scsifront_action_handler() will deadlock on host->host_lock, if the
ring is full and it has to wait for entries to become available.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Juergen Gross <jgross@suse.com>

The _PAGE_IO_MAP PTE flag was only used by Xen PV guests to mark PTEs
that were used to map I/O regions that are 1:1 in the p2m.  This
allowed Xen to obtain the correct PFN when converting the MFNs read
from a PTE back to their PFN.

Xen guests no longer use _PAGE_IOMAP for this. Instead mfn_to_pfn()
returns the correct PFN by using a combination of the m2p and p2m to
determine if an MFN corresponds to a 1:1 mapping in the the p2m.

Remove _PAGE_IOMAP, replacing it with _PAGE_UNUSED2 to allow for
future uses of the PTE flag.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Acked-by: "H. Peter Anvin" <hpa@zytor.com>

Since mfn_to_pfn() returns the correct PFN for identity mappings (as
used for MMIO regions), the use of _PAGE_IOMAP is not required in
pte_mfn_to_pfn().

Do not set the _PAGE_IOMAP flag in pte_pfn_to_mfn() and do not use it
in pte_mfn_to_pfn().

This will allow _PAGE_IOMAP to be removed, making it available for
future use.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

If a fault on a kernel address is due to a non-present page, then it
cannot be the result of stale TLB entry from a protection change (RO
to RW or NX to X).  Thus the pagetable walk in spurious_fault() can be
skipped.

See the initial if in spurious_fault() and the tests in
spurious_fault_check()) for the set of possible error codes checked
for spurious faults.  These are:

         IRUWP
Before   x00xx && ( 1xxxx || xxx1x )
After  ( 10001 || 00011 ) && ( 1xxxx || xxx1x )

Thus the new condition is a subset of the previous one, excluding only
non-present faults (I == 1 and W == 1 are mutually exclusive).

This avoids spurious_fault() oopsing in some cases if the pagetables
it attempts to walk are not accessible.  This obscures the location of
the original fault.

This also fixes a crash with Xen PV guests when they access entries in
the M2P corresponding to device MMIO regions.  The M2P is mapped
(read-only) by Xen into the kernel address space of the guest and this
mapping may contains holes for non-RAM regions.  Read faults will
result in calls to spurious_fault(), but because the page tables for
the M2P mappings are not accessible by the guest the pagetable walk
would fault.

This was not normally a problem as MMIO mappings would not normally
result in a M2P lookup because of the use of the _PAGE_IOMAP bit the
PTE.  However, removing the _PAGE_IOMAP bit requires M2P lookups for
MMIO mappings as well.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reported-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Dave Hansen <dave.hansen@intel.com>

I discovered that some needed stuff is defined/declared in headers
which are not included directly. Currently it works but if somebody
remove required headers from currently included headers then build
will break. So, just in case directly include all needed headers.
Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

This code was confusing because we had an unsigned long and then we
compared it to UINT_MAX and then we stored it in a u16.  How many bytes
is this supposed to have: 2, 4 or 16???

I've made it a u16 throughout.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

This function is only called with a spin_lock held and IRQs disabled.
The allocation is not allowed to sleep and NOIO is not sufficient, it
has to be ATOMIC.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

Add myself as maintainer for the Xen pvSCSI drivers.
Signed-off-by: Juergen Gross <jgross@suse.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

Introduces the Xen pvSCSI backend. With pvSCSI it is possible for a
Xen domU to issue SCSI commands to a SCSI LUN assigned to that
domU. The SCSI commands are passed to the pvSCSI backend in a driver
domain (usually Dom0) which is owner of the physical device. This
allows e.g. to use SCSI tape drives in a Xen domU.

The code is taken from the pvSCSI implementation in Xen done by
Fujitsu based on Linux kernel 2.6.18.

Changes from the original version are:
- port to upstream kernel
- put all code in just one source file
- adapt to Linux style guide
- use target core infrastructure instead doing pure pass-through
- enable module unloading
- support SG-list in grant page(s)
- support task abort
- remove redundant struct backend
- allocate resources dynamically
- correct minor error in scsiback_fast_flush_area
- free allocated resources in case of error during I/O preparation
- remove CDB emulation, now handled by target core infrastructure
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

Introduces the Xen pvSCSI frontend. With pvSCSI it is possible for a
Xen domU to issue SCSI commands to a SCSI LUN assigned to that
domU. The SCSI commands are passed to the pvSCSI backend in a driver
domain (usually Dom0) which is owner of the physical device. This
allows e.g. to use SCSI tape drives in a Xen domU.

The code is taken from the pvSCSI implementation in Xen done by
Fujitsu based on Linux kernel 2.6.18.

Changes from the original version are:
- port to upstream kernel
- put all code in just one source file
- move module to appropriate location in kernel tree
- adapt to Linux style guide
- some minor code simplifications
- replace constants with defines
- remove not used defines
- add support for larger SG lists by putting them in a granted page
Signed-off-by: Juergen Gross <jgross@suse.com>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

Add the definition of pvSCSI protocol used between the pvSCSI frontend
in a XEN domU and the pvSCSI backend in a XEN driver domain (usually
Dom0).

This header was originally provided by Fujitsu for Xen based on Linux
2.6.18.  Changes are:
- Added comments.
- Adapt to Linux style guide.
- Add support for larger SG-lists by putting them in an own granted
  page.
- Remove stale definitions.
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

Export bind_interdomain_evtchn_to_irq() so drivers can use threaded
interrupt handlers with:

 irq = bind_interdomain_evtchn_to_irq(remote_dom, remote_port);
 if (irq < 0)
     /* error */
 ret = request_threaded_irq(...);
Signed-off-by: Juergen Gross <jgross@suse.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

The cleanup loop in grow_gnttab_list() is safe from the underflow of
the unsigned 'i' since nr_glist_frames is >= 1, but refactor it
anyway.
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

Instead of ballooning up and down dom0 memory this remaps the existing mfns
that were replaced by the identity map. The reason for this is that the
existing implementation ballooned memory up and and down which caused dom0
to have discontiguous pages. In some cases this resulted in the use of bounce
buffers which reduced network I/O performance significantly. This change will
honor the existing order of the pages with the exception of some boundary
conditions.

To do this we need to update both the Linux p2m table and the Xen m2p table.
Particular care must be taken when updating the p2m table since it's important
to limit table memory consumption and reuse the existing leaf pages which get
freed when an entire leaf page is set to the identity map. To implement this,
mapping updates are grouped into blocks with table entries getting cached
temporarily and then released.

On my test system before:
Total pages: 2105014
Total contiguous: 1640635

After:
Total pages: 2105014
Total contiguous: 2098904
Signed-off-by: Matthew Rushton <mrushton@amazon.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

Pull ARM fixes from Russell King:
 "Fixes for ARM, the most notable being the fix from Nathan Lynch to fix
  the state of various registers during execve, to ensure that data
  can't be leaked between two executables.

  Fixes from Victor Kamensky for get_user() on big endian platforms,
  since the addition of 8-byte get_user() support broke these fairly
  badly.

  A fix from Sudeep Holla for affinity setting when hotplugging CPU 0.

  A fix from Stephen Boyd for a perf-induced sleep attempt while atomic.

  Lastly, a correctness fix for emulation of the SWP instruction on
  ARMv7+, and a fix for wrong carry handling when updating the
  translation table base address on LPAE platforms"

* 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
  ARM: 8149/1: perf: Don't sleep while atomic when enabling per-cpu interrupts
  ARM: 8148/1: flush TLS and thumbee register state during exec
  ARM: 8151/1: add missing exports for asm functions required by get_user macro
  ARM: 8137/1: fix get_user BE behavior for target variable with size of 8 bytes
  ARM: 8135/1: Fix in-correct barrier usage in SWP{B} emulation
  ARM: 8133/1: use irq_set_affinity with force=false when migrating irqs
  ARM: 8132/1: LPAE: drop wrong carry flag correction after adding TTBR1_OFFSET

Pull media fixes from Mauro Carvalho Chehab:
 "some media bug fixes:
   - a Kconfig dependency issue
   - some fixes for af9033/it913x demod to be more reliable and address
     a performance regression
   - cx18: fix an oops on devices with tda8290 tuner
   - two new USB IDs for af9035
   - a couple fixes on smapp driver"

* tag 'media-v3.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  [media] af9035: new IDs: add support for PCTV 78e and PCTV 79e
  [media] af9033: feed clock to RF tuner
  [media] it913x: init tuner on attach
  [media] af9033: update IT9135 tuner inittabs
  [media] Kconfig: do not select SPI bus on sub-driver auto-select
  [media] cx18: fix kernel oops with tda8290 tuner
  [media] smiapp: Set sub-device owner
  [media] smiapp: Fix power count handling

Pull staging / IIO fixes from Greg KH:
 "Here are some IIO and Staging driver fixes for 3.17-rc6.  They are all
  pretty simple, and resolve reported issues"

* tag 'staging-3.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: vt6655: buffer overflow in ioctl
  iio:magnetometer: bugfix magnetometers gain values
  iio: adc: at91: don't use the last converted data register
  iio: adc: xilinx-xadc: assign auxiliary channels address correctly
  iio: meter: ade7758: Fix indio_dev->trig assignment
  iio: inv_mpu6050: Fix indio_dev->trig assignment
  iio: gyro: itg3200: Fix indio_dev->trig assignment
  iio: st_sensors: Fix indio_dev->trig assignment
  iio: hid_sensor_hub: Fix indio_dev->trig assignment
  iio: adc: ad_sigma_delta: Fix indio_dev->trig assignment
  iio: accel: bma180: Fix indio_dev->trig assignment
  iio:trigger: modify return value for iio_trigger_get
  iio:inkern: fix overwritten -EPROBE_DEFER in of_iio_channel_get_by_name

Pull USB fixes / quirks from Greg KH:
 "Here are some USB and PHY fixes and quirks for 3.17-rc6.  Nothing
  major, just a few things that have been reported"

* tag 'usb-3.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters
  USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter
  USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter
  USB: EHCI: unlink QHs even after the controller has stopped
  phy: spear1340-miphy: fix driver dependencies
  phy: spear1310-miphy: fix driver dependencies
  phy: miphy365x: Fix off-by-one error

Pull SCSI target fixes from Nicholas Bellinger:
 "Here are the target pending fixes for v3.17-rc6.

  Included are Sagi's long overdue fixes related to iser-target
  shutdown, along with a couple of fixes from Sebastian related to ALUA
  Referrals changes that when in during the v3.14 time-frame.

  Also included are a few iscsi-target fixes, most recently of which
  where found during Joern's Coverity scanning of target code"

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  iscsi-target: avoid NULL pointer in iscsi_copy_param_list failure
  iscsi-target: Fix memory corruption in iscsit_logout_post_handler_diffcid
  target: Fix inverted logic in SE_DEV_ALUA_SUPPORT_STATE_STORE
  target: Fix user data segment multiplier in spc_emulate_evpd_b3()
  iscsi-target: Ignore ICF_GOT_LAST_DATAOUT during Data-Out ITT lookup
  Target/iser: Fix initiator_depth and responder_resources
  Target/iser: Avoid calling rdma_disconnect twice
  Target/iser: Don't put isert_conn inside disconnected handler
  Target/iser: Get isert_conn reference once got to connected_handler

Pull drm fixes from Dave Airlie:
 "A bunch of radeon fixes for oops on module unload, and problems with
  resetting the dma engine, one nouveau fix for black boxes in rendering
  on my mbp retina, one sti fix, and a couple of intel fixes"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/nouveau: ltc/gf100-: fix cbc issues on certain boards
  drm/bochs: add missing drm_connector_register call
  drm/cirrus: add missing drm_connector_register call
  drm/radeon: Fix typo 'addr' -> 'entry' in rs400_gart_set_page
  drm/nouveau/runpm: fix module unload
  drm/radeon/px: fix module unload
  vgaswitcheroo: add vga_switcheroo_fini_domain_pm_ops
  drm/radeon: don't reset dma on r6xx-evergreen init
  drm/radeon: don't reset sdma on CIK init
  drm/radeon: don't reset dma on NI/SI init
  drm/radeon/dpm: fix resume on mullins
  drm/radeon: Disable HDP flush before every CS again for < r600
  drm/radeon: delete unused PTE_* defines
  drm/i915: Add limited color range readout for HDMI/DP ports on g4x/vlv/chv
  drm: sti: do not iterate over the info frame array
  drm/i915: Fix SRC_COPY width on 830/845g

A mismatch between FB and LTC's idea of how big a large page is causes
issues such as black "holes" in rendering to occur on some boards
(those where LTC is configured for 64KiB large pages) when compression
is used.

Confirmed to fix at least the GK107 MBP.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>

single fix for regression on rs4xx/rs690/rs740
* 'drm-fixes-3.17' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: Fix typo 'addr' -> 'entry' in rs400_gart_set_page

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

->u.generic_elem.len is a user controlled number between 0-255.  We
should limit it to avoid memory corruption.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge tag 'iio-fixes-3.17a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus

Jonathan writes:

First round of IIO fixes for the 3.17 cycle.

* Fix an overwritten error return that can prevent deferred probing when
  using of_iio_channel_get_by_name
* A series that deals with an incorrect reference count when the default
  trigger is set within the main probe routine for a driver.  Can result
  in a double free if the trigger is changed.
* Fix a buglet with xilinx-xadc concerning setup of the address for an
  aux channel.
* At91 adc driver could sometimes get a touchscreen reading rather than
  the intended adc channel.  This is fixed by using the channel data register
  instead.
* Fix some ST magnetometer gain values that differ in production parts from
  the prerelease ones used for driver development.

This patch adds quirks for Entrega Technologies (later Xircom PortGear) USB-
SCSI converters. They use Shuttle Technology EUSB-01/EUSB-S1 chips. The
US_FL_SCM_MULT_TARG quirk is needed to allow multiple devices on the SCSI
chain to be accessed. Without it only the (single) device with SCSI ID 0
can be used.

The standalone converter sold by Entrega had model number U1-SC25. Xircom
acquired Entrega and re-branded the product line PortGear. The PortGear USB
to SCSI Converter (model PGSCSI) is internally identical to the Entrega
product, but later models may use a different USB ID. The Entrega-branded
units have USB ID 1645:0007, as does my Xircom PGSCSI, but the Windows and
Macintosh drivers also support 085A:0028.

Entrega also sold the "Mac USB Dock", which provides two USB ports, a Mac
(8-pin mini-DIN) serial port and a SCSI port. It appears to the computer as
a four-port hub, USB-serial, and USB-SCSI converters. The USB-SCSI part may
have initially used the same ID as the standalone U1-SC25 (1645:0007), but
later production used 085A:0026.

My Xircom PortGear PGSCSI has bcdDevice=0x0100. Units with bcdDevice=0x0133
probably also exist.

This patch adds quirks for 1645:0007, 085A:0026 and 085A:0028. The Windows
driver INF file also mentions 085A:0032 "PortStation SCSI Module", but I
couldn't find any mention of that actually existing in the wild; perhaps it
was cancelled before release?
Signed-off-by: Mark Knibbs <markk@clara.co.uk>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Hi,

The Ariston Technologies iConnect 025 and iConnect 050 (also known as e.g.
iSCSI-50) are SCSI-USB converters which use Shuttle Technology/SCM
Microsystems chips. Only the connectors differ; both have the same USB ID.
The US_FL_SCM_MULT_TARG quirk is required to use SCSI devices with ID other
than 0.

I don't have one of these, but based on the other entries for Shuttle/
SCM-based converters this patch is very likely correct. I used 0x0000 and
0x9999 for bcdDeviceMin and bcdDeviceMax because I'm not sure which
bcdDevice value the products use.
Signed-off-by: Mark Knibbs <markk@clara.co.uk>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The Adaptec USBConnect 2000 is another SCSI-USB converter which uses
Shuttle Technology/SCM Microsystems chips. The US_FL_SCM_MULT_TARG quirk is
required to use SCSI devices with ID other than 0.

I don't have a USBConnect 2000, but based on the other entries for Shuttle/
SCM-based converters this patch is very likely correct. I used 0x0000 and
0x9999 for bcdDeviceMin and bcdDeviceMax because I'm not sure which
bcdDevice value the product uses.
Signed-off-by: Mark Knibbs <markk@clara.co.uk>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Old code in ehci-hcd tries to expedite disabling endpoints after the
controller has stopped, by destroying the endpoint's associated QH
without first unlinking the QH.  This was necessary back when the
driver wasn't so careful about keeping track of the controller's
state.

But now we are careful about it, and the driver knows that when the
controller isn't running, no unlinking delay is needed.  Furthermore,
skipping the unlink step will trigger a BUG() in qh_destroy() when the
preceding QH is released, because the link pointer will be non-NULL.

Removing the lines that skip the unlinking step and go directly to
QH_STATE_IDLE fixes the problem.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Joe Lawrence <joe.lawrence@stratus.com>
Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge tag 'for_3.17-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy into usb-linus

Kishon writes:

misc fixes in PHY drivers

Pull btrfs fixes from Chris Mason:
 "I've got a revert to fix a regression with btrfs device registration,
  and Filipe has part two of his fsync fix from last week"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  Revert "Btrfs: device_list_add() should not update list when mounted"
  Btrfs: set inode's logged_trans/last_log_commit after ranged fsync

Pull NFS client fixes from Trond Myklebust:
 "Highligts:
   - fix an Oops in nfs4_open_and_get_state
   - fix an Oops in the nfs4_state_manager
   - fix another bug in the close/open_downgrade code"

* tag 'nfs-for-3.17-5' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  NFSv4: Fix another bug in the close/open_downgrade code
  NFSv4: nfs4_state_manager() vs. nfs_server_remove_lists()
  NFS: remove BUG possibility in nfs4_open_and_get_state

Pull PCI fixes from Bjorn Helgaas:
 "These fix:

   - Boot video device detection on dual-GPU Apple systems
   - Hotplug fiascos on VGA switcheroo with radeon & nouveau drivers
   - Boot hang on Freescale i.MX6 systems
   - Excessive "no hotplug settings from platform" warnings

  In particular:

  Enumeration
    - Don't default exclusively to first video device (Bruno Prémont)

  PCI device hotplug
    - Remove "no hotplug settings from platform" warning (Bjorn Helgaas)
    - Add pci_ignore_hotplug() for VGA switcheroo (Bjorn Helgaas)

  Freescale i.MX6
    - Put LTSSM in "Detect" state before disabling (Lucas Stach)"

* tag 'pci-v3.17-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  vgaarb: Drop obsolete #ifndef
  vgaarb: Don't default exclusively to first video device with mem+io
  ACPIPHP / radeon / nouveau: Remove acpi_bus_no_hotplug()
  PCI: Remove "no hotplug settings from platform" warning
  PCI: Add pci_ignore_hotplug() to ignore hotplug events for a device
  PCI: imx6: Put LTSSM in "Detect" state before disabling it
  MAINTAINERS: Add Lucas Stach as co-maintainer for i.MX6 PCI driver

Pull SCSI fixes from James Bottomley:
 "This is a set of three fixes.

  One represents a nasty shared tag map regression (another inverted
  condition) caused by recent SCSI MQ patches, one is a longstanding
  potential buffer overrun in the iscsi data buffer and the final one is
  a use after free for the rare bidirectional commands"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  [SCSI] fix for bidi use after free
  [SCSI] fix regression that accidentally disabled block-based tcq
  [SCSI] libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu

Pull perf fixes from Ingo Molnar:
 "Two kernel side fixes: a kprobes fix and a perf_remove_from_context()
  fix (which does not yet fix the migration bug which is WIP)"

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Fix a race condition in perf_remove_from_context()
  kprobes/x86: Free 'optinsn' cache when range check fails

Pull x86 fixes from Ingo Molnar:
 "Misc fixes:

  EFI fixes, a build fix, a page table dumping (debug) fix and a clang
  build fix"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  efi/arm64: Fix fdt-related memory reservation
  x86/mm: Apply the section attribute to the variable, not its type
  x86/efi: Fixup GOT in all boot code paths
  x86/efi: Only load initrd above 4g on second try
  x86-64, ptdump: Mark espfix area only if existent
  x86, irq: Fix build error caused by 9eabc99a

Pull MIPS fixes from Ralf Baechle:
 "A fair number of build fixes for various configurations.

  Fixes to BPF, and the BCM47xx platform code, a preemption fix for the
  Loongson core, a syscall auditing fix, wire up the new getrandom and
  memfd_create.  Several patches for EVA"

* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (30 commits)
  MIPS: SmartMIPS: Disable assembler warnings
  MIPS: Move CPU topology macros to topology.h
  MIPS: Wire up new syscalls getrandom and memfd_create.
  MIPS: Fix a warning for virt_to_page
  arch/mips/net/bpf_jit.c: fix failure check
  MIPS: COP2: CPP macro safety fixes.
  MIPS: Kconfig: Select SMP symbols for CMP
  MIPS: ZBOOT: add missing <linux/string.h> include
  MIPS: IP28: Fix/clean spaces.h
  MIPS: IP28: Select correct L1_CACHE_SHIFT
  MIPS: BCM63xx: delete double assignment
  MIPS: Spelling s/confugrations/configurations/
  MIPS: OCTEON: make get_system_type() thread-safe
  MIPS: CPS: Initialize EVA before bringing up VPEs from secondary cores
  MIPS: Malta: EVA: Rename 'eva_entry' to 'platform_eva_init'
  MIPS: EVA: Add new EVA header
  MIPS: scall64-o32: Fix indirect syscall detection
  MIPS: syscall: Fix AUDIT value for O32 processes on MIPS64
  MIPS: Loongson: Fix COP2 usage for preemptible kernel
  MIPS: NL: Fix nlm_xlp_defconfig build error
  ...

When ending a bi-directionional SCSI request, blk_finish_request()
cleans up and frees the request, but scsi_release_bidi_buffers() tries
to indirect through the request to find it's data buffers.  This causes
a panic due to a null pointer dereference.

Move the call to scsi_release_bidi_buffers() before the call to
blk_finish_request().
Signed-off-by: Daniel Gryniewicz <dang@linuxbox.com>
Reviewed-by: Webb Scales <webbnh@hp.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>