--- /dev/null
+From 313741611fb2877bc9777e4526318b49c8f9b138 Mon Sep 17 00:00:00 2001
+From: Marc Dionne <marc.dionne@auristor.com>
+Date: Tue, 30 Jul 2019 14:38:51 +0100
+Subject: afs: Fix loop index mixup in afs_deliver_vl_get_entry_by_name_u()
+
+[ Upstream commit 4a46fdba449a5cd890271df5a9e23927d519ed00 ]
+
+afs_deliver_vl_get_entry_by_name_u() scans through the vl entry
+received from the volume location server and builds a return list
+containing the sites that are currently valid. When assigning
+values for the return list, the index into the vl entry (i) is used
+rather than the one for the new list (entry->nr_server). If all
+sites are usable, this works out fine as the indices will match.
+If some sites are not valid, for example if AFS_VLSF_DONTUSE is
+set, fs_mask and the uuid will be set for the wrong return site.
+
+Fix this by using entry->nr_server as the index into the arrays
+being filled in rather than i.
+
+This can lead to EDESTADDRREQ errors if none of the returned sites
+have a valid fs_mask.
+
+Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation")
+Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/vlclient.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c
+index c3b740813fc71..c7dd47eaff29d 100644
+--- a/fs/afs/vlclient.c
++++ b/fs/afs/vlclient.c
+@@ -60,23 +60,24 @@ static int afs_deliver_vl_get_entry_by_name_u(struct afs_call *call)
+ struct afs_uuid__xdr *xdr;
+ struct afs_uuid *uuid;
+ int j;
++ int n = entry->nr_servers;
+
+ tmp = ntohl(uvldb->serverFlags[i]);
+ if (tmp & AFS_VLSF_DONTUSE ||
+ (new_only && !(tmp & AFS_VLSF_NEWREPSITE)))
+ continue;
+ if (tmp & AFS_VLSF_RWVOL) {
+- entry->fs_mask[i] |= AFS_VOL_VTM_RW;
++ entry->fs_mask[n] |= AFS_VOL_VTM_RW;
+ if (vlflags & AFS_VLF_BACKEXISTS)
+- entry->fs_mask[i] |= AFS_VOL_VTM_BAK;
++ entry->fs_mask[n] |= AFS_VOL_VTM_BAK;
+ }
+ if (tmp & AFS_VLSF_ROVOL)
+- entry->fs_mask[i] |= AFS_VOL_VTM_RO;
+- if (!entry->fs_mask[i])
++ entry->fs_mask[n] |= AFS_VOL_VTM_RO;
++ if (!entry->fs_mask[n])
+ continue;
+
+ xdr = &uvldb->serverNumber[i];
+- uuid = (struct afs_uuid *)&entry->fs_server[i];
++ uuid = (struct afs_uuid *)&entry->fs_server[n];
+ uuid->time_low = xdr->time_low;
+ uuid->time_mid = htons(ntohl(xdr->time_mid));
+ uuid->time_hi_and_version = htons(ntohl(xdr->time_hi_and_version));
+--
+2.20.1
+
--- /dev/null
+From 32601551eabd4580b9c0a50cd337e42720f0f2f9 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Tue, 30 Jul 2019 14:38:51 +0100
+Subject: afs: Fix the CB.ProbeUuid service handler to reply correctly
+
+[ Upstream commit 2067b2b3f4846402a040286135f98f46f8919939 ]
+
+Fix the service handler function for the CB.ProbeUuid RPC call so that it
+replies in the correct manner - that is an empty reply for success and an
+abort of 1 for failure.
+
+Putting 0 or 1 in an integer in the body of the reply should result in the
+fileserver throwing an RX_PROTOCOL_ERROR abort and discarding its record of
+the client; older servers, however, don't necessarily check that all the
+data got consumed, and so might incorrectly think that they got a positive
+response and associate the client with the wrong host record.
+
+If the client is incorrectly associated, this will result in callbacks
+intended for a different client being delivered to this one and then, when
+the other client connects and responds positively, all of the callback
+promises meant for the client that issued the improper response will be
+lost and it won't receive any further change notifications.
+
+Fixes: 9396d496d745 ("afs: support the CB.ProbeUuid RPC op")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/cmservice.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
+index 9e51d6fe7e8f9..40c6860d4c632 100644
+--- a/fs/afs/cmservice.c
++++ b/fs/afs/cmservice.c
+@@ -423,18 +423,14 @@ static void SRXAFSCB_ProbeUuid(struct work_struct *work)
+ struct afs_call *call = container_of(work, struct afs_call, work);
+ struct afs_uuid *r = call->request;
+
+- struct {
+- __be32 match;
+- } reply;
+-
+ _enter("");
+
+ if (memcmp(r, &call->net->uuid, sizeof(call->net->uuid)) == 0)
+- reply.match = htonl(0);
++ afs_send_empty_reply(call);
+ else
+- reply.match = htonl(1);
++ rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
++ 1, 1, "K-1");
+
+- afs_send_simple_reply(call, &reply, sizeof(reply));
+ afs_put_call(call);
+ _leave("");
+ }
+--
+2.20.1
+
--- /dev/null
+From fd818b0aba8fa1211ee6dd88353de4adbf294968 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Tue, 30 Jul 2019 14:38:51 +0100
+Subject: afs: Only update d_fsdata if different in afs_d_revalidate()
+
+[ Upstream commit 5dc84855b0fc7e1db182b55c5564fd539d6eff92 ]
+
+In the in-kernel afs filesystem, d_fsdata is set with the data version of
+the parent directory. afs_d_revalidate() will update this to the current
+directory version, but it shouldn't do this if it the value it read from
+d_fsdata is the same as no lock is held and cmpxchg() is not used.
+
+Fix the code to only change the value if it is different from the current
+directory version.
+
+Fixes: 260a980317da ("[AFS]: Add "directory write" support.")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dir.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 855bf2b79fed4..54e7f6f1405e2 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -937,7 +937,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+ dir_version = (long)dir->status.data_version;
+ de_version = (long)dentry->d_fsdata;
+ if (de_version == dir_version)
+- goto out_valid;
++ goto out_valid_noupdate;
+
+ dir_version = (long)dir->invalid_before;
+ if (de_version - dir_version >= 0)
+@@ -1001,6 +1001,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+
+ out_valid:
+ dentry->d_fsdata = (void *)dir_version;
++out_valid_noupdate:
+ dput(parent);
+ key_put(key);
+ _leave(" = 1 [valid]");
+--
+2.20.1
+
--- /dev/null
+From 73974176562a0085b38c78fc6bc1817ff91691dc Mon Sep 17 00:00:00 2001
+From: Will Deacon <will@kernel.org>
+Date: Mon, 12 Aug 2019 16:02:25 +0100
+Subject: arm64: cpufeature: Don't treat granule sizes as strict
+
+[ Upstream commit 5717fe5ab38f9ccb32718bcb03bea68409c9cce4 ]
+
+If a CPU doesn't support the page size for which the kernel is
+configured, then we will complain and refuse to bring it online. For
+secondary CPUs (and the boot CPU on a system booting with EFI), we will
+also print an error identifying the mismatch.
+
+Consequently, the only time that the cpufeature code can detect a
+granule size mismatch is for a granule other than the one that is
+currently being used. Although we would rather such systems didn't
+exist, we've unfortunately lost that battle and Kevin reports that
+on his amlogic S922X (odroid-n2 board) we end up warning and taining
+with defconfig because 16k pages are not supported by all of the CPUs.
+
+In such a situation, we don't actually care about the feature mismatch,
+particularly now that KVM only exposes the sanitised view of the CPU
+registers (commit 93390c0a1b20 - "arm64: KVM: Hide unsupported AArch64
+CPU features from guests"). Treat the granule fields as non-strict and
+let Kevin run without a tainted kernel.
+
+Cc: Marc Zyngier <maz@kernel.org>
+Reported-by: Kevin Hilman <khilman@baylibre.com>
+Tested-by: Kevin Hilman <khilman@baylibre.com>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Acked-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+[catalin.marinas@arm.com: changelog updated with KVM sanitised regs commit]
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/cpufeature.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index bce06083685dc..94babc3d0ec2c 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -165,9 +165,17 @@ static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = {
+ };
+
+ static const struct arm64_ftr_bits ftr_id_aa64mmfr0[] = {
+- S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, 4, ID_AA64MMFR0_TGRAN4_NI),
+- S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, 4, ID_AA64MMFR0_TGRAN64_NI),
+- ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN16_SHIFT, 4, ID_AA64MMFR0_TGRAN16_NI),
++ /*
++ * We already refuse to boot CPUs that don't support our configured
++ * page size, so we can only detect mismatches for a page size other
++ * than the one we're currently using. Unfortunately, SoCs like this
++ * exist in the wild so, even though we don't like it, we'll have to go
++ * along with it and treat them as non-strict.
++ */
++ S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, 4, ID_AA64MMFR0_TGRAN4_NI),
++ S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, 4, ID_AA64MMFR0_TGRAN64_NI),
++ ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN16_SHIFT, 4, ID_AA64MMFR0_TGRAN16_NI),
++
+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_BIGENDEL0_SHIFT, 4, 0),
+ /* Linux shouldn't care about secure memory */
+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_SNSMEM_SHIFT, 4, 0),
+--
+2.20.1
+
--- /dev/null
+From c04ae16eaa2086639831b54826287fd8891c1b29 Mon Sep 17 00:00:00 2001
+From: zhengbin <zhengbin13@huawei.com>
+Date: Mon, 8 Jul 2019 20:42:18 +0800
+Subject: auxdisplay: panel: need to delete scan_timer when misc_register fails
+ in panel_attach
+
+[ Upstream commit b33d567560c1aadf3033290d74d4fd67af47aa61 ]
+
+In panel_attach, if misc_register fails, we need to delete scan_timer,
+which was setup in keypad_init->init_scan_timer.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: zhengbin <zhengbin13@huawei.com>
+Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/auxdisplay/panel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
+index 3b25a643058c9..0b8e2a7d6e934 100644
+--- a/drivers/auxdisplay/panel.c
++++ b/drivers/auxdisplay/panel.c
+@@ -1618,6 +1618,8 @@ static void panel_attach(struct parport *port)
+ return;
+
+ err_lcd_unreg:
++ if (scan_timer.function)
++ del_timer_sync(&scan_timer);
+ if (lcd.enabled)
+ charlcd_unregister(lcd.charlcd);
+ err_unreg_device:
+--
+2.20.1
+
--- /dev/null
+From 90dae3c6ee479efc3d6af0da31e0ad7f64983ef0 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 12 Jul 2019 11:13:30 +0200
+Subject: dmaengine: ste_dma40: fix unneeded variable warning
+
+[ Upstream commit 5d6fb560729a5d5554e23db8d00eb57cd0021083 ]
+
+clang-9 points out that there are two variables that depending on the
+configuration may only be used in an ARRAY_SIZE() expression but not
+referenced:
+
+drivers/dma/ste_dma40.c:145:12: error: variable 'd40_backup_regs' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
+static u32 d40_backup_regs[] = {
+ ^
+drivers/dma/ste_dma40.c:214:12: error: variable 'd40_backup_regs_chan' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
+static u32 d40_backup_regs_chan[] = {
+
+Mark these __maybe_unused to shut up the warning.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20190712091357.744515-1-arnd@arndb.de
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ste_dma40.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
+index f4edfc56f34ef..3d55405c49cac 100644
+--- a/drivers/dma/ste_dma40.c
++++ b/drivers/dma/ste_dma40.c
+@@ -142,7 +142,7 @@ enum d40_events {
+ * when the DMA hw is powered off.
+ * TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
+ */
+-static u32 d40_backup_regs[] = {
++static __maybe_unused u32 d40_backup_regs[] = {
+ D40_DREG_LCPA,
+ D40_DREG_LCLA,
+ D40_DREG_PRMSE,
+@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = {
+
+ #define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b)
+
+-static u32 d40_backup_regs_chan[] = {
++static __maybe_unused u32 d40_backup_regs_chan[] = {
+ D40_CHAN_REG_SSCFG,
+ D40_CHAN_REG_SSELT,
+ D40_CHAN_REG_SSPTR,
+--
+2.20.1
+
--- /dev/null
+From 584cc8700a538bbb6deb813077fc76052aa8d1ce Mon Sep 17 00:00:00 2001
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Mon, 29 Jul 2019 10:08:49 +0800
+Subject: dmaengine: stm32-mdma: Fix a possible null-pointer dereference in
+ stm32_mdma_irq_handler()
+
+[ Upstream commit 39c71a5b8212f4b502d9a630c6706ac723abd422 ]
+
+In stm32_mdma_irq_handler(), chan is checked on line 1368.
+When chan is NULL, it is still used on line 1369:
+ dev_err(chan2dev(chan), "MDMA channel not initialized\n");
+
+Thus, a possible null-pointer dereference may occur.
+
+To fix this bug, "dev_dbg(mdma2dev(dmadev), ...)" is used instead.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver")
+Link: https://lore.kernel.org/r/20190729020849.17971-1-baijiaju1990@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32-mdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
+index 06dd1725375e5..8c3c3e5b812a8 100644
+--- a/drivers/dma/stm32-mdma.c
++++ b/drivers/dma/stm32-mdma.c
+@@ -1376,7 +1376,7 @@ static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid)
+
+ chan = &dmadev->chan[id];
+ if (!chan) {
+- dev_err(chan2dev(chan), "MDMA channel not initialized\n");
++ dev_dbg(mdma2dev(dmadev), "MDMA channel not initialized\n");
+ goto exit;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 193d1f943595c85c7ea7898409e786cd21209cab Mon Sep 17 00:00:00 2001
+From: "Y.C. Chen" <yc_chen@aspeedtech.com>
+Date: Wed, 11 Apr 2018 09:27:39 +0800
+Subject: drm/ast: Fixed reboot test may cause system hanged
+
+[ Upstream commit 05b439711f6ff8700e8660f97a1179650778b9cb ]
+
+There is another thread still access standard VGA I/O while loading drm driver.
+Disable standard VGA I/O decode to avoid this issue.
+
+Signed-off-by: Y.C. Chen <yc_chen@aspeedtech.com>
+Reviewed-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1523410059-18415-1-git-send-email-yc_chen@aspeedtech.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ast/ast_main.c | 5 ++++-
+ drivers/gpu/drm/ast/ast_mode.c | 2 +-
+ drivers/gpu/drm/ast/ast_post.c | 2 +-
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
+index 373700c05a00f..224fa1ef87ff9 100644
+--- a/drivers/gpu/drm/ast/ast_main.c
++++ b/drivers/gpu/drm/ast/ast_main.c
+@@ -131,8 +131,8 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post)
+
+
+ /* Enable extended register access */
+- ast_enable_mmio(dev);
+ ast_open_key(ast);
++ ast_enable_mmio(dev);
+
+ /* Find out whether P2A works or whether to use device-tree */
+ ast_detect_config_mode(dev, &scu_rev);
+@@ -576,6 +576,9 @@ void ast_driver_unload(struct drm_device *dev)
+ {
+ struct ast_private *ast = dev->dev_private;
+
++ /* enable standard VGA decode */
++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x04);
++
+ ast_release_firmware(dev);
+ kfree(ast->dp501_fw_addr);
+ ast_mode_fini(dev);
+diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
+index 8bb355d5d43d8..9d92d2d2fcfc7 100644
+--- a/drivers/gpu/drm/ast/ast_mode.c
++++ b/drivers/gpu/drm/ast/ast_mode.c
+@@ -600,7 +600,7 @@ static int ast_crtc_mode_set(struct drm_crtc *crtc,
+ return -EINVAL;
+ ast_open_key(ast);
+
+- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04);
++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06);
+
+ ast_set_std_reg(crtc, adjusted_mode, &vbios_mode);
+ ast_set_crtc_reg(crtc, adjusted_mode, &vbios_mode);
+diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
+index f7d421359d564..c1d1ac51d1c20 100644
+--- a/drivers/gpu/drm/ast/ast_post.c
++++ b/drivers/gpu/drm/ast/ast_post.c
+@@ -46,7 +46,7 @@ void ast_enable_mmio(struct drm_device *dev)
+ {
+ struct ast_private *ast = dev->dev_private;
+
+- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04);
++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06);
+ }
+
+
+--
+2.20.1
+
--- /dev/null
+From 4b766a79d3a24d8b94e33511643ac43dfe2fd475 Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Mon, 10 Jun 2019 16:57:38 +0300
+Subject: drm/bridge: tfp410: fix memleak in get_modes()
+
+[ Upstream commit c08f99c39083ab55a9c93b3e93cef48711294dad ]
+
+We don't free the edid blob allocated by the call to drm_get_edid(),
+causing a memleak. Fix this by calling kfree(edid) at the end of the
+get_modes().
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190610135739.6077-1-tomi.valkeinen@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-tfp410.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/ti-tfp410.c b/drivers/gpu/drm/bridge/ti-tfp410.c
+index c3e32138c6bb0..9dc109df0808c 100644
+--- a/drivers/gpu/drm/bridge/ti-tfp410.c
++++ b/drivers/gpu/drm/bridge/ti-tfp410.c
+@@ -64,7 +64,12 @@ static int tfp410_get_modes(struct drm_connector *connector)
+
+ drm_connector_update_edid_property(connector, edid);
+
+- return drm_add_edid_modes(connector, edid);
++ ret = drm_add_edid_modes(connector, edid);
++
++ kfree(edid);
++
++ return ret;
++
+ fallback:
+ /* No EDID, fallback on the XGA standard modes */
+ ret = drm_add_modes_noedid(connector, 1920, 1200);
+--
+2.20.1
+
--- /dev/null
+From 0ed0cc9921be280b94c58bd77c15a21c1e23fa8e Mon Sep 17 00:00:00 2001
+From: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Date: Mon, 12 Nov 2018 12:39:31 +0000
+Subject: drm/i915: fix broadwell EU computation
+
+[ Upstream commit 63ac3328f0d1d37f286e397b14d9596ed09d7ca5 ]
+
+subslice_mask is an array indexed by slice, not subslice.
+
+Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Fixes: 8cc7669355136f ("drm/i915: store all subslice masks")
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108712
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181112123931.2815-1-lionel.g.landwerlin@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/intel_device_info.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_device_info.c b/drivers/gpu/drm/i915/intel_device_info.c
+index 0ef0c6448d53a..01fa98299bae6 100644
+--- a/drivers/gpu/drm/i915/intel_device_info.c
++++ b/drivers/gpu/drm/i915/intel_device_info.c
+@@ -474,7 +474,7 @@ static void broadwell_sseu_info_init(struct drm_i915_private *dev_priv)
+ u8 eu_disabled_mask;
+ u32 n_disabled;
+
+- if (!(sseu->subslice_mask[ss] & BIT(ss)))
++ if (!(sseu->subslice_mask[s] & BIT(ss)))
+ /* skip disabled subslice */
+ continue;
+
+--
+2.20.1
+
--- /dev/null
+From d7b40ae7640263fd0c28433e112325d262b20c27 Mon Sep 17 00:00:00 2001
+From: Jyri Sarha <jsarha@ti.com>
+Date: Wed, 12 Dec 2018 19:26:32 +0200
+Subject: drm/tilcdc: Register cpufreq notifier after we have initialized crtc
+
+[ Upstream commit 432973fd3a20102840d5f7e61af9f1a03c217a4c ]
+
+Register cpufreq notifier after we have initialized the crtc and
+unregister it before we remove the ctrc. Receiving a cpufreq notify
+without crtc causes a crash.
+
+Reported-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Jyri Sarha <jsarha@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tilcdc/tilcdc_drv.c | 34 ++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+index 0fb300d41a09c..e1868776da252 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+@@ -184,6 +184,12 @@ static void tilcdc_fini(struct drm_device *dev)
+ {
+ struct tilcdc_drm_private *priv = dev->dev_private;
+
++#ifdef CONFIG_CPU_FREQ
++ if (priv->freq_transition.notifier_call)
++ cpufreq_unregister_notifier(&priv->freq_transition,
++ CPUFREQ_TRANSITION_NOTIFIER);
++#endif
++
+ if (priv->crtc)
+ tilcdc_crtc_shutdown(priv->crtc);
+
+@@ -198,12 +204,6 @@ static void tilcdc_fini(struct drm_device *dev)
+ drm_mode_config_cleanup(dev);
+ tilcdc_remove_external_device(dev);
+
+-#ifdef CONFIG_CPU_FREQ
+- if (priv->freq_transition.notifier_call)
+- cpufreq_unregister_notifier(&priv->freq_transition,
+- CPUFREQ_TRANSITION_NOTIFIER);
+-#endif
+-
+ if (priv->clk)
+ clk_put(priv->clk);
+
+@@ -274,17 +274,6 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev)
+ goto init_failed;
+ }
+
+-#ifdef CONFIG_CPU_FREQ
+- priv->freq_transition.notifier_call = cpufreq_transition;
+- ret = cpufreq_register_notifier(&priv->freq_transition,
+- CPUFREQ_TRANSITION_NOTIFIER);
+- if (ret) {
+- dev_err(dev, "failed to register cpufreq notifier\n");
+- priv->freq_transition.notifier_call = NULL;
+- goto init_failed;
+- }
+-#endif
+-
+ if (of_property_read_u32(node, "max-bandwidth", &priv->max_bandwidth))
+ priv->max_bandwidth = TILCDC_DEFAULT_MAX_BANDWIDTH;
+
+@@ -361,6 +350,17 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev)
+ }
+ modeset_init(ddev);
+
++#ifdef CONFIG_CPU_FREQ
++ priv->freq_transition.notifier_call = cpufreq_transition;
++ ret = cpufreq_register_notifier(&priv->freq_transition,
++ CPUFREQ_TRANSITION_NOTIFIER);
++ if (ret) {
++ dev_err(dev, "failed to register cpufreq notifier\n");
++ priv->freq_transition.notifier_call = NULL;
++ goto init_failed;
++ }
++#endif
++
+ if (priv->is_componentized) {
+ ret = component_bind_all(dev, ddev);
+ if (ret < 0)
+--
+2.20.1
+
--- /dev/null
+From d4d7e2d9631ed3c579ca4813437a2fec4ae61a13 Mon Sep 17 00:00:00 2001
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Tue, 30 Jul 2019 14:38:51 +0100
+Subject: fs: afs: Fix a possible null-pointer dereference in afs_put_read()
+
+[ Upstream commit a6eed4ab5dd4bfb696c1a3f49742b8d1846a66a0 ]
+
+In afs_read_dir(), there is an if statement on line 255 to check whether
+req->pages is NULL:
+ if (!req->pages)
+ goto error;
+
+If req->pages is NULL, afs_put_read() on line 337 is executed.
+In afs_put_read(), req->pages[i] is used on line 195.
+Thus, a possible null-pointer dereference may occur in this case.
+
+To fix this possible bug, an if statement is added in afs_put_read() to
+check req->pages.
+
+This bug is found by a static analysis tool STCheck written by us.
+
+Fixes: f3ddee8dc4e2 ("afs: Fix directory handling")
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/file.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/fs/afs/file.c b/fs/afs/file.c
+index 7d4f26198573d..843d3b970b845 100644
+--- a/fs/afs/file.c
++++ b/fs/afs/file.c
+@@ -193,11 +193,13 @@ void afs_put_read(struct afs_read *req)
+ int i;
+
+ if (refcount_dec_and_test(&req->usage)) {
+- for (i = 0; i < req->nr_pages; i++)
+- if (req->pages[i])
+- put_page(req->pages[i]);
+- if (req->pages != req->array)
+- kfree(req->pages);
++ if (req->pages) {
++ for (i = 0; i < req->nr_pages; i++)
++ if (req->pages[i])
++ put_page(req->pages[i]);
++ if (req->pages != req->array)
++ kfree(req->pages);
++ }
+ kfree(req);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From e126f799564f9ecf38710d17ba0ffc2372b7b471 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Thu, 8 Aug 2019 21:54:17 +0200
+Subject: i2c: emev2: avoid race when unregistering slave client
+
+[ Upstream commit d7437fc0d8291181debe032671a289b6bd93f46f ]
+
+After we disabled interrupts, there might still be an active one
+running. Sync before clearing the pointer to the slave device.
+
+Fixes: c31d0a00021d ("i2c: emev2: add slave support")
+Reported-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-emev2.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c
+index 35b302d983e0d..959d4912ec0d5 100644
+--- a/drivers/i2c/busses/i2c-emev2.c
++++ b/drivers/i2c/busses/i2c-emev2.c
+@@ -69,6 +69,7 @@ struct em_i2c_device {
+ struct completion msg_done;
+ struct clk *sclk;
+ struct i2c_client *slave;
++ int irq;
+ };
+
+ static inline void em_clear_set_bit(struct em_i2c_device *priv, u8 clear, u8 set, u8 reg)
+@@ -339,6 +340,12 @@ static int em_i2c_unreg_slave(struct i2c_client *slave)
+
+ writeb(0, priv->base + I2C_OFS_SVA0);
+
++ /*
++ * Wait for interrupt to finish. New slave irqs cannot happen because we
++ * cleared the slave address and, thus, only extension codes will be
++ * detected which do not use the slave ptr.
++ */
++ synchronize_irq(priv->irq);
+ priv->slave = NULL;
+
+ return 0;
+@@ -355,7 +362,7 @@ static int em_i2c_probe(struct platform_device *pdev)
+ {
+ struct em_i2c_device *priv;
+ struct resource *r;
+- int irq, ret;
++ int ret;
+
+ priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+@@ -390,8 +397,8 @@ static int em_i2c_probe(struct platform_device *pdev)
+
+ em_i2c_reset(&priv->adap);
+
+- irq = platform_get_irq(pdev, 0);
+- ret = devm_request_irq(&pdev->dev, irq, em_i2c_irq_handler, 0,
++ priv->irq = platform_get_irq(pdev, 0);
++ ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0,
+ "em_i2c", priv);
+ if (ret)
+ goto err_clk;
+@@ -401,7 +408,8 @@ static int em_i2c_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_clk;
+
+- dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, irq);
++ dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr,
++ priv->irq);
+
+ return 0;
+
+--
+2.20.1
+
--- /dev/null
+From 630c9e8e4dc24ef2d36f1f7c9720df8112fffd93 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Thu, 8 Aug 2019 21:39:10 +0200
+Subject: i2c: rcar: avoid race when unregistering slave client
+
+[ Upstream commit 7b814d852af6944657c2961039f404c4490771c0 ]
+
+After we disabled interrupts, there might still be an active one
+running. Sync before clearing the pointer to the slave device.
+
+Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
+Reported-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 254e6219e5389..2c29f901d3090 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -139,6 +139,7 @@ struct rcar_i2c_priv {
+ enum dma_data_direction dma_direction;
+
+ struct reset_control *rstc;
++ int irq;
+ };
+
+ #define rcar_i2c_priv_to_dev(p) ((p)->adap.dev.parent)
+@@ -859,9 +860,11 @@ static int rcar_unreg_slave(struct i2c_client *slave)
+
+ WARN_ON(!priv->slave);
+
++ /* disable irqs and ensure none is running before clearing ptr */
+ rcar_i2c_write(priv, ICSIER, 0);
+ rcar_i2c_write(priv, ICSCR, 0);
+
++ synchronize_irq(priv->irq);
+ priv->slave = NULL;
+
+ pm_runtime_put(rcar_i2c_priv_to_dev(priv));
+@@ -916,7 +919,7 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ struct i2c_adapter *adap;
+ struct device *dev = &pdev->dev;
+ struct i2c_timings i2c_t;
+- int irq, ret;
++ int ret;
+
+ priv = devm_kzalloc(dev, sizeof(struct rcar_i2c_priv), GFP_KERNEL);
+ if (!priv)
+@@ -979,10 +982,10 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ pm_runtime_put(dev);
+
+
+- irq = platform_get_irq(pdev, 0);
+- ret = devm_request_irq(dev, irq, rcar_i2c_irq, 0, dev_name(dev), priv);
++ priv->irq = platform_get_irq(pdev, 0);
++ ret = devm_request_irq(dev, priv->irq, rcar_i2c_irq, 0, dev_name(dev), priv);
+ if (ret < 0) {
+- dev_err(dev, "cannot get irq %d\n", irq);
++ dev_err(dev, "cannot get irq %d\n", priv->irq);
+ goto out_pm_disable;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From da09aac25bf6ae4c405dbe16e816d34276049081 Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Mon, 29 Jul 2019 17:46:00 +0100
+Subject: iommu/dma: Handle SG length overflow better
+
+[ Upstream commit ab2cbeb0ed301a9f0460078e91b09f39958212ef ]
+
+Since scatterlist dimensions are all unsigned ints, in the relatively
+rare cases where a device's max_segment_size is set to UINT_MAX, then
+the "cur_len + s_length <= max_len" check in __finalise_sg() will always
+return true. As a result, the corner case of such a device mapping an
+excessively large scatterlist which is mergeable to or beyond a total
+length of 4GB can lead to overflow and a bogus truncated dma_length in
+the resulting segment.
+
+As we already assume that any single segment must be no longer than
+max_len to begin with, this can easily be addressed by reshuffling the
+comparison.
+
+Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
+Reported-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Tested-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/dma-iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
+index 511ff9a1d6d94..f9dbb064f9571 100644
+--- a/drivers/iommu/dma-iommu.c
++++ b/drivers/iommu/dma-iommu.c
+@@ -675,7 +675,7 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents,
+ * - and wouldn't make the resulting output segment too long
+ */
+ if (cur_len && !s_iova_off && (dma_addr & seg_mask) &&
+- (cur_len + s_length <= max_len)) {
++ (max_len - cur_len >= s_length)) {
+ /* ...then concatenate it with the previous one */
+ cur_len += s_length;
+ } else {
+--
+2.20.1
+
--- /dev/null
+From f5144fac683ca92285c21b59c5eaddd101c57ba5 Mon Sep 17 00:00:00 2001
+From: Sagi Grimberg <sagi@grimberg.me>
+Date: Wed, 31 Jul 2019 11:00:26 -0700
+Subject: nvme: fix a possible deadlock when passthru commands sent to a
+ multipath device
+
+[ Upstream commit b9156daeb1601d69007b7e50efcf89d69d72ec1d ]
+
+When the user issues a command with side effects, we will end up freezing
+the namespace request queue when updating disk info (and the same for
+the corresponding mpath disk node).
+
+However, we are not freezing the mpath node request queue,
+which means that mpath I/O can still come in and block on blk_queue_enter
+(called from nvme_ns_head_make_request -> direct_make_request).
+
+This is a deadlock, because blk_queue_enter will block until the inner
+namespace request queue is unfroze, but that process is blocked because
+the namespace revalidation is trying to update the mpath disk info
+and freeze its request queue (which will never complete because
+of the I/O that is blocked on blk_queue_enter).
+
+Fix this by freezing all the subsystem nsheads request queues before
+executing the passthru command. Given that these commands are infrequent
+we should not worry about this temporary I/O freeze to keep things sane.
+
+Here is the matching hang traces:
+--
+[ 374.465002] INFO: task systemd-udevd:17994 blocked for more than 122 seconds.
+[ 374.472975] Not tainted 5.2.0-rc3-mpdebug+ #42
+[ 374.478522] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 374.487274] systemd-udevd D 0 17994 1 0x00000000
+[ 374.493407] Call Trace:
+[ 374.496145] __schedule+0x2ef/0x620
+[ 374.500047] schedule+0x38/0xa0
+[ 374.503569] blk_queue_enter+0x139/0x220
+[ 374.507959] ? remove_wait_queue+0x60/0x60
+[ 374.512540] direct_make_request+0x60/0x130
+[ 374.517219] nvme_ns_head_make_request+0x11d/0x420 [nvme_core]
+[ 374.523740] ? generic_make_request_checks+0x307/0x6f0
+[ 374.529484] generic_make_request+0x10d/0x2e0
+[ 374.534356] submit_bio+0x75/0x140
+[ 374.538163] ? guard_bio_eod+0x32/0xe0
+[ 374.542361] submit_bh_wbc+0x171/0x1b0
+[ 374.546553] block_read_full_page+0x1ed/0x330
+[ 374.551426] ? check_disk_change+0x70/0x70
+[ 374.556008] ? scan_shadow_nodes+0x30/0x30
+[ 374.560588] blkdev_readpage+0x18/0x20
+[ 374.564783] do_read_cache_page+0x301/0x860
+[ 374.569463] ? blkdev_writepages+0x10/0x10
+[ 374.574037] ? prep_new_page+0x88/0x130
+[ 374.578329] ? get_page_from_freelist+0xa2f/0x1280
+[ 374.583688] ? __alloc_pages_nodemask+0x179/0x320
+[ 374.588947] read_cache_page+0x12/0x20
+[ 374.593142] read_dev_sector+0x2d/0xd0
+[ 374.597337] read_lba+0x104/0x1f0
+[ 374.601046] find_valid_gpt+0xfa/0x720
+[ 374.605243] ? string_nocheck+0x58/0x70
+[ 374.609534] ? find_valid_gpt+0x720/0x720
+[ 374.614016] efi_partition+0x89/0x430
+[ 374.618113] ? string+0x48/0x60
+[ 374.621632] ? snprintf+0x49/0x70
+[ 374.625339] ? find_valid_gpt+0x720/0x720
+[ 374.629828] check_partition+0x116/0x210
+[ 374.634214] rescan_partitions+0xb6/0x360
+[ 374.638699] __blkdev_reread_part+0x64/0x70
+[ 374.643377] blkdev_reread_part+0x23/0x40
+[ 374.647860] blkdev_ioctl+0x48c/0x990
+[ 374.651956] block_ioctl+0x41/0x50
+[ 374.655766] do_vfs_ioctl+0xa7/0x600
+[ 374.659766] ? locks_lock_inode_wait+0xb1/0x150
+[ 374.664832] ksys_ioctl+0x67/0x90
+[ 374.668539] __x64_sys_ioctl+0x1a/0x20
+[ 374.672732] do_syscall_64+0x5a/0x1c0
+[ 374.676828] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+[ 374.738474] INFO: task nvmeadm:49141 blocked for more than 123 seconds.
+[ 374.745871] Not tainted 5.2.0-rc3-mpdebug+ #42
+[ 374.751419] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 374.760170] nvmeadm D 0 49141 36333 0x00004080
+[ 374.766301] Call Trace:
+[ 374.769038] __schedule+0x2ef/0x620
+[ 374.772939] schedule+0x38/0xa0
+[ 374.776452] blk_mq_freeze_queue_wait+0x59/0x100
+[ 374.781614] ? remove_wait_queue+0x60/0x60
+[ 374.786192] blk_mq_freeze_queue+0x1a/0x20
+[ 374.790773] nvme_update_disk_info.isra.57+0x5f/0x350 [nvme_core]
+[ 374.797582] ? nvme_identify_ns.isra.50+0x71/0xc0 [nvme_core]
+[ 374.804006] __nvme_revalidate_disk+0xe5/0x110 [nvme_core]
+[ 374.810139] nvme_revalidate_disk+0xa6/0x120 [nvme_core]
+[ 374.816078] ? nvme_submit_user_cmd+0x11e/0x320 [nvme_core]
+[ 374.822299] nvme_user_cmd+0x264/0x370 [nvme_core]
+[ 374.827661] nvme_dev_ioctl+0x112/0x1d0 [nvme_core]
+[ 374.833114] do_vfs_ioctl+0xa7/0x600
+[ 374.837117] ? __audit_syscall_entry+0xdd/0x130
+[ 374.842184] ksys_ioctl+0x67/0x90
+[ 374.845891] __x64_sys_ioctl+0x1a/0x20
+[ 374.850082] do_syscall_64+0x5a/0x1c0
+[ 374.854178] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+--
+
+Reported-by: James Puthukattukaran <james.puthukattukaran@oracle.com>
+Tested-by: James Puthukattukaran <james.puthukattukaran@oracle.com>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 5 +++++
+ drivers/nvme/host/multipath.c | 30 ++++++++++++++++++++++++++++++
+ drivers/nvme/host/nvme.h | 12 ++++++++++++
+ 3 files changed, 47 insertions(+)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index d838a300ae770..ae0b01059fc6d 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1183,6 +1183,9 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
+ */
+ if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
+ mutex_lock(&ctrl->scan_lock);
++ mutex_lock(&ctrl->subsys->lock);
++ nvme_mpath_start_freeze(ctrl->subsys);
++ nvme_mpath_wait_freeze(ctrl->subsys);
+ nvme_start_freeze(ctrl);
+ nvme_wait_freeze(ctrl);
+ }
+@@ -1213,6 +1216,8 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
+ nvme_update_formats(ctrl);
+ if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
+ nvme_unfreeze(ctrl);
++ nvme_mpath_unfreeze(ctrl->subsys);
++ mutex_unlock(&ctrl->subsys->lock);
+ mutex_unlock(&ctrl->scan_lock);
+ }
+ if (effects & NVME_CMD_EFFECTS_CCC)
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index a11e210d173e4..05d6371c7f385 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -20,6 +20,36 @@ module_param(multipath, bool, 0444);
+ MODULE_PARM_DESC(multipath,
+ "turn on native support for multiple controllers per subsystem");
+
++void nvme_mpath_unfreeze(struct nvme_subsystem *subsys)
++{
++ struct nvme_ns_head *h;
++
++ lockdep_assert_held(&subsys->lock);
++ list_for_each_entry(h, &subsys->nsheads, entry)
++ if (h->disk)
++ blk_mq_unfreeze_queue(h->disk->queue);
++}
++
++void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
++{
++ struct nvme_ns_head *h;
++
++ lockdep_assert_held(&subsys->lock);
++ list_for_each_entry(h, &subsys->nsheads, entry)
++ if (h->disk)
++ blk_mq_freeze_queue_wait(h->disk->queue);
++}
++
++void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
++{
++ struct nvme_ns_head *h;
++
++ lockdep_assert_held(&subsys->lock);
++ list_for_each_entry(h, &subsys->nsheads, entry)
++ if (h->disk)
++ blk_freeze_queue_start(h->disk->queue);
++}
++
+ /*
+ * If multipathing is enabled we need to always use the subsystem instance
+ * number for numbering our devices to avoid conflicts between subsystems that
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index d5e29b57eb340..2653e1f4196d5 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -469,6 +469,9 @@ static inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl)
+ return ctrl->ana_log_buf != NULL;
+ }
+
++void nvme_mpath_unfreeze(struct nvme_subsystem *subsys);
++void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys);
++void nvme_mpath_start_freeze(struct nvme_subsystem *subsys);
+ void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
+ struct nvme_ctrl *ctrl, int *flags);
+ void nvme_failover_req(struct request *req);
+@@ -553,6 +556,15 @@ static inline void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
+ static inline void nvme_mpath_stop(struct nvme_ctrl *ctrl)
+ {
+ }
++static inline void nvme_mpath_unfreeze(struct nvme_subsystem *subsys)
++{
++}
++static inline void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
++{
++}
++static inline void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
++{
++}
+ #endif /* CONFIG_NVME_MULTIPATH */
+
+ #ifdef CONFIG_NVM
+--
+2.20.1
+
--- /dev/null
+From a6d6968665a7706b5adc7a1d696480cd8d3be609 Mon Sep 17 00:00:00 2001
+From: Anthony Iliopoulos <ailiopoulos@suse.com>
+Date: Mon, 29 Jul 2019 14:40:40 +0200
+Subject: nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns
+
+[ Upstream commit fab7772bfbcfe8fb8e3e352a6a8fcaf044cded17 ]
+
+When CONFIG_NVME_MULTIPATH is set, only the hidden gendisk associated
+with the per-controller ns is run through revalidate_disk when a
+rescan is triggered, while the visible blockdev never gets its size
+(bdev->bd_inode->i_size) updated to reflect any capacity changes that
+may have occurred.
+
+This prevents online resizing of nvme block devices and in extension of
+any filesystems atop that will are unable to expand while mounted, as
+userspace relies on the blockdev size for obtaining the disk capacity
+(via BLKGETSIZE/64 ioctls).
+
+Fix this by explicitly revalidating the actual namespace gendisk in
+addition to the per-controller gendisk, when multipath is enabled.
+
+Signed-off-by: Anthony Iliopoulos <ailiopoulos@suse.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index e26d1191c5ad6..d838a300ae770 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1557,6 +1557,7 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
+ if (ns->head->disk) {
+ nvme_update_disk_info(ns->head->disk, ns, id);
+ blk_queue_stack_limits(ns->head->disk->queue, ns->queue);
++ revalidate_disk(ns->head->disk);
+ }
+ #endif
+ }
+--
+2.20.1
+
--- /dev/null
+From 18c4642d6bdc80ed0634dd5089461f8349873636 Mon Sep 17 00:00:00 2001
+From: Keith Busch <kbusch@kernel.org>
+Date: Mon, 29 Jul 2019 16:34:52 -0600
+Subject: nvme-pci: Fix async probe remove race
+
+[ Upstream commit bd46a90634302bfe791e93ad5496f98f165f7ae0 ]
+
+Ensure the controller is not in the NEW state when nvme_probe() exits.
+This will always allow a subsequent nvme_remove() to set the state to
+DELETING, fixing a potential race between the initial asynchronous probe
+and device removal.
+
+Reported-by: Li Zhong <lizhongfs@gmail.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 0a5d064f82ca3..a64a8bca0d5b9 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2468,7 +2468,7 @@ static void nvme_async_probe(void *data, async_cookie_t cookie)
+ {
+ struct nvme_dev *dev = data;
+
+- nvme_reset_ctrl_sync(&dev->ctrl);
++ flush_work(&dev->ctrl.reset_work);
+ flush_work(&dev->ctrl.scan_work);
+ nvme_put_ctrl(&dev->ctrl);
+ }
+@@ -2535,6 +2535,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
+
++ nvme_reset_ctrl(&dev->ctrl);
+ nvme_get_ctrl(&dev->ctrl);
+ async_schedule(nvme_async_probe, dev);
+
+--
+2.20.1
+
--- /dev/null
+From 48d643606f01b17f3aa2f189338085af8b6509dc Mon Sep 17 00:00:00 2001
+From: Logan Gunthorpe <logang@deltatee.com>
+Date: Wed, 31 Jul 2019 17:35:32 -0600
+Subject: nvmet-loop: Flush nvme_delete_wq when removing the port
+
+[ Upstream commit 86b9a63e595ff03f9d0a7b92b6acc231fecefc29 ]
+
+After calling nvme_loop_delete_ctrl(), the controllers will not
+yet be deleted because nvme_delete_ctrl() only schedules work
+to do the delete.
+
+This means a race can occur if a port is removed but there
+are still active controllers trying to access that memory.
+
+To fix this, flush the nvme_delete_wq before returning from
+nvme_loop_remove_port() so that any controllers that might
+be in the process of being deleted won't access a freed port.
+
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Reviewed-by : Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/loop.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
+index 9908082b32c4b..137a27fa369cb 100644
+--- a/drivers/nvme/target/loop.c
++++ b/drivers/nvme/target/loop.c
+@@ -678,6 +678,14 @@ static void nvme_loop_remove_port(struct nvmet_port *port)
+ mutex_lock(&nvme_loop_ports_mutex);
+ list_del_init(&port->entry);
+ mutex_unlock(&nvme_loop_ports_mutex);
++
++ /*
++ * Ensure any ctrls that are in the process of being
++ * deleted are in fact deleted before we return
++ * and free the port. This is to prevent active
++ * ctrls from using a port after it's freed.
++ */
++ flush_workqueue(nvme_delete_wq);
+ }
+
+ static const struct nvmet_fabrics_ops nvme_loop_ops = {
+--
+2.20.1
+
--- /dev/null
+From 7848d898b2b6ff61606a449dd6f27abf09383ef4 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Fri, 9 Aug 2019 10:32:40 +0200
+Subject: omap-dma/omap_vout_vrfb: fix off-by-one fi value
+
+[ Upstream commit d555c34338cae844b207564c482e5a3fb089d25e ]
+
+The OMAP 4 TRM specifies that when using double-index addressing
+the address increases by the ES plus the EI value minus 1 within
+a frame. When a full frame is transferred, the address increases
+by the ES plus the frame index (FI) value minus 1.
+
+The omap-dma code didn't account for the 'minus 1' in the FI register.
+To get correct addressing, add 1 to the src_icg value.
+
+This was found when testing a hacked version of the media m2m-deinterlace.c
+driver on a Pandaboard.
+
+The only other source that uses this feature is omap_vout_vrfb.c,
+and that adds a + 1 when setting the dst_icg. This is a workaround
+for the broken omap-dma.c behavior. So remove the workaround at the
+same time that we fix omap-dma.c.
+
+I tested the omap_vout driver with a Beagle XM board to check that
+the '+ 1' in omap_vout_vrfb.c was indeed a workaround for the omap-dma
+bug.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Acked-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Link: https://lore.kernel.org/r/952e7f51-f208-9333-6f58-b7ed20d2ea0b@xs4all.nl
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ti/omap-dma.c | 4 ++--
+ drivers/media/platform/omap/omap_vout_vrfb.c | 3 +--
+ 2 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c
+index a4a931ddf6f69..aeb9c29e52554 100644
+--- a/drivers/dma/ti/omap-dma.c
++++ b/drivers/dma/ti/omap-dma.c
+@@ -1237,7 +1237,7 @@ static struct dma_async_tx_descriptor *omap_dma_prep_dma_interleaved(
+ if (src_icg) {
+ d->ccr |= CCR_SRC_AMODE_DBLIDX;
+ d->ei = 1;
+- d->fi = src_icg;
++ d->fi = src_icg + 1;
+ } else if (xt->src_inc) {
+ d->ccr |= CCR_SRC_AMODE_POSTINC;
+ d->fi = 0;
+@@ -1252,7 +1252,7 @@ static struct dma_async_tx_descriptor *omap_dma_prep_dma_interleaved(
+ if (dst_icg) {
+ d->ccr |= CCR_DST_AMODE_DBLIDX;
+ sg->ei = 1;
+- sg->fi = dst_icg;
++ sg->fi = dst_icg + 1;
+ } else if (xt->dst_inc) {
+ d->ccr |= CCR_DST_AMODE_POSTINC;
+ sg->fi = 0;
+diff --git a/drivers/media/platform/omap/omap_vout_vrfb.c b/drivers/media/platform/omap/omap_vout_vrfb.c
+index 29e3f5da59c1f..11ec048929e80 100644
+--- a/drivers/media/platform/omap/omap_vout_vrfb.c
++++ b/drivers/media/platform/omap/omap_vout_vrfb.c
+@@ -253,8 +253,7 @@ int omap_vout_prepare_vrfb(struct omap_vout_device *vout,
+ */
+
+ pixsize = vout->bpp * vout->vrfb_bpp;
+- dst_icg = ((MAX_PIXELS_PER_LINE * pixsize) -
+- (vout->pix.width * vout->bpp)) + 1;
++ dst_icg = MAX_PIXELS_PER_LINE * pixsize - vout->pix.width * vout->bpp;
+
+ xt->src_start = vout->buf_phy_addr[vb->i];
+ xt->dst_start = vout->vrfb_context[vb->i].paddr[0];
+--
+2.20.1
+
--- /dev/null
+From 53a19233ff3370b1eda09d3888cfa68d9f94e54b Mon Sep 17 00:00:00 2001
+From: Pedro Sousa <sousa@synopsys.com>
+Date: Thu, 18 Apr 2019 21:13:34 +0200
+Subject: scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
+
+[ Upstream commit ebcb8f8508c5edf428f52525cec74d28edea7bcb ]
+
+Fix RX_TERMINATION_FORCE_ENABLE define value from 0x0089 to 0x00A9
+according to MIPI Alliance MPHY specification.
+
+Fixes: e785060ea3a1 ("ufs: definitions for phy interface")
+Signed-off-by: Pedro Sousa <sousa@synopsys.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/unipro.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ufs/unipro.h b/drivers/scsi/ufs/unipro.h
+index 23129d7b2678d..c77e365264478 100644
+--- a/drivers/scsi/ufs/unipro.h
++++ b/drivers/scsi/ufs/unipro.h
+@@ -52,7 +52,7 @@
+ #define RX_HS_UNTERMINATED_ENABLE 0x00A6
+ #define RX_ENTER_HIBERN8 0x00A7
+ #define RX_BYPASS_8B10B_ENABLE 0x00A8
+-#define RX_TERMINATION_FORCE_ENABLE 0x0089
++#define RX_TERMINATION_FORCE_ENABLE 0x00A9
+ #define RX_MIN_ACTIVATETIME_CAPABILITY 0x008F
+ #define RX_HIBERN8TIME_CAPABILITY 0x0092
+ #define RX_REFCLKFREQ 0x00EB
+--
+2.20.1
+
--- /dev/null
+dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
+nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
+afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
+afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
+fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
+afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
+nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
+nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
+nvme-pci-fix-async-probe-remove-race.patch
+soundwire-cadence_master-fix-register-definition-for.patch
+soundwire-cadence_master-fix-definitions-for-intstat.patch
+auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
+dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
+omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
+iommu-dma-handle-sg-length-overflow-better.patch
+usb-gadget-composite-clear-suspended-on-reset-discon.patch
+usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
+xen-blkback-fix-memory-leaks.patch
+arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
+i2c-rcar-avoid-race-when-unregistering-slave-client.patch
+i2c-emev2-avoid-race-when-unregistering-slave-client.patch
+drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
+usb-host-fotg2-restart-hcd-after-port-reset.patch
+tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
+tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
+drm-i915-fix-broadwell-eu-computation.patch
+watchdog-bcm2835_wdt-fix-module-autoload.patch
+drm-bridge-tfp410-fix-memleak-in-get_modes.patch
+scsi-ufs-fix-rx_termination_force_enable-define-valu.patch
+drm-tilcdc-register-cpufreq-notifier-after-we-have-i.patch
--- /dev/null
+From 5b28439f113df0a52b18d555372d878d38cef071 Mon Sep 17 00:00:00 2001
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Date: Thu, 25 Jul 2019 18:40:06 -0500
+Subject: soundwire: cadence_master: fix definitions for INTSTAT0/1
+
+[ Upstream commit 664b16589f882202b8fa8149d0074f3159bade76 ]
+
+Two off-by-one errors: INTSTAT0 missed BIT(31) and INTSTAT1 is only
+defined on first 16 bits.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20190725234032.21152-15-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/cadence_master.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c
+index d3d7de5a319c5..70f78eda037e8 100644
+--- a/drivers/soundwire/cadence_master.c
++++ b/drivers/soundwire/cadence_master.c
+@@ -96,8 +96,8 @@
+ #define CDNS_MCP_SLAVE_INTMASK0 0x5C
+ #define CDNS_MCP_SLAVE_INTMASK1 0x60
+
+-#define CDNS_MCP_SLAVE_INTMASK0_MASK GENMASK(30, 0)
+-#define CDNS_MCP_SLAVE_INTMASK1_MASK GENMASK(16, 0)
++#define CDNS_MCP_SLAVE_INTMASK0_MASK GENMASK(31, 0)
++#define CDNS_MCP_SLAVE_INTMASK1_MASK GENMASK(15, 0)
+
+ #define CDNS_MCP_PORT_INTSTAT 0x64
+ #define CDNS_MCP_PDI_STAT 0x6C
+--
+2.20.1
+
--- /dev/null
+From 59b2706a0716980131805f23421ea756f0e8dd03 Mon Sep 17 00:00:00 2001
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Date: Thu, 25 Jul 2019 18:40:05 -0500
+Subject: soundwire: cadence_master: fix register definition for SLAVE_STATE
+
+[ Upstream commit b07dd9b400981f487940a4d84292d3a0e7cd9362 ]
+
+wrong prefix and wrong macro.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20190725234032.21152-14-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/cadence_master.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c
+index cb6a331f448ab..d3d7de5a319c5 100644
+--- a/drivers/soundwire/cadence_master.c
++++ b/drivers/soundwire/cadence_master.c
+@@ -81,8 +81,8 @@
+
+ #define CDNS_MCP_INTSET 0x4C
+
+-#define CDNS_SDW_SLAVE_STAT 0x50
+-#define CDNS_MCP_SLAVE_STAT_MASK BIT(1, 0)
++#define CDNS_MCP_SLAVE_STAT 0x50
++#define CDNS_MCP_SLAVE_STAT_MASK GENMASK(1, 0)
+
+ #define CDNS_MCP_SLAVE_INTSTAT0 0x54
+ #define CDNS_MCP_SLAVE_INTSTAT1 0x58
+--
+2.20.1
+
--- /dev/null
+From 63da5bd87c15655a12ca6d359bf7a712e184106e Mon Sep 17 00:00:00 2001
+From: Adrian Vladu <avladu@cloudbasesolutions.com>
+Date: Mon, 6 May 2019 16:50:58 +0000
+Subject: tools: hv: fix KVP and VSS daemons exit code
+
+[ Upstream commit b0995156071b0ff29a5902964a9dc8cfad6f81c0 ]
+
+HyperV KVP and VSS daemons should exit with 0 when the '--help'
+or '-h' flags are used.
+
+Signed-off-by: Adrian Vladu <avladu@cloudbasesolutions.com>
+
+Cc: "K. Y. Srinivasan" <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Cc: Sasha Levin <sashal@kernel.org>
+Cc: Alessandro Pilotti <apilotti@cloudbasesolutions.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/hv/hv_kvp_daemon.c | 2 ++
+ tools/hv/hv_vss_daemon.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
+index d7e06fe0270ee..0ce50c319cfd6 100644
+--- a/tools/hv/hv_kvp_daemon.c
++++ b/tools/hv/hv_kvp_daemon.c
+@@ -1386,6 +1386,8 @@ int main(int argc, char *argv[])
+ daemonize = 0;
+ break;
+ case 'h':
++ print_usage(argv);
++ exit(0);
+ default:
+ print_usage(argv);
+ exit(EXIT_FAILURE);
+diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c
+index b133001727623..c2bb8a3601777 100644
+--- a/tools/hv/hv_vss_daemon.c
++++ b/tools/hv/hv_vss_daemon.c
+@@ -229,6 +229,8 @@ int main(int argc, char *argv[])
+ daemonize = 0;
+ break;
+ case 'h':
++ print_usage(argv);
++ exit(0);
+ default:
+ print_usage(argv);
+ exit(EXIT_FAILURE);
+--
+2.20.1
+
--- /dev/null
+From 352a964c39f36ba59f01783d3441567843a89210 Mon Sep 17 00:00:00 2001
+From: Adrian Vladu <avladu@cloudbasesolutions.com>
+Date: Mon, 6 May 2019 17:27:37 +0000
+Subject: tools: hv: fixed Python pep8/flake8 warnings for lsvmbus
+
+[ Upstream commit 5912e791f3018de0a007c8cfa9cb38c97d3e5f5c ]
+
+Fixed pep8/flake8 python style code for lsvmbus tool.
+
+The TAB indentation was on purpose ignored (pep8 rule W191) to make
+sure the code is complying with the Linux code guideline.
+The following command doe not show any warnings now:
+pep8 --ignore=W191 lsvmbus
+flake8 --ignore=W191 lsvmbus
+
+Signed-off-by: Adrian Vladu <avladu@cloudbasesolutions.com>
+
+Cc: "K. Y. Srinivasan" <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Cc: Sasha Levin <sashal@kernel.org>
+Cc: Dexuan Cui <decui@microsoft.com>
+Cc: Alessandro Pilotti <apilotti@cloudbasesolutions.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/hv/lsvmbus | 75 +++++++++++++++++++++++++++---------------------
+ 1 file changed, 42 insertions(+), 33 deletions(-)
+
+diff --git a/tools/hv/lsvmbus b/tools/hv/lsvmbus
+index 55e7374bade0d..099f2c44dbed2 100644
+--- a/tools/hv/lsvmbus
++++ b/tools/hv/lsvmbus
+@@ -4,10 +4,10 @@
+ import os
+ from optparse import OptionParser
+
++help_msg = "print verbose messages. Try -vv, -vvv for more verbose messages"
+ parser = OptionParser()
+-parser.add_option("-v", "--verbose", dest="verbose",
+- help="print verbose messages. Try -vv, -vvv for \
+- more verbose messages", action="count")
++parser.add_option(
++ "-v", "--verbose", dest="verbose", help=help_msg, action="count")
+
+ (options, args) = parser.parse_args()
+
+@@ -21,27 +21,28 @@ if not os.path.isdir(vmbus_sys_path):
+ exit(-1)
+
+ vmbus_dev_dict = {
+- '{0e0b6031-5213-4934-818b-38d90ced39db}' : '[Operating system shutdown]',
+- '{9527e630-d0ae-497b-adce-e80ab0175caf}' : '[Time Synchronization]',
+- '{57164f39-9115-4e78-ab55-382f3bd5422d}' : '[Heartbeat]',
+- '{a9a0f4e7-5a45-4d96-b827-8a841e8c03e6}' : '[Data Exchange]',
+- '{35fa2e29-ea23-4236-96ae-3a6ebacba440}' : '[Backup (volume checkpoint)]',
+- '{34d14be3-dee4-41c8-9ae7-6b174977c192}' : '[Guest services]',
+- '{525074dc-8985-46e2-8057-a307dc18a502}' : '[Dynamic Memory]',
+- '{cfa8b69e-5b4a-4cc0-b98b-8ba1a1f3f95a}' : 'Synthetic mouse',
+- '{f912ad6d-2b17-48ea-bd65-f927a61c7684}' : 'Synthetic keyboard',
+- '{da0a7802-e377-4aac-8e77-0558eb1073f8}' : 'Synthetic framebuffer adapter',
+- '{f8615163-df3e-46c5-913f-f2d2f965ed0e}' : 'Synthetic network adapter',
+- '{32412632-86cb-44a2-9b5c-50d1417354f5}' : 'Synthetic IDE Controller',
+- '{ba6163d9-04a1-4d29-b605-72e2ffb1dc7f}' : 'Synthetic SCSI Controller',
+- '{2f9bcc4a-0069-4af3-b76b-6fd0be528cda}' : 'Synthetic fiber channel adapter',
+- '{8c2eaf3d-32a7-4b09-ab99-bd1f1c86b501}' : 'Synthetic RDMA adapter',
+- '{44c4f61d-4444-4400-9d52-802e27ede19f}' : 'PCI Express pass-through',
+- '{276aacf4-ac15-426c-98dd-7521ad3f01fe}' : '[Reserved system device]',
+- '{f8e65716-3cb3-4a06-9a60-1889c5cccab5}' : '[Reserved system device]',
+- '{3375baf4-9e15-4b30-b765-67acb10d607b}' : '[Reserved system device]',
++ '{0e0b6031-5213-4934-818b-38d90ced39db}': '[Operating system shutdown]',
++ '{9527e630-d0ae-497b-adce-e80ab0175caf}': '[Time Synchronization]',
++ '{57164f39-9115-4e78-ab55-382f3bd5422d}': '[Heartbeat]',
++ '{a9a0f4e7-5a45-4d96-b827-8a841e8c03e6}': '[Data Exchange]',
++ '{35fa2e29-ea23-4236-96ae-3a6ebacba440}': '[Backup (volume checkpoint)]',
++ '{34d14be3-dee4-41c8-9ae7-6b174977c192}': '[Guest services]',
++ '{525074dc-8985-46e2-8057-a307dc18a502}': '[Dynamic Memory]',
++ '{cfa8b69e-5b4a-4cc0-b98b-8ba1a1f3f95a}': 'Synthetic mouse',
++ '{f912ad6d-2b17-48ea-bd65-f927a61c7684}': 'Synthetic keyboard',
++ '{da0a7802-e377-4aac-8e77-0558eb1073f8}': 'Synthetic framebuffer adapter',
++ '{f8615163-df3e-46c5-913f-f2d2f965ed0e}': 'Synthetic network adapter',
++ '{32412632-86cb-44a2-9b5c-50d1417354f5}': 'Synthetic IDE Controller',
++ '{ba6163d9-04a1-4d29-b605-72e2ffb1dc7f}': 'Synthetic SCSI Controller',
++ '{2f9bcc4a-0069-4af3-b76b-6fd0be528cda}': 'Synthetic fiber channel adapter',
++ '{8c2eaf3d-32a7-4b09-ab99-bd1f1c86b501}': 'Synthetic RDMA adapter',
++ '{44c4f61d-4444-4400-9d52-802e27ede19f}': 'PCI Express pass-through',
++ '{276aacf4-ac15-426c-98dd-7521ad3f01fe}': '[Reserved system device]',
++ '{f8e65716-3cb3-4a06-9a60-1889c5cccab5}': '[Reserved system device]',
++ '{3375baf4-9e15-4b30-b765-67acb10d607b}': '[Reserved system device]',
+ }
+
++
+ def get_vmbus_dev_attr(dev_name, attr):
+ try:
+ f = open('%s/%s/%s' % (vmbus_sys_path, dev_name, attr), 'r')
+@@ -52,6 +53,7 @@ def get_vmbus_dev_attr(dev_name, attr):
+
+ return lines
+
++
+ class VMBus_Dev:
+ pass
+
+@@ -66,12 +68,13 @@ for f in os.listdir(vmbus_sys_path):
+
+ chn_vp_mapping = get_vmbus_dev_attr(f, 'channel_vp_mapping')
+ chn_vp_mapping = [c.strip() for c in chn_vp_mapping]
+- chn_vp_mapping = sorted(chn_vp_mapping,
+- key = lambda c : int(c.split(':')[0]))
++ chn_vp_mapping = sorted(
++ chn_vp_mapping, key=lambda c: int(c.split(':')[0]))
+
+- chn_vp_mapping = ['\tRel_ID=%s, target_cpu=%s' %
+- (c.split(':')[0], c.split(':')[1])
+- for c in chn_vp_mapping]
++ chn_vp_mapping = [
++ '\tRel_ID=%s, target_cpu=%s' %
++ (c.split(':')[0], c.split(':')[1]) for c in chn_vp_mapping
++ ]
+ d = VMBus_Dev()
+ d.sysfs_path = '%s/%s' % (vmbus_sys_path, f)
+ d.vmbus_id = vmbus_id
+@@ -85,7 +88,7 @@ for f in os.listdir(vmbus_sys_path):
+ vmbus_dev_list.append(d)
+
+
+-vmbus_dev_list = sorted(vmbus_dev_list, key = lambda d : int(d.vmbus_id))
++vmbus_dev_list = sorted(vmbus_dev_list, key=lambda d: int(d.vmbus_id))
+
+ format0 = '%2s: %s'
+ format1 = '%2s: Class_ID = %s - %s\n%s'
+@@ -95,9 +98,15 @@ for d in vmbus_dev_list:
+ if verbose == 0:
+ print(('VMBUS ID ' + format0) % (d.vmbus_id, d.dev_desc))
+ elif verbose == 1:
+- print (('VMBUS ID ' + format1) % \
+- (d.vmbus_id, d.class_id, d.dev_desc, d.chn_vp_mapping))
++ print(
++ ('VMBUS ID ' + format1) %
++ (d.vmbus_id, d.class_id, d.dev_desc, d.chn_vp_mapping)
++ )
+ else:
+- print (('VMBUS ID ' + format2) % \
+- (d.vmbus_id, d.class_id, d.dev_desc, \
+- d.device_id, d.sysfs_path, d.chn_vp_mapping))
++ print(
++ ('VMBUS ID ' + format2) %
++ (
++ d.vmbus_id, d.class_id, d.dev_desc,
++ d.device_id, d.sysfs_path, d.chn_vp_mapping
++ )
++ )
+--
+2.20.1
+
--- /dev/null
+From bd0c90c82709f0d8d600c1b66888a23a4e0b533e Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Fri, 26 Jul 2019 14:59:03 +1000
+Subject: usb: gadget: composite: Clear "suspended" on reset/disconnect
+
+[ Upstream commit 602fda17c7356bb7ae98467d93549057481d11dd ]
+
+In some cases, one can get out of suspend with a reset or
+a disconnect followed by a reconnect. Previously we would
+leave a stale suspended flag set.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/composite.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index b8a15840b4ffd..dfcabadeed01b 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1976,6 +1976,7 @@ void composite_disconnect(struct usb_gadget *gadget)
+ * disconnect callbacks?
+ */
+ spin_lock_irqsave(&cdev->lock, flags);
++ cdev->suspended = 0;
+ if (cdev->config)
+ reset_config(cdev);
+ if (cdev->driver->disconnect)
+--
+2.20.1
+
--- /dev/null
+From 6cc7d3cb64ba4dab93a99ae9a26bbccaf99a0e34 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Fri, 26 Jul 2019 14:59:04 +1000
+Subject: usb: gadget: mass_storage: Fix races between fsg_disable and
+ fsg_set_alt
+
+[ Upstream commit 4a56a478a525d6427be90753451c40e1327caa1a ]
+
+If fsg_disable() and fsg_set_alt() are called too closely to each
+other (for example due to a quick reset/reconnect), what can happen
+is that fsg_set_alt sets common->new_fsg from an interrupt while
+handle_exception is trying to process the config change caused by
+fsg_disable():
+
+ fsg_disable()
+ ...
+ handle_exception()
+ sets state back to FSG_STATE_NORMAL
+ hasn't yet called do_set_interface()
+ or is inside it.
+
+ ---> interrupt
+ fsg_set_alt
+ sets common->new_fsg
+ queues a new FSG_STATE_CONFIG_CHANGE
+ <---
+
+Now, the first handle_exception can "see" the updated
+new_fsg, treats it as if it was a fsg_set_alt() response,
+call usb_composite_setup_continue() etc...
+
+But then, the thread sees the second FSG_STATE_CONFIG_CHANGE,
+and goes back down the same path, wipes and reattaches a now
+active fsg, and .. calls usb_composite_setup_continue() which
+at this point is wrong.
+
+Not only we get a backtrace, but I suspect the second set_interface
+wrecks some state causing the host to get upset in my case.
+
+This fixes it by replacing "new_fsg" by a "state argument" (same
+principle) which is set in the same lock section as the state
+update, and retrieved similarly.
+
+That way, there is never any discrepancy between the dequeued
+state and the observed value of it. We keep the ability to have
+the latest reconfig operation take precedence, but we guarantee
+that once "dequeued" the argument (new_fsg) will not be clobbered
+by any new event.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_mass_storage.c | 28 +++++++++++++-------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
+index 1074cb82ec172..0b7b4d09785b6 100644
+--- a/drivers/usb/gadget/function/f_mass_storage.c
++++ b/drivers/usb/gadget/function/f_mass_storage.c
+@@ -261,7 +261,7 @@ struct fsg_common;
+ struct fsg_common {
+ struct usb_gadget *gadget;
+ struct usb_composite_dev *cdev;
+- struct fsg_dev *fsg, *new_fsg;
++ struct fsg_dev *fsg;
+ wait_queue_head_t io_wait;
+ wait_queue_head_t fsg_wait;
+
+@@ -290,6 +290,7 @@ struct fsg_common {
+ unsigned int bulk_out_maxpacket;
+ enum fsg_state state; /* For exception handling */
+ unsigned int exception_req_tag;
++ void *exception_arg;
+
+ enum data_direction data_dir;
+ u32 data_size;
+@@ -391,7 +392,8 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
+
+ /* These routines may be called in process context or in_irq */
+
+-static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
++static void __raise_exception(struct fsg_common *common, enum fsg_state new_state,
++ void *arg)
+ {
+ unsigned long flags;
+
+@@ -404,6 +406,7 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+ if (common->state <= new_state) {
+ common->exception_req_tag = common->ep0_req_tag;
+ common->state = new_state;
++ common->exception_arg = arg;
+ if (common->thread_task)
+ send_sig_info(SIGUSR1, SEND_SIG_FORCED,
+ common->thread_task);
+@@ -411,6 +414,10 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+ spin_unlock_irqrestore(&common->lock, flags);
+ }
+
++static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
++{
++ __raise_exception(common, new_state, NULL);
++}
+
+ /*-------------------------------------------------------------------------*/
+
+@@ -2285,16 +2292,16 @@ reset:
+ static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+ {
+ struct fsg_dev *fsg = fsg_from_func(f);
+- fsg->common->new_fsg = fsg;
+- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
++
++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, fsg);
+ return USB_GADGET_DELAYED_STATUS;
+ }
+
+ static void fsg_disable(struct usb_function *f)
+ {
+ struct fsg_dev *fsg = fsg_from_func(f);
+- fsg->common->new_fsg = NULL;
+- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
++
++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
+ }
+
+
+@@ -2307,6 +2314,7 @@ static void handle_exception(struct fsg_common *common)
+ enum fsg_state old_state;
+ struct fsg_lun *curlun;
+ unsigned int exception_req_tag;
++ struct fsg_dev *new_fsg;
+
+ /*
+ * Clear the existing signals. Anything but SIGUSR1 is converted
+@@ -2360,6 +2368,7 @@ static void handle_exception(struct fsg_common *common)
+ common->next_buffhd_to_fill = &common->buffhds[0];
+ common->next_buffhd_to_drain = &common->buffhds[0];
+ exception_req_tag = common->exception_req_tag;
++ new_fsg = common->exception_arg;
+ old_state = common->state;
+ common->state = FSG_STATE_NORMAL;
+
+@@ -2413,8 +2422,8 @@ static void handle_exception(struct fsg_common *common)
+ break;
+
+ case FSG_STATE_CONFIG_CHANGE:
+- do_set_interface(common, common->new_fsg);
+- if (common->new_fsg)
++ do_set_interface(common, new_fsg);
++ if (new_fsg)
+ usb_composite_setup_continue(common->cdev);
+ break;
+
+@@ -2989,8 +2998,7 @@ static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
+
+ DBG(fsg, "unbind\n");
+ if (fsg->common->fsg == fsg) {
+- fsg->common->new_fsg = NULL;
+- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
+ /* FIXME: make interruptible or killable somehow? */
+ wait_event(common->fsg_wait, common->fsg != fsg);
+ }
+--
+2.20.1
+
--- /dev/null
+From 1356f72b847b13e6454d2ba74d24084d8c5ac52a Mon Sep 17 00:00:00 2001
+From: Hans Ulli Kroll <ulli.kroll@googlemail.com>
+Date: Sat, 10 Aug 2019 17:04:58 +0200
+Subject: usb: host: fotg2: restart hcd after port reset
+
+[ Upstream commit 777758888ffe59ef754cc39ab2f275dc277732f4 ]
+
+On the Gemini SoC the FOTG2 stalls after port reset
+so restart the HCD after each port reset.
+
+Signed-off-by: Hans Ulli Kroll <ulli.kroll@googlemail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20190810150458.817-1-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/fotg210-hcd.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
+index e64eb47770c8b..2d5a72c15069e 100644
+--- a/drivers/usb/host/fotg210-hcd.c
++++ b/drivers/usb/host/fotg210-hcd.c
+@@ -1627,6 +1627,10 @@ static int fotg210_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ /* see what we found out */
+ temp = check_reset_complete(fotg210, wIndex, status_reg,
+ fotg210_readl(fotg210, status_reg));
++
++ /* restart schedule */
++ fotg210->command |= CMD_RUN;
++ fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
+ }
+
+ if (!(temp & (PORT_RESUME|PORT_RESET))) {
+--
+2.20.1
+
--- /dev/null
+From 10ae237e046e2e2f8fc6540bb397bbe052aa4c45 Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <wahrenst@gmx.net>
+Date: Wed, 15 May 2019 19:14:18 +0200
+Subject: watchdog: bcm2835_wdt: Fix module autoload
+
+[ Upstream commit 215e06f0d18d5d653d6ea269e4dfc684854d48bf ]
+
+The commit 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe
+to an MFD.") broke module autoloading on Raspberry Pi. So add a
+module alias this fix this.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/bcm2835_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
+index ed05514cc2dce..e6c27b71b136d 100644
+--- a/drivers/watchdog/bcm2835_wdt.c
++++ b/drivers/watchdog/bcm2835_wdt.c
+@@ -249,6 +249,7 @@ module_param(nowayout, bool, 0);
+ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
+ __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+
++MODULE_ALIAS("platform:bcm2835-wdt");
+ MODULE_AUTHOR("Lubomir Rintel <lkundrak@v3.sk>");
+ MODULE_DESCRIPTION("Driver for Broadcom BCM2835 watchdog timer");
+ MODULE_LICENSE("GPL");
+--
+2.20.1
+
--- /dev/null
+From 372dd8959cd769eebce676cd177a18677f43ffab Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wenwen@cs.uga.edu>
+Date: Sun, 11 Aug 2019 12:23:22 -0500
+Subject: xen/blkback: fix memory leaks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit ae78ca3cf3d9e9f914bfcd0bc5c389ff18b9c2e0 ]
+
+In read_per_ring_refs(), after 'req' and related memory regions are
+allocated, xen_blkif_map() is invoked to map the shared frame, irq, and
+etc. However, if this mapping process fails, no cleanup is performed,
+leading to memory leaks. To fix this issue, invoke the cleanup before
+returning the error.
+
+Acked-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/xen-blkback/xenbus.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
+index a4bc74e72c394..55869b362fdfb 100644
+--- a/drivers/block/xen-blkback/xenbus.c
++++ b/drivers/block/xen-blkback/xenbus.c
+@@ -974,6 +974,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
+ }
+ blkif->nr_ring_pages = nr_grefs;
+
++ err = -ENOMEM;
+ for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) {
+ req = kzalloc(sizeof(*req), GFP_KERNEL);
+ if (!req)
+@@ -996,7 +997,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
+ err = xen_blkif_map(ring, ring_ref, nr_grefs, evtchn);
+ if (err) {
+ xenbus_dev_fatal(dev, err, "mapping ring-ref port %u", evtchn);
+- return err;
++ goto fail;
+ }
+
+ return 0;
+@@ -1016,8 +1017,7 @@ fail:
+ }
+ kfree(req);
+ }
+- return -ENOMEM;
+-
++ return err;
+ }
+
+ static int connect_ring(struct backend_info *be)
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
