Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI updates from James Bottomley:
 "This is mostly update of the usual drivers: aacraid, ufs, zfcp,
  NCR5380, lpfc, qla2xxx, smartpqi, hisi_sas, target, mpt3sas, pm80xx
  plus a whole load of minor updates and fixes.

  The major core changes are Al Viro's reworking of sg's handling of
  copy to/from user, Ming Lei's removal of the host busy counter to
  avoid contention in the multiqueue case and Damien Le Moal's fixing of
  residual tracking across error handling"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (251 commits)
  scsi: bnx2fc: timeout calculation invalid for bnx2fc_eh_abort()
  scsi: target: core: Fix a pr_debug() argument
  scsi: iscsi: Don't send data to unbound connection
  scsi: target: iscsi: Wait for all commands to finish before freeing a session
  scsi: target: core: Release SPC-2 reservations when closing a session
  scsi: target: core: Document target_cmd_size_check()
  scsi: bnx2i: fix potential use after free
  Revert "scsi: qla2xxx: Fix memory leak when sending I/O fails"
  scsi: NCR5380: Add disconnect_mask module parameter
  scsi: NCR5380: Unconditionally clear ICR after do_abort()
  scsi: NCR5380: Call scsi_set_resid() on command completion
  scsi: scsi_debug: num_tgts must be >= 0
  scsi: lpfc: use hdwq assigned cpu for allocation
  scsi: arcmsr: fix indentation issues
  scsi: qla4xxx: fix double free bug
  scsi: pm80xx: Modified the logic to collect fatal dump
  scsi: pm80xx: Tie the interrupt name to the module instance
  scsi: pm80xx: Controller fatal error through sysfs
  scsi: pm80xx: Do not request 12G sas speeds
  scsi: pm80xx: Cleanup command when a reset times out
  ...

diff --cc drivers/scsi/cxlflash/main.c
Simple merge

diff --cc drivers/scsi/lpfc/lpfc_init.c
Simple merge

diff --cc drivers/scsi/lpfc/lpfc_nportdisc.c
Simple merge

diff --cc drivers/scsi/lpfc/lpfc_scsi.c
index 6822cd9,ba26df9..b138d9f
--- 1/drivers/scsi/lpfc/lpfc_scsi.c
--- 2/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@@ -526,8 -526,9 +526,8 @@@ lpfc_sli4_io_xri_aborted(struct lpfc_hb
                &qp->lpfc_abts_io_buf_list, list) {
                if (psb->cur_iocbq.sli4_xritag == xri) {
                        list_del_init(&psb->list);
-                       psb->exch_busy = 0;
+                       psb->flags &= ~LPFC_SBUF_XBUSY;
                        psb->status = IOSTAT_SUCCESS;
 -#ifdef BUILD_NVME
                        if (psb->cur_iocbq.iocb_flag == LPFC_IO_NVME) {
                                qp->abts_nvme_io_bufs--;
                                spin_unlock(&qp->abts_io_buf_list_lock);

diff --cc drivers/scsi/lpfc/lpfc_sli.c
Simple merge

diff --cc drivers/scsi/qla2xxx/qla_attr.c
Simple merge

diff --cc drivers/scsi/qla2xxx/qla_mbx.c
Simple merge

diff --cc drivers/scsi/qla2xxx/qla_mid.c
Simple merge

diff --cc drivers/scsi/qla2xxx/qla_os.c
Simple merge

diff --cc drivers/scsi/scsi.c
Simple merge

diff --cc drivers/scsi/scsi_lib.c
Simple merge

diff --cc drivers/scsi/scsi_sysfs.c
index cc51f47,2c76d7a..677b5c5
--- 1/drivers/scsi/scsi_sysfs.c
--- 2/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@@ -466,12 -467,18 +467,18 @@@ static void scsi_device_dev_release_use
        sdev->request_queue = NULL;
  
        mutex_lock(&sdev->inquiry_mutex);
 -      rcu_swap_protected(sdev->vpd_pg0, vpd_pg0,
 -                         lockdep_is_held(&sdev->inquiry_mutex));
 -      rcu_swap_protected(sdev->vpd_pg80, vpd_pg80,
 -                         lockdep_is_held(&sdev->inquiry_mutex));
 -      rcu_swap_protected(sdev->vpd_pg83, vpd_pg83,
 -                         lockdep_is_held(&sdev->inquiry_mutex));
 -      rcu_swap_protected(sdev->vpd_pg89, vpd_pg89,
 -                         lockdep_is_held(&sdev->inquiry_mutex));
++      vpd_pg0 = rcu_replace_pointer(sdev->vpd_pg0, vpd_pg0,
++                                     lockdep_is_held(&sdev->inquiry_mutex));
 +      vpd_pg80 = rcu_replace_pointer(sdev->vpd_pg80, vpd_pg80,
 +                                     lockdep_is_held(&sdev->inquiry_mutex));
 +      vpd_pg83 = rcu_replace_pointer(sdev->vpd_pg83, vpd_pg83,
 +                                     lockdep_is_held(&sdev->inquiry_mutex));
++      vpd_pg89 = rcu_replace_pointer(sdev->vpd_pg89, vpd_pg89,
++                                     lockdep_is_held(&sdev->inquiry_mutex));
        mutex_unlock(&sdev->inquiry_mutex);
  
+       if (vpd_pg0)
+               kfree_rcu(vpd_pg0, rcu);
        if (vpd_pg83)
                kfree_rcu(vpd_pg83, rcu);
        if (vpd_pg80)

diff --cc drivers/scsi/sd.c
Simple merge

diff --cc drivers/scsi/sg.c
index 9e4ef22,0940abd..160748a
--- 1/drivers/scsi/sg.c
--- 2/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@@ -429,28 -429,14 +429,36 @@@ sg_read(struct file *filp, char __user 
        SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
                                      "sg_read: count=%d\n", (int) count));
  
-       if (!access_ok(buf, count))
-               return -EFAULT;
        if (sfp->force_packid && (count >= SZ_SG_HEADER)) {
-               old_hdr = kmalloc(SZ_SG_HEADER, GFP_KERNEL);
-               if (!old_hdr)
-                       return -ENOMEM;
-               if (__copy_from_user(old_hdr, buf, SZ_SG_HEADER)) {
-                       retval = -EFAULT;
-                       goto free_old_hdr;
-               }
+               old_hdr = memdup_user(buf, SZ_SG_HEADER);
+               if (IS_ERR(old_hdr))
+                       return PTR_ERR(old_hdr);
                if (old_hdr->reply_len < 0) {
                        if (count >= SZ_SG_IO_HDR) {
 -                              sg_io_hdr_t __user *p = (void __user *)buf;
 -                              if (get_user(req_pack_id, &p->pack_id)) {
++                              /*
++                               * This is stupid.
++                               *
++                               * We're copying the whole sg_io_hdr_t from user
++                               * space just to get the 'pack_id' field. But the
++                               * field is at different offsets for the compat
++                               * case, so we'll use "get_sg_io_hdr()" to copy
++                               * the whole thing and convert it.
++                               *
++                               * We could do something like just calculating the
++                               * offset based of 'in_compat_syscall()', but the
++                               * 'compat_sg_io_hdr' definition is in the wrong
++                               * place for that.
++                               */
 +                              sg_io_hdr_t *new_hdr;
 +                              new_hdr = kmalloc(SZ_SG_IO_HDR, GFP_KERNEL);
 +                              if (!new_hdr) {
 +                                      retval = -ENOMEM;
 +                                      goto free_old_hdr;
 +                              }
 +                              retval = get_sg_io_hdr(new_hdr, buf);
 +                              req_pack_id = new_hdr->pack_id;
 +                              kfree(new_hdr);
 +                              if (retval) {
                                        retval = -EFAULT;
                                        goto free_old_hdr;
                                }

diff --cc drivers/scsi/ufs/ufs_bsg.c
Simple merge

diff --cc drivers/usb/storage/uas.c
Simple merge