Merge android-4.4.154 (d762e28) into msm-4.4

* refs/heads/tmp-d762e28
  Linux 4.4.154
  cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status
  iscsi target: fix session creation failure handling
  scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock
  scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
  MIPS: lib: Provide MIPS64r6 __multi3() for GCC < 7
  MIPS: Correct the 64-bit DSP accumulator register size
  kprobes: Make list and blacklist root user read only
  s390/pci: fix out of bounds access during irq setup
  s390/qdio: reset old sbal_state flags
  s390: fix br_r1_trampoline for machines without exrl
  x86/spectre: Add missing family 6 check to microcode check
  x86/irqflags: Mark native_restore_fl extern inline
  pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show()
  ASoC: sirf: Fix potential NULL pointer dereference
  ASoC: dpcm: don't merge format from invalid codec dai
  udl-kms: fix crash due to uninitialized memory
  udl-kms: handle allocation failure
  udl-kms: change down_interruptible to down
  fuse: Add missed unlock_page() to fuse_readpages_fill()
  fuse: Fix oops at process_init_reply()
  fuse: umount should wait for all requests
  fuse: fix unlocked access to processing queue
  fuse: fix double request_end()
  fuse: Don't access pipe->buffers without pipe_lock()
  x86/process: Re-export start_thread()
  x86/speculation/l1tf: Suggest what to do on systems with too much RAM
  x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM
  x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit
  KVM: arm/arm64: Skip updating PMD entry if no change
  KVM: arm/arm64: Skip updating PTE entry if no change
  arm64: mm: check for upper PAGE_SHIFT bits in pfn_valid()
  ext4: reset error code in ext4_find_entry in fallback
  ext4: sysfs: print ext4_super_block fields as little-endian
  ext4: check for NUL characters in extended attribute's name
  s390/kvm: fix deadlock when killed by oom
  btrfs: don't leak ret from do_chunk_alloc
  smb3: don't request leases in symlink creation and query
  smb3: Do not send SMB3 SET_INFO if nothing changed
  cifs: check kmalloc before use
  cifs: add missing debug entries for kconfig options
  mm/memory.c: check return value of ioremap_prot
  scsi: vmw_pvscsi: Return DID_RESET for status SAM_STAT_COMMAND_TERMINATED
  scsi: fcoe: drop frames in ELS LOGO error path
  drivers: net: lmc: fix case value for target abort error
  arc: fix type warnings in arc/mm/cache.c
  arc: fix build errors in arc/include/asm/delay.h
  enic: handle mtu change for vf properly
  Revert "MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum"
  tools/power turbostat: Read extended processor family from CPUID
  zswap: re-check zswap_is_full() after do zswap_shrink()
  selftests/ftrace: Add snapshot and tracing_on test case
  cachefiles: Wait rather than BUG'ing on "Unexpected object collision"
  cachefiles: Fix refcounting bug in backing-file read monitoring
  fscache: Allow cancelled operations to be enqueued
  net: axienet: Fix double deregister of mdio
  bnx2x: Fix invalid memory access in rss hash config path.
  media: staging: omap4iss: Include asm/cacheflush.h after generic includes
  i2c: davinci: Avoid zero value of CLKH
  can: mpc5xxx_can: check of_iomap return before use
  net: prevent ISA drivers from building on PPC32
  atl1c: reserve min skb headroom
  qed: Fix possible race for the link state value.
  net: caif: Add a missing rcu_read_unlock() in caif_flow_cb
  tools/power turbostat: fix -S on UP systems
  usb: gadget: f_uac2: fix endianness of 'struct cntrl_*_lay3'
  tools: usb: ffs-test: Fix build on big endian systems
  usb/phy: fix PPC64 build errors in phy-fsl-usb.c
  usb: gadget: r8a66597: Fix a possible sleep-in-atomic-context bugs in r8a66597_queue()
  usb: gadget: r8a66597: Fix two possible sleep-in-atomic-context bugs in init_controller()
  drm/imx: imx-ldb: check if channel is enabled before printing warning
  drm/imx: imx-ldb: disable LDB on driver bind
  scsi: libiscsi: fix possible NULL pointer dereference in case of TMF
  drm/bridge: adv7511: Reset registers on hotplug
  nl80211: Add a missing break in parse_station_flags
  mac80211: add stations tied to AP_VLANs during hw reconfig
  xfrm: free skb if nlsk pointer is NULL
  xfrm: fix missing dst_release() after policy blocking lbcast and multicast
  vti6: fix PMTU caching and reporting on xmit
  Cipso: cipso_v4_optptr enter infinite loop
  sched/sysctl: Check user input value of sysctl_sched_time_avg
  BACKPORT: zram: drop max_zpage_size and use zs_huge_class_size()
  BACKPORT: zsmalloc: introduce zs_huge_class_size()
  ANDROID: tracing: fix race condition reading saved tgids

Conflicts:
	mm/zsmalloc.c

Change-Id: I1add2f0311c887c135ddc6160963702beeb7bb88
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

4 files changed, 34 insertions, 13 deletions

diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 34a1b1f333b4..d5184aa1ace4 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -752,9 +752,9 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
 	case ELS_LOGO:
 		if (fip->mode == FIP_MODE_VN2VN) {
 			if (fip->state != FIP_ST_VNMP_UP)
-				return -EINVAL;
+				goto drop;
 			if (ntoh24(fh->fh_d_id) == FC_FID_FLOGI)
-				return -EINVAL;
+				goto drop;
 		} else {
 			if (fip->state != FIP_ST_ENABLED)
 				return 0;
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 9f0b00c38658..a74f8fbefd33 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -283,11 +283,11 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
 		 */
 		if (opcode != ISCSI_OP_SCSI_DATA_OUT) {
 			iscsi_conn_printk(KERN_INFO, conn,
-					  "task [op %x/%x itt "
+					  "task [op %x itt "
 					  "0x%x/0x%x] "
 					  "rejected.\n",
-					  task->hdr->opcode, opcode,
-					  task->itt, task->hdr_itt);
+					  opcode, task->itt,
+					  task->hdr_itt);
 			return -EACCES;
 		}
 		/*
@@ -296,10 +296,10 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
 		 */
 		if (conn->session->fast_abort) {
 			iscsi_conn_printk(KERN_INFO, conn,
-					  "task [op %x/%x itt "
+					  "task [op %x itt "
 					  "0x%x/0x%x] fast abort.\n",
-					  task->hdr->opcode, opcode,
-					  task->itt, task->hdr_itt);
+					  opcode, task->itt,
+					  task->hdr_itt);
 			return -EACCES;
 		}
 		break;
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 9f2c9a2fdd74..55fb1088d0b8 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -678,8 +678,24 @@ static ssize_t
 sdev_store_delete(struct device *dev, struct device_attribute *attr,
 		  const char *buf, size_t count)
 {
-	if (device_remove_file_self(dev, attr))
-		scsi_remove_device(to_scsi_device(dev));
+	struct kernfs_node *kn;
+
+	kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
+	WARN_ON_ONCE(!kn);
+	/*
+	 * Concurrent writes into the "delete" sysfs attribute may trigger
+	 * concurrent calls to device_remove_file() and scsi_remove_device().
+	 * device_remove_file() handles concurrent removal calls by
+	 * serializing these and by ignoring the second and later removal
+	 * attempts.  Concurrent calls of scsi_remove_device() are
+	 * serialized. The second and later calls of scsi_remove_device() are
+	 * ignored because the first call of that function changes the device
+	 * state into SDEV_DEL.
+	 */
+	device_remove_file(dev, attr);
+	scsi_remove_device(to_scsi_device(dev));
+	if (kn)
+		sysfs_unbreak_active_protection(kn);
 	return count;
 };
 static DEVICE_ATTR(delete, S_IWUSR, NULL, sdev_store_delete);
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index 0f133c1817de..0de2f9069e23 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -545,9 +545,14 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter,
 	    (btstat == BTSTAT_SUCCESS ||
 	     btstat == BTSTAT_LINKED_COMMAND_COMPLETED ||
 	     btstat == BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG)) {
-		cmd->result = (DID_OK << 16) | sdstat;
-		if (sdstat == SAM_STAT_CHECK_CONDITION && cmd->sense_buffer)
-			cmd->result |= (DRIVER_SENSE << 24);
+		if (sdstat == SAM_STAT_COMMAND_TERMINATED) {
+			cmd->result = (DID_RESET << 16);
+		} else {
+			cmd->result = (DID_OK << 16) | sdstat;
+			if (sdstat == SAM_STAT_CHECK_CONDITION &&
+			    cmd->sense_buffer)
+				cmd->result |= (DRIVER_SENSE << 24);
+		}
 	} else
 		switch (btstat) {
 		case BTSTAT_SUCCESS: