--- /dev/null
+From b3fb22733ae61050f8d10a1d6a8af176c5c5db1a Mon Sep 17 00:00:00 2001
+From: Ondrej Zary <linux@rainbow-software.org>
+Date: Fri, 9 Mar 2018 23:22:04 +0100
+Subject: drm/i915: Disable LVDS on Radiant P845
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ondrej Zary <linux@rainbow-software.org>
+
+commit b3fb22733ae61050f8d10a1d6a8af176c5c5db1a upstream.
+
+Radiant P845 does not have LVDS, only VGA.
+
+Cc: stable@vger.kernel.org
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105468
+Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180309222204.4771-1-linux@rainbow-software.org
+(cherry picked from commit 7f7105f99b75aca4f8c2a748ed6b82c7f8be3293)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_lvds.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -845,6 +845,14 @@ static const struct dmi_system_id intel_
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "D525MW"),
+ },
+ },
++ {
++ .callback = intel_no_lvds_dmi_callback,
++ .ident = "Radiant P845",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Radiant Systems Inc"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P845"),
++ },
++ },
+
+ { } /* terminating entry */
+ };
--- /dev/null
+From b9eb9c92899a509fe258d38dd6c214b1de69eee0 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Fri, 18 May 2018 08:48:40 +0100
+Subject: drm/i915/lvds: Move acpi lid notification registration to registration phase
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit b9eb9c92899a509fe258d38dd6c214b1de69eee0 upstream.
+
+Delay registering ourselves with the acpi lid notification mechanism
+until we are registering the connectors after initialisation is
+complete. This prevents a possibility of trying to handle the lid
+notification before we are ready with the danger of chasing
+uninitialised function pointers.
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
+ IP: (null)
+ PGD 0 P4D 0
+ Oops: 0010 [#1] PREEMPT SMP PTI
+ Modules linked in: arc4(+) iwldvm(+) i915(+) mac80211 i2c_algo_bit coretemp mei_wdt iwlwifi drm_kms_helper kvm_intel wmi_bmof iTCO_wdt iTCO_vendor_support kvm snd_hda_codec_conexant snd_hda_codec_generic drm psmouse cfg80211 irqbypass input_leds pcspkr i2c_i801 snd_hda_intel snd_hda_codec thinkpad_acpi snd_hda_core mei_me lpc_ich snd_hwdep e1000e wmi nvram snd_pcm mei snd_timer shpchp ptp pps_core rfkill syscopyarea snd intel_agp sysfillrect intel_gtt soundcore sysimgblt battery led_class fb_sys_fops ac rtc_cmos agpgart evdev mac_hid acpi_cpufreq ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 fscrypto crypto_simd glue_helper cryptd aes_x86_64 xts algif_skcipher af_alg dm_crypt dm_mod sd_mod uas usb_storage serio_raw atkbd libps2 ahci libahci uhci_hcd libata scsi_mod ehci_pci
+ ehci_hcd usbcore usb_common i8042 serio
+ CPU: 1 PID: 378 Comm: systemd-logind Not tainted 4.16.8-1-ARCH #1
+ Hardware name: LENOVO 7454CTO/7454CTO, BIOS 6DET72WW (3.22 ) 10/25/2012
+ RIP: 0010: (null)
+ RSP: 0018:ffffaf4580c33a18 EFLAGS: 00010287
+ RAX: 0000000000000000 RBX: ffff947533558000 RCX: 000000000000003e
+ RDX: ffffffffc0aa80c0 RSI: ffffaf4580c33a3c RDI: ffff947534e4c000
+ RBP: ffff947533558338 R08: ffff947534598930 R09: ffffffffc0a928b1
+ R10: ffffd8f181d5fd40 R11: 0000000000000000 R12: ffffffffc0a928b1
+ R13: ffff947533558368 R14: ffffffffc0a928a9 R15: ffff947534e4c000
+ FS: 00007f3dc4ddb940(0000) GS:ffff947539280000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000000 CR3: 000000006e214000 CR4: 00000000000406e0
+ Call Trace:
+ ? intel_modeset_setup_hw_state+0x385/0xf60 [i915]
+ ? __intel_display_resume+0x1e/0xc0 [i915]
+ ? intel_display_resume+0xcc/0x120 [i915]
+ ? intel_lid_notify+0xbc/0xc0 [i915]
+ ? notifier_call_chain+0x47/0x70
+ ? blocking_notifier_call_chain+0x3e/0x60
+ ? acpi_lid_notify_state+0x8f/0x1d0
+ ? acpi_lid_update_state+0x49/0x70
+ ? acpi_lid_input_open+0x60/0x90
+ ? input_open_device+0x5d/0xa0
+ ? evdev_open+0x1ba/0x1e0 [evdev]
+ ? chrdev_open+0xa3/0x1b0
+ ? cdev_put.part.0+0x20/0x20
+ ? do_dentry_open+0x14c/0x300
+ ? path_openat+0x30c/0x1240
+ ? current_time+0x16/0x60
+ ? do_filp_open+0x93/0x100
+ ? __check_object_size+0xfb/0x180
+ ? do_sys_open+0x186/0x210
+ ? do_syscall_64+0x74/0x190
+ ? entry_SYSCALL_64_after_hwframe+0x3d/0xa2
+ Code: Bad RIP value.
+ RIP: (null) RSP: ffffaf4580c33a18
+ CR2: 0000000000000000
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=106559
+Fixes: c1c7af608920 ("drm/i915: force mode set at lid open time")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180518074840.16194-1-chris@chris-wilson.co.uk
+Cc: stable@vger.kernel.org
+(cherry picked from commit e578a570dc7c20475774d1ff993825e3bd7a7011)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_lvds.c | 43 ++++++++++++++++++++++++++++----------
+ 1 file changed, 32 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -565,6 +565,36 @@ exit:
+ return NOTIFY_OK;
+ }
+
++static int
++intel_lvds_connector_register(struct drm_connector *connector)
++{
++ struct intel_lvds_connector *lvds = to_lvds_connector(connector);
++ int ret;
++
++ ret = intel_connector_register(connector);
++ if (ret)
++ return ret;
++
++ lvds->lid_notifier.notifier_call = intel_lid_notify;
++ if (acpi_lid_notifier_register(&lvds->lid_notifier)) {
++ DRM_DEBUG_KMS("lid notifier registration failed\n");
++ lvds->lid_notifier.notifier_call = NULL;
++ }
++
++ return 0;
++}
++
++static void
++intel_lvds_connector_unregister(struct drm_connector *connector)
++{
++ struct intel_lvds_connector *lvds = to_lvds_connector(connector);
++
++ if (lvds->lid_notifier.notifier_call)
++ acpi_lid_notifier_unregister(&lvds->lid_notifier);
++
++ intel_connector_unregister(connector);
++}
++
+ /**
+ * intel_lvds_destroy - unregister and free LVDS structures
+ * @connector: connector to free
+@@ -577,9 +607,6 @@ static void intel_lvds_destroy(struct dr
+ struct intel_lvds_connector *lvds_connector =
+ to_lvds_connector(connector);
+
+- if (lvds_connector->lid_notifier.notifier_call)
+- acpi_lid_notifier_unregister(&lvds_connector->lid_notifier);
+-
+ if (!IS_ERR_OR_NULL(lvds_connector->base.edid))
+ kfree(lvds_connector->base.edid);
+
+@@ -600,8 +627,8 @@ static const struct drm_connector_funcs
+ .fill_modes = drm_helper_probe_single_connector_modes,
+ .atomic_get_property = intel_digital_connector_atomic_get_property,
+ .atomic_set_property = intel_digital_connector_atomic_set_property,
+- .late_register = intel_connector_register,
+- .early_unregister = intel_connector_unregister,
++ .late_register = intel_lvds_connector_register,
++ .early_unregister = intel_lvds_connector_unregister,
+ .destroy = intel_lvds_destroy,
+ .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+ .atomic_duplicate_state = intel_digital_connector_duplicate_state,
+@@ -1149,12 +1176,6 @@ out:
+
+ lvds_encoder->a3_power = lvds & LVDS_A3_POWER_MASK;
+
+- lvds_connector->lid_notifier.notifier_call = intel_lid_notify;
+- if (acpi_lid_notifier_register(&lvds_connector->lid_notifier)) {
+- DRM_DEBUG_KMS("lid notifier registration failed\n");
+- lvds_connector->lid_notifier.notifier_call = NULL;
+- }
+-
+ return;
+
+ failed:
--- /dev/null
+From bdcc02cf1bb508fc700df7662f55058f651f2621 Mon Sep 17 00:00:00 2001
+From: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Date: Fri, 11 May 2018 12:51:42 -0700
+Subject: drm/psr: Fix missed entry in PSR setup time table.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+
+commit bdcc02cf1bb508fc700df7662f55058f651f2621 upstream.
+
+Entry corresponding to 220 us setup time was missing. I am not aware of
+any specific bug this fixes, but this could potentially result in enabling
+PSR on a panel with a higher setup time requirement than supported by the
+hardware.
+
+I verified the value is present in eDP spec versions 1.3, 1.4 and 1.4a.
+
+Fixes: 6608804b3d7f ("drm/dp: Add drm_dp_psr_setup_time()")
+Cc: stable@vger.kernel.org
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Jose Roberto de Souza <jose.souza@intel.com>
+Cc: dri-devel@lists.freedesktop.org
+Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
+Reviewed-by: Tarun Vyas <tarun.vyas@intel.com>
+Signed-off-by: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180511195145.3829-3-dhinakaran.pandiyan@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_helper.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/drm_dp_helper.c
++++ b/drivers/gpu/drm/drm_dp_helper.c
+@@ -1139,6 +1139,7 @@ int drm_dp_psr_setup_time(const u8 psr_c
+ static const u16 psr_setup_time_us[] = {
+ PSR_SETUP_TIME(330),
+ PSR_SETUP_TIME(275),
++ PSR_SETUP_TIME(220),
+ PSR_SETUP_TIME(165),
+ PSR_SETUP_TIME(110),
+ PSR_SETUP_TIME(55),
--- /dev/null
+From 806e30873f0e74d9d41b0ef761bd4d3e55c7d510 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Sat, 26 May 2018 08:49:24 +0200
+Subject: hwtracing: stm: fix build error on some arches
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 806e30873f0e74d9d41b0ef761bd4d3e55c7d510 upstream.
+
+Commit b5e2ced9bf81 ("stm class: Use vmalloc for the master map") caused
+a build error on some arches as vmalloc.h was not explicitly included.
+
+Fix that by adding it to the list of includes.
+
+Fixes: b5e2ced9bf81 ("stm class: Use vmalloc for the master map")
+Reported-by: kbuild test robot <lkp@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -27,6 +27,7 @@
+ #include <linux/stm.h>
+ #include <linux/fs.h>
+ #include <linux/mm.h>
++#include <linux/vmalloc.h>
+ #include "stm.h"
+
+ #include <uapi/linux/stm.h>
--- /dev/null
+From a840c93ca7582bb6c88df2345a33f979b7a67874 Mon Sep 17 00:00:00 2001
+From: Parav Pandit <parav@mellanox.com>
+Date: Sun, 27 May 2018 14:49:16 +0300
+Subject: IB/core: Fix error code for invalid GID entry
+
+From: Parav Pandit <parav@mellanox.com>
+
+commit a840c93ca7582bb6c88df2345a33f979b7a67874 upstream.
+
+When a GID entry is invalid EAGAIN is returned. This is an incorrect error
+code, there is nothing that will make this GID entry valid again in
+bounded time.
+
+Some user space tools fail incorrectly if EAGAIN is returned here, and
+this represents a small ABI change from earlier kernels.
+
+The first patch in the Fixes list makes entries that were valid before
+to become invalid, allowing this code to trigger, while the second patch
+in the Fixes list introduced the wrong EAGAIN.
+
+Therefore revert the return result to EINVAL which matches the historical
+expectations of the ibv_query_gid_type() API of the libibverbs user space
+library.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 598ff6bae689 ("IB/core: Refactor GID modify code for RoCE")
+Fixes: 03db3a2d81e6 ("IB/core: Add RoCE GID table management")
+Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/cache.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/cache.c
++++ b/drivers/infiniband/core/cache.c
+@@ -434,7 +434,7 @@ static int __ib_cache_gid_get(struct ib_
+ return -EINVAL;
+
+ if (table->data_vec[index].props & GID_TABLE_ENTRY_INVALID)
+- return -EAGAIN;
++ return -EINVAL;
+
+ memcpy(gid, &table->data_vec[index].gid, sizeof(*gid));
+ if (attr) {
--- /dev/null
+From 490fba90a90eb7b741f57fefd2bcf2c1e11eb471 Mon Sep 17 00:00:00 2001
+From: Michael Nosthoff <committed@heine.so>
+Date: Fri, 9 Mar 2018 16:13:52 +0100
+Subject: iio: ad7793: implement IIO_CHAN_INFO_SAMP_FREQ
+
+From: Michael Nosthoff <committed@heine.so>
+
+commit 490fba90a90eb7b741f57fefd2bcf2c1e11eb471 upstream.
+
+This commit is a follow-up to changes made to ad_sigma_delta.h
+in staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ
+which broke ad7793 as it was not altered to match those changes.
+
+This driver predates the availability of IIO_CHAN_INFO_SAMP_FREQ
+attribute wherein usage has some advantages like it can be accessed by
+in-kernel consumers as well as reduces the code size.
+
+Therefore, use IIO_CHAN_INFO_SAMP_FREQ to implement the
+sampling_frequency attribute instead of using IIO_DEV_ATTR_SAMP_FREQ()
+macro.
+
+Move code from the functions associated with IIO_DEV_ATTR_SAMP_FREQ()
+into respective read and write hooks with the mask set to
+IIO_CHAN_INFO_SAMP_FREQ.
+
+Fixes: a13e831fcaa7 ("staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ")
+
+Signed-off-by: Michael Nosthoff <committed@heine.so>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/ad7793.c | 75 +++++++++++++++--------------------------------
+ 1 file changed, 24 insertions(+), 51 deletions(-)
+
+--- a/drivers/iio/adc/ad7793.c
++++ b/drivers/iio/adc/ad7793.c
+@@ -348,55 +348,6 @@ static const u16 ad7793_sample_freq_avai
+ static const u16 ad7797_sample_freq_avail[16] = {0, 0, 0, 123, 62, 50, 0,
+ 33, 0, 17, 16, 12, 10, 8, 6, 4};
+
+-static ssize_t ad7793_read_frequency(struct device *dev,
+- struct device_attribute *attr,
+- char *buf)
+-{
+- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+- struct ad7793_state *st = iio_priv(indio_dev);
+-
+- return sprintf(buf, "%d\n",
+- st->chip_info->sample_freq_avail[AD7793_MODE_RATE(st->mode)]);
+-}
+-
+-static ssize_t ad7793_write_frequency(struct device *dev,
+- struct device_attribute *attr,
+- const char *buf,
+- size_t len)
+-{
+- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+- struct ad7793_state *st = iio_priv(indio_dev);
+- long lval;
+- int i, ret;
+-
+- ret = kstrtol(buf, 10, &lval);
+- if (ret)
+- return ret;
+-
+- if (lval == 0)
+- return -EINVAL;
+-
+- for (i = 0; i < 16; i++)
+- if (lval == st->chip_info->sample_freq_avail[i])
+- break;
+- if (i == 16)
+- return -EINVAL;
+-
+- ret = iio_device_claim_direct_mode(indio_dev);
+- if (ret)
+- return ret;
+- st->mode &= ~AD7793_MODE_RATE(-1);
+- st->mode |= AD7793_MODE_RATE(i);
+- ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode), st->mode);
+- iio_device_release_direct_mode(indio_dev);
+-
+- return len;
+-}
+-
+-static IIO_DEV_ATTR_SAMP_FREQ(S_IWUSR | S_IRUGO,
+- ad7793_read_frequency,
+- ad7793_write_frequency);
+-
+ static IIO_CONST_ATTR_SAMP_FREQ_AVAIL(
+ "470 242 123 62 50 39 33 19 17 16 12 10 8 6 4");
+
+@@ -424,7 +375,6 @@ static IIO_DEVICE_ATTR_NAMED(in_m_in_sca
+ ad7793_show_scale_available, NULL, 0);
+
+ static struct attribute *ad7793_attributes[] = {
+- &iio_dev_attr_sampling_frequency.dev_attr.attr,
+ &iio_const_attr_sampling_frequency_available.dev_attr.attr,
+ &iio_dev_attr_in_m_in_scale_available.dev_attr.attr,
+ NULL
+@@ -435,7 +385,6 @@ static const struct attribute_group ad77
+ };
+
+ static struct attribute *ad7797_attributes[] = {
+- &iio_dev_attr_sampling_frequency.dev_attr.attr,
+ &iio_const_attr_sampling_frequency_available_ad7797.dev_attr.attr,
+ NULL
+ };
+@@ -505,6 +454,10 @@ static int ad7793_read_raw(struct iio_de
+ *val -= offset;
+ }
+ return IIO_VAL_INT;
++ case IIO_CHAN_INFO_SAMP_FREQ:
++ *val = st->chip_info
++ ->sample_freq_avail[AD7793_MODE_RATE(st->mode)];
++ return IIO_VAL_INT;
+ }
+ return -EINVAL;
+ }
+@@ -542,6 +495,26 @@ static int ad7793_write_raw(struct iio_d
+ break;
+ }
+ break;
++ case IIO_CHAN_INFO_SAMP_FREQ:
++ if (!val) {
++ ret = -EINVAL;
++ break;
++ }
++
++ for (i = 0; i < 16; i++)
++ if (val == st->chip_info->sample_freq_avail[i])
++ break;
++
++ if (i == 16) {
++ ret = -EINVAL;
++ break;
++ }
++
++ st->mode &= ~AD7793_MODE_RATE(-1);
++ st->mode |= AD7793_MODE_RATE(i);
++ ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode),
++ st->mode);
++ break;
+ default:
+ ret = -EINVAL;
+ }
--- /dev/null
+From 76974ef9d1bf397b7bb97892a3b3bc516a1fc2c2 Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Mon, 16 Apr 2018 09:54:03 +0300
+Subject: iio: adc: select buffer for at91-sama5d2_adc
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+commit 76974ef9d1bf397b7bb97892a3b3bc516a1fc2c2 upstream.
+
+We need to select the buffer code, otherwise we get build errors
+with undefined functions on the trigger and buffer,
+if we select just IIO and then AT91_SAMA5D2_ADC from menuconfig
+
+This adds a Kconfig 'select' statement like other ADC
+drivers have it already.
+
+Fixes: 5e1a1da0f8c9 ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support")
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/adc/Kconfig
++++ b/drivers/iio/adc/Kconfig
+@@ -158,6 +158,7 @@ config AT91_SAMA5D2_ADC
+ tristate "Atmel AT91 SAMA5D2 ADC"
+ depends on ARCH_AT91 || COMPILE_TEST
+ depends on HAS_IOMEM
++ select IIO_BUFFER
+ select IIO_TRIGGERED_BUFFER
+ help
+ Say yes here to build support for Atmel SAMA5D2 ADC which is
--- /dev/null
+From c043ec1ca5baae63726aae32abbe003192bc6eec Mon Sep 17 00:00:00 2001
+From: Martin Kelly <mkelly@xevo.com>
+Date: Mon, 26 Mar 2018 14:27:51 -0700
+Subject: iio:buffer: make length types match kfifo types
+
+From: Martin Kelly <mkelly@xevo.com>
+
+commit c043ec1ca5baae63726aae32abbe003192bc6eec upstream.
+
+Currently, we use int for buffer length and bytes_per_datum. However,
+kfifo uses unsigned int for length and size_t for element size. We need
+to make sure these matches or we will have bugs related to overflow (in
+the range between INT_MAX and UINT_MAX for length, for example).
+
+In addition, set_bytes_per_datum uses size_t while bytes_per_datum is an
+int, which would cause bugs for large values of bytes_per_datum.
+
+Change buffer length to use unsigned int and bytes_per_datum to use
+size_t.
+
+Signed-off-by: Martin Kelly <mkelly@xevo.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/buffer/industrialio-buffer-dma.c | 2 +-
+ drivers/iio/buffer/kfifo_buf.c | 4 ++--
+ include/linux/iio/buffer_impl.h | 6 +++---
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/iio/buffer/industrialio-buffer-dma.c
++++ b/drivers/iio/buffer/industrialio-buffer-dma.c
+@@ -587,7 +587,7 @@ EXPORT_SYMBOL_GPL(iio_dma_buffer_set_byt
+ * Should be used as the set_length callback for iio_buffer_access_ops
+ * struct for DMA buffers.
+ */
+-int iio_dma_buffer_set_length(struct iio_buffer *buffer, int length)
++int iio_dma_buffer_set_length(struct iio_buffer *buffer, unsigned int length)
+ {
+ /* Avoid an invalid state */
+ if (length < 2)
+--- a/drivers/iio/buffer/kfifo_buf.c
++++ b/drivers/iio/buffer/kfifo_buf.c
+@@ -22,7 +22,7 @@ struct iio_kfifo {
+ #define iio_to_kfifo(r) container_of(r, struct iio_kfifo, buffer)
+
+ static inline int __iio_allocate_kfifo(struct iio_kfifo *buf,
+- int bytes_per_datum, int length)
++ size_t bytes_per_datum, unsigned int length)
+ {
+ if ((length == 0) || (bytes_per_datum == 0))
+ return -EINVAL;
+@@ -67,7 +67,7 @@ static int iio_set_bytes_per_datum_kfifo
+ return 0;
+ }
+
+-static int iio_set_length_kfifo(struct iio_buffer *r, int length)
++static int iio_set_length_kfifo(struct iio_buffer *r, unsigned int length)
+ {
+ /* Avoid an invalid state */
+ if (length < 2)
+--- a/include/linux/iio/buffer_impl.h
++++ b/include/linux/iio/buffer_impl.h
+@@ -53,7 +53,7 @@ struct iio_buffer_access_funcs {
+ int (*request_update)(struct iio_buffer *buffer);
+
+ int (*set_bytes_per_datum)(struct iio_buffer *buffer, size_t bpd);
+- int (*set_length)(struct iio_buffer *buffer, int length);
++ int (*set_length)(struct iio_buffer *buffer, unsigned int length);
+
+ int (*enable)(struct iio_buffer *buffer, struct iio_dev *indio_dev);
+ int (*disable)(struct iio_buffer *buffer, struct iio_dev *indio_dev);
+@@ -72,10 +72,10 @@ struct iio_buffer_access_funcs {
+ */
+ struct iio_buffer {
+ /** @length: Number of datums in buffer. */
+- int length;
++ unsigned int length;
+
+ /** @bytes_per_datum: Size of individual datum including timestamp. */
+- int bytes_per_datum;
++ size_t bytes_per_datum;
+
+ /**
+ * @access: Buffer access functions associated with the
--- /dev/null
+From 3d13de4b027d5f6276c0f9d3a264f518747d83f2 Mon Sep 17 00:00:00 2001
+From: Martin Kelly <mkelly@xevo.com>
+Date: Mon, 26 Mar 2018 14:27:52 -0700
+Subject: iio:kfifo_buf: check for uint overflow
+
+From: Martin Kelly <mkelly@xevo.com>
+
+commit 3d13de4b027d5f6276c0f9d3a264f518747d83f2 upstream.
+
+Currently, the following causes a kernel OOPS in memcpy:
+
+echo 1073741825 > buffer/length
+echo 1 > buffer/enable
+
+Note that using 1073741824 instead of 1073741825 causes "write error:
+Cannot allocate memory" but no OOPS.
+
+This is because 1073741824 == 2^30 and 1073741825 == 2^30+1. Since kfifo
+rounds up to the nearest power of 2, it will actually call kmalloc with
+roundup_pow_of_two(length) * bytes_per_datum.
+
+Using length == 1073741825 and bytes_per_datum == 2, we get:
+
+kmalloc(roundup_pow_of_two(1073741825) * 2
+or kmalloc(2147483648 * 2)
+or kmalloc(4294967296)
+or kmalloc(UINT_MAX + 1)
+
+so this overflows to 0, causing kmalloc to return ZERO_SIZE_PTR and
+subsequent memcpy to fail once the device is enabled.
+
+Fix this by checking for overflow prior to allocating a kfifo. With this
+check added, the above code returns -EINVAL when enabling the buffer,
+rather than causing an OOPS.
+
+Signed-off-by: Martin Kelly <mkelly@xevo.com>
+cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/buffer/kfifo_buf.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/iio/buffer/kfifo_buf.c
++++ b/drivers/iio/buffer/kfifo_buf.c
+@@ -27,6 +27,13 @@ static inline int __iio_allocate_kfifo(s
+ if ((length == 0) || (bytes_per_datum == 0))
+ return -EINVAL;
+
++ /*
++ * Make sure we don't overflow an unsigned int after kfifo rounds up to
++ * the next power of 2.
++ */
++ if (roundup_pow_of_two(length) > UINT_MAX / bytes_per_datum)
++ return -EINVAL;
++
+ return __kfifo_alloc((struct __kfifo *)&buf->kf, length,
+ bytes_per_datum, GFP_KERNEL);
+ }
--- /dev/null
+From 0ed2424b911f3a058dfea01b78817abed767433d Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Thu, 24 May 2018 11:27:27 +0300
+Subject: intel_th: Use correct device when freeing buffers
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 0ed2424b911f3a058dfea01b78817abed767433d upstream.
+
+Commit d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU
+domain allocation") changes dma buffer allocation to use the actual
+underlying device, but forgets to change the deallocation path, which leads
+to (if you've got CAP_SYS_RAWIO):
+
+> # echo 0,0 > /sys/bus/intel_th/devices/0-msc0/nr_pages
+> ------------[ cut here ]------------
+> kernel BUG at ../linux/drivers/iommu/intel-iommu.c:3670!
+> CPU: 3 PID: 231 Comm: sh Not tainted 4.17.0-rc1+ #2729
+> RIP: 0010:intel_unmap+0x11e/0x130
+...
+> Call Trace:
+> intel_free_coherent+0x3e/0x60
+> msc_buffer_win_free+0x100/0x160 [intel_th_msu]
+
+This patch fixes the buffer deallocation code to use the correct device.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU domain allocation")
+Reported-by: Baofeng Tian <baofeng.tian@intel.com>
+CC: stable@vger.kernel.org # v4.14+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/msu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -741,8 +741,8 @@ err_nomem:
+ /* Reset the page to write-back before releasing */
+ set_memory_wb((unsigned long)win->block[i].bdesc, 1);
+ #endif
+- dma_free_coherent(msc_dev(msc), size, win->block[i].bdesc,
+- win->block[i].addr);
++ dma_free_coherent(msc_dev(msc)->parent->parent, size,
++ win->block[i].bdesc, win->block[i].addr);
+ }
+ kfree(win);
+
+@@ -777,7 +777,7 @@ static void msc_buffer_win_free(struct m
+ /* Reset the page to write-back before releasing */
+ set_memory_wb((unsigned long)win->block[i].bdesc, 1);
+ #endif
+- dma_free_coherent(msc_dev(win->msc), PAGE_SIZE,
++ dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE,
+ win->block[i].bdesc, win->block[i].addr);
+ }
+
--- /dev/null
+From 32795631e67e16141aa5e065c28ba03bf17abb90 Mon Sep 17 00:00:00 2001
+From: Mathias Kresin <dev@kresin.me>
+Date: Sun, 8 Apr 2018 10:30:03 +0200
+Subject: MIPS: lantiq: gphy: Drop reboot/remove reset asserts
+
+From: Mathias Kresin <dev@kresin.me>
+
+commit 32795631e67e16141aa5e065c28ba03bf17abb90 upstream.
+
+While doing a global software reset, these bits are not cleared and let
+some bootloader fail to initialise the GPHYs. The bootloader don't
+expect the GPHYs in reset, as they aren't during power on.
+
+The asserts were a workaround for a wrong syscon-reboot mask. With a
+mask set which includes the GPHY resets, these resets aren't required
+any more.
+
+Fixes: 126534141b45 ("MIPS: lantiq: Add a GPHY driver which uses the RCU syscon-mfd")
+Signed-off-by: Mathias Kresin <dev@kresin.me>
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: John Crispin <john@phrozen.org>
+Cc: linux-mips@linux-mips.org
+Cc: <stable@vger.kernel.org> # 4.14+
+Patchwork: https://patchwork.linux-mips.org/patch/19003/
+[jhogan@kernel.org: Fix build warnings]
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/soc/lantiq/gphy.c | 36 ------------------------------------
+ 1 file changed, 36 deletions(-)
+
+--- a/drivers/soc/lantiq/gphy.c
++++ b/drivers/soc/lantiq/gphy.c
+@@ -30,7 +30,6 @@ struct xway_gphy_priv {
+ struct clk *gphy_clk_gate;
+ struct reset_control *gphy_reset;
+ struct reset_control *gphy_reset2;
+- struct notifier_block gphy_reboot_nb;
+ void __iomem *membase;
+ char *fw_name;
+ };
+@@ -64,24 +63,6 @@ static const struct of_device_id xway_gp
+ };
+ MODULE_DEVICE_TABLE(of, xway_gphy_match);
+
+-static struct xway_gphy_priv *to_xway_gphy_priv(struct notifier_block *nb)
+-{
+- return container_of(nb, struct xway_gphy_priv, gphy_reboot_nb);
+-}
+-
+-static int xway_gphy_reboot_notify(struct notifier_block *reboot_nb,
+- unsigned long code, void *unused)
+-{
+- struct xway_gphy_priv *priv = to_xway_gphy_priv(reboot_nb);
+-
+- if (priv) {
+- reset_control_assert(priv->gphy_reset);
+- reset_control_assert(priv->gphy_reset2);
+- }
+-
+- return NOTIFY_DONE;
+-}
+-
+ static int xway_gphy_load(struct device *dev, struct xway_gphy_priv *priv,
+ dma_addr_t *dev_addr)
+ {
+@@ -205,14 +186,6 @@ static int xway_gphy_probe(struct platfo
+ reset_control_deassert(priv->gphy_reset);
+ reset_control_deassert(priv->gphy_reset2);
+
+- /* assert the gphy reset because it can hang after a reboot: */
+- priv->gphy_reboot_nb.notifier_call = xway_gphy_reboot_notify;
+- priv->gphy_reboot_nb.priority = -1;
+-
+- ret = register_reboot_notifier(&priv->gphy_reboot_nb);
+- if (ret)
+- dev_warn(dev, "Failed to register reboot notifier\n");
+-
+ platform_set_drvdata(pdev, priv);
+
+ return ret;
+@@ -220,21 +193,12 @@ static int xway_gphy_probe(struct platfo
+
+ static int xway_gphy_remove(struct platform_device *pdev)
+ {
+- struct device *dev = &pdev->dev;
+ struct xway_gphy_priv *priv = platform_get_drvdata(pdev);
+- int ret;
+-
+- reset_control_assert(priv->gphy_reset);
+- reset_control_assert(priv->gphy_reset2);
+
+ iowrite32be(0, priv->membase);
+
+ clk_disable_unprepare(priv->gphy_clk_gate);
+
+- ret = unregister_reboot_notifier(&priv->gphy_reboot_nb);
+- if (ret)
+- dev_warn(dev, "Failed to unregister reboot notifier\n");
+-
+ return 0;
+ }
+
--- /dev/null
+From 28e4213dd331e944e7fca1954a946829162ed9d4 Mon Sep 17 00:00:00 2001
+From: "Maciej W. Rozycki" <macro@mips.com>
+Date: Tue, 15 May 2018 23:04:44 +0100
+Subject: MIPS: prctl: Disallow FRE without FR with PR_SET_FP_MODE requests
+
+From: Maciej W. Rozycki <macro@mips.com>
+
+commit 28e4213dd331e944e7fca1954a946829162ed9d4 upstream.
+
+Having PR_FP_MODE_FRE (i.e. Config5.FRE) set without PR_FP_MODE_FR (i.e.
+Status.FR) is not supported as the lone purpose of Config5.FRE is to
+emulate Status.FR=0 handling on FPU hardware that has Status.FR=1
+hardwired[1][2]. Also we do not handle this case elsewhere, and assume
+throughout our code that TIF_HYBRID_FPREGS and TIF_32BIT_FPREGS cannot
+be set both at once for a task, leading to inconsistent behaviour if
+this does happen.
+
+Return unsuccessfully then from prctl(2) PR_SET_FP_MODE calls requesting
+PR_FP_MODE_FRE to be set with PR_FP_MODE_FR clear. This corresponds to
+modes allowed by `mips_set_personality_fp'.
+
+References:
+
+[1] "MIPS Architecture For Programmers, Vol. III: MIPS32 / microMIPS32
+ Privileged Resource Architecture", Imagination Technologies,
+ Document Number: MD00090, Revision 6.02, July 10, 2015, Table 9.69
+ "Config5 Register Field Descriptions", p. 262
+
+[2] "MIPS Architecture For Programmers, Volume III: MIPS64 / microMIPS64
+ Privileged Resource Architecture", Imagination Technologies,
+ Document Number: MD00091, Revision 6.03, December 22, 2015, Table
+ 9.72 "Config5 Register Field Descriptions", p. 288
+
+Fixes: 9791554b45a2 ("MIPS,prctl: add PR_[GS]ET_FP_MODE prctl options for MIPS")
+Signed-off-by: Maciej W. Rozycki <macro@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Cc: <stable@vger.kernel.org> # 4.0+
+Patchwork: https://patchwork.linux-mips.org/patch/19327/
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/process.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -721,6 +721,10 @@ int mips_set_process_fp_mode(struct task
+ if (value & ~known_bits)
+ return -EOPNOTSUPP;
+
++ /* Setting FRE without FR is not supported. */
++ if ((value & (PR_FP_MODE_FR | PR_FP_MODE_FRE)) == PR_FP_MODE_FRE)
++ return -EOPNOTSUPP;
++
+ /* Avoid inadvertently triggering emulation */
+ if ((value & PR_FP_MODE_FR) && raw_cpu_has_fpu &&
+ !(raw_current_cpu_data.fpu_id & MIPS_FPIR_F64))
--- /dev/null
+From c7e814628df65f424fe197dde73bfc67e4a244d7 Mon Sep 17 00:00:00 2001
+From: "Maciej W. Rozycki" <macro@mips.com>
+Date: Wed, 16 May 2018 16:39:58 +0100
+Subject: MIPS: ptrace: Fix PTRACE_PEEKUSR requests for 64-bit FGRs
+
+From: Maciej W. Rozycki <macro@mips.com>
+
+commit c7e814628df65f424fe197dde73bfc67e4a244d7 upstream.
+
+Use 64-bit accesses for 64-bit floating-point general registers with
+PTRACE_PEEKUSR, removing the truncation of their upper halves in the
+FR=1 mode, caused by commit bbd426f542cb ("MIPS: Simplify FP context
+access"), which inadvertently switched them to using 32-bit accesses.
+
+The PTRACE_POKEUSR side is fine as it's never been broken and continues
+using 64-bit accesses.
+
+Fixes: bbd426f542cb ("MIPS: Simplify FP context access")
+Signed-off-by: Maciej W. Rozycki <macro@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Cc: <stable@vger.kernel.org> # 3.15+
+Patchwork: https://patchwork.linux-mips.org/patch/19334/
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/ptrace.c | 2 +-
+ arch/mips/kernel/ptrace32.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/kernel/ptrace.c
++++ b/arch/mips/kernel/ptrace.c
+@@ -809,7 +809,7 @@ long arch_ptrace(struct task_struct *chi
+ break;
+ }
+ #endif
+- tmp = get_fpr32(&fregs[addr - FPR_BASE], 0);
++ tmp = get_fpr64(&fregs[addr - FPR_BASE], 0);
+ break;
+ case PC:
+ tmp = regs->cp0_epc;
+--- a/arch/mips/kernel/ptrace32.c
++++ b/arch/mips/kernel/ptrace32.c
+@@ -108,7 +108,7 @@ long compat_arch_ptrace(struct task_stru
+ addr & 1);
+ break;
+ }
+- tmp = get_fpr32(&fregs[addr - FPR_BASE], 0);
++ tmp = get_fpr64(&fregs[addr - FPR_BASE], 0);
+ break;
+ case PC:
+ tmp = regs->cp0_epc;
--- /dev/null
+From 2d077d4b59924acd1f5180c6fb73b57f4771fde6 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Fri, 1 Jun 2018 16:50:45 -0700
+Subject: mm/huge_memory.c: __split_huge_page() use atomic ClearPageDirty()
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 2d077d4b59924acd1f5180c6fb73b57f4771fde6 upstream.
+
+Swapping load on huge=always tmpfs (with khugepaged tuned up to be very
+eager, but I'm not sure that is relevant) soon hung uninterruptibly,
+waiting for page lock in shmem_getpage_gfp()'s find_lock_entry(), most
+often when "cp -a" was trying to write to a smallish file. Debug showed
+that the page in question was not locked, and page->mapping NULL by now,
+but page->index consistent with having been in a huge page before.
+
+Reproduced in minutes on a 4.15 kernel, even with 4.17's 605ca5ede764
+("mm/huge_memory.c: reorder operations in __split_huge_page_tail()") added
+in; but took hours to reproduce on a 4.17 kernel (no idea why).
+
+The culprit proved to be the __ClearPageDirty() on tails beyond i_size in
+__split_huge_page(): the non-atomic __bitoperation may have been safe when
+4.8's baa355fd3314 ("thp: file pages support for split_huge_page()")
+introduced it, but liable to erase PageWaiters after 4.10's 62906027091f
+("mm: add PageWaiters indicating tasks are waiting for a page bit").
+
+Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1805291841070.3197@eggly.anvils
+Fixes: 62906027091f ("mm: add PageWaiters indicating tasks are waiting for a page bit")
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/huge_memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2388,7 +2388,7 @@ static void __split_huge_page(struct pag
+ __split_huge_page_tail(head, i, lruvec, list);
+ /* Some pages can be beyond i_size: drop them from page cache */
+ if (head[i].index >= end) {
+- __ClearPageDirty(head + i);
++ ClearPageDirty(head + i);
+ __delete_from_page_cache(head + i, NULL);
+ if (IS_ENABLED(CONFIG_SHMEM) && PageSwapBacked(head))
+ shmem_uncharge(head->mapping->host, 1);
--- /dev/null
+From 52a192362932f333a7ebafd581c4d9b81da2fec8 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Mon, 28 May 2018 13:25:06 +0200
+Subject: Revert "rt2800: use TXOP_BACKOFF for probe frames"
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 52a192362932f333a7ebafd581c4d9b81da2fec8 upstream.
+
+This reverts commit fb47ada8dc3c30c8e7b415da155742b49536c61e.
+
+In some situations when we set TXOP_BACKOFF, the probe frame is
+not sent at all. What it worse then sending probe frame as part
+of AMPDU and can degrade 11n performance to 11g rates.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+@@ -372,16 +372,15 @@ static void rt2x00queue_create_tx_descri
+
+ /*
+ * Determine IFS values
+- * - Use TXOP_BACKOFF for probe and management frames except beacons
++ * - Use TXOP_BACKOFF for management frames except beacons
+ * - Use TXOP_SIFS for fragment bursts
+ * - Use TXOP_HTTXOP for everything else
+ *
+ * Note: rt2800 devices won't use CTS protection (if used)
+ * for frames not transmitted with TXOP_HTTXOP
+ */
+- if ((ieee80211_is_mgmt(hdr->frame_control) &&
+- !ieee80211_is_beacon(hdr->frame_control)) ||
+- (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
++ if (ieee80211_is_mgmt(hdr->frame_control) &&
++ !ieee80211_is_beacon(hdr->frame_control))
+ txdesc->u.ht.txop = TXOP_BACKOFF;
+ else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT))
+ txdesc->u.ht.txop = TXOP_SIFS;
--- /dev/null
+From c9ddf73476ff4fffb7a87bd5107a0705bf2cf64b Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Mon, 21 May 2018 11:17:29 -0700
+Subject: scsi: scsi_transport_srp: Fix shost to rport translation
+
+From: Bart Van Assche <bart.vanassche@wdc.com>
+
+commit c9ddf73476ff4fffb7a87bd5107a0705bf2cf64b upstream.
+
+Since an SRP remote port is attached as a child to shost->shost_gendev
+and as the only child, the translation from the shost pointer into an
+rport pointer must happen by looking up the shost child that is an
+rport. This patch fixes the following KASAN complaint:
+
+BUG: KASAN: slab-out-of-bounds in srp_timed_out+0x57/0x110 [scsi_transport_srp]
+Read of size 4 at addr ffff880035d3fcc0 by task kworker/1:0H/19
+
+CPU: 1 PID: 19 Comm: kworker/1:0H Not tainted 4.16.0-rc3-dbg+ #1
+Workqueue: kblockd blk_mq_timeout_work
+Call Trace:
+dump_stack+0x85/0xc7
+print_address_description+0x65/0x270
+kasan_report+0x231/0x350
+srp_timed_out+0x57/0x110 [scsi_transport_srp]
+scsi_times_out+0xc7/0x3f0 [scsi_mod]
+blk_mq_terminate_expired+0xc2/0x140
+bt_iter+0xbc/0xd0
+blk_mq_queue_tag_busy_iter+0x1c7/0x350
+blk_mq_timeout_work+0x325/0x3f0
+process_one_work+0x441/0xa50
+worker_thread+0x76/0x6c0
+kthread+0x1b2/0x1d0
+ret_from_fork+0x24/0x30
+
+Fixes: e68ca75200fe ("scsi_transport_srp: Reduce failover time")
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Johannes Thumshirn <jthumshirn@suse.de>
+Cc: Jason Gunthorpe <jgg@mellanox.com>
+Cc: Doug Ledford <dledford@redhat.com>
+Cc: Laurence Oberman <loberman@redhat.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_transport_srp.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/scsi_transport_srp.c
++++ b/drivers/scsi/scsi_transport_srp.c
+@@ -51,6 +51,8 @@ struct srp_internal {
+ struct transport_container rport_attr_cont;
+ };
+
++static int scsi_is_srp_rport(const struct device *dev);
++
+ #define to_srp_internal(tmpl) container_of(tmpl, struct srp_internal, t)
+
+ #define dev_to_rport(d) container_of(d, struct srp_rport, dev)
+@@ -60,9 +62,24 @@ static inline struct Scsi_Host *rport_to
+ return dev_to_shost(r->dev.parent);
+ }
+
++static int find_child_rport(struct device *dev, void *data)
++{
++ struct device **child = data;
++
++ if (scsi_is_srp_rport(dev)) {
++ WARN_ON_ONCE(*child);
++ *child = dev;
++ }
++ return 0;
++}
++
+ static inline struct srp_rport *shost_to_rport(struct Scsi_Host *shost)
+ {
+- return transport_class_to_srp_rport(&shost->shost_gendev);
++ struct device *child = NULL;
++
++ WARN_ON_ONCE(device_for_each_child(&shost->shost_gendev, &child,
++ find_child_rport) < 0);
++ return child ? dev_to_rport(child) : NULL;
+ }
+
+ /**
+@@ -600,7 +617,8 @@ enum blk_eh_timer_return srp_timed_out(s
+ struct srp_rport *rport = shost_to_rport(shost);
+
+ pr_debug("timeout for sdev %s\n", dev_name(&sdev->sdev_gendev));
+- return rport->fast_io_fail_tmo < 0 && rport->dev_loss_tmo < 0 &&
++ return rport && rport->fast_io_fail_tmo < 0 &&
++ rport->dev_loss_tmo < 0 &&
+ i->f->reset_timer_if_blocked && scsi_device_blocked(sdev) ?
+ BLK_EH_RESET_TIMER : BLK_EH_NOT_HANDLED;
+ }
platform-chrome-cros_ec_lpc-remove-redundant-pointer-request.patch
kbuild-clang-disable-unused-variable-warnings-only-when-constant.patch
tcp-avoid-integer-overflows-in-tcp_rcv_space_adjust.patch
+iio-ad7793-implement-iio_chan_info_samp_freq.patch
+iio-buffer-make-length-types-match-kfifo-types.patch
+iio-kfifo_buf-check-for-uint-overflow.patch
+iio-adc-select-buffer-for-at91-sama5d2_adc.patch
+mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch
+mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch
+mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch
+scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch
+stm-class-use-vmalloc-for-the-master-map.patch
+hwtracing-stm-fix-build-error-on-some-arches.patch
+ib-core-fix-error-code-for-invalid-gid-entry.patch
+mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch
+revert-rt2800-use-txop_backoff-for-probe-frames.patch
+intel_th-use-correct-device-when-freeing-buffers.patch
+drm-psr-fix-missed-entry-in-psr-setup-time-table.patch
+drm-i915-lvds-move-acpi-lid-notification-registration-to-registration-phase.patch
+drm-i915-disable-lvds-on-radiant-p845.patch
--- /dev/null
+From b5e2ced9bf81393034072dd4d372f6b430bc1f0a Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Thu, 24 May 2018 11:27:26 +0300
+Subject: stm class: Use vmalloc for the master map
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit b5e2ced9bf81393034072dd4d372f6b430bc1f0a upstream.
+
+Fengguang is running into a warning from the buddy allocator:
+
+> swapper/0: page allocation failure: order:9, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null)
+> CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.17.0-rc1 #262
+> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
+> Call Trace:
+...
+> __kmalloc+0x14b/0x180: ____cache_alloc at mm/slab.c:3127
+> stm_register_device+0xf3/0x5c0: stm_register_device at drivers/hwtracing/stm/core.c:695
+...
+
+Which is basically a result of the stm class trying to allocate ~512kB
+for the dummy_stm with its default parameters. There's no reason, however,
+for it not to be vmalloc()ed instead, which is what this patch does.
+
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+CC: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -682,7 +682,7 @@ static void stm_device_release(struct de
+ {
+ struct stm_device *stm = to_stm_device(dev);
+
+- kfree(stm);
++ vfree(stm);
+ }
+
+ int stm_register_device(struct device *parent, struct stm_data *stm_data,
+@@ -699,7 +699,7 @@ int stm_register_device(struct device *p
+ return -EINVAL;
+
+ nmasters = stm_data->sw_end - stm_data->sw_start + 1;
+- stm = kzalloc(sizeof(*stm) + nmasters * sizeof(void *), GFP_KERNEL);
++ stm = vzalloc(sizeof(*stm) + nmasters * sizeof(void *));
+ if (!stm)
+ return -ENOMEM;
+
+@@ -752,7 +752,7 @@ err_device:
+ /* matches device_initialize() above */
+ put_device(&stm->dev);
+ err_free:
+- kfree(stm);
++ vfree(stm);
+
+ return err;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
