RSSIfzb+mvXyx9Vr7o4LYK2B P6AekC16x6R8KUED1hfxKdagguRACDfKf91bMAxDCN/PXqITVbk3RxxxH6wHAvOx Ihf4G5h800/ks6X1oMBYZcbFFbNCUHZjyL7V1M/iy1TrKuRhEtou4Ft3X+gOauLS CG8VR9Jo1/BAvMaJmy5Hg9RPNoxEMstDi6x3ugD0wH57XHSZ5QmFMBzCbuWR6hWM q1DvBK/I54BXlsdYU9WySn1hm2gKCNPZ+zGzLTo1l426vme+YjhC5911V7Tv+WHm lc5FTXWtXGhoAZuNSIGDrlv3Dyq44iMNrqXrhlPmJjWD3Hx4hFGGp2GyHOpK+5+7 7egPk9m1WrhUKzA9m1/M =InCr -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEJDfLduVEy2qz2d/TmXOSYMtstxYFAlpqfQUACgkQmXOSYMts txZNghAApD/SW4fTOx6RZFCPVjAP70FfXvZsQYf3Zfp44Ytm2Kax3GIABPuknlI+ IZRAPnXb6KP8DNDdCyGcJ0avI5uw96sXyeZWlDZyeS1WHHizJq3+BLB09zzdegSk K1dJrobXCYNESmcQMT5diGwqLYkdOs3hh7Ehqut29njwCzVzNG3n43H9F15o9cUZ 6lAM8/Zb6ai+0KgVgwC40QJneVltDEFfXVr6wo/IJXnYNaRCPKQM5lsG09pxxopG NVSsmUyeJI5bPWEm5vbuBL2JVhaCcMtTfAPHflqbtykE8eSVEWdTeCWPuGWcATB+ 2sGp3cVR2W7+4CHpbcnrXolmP/OI3jXHbG1LvyRqg4Iw1jgtZ8wwjCEkdsPz3fED g2+EtSYl/NLW7N8P4KQV9jzihYIfELBj9HQsEs5aPOstyjyxl12RxJvjw835v5ts oa7qKQAHIwZsuaB34qK+DjI5coNeKRvDMy5mm0GL3TqmLLFEzSVpaTceGpdvNLi0 6k3RkuJzU0TwAoTShWyYu6AbV+8aHniBQbjzYs5sufRgDy9pjnfWzDqtUM+chTsm WaxwhpHdpOomwAfZr8/Zaf0xIxP/M99SFKevntE04Ft93P8dKuLqFcNAjQkMdibY UHrJ67nBllmDtlH8yGO9j4FD89O0QaBX4J3qGyIu5eE73/iibvo= =J7vi -----END PGP SIGNATURE----- Merge 3.10.107 into android-msm-bullhead-3.10-oreo-m5 Changes in 3.10.107: (270 commits) Revert "Btrfs: don't delay inode ref updates during log, replay" Btrfs: fix memory leak in reading btree blocks ext4: use more strict checks for inodes_per_block on mount ext4: fix in-superblock mount options processing ext4: add sanity checking to count_overhead() ext4: validate s_first_meta_bg at mount time jbd2: don't leak modified metadata buffers on an aborted journal ext4: fix fencepost in s_first_meta_bg validation ext4: trim allocation requests to group size ext4: preserve the needs_recovery flag when the journal is aborted ext4: return EROFS if device is r/o and journal replay is needed ext4: fix inode checksum calculation problem if i_extra_size is small block: fix use-after-free in sys_ioprio_get() block: allow WRITE_SAME commands with the SG_IO ioctl block: fix del_gendisk() vs blkdev_ioctl crash dm crypt: mark key as invalid until properly loaded dm space map metadata: fix 'struct sm_metadata' leak on failed create md/raid5: limit request size according to implementation limits md:raid1: fix a dead loop when read from a WriteMostly disk md linear: fix a race between linear_add() and linear_congested() CIFS: Fix a possible memory corruption during reconnect CIFS: Fix missing nls unload in smb2_reconnect() CIFS: Fix a possible memory corruption in push locks CIFS: remove bad_network_name flag fs/cifs: make share unaccessible at root level mountable cifs: Do not send echoes before Negotiate is complete ocfs2: fix crash caused by stale lvb with fsdlm plugin ocfs2: fix BUG_ON() in ocfs2_ci_checkpointed() can: raw: raw_setsockopt: limit number of can_filter that can be set can: peak: fix bad memory access and free sequence can: c_can_pci: fix null-pointer-deref in c_can_start() - set device pointer can: ti_hecc: add missing prepare and unprepare of the clock can: bcm: fix hrtimer/tasklet termination in bcm op removal can: usb_8dev: Fix memory leak of priv->cmd_msg_buffer ALSA: hda - Fix up GPIO for ASUS ROG Ranger ALSA: seq: Fix race at creating a queue ALSA: seq: Don't handle loop timeout at snd_seq_pool_done() ALSA: timer: Reject user params with too small ticks ALSA: seq: Fix link corruption by event error handling ALSA: seq: Fix racy cell insertions during snd_seq_pool_done() ALSA: seq: Fix race during FIFO resize ALSA: seq: Don't break snd_use_lock_sync() loop by timeout ALSA: usb-audio: Add QuickCam Communicate Deluxe/S7500 to volume_control_quirks usb: gadgetfs: restrict upper bound on device configuration size USB: gadgetfs: fix unbounded memory allocation bug USB: gadgetfs: fix use-after-free bug USB: gadgetfs: fix checks of wTotalLength in config descriptors xhci: free xhci virtual devices with leaf nodes first USB: serial: io_ti: bind to interface after fw download usb: gadget: composite: always set ep->mult to a sensible value USB: cdc-acm: fix double usb_autopm_put_interface() in acm_port_activate() USB: cdc-acm: fix open and suspend race USB: cdc-acm: fix failed open not being detected usb: dwc3: gadget: make Set Endpoint Configuration macros safe usb: host: xhci-plat: Fix timeout on removal of hot pluggable xhci controllers usb: dwc3: gadget: delay unmap of bounced requests usb: hub: Wait for connection to be reestablished after port reset usb: gadget: composite: correctly initialize ep->maxpacket USB: UHCI: report non-PME wakeup signalling for Intel hardware arm/xen: Use alloc_percpu rather than __alloc_percpu xfs: set AGI buffer type in xlog_recover_clear_agi_bucket xfs: clear _XBF_PAGES from buffers when readahead page ssb: Fix error routine when fallback SPROM fails drivers/gpu/drm/ast: Fix infinite loop if read fails scsi: avoid a permanent stop of the scsi device's request queue scsi: move the nr_phys_segments assert into scsi_init_io scsi: don't BUG_ON() empty DMA transfers scsi: storvsc: properly handle SRB_ERROR when sense message is present scsi: storvsc: properly set residual data length on errors target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export scsi: lpfc: Add shutdown method for kexec scsi: sr: Sanity check returned mode data scsi: sd: Fix capacity calculation with 32-bit sector_t s390/vmlogrdr: fix IUCV buffer allocation libceph: verify authorize reply on connect nfs_write_end(): fix handling of short copies powerpc/ps3: Fix system hang with GCC 5 builds sg_write()/bsg_write() is not fit to be called under KERNEL_DS ftrace/x86: Set ftrace_stub to weak to prevent gcc from using short jumps to it cred/userns: define current_user_ns() as a function net: ti: cpmac: Fix compiler warning due to type confusion tick/broadcast: Prevent NULL pointer dereference netvsc: reduce maximum GSO size drop_monitor: add missing call to genlmsg_end drop_monitor: consider inserted data in genlmsg_end igmp: Make igmp group member RFC 3376 compliant HID: hid-cypress: validate length of report Input: xpad - use correct product id for x360w controllers Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000 Input: iforce - validate number of endpoints before using them Input: kbtab - validate number of endpoints before using them Input: joydev - do not report stale values on first open Input: tca8418 - use the interrupt trigger from the device tree Input: mpr121 - handle multiple bits change of status register Input: mpr121 - set missing event capability Input: i8042 - add Clevo P650RS to the i8042 reset list i2c: fix kernel memory disclosure in dev interface vme: Fix wrong pointer utilization in ca91cx42_slave_get sysrq: attach sysrq handler correctly for 32-bit kernel pinctrl: sh-pfc: Do not unconditionally support PIN_CONFIG_BIAS_DISABLE x86/PCI: Ignore _CRS on Supermicro X8DTH-i/6/iF/6F qla2xxx: Fix crash due to null pointer access ARM: 8634/1: hw_breakpoint: blacklist Scorpion CPUs ARM: dts: da850-evm: fix read access to SPI flash NFSv4: Ensure nfs_atomic_open set the dentry verifier on ENOENT vmxnet3: Wake queue from reset work Fix memory leaks in cifs_do_mount() Compare prepaths when comparing superblocks Move check for prefix path to within cifs_get_root() Fix regression which breaks DFS mounting apparmor: fix uninitialized lsm_audit member apparmor: exec should not be returning ENOENT when it denies apparmor: fix disconnected bind mnts reconnection apparmor: internal paths should be treated as disconnected apparmor: check that xindex is in trans_table bounds apparmor: add missing id bounds check on dfa verification apparmor: don't check for vmalloc_addr if kvzalloc() failed apparmor: fix oops in profile_unpack() when policy_db is not present apparmor: fix module parameters can be changed after policy is locked apparmor: do not expose kernel stack vfio/pci: Fix integer overflows, bitmask check bna: Add synchronization for tx ring. sg: Fix double-free when drives detach during SG_IO move the call of __d_drop(anon) into __d_materialise_unique(dentry, anon) serial: 8250_pci: Detach low-level driver during PCI error recovery bnx2x: Correct ringparam estimate when DOWN tile/ptrace: Preserve previous registers for short regset write sysctl: fix proc_doulongvec_ms_jiffies_minmax() ISDN: eicon: silence misleading array-bounds warning ARC: [arcompact] handle unaligned access delay slot corner case parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header nfs: Don't increment lock sequence ID after NFS4ERR_MOVED ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side lock af_unix: move unix_mknod() out of bindlock drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval crypto: api - Clear CRYPTO_ALG_DEAD bit before registering an alg ata: sata_mv:- Handle return value of devm_ioremap. mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone() mm, fs: check for fatal signals in do_generic_file_read() ARC: [arcompact] brown paper bag bug in unaligned access delay slot fixup sched/debug: Don't dump sched debug info in SysRq-W tcp: fix 0 divide in __tcp_select_window() macvtap: read vnet_hdr_size once packet: round up linear to header len vfs: fix uninitialized flags in splice_to_pipe() siano: make it work again with CONFIG_VMAP_STACK futex: Move futex_init() to core_initcall rtc: interface: ignore expired timers when enqueuing new timers irda: Fix lockdep annotations in hashbin_delete(). tty: serial: msm: Fix module autoload rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down af_packet: remove a stray tab in packet_set_ring() MIPS: Fix special case in 64 bit IP checksumming. mm: vmpressure: fix sending wrong events on underflow ipc/shm: Fix shmat mmap nil-page protection sd: get disk reference in sd_check_events() samples/seccomp: fix 64-bit comparison macros ath5k: drop bogus warning on drv_set_key with unsupported cipher rdma_cm: fail iwarp accepts w/o connection params NFSv4: fix getacl ERANGE for some ACL buffer sizes bcma: use (get|put)_device when probing/removing device driver powerpc/xmon: Fix data-breakpoint KVM: VMX: use correct vmcs_read/write for guest segment selector/base KVM: PPC: Book3S PR: Fix illegal opcode emulation KVM: s390: fix task size check s390: TASK_SIZE for kernel threads xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD mac80211: flush delayed work when entering suspend drm/ast: Fix test for VGA enabled drm/ttm: Make sure BOs being swapped out are cacheable fat: fix using uninitialized fields of fat_inode/fsinfo_inode drivers: hv: Turn off write permission on the hypercall page xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers crypto: improve gcc optimization flags for serpent and wp512 mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy cpmac: remove hopeless #warning mvsas: fix misleading indentation l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv net: don't call strlen() on the user buffer in packet_bind_spkt() dccp: Unlock sock before calling sk_free() tcp: fix various issues for sockets morphing to listen state uapi: fix linux/packet_diag.h userspace compilation error ipv6: avoid write to a possibly cloned skb dccp: fix memory leak during tear-down of unsuccessful connection request futex: Fix potential use-after-free in FUTEX_REQUEUE_PI futex: Add missing error handling to FUTEX_REQUEUE_PI give up on gcc ilog2() constant optimizations cancel the setfilesize transation when io error happen crypto: ghash-clmulni - Fix load failure crypto: cryptd - Assign statesize properly ACPI / video: skip evaluating _DOD when it does not exist Drivers: hv: balloon: don't crash when memory is added in non-sorted order s390/pci: fix use after free in dma_init cpufreq: Fix and clean up show_cpuinfo_cur_freq() igb: Workaround for igb i210 firmware issue igb: add i211 to i210 PHY workaround ipv4: provide stronger user input validation in nl_fib_input() tcp: initialize icsk_ack.lrcvtime at session start time ACM gadget: fix endianness in notifications mmc: sdhci: Do not disable interrupts while waiting for clock uvcvideo: uvc_scan_fallback() for webcams with broken chain fbcon: Fix vc attr at deinit crypto: algif_hash - avoid zero-sized array virtio_balloon: init 1st buffer in stats vq c6x/ptrace: Remove useless PTRACE_SETREGSET implementation sparc/ptrace: Preserve previous registers for short regset write metag/ptrace: Preserve previous registers for short regset write metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS metag/ptrace: Reject partial NT_METAG_RPIPE writes libceph: force GFP_NOIO for socket allocations ACPI: Fix incompatibility with mcount-based function graph tracing ACPI / power: Avoid maybe-uninitialized warning rtc: s35390a: make sure all members in the output are set rtc: s35390a: implement reset routine as suggested by the reference rtc: s35390a: improve irq handling padata: avoid race in reordering HID: hid-lg: Fix immediate disconnection of Logitech Rumblepad 2 HID: i2c-hid: Add sleep between POWER ON and RESET drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl() drm/vmwgfx: Remove getparam error message drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() Reset TreeId to zero on SMB2 TREE_CONNECT metag/usercopy: Drop unused macros metag/usercopy: Zero rest of buffer from copy_from_user powerpc: Don't try to fix up misaligned load-with-reservation instructions mm/mempolicy.c: fix error handling in set_mempolicy and mbind. mtd: bcm47xxpart: fix parsing first block after aligned TRX net/packet: fix overflow in check for priv area size x86/vdso: Plug race between mapping and ELF header setup iscsi-target: Fix TMR reference leak during session shutdown iscsi-target: Drop work-around for legacy GlobalSAN initiator xen, fbfront: fix connecting to backend char: lack of bool string made CONFIG_DEVPORT always on platform/x86: acer-wmi: setup accelerometer when machine has appropriate notify event platform/x86: acer-wmi: setup accelerometer when ACPI device was found mm: Tighten x86 /dev/mem with zeroing reads virtio-console: avoid DMA from stack catc: Combine failure cleanup code in catc_probe() catc: Use heap buffer for memory size test net: ipv6: check route protocol when deleting routes Drivers: hv: don't leak memory in vmbus_establish_gpadl() Drivers: hv: get rid of timeout in vmbus_open() ubi/upd: Always flush after prepared for an update x86/mce/AMD: Give a name to MCA bank 3 when accessed with legacy MSRs powerpc: Reject binutils 2.24 when building little endian net/packet: fix overflow in check for tp_frame_nr net/packet: fix overflow in check for tp_reserve tty: nozomi: avoid a harmless gcc warning hostap: avoid uninitialized variable use in hfa384x_get_rid gfs2: avoid uninitialized variable warning net: neigh: guard against NULL solicit() method sctp: listen on the sock only when it's state is listening or closed ip6mr: fix notification device destruction MIPS: Fix crash registers on non-crashing CPUs RDS: Fix the atomicity for congestion map update xen/x86: don't lose event interrupts p9_client_readdir() fix nfsd: check for oversized NFSv2/v3 arguments ftrace/x86: Fix triple fault with graph tracing and suspend-to-ram kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) tun: read vnet_hdr_sz once printk: use rcuidle console tracepoint ipv6: check raw payload size correctly in ioctl x86: standardize mmap_rnd() usage x86/mm/32: Enable full randomization on i386 and X86_32 mm: larger stack guard gap, between vmas mm: fix new crash in unmapped_area_topdown() Allow stack to grow up to address space limit Linux 3.10.107 Signed-off-by: Nathan Chancellor <natechancellor@gmail.com> Conflicts: arch/x86/mm/mmap.c drivers/mmc/host/sdhci.c drivers/usb/host/xhci-plat.c fs/ext4/super.c kernel/sched/core.c	2018-01-25 17:57:41 -07:00
Nathan Chancellor	8ca93b4c05	This is the 3.10.106 stable release ... -----BEGIN PGP SIGNATURE----- iQIcBAABAgAGBQJZQspmAAoJEE44bZycYXAvLXMP/3Uqx7K7dGjHvvhGA4DhnzSp bGLpjeP1sXXnnd932PN+qkGbl2j/NPjS74DobDqGWnrwxKRzQ21F4YkWJGtb4Pe2 JKcY7y2rbKGcwhpS9qDMkSWuaUKJWF5MAsH08LnCWqlGphGwAH/uPTdqS4iI/CJM aQvaaITe5SVzvpvpyoCVdHqu8K+Ukraf91mvt7hlmrn9OnqO9us9MWulw5sSXQcd pM8ZbRkBDE5OFeVnPKJDBY+cR2ML41wekMMwvJWt7uRyrX2i5c7oQVXYoeYE4MKx Pueb7aG7LQwBUzNJCiZA6PAEFQPwNPCoxHZbAax0D6/JyDWOZukappquzjd6gLDM +U7mxeFTeNZJ5v9tUcUIOb4GaaFcccS3wdDP23V2N8iM88hFVwJn0RSy/pksX37+ ZNDiEyDeJBjz3kh/Kf40zhFIIrABMozFeX3tpSRVVqXb+T6P9l8Y88O2LGY5FCXK QBbAC+jC4X4YI+4v+QWImg9mkfTwzZyjyAlfyjPlHVSK9KDP9M6LXpr2+jKS7jOc ievMOh9ku0HIVuSWGUKZSqjvcF01Bh99tFlX+KqipomwNTwa4hKCLmnOVflF1BPE 8sfD9hvenA0e949kXrURUmqpg6Ujkrbb/lXuD7e2CakCu+XjEMf317R11TyTsHNG 10hsmPsGDVcwbyFOFHS3 =mvzl -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEJDfLduVEy2qz2d/TmXOSYMtstxYFAlpqfEUACgkQmXOSYMts txbJOQ/+Pce1eBSgjESWKuz0OP9BfAe9RpWFi7lBZ/EgRwJVYEx6jau9EYXAQ7YT roCIsV6eufhMplYGHJz6EHxK2Hieb1zG9ooX9ss9GxiB6qmqeqC0Slm9EQE15yGT px3fVz9r86edqjtj7UKK0/n8DJUaFh5LWOymLD3d3/115RYQsl/GowugH9F79PvN pR+OyXq7srtfCmwdhZ65012Ef10RXqBRv0fCYBH6r+jkMqb7uSDFzdR39Z7k3QFk AM4+3lTm6EEZ4xZkcMyX3GuQWslpPAlvFdEx43TjdCbseXAqURoppmxvz+Izum75 fy0oOdKl5OSpyZArRkUfZ0MnL6BHGcKxwYV4u1LupwvqPyaUT4yiT5VEUdy9EqJo Syrr0oSR2lrXqQESdxKkmOZVXyul0nF3Fh1p5QlU1/Id9oskMLYqcXegFyhr2Wyp +A4ZozljEQ4AGm4dYFdH3w8TcNDttjztYoKf8OXnaCOj3p/SEq84tk4Hm3vpoPvh 5OzsZC3UB9gJ1mXsKOVKLJFCPzmg61KOvwhopfAcC6cyiIIf/MPCneZeOzsavtQX J+atSNcLVNE3jmrXvUrwxSpZ3KCc3Ti5Q8pD9ni6/B6st2+LO8EXPrS6n2+28nvu hVpjyCXLbghdmn1mjOGW9lvMQEg/Dupj/ocpCPHJnXpbpM8Mcjo= =3eAv -----END PGP SIGNATURE----- Merge 3.10.106 into android-msm-bullhead-3.10-oreo-m5 Changes in 3.10.106: (252 commits) packet: fix race condition in packet_set_ring crypto: crypto_memneq - add equality testing of memory regions w/o timing leaks EVM: Use crypto_memneq() for digest comparisons libceph: don't set weight to IN when OSD is destroyed KVM: x86: fix emulation of "MOV SS, null selector" KVM: x86: Introduce segmented_write_std posix_acl: Clear SGID bit when setting file permissions tmpfs: clear S_ISGID when setting posix ACLs fbdev: color map copying bounds checking selinux: fix off-by-one in setprocattr tcp: avoid infinite loop in tcp_splice_read() xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings KEYS: Change the name of the dead type to ".dead" to prevent user access KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings ext4: fix data exposure after a crash locking/rtmutex: Prevent dequeue vs. unlock race m68k: Fix ndelay() macro hotplug: Make register and unregister notifier API symmetric Btrfs: fix tree search logic when replaying directory entry deletes USB: serial: kl5kusb105: fix open error path block_dev: don't test bdev->bd_contains when it is not stable crypto: caam - fix AEAD givenc descriptors ext4: fix mballoc breakage with 64k block size ext4: fix stack memory corruption with 64k block size ext4: reject inodes with negative size ext4: return -ENOMEM instead of success f2fs: set ->owner for debugfs status file's file_operations block: protect iterate_bdevs() against concurrent close scsi: zfcp: fix use-after-"free" in FC ingress path after TMF scsi: zfcp: do not trace pure benign residual HBA responses at default level scsi: zfcp: fix rport unblock race with LUN recovery ftrace/x86_32: Set ftrace_stub to weak to prevent gcc from using short jumps to it IB/mad: Fix an array index check IB/multicast: Check ib_find_pkey() return value powerpc: Convert cmp to cmpd in idle enter sequence usb: gadget: composite: Test get_alt() presence instead of set_alt() USB: serial: omninet: fix NULL-derefs at open and disconnect USB: serial: quatech2: fix sleep-while-atomic in close USB: serial: pl2303: fix NULL-deref at open USB: serial: keyspan_pda: verify endpoints at probe USB: serial: spcp8x5: fix NULL-deref at open USB: serial: io_ti: fix NULL-deref at open USB: serial: io_ti: fix another NULL-deref at open USB: serial: iuu_phoenix: fix NULL-deref at open USB: serial: garmin_gps: fix memory leak on failed URB submit USB: serial: ti_usb_3410_5052: fix NULL-deref at open USB: serial: io_edgeport: fix NULL-deref at open USB: serial: oti6858: fix NULL-deref at open USB: serial: cyberjack: fix NULL-deref at open USB: serial: kobil_sct: fix NULL-deref in write USB: serial: mos7840: fix NULL-deref at open USB: serial: mos7720: fix NULL-deref at open USB: serial: mos7720: fix use-after-free on probe errors USB: serial: mos7720: fix parport use-after-free on probe errors USB: serial: mos7720: fix parallel probe usb: xhci-mem: use passed in GFP flags instead of GFP_KERNEL usb: musb: Fix trying to free already-free IRQ 4 ALSA: usb-audio: Fix bogus error return in snd_usb_create_stream() USB: serial: kl5kusb105: abort on open exception path staging: iio: ad7606: fix improper setting of oversampling pins usb: dwc3: gadget: always unmap EP0 requests cris: Only build flash rescue image if CONFIG_ETRAX_AXISFLASHMAP is selected hwmon: (ds620) Fix overflows seen when writing temperature limits clk: clk-wm831x: fix a logic error iommu/amd: Fix the left value check of cmd buffer scsi: mvsas: fix command_active typo target/iscsi: Fix double free in lio_target_tiqn_addtpg() mmc: mmc_test: Uninitialized return value powerpc/pci/rpadlpar: Fix device reference leaks ser_gigaset: return -ENOMEM on error instead of success net, sched: fix soft lockup in tc_classify net: stmmac: Fix race between stmmac_drv_probe and stmmac_open gro: Enter slow-path if there is no tailroom gro: use min_t() in skb_gro_reset_offset() gro: Disable frag0 optimization on IPv6 ext headers powerpc: Fix build warning on 32-bit PPC Input: i8042 - add Pegatron touchpad to noloop table mm/hugetlb.c: fix reservation race when freeing surplus pages USB: serial: kl5kusb105: fix line-state error handling USB: serial: ch341: fix initial modem-control state USB: serial: ch341: fix open error handling USB: serial: ch341: fix control-message error handling USB: serial: ch341: fix open and resume after B0 USB: serial: ch341: fix resume after reset USB: serial: ch341: fix modem-control and B0 handling x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option NFSv4.1: nfs4_fl_prepare_ds must be careful about reporting success. powerpc/ibmebus: Fix further device reference leaks powerpc/ibmebus: Fix device reference leaks in sysfs interface IB/mlx4: Set traffic class in AH IB/mlx4: Fix port query for 56Gb Ethernet links perf scripting: Avoid leaking the scripting_context variable ARM: dts: imx31: fix clock control module interrupts description svcrpc: don't leak contexts on PROC_DESTROY mmc: mxs-mmc: Fix additional cycles after transmission stop mtd: nand: xway: disable module support ubifs: Fix journal replay wrt. xattr nodes arm64/ptrace: Preserve previous registers for short regset write arm64/ptrace: Avoid uninitialised struct padding in fpr_set() arm64/ptrace: Reject attempts to set incomplete hardware breakpoint fields ARM: ux500: fix prcmu_is_cpu_in_wfi() calculation ite-cir: initialize use_demodulator before using it fuse: do not use iocb after it may have been freed crypto: caam - fix non-hmac hashes drm/i915: Don't leak edid in intel_crt_detect_ddc() s5k4ecgx: select CRC32 helper platform/x86: intel_mid_powerbtn: Set IRQ_ONESHOT net: fix harmonize_features() vs NETIF_F_HIGHDMA tcp: initialize max window for a new fastopen socket svcrpc: fix oops in absence of krb5 module ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset write mac80211: Fix adding of mesh vendor IEs scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send drm/i915: fix use-after-free in page_flip_completed() net: use a work queue to defer net_disable_timestamp() work ipv4: keep skb->dst around in presence of IP options netlabel: out of bound access in cipso_v4_validate() ip6_gre: fix ip6gre_err() invalid reads ping: fix a null pointer dereference l2tp: do not use udp_ioctl() packet: fix races in fanout_add() packet: Do not call fanout_release from atomic contexts net: socket: fix recvmmsg not returning error from sock_error USB: serial: mos7840: fix another NULL-deref at open USB: serial: ftdi_sio: fix modem-status error handling USB: serial: ftdi_sio: fix extreme low-latency setting USB: serial: ftdi_sio: fix line-status over-reporting USB: serial: spcp8x5: fix modem-status handling USB: serial: opticon: fix CTS retrieval at open USB: serial: ark3116: fix register-accessor error handling x86/platform/goldfish: Prevent unconditional loading goldfish: Sanitize the broken interrupt handler ocfs2: do not write error flag to user structure we cannot copy from/to mfd: pm8921: Potential NULL dereference in pm8921_remove() drm/nv50/disp: min/max are reversed in nv50_crtc_gamma_set() net: 6lowpan: fix lowpan_header_create non-compression memcpy call vti4: Don't count header length twice. net/sched: em_meta: Fix 'meta vlan' to correctly recognize zero VID frames MIPS: OCTEON: Fix copy_from_user fault handling for large buffers MIPS: Clear ISA bit correctly in get_frame_info() MIPS: Prevent unaligned accesses during stack unwinding MIPS: Fix get_frame_info() handling of microMIPS function size MIPS: Fix is_jump_ins() handling of 16b microMIPS instructions MIPS: Calculate microMIPS ra properly when unwinding the stack MIPS: Handle microMIPS jumps in the same way as MIPS32/MIPS64 jumps uvcvideo: Fix a wrong macro scsi: aacraid: Reorder Adapter status check ath9k: use correct OTP register offsets for the AR9340 and AR9550 fuse: add missing FR_FORCE RDMA/core: Fix incorrect structure packing for booleans NFSv4: fix getacl head length estimation s390/qdio: clear DSCI prior to scanning multiple input queues IB/ipoib: Fix deadlock between rmmod and set_mode ktest: Fix child exit code processing nlm: Ensure callback code also checks that the files match dm: flush queued bios when process blocks to avoid deadlock USB: serial: digi_acceleport: fix OOB data sanity check USB: serial: digi_acceleport: fix OOB-event processing MIPS: ip27: Disable qlge driver in defconfig tracing: Add #undef to fix compile error USB: serial: safe_serial: fix information leak in completion handler USB: serial: omninet: fix reference leaks at open USB: iowarrior: fix NULL-deref at probe USB: iowarrior: fix NULL-deref in write USB: serial: io_ti: fix NULL-deref in interrupt callback USB: serial: io_ti: fix information leak in completion handler vxlan: correctly validate VXLAN ID against VXLAN_N_VID ipv4: mask tos for input route locking/static_keys: Add static_key_{en,dis}able() helpers net: net_enable_timestamp() can be called from irq contexts dccp/tcp: fix routing redirect race net sched actions: decrement module reference count after table flush. perf/core: Fix event inheritance on fork() isdn/gigaset: fix NULL-deref at probe xen: do not re-use pirq number cached in pci device msi msg data net: properly release sk_frag.page net: unix: properly re-increment inflight counter of GC discarded candidates Input: ims-pcu - validate number of endpoints before using them Input: hanwang - validate number of endpoints before using them Input: yealink - validate number of endpoints before using them Input: cm109 - validate number of endpoints before using them USB: uss720: fix NULL-deref at probe USB: idmouse: fix NULL-deref at probe USB: wusbcore: fix NULL-deref at probe uwb: i1480-dfu: fix NULL-deref at probe uwb: hwa-rc: fix NULL-deref at probe mmc: ushc: fix NULL-deref at probe ext4: mark inode dirty after converting inline directory scsi: libsas: fix ata xfer length ALSA: ctxfi: Fallback DMA mask to 32bit ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call ACPI / PNP: Avoid conflicting resource reservations ACPI / resources: free memory on error in add_region_before() ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage USB: OHCI: Fix race between ED unlink and URB submission i2c: at91: manage unexpected RXRDY flag when starting a transfer ipv4: igmp: Allow removing groups from a removed interface ptrace: fix PTRACE_LISTEN race corrupting task->state ring-buffer: Fix return value check in test_ringbuffer() metag/usercopy: Fix alignment error checking metag/usercopy: Add early abort to copy_to_user metag/usercopy: Set flags before ADDZ metag/usercopy: Fix src fixup in from user rapf loops metag/usercopy: Add missing fixups s390/decompressor: fix initrd corruption caused by bss clear net/mlx4_en: Fix bad WQE issue net/mlx4_core: Fix racy CQ (Completion Queue) free char: Drop bogus dependency of DEVPORT on !M68K powerpc: Disable HFSCR[TM] if TM is not supported pegasus: Use heap buffers for all register access rtl8150: Use heap buffers for all register access tracing: Allocate the snapshot buffer before enabling probe ring-buffer: Have ring_buffer_iter_empty() return true when empty netfilter: arp_tables: fix invoking 32bit "iptable -P INPUT ACCEPT" failed in 64bit kernel net: phy: handle state correctly in phy_stop_machine l2tp: take reference on sessions being dumped MIPS: KGDB: Use kernel context for sleeping threads ARM: dts: imx31: move CCM device node to AIPS2 bus devices ARM: dts: imx31: fix AVIC base address tun: Fix TUN_PKT_STRIP setting Staging: vt6655-6: potential NULL dereference in hostap_disable_hostapd() net: sctp: rework multihoming retransmission path selection to rfc4960 perf trace: Use the syscall raw_syscalls:sys_enter timestamp USB: usbtmc: add missing endpoint sanity check ping: implement proper locking USB: fix problems with duplicate endpoint addresses USB: dummy-hcd: fix bug in stop_activity (handle ep0) mm/init: fix zone boundary creation can: Fix kernel panic at security_sock_rcv_skb Drivers: hv: avoid vfree() on crash xc2028: avoid use after free xc2028: unlock on error in xc2028_set_config() xc2028: Fix use-after-free bug properly ipv6: fix ip6_tnl_parse_tlv_enc_lim() ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim() ipv6: fix the use of pcpu_tstats in ip6_tunnel sctp: avoid BUG_ON on sctp_wait_for_sndbuf sctp: deny peeloff operation on asocs with threads sleeping on it KVM: x86: clear bus pointer when destroyed kvm: exclude ioeventfd from counting kvm_io_range limit KVM: kvm_io_bus_unregister_dev() should never fail TTY: n_hdlc, fix lockdep false positive tty: n_hdlc: get rid of racy n_hdlc.tbuf ipv6: handle -EFAULT from skb_copy_bits fs: exec: apply CLOEXEC before changing dumpable task flags mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp dccp/tcp: do not inherit mc_list from parent char: lp: fix possible integer overflow in lp_setup() dccp: fix freeing skb too early for IPV6_RECVPKTINFO Linux 3.10.106 Signed-off-by: Nathan Chancellor <natechancellor@gmail.com> Conflicts: drivers/mfd/pm8921-core.c include/linux/cpu.h kernel/cpu.c net/ipv4/inet_connection_sock.c net/ipv4/ping.c	2018-01-25 17:54:29 -07:00
Nathan Chancellor	a626beca4c	This is the 3.10.105 stable release ... -----BEGIN PGP SIGNATURE----- iQIcBAABAgAGBQJYnZNdAAoJEE44bZycYXAvJv0P/jpPc+jKb+D0FVUOiYDkY5Rw jxsZ3oeruTIeSFAAIzusVMLm9moBJA6DThuTHU5Kt68mRaKB2lgmqwkkvQAPTSYh tnDQwlrF7dOSVmPczJFHalpaLpRdXdQP9r8y+38PibaFZPssKdnZr3BBfdOdi5DT lj029AGKfG7co6Hb/iAhsxuAFfPmvGHY4QNwJ2FRbU1m6MDtmCTbXzF0fc6X5AW1 qrtaWwPulJtZ/5MPk7aFyNpuCpNvIaTEqNaQsZbuz3bHfzDQVLerWze98vgHC0QM 2YOTP6TnEiHhxHGMb9SywUgSV1ylx0X542YDfxmcfyxBWRr0khlxQh1gpX+waqE3 pqdSlvN7AFzifw6kubbG2/XjkNvFtJcDTgrL3qco4utIezSijXmoOsDpKNnJuzk/ kSD5WYd+Q1CSHOkqZX29QPw1Dl/7Ftm7GPfxu7Pis1OBuPByqtRkEfmn9DpiKSs5 Aja0ljZYiQ3jy3fH+WlEzo6PVSxx0ZxKg0fOShlpgjj8KjMUdGfl9cB1OZxyWnNH UiQ9iIWd3tJci7WbsBOfawsQpq3EIJxZKjyUmLYpBht5/YenYxOBDCr/CLJDQBGI IQUPAs/E1JGDxGTUY3AmsaMVrcX2yOfhLzjrsVJGqSdote0um+2PdTLZHE4MMiz2 Dh6CbUVYWS1KNgmQ8T8L =k5mW -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEJDfLduVEy2qz2d/TmXOSYMtstxYFAlpqeiwACgkQmXOSYMts txaBAQ/+KqZh90YZI+gRHGdczbo3XnlryHMdpp+DTIFtN3zU+2LM352oP+haoJfr YhNsixcMhW5TX0is5fg4SkIc0B3ooGKZLVKOPIRw+1NLBAVG5yVuYxW7I1faJgk6 F37+4rvq7KAOPCNMjAEXRt7GqZ4WZjgvgKy+u5wzKh3k5kUylqDwlP2qdgx2L5Rc IxyxgOuaVGV6dZTyAyRlRMild5Tlz+SMY4pWoMe0sulDDXhd5/5PnGNVIgh+XqB6 m0AGkIIzPVe+wmg6n1iYs93dQO0Jmu6DL47Zv4f3ASZNL/XVSLvU9ie63FyWGZXG e52qAPtztXInEOo15vPQSAAq7McZHDTzhHhsU/ZtkBT+LeSUU+rsxXddJ2EO5UgC O3cVm11x1FWMzbBtFNFtkqeri2Y2OxvU4O81mfNP1oOUQBTMeSHTzQ8psbCdXeEr ktSOtI+nakPmDE3aq4YSaz7BwSgt2tU/vZehkrTxtAQJxt0b88r2xFfThy5WScT1 v6muoqxlprjjvFld7v99P8cXxJq4QrxKUxXtEBTdB79Q5xtCC29OAcTelpPFDCED /KpgZflubzH/Z872AW9Ru8OL9PYty6hBNDOP4aHLSFWfCu3KQxL6BMEeqi5qBjBX mJ8JT0dCQYP6xONIWq6a3fICroNMazhNFxdpPSfsQFRhujhjGPg= =zhKv -----END PGP SIGNATURE----- Merge 3.10.105 into android-msm-bullhead-3.10-oreo-m5 Changes in 3.10.105: (315 commits) sched/core: Fix a race between try_to_wake_up() and a woken up task sched/core: Fix an SMP ordering race in try_to_wake_up() vs. schedule() crypto: algif_skcipher - Require setkey before accept(2) crypto: af_alg - Disallow bind/setkey/... after accept(2) crypto: af_alg - Add nokey compatibility path crypto: algif_skcipher - Add nokey compatibility path crypto: hash - Add crypto_ahash_has_setkey crypto: shash - Fix has_key setting crypto: algif_hash - Require setkey before accept(2) crypto: skcipher - Add crypto_skcipher_has_setkey crypto: algif_skcipher - Add key check exception for cipher_null crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path crypto: algif_hash - Remove custom release parent function crypto: algif_skcipher - Remove custom release parent function crypto: af_alg - Forbid bind(2) when nokey child sockets are present crypto: algif_hash - Fix race condition in hash_check_key crypto: algif_skcipher - Fix race condition in skcipher_check_key crypto: algif_skcipher - Load TX SG list after waiting crypto: cryptd - initialize child shash_desc on import crypto: skcipher - Fix blkcipher walk OOM crash crypto: gcm - Fix IV buffer size in crypto_gcm_setkey MIPS: KVM: Fix unused variable build warning KVM: MIPS: Precalculate MMIO load resume PC KVM: MIPS: Drop other CPU ASIDs on guest MMU changes KVM: nVMX: postpone VMCS changes on MSR_IA32_APICBASE write KVM: MIPS: Make ERET handle ERL before EXL KVM: x86: fix wbinvd_dirty_mask use-after-free KVM: x86: fix missed SRCU usage in kvm_lapic_set_vapic_addr KVM: Disable irq while unregistering user notifier PM / devfreq: Fix incorrect type issue. ppp: defer netns reference release for ppp channel x86/mm/xen: Suppress hugetlbfs in PV guests xen: Add RING_COPY_REQUEST() xen-netback: don't use last request to determine minimum Tx credit xen-netback: use RING_COPY_REQUEST() throughout xen-blkback: only read request operation from shared ring once xen/pciback: Save xen_pci_op commands before processing it xen/pciback: Save the number of MSI-X entries to be copied later. xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled xen/pciback: Do not install an IRQ handler for MSI interrupts. xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled. xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set. xen-pciback: Add name prefix to global 'permissive' variable x86/xen: fix upper bound of pmd loop in xen_cleanhighmap() x86/traps: Ignore high word of regs->cs in early_idt_handler_common x86/mm: Disable preemption during CR3 read+write x86/apic: Do not init irq remapping if ioapic is disabled x86/mm/pat, /dev/mem: Remove superfluous error message x86/paravirt: Do not trace _paravirt_ident_*() functions x86/build: Build compressed x86 kernels as PIE x86/um: reuse asm-generic/barrier.h iommu/amd: Update Alias-DTE in update_device_table() iommu/amd: Free domain id when free a domain of struct dma_ops_domain ARM: 8616/1: dt: Respect property size when parsing CPUs ARM: 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7 ARM: sa1100: clear reset status prior to reboot ARM: sa1111: fix pcmcia suspend/resume arm64: avoid returning from bad_mode arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb() arm64: debug: avoid resetting stepping state machine when TIF_SINGLESTEP MIPS: Malta: Fix IOCU disable switch read for MIPS64 MIPS: ptrace: Fix regs_return_value for kernel context powerpc/mm: Don't alias user region to other regions below PAGE_OFFSET powerpc/vdso64: Use double word compare on pointers powerpc/powernv: Use CPU-endian PEST in pnv_pci_dump_p7ioc_diag_data() powerpc/64: Fix incorrect return value from __copy_tofrom_user powerpc/nvram: Fix an incorrect partition merge avr32: fix copy_from_user() avr32: fix 'undefined reference to `___copy_from_user' avr32: off by one in at32_init_pio() s390/dasd: fix hanging device after clear subchannel parisc: Ensure consistent state when switching to kernel stack at syscall entry microblaze: fix __get_user() microblaze: fix copy_from_user() mn10300: failing __get_user() and get_user() should zero m32r: fix __get_user() sh64: failing __get_user() should zero score: fix __get_user/get_user s390: get_user() should zero on failure ARC: uaccess: get_user to zero out dest in cause of fault asm-generic: make get_user() clear the destination on errors frv: fix clear_user() cris: buggered copy_from_user/copy_to_user/clear_user blackfin: fix copy_from_user() score: fix copy_from_user() and friends sh: fix copy_from_user() hexagon: fix strncpy_from_user() error return mips: copy_from_user() must zero the destination on access_ok() failure asm-generic: make copy_from_user() zero the destination properly alpha: fix copy_from_user() metag: copy_from_user() should zero the destination on access_ok() failure parisc: fix copy_from_user() openrisc: fix copy_from_user() openrisc: fix the fix of copy_from_user() mn10300: copy_from_user() should zero on access_ok() failure... sparc32: fix copy_from_user() ppc32: fix copy_from_user() ia64: copy_from_user() should zero the destination on access_ok() failure fix fault_in_multipages_...() on architectures with no-op access_ok() fix memory leaks in tracing_buffers_splice_read() arc: don't leak bits of kernel stack into coredump Fix potential infoleak in older kernels swapfile: fix memory corruption via malformed swapfile coredump: fix unfreezable coredumping task usb: dwc3: gadget: increment request->actual once USB: validate wMaxPacketValue entries in endpoint descriptors USB: fix typo in wMaxPacketSize validation usb: xhci: Fix panic if disconnect USB: serial: fix memleak in driver-registration error path USB: kobil_sct: fix non-atomic allocation in write path USB: serial: mos7720: fix non-atomic allocation in write path USB: serial: mos7840: fix non-atomic allocation in write path usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition USB: change bInterval default to 10 ms usb: gadget: fsl_qe_udc: signedness bug in qe_get_frame() USB: serial: cp210x: fix hardware flow-control disable usb: misc: legousbtower: Fix NULL pointer deference usb: gadget: function: u_ether: don't starve tx request queue USB: serial: cp210x: fix tiocmget error handling usb: gadget: u_ether: remove interrupt throttling usb: chipidea: move the lock initialization to core file Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y ALSA: rawmidi: Fix possible deadlock with virmidi registration ALSA: timer: fix NULL pointer dereference in read()/ioctl() race ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE ALSA: timer: fix NULL pointer dereference on memory allocation failure ALSA: ali5451: Fix out-of-bound position reporting ALSA: pcm : Call kill_fasync() in stream lock zfcp: fix fc_host port_type with NPIV zfcp: fix ELS/GS request&response length for hardware data router zfcp: close window with unblocked rport during rport gone zfcp: retain trace level for SCSI and HBA FSF response records zfcp: restore: Dont use 0 to indicate invalid LUN in rec trace zfcp: trace on request for open and close of WKA port zfcp: restore tracing of handle for port and LUN with HBA records zfcp: fix D_ID field with actual value on tracing SAN responses zfcp: fix payload trace length for SAN request&response zfcp: trace full payload of all SAN records (req,resp,iels) scsi: zfcp: spin_lock_irqsave() is not nestable scsi: mpt3sas: Fix secure erase premature termination scsi: mpt3sas: Unblock device after controller reset scsi: mpt3sas: fix hang on ata passthrough commands mpt2sas: Fix secure erase premature termination scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices scsi: megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression scsi: ibmvfc: Fix I/O hang when port is not mapped scsi: Fix use-after-free scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() scsi: scsi_debug: Fix memory leak if LBP enabled and module is unloaded scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware ext4: validate that metadata blocks do not overlap superblock ext4: avoid modifying checksum fields directly during checksum verification ext4: use __GFP_NOFAIL in ext4_free_blocks() ext4: reinforce check of i_dtime when clearing high fields of uid and gid ext4: allow DAX writeback for hole punch ext4: sanity check the block and cluster size at mount time reiserfs: fix "new_insert_key may be used uninitialized ..." reiserfs: Unlock superblock before calling reiserfs_quota_on_mount() xfs: fix superblock inprogress check libxfs: clean up _calc_dquots_per_chunk btrfs: ensure that file descriptor used with subvol ioctls is a dir ocfs2/dlm: fix race between convert and migration ocfs2: fix start offset to ocfs2_zero_range_for_truncate() ubifs: Fix assertion in layout_in_gaps() ubifs: Fix xattr_names length in exit paths UBIFS: Fix possible memory leak in ubifs_readdir() ubifs: Abort readdir upon error ubifs: Fix regression in ubifs_readdir() UBI: fastmap: scrub PEB when bitflips are detected in a free PEB EC header NFSv4.x: Fix a refcount leak in nfs_callback_up_net NFSD: Using free_conn free connection NFS: Don't drop CB requests with invalid principals NFSv4: Open state recovery must account for file permission changes fs/seq_file: fix out-of-bounds read fs/super.c: fix race between freeze_super() and thaw_super() isofs: Do not return EACCES for unknown filesystems hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common() driver core: Delete an unnecessary check before the function call "put_device" driver core: fix race between creating/querying glue dir and its cleanup drm/radeon: fix radeon_move_blit on 32bit systems drm: Reject page_flip for !DRIVER_MODESET drm/radeon: Ensure vblank interrupt is enabled on DPMS transition to on qxl: check for kmap failures Input: i8042 - break load dependency between atkbd/psmouse and i8042 Input: i8042 - set up shared ps2_cmd_mutex for AUX ports Input: ili210x - fix permissions on "calibrate" attribute hwrng: exynos - Disable runtime PM on probe failure hwrng: omap - Fix assumption that runtime_get_sync will always succeed hwrng: omap - Only fail if pm_runtime_get_sync returns < 0 i2c-eg20t: fix race between i2c init and interrupt enable em28xx-i2c: rt_mutex_trylock() returns zero on failure i2c: core: fix NULL pointer dereference under race condition i2c: at91: fix write transfers by clearing pending interrupt first iio: accel: kxsd9: Fix raw read return iio: accel: kxsd9: Fix scaling bug thermal: hwmon: Properly report critical temperature in sysfs cdc-acm: fix wrong pipe type on rx interrupt xfers timers: Use proper base migration in add_timer_on() EDAC: Increment correct counter in edac_inc_ue_error() IB/ipoib: Fix memory corruption in ipoib cm mode connect flow IB/core: Fix use after free in send_leave function IB/ipoib: Don't allow MC joins during light MC flush IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV IB/mlx4: Fix create CQ error flow IB/uverbs: Fix leak of XRC target QPs IB/cm: Mark stale CM id's whenever the mad agent was unregistered mtd: blkdevs: fix potential deadlock + lockdep warnings mtd: pmcmsp-flash: Allocating too much in init_msp_flash() mtd: nand: davinci: Reinitialize the HW ECC engine in 4bit hwctl perf symbols: Fixup symbol sizes before picking best ones perf: Tighten (and fix) the grouping condition tty: Prevent ldisc drivers from re-using stale tty fields tty: limit terminal size to 4M chars tty: vt, fix bogus division in csi_J vt: clear selection before resizing drivers/vfio: Rework offsetofend() include/stddef.h: Move offsetofend() from vfio.h to a generic kernel header stddef.h: move offsetofend inside #ifndef/#endif guard, neaten ipv6: don't call fib6_run_gc() until routing is ready ipv6: split duplicate address detection and router solicitation timer ipv6: move DAD and addrconf_verify processing to workqueue ipv6: addrconf: fix dev refcont leak when DAD failed ipv6: fix rtnl locking in setsockopt for anycast and multicast ip6_gre: fix flowi6_proto value in ip6gre_xmit_other() ipv6: correctly add local routes when lo goes up ipv6: dccp: fix out of bound access in dccp_v6_err() ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped ip6_tunnel: Clear IP6CB in ip6tunnel_xmit() ip6_tunnel: disable caching when the traffic class is inherited net/irda: handle iriap_register_lsap() allocation failure tcp: fix use after free in tcp_xmit_retransmit_queue() tcp: properly scale window in tcp_v[46]_reqsk_send_ack() tcp: fix overflow in __tcp_retransmit_skb() tcp: fix wrong checksum calculation on MTU probing tcp: take care of truncations done by sk_filter() bonding: Fix bonding crash net: ratelimit warnings about dst entry refcount underflow or overflow mISDN: Support DR6 indication in mISDNipac driver mISDN: Fixing missing validation in base_sock_bind() net: disable fragment reassembly if high_thresh is set to zero ipvs: count pre-established TCP states as active iwlwifi: pcie: fix access to scratch buffer svc: Avoid garbage replies when pc_func() returns rpc_drop_reply brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get() brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap() pstore: Fix buffer overflow while write offset equal to buffer size net/mlx4_core: Allow resetting VF admin mac to zero firewire: net: guard against rx buffer overflows firewire: net: fix fragmented datagram_size off-by-one netfilter: fix namespace handling in nf_log_proc_dostring can: bcm: fix warning in bcm_connect/proc_register net: fix sk_mem_reclaim_partial() net: avoid sk_forward_alloc overflows ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route packet: call fanout_release, while UNREGISTERING a netdev net: sctp, forbid negative length sctp: validate chunk len before actually using it net: clear sk_err_soft in sk_clone_lock() net: mangle zero checksum in skb_checksum_help() dccp: do not send reset to already closed sockets dccp: fix out of bound access in dccp_v4_err() sctp: assign assoc_id earlier in __sctp_connect neigh: check error pointer instead of NULL for ipv4_neigh_lookup() ipv4: use new_gw for redirect neigh lookup mac80211: fix purging multicast PS buffer queue mac80211: discard multicast and 4-addr A-MSDUs cfg80211: limit scan results cache size mwifiex: printk() overflow with 32-byte SSIDs ipv4: Set skb->protocol properly for local output net: sky2: Fix shutdown crash kaweth: fix firmware download tracing: Move mutex to protect against resetting of seq data kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd Revert "ipc/sem.c: optimize sem_lock()" cfq: fix starvation of asynchronous writes drbd: Fix kernel_sendmsg() usage - potential NULL deref lib/genalloc.c: start search from start of chunk tools/vm/slabinfo: fix an unintentional printf rcu: Fix soft lockup for rcu_nocb_kthread ratelimit: fix bug in time interval by resetting right begin time mfd: core: Fix device reference leak in mfd_clone_cell PM / sleep: fix device reference leak in test_suspend mmc: mxs: Initialize the spinlock prior to using it mmc: block: don't use CMD23 with very old MMC cards pstore/core: drop cmpxchg based updates pstore/ram: Use memcpy_toio instead of memcpy pstore/ram: Use memcpy_fromio() to save old buffer mb86a20s: fix the locking logic mb86a20s: fix demod settings cx231xx: don't return error on success cx231xx: fix GPIOs for Pixelview SBTVD hybrid gpio: mpc8xxx: Correct irq handler function uio: fix dmem_region_start computation KEYS: Fix short sprintf buffer in /proc/keys show function hv: do not lose pending heartbeat vmbus packets staging: iio: ad5933: avoid uninitialized variable in error case mei: bus: fix received data size check in NFC fixup ACPI / APEI: Fix incorrect return value of ghes_proc() PCI: Handle read-only BARs on AMD CS553x devices tile: avoid using clocksource_cyc2ns with absolute cycle count dm flakey: fix reads to be issued if drop_writes configured mm,ksm: fix endless looping in allocating memory when ksm enable can: dev: fix deadlock reported after bus-off hwmon: (adt7411) set bit 3 in CFG1 register mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] mfd: 88pm80x: Double shifting bug in suspend/resume ASoC: omap-mcpdm: Fix irq resource handling regulator: tps65910: Work around silicon erratum SWCZ010 dm: mark request_queue dead before destroying the DM device fbdev/efifb: Fix 16 color palette entry calculation metag: Only define atomic_dec_if_positive conditionally Linux 3.10.105 Signed-off-by: Nathan Chancellor <natechancellor@gmail.com> Conflicts: arch/arm/mach-sa1100/generic.c arch/arm64/kernel/traps.c crypto/blkcipher.c drivers/devfreq/devfreq.c drivers/usb/dwc3/gadget.c drivers/usb/gadget/u_ether.c fs/ubifs/dir.c include/net/if_inet6.h lib/genalloc.c net/ipv6/addrconf.c net/ipv6/tcp_ipv6.c net/wireless/scan.c sound/core/timer.c	2018-01-25 17:45:32 -07:00
Nathan Chancellor	88e100f704	This is the 3.10.103 stable release ... -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAABAgAGBQJXwrqoAAoJEE44bZycYXAvXY0P/0ggO2AAwJONCzFgBk3yZKi1 aHiSvhq4JLkFnHk3KRQJwBqAPzDkc9C41If65RTZcNwdczzPMVRBxpzIrQhzjTpg xv2MwuuuTFQpOaJStmRbYSa8uiNs9KCmO357E6Rtz47bNrngqTk6TcXV2qIJxjl9 P5s8+l5iUIfLsPx1AIN9vCiSAeWdL2FLcVvJiIFrfpLfJd0FI0un2Z21/Cw14OLM uoK2I8wf+DzwQdRXTUij+8+yC80IMh+bPmQR5QRcJ/jZx5xj5cdhhabWHZPw2InQ PzPbX/xG514qNosRkALFM0xOgdpsikhOZwr4LzXJoYreFr3uarUiIQ2pGXR/DANY nDmFNuvfwRxJTF8wXNW7J9jxLAhgqlJ5mOfWnNTI1filpUg+zCrp9O2DzyjBZOJA 7bzvCQgFG6pIawicIYX1cLZ+rdEB+oEmpQJtXkAUK9jg84jqluoq/NTQ4leNbjtl 1Vk0Gbvz28FX821lpcrNbEibkmN7MAbAr3LXYKYFtGd3RqED7LlSe1B1bxk4dS+6 FhKcZXpYXlofwGrZieGgdq/NieCUClbfTmBSbqmX7vCM3k0p5pIak+GGFoJW+rAl VTqrxyrB5eBr4T1m04EuK6tIxbFo/SF78CgkjbOE6ghTkqe6BLuntMqXIcKn/lrO 8t0Tg0S+MrzTv3LWsnzx =9dk8 -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEJDfLduVEy2qz2d/TmXOSYMtstxYFAlpqdbgACgkQmXOSYMts txa6FA//biC/xNB75MuS7nVE/4mDKnpzjejjiIWgtWFkcp+NHXIHa2JS8E1hfAfN 3oCifMMDIF8+QoQvjz6MBuxzxc4BoqxEju0Ez+/ktm8R6fTw7SEholmo+nGh4fGW LlXwf2r2HcDrS+MzepCCVK5H2ewso4cDmnqJNVRME/R2CgTf1U+ALQ/Vv+UzXEYp m+LbIRzWx6QcrGd9FiPg8uJ08vy/E5hZBjehKWTm1hMNvPuCysDhL6Cy7mfJhrOm 2/FypjVZHgkj+6ZMTkDOSS9mXvPmZSJ91rQCjt+Mk52OfYycbiALtBWiz3ekwYHc wGkyzRHFMLCnjNTNBAk9LHMOdEHfR4hnvb7zaKvrAui7QyweDgX86SuqS+Okyb6Y DXvPkzSMIs/cQc+0y1d9nSJ+ASTVAJBGewrvqENza0UDO+7r8OF+Yuu9ttlZSzVI ABoCqcE2lqIJEVaCbjGD+r3fAclGQEJHzGhUxBvrvgBz4pKn5E3FMuB+Ll72BQo0 od1uUvP1TIBf9Sy0/k54tYusMR6pZ+0q5ffpAcVHwYg4ScUIv3e2DNlS2YwaAhg0 zUG5Is5jfIjOSzZ1cxNtlicCKKEWZgECI7i013Hx5AP3Im1ZwXZr82plOnGg16pl Yt1pusfixkqhdi6S2gbULO4JfMN5WUDB0PvZAWCJ3US0uqi3ftE= =9Iqv -----END PGP SIGNATURE----- Merge 3.10.103 into android-msm-bullhead-3.10-oreo-m5 Changes in 3.10.103: (178 commits) X.509: remove possible code fragility: enumeration values not handled x86, asmlinkage, apm: Make APM data structure used from assembler visible netfilter: x_tables: validate e->target_offset early netfilter: x_tables: make sure e->next_offset covers remaining blob size netfilter: x_tables: fix unconditional helper netfilter: x_tables: don't move to non-existent next rule netfilter: x_tables: add and use xt_check_entry_offsets netfilter: x_tables: kill check_entry helper netfilter: x_tables: assert minimum target size netfilter: x_tables: add compat version of xt_check_entry_offsets netfilter: x_tables: check standard target size too netfilter: x_tables: check for bogus target offset netfilter: x_tables: validate all offsets and sizes in a rule netfilter: x_tables: don't reject valid target size on some architectures netfilter: arp_tables: simplify translate_compat_table args netfilter: ip_tables: simplify translate_compat_table args netfilter: ip6_tables: simplify translate_compat_table args netfilter: x_tables: xt_compat_match_from_user doesn't need a retval netfilter: ensure number of counters is >0 in do_replace() netfilter: x_tables: do compat validation via translate_table Revert "netfilter: ensure number of counters is >0 in do_replace()" netfilter: x_tables: introduce and use xt_copy_counters_from_user perf/x86: Honor the architectural performance monitoring version perf/x86: Fix undefined shift on 32-bit kernels signal: remove warning about using SI_TKILL in rt_[tg]sigqueueinfo PCI/ACPI: Fix _OSC ordering to allow PCIe hotplug use when available udp: properly support MSG_PEEK with truncated buffers USB: fix invalid memory access in hub_activate() USB: usbfs: fix potential infoleak in devio USB: fix up faulty backports USB: EHCI: declare hostpc register as zero-length array USB: serial: option: add support for Telit LE910 PID 0x1206 usb: musb: Stop bulk endpoint while queue is rotated usb: musb: Ensure rx reinit occurs for shared_fifo endpoints usb: renesas_usbhs: protect the CFIFOSEL setting in usbhsg_ep_enable() x86/mm: Add barriers and document switch_mm()-vs-flush synchronization pipe: limit the per-user amount of pages allocated in pipes cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind KEYS: potential uninitialized variable mm: migrate dirty page without clear_page_dirty_for_io etc printk: do cond_resched() between lines while outputting to consoles HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands libceph: apply new_state before new_up_client on incrementals tmpfs: don't undo fallocate past its last page tmpfs: fix regression hang in fallocate undo tcp: make challenge acks less predictable tcp: record TLP and ER timer stats in v6 stats tcp: consider recv buf for the initial window scale MIPS: KVM: Fix mapped fault broken commpage handling MIPS: KVM: Add missing gfn range check MIPS: KVM: Fix gfn range check in kseg0 tlb faults MIPS: KVM: Propagate kseg0/mapped tlb fault errors MIPS: math-emu: Fix jalr emulation when rd == $0 MIPS: Fix siginfo.h to use strict posix types MIPS: ath79: make bootconsole wait for both THRE and TEMT MIPS: Fix 64k page support for 32 bit kernels. MIPS: KVM: Fix modular KVM under QEMU Input: uinput - handle compat ioctl for UI_SET_PHYS Input: wacom_w8001 - w8001_MAX_LENGTH should be 13 Input: xpad - validate USB endpoint count during probe ath5k: Change led pin configuration for compaq c700 laptop aacraid: Relinquish CPU during timeout wait aacraid: Fix for aac_command_thread hang PCI: Disable all BAR sizing for devices with non-compliant BARs rtlwifi: Fix logic error in enter/exit power-save mode powerpc/book3s64: Fix branching to OOL handlers in relocatable kernel powerpc: Fix definition of SIAR and SDAR registers powerpc: Use privileged SPR number for MMCR2 powerpc/pseries/eeh: Handle RTAS delay requests in configure_bridge powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism powerpc/pseries: Fix PCI config address for DDW powerpc/tm: Always reclaim in start_thread() for exec() class syscalls sunrpc: fix stripping of padded MIC tokens drm/gma500: Fix possible out of bounds read drm/fb_helper: Fix references to dev->mode_config.num_connector drm/radeon: fix asic initialization for virtualized environments drm/radeon: add a delay after ATPX dGPU power off drm/radeon: Poll for both connect/disconnect on analog connectors drm/radeon: fix firmware info version checks ext4: fix hang when processing corrupted orphaned inode list ext4: address UBSAN warning in mb_find_order_for_block() ext4: silence UBSAN in ext4_mb_init() ext4: verify extent header depth ext4: check for extents that wrap around ext4: don't call ext4_should_journal_data() on the journal inode ext4: short-cut orphan cleanup on error ext4: fix reference counting bug on block allocation error dma-debug: avoid spinlock recursion when disabling dma-debug xfs: xfs_iflush_cluster fails to abort on error xfs: fix inode validity check in xfs_iflush_cluster xfs: skip stale inodes in xfs_iflush_cluster KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS ARM: fix PTRACE_SETVFPREGS on SMP systems arm: oabi compat: add missing access checks parisc: Fix pagefault crash in unaligned __get_user() call ecryptfs: forbid opening files without mmap handler fix d_walk()/non-delayed __d_free() race crypto: ux500 - memmove the right size crypto: gcm - Filter out async ghash if necessary crypto: scatterwalk - Fix test in scatterwalk_done sit: correct IP protocol used in ipip6_err ipmr/ip6mr: Initialize the last assert time of mfc entries. net: alx: Work around the DMA RX overflow issue mac80211: mesh: flush mesh paths unconditionally mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs IB/security: Restrict use of the write() interface IB/IPoIB: Don't update neigh validity for unresolved entries IB/mlx4: Fix the SQ size of an RC QP x86, build: copy ldlinux.c32 to image.iso kprobes/x86: Clear TF bit in fault on single-stepping x86/amd_nb: Fix boot crash on non-AMD systems NFS: Fix another OPEN_DOWNGRADE bug mm: Export migrate_page_move_mapping and migrate_page_copy UBIFS: Implement ->migratepage() cdc_ncm: workaround for EM7455 "silent" data interface kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES tracing: Handle NULL formats in hold_module_trace_bprintk_format() base: make module_create_drivers_dir race-free iio: Fix error handling in iio_trigger_attach_poll_func staging: iio: accel: fix error check iio: accel: kxsd9: fix the usage of spi_w8r8() iio:ad7266: Fix broken regulator error handling iio:ad7266: Fix probe deferral for vref tty/vt/keyboard: fix OOB access in do_compute_shiftstate() ALSA: dummy: Fix a use-after-free at closing ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() ALSA: ctl: Stop notification after disconnection ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS ALSA: timer: Fix leak in events via snd_timer_user_ccallback ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt scsi: fix race between simultaneous decrements of ->host_failed scsi: remove scsi_end_request Fix reconnect to not defer smb3 session reconnect long after socket reconnect xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7 s390/seccomp: fix error return for filtered system calls fs/nilfs2: fix potential underflow in call to crc32_le arc: unwind: warn only once if DW2_UNWIND is disabled xen/pciback: Fix conf_space read/write overlap check. Revert "ecryptfs: forbid opening files without mmap handler" ecryptfs: don't allow mmap when the lower fs doesn't support it ARC: use ASL assembler mnemonic qeth: delete napi struct when removing a qeth device mmc: block: fix packed command header endianness can: at91_can: RX queue could get stuck at high bus load can: fix oops caused by wrong rtnl dellink usage ipr: Clear interrupt on croc/crocodile when running with LSI net: mvneta: set real interrupt per packet for tx_done sctp: Prevent soft lockup when sctp_accept() is called during a timeout event x86/mm: Improve switch_mm() barrier comments KEYS: 64-bit MIPS needs to use compat_sys_keyctl for 32-bit userspace scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands block: fix use-after-free in seq file fuse: fix wrong assignment of ->flags in fuse_send_init() net/irda: fix NULL pointer dereference on memory allocation failure gpio: pca953x: Fix NBANK calculation for PCA9536 hp-wmi: Fix wifi cannot be hard-unblocked s5p-mfc: Set device name for reserved memory region devs s5p-mfc: Add release callback for memory region devs Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU cifs: Check for existing directory when opening file with O_CREAT netlabel: add address family checks to netlbl_{sock,req}_delattr() balloon: check the number of available pages in leak balloon ftrace/recordmcount: Work around for addition of metag magic but not relocations metag: Fix __cmpxchg_u32 asm constraint for CMP ubi: Make volume resize power cut aware ubi: Fix race condition between ubi device creation and udev dm flakey: error READ bios during the down_interval module: Invalidate signatures on force-loaded modules be2iscsi: Fix bogus WARN_ON length check squash mm: Export migrate_page_... : also make it non-static HID: hid-input: Add parentheses to quell gcc warning ALSA: oxygen: Fix logical-not-parentheses warning net: rfkill: Do not ignore errors from regulator_enable() isdn: hfcpci_softirq: get func return to suppress compiler warning stb6100: fix buffer length check in stb6100_write_reg_range() spi: spi-xilinx: cleanup a check in xilinx_spi_txrx_bufs() Linux 3.10.103 Signed-off-by: Nathan Chancellor <natechancellor@gmail.com> Conflicts: drivers/usb/core/quirks.c fs/fuse/inode.c kernel/panic.c net/ipv4/tcp_input.c	2018-01-25 17:26:32 -07:00
Nathan Chancellor	1d465ee427	This is the 3.10.99 stable release ... -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAABCAAGBQJW2MPMAAoJEDjbvchgkmk+xlkP/3pLYC8OxOPz11sBFOWDB6Jn +/La3kW252TMcY7K8Z6R2UJC93HxXaCySAZTrLrwUL6mqpSStiHhX/1HQMI6If4c jMtsbgWpU+HZzprPzY8IK6rdrZJKz+Nxu3LMuV0pYTAFKLnCa4d9bSYZ52UArVnC w13KGpk/gnWTO7A6ZNx4dcRpMqYHWcG+eJsT9zdExmyk65qBCxhhUxXh+DijmSn7 QXrFJ4zjWr1kIdsk6Moat/HCTt/zvwMiWuHdnqYIzUSmvWZWbaQsqGw0cFvKM2hL pOJ3zf3fgUY6fsV0vG+SFdrMmL6RtL/v0c2EGM5ZlYCIPbUZcK+XMlaEqOe6UAHz hITIE+r03l2zqagWVb/2HOen8liHIxnfqUPYgHd6vmXz2qWXg9sWTsOhr3ZAQQLA tf0JDjmx/KCyBmiA7ZyhRLeyhx0jD/csxxo14YME8N3tJCyw5gEIOgXlOLNxhWRu uCqSN27FDnnf6ppbX1euMeWxzqi4DCZFMDJQT743V5sJIz10BsVR9HJS6mwyUioN ia4qVc99JfSEsXuawlZhC44Ht+Z/tTSxQPcZjWMHvftGVfxS9AZVf85BM5zNa91t 52mtJivT25N7JxHE41iEQA9t4V1shCjGmEUKD4cVMKgC18cpXD/awDlJ1Or1YuAO ro6ElZeHj+O3YETFp31/ =GlVi -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEJDfLduVEy2qz2d/TmXOSYMtstxYFAlpqdM8ACgkQmXOSYMts txacfQ//SS35oIq6UFvp2viMaloy++Ec9fBNUqMI8GLbdJ25Fwt2lA0kuhOCR+dH bHjwCsb/lo4uf0g+gYuQU4M9XqusWbmsQouTObILBidMt1K2MavKXLqzZsQ+bVD5 pDHLK9ZJwGqTpGgPLlRo1KLIPq+Byf2T+mWiAdoR873gJAJSDPns4PhjJIRvsv52 lnqnIDcjJ//7RzZkBv1hqlA294ttEKRfDqRk+WhLHAJVtnxwpbaiMyRjZgcXvxec rvPgnppkkhIi/EyrJPU3GkZEce8bj3WQBVDLEw+4NxXNQGANwUEo14jgbBVZaQTg /Wrx5QR8S+qqxCeKBN825oHcsgfRdLzmX28J13m6R3hW3RMTH0cTjjLTIW/Ms/LI wiwBW8rYIwkSFUY6r2HYzi9goC9wm1bP/rAJ5n9OdcFkyHc7sVtqkejQEdfmHRfT UQmIzxe8nH21j88xXXmZ2OiVv0AJqZDcc6rBwvhFdxXRqySdZDKzbl6l7tNXVDBM amOzbk6pbv245Mbr9i6BvkhUsoWkAmNpX6ZZeo98RAiGsQs9cvUPllgzNZmW0+KW uDRHreI1ZGBdr7tFYmUCP0JeJYNXv0K3I8bsKIbC97q9xGa/T73M9PFFpQ8r0Cot hd+rsq+fGC6CuXsYg6xAcuVDwM4ljuHwKbAnQTYSEiXvGEd0dDM= =iIAf -----END PGP SIGNATURE----- Merge 3.10.99 into android-msm-bullhead-3.10-oreo-m5 Changes in 3.10.99: (80 commits) tracepoints: Do not trace when cpu is offline drm/ast: Initialized data needed to map fbdev memory netfilter: nf_conntrack: fix RCU race in nf_conntrack_find_get bcache: unregister reboot notifier if bcache fails to unregister device tools: Add a "make all" rule drm/radeon: fix hotplug race at startup efi: Disable interrupts around EFI calls, not in the epilog/prolog calls dm thin metadata: fix bug when taking a metadata snapshot dm thin: fix race condition when destroying thin pool workqueue can: ems_usb: Fix possible tx overflow USB: cp210x: add IDs for GE B650V3 and B850V3 boards USB: option: add support for SIM7100E USB: option: add "4G LTE usb-modem U901" proc: Fix ptrace-based permission checks for accessing task maps iw_cxgb3: Fix incorrectly returning error on success MIPS: KVM: Fix ASID restoration logic MIPS: KVM: Fix CACHE immediate offset sign extension MIPS: KVM: Uninit VCPU in vcpu_create error path splice: sendfile() at once fails for big files Failing to send a CLOSE if file is opened WRONLY and server reboots on a 4.x mount unix: correctly track in-flight fds in sending process user_struct genirq: Prevent chip buslock deadlock clocksource/drivers/vt8500: Increase the minimum delta lockd: create NSM handles per net namespace devres: fix a for loop bounds check wm831x_power: Use IRQF_ONESHOT to request threaded IRQs megaraid_sas: Do not use PAGE_SIZE for max_sectors megaraid_sas : SMAP restriction--do not access user memory from IOCTL code mmc: remove bondage between REQ_META and reliable write mac: validate mac_partition is within sector ARC: dw2 unwind: Remove falllback linear search thru FDE entries vfs: Avoid softlockups with sendfile(2) ring-buffer: Update read stamp with first real commit on page virtio: fix memory leak of virtio ida cache layers mac80211: mesh: fix call_rcu() usage RDS: fix race condition when sending a message on unbound socket can: sja1000: clear interrupts on start sched/core: Remove false-positive warning from wake_up_process() sata_sil: disable trim dm btree: fix bufio buffer leaks in dm_btree_del() error path vgaarb: fix signal handling in vga_get() rfkill: copy the name into the rfkill struct ses: Fix problems with simple enclosures ses: fix additional element traversal bug scripts: recordmcount: break hardlinks Btrfs: add missing brelse when superblock checksum fails Btrfs: igrab inode in writepage Btrfs: send, don't BUG_ON() when an empty symlink is found Btrfs: fix number of transaction units required to create symlink s390: fix normalization bug in exception table sorting s390/dasd: prevent incorrect length error under z/VM after PAV changes s390/dasd: fix refcount for PAV reassignment uml: flush stdout before forking uml: fix hostfs mknod() media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode gspca: ov534/topro: prevent a division by 0 tda1004x: only update the frontend properties if locked dm snapshot: fix hung bios when copy error occurs posix-clock: Fix return code on the poll method's error path mmc: mmci: fix an ages old detection error sparc64: fix incorrect sign extension in sys_sparc64_personality drm/vmwgfx: respect 'nomodeset' drm/radeon: clean up fujitsu quirks drm/radeon: hold reference to fences in radeon_sa_bo_new drm/radeon: use post-decrement in error handling IB/qib: fix mcast detach when qp not attached libceph: don't bail early from try_read() when skipping a message cdc-acm:exclude Samsung phone 04e8:685d rfkill: fix rfkill_fop_read wait_event usage Revert "workqueue: make sure delayed work run in local cpu" libata: fix sff host state machine locking while polling PCI/AER: Flush workqueue on device remove to avoid use-after-free nfs: fix nfs_size_to_loff_t KVM: async_pf: do not warn on page allocation failures tracing: Fix showing function event in available_events sunrpc/cache: fix off-by-one in qword_get() kernel/resource.c: fix muxed resource handling in __request_region() do_last(): don't let a bogus return value from ->open() et.al. to confuse us xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted. Linux 3.10.99 Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>	2018-01-25 17:22:39 -07:00
Steffen Maier	4b106b91a0	scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response ... commit fdb7cee3b9e3c561502e58137a837341f10cbf8b upstream. At the default trace level, we only trace unsuccessful events including FSF responses. zfcp_dbf_hba_fsf_response() only used protocol status and FSF status to decide on an unsuccessful response. However, this is only one of multiple possible sources determining a failed struct zfcp_fsf_req. An FSF request can also "fail" if its response runs into an ERP timeout or if it gets dismissed because a higher level recovery was triggered [trace tags "erscf_1" or "erscf_2" in zfcp_erp_strategy_check_fsfreq()]. FSF requests with ERP timeout are: FSF_QTCB_EXCHANGE_CONFIG_DATA, FSF_QTCB_EXCHANGE_PORT_DATA, FSF_QTCB_OPEN_PORT_WITH_DID or FSF_QTCB_CLOSE_PORT or FSF_QTCB_CLOSE_PHYSICAL_PORT for target ports, FSF_QTCB_OPEN_LUN, FSF_QTCB_CLOSE_LUN. One example is slow queue processing which can cause follow-on errors, e.g. FSF_PORT_ALREADY_OPEN after FSF_QTCB_OPEN_PORT_WITH_DID timed out. In order to see the root cause, we need to see late responses even if the channel presented them successfully with FSF_PROT_GOOD and FSF_GOOD. Example trace records formatted with zfcpdbf from the s390-tools package: Timestamp : ... Area : REC Subarea : 00 Level : 1 Exception : - CPU ID : .. Caller : ... Record ID : 1 Tag : fcegpf1 LUN : 0xffffffffffffffff WWPN : 0x<WWPN> D_ID : 0x00<D_ID> Adapter status : 0x5400050b Port status : 0x41200000 LUN status : 0x00000000 Ready count : 0x00000001 Running count : 0x... ERP want : 0x02 ZFCP_ERP_ACTION_REOPEN_PORT ERP need : 0x02 ZFCP_ERP_ACTION_REOPEN_PORT | Timestamp : ... 30 seconds later Area : REC Subarea : 00 Level : 1 Exception : - CPU ID : .. Caller : ... Record ID : 2 Tag : erscf_2 LUN : 0xffffffffffffffff WWPN : 0x<WWPN> D_ID : 0x00<D_ID> Adapter status : 0x5400050b Port status : 0x41200000 LUN status : 0x00000000 Request ID : 0x<request_ID> ERP status : 0x10000000 ZFCP_STATUS_ERP_TIMEDOUT ERP step : 0x0800 ZFCP_ERP_STEP_PORT_OPENING ERP action : 0x02 ZFCP_ERP_ACTION_REOPEN_PORT ERP count : 0x00 | Timestamp : ... later than previous record Area : HBA Subarea : 00 Level : 5 > default level => 3 <= default level Exception : - CPU ID : 00 Caller : ... Record ID : 1 Tag : fs_qtcb => fs_rerr Request ID : 0x<request_ID> Request status : 0x00001010 ZFCP_STATUS_FSFREQ_DISMISSED | ZFCP_STATUS_FSFREQ_CLEANUP FSF cmnd : 0x00000005 FSF sequence no: 0x... FSF issued : ... > 30 seconds ago FSF stat : 0x00000000 FSF_GOOD FSF stat qual : 00000000 00000000 00000000 00000000 Prot stat : 0x00000001 FSF_PROT_GOOD Prot stat qual : 00000000 00000000 00000000 00000000 Port handle : 0x... LUN handle : 0x00000000 QTCB log length: ... QTCB log info : ... In case of problems detecting that new responses are waiting on the input queue, we sooner or later trigger adapter recovery due to an FSF request timeout (trace tag "fsrth_1"). FSF requests with FSF request timeout are: typically FSF_QTCB_ABORT_FCP_CMND; but theoretically also FSF_QTCB_EXCHANGE_CONFIG_DATA or FSF_QTCB_EXCHANGE_PORT_DATA via sysfs, FSF_QTCB_OPEN_PORT_WITH_DID or FSF_QTCB_CLOSE_PORT for WKA ports, FSF_QTCB_FCP_CMND for task management function (LUN / target reset). One or more pending requests can meanwhile have FSF_PROT_GOOD and FSF_GOOD because the channel filled in the response via DMA into the request's QTCB. In a theroretical case, inject code can create an erroneous FSF request on purpose. If data router is enabled, it uses deferred error reporting. A READ SCSI command can succeed with FSF_PROT_GOOD, FSF_GOOD, and SAM_STAT_GOOD. But on writing the read data to host memory via DMA, it can still fail, e.g. if an intentionally wrong scatter list does not provide enough space. Rather than getting an unsuccessful response, we get a QDIO activate check which in turn triggers adapter recovery. One or more pending requests can meanwhile have FSF_PROT_GOOD and FSF_GOOD because the channel filled in the response via DMA into the request's QTCB. Example trace records formatted with zfcpdbf from the s390-tools package: Timestamp : ... Area : HBA Subarea : 00 Level : 6 > default level => 3 <= default level Exception : - CPU ID : .. Caller : ... Record ID : 1 Tag : fs_norm => fs_rerr Request ID : 0x<request_ID2> Request status : 0x00001010 ZFCP_STATUS_FSFREQ_DISMISSED | ZFCP_STATUS_FSFREQ_CLEANUP FSF cmnd : 0x00000001 FSF sequence no: 0x... FSF issued : ... FSF stat : 0x00000000 FSF_GOOD FSF stat qual : 00000000 00000000 00000000 00000000 Prot stat : 0x00000001 FSF_PROT_GOOD Prot stat qual : ........ ........ 00000000 00000000 Port handle : 0x... LUN handle : 0x... | Timestamp : ... Area : SCSI Subarea : 00 Level : 3 Exception : - CPU ID : .. Caller : ... Record ID : 1 Tag : rsl_err Request ID : 0x<request_ID2> SCSI ID : 0x... SCSI LUN : 0x... SCSI result : 0x000e0000 DID_TRANSPORT_DISRUPTED SCSI retries : 0x00 SCSI allowed : 0x05 SCSI scribble : 0x<request_ID2> SCSI opcode : 28... Read(10) FCP rsp inf cod: 0x00 FCP rsp IU : 00000000 00000000 00000000 00000000 ^^ SAM_STAT_GOOD 00000000 00000000 Only with luck in both above cases, we could see a follow-on trace record of an unsuccesful event following a successful but late FSF response with FSF_PROT_GOOD and FSF_GOOD. Typically this was the case for I/O requests resulting in a SCSI trace record "rsl_err" with DID_TRANSPORT_DISRUPTED [On ZFCP_STATUS_FSFREQ_DISMISSED, zfcp_fsf_protstatus_eval() sets ZFCP_STATUS_FSFREQ_ERROR seen by the request handler functions as failure]. However, the reason for this follow-on trace was invisible because the corresponding HBA trace record was missing at the default trace level (by default hidden records with tags "fs_norm", "fs_qtcb", or "fs_open"). On adapter recovery, after we had shut down the QDIO queues, we perform unsuccessful pseudo completions with flag ZFCP_STATUS_FSFREQ_DISMISSED for each pending FSF request in zfcp_fsf_req_dismiss_all(). In order to find the root cause, we need to see all pseudo responses even if the channel presented them successfully with FSF_PROT_GOOD and FSF_GOOD. Therefore, check zfcp_fsf_req.status for ZFCP_STATUS_FSFREQ_DISMISSED or ZFCP_STATUS_FSFREQ_ERROR and trace with a new tag "fs_rerr". It does not matter that there are numerous places which set ZFCP_STATUS_FSFREQ_ERROR after the location where we trace an FSF response early. These cases are based on protocol status != FSF_PROT_GOOD or == FSF_PROT_FSF_STATUS_PRESENTED and are thus already traced by default as trace tag "fs_perr" or "fs_ferr" respectively. NB: The trace record with tag "fssrh_1" for status read buffers on dismiss all remains. zfcp_fsf_req_complete() handles this and returns early. All other FSF request types are handled separately and as described above. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: 8a36e4532e ("[SCSI] zfcp: enhancement of zfcp debug features") Fixes: 2e261af84c ("[SCSI] zfcp: Only collect FSF/HBA debug data for matching trace levels") Cc: <stable@vger.kernel.org> #2.6.38+ Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Signed-off-by: Benjamin Block <bblock@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-11-02 07:09:50 +01:00
Steffen Maier	bb5cf573ea	scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records ... commit 12c3e5754c8022a4f2fd1e9f00d19e99ee0d3cc1 upstream. If the FCP_RSP UI has optional parts (FCP_SNS_INFO or FCP_RSP_INFO) and thus does not fit into the fsp_rsp field built into a SCSI trace record, trace the full FCP_RSP UI with all optional parts as payload record instead of just FCP_SNS_INFO as payload and a 1 byte RSP_INFO_CODE part of FCP_RSP_INFO built into the SCSI record. That way we would also get the full FCP_SNS_INFO in case a target would ever send more than min(SCSI_SENSE_BUFFERSIZE==96, ZFCP_DBF_PAY_MAX_REC==256)==96. The mandatory part of FCP_RSP IU is only 24 bytes. PAYload costs at least one full PAY record of 256 bytes anyway. We cap to the hardware response size which is only FSF_FCP_RSP_SIZE==128. So we can just put the whole FCP_RSP IU with any optional parts into PAYload similarly as we do for SAN PAY since v4.9 commit aceeffbb59bb ("zfcp: trace full payload of all SAN records (req,resp,iels)"). This does not cause any additional trace records wasting memory. Decoded trace records were confusing because they showed a hard-coded sense data length of 96 even if the FCP_RSP_IU field FCP_SNS_LEN showed actually less. Since the same commit, we set pl_len for SAN traces to the full length of a request/response even if we cap the corresponding trace. In contrast, here for SCSI traces we set pl_len to the pre-computed length of FCP_RSP IU considering SNS_LEN or RSP_LEN if valid. Nonetheless we trace a hardcoded payload of length FSF_FCP_RSP_SIZE==128 if there were optional parts. This makes it easier for the zfcpdbf tool to format only the relevant part of the long FCP_RSP UI buffer. And any trailing information is still available in the payload trace record just in case. Rename the payload record tag from "fcp_sns" to "fcp_riu" to make the new content explicit to zfcpdbf which can then pick a suitable field name such as "FCP rsp IU all:" instead of "Sense info :" Also, the same zfcpdbf can still be backwards compatible with "fcp_sns". Old example trace record before this fix, formatted with the tool zfcpdbf from s390-tools: Timestamp : ... Area : SCSI Subarea : 00 Level : 3 Exception : - CPU id : .. Caller : 0x... Record id : 1 Tag : rsl_err Request id : 0x<request_id> SCSI ID : 0x... SCSI LUN : 0x... SCSI result : 0x00000002 SCSI retries : 0x00 SCSI allowed : 0x05 SCSI scribble : 0x<request_id> SCSI opcode : 00000000 00000000 00000000 00000000 FCP rsp inf cod: 0x00 FCP rsp IU : 00000000 00000000 00000202 00000000 ^^==FCP_SNS_LEN_VALID 00000020 00000000 ^^^^^^^^==FCP_SNS_LEN==32 Sense len : 96 <==min(SCSI_SENSE_BUFFERSIZE,ZFCP_DBF_PAY_MAX_REC) Sense info : 70000600 00000018 00000000 29000000 00000400 00000000 00000000 00000000 00000000 00000000 00000000 00000000<==superfluous 00000000 00000000 00000000 00000000<==superfluous 00000000 00000000 00000000 00000000<==superfluous 00000000 00000000 00000000 00000000<==superfluous New example trace records with this fix: Timestamp : ... Area : SCSI Subarea : 00 Level : 3 Exception : - CPU ID : .. Caller : 0x... Record ID : 1 Tag : rsl_err Request ID : 0x<request_id> SCSI ID : 0x... SCSI LUN : 0x... SCSI result : 0x00000002 SCSI retries : 0x00 SCSI allowed : 0x03 SCSI scribble : 0x<request_id> SCSI opcode : a30c0112 00000000 02000000 00000000 FCP rsp inf cod: 0x00 FCP rsp IU : 00000000 00000000 00000a02 00000200 00000020 00000000 FCP rsp IU len : 56 FCP rsp IU all : 00000000 00000000 00000a02 00000200 ^^=FCP_RESID_UNDER|FCP_SNS_LEN_VALID 00000020 00000000 70000500 00000018 ^^^^^^^^==FCP_SNS_LEN ^^^^^^^^^^^^^^^^^ 00000000 240000cb 00011100 00000000 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 00000000 00000000 ^^^^^^^^^^^^^^^^^==FCP_SNS_INFO Timestamp : ... Area : SCSI Subarea : 00 Level : 1 Exception : - CPU ID : .. Caller : 0x... Record ID : 1 Tag : lr_okay Request ID : 0x<request_id> SCSI ID : 0x... SCSI LUN : 0x... SCSI result : 0x00000000 SCSI retries : 0x00 SCSI allowed : 0x05 SCSI scribble : 0x<request_id> SCSI opcode : <CDB of unrelated SCSI command passed to eh handler> FCP rsp inf cod: 0x00 FCP rsp IU : 00000000 00000000 00000100 00000000 00000000 00000008 FCP rsp IU len : 32 FCP rsp IU all : 00000000 00000000 00000100 00000000 ^^==FCP_RSP_LEN_VALID 00000000 00000008 00000000 00000000 ^^^^^^^^==FCP_RSP_LEN ^^^^^^^^^^^^^^^^^==FCP_RSP_INFO Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: 250a1352b9 ("[SCSI] zfcp: Redesign of the debug tracing for SCSI records.") Cc: <stable@vger.kernel.org> #2.6.38+ Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Signed-off-by: Benjamin Block <bblock@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-11-02 07:09:49 +01:00
Steffen Maier	2c7bfb3408	scsi: zfcp: fix missing trace records for early returns in TMF eh handlers ... commit 1a5d999ebfc7bfe28deb48931bb57faa8e4102b6 upstream. For problem determination we need to see that we were in scsi_eh as well as whether and why we were successful or not. The following commits introduced new early returns without adding a trace record: v2.6.35 commit a1dbfddd02 ("[SCSI] zfcp: Pass return code from fc_block_scsi_eh to scsi eh") on fc_block_scsi_eh() returning != 0 which is FAST_IO_FAIL, v2.6.30 commit 63caf367e1 ("[SCSI] zfcp: Improve reliability of SCSI eh handlers in zfcp") on not having gotten an FSF request after the maximum number of retry attempts and thus could not issue a TMF and has to return FAILED. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: a1dbfddd02 ("[SCSI] zfcp: Pass return code from fc_block_scsi_eh to scsi eh") Fixes: 63caf367e1 ("[SCSI] zfcp: Improve reliability of SCSI eh handlers in zfcp") Cc: <stable@vger.kernel.org> #2.6.38+ Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Signed-off-by: Benjamin Block <bblock@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-11-02 07:09:44 +01:00
Benjamin Block	e7ab3bd99e	scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path ... commit a099b7b1fc1f0418ab8d79ecf98153e1e134656e upstream. Up until now zfcp would just ignore the FCP_RESID_OVER flag in the FCP response IU. When this flag is set, it is possible, in regards to the FCP standard, that the storage-server processes the command normally, up to the point where data is missing and simply ignores those. In this case no CHECK CONDITION would be set, and because we ignored the FCP_RESID_OVER flag we resulted in at least a data loss or even -corruption as a follow-up error, depending on how the applications/layers on top behave. To prevent this, we now set the host-byte of the corresponding scsi_cmnd to DID_ERROR. Other storage-behaviors, where the same condition results in a CHECK CONDITION set in the answer, don't need to be changed as they are handled in the mid-layer already. Following is an example trace record decoded with zfcpdbf from the s390-tools package. We forcefully injected a fc_dl which is one byte too small: Timestamp : ... Area : SCSI Subarea : 00 Level : 3 Exception : - CPU ID : .. Caller : 0x... Record ID : 1 Tag : rsl_err Request ID : 0x... SCSI ID : 0x... SCSI LUN : 0x... SCSI result : 0x00070000 ^^DID_ERROR SCSI retries : 0x.. SCSI allowed : 0x.. SCSI scribble : 0x... SCSI opcode : 2a000000 00000000 08000000 00000000 FCP rsp inf cod: 0x00 FCP rsp IU : 00000000 00000000 00000400 00000001 ^^fr_flags==FCP_RESID_OVER ^^fr_status==SAM_STAT_GOOD ^^^^^^^^fr_resid 00000000 00000000 As of now, we don't actively handle to possibility that a response IU has both flags - FCP_RESID_OVER and FCP_RESID_UNDER - set at once. Reported-by: Luke M. Hopkins <lmhopkin@us.ibm.com> Reviewed-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: 553448f6c4 ("[SCSI] zfcp: Message cleanup") Fixes: ea127f975424 ("[PATCH] s390 (7/7): zfcp host adapter.") (tglx/history.git) Cc: <stable@vger.kernel.org> #2.6.33+ Signed-off-by: Benjamin Block <bblock@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-11-01 22:12:44 +01:00
Steffen Maier	f609dac650	scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled ... commit 71b8e45da51a7b64a23378221c0a5868bd79da4f upstream. Since commit db007fc5e2 ("[SCSI] Command protection operation"), scsi_eh_prep_cmnd() saves scmd->prot_op and temporarily resets it to SCSI_PROT_NORMAL. Other FCP LLDDs such as qla2xxx and lpfc shield their queuecommand() to only access any of scsi_prot_sg...() if (scsi_get_prot_op(cmd) != SCSI_PROT_NORMAL). Do the same thing for zfcp, which introduced DIX support with commit ef3eb71d8b ("[SCSI] zfcp: Introduce experimental support for DIF/DIX"). Otherwise, TUR SCSI commands as part of scsi_eh likely fail in zfcp, because the regular SCSI command with DIX protection data, that scsi_eh re-uses in scsi_send_eh_cmnd(), of course still has (scsi_prot_sg_count() != 0) and so zfcp sends down bogus requests to the FCP channel hardware. This causes scsi_eh_test_devices() to have (finish_cmds == 0) [not SCSI device is online or not scsi_eh_tur() failed] so regular SCSI commands, that caused / were affected by scsi_eh, are moved to work_q and scsi_eh_test_devices() itself returns false. In turn, it unnecessarily escalates in our case in scsi_eh_ready_devs() beyond host reset to finally scsi_eh_offline_sdevs() which sets affected SCSI devices offline with the following kernel message: "kernel: sd H:0:T:L: Device offlined - not ready after error recovery" Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: ef3eb71d8b ("[SCSI] zfcp: Introduce experimental support for DIF/DIX") Cc: <stable@vger.kernel.org> #2.6.36+ Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Signed-off-by: Benjamin Block <bblock@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-11-01 22:12:44 +01:00
Gerald Schaefer	8cfc539f62	s390/vmlogrdr: fix IUCV buffer allocation ... commit 5457e03de918f7a3e294eb9d26a608ab8a579976 upstream. The buffer for iucv_message_receive() needs to be below 2 GB. In __iucv_message_receive(), the buffer address is casted to an u32, which would result in either memory corruption or an addressing exception when using addresses >= 2 GB. Fix this by using GFP_DMA for the buffer allocation. Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-06-20 14:03:24 +02:00
Julian Wiedmann	8e68a4d13a	s390/qdio: clear DSCI prior to scanning multiple input queues ... commit 1e4a382fdc0ba8d1a85b758c0811de3a3631085e upstream. For devices with multiple input queues, tiqdio_call_inq_handlers() iterates over all input queues and clears the device's DSCI during each iteration. If the DSCI is re-armed during one of the later iterations, we therefore do not scan the previous queues again. The re-arming also raises a new adapter interrupt. But its handler does not trigger a rescan for the device, as the DSCI has already been erroneously cleared. This can result in queue stalls on devices with multiple input queues. Fix it by clearing the DSCI just once, prior to scanning the queues. As the code is moved in front of the loop, we also need to access the DSCI directly (ie irq->dsci) instead of going via each queue's parent pointer to the same irq. This is not a functional change, and a follow-up patch will clean up the other users. In practice, this bug only affects CQ-enabled HiperSockets devices, ie. devices with sysfs-attribute "hsuid" set. Setting a hsuid is needed for AF_IUCV socket applications that use HiperSockets communication. Fixes: 104ea556ee ("qdio: support asynchronous delivery of storage blocks") Reviewed-by: Ursula Braun <ubraun@linux.vnet.ibm.com> Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-06-08 00:47:02 +02:00
Steffen Maier	01e26ca64b	scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send ... commit 2dfa6688aafdc3f74efeb1cf05fb871465d67f79 upstream. Dan Carpenter kindly reported: <quote> The patch d27a7cb91960: "zfcp: trace on request for open and close of WKA port" from Aug 10, 2016, leads to the following static checker warning: drivers/s390/scsi/zfcp_fsf.c:1615 zfcp_fsf_open_wka_port() warn: 'req' was already freed. drivers/s390/scsi/zfcp_fsf.c 1609 zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT); 1610 retval = zfcp_fsf_req_send(req); 1611 if (retval) 1612 zfcp_fsf_req_free(req); ^^^ Freed. 1613 out: 1614 spin_unlock_irq(&qdio->req_q_lock); 1615 if (req && !IS_ERR(req)) 1616 zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id); ^^^^^^^^^^^ Use after free. 1617 return retval; 1618 } Same thing for zfcp_fsf_close_wka_port() as well. </quote> Rather than relying on req being NULL (or ERR_PTR) for all cases where we don't want to trace or should not trace, simply check retval which is unconditionally initialized with -EIO != 0 and it can only become 0 on successful retval = zfcp_fsf_req_send(req). With that we can also remove the then again unnecessary unconditional initialization of req which was introduced with that earlier commit. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Suggested-by: Benjamin Block <bblock@linux.vnet.ibm.com> Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: d27a7cb91960 ("zfcp: trace on request for open and close of WKA port") Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Reviewed-by: Jens Remus <jremus@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-06-08 00:46:58 +02:00
Steffen Maier	1c2287b99f	scsi: zfcp: fix rport unblock race with LUN recovery ... commit 6f2ce1c6af37191640ee3ff6e8fc39ea10352f4c upstream. It is unavoidable that zfcp_scsi_queuecommand() has to finish requests with DID_IMM_RETRY (like fc_remote_port_chkready()) during the time window when zfcp detected an unavailable rport but fc_remote_port_delete(), which is asynchronous via zfcp_scsi_schedule_rport_block(), has not yet blocked the rport. However, for the case when the rport becomes available again, we should prevent unblocking the rport too early. In contrast to other FCP LLDDs, zfcp has to open each LUN with the FCP channel hardware before it can send I/O to a LUN. So if a port already has LUNs attached and we unblock the rport just after port recovery, recoveries of LUNs behind this port can still be pending which in turn force zfcp_scsi_queuecommand() to unnecessarily finish requests with DID_IMM_RETRY. This also opens a time window with unblocked rport (until the followup LUN reopen recovery has finished). If a scsi_cmnd timeout occurs during this time window fc_timed_out() cannot work as desired and such command would indeed time out and trigger scsi_eh. This prevents a clean and timely path failover. This should not happen if the path issue can be recovered on FC transport layer such as path issues involving RSCNs. Fix this by only calling zfcp_scsi_schedule_rport_register(), to asynchronously trigger fc_remote_port_add(), after all LUN recoveries as children of the rport have finished and no new recoveries of equal or higher order were triggered meanwhile. Finished intentionally includes any recovery result no matter if successful or failed (still unblock rport so other successful LUNs work). For simplicity, we check after each finished LUN recovery if there is another LUN recovery pending on the same port and then do nothing. We handle the special case of a successful recovery of a port without LUN children the same way without changing this case's semantics. For debugging we introduce 2 new trace records written if the rport unblock attempt was aborted due to still unfinished or freshly triggered recovery. The records are only written above the default trace level. Benjamin noticed the important special case of new recovery that can be triggered between having given up the erp_lock and before calling zfcp_erp_action_cleanup() within zfcp_erp_strategy(). We must avoid the following sequence: ERP thread rport_work other context ------------------------- -------------- -------------------------------- port is unblocked, rport still blocked, due to pending/running ERP action, so ((port->status & ...UNBLOCK) != 0) and (port->rport == NULL) unlock ERP zfcp_erp_action_cleanup() case ZFCP_ERP_ACTION_REOPEN_LUN: zfcp_erp_try_rport_unblock() ((status & ...UNBLOCK) != 0) [OLD!] zfcp_erp_port_reopen() lock ERP zfcp_erp_port_block() port->status clear ...UNBLOCK unlock ERP zfcp_scsi_schedule_rport_block() port->rport_task = RPORT_DEL queue_work(rport_work) zfcp_scsi_rport_work() (port->rport_task != RPORT_ADD) port->rport_task = RPORT_NONE zfcp_scsi_rport_block() if (!port->rport) return zfcp_scsi_schedule_rport_register() port->rport_task = RPORT_ADD queue_work(rport_work) zfcp_scsi_rport_work() (port->rport_task == RPORT_ADD) port->rport_task = RPORT_NONE zfcp_scsi_rport_register() (port->rport == NULL) rport = fc_remote_port_add() port->rport = rport; Now the rport was erroneously unblocked while the zfcp_port is blocked. This is another situation we want to avoid due to scsi_eh potential. This state would at least remain until the new recovery from the other context finished successfully, or potentially forever if it failed. In order to close this race, we take the erp_lock inside zfcp_erp_try_rport_unblock() when checking the status of zfcp_port or LUN. With that, the possible corresponding rport state sequences would be: (unblock[ERP thread],block[other context]) if the ERP thread gets erp_lock first and still sees ((port->status & ...UNBLOCK) != 0), (block[other context],NOP[ERP thread]) if the ERP thread gets erp_lock after the other context has already cleard ...UNBLOCK from port->status. Since checking fields of struct erp_action is unsafe because they could have been overwritten (re-used for new recovery) meanwhile, we only check status of zfcp_port and LUN since these are only changed under erp_lock elsewhere. Regarding the check of the proper status flags (port or port_forced are similar to the shown adapter recovery): [zfcp_erp_adapter_shutdown()] zfcp_erp_adapter_reopen() zfcp_erp_adapter_block() * clear UNBLOCK ---------------------------------------+ zfcp_scsi_schedule_rports_block() | write_lock_irqsave(&adapter->erp_lock, flags);-------+ | zfcp_erp_action_enqueue() | | zfcp_erp_setup_act() | | * set ERP_INUSE -----------------------------------|--|--+ write_unlock_irqrestore(&adapter->erp_lock, flags);--+ | | .context-switch. | | zfcp_erp_thread() | | zfcp_erp_strategy() | | write_lock_irqsave(&adapter->erp_lock, flags);------+ | | ... | | | zfcp_erp_strategy_check_target() | | | zfcp_erp_strategy_check_adapter() | | | zfcp_erp_adapter_unblock() | | | * set UNBLOCK -----------------------------------|--+ | zfcp_erp_action_dequeue() | | * clear ERP_INUSE ---------------------------------|-----+ ... | write_unlock_irqrestore(&adapter->erp_lock, flags);-+ Hence, we should check for both UNBLOCK and ERP_INUSE because they are interleaved. Also we need to explicitly check ERP_FAILED for the link down case which currently does not clear the UNBLOCK flag in zfcp_fsf_link_down_info_eval(). Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: 8830271c48 ("[SCSI] zfcp: Dont fail SCSI commands when transitioning to blocked fc_rport") Fixes: a2fa0aede0 ("[SCSI] zfcp: Block FC transport rports early on errors") Fixes: 5f852be9e1 ("[SCSI] zfcp: Fix deadlock between zfcp ERP and SCSI") Fixes: 338151e066 ("[SCSI] zfcp: make use of fc_remote_port_delete when target port is unavailable") Fixes: 3859f6a248 ("[PATCH] zfcp: add rports to enable scsi_add_device to work again") Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-06-08 00:46:49 +02:00
Steffen Maier	5d35a96311	scsi: zfcp: do not trace pure benign residual HBA responses at default level ... commit 56d23ed7adf3974f10e91b643bd230e9c65b5f79 upstream. Since quite a while, Linux issues enough SCSI commands per scsi_device which successfully return with FCP_RESID_UNDER, FSF_FCP_RSP_AVAILABLE, and SAM_STAT_GOOD. This floods the HBA trace area and we cannot see other and important HBA trace records long enough. Therefore, do not trace HBA response errors for pure benign residual under counts at the default trace level. This excludes benign residual under count combined with other validity bits set in FCP_RSP_IU, such as FCP_SNS_LEN_VAL. For all those other cases, we still do want to see both the HBA record and the corresponding SCSI record by default. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: a54ca0f62f ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.") Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-06-08 00:46:49 +02:00
Benjamin Block	54539504f0	scsi: zfcp: fix use-after-"free" in FC ingress path after TMF ... commit dac37e15b7d511e026a9313c8c46794c144103cd upstream. When SCSI EH invokes zFCP's callbacks for eh_device_reset_handler() and eh_target_reset_handler(), it expects us to relent the ownership over the given scsi_cmnd and all other scsi_cmnds within the same scope - LUN or target - when returning with SUCCESS from the callback ('release' them). SCSI EH can then reuse those commands. We did not follow this rule to release commands upon SUCCESS; and if later a reply arrived for one of those supposed to be released commands, we would still make use of the scsi_cmnd in our ingress tasklet. This will at least result in undefined behavior or a kernel panic because of a wrong kernel pointer dereference. To fix this, we NULLify all pointers to scsi_cmnds (struct zfcp_fsf_req *)->data in the matching scope if a TMF was successful. This is done under the locks (struct zfcp_adapter *)->abort_lock and (struct zfcp_reqlist *)->lock to prevent the requests from being removed from the request-hashtable, and the ingress tasklet from making use of the scsi_cmnd-pointer in zfcp_fsf_fcp_cmnd_handler(). For cases where a reply arrives during SCSI EH, but before we get a chance to NULLify the pointer - but before we return from the callback -, we assume that the code is protected from races via the CAS operation in blk_complete_request() that is called in scsi_done(). The following stacktrace shows an example for a crash resulting from the previous behavior: Unable to handle kernel pointer dereference at virtual kernel address fffffee17a672000 Oops: 0038 [#1] SMP CPU: 2 PID: 0 Comm: swapper/2 Not tainted task: 00000003f7ff5be0 ti: 00000003f3d38000 task.ti: 00000003f3d38000 Krnl PSW : 0404d00180000000 00000000001156b0 (smp_vcpu_scheduled+0x18/0x40) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 EA:3 Krnl GPRS: 000000200000007e 0000000000000000 fffffee17a671fd8 0000000300000015 ffffffff80000000 00000000005dfde8 07000003f7f80e00 000000004fa4e800 000000036ce8d8f8 000000036ce8d9c0 00000003ece8fe00 ffffffff969c9e93 00000003fffffffd 000000036ce8da10 00000000003bf134 00000003f3b07918 Krnl Code: 00000000001156a2: a7190000 lghi %r1,0 00000000001156a6: a7380015 lhi %r3,21 #00000000001156aa: e32050000008 ag %r2,0(%r5) >00000000001156b0: 482022b0 lh %r2,688(%r2) 00000000001156b4: ae123000 sigp %r1,%r2,0(%r3) 00000000001156b8: b2220020 ipm %r2 00000000001156bc: 8820001c srl %r2,28 00000000001156c0: c02700000001 xilf %r2,1 Call Trace: ([<0000000000000000>] 0x0) [<000003ff807bdb8e>] zfcp_fsf_fcp_cmnd_handler+0x3de/0x490 [zfcp] [<000003ff807be30a>] zfcp_fsf_req_complete+0x252/0x800 [zfcp] [<000003ff807c0a48>] zfcp_fsf_reqid_check+0xe8/0x190 [zfcp] [<000003ff807c194e>] zfcp_qdio_int_resp+0x66/0x188 [zfcp] [<000003ff80440c64>] qdio_kick_handler+0xdc/0x310 [qdio] [<000003ff804463d0>] __tiqdio_inbound_processing+0xf8/0xcd8 [qdio] [<0000000000141fd4>] tasklet_action+0x9c/0x170 [<0000000000141550>] __do_softirq+0xe8/0x258 [<000000000010ce0a>] do_softirq+0xba/0xc0 [<000000000014187c>] irq_exit+0xc4/0xe8 [<000000000046b526>] do_IRQ+0x146/0x1d8 [<00000000005d6a3c>] io_return+0x0/0x8 [<00000000005d6422>] vtime_stop_cpu+0x4a/0xa0 ([<0000000000000000>] 0x0) [<0000000000103d8a>] arch_cpu_idle+0xa2/0xb0 [<0000000000197f94>] cpu_startup_entry+0x13c/0x1f8 [<0000000000114782>] smp_start_secondary+0xda/0xe8 [<00000000005d6efe>] restart_int_handler+0x56/0x6c [<0000000000000000>] 0x0 Last Breaking-Event-Address: [<00000000003bf12e>] arch_spin_lock_wait+0x56/0xb0 Suggested-by: Steffen Maier <maier@linux.vnet.ibm.com> Signed-off-by: Benjamin Block <bblock@linux.vnet.ibm.com> Fixes: ea127f9754 ("[PATCH] s390 (7/7): zfcp host adapter.") (tglx/history.git) Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-06-08 00:46:49 +02:00
Dan Carpenter	7ddb258493	scsi: zfcp: spin_lock_irqsave() is not nestable ... commit e7cb08e894a0b876443ef8fdb0706575dc00a5d2 upstream. We accidentally overwrite the original saved value of "flags" so that we can't re-enable IRQs at the end of the function. Presumably this function is mostly called with IRQs disabled or it would be obvious in testing. Fixes: aceeffbb59bb ("zfcp: trace full payload of all SAN records (req,resp,iels)") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-02-06 23:33:13 +01:00
Steffen Maier	beb0b6c9a7	zfcp: trace full payload of all SAN records (req,resp,iels) ... commit aceeffbb59bb91404a0bda32a542d7ebf878433a upstream. This was lost with commit 2c55b750a8 ("[SCSI] zfcp: Redesign of the debug tracing for SAN records.") but is necessary for problem determination, e.g. to see the currently active zone set during automatic port scan. For the large GPN_FT response (4 pages), save space by not dumping any empty residual entries. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: 2c55b750a8 ("[SCSI] zfcp: Redesign of the debug tracing for SAN records.") Reviewed-by: Alexey Ishchuk <aishchuk@linux.vnet.ibm.com> Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-02-06 23:33:13 +01:00
Steffen Maier	569816b4a0	zfcp: fix payload trace length for SAN request&response ... commit 94db3725f049ead24c96226df4a4fb375b880a77 upstream. commit 2c55b750a8 ("[SCSI] zfcp: Redesign of the debug tracing for SAN records.") started to add FC_CT_HDR_LEN which made zfcp dump random data out of bounds for RSPN GS responses because u.rspn.rsp is the largest and last field in the union of struct zfcp_fc_req. Other request/response types only happened to stay within bounds due to the padding of the union or due to the trace capping of u.gspn.rsp to ZFCP_DBF_SAN_MAX_PAYLOAD. Timestamp : ... Area : SAN Subarea : 00 Level : 1 Exception : - CPU id : .. Caller : ... Record id : 2 Tag : fsscth2 Request id : 0x... Destination ID : 0x00fffffc Payload short : 01000000 fc020000 80020000 00000000 xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx <=== 00000000 00000000 00000000 00000000 Payload length : 32 <=== struct zfcp_fc_req { [0] struct zfcp_fsf_ct_els ct_els; [56] struct scatterlist sg_req; [96] struct scatterlist sg_rsp; union { struct {req; rsp;} adisc; SIZE: 28+28= 56 struct {req; rsp;} gid_pn; SIZE: 24+20= 44 struct {rspsg; req;} gpn_ft; SIZE: 40*4+20=180 struct {req; rsp;} gspn; SIZE: 20+273= 293 struct {req; rsp;} rspn; SIZE: 277+16= 293 [136] } u; } SIZE: 432 Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: 2c55b750a8 ("[SCSI] zfcp: Redesign of the debug tracing for SAN records.") Reviewed-by: Alexey Ishchuk <aishchuk@linux.vnet.ibm.com> Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-02-06 23:33:13 +01:00
Steffen Maier	46737af60b	zfcp: fix D_ID field with actual value on tracing SAN responses ... commit 771bf03537ddfa4a4dde62ef9dfbc82e4f77ab20 upstream. With commit 2c55b750a8 ("[SCSI] zfcp: Redesign of the debug tracing for SAN records.") we lost the N_Port-ID where an ELS response comes from. With commit 7c7dc19681 ("[SCSI] zfcp: Simplify handling of ct and els requests") we lost the N_Port-ID where a CT response comes from. It's especially useful if the request SAN trace record with D_ID was already lost due to trace buffer wrap. GS uses an open WKA port handle and ELS just a D_ID, and only for ELS we could get D_ID from QTCB bottom via zfcp_fsf_req. To cover both cases, add a new field to zfcp_fsf_ct_els and fill it in on request to use in SAN response trace. Strictly speaking the D_ID on SAN response is the FC frame's S_ID. We don't need a field for the other end which is always us. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: 2c55b750a8 ("[SCSI] zfcp: Redesign of the debug tracing for SAN records.") Fixes: 7c7dc19681 ("[SCSI] zfcp: Simplify handling of ct and els requests") Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-02-06 23:33:13 +01:00
Steffen Maier	8467dd468c	zfcp: restore tracing of handle for port and LUN with HBA records ... commit 7c964ffe586bc0c3d9febe9bf97a2e4b2866e5b7 upstream. This information was lost with commit a54ca0f62f ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.") but is required to debug e.g. invalid handle situations. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: a54ca0f62f ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.") Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-02-06 23:33:12 +01:00
Steffen Maier	6916909571	zfcp: trace on request for open and close of WKA port ... commit d27a7cb91960cf1fdd11b10071e601828cbf4b1f upstream. Since commit a54ca0f62f ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.") HBA records no longer contain WWPN, D_ID, or LUN to reduce duplicate information which is already in REC records. In contrast to "regular" target ports, we don't use recovery to open WKA ports such as directory/nameserver, so we don't get REC records. Therefore, introduce pseudo REC running records without any actual recovery action but including D_ID of WKA port on open/close. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: a54ca0f62f ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.") Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-02-06 23:33:12 +01:00
Steffen Maier	053077252d	zfcp: restore: Dont use 0 to indicate invalid LUN in rec trace ... commit 0102a30a6ff60f4bb4c07358ca3b1f92254a6c25 upstream. bring back commit d21e9daa63 ("[SCSI] zfcp: Dont use 0 to indicate invalid LUN in rec trace") which was lost with commit ae0904f60f ("[SCSI] zfcp: Redesign of the debug tracing for recovery actions.") Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: ae0904f60f ("[SCSI] zfcp: Redesign of the debug tracing for recovery actions.") Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-02-06 23:33:12 +01:00
Steffen Maier	909987d41f	zfcp: retain trace level for SCSI and HBA FSF response records ... commit 35f040df97fa0e94c7851c054ec71533c88b4b81 upstream. While retaining the actual filtering according to trace level, the following commits started to write such filtered records with a hardcoded record level of 1 instead of the actual record level: commit 250a1352b9 ("[SCSI] zfcp: Redesign of the debug tracing for SCSI records.") commit a54ca0f62f ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.") Now we can distinguish written records again for offline level filtering. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: 250a1352b9 ("[SCSI] zfcp: Redesign of the debug tracing for SCSI records.") Fixes: a54ca0f62f ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.") Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-02-06 23:33:12 +01:00
Steffen Maier	efaebcb4ac	zfcp: close window with unblocked rport during rport gone ... commit 4eeaa4f3f1d6c47b69f70e222297a4df4743363e upstream. On a successful end of reopen port forced, zfcp_erp_strategy_followup_success() re-uses the port erp_action and the subsequent zfcp_erp_action_cleanup() now sees ZFCP_ERP_SUCCEEDED with erp_action->action==ZFCP_ERP_ACTION_REOPEN_PORT instead of ZFCP_ERP_ACTION_REOPEN_PORT_FORCED but must not perform zfcp_scsi_schedule_rport_register(). We can detect this because the fresh port reopen erp_action is in its very first step ZFCP_ERP_STEP_UNINITIALIZED. Otherwise this opens a time window with unblocked rport (until the followup port reopen recovery would block it again). If a scsi_cmnd timeout occurs during this time window fc_timed_out() cannot work as desired and such command would indeed time out and trigger scsi_eh. This prevents a clean and timely path failover. This should not happen if the path issue can be recovered on FC transport layer such as path issues involving RSCNs. Also, unnecessary and repeated DID_IMM_RETRY for pending and undesired new requests occur because internally zfcp still has its zfcp_port blocked. As follow-on errors with scsi_eh, it can cause, in the worst case, permanently lost paths due to one of: sd <scsidev>: [<scsidisk>] Medium access timeout failure. Offlining disk! sd <scsidev>: Device offlined - not ready after error recovery For fix validation and to aid future debugging with other recoveries we now also trace (un)blocking of rports. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: 5767620c38 ("[SCSI] zfcp: Do not unblock rport from REOPEN_PORT_FORCED") Fixes: a2fa0aede0 ("[SCSI] zfcp: Block FC transport rports early on errors") Fixes: 5f852be9e1 ("[SCSI] zfcp: Fix deadlock between zfcp ERP and SCSI") Fixes: 338151e066 ("[SCSI] zfcp: make use of fc_remote_port_delete when target port is unavailable") Fixes: 3859f6a248 ("[PATCH] zfcp: add rports to enable scsi_add_device to work again") Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-02-06 23:33:12 +01:00
Steffen Maier	5f62704e88	zfcp: fix ELS/GS request&response length for hardware data router ... commit 70369f8e15b220f50a16348c79a61d3f7054813c upstream. In the hardware data router case, introduced with kernel 3.2 commit 86a9668a8d ("[SCSI] zfcp: support for hardware data router") the ELS/GS request&response length needs to be initialized as in the chained SBAL case. Otherwise, the FCP channel rejects ELS requests with FSF_REQUEST_SIZE_TOO_LARGE. Such ELS requests can be issued by user space through BSG / HBA API, or zfcp itself uses ADISC ELS for remote port link test on RSCN. The latter can cause a short path outage due to unnecessary remote target port recovery because the always failing ADISC cannot detect extremely short path interruptions beyond the local FCP channel. Below example is decoded with zfcpdbf from s390-tools: Timestamp : ... Area : SAN Subarea : 00 Level : 1 Exception : - CPU id : .. Caller : zfcp_dbf_san_req+0408 Record id : 1 Tag : fssels1 Request id : 0x<reqid> Destination ID : 0x00<target d_id> Payload info : 52000000 00000000 <our wwpn > [ADISC] <our wwnn > 00<s_id> 00000000 00000000 00000000 00000000 00000000 Timestamp : ... Area : HBA Subarea : 00 Level : 1 Exception : - CPU id : .. Caller : zfcp_dbf_hba_fsf_res+0740 Record id : 1 Tag : fs_ferr Request id : 0x<reqid> Request status : 0x00000010 FSF cmnd : 0x0000000b [FSF_QTCB_SEND_ELS] FSF sequence no: 0x... FSF issued : ... FSF stat : 0x00000061 [FSF_REQUEST_SIZE_TOO_LARGE] FSF stat qual : 00000000 00000000 00000000 00000000 Prot stat : 0x00000100 Prot stat qual : 00000000 00000000 00000000 00000000 Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: 86a9668a8d ("[SCSI] zfcp: support for hardware data router") Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-02-06 23:33:11 +01:00
Steffen Maier	6d35bb9a9f	zfcp: fix fc_host port_type with NPIV ... commit bd77befa5bcff8c51613de271913639edf85fbc2 upstream. For an NPIV-enabled FCP device, zfcp can erroneously show "NPort (fabric via point-to-point)" instead of "NPIV VPORT" for the port_type sysfs attribute of the corresponding fc_host. s390-tools that can be affected are dbginfo.sh and ziomon. zfcp_fsf_exchange_config_evaluate() ignores fsf_qtcb_bottom_config.connection_features indicating NPIV and only sets fc_host_port_type to FC_PORTTYPE_NPORT if fsf_qtcb_bottom_config.fc_topology is FSF_TOPO_FABRIC. Only the independent zfcp_fsf_exchange_port_evaluate() evaluates connection_features to overwrite fc_host_port_type to FC_PORTTYPE_NPIV in case of NPIV. Code was introduced with upstream kernel 2.6.30 commit 0282985da5 ("[SCSI] zfcp: Report fc_host_port_type as NPIV"). This works during FCP device recovery (such as set online) because it performs FSF_QTCB_EXCHANGE_CONFIG_DATA followed by FSF_QTCB_EXCHANGE_PORT_DATA in sequence. However, the zfcp-specific scsi host sysfs attributes "requests", "megabytes", or "seconds_active" trigger only zfcp_fsf_exchange_config_evaluate() resetting fc_host port_type to FC_PORTTYPE_NPORT despite NPIV. The zfcp-specific scsi host sysfs attribute "utilization" triggers only zfcp_fsf_exchange_port_evaluate() correcting the fc_host port_type again in case of NPIV. Evaluate fsf_qtcb_bottom_config.connection_features in zfcp_fsf_exchange_config_evaluate() where it belongs to. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Fixes: 0282985da5 ("[SCSI] zfcp: Report fc_host_port_type as NPIV") Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-02-06 23:33:11 +01:00
Stefan Haberland	2fe6f38f91	s390/dasd: fix hanging device after clear subchannel ... commit 9ba333dc55cbb9523553df973adb3024d223e905 upstream. When a device is in a status where CIO has killed all I/O by itself the interrupt for a clear request may not contain an irb to determine the clear function. Instead it contains an error pointer -EIO. This was ignored by the DASD int_handler leading to a hanging device waiting for a clear interrupt. Handle -EIO error pointer correctly for requests that are clear pending and treat the clear as successful. Signed-off-by: Stefan Haberland <sth@linux.vnet.ibm.com> Reviewed-by: Sebastian Ott <sebott@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Willy Tarreau <w@1wt.eu>	2017-02-06 23:32:57 +01:00
Ursula Braun	80e90a3123	qeth: delete napi struct when removing a qeth device ... commit 7831b4ff0d926e0deeaabef9db8800ed069a2757 upstream. A qeth_card contains a napi_struct linked to the net_device during device probing. This struct must be deleted when removing the qeth device, otherwise Panic on oops can occur when qeth devices are repeatedly removed and added. Fixes: a1c3ed4c9c ("qeth: NAPI support for l2 and l3 discipline") Cc: stable@vger.kernel.org # v2.6.37+ Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com> Tested-by: Alexander Klein <ALKL@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Willy Tarreau <w@1wt.eu>	2016-08-27 11:40:32 +02:00
Stefan Haberland	509a4bccfe	s390/dasd: fix refcount for PAV reassignment ... commit 9d862ababb609439c5d6987f6d3ddd09e703aa0b upstream. Add refcount to the DASD device when a summary unit check worker is scheduled. This prevents that the device is set offline with worker in place. Signed-off-by: Stefan Haberland <stefan.haberland@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2016-03-03 15:06:23 -08:00
Stefan Haberland	9155d3f258	s390/dasd: prevent incorrect length error under z/VM after PAV changes ... commit 020bf042e5b397479c1174081b935d0ff15d1a64 upstream. The channel checks the specified length and the provided amount of data for CCWs and provides an incorrect length error if the size does not match. Under z/VM with simulation activated the length may get changed. Having the suppress length indication bit set is stated as good CCW coding practice and avoids errors under z/VM. Signed-off-by: Stefan Haberland <stefan.haberland@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2016-03-03 15:06:22 -08:00
Mike Snitzer	30046ef03c	UPSTREAM: block: disable entropy contributions for nonrot devices ... (cherry picked from commit b277da0a8a594308e17881f4926879bd5fca2a2d) Clear QUEUE_FLAG_ADD_RANDOM in all block drivers that set QUEUE_FLAG_NONROT. Historically, all block devices have automatically made entropy contributions. But as previously stated in commit e2e1a148 ("block: add sysfs knob for turning off disk entropy contributions"): - On SSD disks, the completion times aren't as random as they are for rotational drives. So it's questionable whether they should contribute to the random pool in the first place. - Calling add_disk_randomness() has a lot of overhead. There are more reliable sources for randomness than non-rotational block devices. From a security perspective it is better to err on the side of caution than to allow entropy contributions from unreliable "random" sources. Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Jens Axboe <axboe@fb.com>	2016-02-10 01:37:31 +00:00
Kees Cook	e635e0d5b0	crypto: prefix module autoloading with "crypto-" ... commit 5d26a105b5a73e5635eae0629b42fa0a90e07b7b upstream. This prefixes all crypto module loading with "crypto-" so we never run the risk of exposing module auto-loading to userspace via a crypto API, as demonstrated by Mathias Krause: https://lkml.org/lkml/2013/3/4/70 Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2015-01-29 17:40:57 -08:00
Martin Schwidefsky	10baac9160	s390/3215: fix tty output containing tabs ... commit e512d56c799517f33b301d81e9a5e0ebf30c2d1e upstream. git commit 37f81fa1f6 "n_tty: do O_ONLCR translation as a single write" surfaced a bug in the 3215 device driver. In combination this broke tab expansion for tty ouput. The cause is an asymmetry in the behaviour of tty3215_ops->write vs tty3215_ops->put_char. The put_char function scans for '\t' but the write function does not. As the driver has logic for the '\t' expansion remove XTABS from c_oflag of the initial termios as well. Reported-by: Stephen Powell <zlinuxman@wowway.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2015-01-27 07:52:33 -08:00
Martin Schwidefsky	214a899e44	s390/3215: fix hanging console issue ... commit 26d766c60f4ea08cd14f0f3435a6db3d6cc2ae96 upstream. The ccw_device_start in raw3215_start_io can fail. raw3215_try_io does not check if the request could be started and removes any pending timer. This can leave the system in a hanging state. Check for pending request after raw3215_start_io and start a timer if necessary. Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2015-01-27 07:52:33 -08:00
Sebastian Ott	506841af86	s390/chsc: fix SEI usage on old FW levels ... commit 06cd7a874ec6e09d151aeb1fa8600e14f1ff89f6 upstream. Using a notification type mask for the store event information chsc is unsupported on some firmware levels. Retry SEI with that mask set to zero (which is the old way of requesting only channel subsystem related events). Reported-and-tested-by: Stefan Haberland <stefan.haberland@de.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.vnet.ibm.com> Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2014-05-13 13:59:42 +02:00
Sebastian Ott	6a52b43b32	s390/cio: fix driver callback initialization for ccw consoles ... commit 2253e8d79237c69086ded391e6767afe16972527 upstream. ccw consoles are in use before they can be properly registered with the driver core. For devices which are in use by a device driver we rely on the ccw_device's pointer to the driver callbacks to be valid. For ccw consoles this pointer is NULL until they are registered later during boot and we dereferenced this pointer. This worked by chance on 64 bit builds (cdev->drv was NULL but the optional callback cdev->drv->path_event was also NULL by coincidence) and was unnoticed until we received reports about boot failures on 31 bit systems. Fix it by initializing the driver pointer for ccw consoles. Reported-by: Mike Frysinger <vapier@gentoo.org> Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.vnet.ibm.com> Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2014-05-06 07:55:27 -07:00
Heiko Carstens	ed93fb01a3	s390/dasd: hold request queue sysfs lock when calling elevator_init() ... commit ef0899410ff630b2e75306da49996dbbfa318165 upstream. "elevator: Fix a race in elevator switching and md device initialization" changed the semantics of elevator_init() in a way that now enforces to hold the corresponding request queue's sysfs_lock when calling elevator_init() to fix a race. The patch did not convert the s390 dasd device driver which is the only device driver which also calls elevator_init(). So add the missing locking. Cc: Tomoki Sekiyama <tomoki.sekiyama@hds.com> Cc: Jens Axboe <axboe@kernel.dk> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Cc: Christian Borntraeger <christian@borntraeger.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2014-03-23 21:38:20 -07:00
Martin Schwidefsky	2202b3646c	s390/3270: fix allocation of tty3270_screen structure ... commit 36d9f4d3b68c7035ead3850dc85f310a579ed0eb upstream. The tty3270_alloc_screen function is called from tty3270_install with swapped arguments, the number of columns instead of rows and vice versa. The number of rows is typically smaller than the number of columns which makes the screen array too big but the individual cell arrays for the lines too small. Creating lines longer than the number of rows will clobber the memory after the end of the cell array. The fix is simple, call tty3270_alloc_screen with the correct argument order. Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2014-01-09 12:24:24 -08:00
Ursula Braun	9dc2f26742	qeth: avoid buffer overflow in snmp ioctl ... commit 6fb392b1a63ae36c31f62bc3fc8630b49d602b62 upstream. Check user-defined length in snmp ioctl request and allow request only if it fits into a qeth command buffer. Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com> Reviewed-by: Heiko Carstens <heicars2@linux.vnet.ibm.com> Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Fabian Yamaguchi <fabs@goesec.de> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2013-12-04 10:56:37 -08:00
Martin Peschke	e1a289ee67	SCSI: zfcp: fix schedule-inside-lock in scsi_device list loops ... commit 924dd584b198a58aa7cb3efefd8a03326550ce8f upstream. BUG: sleeping function called from invalid context at kernel/workqueue.c:2752 in_atomic(): 1, irqs_disabled(): 1, pid: 360, name: zfcperp0.0.1700 CPU: 1 Not tainted 3.9.3+ #69 Process zfcperp0.0.1700 (pid: 360, task: 0000000075b7e080, ksp: 000000007476bc30) <snip> Call Trace: ([<00000000001165de>] show_trace+0x106/0x154) [<00000000001166a0>] show_stack+0x74/0xf4 [<00000000006ff646>] dump_stack+0xc6/0xd4 [<000000000017f3a0>] __might_sleep+0x128/0x148 [<000000000015ece8>] flush_work+0x54/0x1f8 [<00000000001630de>] __cancel_work_timer+0xc6/0x128 [<00000000005067ac>] scsi_device_dev_release_usercontext+0x164/0x23c [<0000000000161816>] execute_in_process_context+0x96/0xa8 [<00000000004d33d8>] device_release+0x60/0xc0 [<000000000048af48>] kobject_release+0xa8/0x1c4 [<00000000004f4bf2>] __scsi_iterate_devices+0xfa/0x130 [<000003ff801b307a>] zfcp_erp_strategy+0x4da/0x1014 [zfcp] [<000003ff801b3caa>] zfcp_erp_thread+0xf6/0x2b0 [zfcp] [<000000000016b75a>] kthread+0xf2/0xfc [<000000000070c9de>] kernel_thread_starter+0x6/0xc [<000000000070c9d8>] kernel_thread_starter+0x0/0xc Apparently, the ref_count for some scsi_device drops down to zero, triggering device removal through execute_in_process_context(), while the lldd error recovery thread iterates through a scsi device list. Unfortunately, execute_in_process_context() decides to immediately execute that device removal function, instead of scheduling asynchronous execution, since it detects process context and thinks it is safe to do so. But almost all calls to shost_for_each_device() in our lldd are inside spin_lock_irq, even in thread context. Obviously, schedule() inside spin_lock_irq sections is a bad idea. Change the lldd to use the proper iterator function, __shost_for_each_device(), in combination with required locking. Occurences that need to be changed include all calls in zfcp_erp.c, since those might be executed in zfcp error recovery thread context with a lock held. Other occurences of shost_for_each_device() in zfcp_fsf.c do not need to be changed (no process context, no surrounding locking). The problem was introduced in Linux 2.6.37 by commit b62a8d9b45 "[SCSI] zfcp: Use SCSI device data zfcp_scsi_dev instead of zfcp_unit". Reported-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Martin Peschke <mpeschke@linux.vnet.ibm.com> Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2013-08-29 09:47:39 -07:00
Martin Peschke	bda5d1efa0	SCSI: zfcp: fix lock imbalance by reworking request queue locking ... commit d79ff142624e1be080ad8d09101f7004d79c36e1 upstream. This patch adds wait_event_interruptible_lock_irq_timeout(), which is a straight-forward descendant of wait_event_interruptible_timeout() and wait_event_interruptible_lock_irq(). The zfcp driver used to call wait_event_interruptible_timeout() in combination with some intricate and error-prone locking. Using wait_event_interruptible_lock_irq_timeout() as a replacement nicely cleans up that locking. This rework removes a situation that resulted in a locking imbalance in zfcp_qdio_sbal_get(): BUG: workqueue leaked lock or atomic: events/1/0xffffff00/10 last function: zfcp_fc_wka_port_offline+0x0/0xa0 [zfcp] It was introduced by commit c2af7545aa "[SCSI] zfcp: Do not wait for SBALs on stopped queue", which had a new code path related to ZFCP_STATUS_ADAPTER_QDIOUP that took an early exit without a required lock being held. The problem occured when a special, non-SCSI I/O request was being submitted in process context, when the adapter's queues had been torn down. In this case the bug surfaced when the Fibre Channel port connection for a well-known address was closed during a concurrent adapter shut-down procedure, which is a rare constellation. This patch also fixes these warnings from the sparse tool (make C=1): drivers/s390/scsi/zfcp_qdio.c:224:12: warning: context imbalance in 'zfcp_qdio_sbal_check' - wrong count at exit drivers/s390/scsi/zfcp_qdio.c:244:5: warning: context imbalance in 'zfcp_qdio_sbal_get' - unexpected unlock Last but not least, we get rid of that crappy lock-unlock-lock sequence at the beginning of the critical section. It is okay to call zfcp_erp_adapter_reopen() with req_q_lock held. Reported-by: Mikulas Patocka <mpatocka@redhat.com> Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Peschke <mpeschke@linux.vnet.ibm.com> Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2013-08-29 09:47:39 -07:00
Steffen Maier	8f425c63ec	SCSI: zfcp: status read buffers on first adapter open with link down ... commit 9edf7d75ee5f21663a0183d21f702682d0ef132f upstream. Commit 64deb6efdc "[SCSI] zfcp: Use status_read_buf_num provided by FCP channel" started using a value returned by the channel but only evaluated the value if the fabric link is up. Commit 8d88cf3f3b "[SCSI] zfcp: Update status read mempool" introduced mempool resizings based on the above value. On setting an FCP device online for the very first time since boot, a new zeroed adapter object is allocated. If the link is down, the number of status read requests remains zero. Since just the config data exchange is incomplete, we proceed with adapter open recovery. However, we unconditionally call mempool_resize with adapter->stat_read_buf_num == 0 in this case. This causes a kernel message "kernel BUG at mm/mempool.c:131!" in process "zfcperp<FCP-device-bus-ID>" with last function mempool_resize in Krnl PSW and zfcp_erp_thread in the Call Trace. Don't evaluate channel values which are invalid on link down. The number of status read requests is always valid, evaluated, and set to a positive minimum greater than zero. The adapter open recovery can proceed and the channel has status read buffers to inform us on a future link up event. While we are not aware of any other code path that could result in mempool resize attempts of size zero, we still also initialize the number of status read buffers to be posted to a static minimum number on adapter object allocation. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2013-07-25 14:07:30 -07:00
Steffen Maier	b22b838699	SCSI: zfcp: block queue limits with data router ... commit 5fea4291deacd80188b996d2f555fc6a1940e5d4 upstream. Commit 86a9668a8d "[SCSI] zfcp: support for hardware data router" reduced the initial block queue limits in the scsi_host_template to the absolute minimum and adjusted them later on. However, the adjustment was too late for the BSG devices of Scsi_Host and fc_host. Therefore, ioctl(..., SG_IO, ...) with request or response size > 4kB to a BSG device of an fc_host or a Scsi_Host fails with EINVAL. As a result, users of such ioctl such as HBA_SendCTPassThru() in libzfcphbaapi return with error HBA_STATUS_ERROR. Initialize the block queue limits in zfcp_scsi_host_template to the greatest common denominator (GCD). While we cannot exploit the slightly enlarged maximum request size with data router, this should be neglectible. Doing so also avoids running into trouble after live guest relocation (LGR) / migration from a data router FCP device to an FCP device that does not support data router. In that case, zfcp would figure out the new limits on adapter recovery, but the fc_host and Scsi_Host (plus in fact all sdevs) still exist with the old and now too large queue limits. It should also OK, not to use half the size as in the DIX case, because fc_host and Scsi_Host do not transport FCP requests including SCSI commands using protection data. Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Reviewed-by: Martin Peschke <mpeschke@linux.vnet.ibm.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2013-07-25 14:07:30 -07:00
Daniel Hansel	88bc592804	SCSI: zfcp: fix adapter (re)open recovery while link to SAN is down ... commit f76ccaac4f82c463a037aa4a1e4ccb85c7011814 upstream. FCP device remains in status ERP_FAILED when device is switched online or adapter recovery is triggered while link to SAN is down. When Exchange Configuration Data command returns the FSF status FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE it aborts the exchange process. The only retries are done during the common error recovery procedure (i.e. max. 3 retries with 8sec sleep between) and remains in status ERP_FAILED with QDIO down. This commit reverts the commit 0df138476c (zfcp: Fix adapter activation on link down). When FSF status FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE is received the adapter recovery will be finished without any retries. QDIO will be up now and status changes such as LINK UP will be received now. Signed-off-by: Daniel Hansel <daniel.hansel@linux.vnet.ibm.com> Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2013-07-25 14:07:30 -07:00
Benjamin Poirier	aaf9522d62	netiucv: Hold rtnl between name allocation and device registration. ... fixes a race condition between concurrent initializations of netiucv devices that try to use the same name. sysfs: cannot create duplicate filename '/devices/iucv/netiucv2' [...] Call Trace: ([<00000000002edea4>] sysfs_add_one+0xb0/0xdc) [<00000000002eecd4>] create_dir+0x80/0xfc [<00000000002eee38>] sysfs_create_dir+0xe8/0x118 [<00000000003835a8>] kobject_add_internal+0x120/0x2d0 [<00000000003839d6>] kobject_add+0x62/0x9c [<00000000003d9564>] device_add+0xcc/0x510 [<000003e00212c7b4>] netiucv_register_device+0xc0/0x1ec [netiucv] Signed-off-by: Benjamin Poirier <bpoirier@suse.de> Tested-by: Ursula Braun <braunu@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2013-06-13 17:41:18 -07:00
Stefan Weinhuber	8b811bae69	s390/dasd: fix handling of gone paths ... When a path is gone and dasd_generic_path_event is called with a PE_PATH_GONE event, we must assume that any I/O request on that subchannel is still running. This is unlike the dasd_generic_notify handler and the CIO_NO_PATH event, which implies that the subchannel has been cleared. If dasd_generic_path_event finds that the path has been the last usable path, it must not call dasd_generic_last_path_gone (which would reset the state of running requests), but just set the DASD_STOPPED_DC_WAIT bit. Signed-off-by: Stefan Weinhuber <wein@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>	2013-05-31 17:23:49 +02:00
Linus Torvalds	c4ad180f0e	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux ... Pull s390 update from Martin Schwidefsky: "An additional sysfs attribute for channel paths and a couple of bux fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/pgtable: fix ipte notify bit s390/xpram: mark xpram as non-rotational s390/smp: fix cpu re-scan vs. cpu state s390/cio: add channel ID sysfs attribute s390/ftrace: fix mcount adjustment s390: fix gmap_ipte_notifier vs. software dirty pages s390: disable pfmf for clear page instruction s390/disassembler: prevent endless loop in print_fn_code() s390: remove non existent reference to GENERIC_KERNEL_THREAD	2013-05-21 09:36:46 -07:00
Christian Borntraeger	00e5d35c0f	s390/xpram: mark xpram as non-rotational ... xpram is a memory technology. Lets mark that as non-rotational. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>	2013-05-17 11:47:04 +02:00