Merge tag 'for-linus-20180920' of git://git.kernel.dk/linux-block

Jens writes:
  "Storage fixes for 4.19-rc5

  - Fix for leaking kernel pointer in floppy ioctl (Andy Whitcroft)

  - NVMe pull request from Christoph, and a single ANA log page fix
    (Hannes)

  - Regression fix for libata qd32 support, where we trigger an illegal
    active command transition. This fixes a CD-ROM detection issue that
    was reported, but could also trigger premature completion of the
    internal tag (me)"

* tag 'for-linus-20180920' of git://git.kernel.dk/linux-block:
  floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl
  libata: mask swap internal and hardware tag
  nvme: count all ANA groups for ANA Log page

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 599e01bcdef22b7064853b30b31ad5f3e6a9b432..a9dd4ea7467df60912baca1fd7ebfeb91c9d2988 100644 (file)
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5359,10 +5359,20 @@ void ata_qc_complete(struct ata_queued_cmd *qc)
  */
 int ata_qc_complete_multiple(struct ata_port *ap, u64 qc_active)
 {
+       u64 done_mask, ap_qc_active = ap->qc_active;
        int nr_done = 0;
-       u64 done_mask;
 
-       done_mask = ap->qc_active ^ qc_active;
+       /*
+        * If the internal tag is set on ap->qc_active, then we care about
+        * bit0 on the passed in qc_active mask. Move that bit up to match
+        * the internal tag.
+        */
+       if (ap_qc_active & (1ULL << ATA_TAG_INTERNAL)) {
+               qc_active |= (qc_active & 0x01) << ATA_TAG_INTERNAL;
+               qc_active ^= qc_active & 0x01;
+       }
+
+       done_mask = ap_qc_active ^ qc_active;
 
        if (unlikely(done_mask & qc_active)) {
                ata_port_err(ap, "illegal qc_active transition (%08llx->%08llx)\n",

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 48f622728ce6a1a6006109b711b6d9077ce56cdf..f2b6f4da10341e77cc0280f48560405fecf8b85e 100644 (file)
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3467,6 +3467,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                                          (struct floppy_struct **)&outparam);
                if (ret)
                        return ret;
+               memcpy(&inparam.g, outparam,
+                               offsetof(struct floppy_struct, name));
+               outparam = &inparam.g;
                break;
        case FDMSGON:
                UDP->flags |= FTD_MSG;

diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index a21caea1e0806a56c43a9f1c6d74d1ac3feae00f..2008fa62a373bb9ba84775e39b5b8956dd25bca6 100644 (file)
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -245,6 +245,10 @@ static void nvmet_execute_get_log_page_ana(struct nvmet_req *req)
                offset += len;
                ngrps++;
        }
+       for ( ; grpid <= NVMET_MAX_ANAGRPS; grpid++) {
+               if (nvmet_ana_group_enabled[grpid])
+                       ngrps++;
+       }
 
        hdr.chgcnt = cpu_to_le64(nvmet_ana_chgcnt);
        hdr.ngrps = cpu_to_le16(ngrps);