--- /dev/null
+From 7787657d7ee55a9ecf4aea4907b46b87a44eda67 Mon Sep 17 00:00:00 2001
+From: Alain Volmat <alain.volmat@st.com>
+Date: Tue, 12 Nov 2019 09:19:44 +0100
+Subject: i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop
+
+From: Alain Volmat <alain.volmat@st.com>
+
+commit 7787657d7ee55a9ecf4aea4907b46b87a44eda67 upstream.
+
+Fix a typo in the free slave id search loop. Instead of I2C_CLIENT_PEC,
+it should have been I2C_CLIENT_TEN. The slave id 1 can only handle 7-bit
+addresses and thus is not eligible in case of 10-bit addresses.
+As a matter of fact none of the slave id support I2C_CLIENT_PEC, overall
+check is performed at the beginning of the stm32f7_i2c_reg_slave function.
+
+Fixes: 60d609f30de2 ("i2c: i2c-stm32f7: Add slave support")
+Signed-off-by: Alain Volmat <alain.volmat@st.com>
+Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-stm32f7.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -1253,7 +1253,7 @@ static int stm32f7_i2c_get_free_slave_id
+ * slave[1] supports 7-bit slave address only
+ */
+ for (i = STM32F7_I2C_MAX_SLAVE - 1; i >= 0; i--) {
+- if (i == 1 && (slave->flags & I2C_CLIENT_PEC))
++ if (i == 1 && (slave->flags & I2C_CLIENT_TEN))
+ continue;
+ if (!i2c_dev->slave[i]) {
+ *id = i;
--- /dev/null
+From 52d3be711e065a97a57c2f2ffba3098748855bd6 Mon Sep 17 00:00:00 2001
+From: Alain Volmat <alain.volmat@st.com>
+Date: Tue, 15 Oct 2019 15:03:09 +0200
+Subject: i2c: stm32f7: rework slave_id allocation
+
+From: Alain Volmat <alain.volmat@st.com>
+
+commit 52d3be711e065a97a57c2f2ffba3098748855bd6 upstream.
+
+The IP can handle two slave addresses. One address can either be
+7 bits or 10 bits while the other can only be 7 bits.
+In order to ensure that a 10 bits address can always be allocated
+(assuming there is only one 7 bits address already allocated),
+pick up the 7-bits only address slot in priority when performing a 7-bits
+address allocation.
+
+Fixes: 60d609f30de2 ("i2c: i2c-stm32f7: Add slave support")
+Signed-off-by: Alain Volmat <alain.volmat@st.com>
+Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-stm32f7.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -1252,7 +1252,7 @@ static int stm32f7_i2c_get_free_slave_id
+ * slave[0] supports 7-bit and 10-bit slave address
+ * slave[1] supports 7-bit slave address only
+ */
+- for (i = 0; i < STM32F7_I2C_MAX_SLAVE; i++) {
++ for (i = STM32F7_I2C_MAX_SLAVE - 1; i >= 0; i--) {
+ if (i == 1 && (slave->flags & I2C_CLIENT_PEC))
+ continue;
+ if (!i2c_dev->slave[i]) {
--- /dev/null
+From 3f31bc67e4dc6a555341dffefe328ddd58e8b431 Mon Sep 17 00:00:00 2001
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Date: Wed, 4 Sep 2019 08:56:25 +0300
+Subject: mfd: intel-lpss: Add default I2C device properties for Gemini Lake
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+commit 3f31bc67e4dc6a555341dffefe328ddd58e8b431 upstream.
+
+It turned out Intel Gemini Lake doesn't use the same I2C timing
+parameters as Broxton.
+
+I got confirmation from the Windows team that Gemini Lake systems should
+use updated timing parameters that differ from those used in Broxton
+based systems.
+
+Fixes: f80e78aa11ad ("mfd: intel-lpss: Add Intel Gemini Lake PCI IDs")
+Tested-by: Chris Chiu <chiu@endlessm.com>
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/intel-lpss-pci.c | 28 ++++++++++++++++++++--------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -126,6 +126,18 @@ static const struct intel_lpss_platform_
+ .properties = apl_i2c_properties,
+ };
+
++static struct property_entry glk_i2c_properties[] = {
++ PROPERTY_ENTRY_U32("i2c-sda-hold-time-ns", 313),
++ PROPERTY_ENTRY_U32("i2c-sda-falling-time-ns", 171),
++ PROPERTY_ENTRY_U32("i2c-scl-falling-time-ns", 290),
++ { },
++};
++
++static const struct intel_lpss_platform_info glk_i2c_info = {
++ .clk_rate = 133000000,
++ .properties = glk_i2c_properties,
++};
++
+ static const struct intel_lpss_platform_info cnl_i2c_info = {
+ .clk_rate = 216000000,
+ .properties = spt_i2c_properties,
+@@ -165,14 +177,14 @@ static const struct pci_device_id intel_
+ { PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info },
+ /* GLK */
+- { PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31b0), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31b2), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31b4), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31b6), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31b8), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31ba), (kernel_ulong_t)&bxt_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31b0), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31b2), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31b4), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31b6), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31b8), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31ba), (kernel_ulong_t)&glk_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x31bc), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x31be), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x31c0), (kernel_ulong_t)&bxt_uart_info },
--- /dev/null
+From 15e14f76f85f4f0eab3b8146e1cd3c58ce272823 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 21 Sep 2019 10:44:01 +0200
+Subject: mt7601u: fix bbp version check in mt7601u_wait_bbp_ready
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+commit 15e14f76f85f4f0eab3b8146e1cd3c58ce272823 upstream.
+
+Fix bbp ready check in mt7601u_wait_bbp_ready. The issue is reported by
+coverity with the following error:
+
+Logical vs. bitwise operator
+The expression's value does not depend on the operands; inadvertent use
+of the wrong operator is a likely logic error.
+
+Addresses-Coverity-ID: 1309441 ("Logical vs. bitwise operator")
+Fixes: c869f77d6abb ("add mt7601u driver")
+Acked-by: Jakub Kicinski <kubakici@wp.pl>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/mediatek/mt7601u/phy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/mediatek/mt7601u/phy.c
++++ b/drivers/net/wireless/mediatek/mt7601u/phy.c
+@@ -221,7 +221,7 @@ int mt7601u_wait_bbp_ready(struct mt7601
+
+ do {
+ val = mt7601u_bbp_rr(dev, MT_BBP_REG_VERSION);
+- if (val && ~val)
++ if (val && val != 0xff)
+ break;
+ } while (--i);
+
--- /dev/null
+From fea7fda7f50a6059220f83251e70709e45cc8040 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 3 Oct 2019 11:43:51 -0700
+Subject: net: phy: broadcom: Fix RGMII delays configuration for BCM54210E
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+commit fea7fda7f50a6059220f83251e70709e45cc8040 upstream.
+
+Commit 0fc9ae107669 ("net: phy: broadcom: add support for
+BCM54210E") added support for BCM54210E but also unconditionally cleared
+the RXC to RXD skew and the TXD to TXC skew, thus only making
+PHY_INTERFACE_MODE_RGMII a possible configuration. Use
+bcm54xx_config_clock_delay() which correctly sets the registers
+depending on the 4 possible PHY interface values that exist for RGMII.
+
+Fixes: 0fc9ae107669 ("net: phy: broadcom: add support for BCM54210E")
+Reported-by: Manasa Mudireddy <manasa.mudireddy@broadcom.com>
+Reported-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/phy/broadcom.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -30,18 +30,13 @@ MODULE_DESCRIPTION("Broadcom PHY driver"
+ MODULE_AUTHOR("Maciej W. Rozycki");
+ MODULE_LICENSE("GPL");
+
++static int bcm54xx_config_clock_delay(struct phy_device *phydev);
++
+ static int bcm54210e_config_init(struct phy_device *phydev)
+ {
+ int val;
+
+- val = bcm54xx_auxctl_read(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC);
+- val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN;
+- val |= MII_BCM54XX_AUXCTL_MISC_WREN;
+- bcm54xx_auxctl_write(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC, val);
+-
+- val = bcm_phy_read_shadow(phydev, BCM54810_SHD_CLK_CTL);
+- val &= ~BCM54810_SHD_CLK_CTL_GTXCLK_EN;
+- bcm_phy_write_shadow(phydev, BCM54810_SHD_CLK_CTL, val);
++ bcm54xx_config_clock_delay(phydev);
+
+ if (phydev->dev_flags & PHY_BRCM_EN_MASTER_MODE) {
+ val = phy_read(phydev, MII_CTRL1000);
--- /dev/null
+From b6afd1234cf93aa0d71b4be4788c47534905f0be Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Wed, 4 Dec 2019 11:50:15 +0000
+Subject: powerpc/archrandom: fix arch_get_random_seed_int()
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit b6afd1234cf93aa0d71b4be4788c47534905f0be upstream.
+
+Commit 01c9348c7620ec65
+
+ powerpc: Use hardware RNG for arch_get_random_seed_* not arch_get_random_*
+
+updated arch_get_random_[int|long]() to be NOPs, and moved the hardware
+RNG backing to arch_get_random_seed_[int|long]() instead. However, it
+failed to take into account that arch_get_random_int() was implemented
+in terms of arch_get_random_long(), and so we ended up with a version
+of the former that is essentially a NOP as well.
+
+Fix this by calling arch_get_random_seed_long() from
+arch_get_random_seed_int() instead.
+
+Fixes: 01c9348c7620ec65 ("powerpc: Use hardware RNG for arch_get_random_seed_* not arch_get_random_*")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20191204115015.18015-1-ardb@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/archrandom.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/include/asm/archrandom.h
++++ b/arch/powerpc/include/asm/archrandom.h
+@@ -28,7 +28,7 @@ static inline int arch_get_random_seed_i
+ unsigned long val;
+ int rc;
+
+- rc = arch_get_random_long(&val);
++ rc = arch_get_random_seed_long(&val);
+ if (rc)
+ *v = val;
+
--- /dev/null
+From 0a87ccd3699983645f54cafd2258514a716b20b8 Mon Sep 17 00:00:00 2001
+From: Tyrel Datwyler <tyreld@linux.ibm.com>
+Date: Sun, 10 Nov 2019 23:21:37 -0600
+Subject: powerpc/pseries: Enable support for ibm,drc-info property
+
+From: Tyrel Datwyler <tyreld@linux.ibm.com>
+
+commit 0a87ccd3699983645f54cafd2258514a716b20b8 upstream.
+
+Advertise client support for the PAPR architected ibm,drc-info device
+tree property during CAS handshake.
+
+Fixes: c7a3275e0f9e ("powerpc/pseries: Revert support for ibm,drc-info devtree property")
+Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1573449697-5448-11-git-send-email-tyreld@linux.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/prom_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/prom_init.c
++++ b/arch/powerpc/kernel/prom_init.c
+@@ -904,7 +904,7 @@ struct ibm_arch_vec __cacheline_aligned
+ .reserved2 = 0,
+ .reserved3 = 0,
+ .subprocessors = 1,
+- .byte22 = OV5_FEAT(OV5_DRMEM_V2),
++ .byte22 = OV5_FEAT(OV5_DRMEM_V2) | OV5_FEAT(OV5_DRC_INFO),
+ .intarch = 0,
+ .mmu = 0,
+ .hash_ext = 0,
revert-efi-fix-debugobjects-warning-on-efi_rts_work.patch
+xfs-sanity-check-flags-of-q_xquotarm-call.patch
+i2c-stm32f7-rework-slave_id-allocation.patch
+i2c-i2c-stm32f7-fix-10-bits-check-in-slave-free-id-search-loop.patch
+mfd-intel-lpss-add-default-i2c-device-properties-for-gemini-lake.patch
+sunrpc-fix-svcauth_gss_proxy_init.patch
+powerpc-pseries-enable-support-for-ibm-drc-info-property.patch
+powerpc-archrandom-fix-arch_get_random_seed_int.patch
+tipc-update-mon-s-self-addr-when-node-addr-generated.patch
+tipc-fix-wrong-timeout-input-for-tipc_wait_for_cond.patch
+net-phy-broadcom-fix-rgmii-delays-configuration-for-bcm54210e.patch
+mt7601u-fix-bbp-version-check-in-mt7601u_wait_bbp_ready.patch
--- /dev/null
+From 5866efa8cbfbadf3905072798e96652faf02dbe8 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Thu, 24 Oct 2019 09:34:16 -0400
+Subject: SUNRPC: Fix svcauth_gss_proxy_init()
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 5866efa8cbfbadf3905072798e96652faf02dbe8 upstream.
+
+gss_read_proxy_verf() assumes things about the XDR buffer containing
+the RPC Call that are not true for buffers generated by
+svc_rdma_recv().
+
+RDMA's buffers look more like what the upper layer generates for
+sending: head is a kmalloc'd buffer; it does not point to a page
+whose contents are contiguous with the first page in the buffers'
+page array. The result is that ACCEPT_SEC_CONTEXT via RPC/RDMA has
+stopped working on Linux NFS servers that use gssproxy.
+
+This does not affect clients that use only TCP to send their
+ACCEPT_SEC_CONTEXT operation (that's all Linux clients). Other
+clients, like Solaris NFS clients, send ACCEPT_SEC_CONTEXT on the
+same transport as they send all other NFS operations. Such clients
+can send ACCEPT_SEC_CONTEXT via RPC/RDMA.
+
+I thought I had found every direct reference in the server RPC code
+to the rqstp->rq_pages field.
+
+Bug found at the 2019 Westford NFS bake-a-thon.
+
+Fixes: 3316f0631139 ("svcrdma: Persistently allocate and DMA- ... ")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Tested-by: Bill Baker <bill.baker@oracle.com>
+Reviewed-by: Simo Sorce <simo@redhat.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/auth_gss/svcauth_gss.c | 84 ++++++++++++++++++++++++++++----------
+ 1 file changed, 63 insertions(+), 21 deletions(-)
+
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -1054,24 +1054,32 @@ gss_read_verf(struct rpc_gss_wire_cred *
+ return 0;
+ }
+
+-/* Ok this is really heavily depending on a set of semantics in
+- * how rqstp is set up by svc_recv and pages laid down by the
+- * server when reading a request. We are basically guaranteed that
+- * the token lays all down linearly across a set of pages, starting
+- * at iov_base in rq_arg.head[0] which happens to be the first of a
+- * set of pages stored in rq_pages[].
+- * rq_arg.head[0].iov_base will provide us the page_base to pass
+- * to the upcall.
+- */
+-static inline int
+-gss_read_proxy_verf(struct svc_rqst *rqstp,
+- struct rpc_gss_wire_cred *gc, __be32 *authp,
+- struct xdr_netobj *in_handle,
+- struct gssp_in_token *in_token)
++static void gss_free_in_token_pages(struct gssp_in_token *in_token)
+ {
+- struct kvec *argv = &rqstp->rq_arg.head[0];
+ u32 inlen;
+- int res;
++ int i;
++
++ i = 0;
++ inlen = in_token->page_len;
++ while (inlen) {
++ if (in_token->pages[i])
++ put_page(in_token->pages[i]);
++ inlen -= inlen > PAGE_SIZE ? PAGE_SIZE : inlen;
++ }
++
++ kfree(in_token->pages);
++ in_token->pages = NULL;
++}
++
++static int gss_read_proxy_verf(struct svc_rqst *rqstp,
++ struct rpc_gss_wire_cred *gc, __be32 *authp,
++ struct xdr_netobj *in_handle,
++ struct gssp_in_token *in_token)
++{
++ struct kvec *argv = &rqstp->rq_arg.head[0];
++ unsigned int page_base, length;
++ int pages, i, res;
++ size_t inlen;
+
+ res = gss_read_common_verf(gc, argv, authp, in_handle);
+ if (res)
+@@ -1081,10 +1089,36 @@ gss_read_proxy_verf(struct svc_rqst *rqs
+ if (inlen > (argv->iov_len + rqstp->rq_arg.page_len))
+ return SVC_DENIED;
+
+- in_token->pages = rqstp->rq_pages;
+- in_token->page_base = (ulong)argv->iov_base & ~PAGE_MASK;
++ pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
++ in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
++ if (!in_token->pages)
++ return SVC_DENIED;
++ in_token->page_base = 0;
+ in_token->page_len = inlen;
++ for (i = 0; i < pages; i++) {
++ in_token->pages[i] = alloc_page(GFP_KERNEL);
++ if (!in_token->pages[i]) {
++ gss_free_in_token_pages(in_token);
++ return SVC_DENIED;
++ }
++ }
+
++ length = min_t(unsigned int, inlen, argv->iov_len);
++ memcpy(page_address(in_token->pages[0]), argv->iov_base, length);
++ inlen -= length;
++
++ i = 1;
++ page_base = rqstp->rq_arg.page_base;
++ while (inlen) {
++ length = min_t(unsigned int, inlen, PAGE_SIZE);
++ memcpy(page_address(in_token->pages[i]),
++ page_address(rqstp->rq_arg.pages[i]) + page_base,
++ length);
++
++ inlen -= length;
++ page_base = 0;
++ i++;
++ }
+ return 0;
+ }
+
+@@ -1259,8 +1293,11 @@ static int svcauth_gss_proxy_init(struct
+ break;
+ case GSS_S_COMPLETE:
+ status = gss_proxy_save_rsc(sn->rsc_cache, &ud, &handle);
+- if (status)
++ if (status) {
++ pr_info("%s: gss_proxy_save_rsc failed (%d)\n",
++ __func__, status);
+ goto out;
++ }
+ cli_handle.data = (u8 *)&handle;
+ cli_handle.len = sizeof(handle);
+ break;
+@@ -1271,15 +1308,20 @@ static int svcauth_gss_proxy_init(struct
+
+ /* Got an answer to the upcall; use it: */
+ if (gss_write_init_verf(sn->rsc_cache, rqstp,
+- &cli_handle, &ud.major_status))
++ &cli_handle, &ud.major_status)) {
++ pr_info("%s: gss_write_init_verf failed\n", __func__);
+ goto out;
++ }
+ if (gss_write_resv(resv, PAGE_SIZE,
+ &cli_handle, &ud.out_token,
+- ud.major_status, ud.minor_status))
++ ud.major_status, ud.minor_status)) {
++ pr_info("%s: gss_write_resv failed\n", __func__);
+ goto out;
++ }
+
+ ret = SVC_COMPLETE;
+ out:
++ gss_free_in_token_pages(&ud.in_token);
+ gssp_free_upcall_data(&ud);
+ return ret;
+ }
--- /dev/null
+From 12db3c8083fcab4270866a88191933f2d9f24f89 Mon Sep 17 00:00:00 2001
+From: Tung Nguyen <tung.q.nguyen@dektech.com.au>
+Date: Thu, 28 Nov 2019 10:10:07 +0700
+Subject: tipc: fix wrong timeout input for tipc_wait_for_cond()
+
+From: Tung Nguyen <tung.q.nguyen@dektech.com.au>
+
+commit 12db3c8083fcab4270866a88191933f2d9f24f89 upstream.
+
+In function __tipc_shutdown(), the timeout value passed to
+tipc_wait_for_cond() is not jiffies.
+
+This commit fixes it by converting that value from milliseconds
+to jiffies.
+
+Fixes: 365ad353c256 ("tipc: reduce risk of user starvation during link congestion")
+Signed-off-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
+Acked-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/tipc/socket.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -501,7 +501,7 @@ static void __tipc_shutdown(struct socke
+ struct sock *sk = sock->sk;
+ struct tipc_sock *tsk = tipc_sk(sk);
+ struct net *net = sock_net(sk);
+- long timeout = CONN_TIMEOUT_DEFAULT;
++ long timeout = msecs_to_jiffies(CONN_TIMEOUT_DEFAULT);
+ u32 dnode = tsk_peer_node(tsk);
+ struct sk_buff *skb;
+
--- /dev/null
+From 46cb01eeeb86fca6afe24dda1167b0cb95424e29 Mon Sep 17 00:00:00 2001
+From: Hoang Le <hoang.h.le@dektech.com.au>
+Date: Tue, 12 Nov 2019 07:40:04 +0700
+Subject: tipc: update mon's self addr when node addr generated
+
+From: Hoang Le <hoang.h.le@dektech.com.au>
+
+commit 46cb01eeeb86fca6afe24dda1167b0cb95424e29 upstream.
+
+In commit 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address
+hash values"), the 32-bit node address only generated after one second
+trial period expired. However the self's addr in struct tipc_monitor do
+not update according to node address generated. This lead to it is
+always zero as initial value. As result, sorting algorithm using this
+value does not work as expected, neither neighbor monitoring framework.
+
+In this commit, we add a fix to update self's addr when 32-bit node
+address generated.
+
+Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values")
+Acked-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/tipc/monitor.c | 15 +++++++++++++++
+ net/tipc/monitor.h | 1 +
+ net/tipc/net.c | 2 ++
+ 3 files changed, 18 insertions(+)
+
+--- a/net/tipc/monitor.c
++++ b/net/tipc/monitor.c
+@@ -665,6 +665,21 @@ void tipc_mon_delete(struct net *net, in
+ kfree(mon);
+ }
+
++void tipc_mon_reinit_self(struct net *net)
++{
++ struct tipc_monitor *mon;
++ int bearer_id;
++
++ for (bearer_id = 0; bearer_id < MAX_BEARERS; bearer_id++) {
++ mon = tipc_monitor(net, bearer_id);
++ if (!mon)
++ continue;
++ write_lock_bh(&mon->lock);
++ mon->self->addr = tipc_own_addr(net);
++ write_unlock_bh(&mon->lock);
++ }
++}
++
+ int tipc_nl_monitor_set_threshold(struct net *net, u32 cluster_size)
+ {
+ struct tipc_net *tn = tipc_net(net);
+--- a/net/tipc/monitor.h
++++ b/net/tipc/monitor.h
+@@ -77,6 +77,7 @@ int __tipc_nl_add_monitor(struct net *ne
+ u32 bearer_id);
+ int tipc_nl_add_monitor_peer(struct net *net, struct tipc_nl_msg *msg,
+ u32 bearer_id, u32 *prev_node);
++void tipc_mon_reinit_self(struct net *net);
+
+ extern const int tipc_max_domain_size;
+ #endif
+--- a/net/tipc/net.c
++++ b/net/tipc/net.c
+@@ -42,6 +42,7 @@
+ #include "node.h"
+ #include "bcast.h"
+ #include "netlink.h"
++#include "monitor.h"
+
+ /*
+ * The TIPC locking policy is designed to ensure a very fine locking
+@@ -136,6 +137,7 @@ static void tipc_net_finalize(struct net
+ tipc_set_node_addr(net, addr);
+ tipc_named_reinit(net);
+ tipc_sk_reinit(net);
++ tipc_mon_reinit_self(net);
+ tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
+ TIPC_CLUSTER_SCOPE, 0, addr);
+ }
--- /dev/null
+From 3dd4d40b420846dd35869ccc8f8627feef2cff32 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 23 Oct 2019 17:00:45 -0700
+Subject: xfs: Sanity check flags of Q_XQUOTARM call
+
+From: Jan Kara <jack@suse.cz>
+
+commit 3dd4d40b420846dd35869ccc8f8627feef2cff32 upstream.
+
+Flags passed to Q_XQUOTARM were not sanity checked for invalid values.
+Fix that.
+
+Fixes: 9da93f9b7cdf ("xfs: fix Q_XQUOTARM ioctl")
+Reported-by: Yang Xu <xuyang2018.jy@cn.fujitsu.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_quotaops.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/xfs/xfs_quotaops.c
++++ b/fs/xfs/xfs_quotaops.c
+@@ -202,6 +202,9 @@ xfs_fs_rm_xquota(
+ if (XFS_IS_QUOTA_ON(mp))
+ return -EINVAL;
+
++ if (uflags & ~(FS_USER_QUOTA | FS_GROUP_QUOTA | FS_PROJ_QUOTA))
++ return -EINVAL;
++
+ if (uflags & FS_USER_QUOTA)
+ flags |= XFS_DQ_USER;
+ if (uflags & FS_GROUP_QUOTA)
projects / thirdparty / kernel / stable-queue.git / commitdiff
