In point-to-point mode, if the PLOGI to the remote port times
out, it can get deleted by the remote port module.  Since there's
no reference by the local port, lport->ptp_data points to a freed
rport, and when the local port is reset and tries to logout again,
an oops occurs in mutex_lock_nested().

Hold a reference count on the point-to-point rdata.
Signed-off-by: NJoe Eykholt <jeykholt@cisco.com>
Signed-off-by: NRobert Love <robert.w.love@intel.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Reduce indentation in fc_rport_recv_prli_req() using gotos.
Also add payload length checks.
Signed-off-by: NJoe Eykholt <jeykholt@cisco.com>
Signed-off-by: NRobert Love <robert.w.love@intel.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

This patch replaces incorrect base address space flag with correct IO
resource flag.  Also, performs check of memory resource to validate
resource before using.
Signed-off-by: NRichard A Lary <rlary@linux.vnet.ibm.com>
Acked-by: N"Desai, Kashyap" <Kashyap.Desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

The variable bfa_itnim is initialized twice to the same (side effect-free)
expression.  Drop one initialization.

A simplified version of the semantic match that finds this problem is:
(http://coccinelle.lip6.fr/)

// <smpl>
@forall@
idexpression *x;
identifier f!=ERR_PTR;
@@

x = f(...)
... when != x
(
x = f(...,<+...x...+>,...)
|
* x = f(...)
)
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Acked-by: NJing Huang <huangj@brocade.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

struct pmcraid_ioctl_header member buffer_length is unsigned, so this
check appears redundant.
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Acked-by: NAnil Ravindranath <anil_ravindranath@pmc-sierra.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

This allows i == MAXHA, which is out of range
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

The region set by the call to memset is immediately overwritten by the
subsequent call to memcpy.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression e1,e2,e3,e4;
@@

- memset(e1,e2,e3);
  memcpy(e1,e4,e3);
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Acked-by: NJack Wang <jack_wang@usish.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

external host not connecting after controller reboot: The
problem is : devices are not coming back after having the cable
disconnected then reconnected. The problem is because the
driver/firmware device removal handshake is failing. Due to this failure,
the controller firmware is not sending out device add events when the target
is reconnected. This is root caused to a race in the driver/firmware device
removal algorithm. There is duplicate code in both interrupt and user
context; where target reset is being issue from user context path while
sas_iounit_control(OP_REMOVE) is being sent from interrupt context. An
active target_reset will fail the OP_REMOVE. To fix this problem, the
duplicate code has been removed from user context path.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Upgraded version string.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Reviewed-by: NEric Moore <eric.moore@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

modified _scsih_sas_device_find_by_handle
so to handle the search on both list(device list and device_init_list)
Also, we moved the priority of the
search so the ioc->sas_device_list is done first.  The
"sas_device_init_list" is only used during the 1st port enable, so its
unlikely there’s devices on it.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Reviewed-by: NEric Moore <eric.moore@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Add the cancel_pending_work flag from the fw_event_work structure, and then to
set the flag during host reset, check the flag later from work threads
context and if cancel_pending_work_flag is set ingore those events.

Now Rescan after host reset is changed.
Added special task MPT2SAS_RESCAN_AFTER_HOST_RESET. This task will be queued
at the time of HBA reset. this task is treated as barrier. All work after
MPT2SAS_RESCAN_AFTER_HOST_RESET will be treated as new work and will be
server by callback handle. If host_recovery is going on while running RESCAN
task, it will wait for shos_recovery_done completion which will be called
from HBA reset DONE context.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Reviewed-by: NEric Moore <eric.moore@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

The rport structure defines dev_loss_tmo as u32, which is
later multiplied with HZ to get the actual timeout value.
This might overflow for large dev_loss_tmo values. So we
should be better using u64 as intermediate variables here
to protect against overflow.
Signed-off-by: NHannes Reinecke <hare@suse.de>
Acked-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

scsi_dma_map() returns -1 if an error occurred (zero means that the
command has no data). So the following current code can't catch an
error:

sges_left = scsi_dma_map(scmd);
if (!sges_left) {
	sdev_printk(KERN_ERR, scmd->device, "pci_map_sg"
	" failed: request for %d bytes!\n", scsi_bufflen(scmd));
	return -ENOMEM;
}
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: N"Desai, Kashyap" <Kashyap.Desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

This small patch forces 60 second timeouts for the older 3w-xxxx &
3w-9xxx drivers for systems that don't contain the udev rule for
setting scsi timeouts to 60 seconds.
Signed-off-by: NAdam Radford <aradford@gmail.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Stanse found that one error path in qla24xx_bsg_timeout omits to
unlock ha->hardware_lock. Fix that.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Acked-by: NGiridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Stanse found that two error paths in lpfc_bsg_rport_els_cmp and
lpfc_issue_ct_rsp_cmp omits to unlock phba->ct_ev_lock. It is
because they wrongly unlock phba->hbalock instead. Fix that.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Acked-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Stanse found that one error path in mgmt_invalidate_icds omits to unlock
ctrl->mbox_lock. Fix that.

Added in 756d29c8 (Enable async mode for mcc rings)
where the spinlock was moved.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Acked-by: NJayamohan Kallickal <jayamohank@serverengines.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

adpt_i2o_delete_hba() calls kfree() so we have to save "pHba->next"
before calling it.  Also inside adpt_i2o_delete_hba() itself, there
was another use after free bug which I fixed by moving the kfree()
down a line.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

I don't claim to understand the tty layer, but it seems like hvc_open and
hvc_close should be balanced in their kref reference counting.

Right now we get a kref every call to hvc_open:

        if (hp->count++ > 0) {
                tty_kref_get(tty); <----- here
                spin_unlock_irqrestore(&hp->lock, flags);
                hvc_kick();
                return 0;
        } /* else count == 0 */

        tty->driver_data = hp;

        hp->tty = tty_kref_get(tty); <------ or here if hp->count was 0

But hvc_close has:

        tty_kref_get(tty);

        if (--hp->count == 0) {
...
                /* Put the ref obtained in hvc_open() */
                tty_kref_put(tty);
...
        }

        tty_kref_put(tty);

Since the outside kref get/put balance we only do a single kref_put when
count reaches 0.

The patch below changes things to call tty_kref_put once for every
hvc_close call, and with that my machine boots fine.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Acked-by: NAmit Shah <amit.shah@redhat.com>
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>

Move MULTIPORT feature and related config changes
out of exported headers, and disable the feature
at runtime.

At this point, it seems less risky to keep code around
until we can enable it than rip it out completely.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>

The get_buf() API sets the second arg to the number of bytes *written*
by the other side; in this case it should be zero as these are output buffers.

lguest gets this right (obviously kvm's console doesn't), resulting in
continual buildup of console writes.
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
Acked-by: NAmit Shah <amit.shah@redhat.com>

Currently early_put_chars is not used by virtio_console because it can
only be used once a port has been found, at which point it's too late
because it is no longer needed. This patch should fix it.
Acked-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>

Hide uncached_access() when pgprot_noncached is not #defined.  This prevents
the following warning:

	  CC      drivers/char/mem.o
	drivers/char/mem.c:229: warning: 'uncached_access' defined but not used

Repairs d7d4d849 ("drivers/char/mem.c:
cleanups").
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

On exit paths in mxc_rtc_probe() method some resources are not freed
correctly.

This patch fixes:
* unrequested memory region containing imx RTC registers
* iounmap() isn't called on exit_free_pdata branch
* clock get rate is called for freed clock source
* clock isn't disabled on exit_put_clk branch

To simplify the fix managed device resources are used.

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: NVladimir Zapolskiy <vzapolskiy@gmail.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Daniel Mack <daniel@caiaq.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

commit dcefafb6 ("/dev/mem: dont allow seek to last page") inadvertently
disabled rewinding on /dev/mem.

This broke x86info for example.
Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
Acked-by: NWu Fengguang <fengguang.wu@intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Requested by hch, for consistency now it is exported.

Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Anton Blanchard <anton@samba.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Jan Kara <jack@suse.cz>
Cc: Jeff Moyer <jmoyer@redhat.com>
Cc: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Commit 148f948b (vfs: Introduce new
helpers for syncing after writing to O_SYNC file or IS_SYNC inode) broke
the raw driver.

We now call through generic_file_aio_write -> generic_write_sync ->
vfs_fsync_range.  vfs_fsync_range has:

        if (!fop || !fop->fsync) {
                ret = -EINVAL;
                goto out;
        }

But drivers/char/raw.c doesn't set an fsync method.

We have two options: fix it or remove the raw driver completely.  I'm
happy to do either, the fact this has been broken for so long suggests it
is rarely used.

The patch below adds an fsync method to the raw driver.  My knowledge of
the block layer is pretty sketchy so this could do with a once over.

If we instead decide to remove the raw driver, this patch might still be
useful as a backport to 2.6.33 and 2.6.32.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Reviewed-by: NJan Kara <jack@suse.cz>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Jens Axboe <jens.axboe@oracle.com>
Reviewed-by: NJeff Moyer <jmoyer@redhat.com>
Tested-by: NJeff Moyer <jmoyer@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Since Valentin's email address @siemens.com is no longer valid, it's time
to change it to the one that actually works so that I don't have to
manually forward patches against mb862xx to him every time.
Signed-off-by: NAlexander Shishkin <virtuoso@slind.org>
Acked-by: NValentin Sitdikov <v.sitdikov@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

mb862xxfb_accel built as a separate module, but it does not have a
MODULE_LICENSE, so it taints the kernel.  Add a MODULE_LICENSE to it (same
as mb862xxfb license).

mb862xxfb_accel: module license 'unspecified' taints kernel.

Or should mb862xxfb_accel be built into the mb862xxfb binary file instead?
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Acked-by: NAlexander Shishkin <virtuoso@slind.org>
Cc: Valentin Sitdikov <v.sitdikov@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

I hit this when we had a bug in IDR for a few days.  Basically sysfs would
fail to create new inodes since it uses an IDR and therefore class_create
would fail.

While we are unlikely to see this fail we may as well handle it instead of
oopsing.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Reviewed-by: NWu Fengguang <fengguang.wu@intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Made necessary by 6992f533 ("sysfs: Use
one lockdep class per sysfs attribute").

Prevents further "key xxx not in .data" bug-reports.  Although some
attributes could probably be converted to static ones, this is left for
people having hardware to test.

Found by this semantic patch:

@ init @
type T;
identifier A;
@@

        T {
                ...
                struct device_attribute A;
                ...
        };

@ main extends init @
expression E;
statement S;
identifier err;
T *name;
@@

        ... when != sysfs_attr_init(&name->A.attr);
(
+       sysfs_attr_init(&name->A.attr);
        if (device_create_file(E, &name->A))
                S
|
+       sysfs_attr_init(&name->A.attr);
        err = device_create_file(E, &name->A);
)

While reviewing, I put the initialization to apropriate places.
Signed-off-by: NWolfram Sang <w.sang@pengutronix.de>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Greg KH <gregkh@suse.de>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Grant Likely <grant.likely@secretlab.ca>
Cc: Mike Isely <isely@pobox.com>
Cc: Mauro Carvalho Chehab <mchehab@infradead.org>
Cc: Sujith Thomas <sujith.thomas@intel.com>
Cc: Matthew Garrett <mjg@redhat.com>
Cc: Len Brown <len.brown@intel.com>
Cc: Krzysztof Helt <krzysztof.h1@wp.pl>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Initialize sysfs attributes before device_create_file call.

Addresses https://bugzilla.kernel.org/show_bug.cgi?id=15548Signed-off-by: NWolfram Sang <w.sang@pengutronix.de>
Signed-off-by: NSergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Greg KH <gregkh@suse.de>
Cc: Zhang Rui <rui.zhang@intel.com>
Cc: Len Brown <len.brown@intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

We take the spin_lock again in fail_all_cmds() so we need to unlock here.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Acked-by: NSteve Cameron <scameron@beardog.cce.hp.com>
Cc: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This should be spin_lock_irq() to match the spin_unlock_irq().  Originally
it was a lock_kernel() but we switched everything to spin_lock_irq() last
November.

[akpm@linux-foundation.org: fix the MOXA_ASPP_MON case too (per Jiri)]
Signed-off-by: NDan Carpenter <error27@gmail.com>
Cc: Jiri Slaby <jirislaby@gmail.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The reset of data lines when the card is removed from the cage results in
a failure.The failure is seen if the card is removed from the cage when TC
is pending after a CMD with data received CC.The reset logic leaves the
controller in a state where niether a TC is received nor DTO.

The rest code can be safely removed here since it is taken care in the IRQ
handler.
Signed-off-by: NMadhusudhan Chikkature <madhu.cr@ti.com>
Cc: Adrian Hunter <adrian.hunter@nokia.com>
Cc: <linux-mmc@vger.kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In an error handling case the lock is not unlocked.  The return is
converted to a goto, to share the unlock at the end of the function.

A simplified version of the semantic patch that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@r exists@
expression E1;
identifier f;
@@

f (...) { <+...
* spin_lock_irqsave (E1,...);
... when != E1
* return ...;
...+> }
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Cc: <richard.rojfors@pelagicore.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

rs_init() is failing to restore interrupts on two error paths, and is
incorrectly calling tty_unregister_driver() with local interrupts
disabled.

Fix these things by disabling interrupts later, after the reauest_irq()
calls.

A simplified version of the semantic patch that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@r exists@
expression E1;
identifier f;
@@

f (...) { <+...
* local_irq_save (E1,...);
... when != E1
* return ...;
...+> }
// </smpl>

[akpm@linux-foundation.org: reimplement the fix]
Signed-off-by: NJulia Lawall <julia@diku.dk>
Cc: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Commit c2e13037 ("platform-drivers: move
probe to .devinit.text in drivers/video") introduced a huge amount of
section mismatch warnings in vesafb code.  Rather than converting all of
the annotations, do the obvious and revert the __init -> __devinit change,
and use the recommended (in that patch) alternative to calling
platform_driver_register(): vesafb depends on information obtained from by
kernel at boot time, cannot be a module, and no post-boot devices can ever
show up.
Signed-off-by: NJan Beulich <jbeulich@novell.com>
Cc: Greg KH <greg@kroah.com>
Acked-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

When ide taskfile access is being used (for example with hdparm --security
commands) and cfq scheduler is selected, the scheduler crashes on BUG in
cfq_put_request.

The reason is that the cfq scheduler is tracking counts of read and write
requests separately; the ide-taskfile subsystem allocates a read request and
then flips the flag to make it a write request. The counters in cfq will
mismatch.

This patch changes ide-taskfile to allocate the READ or WRITE request as
required and don't change the flag later.
Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

NODEMASK_ALLOC/FREE are mapped to kmalloc/free if NODES_SHIFT > 8.
Among its several users, drivers/base/node.c wasn't including slab.h
leading to build failure if NODES_SHIFT > 8.  Include slab.h from
drivers/base/node.c.

This isn't an ideal solution but including slab.h directly from
nodemask.h is not an option because nodemask.h gets included
everywhere.  For now, make it work by including slab.h from its users.
Signed-off-by: NTejun Heo <tj@kernel.org>
Reported-by: NIngo Molnar <mingo@elte.hu>