Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2018-08-09 14:47:15 +0200
committerTakashi Iwai <tiwai@suse.de>2018-08-09 14:47:15 +0200
commit6bff971011eb57652b9cf5be604e2caee82607c5 (patch)
tree47002a58f34b270644b74a9a91affc3ba8737c65
parentd8f791d08536c1515fb68e114cb7cb3a6f9fe7f2 (diff)
parentf922d1b3bb8cc972427a135603d3f71862f60222 (diff)
Merge branch 'SLE12-SP3' into SLE12-SP3_EMBARGOrpm-4.4.143-94.47
-rw-r--r--patches.drivers/ibmvnic-Remove-code-to-request-error-information.patch292
-rw-r--r--patches.drivers/ibmvnic-Revise-RX-TX-queue-error-messages.patch107
-rw-r--r--patches.drivers/ibmvnic-Update-firmware-error-reporting-with-cause-s.patch74
-rw-r--r--patches.fixes/IB-isert-fix-T10-pi-check-mask-setting.patch39
-rw-r--r--patches.fixes/RDMA-ocrdma-Fix-an-error-code-in-ocrdma_alloc_pd.patch36
-rw-r--r--patches.fixes/RDMA-ocrdma-Fix-error-codes-in-ocrdma_create_srq.patch34
-rw-r--r--patches.fixes/blkcg-simplify-statistic-accumulation-code.patch57
-rw-r--r--patches.fixes/block-swim-Fix-array-bounds-check.patch103
-rw-r--r--patches.fixes/dm-thin-metadata-remove-needless-work-from-__commit_.patch50
-rw-r--r--patches.fixes/genirq-Make-force-irq-threading-setup-more-robust.patch67
-rw-r--r--patches.fixes/libata-don-t-try-to-pass-through-NCQ-commands-to-non.patch66
-rw-r--r--patches.fixes/null_blk-use-sector_div-instead-of-do_div.patch58
-rw-r--r--patches.fixes/scsi-qlogicpti-Fix-an-error-handling-path-in-qpti_sb.patch48
-rw-r--r--patches.fixes/scsi-sg-fix-minor-memory-leak-in-error-path.patch35
-rw-r--r--patches.fixes/scsi-target-fix-crash-with-iscsi-target-and-dvd.patch51
-rw-r--r--series.conf17
16 files changed, 1134 insertions, 0 deletions
diff --git a/patches.drivers/ibmvnic-Remove-code-to-request-error-information.patch b/patches.drivers/ibmvnic-Remove-code-to-request-error-information.patch
new file mode 100644
index 0000000000..5d19a52db7
--- /dev/null
+++ b/patches.drivers/ibmvnic-Remove-code-to-request-error-information.patch
@@ -0,0 +1,292 @@
+From 79dabbb7161f43ed29ca888a2488f59e47171aee Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.vnet.ibm.com>
+Date: Mon, 6 Aug 2018 21:39:58 -0500
+Subject: [PATCH] ibmvnic: Remove code to request error information
+
+References: bsc#1104174
+Patch-mainline: queued
+Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: 79dabbb7161f43ed29ca888a2488f59e47171aee
+
+When backing device firmware reports an error, it provides an
+error ID, which is meant to be queried for more detailed error
+information. Currently, however, an error ID is not provided by
+the Virtual I/O server and there are not any plans to do so. For
+now, it is always unfilled or zero, so request_error_information
+will never be called. Remove it.
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 144 +------------------------------------
+ drivers/net/ethernet/ibm/ibmvnic.h | 33 ---------
+ 2 files changed, 1 insertion(+), 176 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index ffe7acbeaa22..109e4a58efad 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -718,23 +718,6 @@ static int init_tx_pools(struct net_device *netdev)
+ return 0;
+ }
+
+-static void release_error_buffers(struct ibmvnic_adapter *adapter)
+-{
+- struct device *dev = &adapter->vdev->dev;
+- struct ibmvnic_error_buff *error_buff, *tmp;
+- unsigned long flags;
+-
+- spin_lock_irqsave(&adapter->error_list_lock, flags);
+- list_for_each_entry_safe(error_buff, tmp, &adapter->errors, list) {
+- list_del(&error_buff->list);
+- dma_unmap_single(dev, error_buff->dma, error_buff->len,
+- DMA_FROM_DEVICE);
+- kfree(error_buff->buff);
+- kfree(error_buff);
+- }
+- spin_unlock_irqrestore(&adapter->error_list_lock, flags);
+-}
+-
+ static void ibmvnic_napi_enable(struct ibmvnic_adapter *adapter)
+ {
+ int i;
+@@ -896,7 +879,6 @@ static void release_resources(struct ibmvnic_adapter *adapter)
+ release_tx_pools(adapter);
+ release_rx_pools(adapter);
+
+- release_error_buffers(adapter);
+ release_napi(adapter);
+ release_login_rsp_buffer(adapter);
+ }
+@@ -3843,133 +3825,16 @@ static void handle_query_ip_offload_rsp(struct ibmvnic_adapter *adapter)
+ ibmvnic_send_crq(adapter, &crq);
+ }
+
+-static void handle_error_info_rsp(union ibmvnic_crq *crq,
+- struct ibmvnic_adapter *adapter)
+-{
+- struct device *dev = &adapter->vdev->dev;
+- struct ibmvnic_error_buff *error_buff, *tmp;
+- unsigned long flags;
+- bool found = false;
+- int i;
+-
+- if (!crq->request_error_rsp.rc.code) {
+- dev_info(dev, "Request Error Rsp returned with rc=%x\n",
+- crq->request_error_rsp.rc.code);
+- return;
+- }
+-
+- spin_lock_irqsave(&adapter->error_list_lock, flags);
+- list_for_each_entry_safe(error_buff, tmp, &adapter->errors, list)
+- if (error_buff->error_id == crq->request_error_rsp.error_id) {
+- found = true;
+- list_del(&error_buff->list);
+- break;
+- }
+- spin_unlock_irqrestore(&adapter->error_list_lock, flags);
+-
+- if (!found) {
+- dev_err(dev, "Couldn't find error id %x\n",
+- be32_to_cpu(crq->request_error_rsp.error_id));
+- return;
+- }
+-
+- dev_err(dev, "Detailed info for error id %x:",
+- be32_to_cpu(crq->request_error_rsp.error_id));
+-
+- for (i = 0; i < error_buff->len; i++) {
+- pr_cont("%02x", (int)error_buff->buff[i]);
+- if (i % 8 == 7)
+- pr_cont(" ");
+- }
+- pr_cont("\n");
+-
+- dma_unmap_single(dev, error_buff->dma, error_buff->len,
+- DMA_FROM_DEVICE);
+- kfree(error_buff->buff);
+- kfree(error_buff);
+-}
+-
+-static void request_error_information(struct ibmvnic_adapter *adapter,
+- union ibmvnic_crq *err_crq)
+-{
+- struct device *dev = &adapter->vdev->dev;
+- struct net_device *netdev = adapter->netdev;
+- struct ibmvnic_error_buff *error_buff;
+- unsigned long timeout = msecs_to_jiffies(30000);
+- union ibmvnic_crq crq;
+- unsigned long flags;
+- int rc, detail_len;
+-
+- error_buff = kmalloc(sizeof(*error_buff), GFP_ATOMIC);
+- if (!error_buff)
+- return;
+-
+- detail_len = be32_to_cpu(err_crq->error_indication.detail_error_sz);
+- error_buff->buff = kmalloc(detail_len, GFP_ATOMIC);
+- if (!error_buff->buff) {
+- kfree(error_buff);
+- return;
+- }
+-
+- error_buff->dma = dma_map_single(dev, error_buff->buff, detail_len,
+- DMA_FROM_DEVICE);
+- if (dma_mapping_error(dev, error_buff->dma)) {
+- netdev_err(netdev, "Couldn't map error buffer\n");
+- kfree(error_buff->buff);
+- kfree(error_buff);
+- return;
+- }
+-
+- error_buff->len = detail_len;
+- error_buff->error_id = err_crq->error_indication.error_id;
+-
+- spin_lock_irqsave(&adapter->error_list_lock, flags);
+- list_add_tail(&error_buff->list, &adapter->errors);
+- spin_unlock_irqrestore(&adapter->error_list_lock, flags);
+-
+- memset(&crq, 0, sizeof(crq));
+- crq.request_error_info.first = IBMVNIC_CRQ_CMD;
+- crq.request_error_info.cmd = REQUEST_ERROR_INFO;
+- crq.request_error_info.ioba = cpu_to_be32(error_buff->dma);
+- crq.request_error_info.len = cpu_to_be32(detail_len);
+- crq.request_error_info.error_id = err_crq->error_indication.error_id;
+-
+- rc = ibmvnic_send_crq(adapter, &crq);
+- if (rc) {
+- netdev_err(netdev, "failed to request error information\n");
+- goto err_info_fail;
+- }
+-
+- if (!wait_for_completion_timeout(&adapter->init_done, timeout)) {
+- netdev_err(netdev, "timeout waiting for error information\n");
+- goto err_info_fail;
+- }
+-
+- return;
+-
+-err_info_fail:
+- spin_lock_irqsave(&adapter->error_list_lock, flags);
+- list_del(&error_buff->list);
+- spin_unlock_irqrestore(&adapter->error_list_lock, flags);
+-
+- kfree(error_buff->buff);
+- kfree(error_buff);
+-}
+-
+ static void handle_error_indication(union ibmvnic_crq *crq,
+ struct ibmvnic_adapter *adapter)
+ {
+ struct device *dev = &adapter->vdev->dev;
+
+- dev_err(dev, "Firmware reports %serror id %x, cause %d\n",
++ dev_err(dev, "Firmware reports %serror, cause %d\n",
+ crq->error_indication.flags
+ & IBMVNIC_FATAL_ERROR ? "FATAL " : "",
+- be32_to_cpu(crq->error_indication.error_id),
+ be16_to_cpu(crq->error_indication.error_cause));
+
+- if (be32_to_cpu(crq->error_indication.error_id))
+- request_error_information(adapter, crq);
+-
+ if (crq->error_indication.flags & IBMVNIC_FATAL_ERROR)
+ ibmvnic_reset(adapter, VNIC_RESET_FATAL);
+ else
+@@ -4468,10 +4333,6 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq,
+ netdev_dbg(netdev, "Got Error Indication\n");
+ handle_error_indication(crq, adapter);
+ break;
+- case REQUEST_ERROR_RSP:
+- netdev_dbg(netdev, "Got Error Detail Response\n");
+- handle_error_info_rsp(crq, adapter);
+- break;
+ case REQUEST_STATISTICS_RSP:
+ netdev_dbg(netdev, "Got Statistics Response\n");
+ complete(&adapter->stats_done);
+@@ -4830,9 +4691,6 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
+
+ spin_lock_init(&adapter->stats_lock);
+
+- INIT_LIST_HEAD(&adapter->errors);
+- spin_lock_init(&adapter->error_list_lock);
+-
+ INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
+ INIT_LIST_HEAD(&adapter->rwi_list);
+ mutex_init(&adapter->reset_lock);
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index f9fb780102ac..f06eec145ca6 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -512,24 +512,6 @@ struct ibmvnic_error_indication {
+ u8 reserved2[2];
+ } __packed __aligned(8);
+
+-struct ibmvnic_request_error_info {
+- u8 first;
+- u8 cmd;
+- u8 reserved[2];
+- __be32 ioba;
+- __be32 len;
+- __be32 error_id;
+-} __packed __aligned(8);
+-
+-struct ibmvnic_request_error_rsp {
+- u8 first;
+- u8 cmd;
+- u8 reserved[2];
+- __be32 error_id;
+- __be32 len;
+- struct ibmvnic_rc rc;
+-} __packed __aligned(8);
+-
+ struct ibmvnic_link_state_indication {
+ u8 first;
+ u8 cmd;
+@@ -709,8 +691,6 @@ union ibmvnic_crq {
+ struct ibmvnic_request_debug_stats request_debug_stats;
+ struct ibmvnic_request_debug_stats request_debug_stats_rsp;
+ struct ibmvnic_error_indication error_indication;
+- struct ibmvnic_request_error_info request_error_info;
+- struct ibmvnic_request_error_rsp request_error_rsp;
+ struct ibmvnic_link_state_indication link_state_indication;
+ struct ibmvnic_change_mac_addr change_mac_addr;
+ struct ibmvnic_change_mac_addr change_mac_addr_rsp;
+@@ -809,8 +789,6 @@ enum ibmvnic_commands {
+ SET_PHYS_PARMS = 0x07,
+ SET_PHYS_PARMS_RSP = 0x87,
+ ERROR_INDICATION = 0x08,
+- REQUEST_ERROR_INFO = 0x09,
+- REQUEST_ERROR_RSP = 0x89,
+ LOGICAL_LINK_STATE = 0x0C,
+ LOGICAL_LINK_STATE_RSP = 0x8C,
+ REQUEST_STATISTICS = 0x0D,
+@@ -945,14 +923,6 @@ struct ibmvnic_rx_pool {
+ struct ibmvnic_long_term_buff long_term_buff;
+ };
+
+-struct ibmvnic_error_buff {
+- char *buff;
+- dma_addr_t dma;
+- int len;
+- struct list_head list;
+- __be32 error_id;
+-};
+-
+ struct ibmvnic_vpd {
+ unsigned char *buff;
+ dma_addr_t dma_addr;
+@@ -1047,9 +1017,6 @@ struct ibmvnic_adapter {
+ struct completion init_done;
+ int init_done_rc;
+
+- struct list_head errors;
+- spinlock_t error_list_lock;
+-
+ struct completion fw_done;
+ int fw_done_rc;
+
+--
+2.13.7
+
diff --git a/patches.drivers/ibmvnic-Revise-RX-TX-queue-error-messages.patch b/patches.drivers/ibmvnic-Revise-RX-TX-queue-error-messages.patch
new file mode 100644
index 0000000000..fff3f0c3af
--- /dev/null
+++ b/patches.drivers/ibmvnic-Revise-RX-TX-queue-error-messages.patch
@@ -0,0 +1,107 @@
+From 2d14d3795294d42aacc278948984a480569bcc23 Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.vnet.ibm.com>
+Date: Fri, 13 Jul 2018 12:03:32 -0500
+Subject: [PATCH] ibmvnic: Revise RX/TX queue error messages
+
+References: bsc#1101331
+Patch-mainline: v4.18-rc6
+Git-commit: 2d14d3795294d42aacc278948984a480569bcc23
+
+During a device failover, there may be latency between the loss
+of the current backing device and a notification from firmware that
+a failover has occurred. This latency can result in a large amount of
+error printouts as firmware returns outgoing traffic with a generic
+error code. These are not necessarily errors in this case as the
+firmware is busy swapping in a new backing adapter and is not ready
+to send packets yet. This patch reclassifies those error codes as
+warnings with an explanation that a failover may be pending. All
+other return codes will be considered errors.
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 39 ++++++++++++++++++++++++++------------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index d0e196bff081..c50963680f30 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -329,7 +329,8 @@ static void replenish_rx_pool(struct ibmvnic_adapter *adapter,
+ return;
+
+ failure:
+- dev_info(dev, "replenish pools failure\n");
++ if (lpar_rc != H_PARAMETER && lpar_rc != H_CLOSED)
++ dev_err_ratelimited(dev, "rx: replenish packet buffer failed\n");
+ pool->free_map[pool->next_free] = index;
+ pool->rx_buff[index].skb = NULL;
+
+@@ -1617,7 +1618,8 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ &tx_crq);
+ }
+ if (lpar_rc != H_SUCCESS) {
+- dev_err(dev, "tx failed with code %ld\n", lpar_rc);
++ if (lpar_rc != H_CLOSED && lpar_rc != H_PARAMETER)
++ dev_err_ratelimited(dev, "tx: send failed\n");
+ dev_kfree_skb_any(skb);
+ tx_buff->skb = NULL;
+
+@@ -3204,6 +3206,25 @@ static union ibmvnic_crq *ibmvnic_next_crq(struct ibmvnic_adapter *adapter)
+ return crq;
+ }
+
++static void print_subcrq_error(struct device *dev, int rc, const char *func)
++{
++ switch (rc) {
++ case H_PARAMETER:
++ dev_warn_ratelimited(dev,
++ "%s failed: Send request is malformed or adapter failover pending. (rc=%d)\n",
++ func, rc);
++ break;
++ case H_CLOSED:
++ dev_warn_ratelimited(dev,
++ "%s failed: Backing queue closed. Adapter is down or failover pending. (rc=%d)\n",
++ func, rc);
++ break;
++ default:
++ dev_err_ratelimited(dev, "%s failed: (rc=%d)\n", func, rc);
++ break;
++ }
++}
++
+ static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle,
+ union sub_crq *sub_crq)
+ {
+@@ -3230,11 +3251,8 @@ static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle,
+ cpu_to_be64(u64_crq[2]),
+ cpu_to_be64(u64_crq[3]));
+
+- if (rc) {
+- if (rc == H_CLOSED)
+- dev_warn(dev, "CRQ Queue closed\n");
+- dev_err(dev, "Send error (rc=%d)\n", rc);
+- }
++ if (rc)
++ print_subcrq_error(dev, rc, __func__);
+
+ return rc;
+ }
+@@ -3252,11 +3270,8 @@ static int send_subcrq_indirect(struct ibmvnic_adapter *adapter,
+ cpu_to_be64(remote_handle),
+ ioba, num_entries);
+
+- if (rc) {
+- if (rc == H_CLOSED)
+- dev_warn(dev, "CRQ Queue closed\n");
+- dev_err(dev, "Send (indirect) error (rc=%d)\n", rc);
+- }
++ if (rc)
++ print_subcrq_error(dev, rc, __func__);
+
+ return rc;
+ }
+--
+2.13.7
+
diff --git a/patches.drivers/ibmvnic-Update-firmware-error-reporting-with-cause-s.patch b/patches.drivers/ibmvnic-Update-firmware-error-reporting-with-cause-s.patch
new file mode 100644
index 0000000000..5bf44ade54
--- /dev/null
+++ b/patches.drivers/ibmvnic-Update-firmware-error-reporting-with-cause-s.patch
@@ -0,0 +1,74 @@
+From c9008d339bc40301a486ea62f36f106c4b2aad0e Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.vnet.ibm.com>
+Date: Mon, 6 Aug 2018 21:39:59 -0500
+Subject: [PATCH] ibmvnic: Update firmware error reporting with cause string
+
+References: bsc#1104174
+Patch-mainline: queued
+Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: c9008d339bc40301a486ea62f36f106c4b2aad0e
+
+Print a string instead of the error code. Since there is a
+possibility that the driver can recover, classify it as a
+warning instead of an error.
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 34 ++++++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 109e4a58efad..dafdd4ade705 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -3825,15 +3825,41 @@ static void handle_query_ip_offload_rsp(struct ibmvnic_adapter *adapter)
+ ibmvnic_send_crq(adapter, &crq);
+ }
+
++static const char *ibmvnic_fw_err_cause(u16 cause)
++{
++ switch (cause) {
++ case ADAPTER_PROBLEM:
++ return "adapter problem";
++ case BUS_PROBLEM:
++ return "bus problem";
++ case FW_PROBLEM:
++ return "firmware problem";
++ case DD_PROBLEM:
++ return "device driver problem";
++ case EEH_RECOVERY:
++ return "EEH recovery";
++ case FW_UPDATED:
++ return "firmware updated";
++ case LOW_MEMORY:
++ return "low Memory";
++ default:
++ return "unknown";
++ }
++}
++
+ static void handle_error_indication(union ibmvnic_crq *crq,
+ struct ibmvnic_adapter *adapter)
+ {
+ struct device *dev = &adapter->vdev->dev;
++ u16 cause;
++
++ cause = be16_to_cpu(crq->error_indication.error_cause);
+
+- dev_err(dev, "Firmware reports %serror, cause %d\n",
+- crq->error_indication.flags
+- & IBMVNIC_FATAL_ERROR ? "FATAL " : "",
+- be16_to_cpu(crq->error_indication.error_cause));
++ dev_warn_ratelimited(dev,
++ "Firmware reports %serror, cause: %s. Starting recovery...\n",
++ crq->error_indication.flags
++ & IBMVNIC_FATAL_ERROR ? "FATAL " : "",
++ ibmvnic_fw_err_cause(cause));
+
+ if (crq->error_indication.flags & IBMVNIC_FATAL_ERROR)
+ ibmvnic_reset(adapter, VNIC_RESET_FATAL);
+--
+2.13.7
+
diff --git a/patches.fixes/IB-isert-fix-T10-pi-check-mask-setting.patch b/patches.fixes/IB-isert-fix-T10-pi-check-mask-setting.patch
new file mode 100644
index 0000000000..f1df2c6941
--- /dev/null
+++ b/patches.fixes/IB-isert-fix-T10-pi-check-mask-setting.patch
@@ -0,0 +1,39 @@
+From: Max Gurtovoy <maxg@mellanox.com>
+Date: Thu, 31 May 2018 11:05:23 +0300
+Subject: [PATCH] IB/isert: fix T10-pi check mask setting
+References: bsc#1082979
+Git-commit: 0e12af84cdd3056460f928adc164f9e87f4b303b
+Patch-mainline: v4.18-rc1
+
+A copy/paste bug (probably) caused setting of an app_tag check mask
+in case where a ref_tag check was needed.
+
+Fixes: 38a2d0d429f1 ("IB/isert: convert to the generic RDMA READ/WRITE API")
+Fixes: 9e961ae73c2c ("IB/isert: Support T10-PI protected transactions")
+Cc: stable@vger.kernel.org
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index cf9a9b3d38e1..bd5b726ce0e5 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -2108,7 +2108,7 @@ isert_set_sig_attrs(struct se_cmd *se_cmd, struct ib_sig_attrs *sig_attrs)
+
+ sig_attrs->check_mask =
+ (se_cmd->prot_checks & TARGET_DIF_CHECK_GUARD ? 0xc0 : 0) |
+- (se_cmd->prot_checks & TARGET_DIF_CHECK_REFTAG ? 0x30 : 0) |
++ (se_cmd->prot_checks & TARGET_DIF_CHECK_APPTAG ? 0x30 : 0) |
+ (se_cmd->prot_checks & TARGET_DIF_CHECK_REFTAG ? 0x0f : 0);
+ return 0;
+ }
+--
+2.12.3
+
diff --git a/patches.fixes/RDMA-ocrdma-Fix-an-error-code-in-ocrdma_alloc_pd.patch b/patches.fixes/RDMA-ocrdma-Fix-an-error-code-in-ocrdma_alloc_pd.patch
new file mode 100644
index 0000000000..22ba5862af
--- /dev/null
+++ b/patches.fixes/RDMA-ocrdma-Fix-an-error-code-in-ocrdma_alloc_pd.patch
@@ -0,0 +1,36 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 13 Jul 2017 10:46:14 +0300
+Subject: [PATCH] RDMA/ocrdma: Fix an error code in ocrdma_alloc_pd()
+References: bsc#1082979
+Git-commit: dd75cfa6d3216c79c695f5af13e52208afe374ad
+Patch-mainline: v4.13-rc2
+
+We should preserve the original "status" error code instead of resetting
+it to zero. Returning ERR_PTR(0) is the same as NULL and results in a
+NULL dereference in the callers. I added a printk() on error instead.
+
+Fixes: 45e86b33ec8b ("RDMA/ocrdma: Cache recv DB until QP moved to RTR")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+---
+ drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+index a73a7017df1a..0ebfb3c3acc2 100644
+--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+@@ -744,7 +744,8 @@ struct ib_pd *ocrdma_alloc_pd(struct ib_device *ibdev,
+ if (is_uctx_pd) {
+ ocrdma_release_ucontext_pd(uctx);
+ } else {
+- status = _ocrdma_dealloc_pd(dev, pd);
++ if (_ocrdma_dealloc_pd(dev, pd))
++ pr_err("%s: _ocrdma_dealloc_pd() failed\n", __func__);
+ }
+ exit:
+ return ERR_PTR(status);
+--
+2.12.3
+
diff --git a/patches.fixes/RDMA-ocrdma-Fix-error-codes-in-ocrdma_create_srq.patch b/patches.fixes/RDMA-ocrdma-Fix-error-codes-in-ocrdma_create_srq.patch
new file mode 100644
index 0000000000..6a3e5232b9
--- /dev/null
+++ b/patches.fixes/RDMA-ocrdma-Fix-error-codes-in-ocrdma_create_srq.patch
@@ -0,0 +1,34 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 13 Jul 2017 10:46:49 +0300
+Subject: [PATCH] RDMA/ocrdma: Fix error codes in ocrdma_create_srq()
+References: bsc#1082979
+Git-commit: f0c6e88288d65c93bbc7da4fb6f7d51b2733228a
+Patch-mainline: v4.13-rc2
+
+If either of these allocations fail then we return ERR_PTR(0). That's
+equivalent to NULL and results in a NULL pointer dereference in the
+caller.
+
+Fixes: fe2caefcdf58 ("RDMA/ocrdma: Add driver for Emulex OneConnect IBoE RDMA adapter")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+---
+ drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+index 0ebfb3c3acc2..d00c8e1f7bc4 100644
+--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+@@ -1909,6 +1909,7 @@ struct ib_srq *ocrdma_create_srq(struct ib_pd *ibpd,
+ goto err;
+
+ if (udata == NULL) {
++ status = -ENOMEM;
+ srq->rqe_wr_id_tbl = kzalloc(sizeof(u64) * srq->rq.max_cnt,
+ GFP_KERNEL);
+ if (srq->rqe_wr_id_tbl == NULL)
+--
+2.12.3
+
diff --git a/patches.fixes/blkcg-simplify-statistic-accumulation-code.patch b/patches.fixes/blkcg-simplify-statistic-accumulation-code.patch
new file mode 100644
index 0000000000..7d32869596
--- /dev/null
+++ b/patches.fixes/blkcg-simplify-statistic-accumulation-code.patch
@@ -0,0 +1,57 @@
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 16 Jan 2018 16:01:36 +0100
+Subject: [PATCH] blkcg: simplify statistic accumulation code
+References: bsc#1082979
+Git-commit: ddc212313f16cd65fcf5e8d9ae223f8374822e4d
+Patch-mainline: v4.16-rc1
+
+Some older compilers (gcc-4.4 through 4.6 in particular) struggle
+with the way that blkg_rwstat_read() returns a structure, leading
+to excessive stack usage and rather inefficient code:
+
+block/blk-cgroup.c: In function 'blkg_destroy':
+block/blk-cgroup.c:354:1: error: the frame size of 1296 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+block/cfq-iosched.c: In function 'cfqg_stats_add_aux':
+block/cfq-iosched.c:753:1: error: the frame size of 1928 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+block/bfq-cgroup.c: In function 'bfqg_stats_add_aux':
+block/bfq-cgroup.c:299:1: error: the frame size of 1928 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+
+I also notice that there is no point in using atomic accesses
+for the local variables, so storing the temporaries in simple 'u64'
+variables not only avoids the stack usage on older compilers but
+also improves the object code on modern versions.
+
+Fixes: e6269c445467 ("blkcg: add blkg_[rw]stat->aux_cnt and replace cfq_group->dead_stats with it")
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+---
+ include/linux/blk-cgroup.h | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h
+index c601fdd8cd68..c31d92bbdde2 100644
+--- a/include/linux/blk-cgroup.h
++++ b/include/linux/blk-cgroup.h
+@@ -674,12 +674,14 @@ static inline void blkg_rwstat_reset(struct blkg_rwstat *rwstat)
+ static inline void blkg_rwstat_add_aux(struct blkg_rwstat *to,
+ struct blkg_rwstat *from)
+ {
+- struct blkg_rwstat v = blkg_rwstat_read(from);
++ u64 sum[BLKG_RWSTAT_NR];
+ int i;
+
+ for (i = 0; i < BLKG_RWSTAT_NR; i++)
+- atomic64_add(atomic64_read(&v.aux_cnt[i]) +
+- atomic64_read(&from->aux_cnt[i]),
++ sum[i] = percpu_counter_sum_positive(&from->cpu_cnt[i]);
++
++ for (i = 0; i < BLKG_RWSTAT_NR; i++)
++ atomic64_add(sum[i] + atomic64_read(&from->aux_cnt[i]),
+ &to->aux_cnt[i]);
+ }
+
+--
+2.12.3
+
diff --git a/patches.fixes/block-swim-Fix-array-bounds-check.patch b/patches.fixes/block-swim-Fix-array-bounds-check.patch
new file mode 100644
index 0000000000..509ed5b7ba
--- /dev/null
+++ b/patches.fixes/block-swim-Fix-array-bounds-check.patch
@@ -0,0 +1,103 @@
+From: Finn Thain <fthain@telegraphics.com.au>
+Date: Wed, 11 Apr 2018 20:50:14 -0400
+Subject: [PATCH] block/swim: Fix array bounds check
+References: bsc#1082979
+Git-commit: 7ae6a2b6cc058005ee3d0d2b9ce27688e51afa4b
+Patch-mainline: v4.17-rc3
+
+In the floppy_find() function in swim.c is a call to
+get_disk(swd->unit[drive].disk). The actual parameter to this call
+can be a NULL pointer when drive == swd->floppy_count. This causes
+an oops in get_disk().
+
+Data read fault at 0x00000198 in Super Data (pc=0x1be5b6)
+BAD KERNEL BUSERR
+Oops: 00000000
+Modules linked in: swim_mod ipv6 mac8390
+PC: [<001be5b6>] get_disk+0xc/0x76
+SR: 2004 SP: 9a078bc1 a2: 0213ed90
+d0: 00000000 d1: 00000000 d2: 00000000 d3: 000000ff
+d4: 00000002 d5: 02983590 a0: 02332e00 a1: 022dfd64
+Process dd (pid: 285, task=020ab25b)
+Frame format=B ssw=074d isc=4a88 isb=6732 daddr=00000198 dobuf=00000000
+baddr=001be5bc dibuf=bfffffff ver=f
+Stack from 022dfca4:
+ 00000000 0203fc00 0213ed90 022dfcc0 02982936 00000000 00200000 022dfd08
+ 0020f85a 00200000 022dfd64 02332e00 004040fc 00000014 001be77e 022dfd64
+ 00334e4a 001be3f8 0800001d 022dfd64 01c04b60 01c04b70 022aba80 029828f8
+ 02332e00 022dfd2c 001be7ac 0203fc00 00200000 022dfd64 02103a00 01c04b60
+ 01c04b60 0200e400 022dfd68 000e191a 00200000 022dfd64 02103a00 0800001d
+ 00000000 00000003 000b89de 00500000 02103a00 01c04b60 02103a08 01c04c2e
+Call Trace: [<02982936>] floppy_find+0x3e/0x4a [swim_mod]
+ [<00200000>] uart_remove_one_port+0x1a2/0x260
+ [<0020f85a>] kobj_lookup+0xde/0x132
+ [<00200000>] uart_remove_one_port+0x1a2/0x260
+ [<001be77e>] get_gendisk+0x0/0x130
+ [<00334e4a>] mutex_lock+0x0/0x2e
+ [<001be3f8>] disk_block_events+0x0/0x6c
+ [<029828f8>] floppy_find+0x0/0x4a [swim_mod]
+ [<001be7ac>] get_gendisk+0x2e/0x130
+ [<00200000>] uart_remove_one_port+0x1a2/0x260
+ [<000e191a>] __blkdev_get+0x32/0x45a
+ [<00200000>] uart_remove_one_port+0x1a2/0x260
+ [<000b89de>] complete_walk+0x0/0x8a
+ [<000e1e22>] blkdev_get+0xe0/0x29a
+ [<000e1fdc>] blkdev_open+0x0/0xb0
+ [<000b89de>] complete_walk+0x0/0x8a
+ [<000e1fdc>] blkdev_open+0x0/0xb0
+ [<000e01cc>] bd_acquire+0x74/0x8a
+ [<000e205c>] blkdev_open+0x80/0xb0
+ [<000e1fdc>] blkdev_open+0x0/0xb0
+ [<000abf24>] do_dentry_open+0x1a4/0x322
+ [<00020000>] __do_proc_douintvec+0x22/0x27e
+ [<000b89de>] complete_walk+0x0/0x8a
+ [<000baa62>] link_path_walk+0x0/0x48e
+ [<000ba3f8>] inode_permission+0x20/0x54
+ [<000ac0e4>] vfs_open+0x42/0x78
+ [<000bc372>] path_openat+0x2b2/0xeaa
+ [<000bc0c0>] path_openat+0x0/0xeaa
+ [<0004463e>] __irq_wake_thread+0x0/0x4e
+ [<0003a45a>] task_tick_fair+0x18/0xc8
+ [<000bd00a>] do_filp_open+0xa0/0xea
+ [<000abae0>] do_sys_open+0x11a/0x1ee
+ [<00020000>] __do_proc_douintvec+0x22/0x27e
+ [<000abbf4>] SyS_open+0x1e/0x22
+ [<00020000>] __do_proc_douintvec+0x22/0x27e
+ [<00002b40>] syscall+0x8/0xc
+ [<00020000>] __do_proc_douintvec+0x22/0x27e
+ [<0000c00b>] dyadic+0x1/0x28
+Code: 4e5e 4e75 4e56 fffc 2f0b 2f02 266e 0008 <206b> 0198 4a88 6732 2428 002c 661e 486b 0058 4eb9 0032 0b96 588f 4a88 672c 2008
+Disabling lock debugging due to kernel taint
+
+Fix the array index bounds check to avoid this.
+
+Cc: Laurent Vivier <lvivier@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: stable@vger.kernel.org # v4.14+
+Fixes: 8852ecd97488 ("[PATCH] m68k: mac - Add SWIM floppy support")
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Acked-by: Laurent Vivier <lvivier@redhat.com>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+---
+ drivers/block/swim.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/swim.c b/drivers/block/swim.c
+index b5afd495d482..072c074d9b04 100644
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -779,7 +779,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
+ struct swim_priv *swd = data;
+ int drive = (*part & 3);
+
+- if (drive > swd->floppy_count)
++ if (drive >= swd->floppy_count)
+ return NULL;
+
+ *part = 0;
+--
+2.12.3
+
diff --git a/patches.fixes/dm-thin-metadata-remove-needless-work-from-__commit_.patch b/patches.fixes/dm-thin-metadata-remove-needless-work-from-__commit_.patch
new file mode 100644
index 0000000000..4660be2a3a
--- /dev/null
+++ b/patches.fixes/dm-thin-metadata-remove-needless-work-from-__commit_.patch
@@ -0,0 +1,50 @@
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Mon, 18 Jun 2018 11:57:51 -0400
+Subject: [PATCH] dm thin metadata: remove needless work from
+ __commit_transaction
+References: bsc#1082979
+Git-commit: 7ccdbf85d3b2237cdbdafe6a47673dbdfab4b7a2
+Patch-mainline: v4.18-rc3
+
+Commit 5a32083d03fb5 ("dm: take care to copy the space map roots before
+locking the superblock") properly removed the calls to dm_sm_root_size()
+from __write_initial_superblock(). But the dm_sm_root_size() calls were
+left dangling in __commit_transaction().
+
+Fixes: 5a32083d03fb5 ("dm: take care to copy the space map roots before locking the superblock")
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+---
+ drivers/md/dm-thin-metadata.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
+index e976f4f39334..0f38d942abab 100644
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -778,7 +778,6 @@ static int __write_changed_details(struct dm_pool_metadata *pmd)
+ static int __commit_transaction(struct dm_pool_metadata *pmd)
+ {
+ int r;
+- size_t metadata_len, data_len;
+ struct thin_disk_superblock *disk_super;
+ struct dm_block *sblock;
+
+@@ -799,14 +798,6 @@ static int __commit_transaction(struct dm_pool_metadata *pmd)
+ if (r < 0)
+ return r;
+
+- r = dm_sm_root_size(pmd->metadata_sm, &metadata_len);
+- if (r < 0)
+- return r;
+-
+- r = dm_sm_root_size(pmd->data_sm, &data_len);
+- if (r < 0)
+- return r;
+-
+ r = save_sm_roots(pmd);
+ if (r < 0)
+ return r;
+--
+2.12.3
+
diff --git a/patches.fixes/genirq-Make-force-irq-threading-setup-more-robust.patch b/patches.fixes/genirq-Make-force-irq-threading-setup-more-robust.patch
new file mode 100644
index 0000000000..68384636d8
--- /dev/null
+++ b/patches.fixes/genirq-Make-force-irq-threading-setup-more-robust.patch
@@ -0,0 +1,67 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Fri, 3 Aug 2018 14:44:59 +0200
+Subject: [PATCH] genirq: Make force irq threading setup more robust
+References: bsc#1082979
+Git-commit: d1f0301b3333eef5efbfa1fe0f0edbea01863d5d
+Patch-mainline: v4.18-rc8
+
+The support of force threading interrupts which are set up with both a
+primary and a threaded handler wreckaged the setup of regular requested
+threaded interrupts (primary handler == NULL).
+
+The reason is that it does not check whether the primary handler is set to
+the default handler which wakes the handler thread. Instead it replaces the
+thread handler with the primary handler as it would do with force threaded
+interrupts which have been requested via request_irq(). So both the primary
+and the thread handler become the same which then triggers the warnon that
+the thread handler tries to wakeup a not configured secondary thread.
+
+Fortunately this only happens when the driver omits the IRQF_ONESHOT flag
+when requesting the threaded interrupt, which is normaly caught by the
+sanity checks when force irq threading is disabled.
+
+Fix it by skipping the force threading setup when a regular threaded
+interrupt is requested. As a consequence the interrupt request which lacks
+the IRQ_ONESHOT flag is rejected correctly instead of silently wreckaging
+it.
+
+Fixes: 2a1d3ab8986d ("genirq: Handle force threading of irqs with primary and thread handler")
+Reported-by: Kurt Kanzenbach <kurt.kanzenbach@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Kurt Kanzenbach <kurt.kanzenbach@linutronix.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+---
+ kernel/irq/manage.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 18ecb1e17375..8c950b5eb879 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -1027,6 +1027,13 @@ static int irq_setup_forced_threading(struct irqaction *new)
+ if (new->flags & (IRQF_NO_THREAD | IRQF_PERCPU | IRQF_ONESHOT))
+ return 0;
+
++ /*
++ * No further action required for interrupts which are requested as
++ * threaded interrupts already
++ */
++ if (new->handler == irq_default_primary_handler)
++ return 0;
++
+ new->flags |= IRQF_ONESHOT;
+
+ /*
+@@ -1034,7 +1041,7 @@ static int irq_setup_forced_threading(struct irqaction *new)
+ * thread handler. We force thread them as well by creating a
+ * secondary action.
+ */
+- if (new->handler != irq_default_primary_handler && new->thread_fn) {
++ if (new->handler && new->thread_fn) {
+ /* Allocate the secondary action */
+ new->secondary = kzalloc(sizeof(struct irqaction), GFP_KERNEL);
+ if (!new->secondary)
+--
+2.12.3
+
diff --git a/patches.fixes/libata-don-t-try-to-pass-through-NCQ-commands-to-non.patch b/patches.fixes/libata-don-t-try-to-pass-through-NCQ-commands-to-non.patch
new file mode 100644
index 0000000000..ee85df63e6
--- /dev/null
+++ b/patches.fixes/libata-don-t-try-to-pass-through-NCQ-commands-to-non.patch
@@ -0,0 +1,66 @@
+From: Eric Biggers <ebiggers@google.com>
+Date: Sat, 3 Feb 2018 20:33:51 -0800
+Subject: [PATCH] libata: don't try to pass through NCQ commands to non-NCQ
+ devices
+References: bsc#1082979
+Git-commit: 2c1ec6fda2d07044cda922ee25337cf5d4b429b3
+Patch-mainline: v4.16-rc7
+
+syzkaller hit a WARN() in ata_bmdma_qc_issue() when writing to /dev/sg0.
+This happened because it issued an ATA pass-through command (ATA_16)
+where the protocol field indicated that NCQ should be used -- but the
+device did not support NCQ.
+
+We could just remove the WARN() from libata-sff.c, but the real problem
+seems to be that the SCSI -> ATA translation code passes through NCQ
+commands without verifying that the device actually supports NCQ.
+
+Fix this by adding the appropriate check to ata_scsi_pass_thru().
+
+Here's reproducer that works in QEMU when /dev/sg0 refers to a disk of
+the default type ("82371SB PIIX3 IDE"):
+
+ #include <fcntl.h>
+ #include <unistd.h>
+
+ int main()
+ {
+ char buf[53] = { 0 };
+
+ buf[36] = 0x85; /* ATA_16 */
+ buf[37] = (12 << 1); /* FPDMA */
+ buf[38] = 0x1; /* Has data */
+ buf[51] = 0xC8; /* ATA_CMD_READ */
+ write(open("/dev/sg0", O_RDWR), buf, sizeof(buf));
+ }
+
+Fixes: ee7fb331c3ac ("libata: add support for NCQ commands for SG interface")
+Reported-by: syzbot+2f69ca28df61bdfc77cd36af2e789850355a221e@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org> # v4.4+
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+---
+ drivers/ata/libata-scsi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 20e97a12e985..6100c3ff4549 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -3308,6 +3308,12 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
+ goto invalid_fld;
+ }
+
++ /* We may not issue NCQ commands to devices not supporting NCQ */
++ if (ata_is_ncq(tf->protocol) && !ata_ncq_enabled(dev)) {
++ fp = 1;
++ goto invalid_fld;
++ }
++
+ /* sanity check for pio multi commands */
+ if ((cdb[1] & 0xe0) && !is_multi_taskfile(tf)) {
+ fp = 1;
+--
+2.12.3
+
diff --git a/patches.fixes/null_blk-use-sector_div-instead-of-do_div.patch b/patches.fixes/null_blk-use-sector_div-instead-of-do_div.patch
new file mode 100644
index 0000000000..58bc3fc162
--- /dev/null
+++ b/patches.fixes/null_blk-use-sector_div-instead-of-do_div.patch
@@ -0,0 +1,58 @@
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 13 Jan 2016 23:04:08 +0100
+Subject: [PATCH] null_blk: use sector_div instead of do_div
+References: bsc#1082979
+Git-commit: e93d12ae3be91d18b2a46deebb90a3f516db3d3c
+Patch-mainline: v4.5-rc1
+
+Dividing a sector_t number should be done using sector_div rather than do_div
+to optimize the 32-bit sector_t case, and with the latest do_div optimizations,
+we now get a compile-time warning for this:
+
+arch/arm/include/asm/div64.h:32:95: note: expected 'uint64_t * {aka long long unsigned int *}' but argument is of type 'sector_t * {aka long unsigned int *}'
+drivers/block/null_blk.c:521:81: warning: comparison of distinct pointer types lacks a cast
+
+This changes the newly added code to use sector_div. It is a simplified version
+of the original patch, as Linus Torvalds pointed out that we should not be using
+an expensive division function in the first place.
+
+This version was suggested by Matias Bjorling.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Matias Bjorling <m@bjorling.me>
+Fixes: b2b7e00148a2 ("null_blk: register as a LightNVM device")
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+---
+ drivers/block/null_blk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
+index 96764cf23d7f..959792d0cedc 100644
+--- a/drivers/block/null_blk.c
++++ b/drivers/block/null_blk.c
+@@ -476,17 +476,17 @@ static int null_lnvm_id(struct nvm_dev *dev, struct nvm_id *id)
+ id->ppaf.ch_offset = 56;
+ id->ppaf.ch_len = 8;
+
+- do_div(size, bs); /* convert size to pages */
+- do_div(size, 256); /* concert size to pgs pr blk */
++ sector_div(size, bs); /* convert size to pages */
++ size >>= 8; /* concert size to pgs pr blk */
+ grp = &id->groups[0];
+ grp->mtype = 0;
+ grp->fmtype = 0;
+ grp->num_ch = 1;
+ grp->num_pg = 256;
+ blksize = size;
+- do_div(size, (1 << 16));
++ size >>= 16;
+ grp->num_lun = size + 1;
+- do_div(blksize, grp->num_lun);
++ sector_div(blksize, grp->num_lun);
+ grp->num_blk = blksize;
+ grp->num_pln = 1;
+
+--
+2.12.3
+
diff --git a/patches.fixes/scsi-qlogicpti-Fix-an-error-handling-path-in-qpti_sb.patch b/patches.fixes/scsi-qlogicpti-Fix-an-error-handling-path-in-qpti_sb.patch
new file mode 100644
index 0000000000..6d60604d0d
--- /dev/null
+++ b/patches.fixes/scsi-qlogicpti-Fix-an-error-handling-path-in-qpti_sb.patch
@@ -0,0 +1,48 @@
+From: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
+Date: Thu, 10 May 2018 13:45:58 +0200
+Subject: [PATCH] scsi: qlogicpti: Fix an error handling path in
+ 'qpti_sbus_probe()'
+References: bsc#1082979
+Git-commit: 51b910c3c70986a5a0a84eea11cb8e904e37ba8b
+Patch-mainline: v4.18-rc1
+
+The 'free_irq()' call is not at the right place in the error handling
+path. The changed order has been introduced in commit 3d4253d9afab
+("[SCSI] qlogicpti: Convert to new SBUS device framework.")
+
+Fixes: 3d4253d9afab ("[SCSI] qlogicpti: Convert to new SBUS device framework.")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+---
+ drivers/scsi/qlogicpti.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
+index 676385ff28ef..e964be4460e2 100644
+--- a/drivers/scsi/qlogicpti.c
++++ b/drivers/scsi/qlogicpti.c
+@@ -1385,6 +1385,9 @@ static int qpti_sbus_probe(struct platform_device *op)
+ qpti->req_cpu, qpti->req_dvma);
+ #undef QSIZE
+
++fail_free_irq:
++ free_irq(qpti->irq, qpti);
++
+ fail_unmap_regs:
+ of_iounmap(&op->resource[0], qpti->qregs,
+ resource_size(&op->resource[0]));
+@@ -1392,9 +1395,6 @@ static int qpti_sbus_probe(struct platform_device *op)
+ of_iounmap(&op->resource[0], qpti->sreg,
+ sizeof(unsigned char));
+
+-fail_free_irq:
+- free_irq(qpti->irq, qpti);
+-
+ fail_unlink:
+ scsi_host_put(host);
+
+--
+2.12.3
+
diff --git a/patches.fixes/scsi-sg-fix-minor-memory-leak-in-error-path.patch b/patches.fixes/scsi-sg-fix-minor-memory-leak-in-error-path.patch
new file mode 100644
index 0000000000..91f84f8087
--- /dev/null
+++ b/patches.fixes/scsi-sg-fix-minor-memory-leak-in-error-path.patch
@@ -0,0 +1,35 @@
+From: Tony Battersby <tonyb@cybernetics.com>
+Date: Thu, 12 Jul 2018 16:30:45 -0400
+Subject: [PATCH] scsi: sg: fix minor memory leak in error path
+References: bsc#1082979
+Git-commit: c170e5a8d222537e98aa8d4fddb667ff7a2ee114
+Patch-mainline: v4.18-rc8
+
+Fix a minor memory leak when there is an error opening a /dev/sg device.
+
+Fixes: cc833acbee9d ("sg: O_EXCL and other lock handling")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+---
+ drivers/scsi/sg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 2065a0f9dca6..8d9b416399f9 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -2185,6 +2185,7 @@ sg_add_sfp(Sg_device * sdp)
+ write_lock_irqsave(&sdp->sfd_lock, iflags);
+ if (atomic_read(&sdp->detaching)) {
+ write_unlock_irqrestore(&sdp->sfd_lock, iflags);
++ kfree(sfp);
+ return ERR_PTR(-ENODEV);
+ }
+ list_add_tail(&sfp->sfd_siblings, &sdp->sfds);
+--
+2.12.3
+
diff --git a/patches.fixes/scsi-target-fix-crash-with-iscsi-target-and-dvd.patch b/patches.fixes/scsi-target-fix-crash-with-iscsi-target-and-dvd.patch
new file mode 100644
index 0000000000..efedacfc90
--- /dev/null
+++ b/patches.fixes/scsi-target-fix-crash-with-iscsi-target-and-dvd.patch
@@ -0,0 +1,51 @@
+From: Ming Lei <ming.lei@redhat.com>
+Date: Mon, 16 Apr 2018 17:48:41 +0800
+Subject: [PATCH] scsi: target: fix crash with iscsi target and dvd
+References: bsc#1082979
+Git-commit: 8e1ceafe50ec4d1bcfae154dd70e7cb6946a6177
+Patch-mainline: v4.17-rc3
+
+When the current page can't be added to bio, one new bio should be
+created for adding this page again, instead of ignoring this page.
+
+This patch fixes kernel crash with iscsi target and dvd, as reported by
+Wakko.
+
+Cc: Wakko Warner <wakko@animx.eu.org>
+Cc: Bart Van Assche <Bart.VanAssche@wdc.com>
+Cc: target-devel@vger.kernel.org
+Cc: linux-scsi@vger.kernel.org
+Cc: "Nicholas A. Bellinger" <nab@linux-iscsi.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Fixes: 84c8590646d5b35804 ("target: avoid accessing .bi_vcnt directly")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+---
+ drivers/target/target_core_pscsi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index 71913beb8413..48a537e46fcc 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -910,6 +910,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
+ bytes = min(bytes, data_len);
+
+ if (!bio) {
++new_bio:
+ nr_vecs = min_t(int, BIO_MAX_PAGES, nr_pages);
+ nr_pages -= nr_vecs;
+ /*
+@@ -951,6 +952,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
+ * be allocated with pscsi_get_bio() above.
+ */
+ bio = NULL;
++ goto new_bio;
+ }
+
+ data_len -= bytes;
+--
+2.12.3
+
diff --git a/series.conf b/series.conf
index 3b35a8b50f..932fb1bb3f 100644
--- a/series.conf
+++ b/series.conf
@@ -9932,6 +9932,7 @@
patches.drivers/ata-pata_artop-remove-redundant-initialization-of-pi.patch
patches.drivers/ata-sata_dwc_460ex-remove-incorrect-locking.patch
patches.drivers/ata-ahci_xgene-free-structure-returned-by-acpi_get_o.patch
+ patches.fixes/libata-don-t-try-to-pass-through-NCQ-commands-to-non.patch
#bsc#1032730
patches.drivers/0001-ahci-qoriq-added-a-condition-to-enable-dma-coherence.patch
@@ -16378,9 +16379,14 @@
patches.drivers/0001-drm-msm-Fix-possible-null-dereference-on-failure-of-.patch
patches.fixes/xen-netfront-fix-mismatched-rtnl_unlock.patch
patches.fixes/xen-netfront-update-features-after-registering-netdev.patch
+ patches.drivers/ibmvnic-Revise-RX-TX-queue-error-messages.patch
patches.drivers/ibmvnic-Fix-error-recovery-on-login-failure.patch
patches.fixes/0001-drm-re-enable-error-handling.patch
+ # davem/net-next
+ patches.drivers/ibmvnic-Remove-code-to-request-error-information.patch
+ patches.drivers/ibmvnic-Update-firmware-error-reporting-with-cause-s.patch
+
# mkp/scsi queue
patches.drivers/scsi-ipr-Format-HCAM-overlay-ID-0x41.patch
@@ -17918,6 +17924,7 @@
patches.drivers/dm-rq-clear-kworker_task-if-kthread_run-returned-an-.patch
patches.drivers/dm-table-fix-missing-dm_put_target_type-in-dm_table_.patch
patches.drivers/dm-raid-fix-data-corruption-on-reshape-request.patch
+ patches.fixes/dm-thin-metadata-remove-needless-work-from-__commit_.patch
########################################################
# md
@@ -18934,6 +18941,12 @@
patches.suse/blk-mq-stop-delayed_run_work-in-blk_mq_stop_hw_queue.patch
patches.suse/sbitmap-check-for-valid-bitmap-in-sbitmap_for_each.patch
patches.fixes/block-copy-ioprio-in-__bio_clone_fast.patch
+ patches.fixes/blkcg-simplify-statistic-accumulation-code.patch
+ patches.fixes/block-swim-Fix-array-bounds-check.patch
+ patches.fixes/scsi-target-fix-crash-with-iscsi-target-and-dvd.patch
+ patches.fixes/null_blk-use-sector_div-instead-of-do_div.patch
+ patches.fixes/scsi-sg-fix-minor-memory-leak-in-error-path.patch
+ patches.fixes/scsi-qlogicpti-Fix-an-error-handling-path-in-qpti_sb.patch
# bsc#1073407, bsc#1069135
patches.fixes/0001-fs-Fix-page-cache-inconsistency-when-mixing-buffered.patch
@@ -20623,6 +20636,9 @@
patches.drivers/qed-Fix-possibility-of-list-corruption-during-rmmod-.patch
patches.drivers/qed-Fix-LL2-race-during-connection-terminate.patch
patches.drivers/RDMA-qedr-Fix-doorbell-bar-mapping-for-dpi-1.patch
+ patches.fixes/IB-isert-fix-T10-pi-check-mask-setting.patch
+ patches.fixes/RDMA-ocrdma-Fix-an-error-code-in-ocrdma_alloc_pd.patch
+ patches.fixes/RDMA-ocrdma-Fix-error-codes-in-ocrdma_create_srq.patch
# powerpc VMX crypto acceleration fate#321642
patches.drivers/crypto-vmx-0001-Adding-support-for-XTS.patch
@@ -21642,6 +21658,7 @@
patches.drivers/genirq-affinity-Use-default-affinity-mask-for-reserv.patch
patches.drivers/genirq-affinity-Fix-node-generation-from-cpumask.patch
patches.drivers/PCI-MSI-Fix-msi_desc-affinity-memory-leak-when-freei.patch
+ patches.fixes/genirq-Make-force-irq-threading-setup-more-robust.patch
# Amazon ena update
patches.drivers/net-ena-switch-to-pci_alloc_irq_vectors.patch