This is needed for the bcm2836 branch, pulling in the fixes
that went into rc5 to avoid a larger backmerge.

* depends/usb-fixes:
  usb: dwc2: fix kernel oops during driver probe
  usb: phy: mxs: add "fsl,imx6ul-usbphy" compatible string
  usb: gadget: f_midi: fix leak on failed to enqueue out requests
  usb: gadget: f_midi: Transmit data only when IN ep is enabled
  usb: dwc2: make otg clk optional
  usb: dwc2: Return errors from PHY
  usb: dwc2: Make PHY optional
  usb: renesas_usbhs: gadget: Fix NULL pointer dereference in usbhsg_ep_dequeue()
  usb: kconfig: fix warning of select USB_OTG
  usb: gadget: pxa27x: fix suspend callback
  usb: gadget: functionfs: fix missing access_ok checks
  usb: musb: USB_TI_CPPI41_DMA requires dmaengine support

Merge tag 'omap-for-v4.5/wakeup-m3' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into next/drivers

TI wakeup M3 IPC device driver for v4.5 merge window. This driver will
eventually allow am33xx and am437x to support PM with their Cortex-M3
power management processor.

This driver has been waiting to get merged for quite a while but has
had dependencies to the remoteproc that are now out of the way.

* tag 'omap-for-v4.5/wakeup-m3' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  soc: ti: Add wkup_m3_ipc driver
  Documentation: dt: add bindings for TI Wakeup M3 IPC device
Signed-off-by: Olof Johansson <olof@lixom.net>

Change the scpsys to builtin_platform_driver_probe.

Add regulator support for scpsys driver.

* tag 'v4.4-next-soc' of https://github.com/mbgg/linux-mediatek:
  drivers/soc: make mediatek/mtk-scpsys.c explicitly non-modular
  soc: mediatek: SCPSYS: Add regulator support
Signed-off-by: Olof Johansson <olof@lixom.net>

commit bbeaa595 ("MAINTAINERS: Change QCOM entries") was supposed to drop
Kumar, but didn't. Kumar acked the patch but I suspect Andy had a mistake in
a rebase. Fix it up.
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'qcom-soc-for-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux into next/drivers

Qualcomm ARM Based SoC Updates for 4.5

* Add WCNSS_CTRL client
* Various Kconfig changes to fix build issues
* Update SoC Qualcomm MAINTAINERS entry
* Add SMP2P, SMSM, and SMEM state machine drivers
* Add SMD-RPM support for existing platforms

* tag 'qcom-soc-for-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux:
  MAINTAINERS: Change QCOM entries
  soc: qcom: smd-rpm: Add existing platform support
  soc: qcom: Introduce WCNSS_CTRL SMD client
  ARM: qcom: select ARM_CPU_SUSPEND for power management
  MAINTAINERS: Add rules for Qualcomm dts files
  soc: qcom: enable smsm/smp2p modular build
  serial: msm_serial: Make config tristate
  soc: qcom: smp2p: Qualcomm Shared Memory Point to Point
  soc: qcom: smsm: Add driver for Qualcomm SMSM
  soc: qcom: Introduce common SMEM state machine code
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'tegra-for-4.5-memory' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into next/drivers

memory: tegra: Changes for v4.5-rc1

This is a single fix to improve performance of the SMMU on Tegra124.

* tag 'tegra-for-4.5-memory' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
  memory/tegra: Add number of TLB lines for Tegra124
Signed-off-by: Olof Johansson <olof@lixom.net>

The UniPhier System Bus is an external bus that connects on-board
devices to the UniPhier SoC.  Each bank (chip select) is dynamically
mapped to the CPU-viewed address base via the bus controller.  The
bus controller must be configured before any access to the bus.

This driver parses the "ranges" property of the System Bus node and
initialized the bus controller.  After the bus becomes ready, devices
below it are populated.

Note:
Each bank can be mapped anywhere in the supported address space;
there is nothing preventing us from assigning bank 0 on 0x42000000,
0x43000000, or anywhere as long as such region is not used by others.
So, the "ranges" is just one possible software configuration, which
does not seem to fit in device tree because device tree is a hardware
description language.  However, of_translate_address() requires
"ranges" in every bus node between CPUs and device mapped on the CPU
address space.  In other words, "ranges" properties must be statically
defined in device tree.  After some discussion, I decided the dynamic
address reassignment by the driver is too bothersome.  Instead, the
device tree should provide a reasonable translation setup that the OS
can rely on.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Acked-by: Rob Herring <robh@kernel.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Olof Johansson <olof@lixom.net>

The Kconfig currently controlling compilation of this code is:

drivers/soc/mediatek/Kconfig:config MTK_SCPSYS
drivers/soc/mediatek/Kconfig:   bool "MediaTek SCPSYS Support"

...meaning that it currently is not being built as a module by anyone.

Lets remove the couple traces of modularity so that when reading the
driver there is no doubt it is builtin-only.

Since module_platform_driver() uses the same init level priority as
builtin_platform_driver() the init ordering remains unchanged with
this commit.

Cc: Matthias Brugger <matthias.bgg@gmail.com>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Daniel Kurtz <djkurtz@chromium.org>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Olof Johansson <olof@lixom.net>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-mediatek@lists.infradead.org
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>

The power domains are supplied by regulators. Add support for them so
that the regulators are properly turned on before a domain is powered up
and turned off when a domain is powered down.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>

This patch changes the email address for Andy Gross and David Brown and drops
Kumar Gala.  In addition, it changes the location of the repository
Signed-off-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Andy Gross <agross@codeaurora.org>
Acked-by: David Brown <david.brown@linaro.org>
Acked-by: Kumar Gala <galak@codeaurora.org>

This patch adds support for all current Qualcomm platforms which utilize
RPM over SMD.  This includes both MSM8916 and APQ8084.
Reviewed-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
Signed-off-by: Andy Gross <agross@codeaurora.org>

Tegra124 was accidentally left out when the number of TLB lines was
parameterized in commit 11cec15b ("iommu/tegra-smmu: Parameterize
number of TLB lines"). Fortunately this doesn't cause any noticeable
regressions upstream, presumably because there aren't any use-cases
that exercise enough pressure on the SMMU. But it is a regression
nonetheless, so let's fix it.

Fixes: 11cec15b ("iommu/tegra-smmu: Parameterize number of TLB lines")
Signed-off-by: Vince Hsu <vince.h@nvidia.com>
Signed-off-by: Tomasz Figa <tfiga@chromium.org>
[treding@nvidia.com: extract from unrelated patch]
Signed-off-by: Thierry Reding <treding@nvidia.com>

We need to include <linux/module.h> to build the driver as a loadable
module:

drivers/reset/hisilicon/hi6220_reset.c:108:1: warning: data definition has no type or storage class
 postcore_initcall(hi6220_reset_init);
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge "Reset controller changes for v4.5 v2" from Philipp Zabel:

- oftree support for getting reset devices by index
- fixed return value consistency of of_reset_control_get
- added support for STi co-processor resets
- added STi status callback
- added HiSilicon Hi6220 reset driver
- added ath79 system restart support
- various fixes

* tag 'reset-for-4.5-2' of git://git.pengutronix.de/git/pza/linux:
  reset: ath79: Add system restart support
  arm64: dts: Add reset dts config for Hisilicon Hi6220 SoC
  reset: hi6220: Reset driver for hisilicon hi6220 SoC
  reset: hisilicon: document hisi-hi6220 reset controllers bindings
  reset: remove unused device pointer from struct reset_control

Merge "Reset controller changes for v4.5" from Philipp Zabel:

- oftree support for getting reset devices by index
- fixed return value consistency of of_reset_control_get
- added support for STi co-processor resets
- added STi status callback
- various fixes

* tag 'reset-for-4.5' of git://git.pengutronix.de/git/pza/linux:
  reset: check return value of reset_controller_register()
  reset: remove redundant $(CONFIG_RESET_CONTROLLER) from Makefile
  reset: use ENOTSUPP instead of ENOSYS
  reset: sunxi: mark the of_device_id array as __initconst
  reset: sti: add a missing blank line after declaration
  reset: sti: Provide ops .status() call-back
  reset: sti: Add support for resetting co-processors
  ARM: STi: Add DT defines for co-processor reset lines
  reset: Fix of_reset_control_get() for consistent return values
  reset: add of_reset_control_get_by_index()

The WCNSS_CTRL SMD client is used for among other things upload nv
firmware to a newly booted WCNSS chip.
Signed-off-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
Signed-off-by: Andy Gross <agross@codeaurora.org>

The qcom spm driver uses cpu_resume_arm(), which is not included
in the kernel in all configurations:

drivers/built-in.o: In function `qcom_cpu_spc':
:(.text+0xbc022): undefined reference to `cpu_suspend'
drivers/built-in.o: In function `qcom_cpuidle_init':
:(.init.text+0x610c): undefined reference to `cpu_resume_arm'

This adds a 'select' Kconfig statement to ensure it's always
enabled.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Andy Gross <agross@codeaurora.org>

Make the get_maintainer script pick up the proper maintainers for the
Qualcomm dts files.
Signed-off-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
Signed-off-by: Andy Gross <agross@codeaurora.org>

The newly added smp2p and smsm drivers cannot be loadable modules
but depend on smem, which can be, and that causes a link error:

drivers/built-in.o: In function `qcom_smp2p_intr':
:(.text+0xa6e68): undefined reference to `qcom_smem_get'
drivers/built-in.o: In function `qcom_smp2p_probe':
:(.text+0xa7320): undefined reference to `qcom_smem_alloc'
:(.text+0xa736c): undefined reference to `qcom_smem_get'
drivers/built-in.o: In function `qcom_smsm_probe':
:(.text+0xa7b34): undefined reference to `qcom_smem_get'

This marks all the drivers as 'tristate' to make the Kconfig
dependency resolution work properly.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: dbb04bd7122f ("soc: qcom: smp2p: Qualcomm Shared Memory Point to Point")
Fixes: d7387fc6add4 ("soc: qcom: smsm: Add driver for Qualcomm SMSM")
Signed-off-by: Andy Gross <agross@codeaurora.org>

This driver works as a module, so mark it as a tristate config
instead of a bool.

Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Reviewed-by: Andy Gross <agross@codeaurora.org>
Signed-off-by: Andy Gross <agross@codeaurora.org>

Introduce the Qualcomm Shard Memory Point to Point driver.
Signed-off-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
Signed-off-by: Andy Gross <agross@codeaurora.org>

This driver exposed the Qualcomm Shared Memory State Machine bits.
Signed-off-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
Signed-off-by: Andy Gross <agross@codeaurora.org>

This implements a common API for handling and exposing SMP2P and SMSM
state information.
Signed-off-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
Signed-off-by: Andy Gross <agross@codeaurora.org>

Introduce a wkup_m3_ipc driver to handle communication between the MPU
and Cortex M3 wkup_m3 present on am335x.

This driver is responsible for actually booting the wkup_m3_rproc and
also handling all IPC which is done using the IPC registers in the control
module, a mailbox, and a separate interrupt back from the wkup_m3. A small
API is exposed for executing specific power commands, which include
configuring for low power mode, request a transition to a low power mode,
and status info on a previous transition.
Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>

Add the device tree bindings document for the TI Wakeup M3 IPC
device on AM33xx and AM43xx SoCs. These devices are used by the
TI wkup_m3_ipc driver, and contain the registers upon which the
IPC protocol to communicate with the Wakeup M3 processor is
implemented.
Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
Signed-off-by: Suman Anna <s-anna@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>

Pull nouveau and radeon fixes from Dave Airlie:
 "Just some nouveau and radeon/amdgpu fixes.

  The nouveau fixes look large as the firmware context files are
  regenerated, but the actual change is quite small"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon: make some dpm errors debug only
  drm/nouveau/volt/pwm/gk104: fix an off-by-one resulting in the voltage not being set
  drm/nouveau/nvif: allow userspace access to its own client object
  drm/nouveau/gr/gf100-: fix oops when calling zbc methods
  drm/nouveau/gr/gf117-: assume no PPC if NV_PGRAPH_GPC_GPM_PD_PES_TPC_ID_MASK is zero
  drm/nouveau/gr/gf117-: read NV_PGRAPH_GPC_GPM_PD_PES_TPC_ID_MASK from correct GPC
  drm/nouveau/gr/gf100-: split out per-gpc address calculation macro
  drm/nouveau/bios: return actual size of the buffer retrieved via _ROM
  drm/nouveau/instmem: protect instobj list with a spinlock
  drm/nouveau/pci: enable c800 magic for some unknown Samsung laptop
  drm/nouveau/pci: enable c800 magic for Clevo P157SM
  drm/radeon: make rv770_set_sw_state failures non-fatal
  drm/amdgpu: move dependency handling out of atomic section v2
  drm/amdgpu: optimize scheduler fence handling
  drm/amdgpu: remove vm->mutex
  drm/amdgpu: add mutex for ba_va->valids/invalids
  drm/amdgpu: adapt vce session create interface changes
  drm/amdgpu: vce use multiple cache surface starting from stoney
  drm/amdgpu: reset vce trap interrupt flag

Pull RTC fixes from Alexandre Belloni:
 "Two fixes for the ds1307 alarm and wakeup"

* tag 'rtc-4.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:
  rtc: ds1307: fix alarm reading at probe time
  rtc: ds1307: fix kernel splat due to wakeup irq handling

Pull MIPS fix from Ralf Baechle:
 "Just a fix for empty loops that may be removed by non-antique GCC"

* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
  MIPS: Fix delay loops which may be removed by GCC.

Pull m68k fixes from Geert Uytterhoeven:
 "Summary:

   - Add missing initialization of max_pfn, which is needed to make
     selftests/vm/mlock2-tests succeed,

   - Wire up new mlock2 syscall"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
  m68k: Wire up mlock2
  m68knommu: Add missing initialization of max_pfn and {min,max}_low_pfn
  m68k/mm: sun3 - Add missing initialization of max_pfn and {min,max}_low_pfn
  m68k/mm: m54xx - Add missing initialization of max_pfn
  m68k/mm: motorola - Add missing initialization of max_pfn

Pull ARM fixes from Russell King:
 "Just two changes this time around:

   - wire up the new mlock2 syscall added during the last merge window

   - fix a build problem with certain configurations provoked by making
     CONFIG_OF user selectable"

* 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
  ARM: 8454/1: OF implies OF_FLATTREE
  ARM: wire up mlock2 syscall

Pull SCSI target fixes from Nicholas Bellinger:
 - fix tcm-user backend driver expired cmd time processing (agrover)
 - eliminate kref_put_spinlock_irqsave() for I/O completion (bart)
 - fix iscsi login kthread failure case hung task regression (nab)
 - fix COMPARE_AND_WRITE completion use-after-free race (nab)
 - fix COMPARE_AND_WRITE with SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC non zero
   SGL offset data corruption.  (Jan + Doug)
 - fix >= v4.4-rc1 regression for tcm_qla2xxx enable configfs attribute
   (Himanshu + HCH)

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  target/stat: print full t10_wwn.model buffer
  target: fix COMPARE_AND_WRITE non zero SGL offset data corruption
  qla2xxx: Fix regression introduced by target configFS changes
  kref: Remove kref_put_spinlock_irqsave()
  target: Invoke release_cmd() callback without holding a spinlock
  target: Fix race for SCF_COMPARE_AND_WRITE_POST checking
  iscsi-target: Fix rx_login_comp hang after login failure
  iscsi-target: return -ENOMEM instead of -1 in case of failed kmalloc()
  target/user: Do not set unused fields in tcmu_ops
  target/user: Fix time calc in expired cmd processing

Pull thermal management fixes from Zhang Rui:
 "Specifics:

 - several fixes and cleanups on Rockchip thermal drivers.

 - add the missing support of RK3368 SoCs in Rockchip driver.

 - small fixes on of-thermal, power_allocator, rcar driver, IMX, and
   QCOM drivers, and also compilation fixes, on thermal.h, when thermal
   is not selected"

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
  imx: thermal: use CPU temperature grade info for thresholds
  thermal: fix thermal_zone_bind_cooling_device prototype
  Revert "thermal: qcom_spmi: allow compile test"
  thermal: rcar_thermal: remove redundant operation
  thermal: of-thermal: Reduce log level for message when can't fine thermal zone
  thermal: power_allocator: Use temperature reading from tz
  thermal: rockchip: Support the RK3368 SoCs in thermal driver
  thermal: rockchip: consistently use int for temperatures
  thermal: rockchip: Add the sort mode for adc value increment or decrement
  thermal: rockchip: improve the conversion function
  thermal: rockchip: trivial: fix typo in commit
  thermal: rockchip: better to compatible the driver for different SoCs
  dt-bindings: rockchip-thermal: Support the RK3368 SoCs compatible

Cut 'n paste error saw it only process sizeof(t10_wwn.vendor) characters.
Signed-off-by: David Disseldorp <ddiss@suse.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

target_core_sbc's compare_and_write functionality suffers from taking
data at the wrong memory location when writing a CAW request to disk
when a SGL offset is non-zero.

This can happen with loopback and vhost-scsi fabric drivers when
SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC is used to map existing user-space
SGL memory into COMPARE_AND_WRITE READ/WRITE payload buffers.

Given the following sample LIO subtopology,

% targetcli ls /loopback/
o- loopback ................................. [1 Target]
  o- naa.6001405ebb8df14a ....... [naa.60014059143ed2b3]
    o- luns ................................... [2 LUNs]
      o- lun0 ................ [iblock/ram0 (/dev/ram0)]
      o- lun1 ................ [iblock/ram1 (/dev/ram1)]
% lsscsi -g
[3:0:1:0]    disk    LIO-ORG  IBLOCK           4.0   /dev/sdc   /dev/sg3
[3:0:1:1]    disk    LIO-ORG  IBLOCK           4.0   /dev/sdd   /dev/sg4

the following bug can be observed in Linux 4.3 and 4.4~rc1:

% perl -e 'print chr$_ for 0..255,reverse 0..255' >rand
% perl -e 'print "\0" x 512' >zero
% cat rand >/dev/sdd
% sg_compare_and_write -i rand -D zero --lba 0 /dev/sdd
% sg_compare_and_write -i zero -D rand --lba 0 /dev/sdd
Miscompare reported
% hexdump -Cn 512 /dev/sdd
00000000  0f 0e 0d 0c 0b 0a 09 08  07 06 05 04 03 02 01 00
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
*
00000200

Rather than writing all-zeroes as instructed with the -D file, it
corrupts the data in the sector by splicing some of the original
bytes in. The page of the first entry of cmd->t_data_sg includes the
CDB, and sg->offset is set to a position past the CDB. I presume that
sg->offset is also the right choice to use for subsequent sglist
members.
Signed-off-by: Jan Engelhardt <jengelh@netitwork.de>
Tested-by: Douglas Gilbert <dgilbert@interlog.com>
Cc: <stable@vger.kernel.org> # v3.12+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

this patch fixes following regression

 # targetcli
 [Errno 13] Permission denied: '/sys/kernel/config/target/qla2xxx/21:00:00:0e:1e:08:c7:20/tpgt_1/enable'

Fixes: 2eafd729 ("target: use per-attribute show and store methods")
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

The last user is gone. Hence remove this function.
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Joern Engel <joern@logfs.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

This patch fixes the following kernel warning because it avoids that
IRQs are disabled while ft_release_cmd() is invoked (fc_seq_set_resp()
invokes spin_unlock_bh()):

WARNING: CPU: 3 PID: 117 at kernel/softirq.c:150 __local_bh_enable_ip+0xaa/0x110()
Call Trace:
 [<ffffffff814f71eb>] dump_stack+0x4f/0x7b
 [<ffffffff8105e56a>] warn_slowpath_common+0x8a/0xc0
 [<ffffffff8105e65a>] warn_slowpath_null+0x1a/0x20
 [<ffffffff81062b2a>] __local_bh_enable_ip+0xaa/0x110
 [<ffffffff814ff229>] _raw_spin_unlock_bh+0x39/0x40
 [<ffffffffa03a7f94>] fc_seq_set_resp+0xe4/0x100 [libfc]
 [<ffffffffa02e604a>] ft_free_cmd+0x4a/0x90 [tcm_fc]
 [<ffffffffa02e6972>] ft_release_cmd+0x12/0x20 [tcm_fc]
 [<ffffffffa042bd66>] target_release_cmd_kref+0x56/0x90 [target_core_mod]
 [<ffffffffa042caf0>] target_put_sess_cmd+0xc0/0x110 [target_core_mod]
 [<ffffffffa042cb81>] transport_release_cmd+0x41/0x70 [target_core_mod]
 [<ffffffffa042d975>] transport_generic_free_cmd+0x35/0x420 [target_core_mod]
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Acked-by: Joern Engel <joern@logfs.org>
Reviewed-by: Andy Grover <agrover@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

This patch addresses a race + use after free where the first
stage of COMPARE_AND_WRITE in compare_and_write_callback()
is rescheduled after the backend sends the secondary WRITE,
resulting in second stage compare_and_write_post() callback
completing in target_complete_ok_work() before the first
can return.

Because current code depends on checking se_cmd->se_cmd_flags
after return from se_cmd->transport_complete_callback(),
this results in first stage having SCF_COMPARE_AND_WRITE_POST
set, which incorrectly falls through into second stage CAW
processing code, eventually triggering a NULL pointer
dereference due to use after free.

To address this bug, pass in a new *post_ret parameter into
se_cmd->transport_complete_callback(), and depend upon this
value instead of ->se_cmd_flags to determine when to return
or fall through into ->queue_status() code for CAW.

Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: <stable@vger.kernel.org> # v3.12+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

This patch addresses a case where iscsi_target_do_tx_login_io()
fails sending the last login response PDU, after the RX/TX
threads have already been started.

The case centers around iscsi_target_rx_thread() not invoking
allow_signal(SIGINT) before the send_sig(SIGINT, ...) occurs
from the failure path, resulting in RX thread hanging
indefinately on iscsi_conn->rx_login_comp.

Note this bug is a regression introduced by:

  commit e5419865
  Author: Nicholas Bellinger <nab@linux-iscsi.org>
  Date:   Wed Jul 22 23:14:19 2015 -0700

      iscsi-target: Fix iscsit_start_kthreads failure OOPs

To address this bug, complete ->rx_login_complete for good
measure in the failure path, and immediately return from
RX thread context if connection state did not actually reach
full feature phase (TARG_CONN_STATE_LOGGED_IN).

Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: <stable@vger.kernel.org> # v3.10+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>