--- /dev/null
+From foo@baz Sat Nov 10 11:35:27 PST 2018
+From: Omar Sandoval <osandov@fb.com>
+Date: Thu, 11 Oct 2018 12:20:49 -0700
+Subject: ataflop: fix error handling during setup
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit 71327f547ee3a46ec5c39fdbbd268401b2578d0e ]
+
+Move queue allocation next to disk allocation to fix a couple of issues:
+
+- If add_disk() hasn't been called, we should clear disk->queue before
+ calling put_disk().
+- If we fail to allocate a request queue, we still need to put all of
+ the disks, not just the ones that we allocated queues for.
+
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/ataflop.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/drivers/block/ataflop.c
++++ b/drivers/block/ataflop.c
+@@ -1933,6 +1933,11 @@ static int __init atari_floppy_init (voi
+ unit[i].disk = alloc_disk(1);
+ if (!unit[i].disk)
+ goto Enomem;
++
++ unit[i].disk->queue = blk_init_queue(do_fd_request,
++ &ataflop_lock);
++ if (!unit[i].disk->queue)
++ goto Enomem;
+ }
+
+ if (UseTrackbuffer < 0)
+@@ -1964,10 +1969,6 @@ static int __init atari_floppy_init (voi
+ sprintf(unit[i].disk->disk_name, "fd%d", i);
+ unit[i].disk->fops = &floppy_fops;
+ unit[i].disk->private_data = &unit[i];
+- unit[i].disk->queue = blk_init_queue(do_fd_request,
+- &ataflop_lock);
+- if (!unit[i].disk->queue)
+- goto Enomem;
+ set_capacity(unit[i].disk, MAX_DISK_SIZE * 2);
+ add_disk(unit[i].disk);
+ }
+@@ -1982,13 +1983,17 @@ static int __init atari_floppy_init (voi
+
+ return 0;
+ Enomem:
+- while (i--) {
+- struct request_queue *q = unit[i].disk->queue;
++ do {
++ struct gendisk *disk = unit[i].disk;
+
+- put_disk(unit[i].disk);
+- if (q)
+- blk_cleanup_queue(q);
+- }
++ if (disk) {
++ if (disk->queue) {
++ blk_cleanup_queue(disk->queue);
++ disk->queue = NULL;
++ }
++ put_disk(unit[i].disk);
++ }
++ } while (i--);
+
+ unregister_blkdev(FLOPPY_MAJOR, "fd");
+ return -ENOMEM;
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: Martin Willi <martin@strongswan.org>
+Date: Wed, 22 Aug 2018 09:39:52 +0200
+Subject: ath10k: schedule hardware restart if WMI command times out
+
+From: Martin Willi <martin@strongswan.org>
+
+[ Upstream commit a9911937e7d332761e8c4fcbc7ba0426bdc3956f ]
+
+When running in AP mode, ath10k sometimes suffers from TX credit
+starvation. The issue is hard to reproduce and shows up once in a
+few days, but has been repeatedly seen with QCA9882 and a large
+range of firmwares, including 10.2.4.70.67.
+
+Once the module is in this state, TX credits are never replenished,
+which results in "SWBA overrun" errors, as no beacons can be sent.
+Even worse, WMI commands run in a timeout while holding the conf
+mutex for three seconds each, making any further operations slow
+and the whole system unresponsive.
+
+The firmware/driver never recovers from that state automatically,
+and triggering TX flush or warm restarts won't work over WMI. So
+issue a hardware restart if a WMI command times out due to missing
+TX credits. This implies a connectivity outage of about 1.4s in AP
+mode, but brings back the interface and the whole system to a usable
+state. WMI command timeouts have not been seen in absent of this
+specific issue, so taking such drastic actions seems legitimate.
+
+Signed-off-by: Martin Willi <martin@strongswan.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -751,6 +751,12 @@ int ath10k_wmi_cmd_send(struct ath10k *a
+ if (ret)
+ dev_kfree_skb_any(skb);
+
++ if (ret == -EAGAIN) {
++ ath10k_warn(ar, "wmi command %d timeout, restarting hardware\n",
++ cmd_id);
++ queue_work(ar->workqueue, &ar->restart_work);
++ }
++
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: Prarit Bhargava <prarit@redhat.com>
+Date: Mon, 8 Oct 2018 11:06:19 -0400
+Subject: cpupower: Fix coredump on VMWare
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+[ Upstream commit f69ffc5d3db8f1f03fd6d1df5930f9a1fbd787b6 ]
+
+cpupower crashes on VMWare guests. The guests have the AMD PStateDef MSR
+(0xC0010064 + state number) set to zero. As a result fid and did are zero
+and the crash occurs because of a divide by zero (cof = fid/did). This
+can be prevented by checking the enable bit in the PStateDef MSR before
+calculating cof. By doing this the value of pstate[i] remains zero and
+the value can be tested before displaying the active Pstates.
+
+Check the enable bit in the PstateDef register for all supported families
+and only print out enabled Pstates.
+
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/power/cpupower/utils/cpufreq-info.c | 2 ++
+ tools/power/cpupower/utils/helpers/amd.c | 5 +++++
+ 2 files changed, 7 insertions(+)
+
+--- a/tools/power/cpupower/utils/cpufreq-info.c
++++ b/tools/power/cpupower/utils/cpufreq-info.c
+@@ -200,6 +200,8 @@ static int get_boost_mode(unsigned int c
+ printf(_(" Boost States: %d\n"), b_states);
+ printf(_(" Total States: %d\n"), pstate_no);
+ for (i = 0; i < pstate_no; i++) {
++ if (!pstates[i])
++ continue;
+ if (i < b_states)
+ printf(_(" Pstate-Pb%d: %luMHz (boost state)"
+ "\n"), i, pstates[i]);
+--- a/tools/power/cpupower/utils/helpers/amd.c
++++ b/tools/power/cpupower/utils/helpers/amd.c
+@@ -103,6 +103,11 @@ int decode_pstates(unsigned int cpu, uns
+ }
+ if (read_msr(cpu, MSR_AMD_PSTATE + i, &pstate.val))
+ return -1;
++ if ((cpu_family == 0x17) && (!pstate.fam17h_bits.en))
++ continue;
++ else if (!pstate.bits.en)
++ continue;
++
+ pstates[i] = get_cof(cpu_family, pstate);
+ }
+ *no = i;
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Tue, 2 Oct 2018 01:34:44 -0400
+Subject: ext4: fix argument checking in EXT4_IOC_MOVE_EXT
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit f18b2b83a727a3db208308057d2c7945f368e625 ]
+
+If the starting block number of either the source or destination file
+exceeds the EOF, EXT4_IOC_MOVE_EXT should return EINVAL.
+
+Also fixed the helper function mext_check_coverage() so that if the
+logical block is beyond EOF, make it return immediately, instead of
+looping until the block number wraps all the away around. This takes
+long enough that if there are multiple threads trying to do pound on
+an the same inode doing non-sensical things, it can end up triggering
+the kernel's soft lockup detector.
+
+Reported-by: syzbot+c61979f6f2cba5cb3c06@syzkaller.appspotmail.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/move_extent.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -533,9 +533,13 @@ mext_check_arguments(struct inode *orig_
+ orig_inode->i_ino, donor_inode->i_ino);
+ return -EINVAL;
+ }
+- if (orig_eof < orig_start + *len - 1)
++ if (orig_eof <= orig_start)
++ *len = 0;
++ else if (orig_eof < orig_start + *len - 1)
+ *len = orig_eof - orig_start;
+- if (donor_eof < donor_start + *len - 1)
++ if (donor_eof <= donor_start)
++ *len = 0;
++ else if (donor_eof < donor_start + *len - 1)
+ *len = donor_eof - donor_start;
+ if (!*len) {
+ ext4_debug("ext4 move extent: len should not be 0 "
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Tue, 11 Sep 2018 19:20:40 +0900
+Subject: kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 819319fc93461c07b9cdb3064f154bd8cfd48172 ]
+
+Make reuse_unused_kprobe() to return error code if
+it fails to reuse unused kprobe for optprobe instead
+of calling BUG_ON().
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: David S . Miller <davem@davemloft.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Naveen N . Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/153666124040.21306.14150398706331307654.stgit@devbox
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/kprobes.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -665,9 +665,10 @@ static void unoptimize_kprobe(struct kpr
+ }
+
+ /* Cancel unoptimizing for reusing */
+-static void reuse_unused_kprobe(struct kprobe *ap)
++static int reuse_unused_kprobe(struct kprobe *ap)
+ {
+ struct optimized_kprobe *op;
++ int ret;
+
+ BUG_ON(!kprobe_unused(ap));
+ /*
+@@ -681,8 +682,12 @@ static void reuse_unused_kprobe(struct k
+ /* Enable the probe again */
+ ap->flags &= ~KPROBE_FLAG_DISABLED;
+ /* Optimize it again (remove from op->list) */
+- BUG_ON(!kprobe_optready(ap));
++ ret = kprobe_optready(ap);
++ if (ret)
++ return ret;
++
+ optimize_kprobe(ap);
++ return 0;
+ }
+
+ /* Remove optimized instructions */
+@@ -893,11 +898,16 @@ static void __disarm_kprobe(struct kprob
+ #define kprobe_disarmed(p) kprobe_disabled(p)
+ #define wait_for_kprobe_optimizer() do {} while (0)
+
+-/* There should be no unused kprobes can be reused without optimization */
+-static void reuse_unused_kprobe(struct kprobe *ap)
++static int reuse_unused_kprobe(struct kprobe *ap)
+ {
++ /*
++ * If the optimized kprobe is NOT supported, the aggr kprobe is
++ * released at the same time that the last aggregated kprobe is
++ * unregistered.
++ * Thus there should be no chance to reuse unused kprobe.
++ */
+ printk(KERN_ERR "Error: There should be no unused kprobe here.\n");
+- BUG_ON(kprobe_unused(ap));
++ return -EINVAL;
+ }
+
+ static void free_aggr_kprobe(struct kprobe *p)
+@@ -1275,9 +1285,12 @@ static int register_aggr_kprobe(struct k
+ goto out;
+ }
+ init_aggr_kprobe(ap, orig_p);
+- } else if (kprobe_unused(ap))
++ } else if (kprobe_unused(ap)) {
+ /* This probe is going to die. Rescue it */
+- reuse_unused_kprobe(ap);
++ ret = reuse_unused_kprobe(ap);
++ if (ret)
++ goto out;
++ }
+
+ if (kprobe_gone(ap)) {
+ /*
--- /dev/null
+From foo@baz Sat Nov 10 11:35:27 PST 2018
+From: Waiman Long <longman@redhat.com>
+Date: Thu, 18 Oct 2018 21:45:17 -0400
+Subject: locking/lockdep: Fix debug_locks off performance problem
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 9506a7425b094d2f1d9c877ed5a78f416669269b ]
+
+It was found that when debug_locks was turned off because of a problem
+found by the lockdep code, the system performance could drop quite
+significantly when the lock_stat code was also configured into the
+kernel. For instance, parallel kernel build time on a 4-socket x86-64
+server nearly doubled.
+
+Further analysis into the cause of the slowdown traced back to the
+frequent call to debug_locks_off() from the __lock_acquired() function
+probably due to some inconsistent lockdep states with debug_locks
+off. The debug_locks_off() function did an unconditional atomic xchg
+to write a 0 value into debug_locks which had already been set to 0.
+This led to severe cacheline contention in the cacheline that held
+debug_locks. As debug_locks is being referenced in quite a few different
+places in the kernel, this greatly slow down the system performance.
+
+To prevent that trashing of debug_locks cacheline, lock_acquired()
+and lock_contended() now checks the state of debug_locks before
+proceeding. The debug_locks_off() function is also modified to check
+debug_locks before calling __debug_locks_off().
+
+Signed-off-by: Waiman Long <longman@redhat.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Will Deacon <will.deacon@arm.com>
+Link: http://lkml.kernel.org/r/1539913518-15598-1-git-send-email-longman@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/locking/lockdep.c | 4 ++--
+ lib/debug_locks.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -3808,7 +3808,7 @@ void lock_contended(struct lockdep_map *
+ {
+ unsigned long flags;
+
+- if (unlikely(!lock_stat))
++ if (unlikely(!lock_stat || !debug_locks))
+ return;
+
+ if (unlikely(current->lockdep_recursion))
+@@ -3828,7 +3828,7 @@ void lock_acquired(struct lockdep_map *l
+ {
+ unsigned long flags;
+
+- if (unlikely(!lock_stat))
++ if (unlikely(!lock_stat || !debug_locks))
+ return;
+
+ if (unlikely(current->lockdep_recursion))
+--- a/lib/debug_locks.c
++++ b/lib/debug_locks.c
+@@ -37,7 +37,7 @@ EXPORT_SYMBOL_GPL(debug_locks_silent);
+ */
+ int debug_locks_off(void)
+ {
+- if (__debug_locks_off()) {
++ if (debug_locks && __debug_locks_off()) {
+ if (!debug_locks_silent) {
+ console_verbose();
+ return 1;
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: Shaohua Li <shli@fb.com>
+Date: Mon, 1 Oct 2018 18:36:36 -0700
+Subject: MD: fix invalid stored role for a disk
+
+From: Shaohua Li <shli@fb.com>
+
+[ Upstream commit d595567dc4f0c1d90685ec1e2e296e2cad2643ac ]
+
+If we change the number of array's device after device is removed from array,
+then add the device back to array, we can see that device is added as active
+role instead of spare which we expected.
+
+Please see the below link for details:
+https://marc.info/?l=linux-raid&m=153736982015076&w=2
+
+This is caused by that we prefer to use device's previous role which is
+recorded by saved_raid_disk, but we should respect the new number of
+conf->raid_disks since it could be changed after device is removed.
+
+Reported-by: Gioh Kim <gi-oh.kim@profitbricks.com>
+Tested-by: Gioh Kim <gi-oh.kim@profitbricks.com>
+Acked-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/md.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1646,6 +1646,10 @@ static int super_1_validate(struct mddev
+ } else
+ set_bit(In_sync, &rdev->flags);
+ rdev->raid_disk = role;
++ if (role >= mddev->raid_disks) {
++ rdev->saved_raid_disk = -1;
++ rdev->raid_disk = -1;
++ }
+ break;
+ }
+ if (sb->devflags & WriteMostly1)
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 23 Sep 2018 14:39:24 -0600
+Subject: mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01
+
+From: Yu Zhao <yuzhao@google.com>
+
+[ Upstream commit 5169894982bb67486d93cc1e10151712bb86bcb6 ]
+
+This device reports SDHCI_CLOCK_INT_STABLE even though it's not
+ready to take SDHCI_CLOCK_CARD_EN. The symptom is that reading
+SDHCI_CLOCK_CONTROL after enabling the clock shows absence of the
+bit from the register (e.g. expecting 0x0000fa07 = 0x0000fa03 |
+SDHCI_CLOCK_CARD_EN but only observed the first operand).
+
+mmc1: Timeout waiting for hardware cmd interrupt.
+mmc1: sdhci: ============ SDHCI REGISTER DUMP ===========
+mmc1: sdhci: Sys addr: 0x00000000 | Version: 0x00000603
+mmc1: sdhci: Blk size: 0x00000000 | Blk cnt: 0x00000000
+mmc1: sdhci: Argument: 0x00000000 | Trn mode: 0x00000000
+mmc1: sdhci: Present: 0x01ff0001 | Host ctl: 0x00000001
+mmc1: sdhci: Power: 0x0000000f | Blk gap: 0x00000000
+mmc1: sdhci: Wake-up: 0x00000000 | Clock: 0x0000fa03
+mmc1: sdhci: Timeout: 0x00000000 | Int stat: 0x00000000
+mmc1: sdhci: Int enab: 0x00ff0083 | Sig enab: 0x00ff0083
+mmc1: sdhci: AC12 err: 0x00000000 | Slot int: 0x00000000
+mmc1: sdhci: Caps: 0x25fcc8bf | Caps_1: 0x00002077
+mmc1: sdhci: Cmd: 0x00000000 | Max curr: 0x005800c8
+mmc1: sdhci: Resp[0]: 0x00000000 | Resp[1]: 0x00000000
+mmc1: sdhci: Resp[2]: 0x00000000 | Resp[3]: 0x00000000
+mmc1: sdhci: Host ctl2: 0x00000008
+mmc1: sdhci: ADMA Err: 0x00000000 | ADMA Ptr: 0x00000000
+mmc1: sdhci: ============================================
+
+The problem happens during wakeup from S3. Adding a delay quirk
+after power up reliably fixes the problem.
+
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-pci-o2micro.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-pci-o2micro.c
++++ b/drivers/mmc/host/sdhci-pci-o2micro.c
+@@ -336,6 +336,9 @@ int sdhci_pci_o2_probe(struct sdhci_pci_
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+ break;
+ case PCI_DEVICE_ID_O2_SEABIRD0:
++ if (chip->pdev->revision == 0x01)
++ chip->quirks |= SDHCI_QUIRK_DELAY_AFTER_POWER;
++ /* fall through */
+ case PCI_DEVICE_ID_O2_SEABIRD1:
+ /* UnLock WP */
+ ret = pci_read_config_byte(chip->pdev,
--- /dev/null
+From foo@baz Sat Nov 10 11:35:27 PST 2018
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Fri, 12 Oct 2018 19:14:58 -0700
+Subject: net: qla3xxx: Remove overflowing shift statement
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 8c3bf9b62b667456a57aefcf1689e826df146159 ]
+
+Clang currently warns:
+
+drivers/net/ethernet/qlogic/qla3xxx.c:384:24: warning: signed shift
+result (0xF00000000) requires 37 bits to represent, but 'int' only has
+32 bits [-Wshift-overflow]
+ ((ISP_NVRAM_MASK << 16) | qdev->eeprom_cmd_data));
+ ~~~~~~~~~~~~~~ ^ ~~
+1 warning generated.
+
+The warning is certainly accurate since ISP_NVRAM_MASK is defined as
+(0x000F << 16) which is then shifted by 16, resulting in 64424509440,
+well above UINT_MAX.
+
+Given that this is the only location in this driver where ISP_NVRAM_MASK
+is shifted again, it seems likely that ISP_NVRAM_MASK was originally
+defined without a shift and during the move of the shift to the
+definition, this statement wasn't properly removed (since ISP_NVRAM_MASK
+is used in the statenent right above this). Only the maintainers can
+confirm this since this statment has been here since the driver was
+first added to the kernel.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/127
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qla3xxx.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -382,8 +382,6 @@ static void fm93c56a_select(struct ql3_a
+
+ qdev->eeprom_cmd_data = AUBURN_EEPROM_CS_1;
+ ql_write_nvram_reg(qdev, spir, ISP_NVRAM_MASK | qdev->eeprom_cmd_data);
+- ql_write_nvram_reg(qdev, spir,
+- ((ISP_NVRAM_MASK << 16) | qdev->eeprom_cmd_data));
+ }
+
+ /*
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: Sanskriti Sharma <sansharm@redhat.com>
+Date: Tue, 2 Oct 2018 10:29:11 -0400
+Subject: perf tools: Cleanup trace-event-info 'tdata' leak
+
+From: Sanskriti Sharma <sansharm@redhat.com>
+
+[ Upstream commit faedbf3fd19f2511a39397f76359e4cc6ee93072 ]
+
+Free tracing_data structure in tracing_data_get() error paths.
+
+Fixes the following coverity complaint:
+
+ Error: RESOURCE_LEAK (CWE-772):
+ leaked_storage: Variable "tdata" going out of scope leaks the storage
+
+Signed-off-by: Sanskriti Sharma <sansharm@redhat.com>
+Reviewed-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Joe Lawrence <joe.lawrence@redhat.com>
+Link: http://lkml.kernel.org/r/1538490554-8161-3-git-send-email-sansharm@redhat.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/trace-event-info.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/tools/perf/util/trace-event-info.c
++++ b/tools/perf/util/trace-event-info.c
+@@ -513,12 +513,14 @@ struct tracing_data *tracing_data_get(st
+ "/tmp/perf-XXXXXX");
+ if (!mkstemp(tdata->temp_file)) {
+ pr_debug("Can't make temp file");
++ free(tdata);
+ return NULL;
+ }
+
+ temp_fd = open(tdata->temp_file, O_RDWR);
+ if (temp_fd < 0) {
+ pr_debug("Can't read '%s'", tdata->temp_file);
++ free(tdata);
+ return NULL;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 11:35:27 PST 2018
+From: Sanskriti Sharma <sansharm@redhat.com>
+Date: Tue, 2 Oct 2018 10:29:14 -0400
+Subject: perf tools: Free temporary 'sys' string in read_event_files()
+
+From: Sanskriti Sharma <sansharm@redhat.com>
+
+[ Upstream commit 1e44224fb0528b4c0cc176bde2bb31e9127eb14b ]
+
+For each system in a given pevent, read_event_files() reads in a
+temporary 'sys' string. Be sure to free this string before moving onto
+to the next system and/or leaving read_event_files().
+
+Fixes the following coverity complaints:
+
+ Error: RESOURCE_LEAK (CWE-772):
+
+ tools/perf/util/trace-event-read.c:343: overwrite_var: Overwriting
+ "sys" in "sys = read_string()" leaks the storage that "sys" points to.
+
+ tools/perf/util/trace-event-read.c:353: leaked_storage: Variable "sys"
+ going out of scope leaks the storage it points to.
+
+Signed-off-by: Sanskriti Sharma <sansharm@redhat.com>
+Reviewed-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Joe Lawrence <joe.lawrence@redhat.com>
+Link: http://lkml.kernel.org/r/1538490554-8161-6-git-send-email-sansharm@redhat.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/trace-event-read.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/util/trace-event-read.c
++++ b/tools/perf/util/trace-event-read.c
+@@ -336,9 +336,12 @@ static int read_event_files(struct peven
+ for (x=0; x < count; x++) {
+ size = read8(pevent);
+ ret = read_event_file(pevent, sys, size);
+- if (ret)
++ if (ret) {
++ free(sys);
+ return ret;
++ }
+ }
++ free(sys);
+ }
+ return 0;
+ }
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: Finn Thain <fthain@telegraphics.com.au>
+Date: Tue, 16 Oct 2018 16:31:25 +1100
+Subject: scsi: esp_scsi: Track residual for PIO transfers
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit fd47d919d0c336e7c22862b51ee94927ffea227a ]
+
+If a target disconnects during a PIO data transfer the command may fail
+when the target reconnects:
+
+scsi host1: DMA length is zero!
+scsi host1: cur adr[04380000] len[00000000]
+
+The scsi bus is then reset. This happens because the residual reached
+zero before the transfer was completed.
+
+The usual residual calculation relies on the Transfer Count registers.
+That works for DMA transfers but not for PIO transfers. Fix the problem
+by storing the PIO transfer residual and using that to correctly
+calculate bytes_sent.
+
+Fixes: 6fe07aaffbf0 ("[SCSI] m68k: new mac_esp scsi driver")
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/esp_scsi.c | 1 +
+ drivers/scsi/esp_scsi.h | 2 ++
+ drivers/scsi/mac_esp.c | 2 ++
+ 3 files changed, 5 insertions(+)
+
+--- a/drivers/scsi/esp_scsi.c
++++ b/drivers/scsi/esp_scsi.c
+@@ -1316,6 +1316,7 @@ static int esp_data_bytes_sent(struct es
+
+ bytes_sent = esp->data_dma_len;
+ bytes_sent -= ecount;
++ bytes_sent -= esp->send_cmd_residual;
+
+ if (!(ent->flags & ESP_CMD_FLAG_WRITE))
+ bytes_sent -= fifo_cnt;
+--- a/drivers/scsi/esp_scsi.h
++++ b/drivers/scsi/esp_scsi.h
+@@ -524,6 +524,8 @@ struct esp {
+
+ void *dma;
+ int dmarev;
++
++ u32 send_cmd_residual;
+ };
+
+ /* A front-end driver for the ESP chip should do the following in
+--- a/drivers/scsi/mac_esp.c
++++ b/drivers/scsi/mac_esp.c
+@@ -426,6 +426,8 @@ static void mac_esp_send_pio_cmd(struct
+ scsi_esp_cmd(esp, ESP_CMD_TI);
+ }
+ }
++
++ esp->send_cmd_residual = esp_count;
+ }
+
+ static int mac_esp_irq_pending(struct esp *esp)
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: James Smart <jsmart2021@gmail.com>
+Date: Mon, 10 Sep 2018 10:30:45 -0700
+Subject: scsi: lpfc: Correct soft lockup when running mds diagnostics
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 0ef01a2d95fd62bb4f536e7ce4d5e8e74b97a244 ]
+
+When running an mds diagnostic that passes frames with the switch, soft
+lockups are detected. The driver is in a CQE processing loop and has
+sufficient amount of traffic that it never exits the ring processing routine,
+thus the "lockup".
+
+Cap the number of elements in the work processing routine to 64 elements. This
+ensures that the cpu will be given up and the handler reschedule to process
+additional items.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -3441,6 +3441,7 @@ lpfc_sli_handle_slow_ring_event_s4(struc
+ struct hbq_dmabuf *dmabuf;
+ struct lpfc_cq_event *cq_event;
+ unsigned long iflag;
++ int count = 0;
+
+ spin_lock_irqsave(&phba->hbalock, iflag);
+ phba->hba_flag &= ~HBA_SP_QUEUE_EVT;
+@@ -3462,16 +3463,22 @@ lpfc_sli_handle_slow_ring_event_s4(struc
+ if (irspiocbq)
+ lpfc_sli_sp_handle_rspiocb(phba, pring,
+ irspiocbq);
++ count++;
+ break;
+ case CQE_CODE_RECEIVE:
+ case CQE_CODE_RECEIVE_V1:
+ dmabuf = container_of(cq_event, struct hbq_dmabuf,
+ cq_event);
+ lpfc_sli4_handle_received_buffer(phba, dmabuf);
++ count++;
+ break;
+ default:
+ break;
+ }
++
++ /* Limit the number of events to 64 to avoid soft lockups */
++ if (count == 64)
++ break;
+ }
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 11:35:27 PST 2018
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Thu, 18 Oct 2018 22:13:02 +0900
+Subject: selftests: ftrace: Add synthetic event syntax testcase
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit ba0e41ca81b935b958006c7120466e2217357827 ]
+
+Add a testcase to check the syntax and field types for
+synthetic_events interface.
+
+Link: http://lkml.kernel.org/r/153986838264.18251.16627517536956299922.stgit@devbox
+
+Acked-by: Shuah Khan <shuah@kernel.org>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc | 80 ++++++++++
+ 1 file changed, 80 insertions(+)
+ create mode 100644 tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc
+
+--- /dev/null
++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc
+@@ -0,0 +1,80 @@
++#!/bin/sh
++# SPDX-License-Identifier: GPL-2.0
++# description: event trigger - test synthetic_events syntax parser
++
++do_reset() {
++ reset_trigger
++ echo > set_event
++ clear_trace
++}
++
++fail() { #msg
++ do_reset
++ echo $1
++ exit_fail
++}
++
++if [ ! -f set_event ]; then
++ echo "event tracing is not supported"
++ exit_unsupported
++fi
++
++if [ ! -f synthetic_events ]; then
++ echo "synthetic event is not supported"
++ exit_unsupported
++fi
++
++reset_tracer
++do_reset
++
++echo "Test synthetic_events syntax parser"
++
++echo > synthetic_events
++
++# synthetic event must have a field
++! echo "myevent" >> synthetic_events
++echo "myevent u64 var1" >> synthetic_events
++
++# synthetic event must be found in synthetic_events
++grep "myevent[[:space:]]u64 var1" synthetic_events
++
++# it is not possible to add same name event
++! echo "myevent u64 var2" >> synthetic_events
++
++# Non-append open will cleanup all events and add new one
++echo "myevent u64 var2" > synthetic_events
++
++# multiple fields with different spaces
++echo "myevent u64 var1; u64 var2;" > synthetic_events
++grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events
++echo "myevent u64 var1 ; u64 var2 ;" > synthetic_events
++grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events
++echo "myevent u64 var1 ;u64 var2" > synthetic_events
++grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events
++
++# test field types
++echo "myevent u32 var" > synthetic_events
++echo "myevent u16 var" > synthetic_events
++echo "myevent u8 var" > synthetic_events
++echo "myevent s64 var" > synthetic_events
++echo "myevent s32 var" > synthetic_events
++echo "myevent s16 var" > synthetic_events
++echo "myevent s8 var" > synthetic_events
++
++echo "myevent char var" > synthetic_events
++echo "myevent int var" > synthetic_events
++echo "myevent long var" > synthetic_events
++echo "myevent pid_t var" > synthetic_events
++
++echo "myevent unsigned char var" > synthetic_events
++echo "myevent unsigned int var" > synthetic_events
++echo "myevent unsigned long var" > synthetic_events
++grep "myevent[[:space:]]unsigned long var" synthetic_events
++
++# test string type
++echo "myevent char var[10]" > synthetic_events
++grep "myevent[[:space:]]char\[10\] var" synthetic_events
++
++do_reset
++
++exit 0
acpica-aml-interpreter-add-region-addresses-in-global-list-during-initialization.patch
alsa-ca0106-disable-izd-on-sb0570-dac-to-fix-audio-pops.patch
x86-corruption-check-fix-panic-in-memory_corruption_check-when-boot-option-without-value-is-provided.patch
+sparc-fix-single-pcr-perf-event-counter-management.patch
+sparc-throttle-perf-events-properly.patch
+net-qla3xxx-remove-overflowing-shift-statement.patch
+selftests-ftrace-add-synthetic-event-syntax-testcase.patch
+locking-lockdep-fix-debug_locks-off-performance-problem.patch
+ataflop-fix-error-handling-during-setup.patch
+swim-fix-cleanup-on-setup-error.patch
+tun-consistently-configure-generic-netdev-params-via-rtnetlink.patch
+perf-tools-free-temporary-sys-string-in-read_event_files.patch
+perf-tools-cleanup-trace-event-info-tdata-leak.patch
+cpupower-fix-coredump-on-vmware.patch
+mmc-sdhci-pci-o2micro-add-quirk-for-o2-micro-dev-0x8620-rev-0x01.patch
+x86-olpc-indicate-that-legacy-pc-xo-1-platform-should-not-register-rtc.patch
+x86-boot-fix-efi-stub-alignment.patch
+kprobes-return-error-if-we-fail-to-reuse-kprobe-instead-of-bug_on.patch
+ath10k-schedule-hardware-restart-if-wmi-command-times-out.patch
+scsi-esp_scsi-track-residual-for-pio-transfers.patch
+ext4-fix-argument-checking-in-ext4_ioc_move_ext.patch
+md-fix-invalid-stored-role-for-a-disk.patch
+usb-chipidea-prevent-unbalanced-irq-disable.patch
+uio-ensure-class-is-registered-before-devices.patch
+scsi-lpfc-correct-soft-lockup-when-running-mds-diagnostics.patch
+signal-always-deliver-the-kernel-s-sigkill-and-sigstop-to-a-pid-namespace-init.patch
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Mon, 3 Sep 2018 20:02:46 +0200
+Subject: signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+[ Upstream commit 3597dfe01d12f570bc739da67f857fd222a3ea66 ]
+
+Instead of playing whack-a-mole and changing SEND_SIG_PRIV to
+SEND_SIG_FORCED throughout the kernel to ensure a pid namespace init
+gets signals sent by the kernel, stop allowing a pid namespace init to
+ignore SIGKILL or SIGSTOP sent by the kernel. A pid namespace init is
+only supposed to be able to ignore signals sent from itself and
+children with SIG_DFL.
+
+Fixes: 921cf9f63089 ("signals: protect cinit from unblocked SIG_DFL signals")
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/signal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -1042,7 +1042,7 @@ static int __send_signal(int sig, struct
+
+ result = TRACE_SIGNAL_IGNORED;
+ if (!prepare_signal(sig, t,
+- from_ancestor_ns || (info == SEND_SIG_FORCED)))
++ from_ancestor_ns || (info == SEND_SIG_PRIV) || (info == SEND_SIG_FORCED)))
+ goto ret;
+
+ pending = group ? &t->signal->shared_pending : &t->pending;
--- /dev/null
+From foo@baz Sat Nov 10 11:35:27 PST 2018
+From: "David S. Miller" <davem@davemloft.net>
+Date: Fri, 12 Oct 2018 10:31:58 -0700
+Subject: sparc: Fix single-pcr perf event counter management.
+
+From: "David S. Miller" <davem@davemloft.net>
+
+[ Upstream commit cfdc3170d214046b9509183fe9b9544dc644d40b ]
+
+It is important to clear the hw->state value for non-stopped events
+when they are added into the PMU. Otherwise when the event is
+scheduled out, we won't read the counter because HES_UPTODATE is still
+set. This breaks 'perf stat' and similar use cases, causing all the
+events to show zero.
+
+This worked for multi-pcr because we make explicit sparc_pmu_start()
+calls in calculate_multiple_pcrs(). calculate_single_pcr() doesn't do
+this because the idea there is to accumulate all of the counter
+settings into the single pcr value. So we have to add explicit
+hw->state handling there.
+
+Like x86, we use the PERF_HES_ARCH bit to track truly stopped events
+so that we don't accidently start them on a reload.
+
+Related to all of this, sparc_pmu_start() is missing a userpage update
+so add it.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/sparc/kernel/perf_event.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/arch/sparc/kernel/perf_event.c
++++ b/arch/sparc/kernel/perf_event.c
+@@ -919,6 +919,8 @@ static void read_in_all_counters(struct
+ sparc_perf_event_update(cp, &cp->hw,
+ cpuc->current_idx[i]);
+ cpuc->current_idx[i] = PIC_NO_INDEX;
++ if (cp->hw.state & PERF_HES_STOPPED)
++ cp->hw.state |= PERF_HES_ARCH;
+ }
+ }
+ }
+@@ -951,10 +953,12 @@ static void calculate_single_pcr(struct
+
+ enc = perf_event_get_enc(cpuc->events[i]);
+ cpuc->pcr[0] &= ~mask_for_index(idx);
+- if (hwc->state & PERF_HES_STOPPED)
++ if (hwc->state & PERF_HES_ARCH) {
+ cpuc->pcr[0] |= nop_for_index(idx);
+- else
++ } else {
+ cpuc->pcr[0] |= event_encoding(enc, idx);
++ hwc->state = 0;
++ }
+ }
+ out:
+ cpuc->pcr[0] |= cpuc->event[0]->hw.config_base;
+@@ -980,6 +984,9 @@ static void calculate_multiple_pcrs(stru
+
+ cpuc->current_idx[i] = idx;
+
++ if (cp->hw.state & PERF_HES_ARCH)
++ continue;
++
+ sparc_pmu_start(cp, PERF_EF_RELOAD);
+ }
+ out:
+@@ -1071,6 +1078,8 @@ static void sparc_pmu_start(struct perf_
+ event->hw.state = 0;
+
+ sparc_pmu_enable_event(cpuc, &event->hw, idx);
++
++ perf_event_update_userpage(event);
+ }
+
+ static void sparc_pmu_stop(struct perf_event *event, int flags)
+@@ -1363,9 +1372,9 @@ static int sparc_pmu_add(struct perf_eve
+ cpuc->events[n0] = event->hw.event_base;
+ cpuc->current_idx[n0] = PIC_NO_INDEX;
+
+- event->hw.state = PERF_HES_UPTODATE;
++ event->hw.state = PERF_HES_UPTODATE | PERF_HES_STOPPED;
+ if (!(ef_flags & PERF_EF_START))
+- event->hw.state |= PERF_HES_STOPPED;
++ event->hw.state |= PERF_HES_ARCH;
+
+ /*
+ * If group events scheduling transaction was started,
--- /dev/null
+From foo@baz Sat Nov 10 11:35:27 PST 2018
+From: "David S. Miller" <davem@davemloft.net>
+Date: Fri, 12 Oct 2018 10:33:20 -0700
+Subject: sparc: Throttle perf events properly.
+
+From: "David S. Miller" <davem@davemloft.net>
+
+[ Upstream commit 455adb3174d2c8518cef1a61140c211f6ac224d2 ]
+
+Like x86 and arm, call perf_sample_event_took() in perf event
+NMI interrupt handler.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/sparc/kernel/perf_event.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/sparc/kernel/perf_event.c
++++ b/arch/sparc/kernel/perf_event.c
+@@ -23,6 +23,7 @@
+ #include <asm/cpudata.h>
+ #include <asm/uaccess.h>
+ #include <linux/atomic.h>
++#include <linux/sched/clock.h>
+ #include <asm/nmi.h>
+ #include <asm/pcr.h>
+ #include <asm/cacheflush.h>
+@@ -1586,6 +1587,8 @@ static int __kprobes perf_event_nmi_hand
+ struct perf_sample_data data;
+ struct cpu_hw_events *cpuc;
+ struct pt_regs *regs;
++ u64 finish_clock;
++ u64 start_clock;
+ int i;
+
+ if (!atomic_read(&active_events))
+@@ -1599,6 +1602,8 @@ static int __kprobes perf_event_nmi_hand
+ return NOTIFY_DONE;
+ }
+
++ start_clock = sched_clock();
++
+ regs = args->regs;
+
+ cpuc = this_cpu_ptr(&cpu_hw_events);
+@@ -1637,6 +1642,10 @@ static int __kprobes perf_event_nmi_hand
+ sparc_pmu_stop(event, 0);
+ }
+
++ finish_clock = sched_clock();
++
++ perf_sample_event_took(finish_clock - start_clock);
++
+ return NOTIFY_STOP;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 11:35:27 PST 2018
+From: Omar Sandoval <osandov@fb.com>
+Date: Thu, 11 Oct 2018 12:20:41 -0700
+Subject: swim: fix cleanup on setup error
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit 1448a2a5360ae06f25e2edc61ae070dff5c0beb4 ]
+
+If we fail to allocate the request queue for a disk, we still need to
+free that disk, not just the previous ones. Additionally, we need to
+cleanup the previous request queues.
+
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/swim.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -868,8 +868,17 @@ static int swim_floppy_init(struct swim_
+
+ exit_put_disks:
+ unregister_blkdev(FLOPPY_MAJOR, "fd");
+- while (drive--)
+- put_disk(swd->unit[drive].disk);
++ do {
++ struct gendisk *disk = swd->unit[drive].disk;
++
++ if (disk) {
++ if (disk->queue) {
++ blk_cleanup_queue(disk->queue);
++ disk->queue = NULL;
++ }
++ put_disk(disk);
++ }
++ } while (drive--);
+ return err;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 11:35:27 PST 2018
+From: Serhey Popovych <serhe.popovych@gmail.com>
+Date: Tue, 9 Oct 2018 21:21:01 +0300
+Subject: tun: Consistently configure generic netdev params via rtnetlink
+
+From: Serhey Popovych <serhe.popovych@gmail.com>
+
+[ Upstream commit df52eab23d703142c766ac00bdb8db19d71238d0 ]
+
+Configuring generic network device parameters on tun will fail in
+presence of IFLA_INFO_KIND attribute in IFLA_LINKINFO nested attribute
+since tun_validate() always return failure.
+
+This can be visualized with following ip-link(8) command sequences:
+
+ # ip link set dev tun0 group 100
+ # ip link set dev tun0 group 100 type tun
+ RTNETLINK answers: Invalid argument
+
+with contrast to dummy and veth drivers:
+
+ # ip link set dev dummy0 group 100
+ # ip link set dev dummy0 type dummy
+
+ # ip link set dev veth0 group 100
+ # ip link set dev veth0 group 100 type veth
+
+Fix by returning zero in tun_validate() when @data is NULL that is
+always in case since rtnl_link_ops->maxtype is zero in tun driver.
+
+Fixes: f019a7a594d9 ("tun: Implement ip link del tunXXX")
+Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/tun.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1423,6 +1423,8 @@ static void tun_setup(struct net_device
+ */
+ static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
+ {
++ if (!data)
++ return 0;
+ return -EINVAL;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Thu, 16 Aug 2018 09:39:41 +0200
+Subject: uio: ensure class is registered before devices
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit ae61cf5b9913027c6953a79ed3894da4f47061bd ]
+
+When both uio and the uio drivers are built in the kernel, it is possible
+for a driver to register devices before the uio class is registered.
+
+This may result in a NULL pointer dereference later on in
+get_device_parent() when accessing the class glue_dirs spinlock.
+
+The trace looks like that:
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000140
+[...]
+[<ffff0000089cc234>] _raw_spin_lock+0x14/0x48
+[<ffff0000084f56bc>] device_add+0x154/0x6a0
+[<ffff0000084f5e48>] device_create_groups_vargs+0x120/0x128
+[<ffff0000084f5edc>] device_create+0x54/0x60
+[<ffff0000086e72c0>] __uio_register_device+0x120/0x4a8
+[<ffff000008528b7c>] jaguar2_pci_probe+0x2d4/0x558
+[<ffff0000083fc18c>] local_pci_probe+0x3c/0xb8
+[<ffff0000083fd81c>] pci_device_probe+0x11c/0x180
+[<ffff0000084f88bc>] driver_probe_device+0x22c/0x2d8
+[<ffff0000084f8a24>] __driver_attach+0xbc/0xc0
+[<ffff0000084f69fc>] bus_for_each_dev+0x4c/0x98
+[<ffff0000084f81b8>] driver_attach+0x20/0x28
+[<ffff0000084f7d08>] bus_add_driver+0x1b8/0x228
+[<ffff0000084f93c0>] driver_register+0x60/0xf8
+[<ffff0000083fb918>] __pci_register_driver+0x40/0x48
+
+Return EPROBE_DEFER in that case so the driver can register the device
+later.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/uio/uio.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -249,6 +249,8 @@ static struct class uio_class = {
+ .dev_groups = uio_groups,
+ };
+
++bool uio_class_registered;
++
+ /*
+ * device functions
+ */
+@@ -771,6 +773,9 @@ static int init_uio_class(void)
+ printk(KERN_ERR "class_register failed for uio\n");
+ goto err_class_register;
+ }
++
++ uio_class_registered = true;
++
+ return 0;
+
+ err_class_register:
+@@ -781,6 +786,7 @@ exit:
+
+ static void release_uio_class(void)
+ {
++ uio_class_registered = false;
+ class_unregister(&uio_class);
+ uio_major_cleanup();
+ }
+@@ -800,6 +806,9 @@ int __uio_register_device(struct module
+ struct uio_device *idev;
+ int ret = 0;
+
++ if (!uio_class_registered)
++ return -EPROBE_DEFER;
++
+ if (!parent || !info || !info->name || !info->version)
+ return -EINVAL;
+
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: Loic Poulain <loic.poulain@linaro.org>
+Date: Tue, 4 Sep 2018 17:18:57 +0200
+Subject: usb: chipidea: Prevent unbalanced IRQ disable
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit 8b97d73c4d72a2abf58f8e49062a7ee1e5f1334e ]
+
+The ChipIdea IRQ is disabled before scheduling the otg work and
+re-enabled on otg work completion. However if the job is already
+scheduled we have to undo the effect of disable_irq int order to
+balance the IRQ disable-depth value.
+
+Fixes: be6b0c1bd0be ("usb: chipidea: using one inline function to cover queue work operations")
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/chipidea/otg.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/chipidea/otg.h
++++ b/drivers/usb/chipidea/otg.h
+@@ -20,7 +20,8 @@ void ci_handle_vbus_change(struct ci_hdr
+ static inline void ci_otg_queue_work(struct ci_hdrc *ci)
+ {
+ disable_irq_nosync(ci->irq);
+- queue_work(ci->wq, &ci->work);
++ if (queue_work(ci->wq, &ci->work) == false)
++ enable_irq(ci->irq);
+ }
+
+ #endif /* __DRIVERS_USB_CHIPIDEA_OTG_H */
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Sun, 16 Sep 2018 16:22:47 +0100
+Subject: x86: boot: Fix EFI stub alignment
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit 9c1442a9d039a1a3302fa93e9a11001c5f23b624 ]
+
+We currently align the end of the compressed image to a multiple of
+16. However, the PE-COFF header included in the EFI stub says that
+the file alignment is 32 bytes, and when adding an EFI signature to
+the file it must first be padded to this alignment.
+
+sbsigntool commands warn about this:
+
+ warning: file-aligned section .text extends beyond end of file
+ warning: checksum areas are greater than image size. Invalid section table?
+
+Worse, pesign -at least when creating a detached signature- uses the
+hash of the unpadded file, resulting in an invalid signature if
+padding is required.
+
+Avoid both these problems by increasing alignment to 32 bytes when
+CONFIG_EFI_STUB is enabled.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/boot/tools/build.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/x86/boot/tools/build.c
++++ b/arch/x86/boot/tools/build.c
+@@ -391,6 +391,13 @@ int main(int argc, char ** argv)
+ die("Unable to mmap '%s': %m", argv[2]);
+ /* Number of 16-byte paragraphs, including space for a 4-byte CRC */
+ sys_size = (sz + 15 + 4) / 16;
++#ifdef CONFIG_EFI_STUB
++ /*
++ * COFF requires minimum 32-byte alignment of sections, and
++ * adding a signature is problematic without that alignment.
++ */
++ sys_size = (sys_size + 1) & ~1;
++#endif
+
+ /* Patch the setup code with the appropriate size parameters */
+ buf[0x1f1] = setup_sectors-1;
--- /dev/null
+From foo@baz Sat Nov 10 11:35:28 PST 2018
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Thu, 4 Oct 2018 18:08:08 +0200
+Subject: x86/olpc: Indicate that legacy PC XO-1 platform should not register RTC
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit d92116b800fb79a72ad26121f5011f6aa3ad94c2 ]
+
+On OLPC XO-1, the RTC is discovered via device tree from the arch
+initcall. Don't let the PC platform register another one from its device
+initcall, it's not going to work:
+
+ sysfs: cannot create duplicate filename '/devices/platform/rtc_cmos'
+ CPU: 0 PID: 1 Comm: swapper Not tainted 4.19.0-rc6 #12
+ Hardware name: OLPC XO/XO, BIOS OLPC Ver 1.00.01 06/11/2014
+ Call Trace:
+ dump_stack+0x16/0x18
+ sysfs_warn_dup+0x46/0x58
+ sysfs_create_dir_ns+0x76/0x9b
+ kobject_add_internal+0xed/0x209
+ ? __schedule+0x3fa/0x447
+ kobject_add+0x5b/0x66
+ device_add+0x298/0x535
+ ? insert_resource_conflict+0x2a/0x3e
+ platform_device_add+0x14d/0x192
+ ? io_delay_init+0x19/0x19
+ platform_device_register+0x1c/0x1f
+ add_rtc_cmos+0x16/0x31
+ do_one_initcall+0x78/0x14a
+ ? do_early_param+0x75/0x75
+ kernel_init_freeable+0x152/0x1e0
+ ? rest_init+0xa2/0xa2
+ kernel_init+0x8/0xd5
+ ret_from_fork+0x2e/0x38
+ kobject_add_internal failed for rtc_cmos with -EEXIST, don't try to
+ register things with the same name in the same directory.
+ platform rtc_cmos: registered platform RTC device (no PNP device found)
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+CC: "H. Peter Anvin" <hpa@zytor.com>
+CC: Ingo Molnar <mingo@redhat.com>
+CC: x86-ml <x86@kernel.org>
+Link: http://lkml.kernel.org/r/20181004160808.307738-1-lkundrak@v3.sk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/platform/olpc/olpc-xo1-rtc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/platform/olpc/olpc-xo1-rtc.c
++++ b/arch/x86/platform/olpc/olpc-xo1-rtc.c
+@@ -16,6 +16,7 @@
+
+ #include <asm/msr.h>
+ #include <asm/olpc.h>
++#include <asm/x86_init.h>
+
+ static void rtc_wake_on(struct device *dev)
+ {
+@@ -75,6 +76,8 @@ static int __init xo1_rtc_init(void)
+ if (r)
+ return r;
+
++ x86_platform.legacy.rtc = 0;
++
+ device_init_wakeup(&xo1_rtc_device.dev, 1);
+ return 0;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
