--- /dev/null
+From dfd68a48a1b3a1f70a2d99ca286c71cf2c3916ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 18:48:39 +0000
+Subject: ACPI / APEI: Switch estatus pool to use vmalloc memory
+
+From: James Morse <james.morse@arm.com>
+
+[ Upstream commit 0ac234be1a9497498e57d958f4251f5257b116b4 ]
+
+The ghes code is careful to parse and round firmware's advertised
+memory requirements for CPER records, up to a maximum of 64K.
+However when ghes_estatus_pool_expand() does its work, it splits
+the requested size into PAGE_SIZE granules.
+
+This means if firmware generates 5K of CPER records, and correctly
+describes this in the table, __process_error() will silently fail as it
+is unable to allocate more than PAGE_SIZE.
+
+Switch the estatus pool to vmalloc() memory. On x86 vmalloc() memory
+may fault and be fixed up by vmalloc_fault(). To prevent this call
+vmalloc_sync_all() before an NMI handler could discover the memory.
+
+Signed-off-by: James Morse <james.morse@arm.com>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index bb81cd05f0bc8..d532aa87eef10 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -198,40 +198,40 @@ static int ghes_estatus_pool_init(void)
+ return 0;
+ }
+
+-static void ghes_estatus_pool_free_chunk_page(struct gen_pool *pool,
++static void ghes_estatus_pool_free_chunk(struct gen_pool *pool,
+ struct gen_pool_chunk *chunk,
+ void *data)
+ {
+- free_page(chunk->start_addr);
++ vfree((void *)chunk->start_addr);
+ }
+
+ static void ghes_estatus_pool_exit(void)
+ {
+ gen_pool_for_each_chunk(ghes_estatus_pool,
+- ghes_estatus_pool_free_chunk_page, NULL);
++ ghes_estatus_pool_free_chunk, NULL);
+ gen_pool_destroy(ghes_estatus_pool);
+ }
+
+ static int ghes_estatus_pool_expand(unsigned long len)
+ {
+- unsigned long i, pages, size, addr;
+- int ret;
++ unsigned long size, addr;
+
+ ghes_estatus_pool_size_request += PAGE_ALIGN(len);
+ size = gen_pool_size(ghes_estatus_pool);
+ if (size >= ghes_estatus_pool_size_request)
+ return 0;
+- pages = (ghes_estatus_pool_size_request - size) / PAGE_SIZE;
+- for (i = 0; i < pages; i++) {
+- addr = __get_free_page(GFP_KERNEL);
+- if (!addr)
+- return -ENOMEM;
+- ret = gen_pool_add(ghes_estatus_pool, addr, PAGE_SIZE, -1);
+- if (ret)
+- return ret;
+- }
+
+- return 0;
++ addr = (unsigned long)vmalloc(PAGE_ALIGN(len));
++ if (!addr)
++ return -ENOMEM;
++
++ /*
++ * New allocation must be visible in all pgd before it can be found by
++ * an NMI allocating from the pool.
++ */
++ vmalloc_sync_all();
++
++ return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1);
+ }
+
+ static struct ghes *ghes_new(struct acpi_hest_generic *generic)
+--
+2.20.1
+
--- /dev/null
+From 865551dc3ba9e97c1f213ffc45ecb7cea45ad766 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Dec 2018 13:59:24 +0100
+Subject: ACPI / LPSS: Ignore acpi_device_fix_up_power() return value
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 1a2fa02f7489dc4d746f2a15fb77b3ce1affade8 ]
+
+Ignore acpi_device_fix_up_power() return value. If we return an error
+we end up with acpi_default_enumeration() still creating a platform-
+device for the device and we end up with the device still being used
+but without the special LPSS related handling which is not useful.
+
+Specicifically ignoring the error fixes the touchscreen no longer
+working after a suspend/resume on a Prowise PT301 tablet.
+
+This tablet has a broken _PS0 method on the touchscreen's I2C controller,
+causing acpi_device_fix_up_power() to fail, causing fallback to standard
+platform-dev handling and specifically causing acpi_lpss_save/restore_ctx
+to not run.
+
+The I2C controllers _PS0 method does actually turn on the device, but then
+does some more nonsense which fails when run during early boot trying to
+use I2C opregion handling on another not-yet registered I2C controller.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpss.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 572755e557d6a..e54e6170981b4 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -405,12 +405,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
+ * have _PS0 and _PS3 without _PSC (and no power resources), so
+ * acpi_bus_init_power() will assume that the BIOS has put them into D0.
+ */
+- ret = acpi_device_fix_up_power(adev);
+- if (ret) {
+- /* Skip the device, but continue the namespace scan. */
+- ret = 0;
+- goto err_out;
+- }
++ acpi_device_fix_up_power(adev);
+
+ adev->driver_data = pdata;
+ pdev = acpi_create_platform_device(adev);
+--
+2.20.1
+
--- /dev/null
+From f26ee5427037b7990b49f66be565dcf39a02b27d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:04:16 +0100
+Subject: ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 7c41ea57beb2aee96fa63091a457b1a2826f3c42 ]
+
+If debugging on i.MX is enabled DEBUG_IMX_UART_PORT defines which UART
+is used for the debug output. If however debugging is off don't only
+hide the then unused config item but drop it completely by using a
+dependency instead of a conditional prompt.
+
+This fixes DEBUG_IMX_UART_PORT being present in the kernel config even
+if DEBUG_LL is disabled.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig.debug | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index ddbb361267d87..9c3042da44402 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -1260,21 +1260,21 @@ config DEBUG_OMAP2PLUS_UART
+ depends on ARCH_OMAP2PLUS
+
+ config DEBUG_IMX_UART_PORT
+- int "i.MX Debug UART Port Selection" if DEBUG_IMX1_UART || \
+- DEBUG_IMX25_UART || \
+- DEBUG_IMX21_IMX27_UART || \
+- DEBUG_IMX31_UART || \
+- DEBUG_IMX35_UART || \
+- DEBUG_IMX50_UART || \
+- DEBUG_IMX51_UART || \
+- DEBUG_IMX53_UART || \
+- DEBUG_IMX6Q_UART || \
+- DEBUG_IMX6SL_UART || \
+- DEBUG_IMX6SX_UART || \
+- DEBUG_IMX6UL_UART || \
+- DEBUG_IMX7D_UART
++ int "i.MX Debug UART Port Selection"
++ depends on DEBUG_IMX1_UART || \
++ DEBUG_IMX25_UART || \
++ DEBUG_IMX21_IMX27_UART || \
++ DEBUG_IMX31_UART || \
++ DEBUG_IMX35_UART || \
++ DEBUG_IMX50_UART || \
++ DEBUG_IMX51_UART || \
++ DEBUG_IMX53_UART || \
++ DEBUG_IMX6Q_UART || \
++ DEBUG_IMX6SL_UART || \
++ DEBUG_IMX6SX_UART || \
++ DEBUG_IMX6UL_UART || \
++ DEBUG_IMX7D_UART
+ default 1
+- depends on ARCH_MXC
+ help
+ Choose UART port on which kernel low-level debug messages
+ should be output.
+--
+2.20.1
+
--- /dev/null
+From 07c064c4785c2beedb3c00eb5207ba19a48f2974 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 16:10:01 -0200
+Subject: ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 998a84c27a7f3f9133d32af64e19c05cec161a1a ]
+
+imx53-voipac-dmm-668 has two memory nodes, but the correct representation
+would be to use a single one with two reg entries - one for each RAM chip
+select, so fix it accordingly.
+
+Reported-by: Marco Franchi <marco.franchi@nxp.com>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Marco Franchi <marco.franchi@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
+index ba689fbd0e413..301cf8d45947f 100644
+--- a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
++++ b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
+@@ -17,12 +17,8 @@
+
+ memory@70000000 {
+ device_type = "memory";
+- reg = <0x70000000 0x20000000>;
+- };
+-
+- memory@b0000000 {
+- device_type = "memory";
+- reg = <0xb0000000 0x20000000>;
++ reg = <0x70000000 0x20000000>,
++ <0xb0000000 0x20000000>;
+ };
+
+ regulators {
+--
+2.20.1
+
--- /dev/null
+From 525a2496785d2fc0fde41a2991067addedce090f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 22:58:38 +0100
+Subject: ARM: ks8695: fix section mismatch warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 4aa64677330beeeed721b4b122884dabad845d66 ]
+
+WARNING: vmlinux.o(.text+0x13250): Section mismatch in reference from the function acs5k_i2c_init() to the (unknown reference) .init.data:(unknown)
+The function acs5k_i2c_init() references
+the (unknown reference) __initdata (unknown).
+This is often because acs5k_i2c_init lacks a __initdata
+annotation or the annotation of (unknown) is wrong.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-ks8695/board-acs5k.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-ks8695/board-acs5k.c b/arch/arm/mach-ks8695/board-acs5k.c
+index 9f9c0441a9175..e372609c48dd0 100644
+--- a/arch/arm/mach-ks8695/board-acs5k.c
++++ b/arch/arm/mach-ks8695/board-acs5k.c
+@@ -92,7 +92,7 @@ static struct i2c_board_info acs5k_i2c_devs[] __initdata = {
+ },
+ };
+
+-static void acs5k_i2c_init(void)
++static void __init acs5k_i2c_init(void)
+ {
+ /* The gpio interface */
+ platform_device_register(&acs5k_i2c_device);
+--
+2.20.1
+
--- /dev/null
+From d634c3ecf750209d0e770f0d0b22ccaf8f86a03b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 18:07:33 +0000
+Subject: arm64: smp: Handle errors reported by the firmware
+
+From: Suzuki K Poulose <Suzuki.Poulose@arm.com>
+
+[ Upstream commit f357b3a7e17af7736d67d8267edc1ed3d1dd9391 ]
+
+The __cpu_up() routine ignores the errors reported by the firmware
+for a CPU bringup operation and looks for the error status set by the
+booting CPU. If the CPU never entered the kernel, we could end up
+in assuming stale error status, which otherwise would have been
+set/cleared appropriately by the booting CPU.
+
+Reported-by: Steve Capper <steve.capper@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/smp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index 03c0946b79d20..7e90f429f7e5c 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -115,6 +115,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ }
+ } else {
+ pr_err("CPU%u: failed to boot: %d\n", cpu, ret);
++ return ret;
+ }
+
+ secondary_data.stack = NULL;
+--
+2.20.1
+
--- /dev/null
+From e50bbb50838247bac9bd780a9f5e17c2433b1560 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 10:54:32 +0100
+Subject: ASoC: compress: fix unsigned integer overflow check
+
+From: Xiaojun Sang <xsang@codeaurora.org>
+
+[ Upstream commit d3645b055399538415586ebaacaedebc1e5899b0 ]
+
+Parameter fragments and fragment_size are type of u32. U32_MAX is
+the correct check.
+
+Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Acked-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20191021095432.5639-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/compress_offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 771d7b334ad87..07f5017cbea2a 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -501,7 +501,7 @@ static int snd_compress_check_input(struct snd_compr_params *params)
+ {
+ /* first let's check the buffer parameter's */
+ if (params->buffer.fragment_size == 0 ||
+- params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
++ params->buffer.fragments > U32_MAX / params->buffer.fragment_size ||
+ params->buffer.fragments == 0)
+ return -EINVAL;
+
+--
+2.20.1
+
--- /dev/null
+From 1b9a30a3f3f5859fe3e3facf5d05e25c4b0a377e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 14:46:44 +0100
+Subject: ASoC: kirkwood: fix external clock probe defer
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 4523817d51bc3b2ef38da768d004fda2c8bc41de ]
+
+When our call to get the external clock fails, we forget to clean up
+the enabled internal clock correctly. Enable the clock after we have
+obtained all our resources.
+
+Fixes: 84aac6c79bfd ("ASoC: kirkwood: fix loss of external clock at probe time")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Link: https://lore.kernel.org/r/E1iNGyK-0004oF-6A@rmk-PC.armlinux.org.uk
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/kirkwood/kirkwood-i2s.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
+index 3a36d60e17850..0a5d9fb6fc84b 100644
+--- a/sound/soc/kirkwood/kirkwood-i2s.c
++++ b/sound/soc/kirkwood/kirkwood-i2s.c
+@@ -570,10 +570,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ return PTR_ERR(priv->clk);
+ }
+
+- err = clk_prepare_enable(priv->clk);
+- if (err < 0)
+- return err;
+-
+ priv->extclk = devm_clk_get(&pdev->dev, "extclk");
+ if (IS_ERR(priv->extclk)) {
+ if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
+@@ -589,6 +585,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ }
+ }
+
++ err = clk_prepare_enable(priv->clk);
++ if (err < 0)
++ return err;
++
+ /* Some sensible defaults - this reflects the powerup values */
+ priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24;
+ priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24;
+--
+2.20.1
+
--- /dev/null
+From 0dd4d30426e9c84f1cc0099a35d745565167052e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 09:43:13 +0200
+Subject: ath6kl: Fix off by one error in scan completion
+
+From: Kyle Roeschley <kyle.roeschley@ni.com>
+
+[ Upstream commit 5803c12816c43bd09e5f4247dd9313c2d9a2c41b ]
+
+When ath6kl was reworked to share code between regular and scheduled scans
+in commit 3b8ffc6a22ba ("ath6kl: Configure probed SSID list consistently"),
+probed SSID entry changed from 1-index to 0-indexed. However,
+ath6kl_cfg80211_scan_complete_event() was missed in that change. Fix its
+indexing so that we correctly clear out the probed SSID list.
+
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index 2b79815f59093..7653fa47508bb 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -1083,7 +1083,7 @@ void ath6kl_cfg80211_scan_complete_event(struct ath6kl_vif *vif, bool aborted)
+ if (vif->scan_req->n_ssids && vif->scan_req->ssids[0].ssid_len) {
+ for (i = 0; i < vif->scan_req->n_ssids; i++) {
+ ath6kl_wmi_probedssid_cmd(ar->wmi, vif->fw_vif_idx,
+- i + 1, DISABLE_SSID_FLAG,
++ i, DISABLE_SSID_FLAG,
+ 0, NULL);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From ee82b503e55d3c840fa777c78bf0289219d94187 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 09:43:11 +0200
+Subject: ath6kl: Only use match sets when firmware supports it
+
+From: Kyle Roeschley <kyle.roeschley@ni.com>
+
+[ Upstream commit fb376a495fbdb886f38cfaf5a3805401b9e46f13 ]
+
+Commit dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan")
+merged the probed and matched SSID lists before sending them to the
+firmware. In the process, it assumed match set support is always available
+in ath6kl_set_probed_ssids, which breaks scans for hidden SSIDs. Now, check
+that the firmware supports matching SSIDs in scheduled scans before setting
+MATCH_SSID_FLAG.
+
+Fixes: dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan")
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index 81ac8c59f0ecd..2b79815f59093 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -932,7 +932,7 @@ static int ath6kl_set_probed_ssids(struct ath6kl *ar,
+ else
+ ssid_list[i].flag = ANY_SSID_FLAG;
+
+- if (n_match_ssid == 0)
++ if (ar->wiphy->max_match_sets != 0 && n_match_ssid == 0)
+ ssid_list[i].flag |= MATCH_SSID_FLAG;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c4d33d475ce69996800919846a86ab0e54ac9e7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 22:23:19 -0600
+Subject: atl1e: checking the status of atl1e_write_phy_reg
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit ff07d48d7bc0974d4f96a85a4df14564fb09f1ef ]
+
+atl1e_write_phy_reg() could fail. The fix issues an error message when
+it fails.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+index 59a03a193e835..4384b2b4d2382 100644
+--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+@@ -478,7 +478,9 @@ static void atl1e_mdio_write(struct net_device *netdev, int phy_id,
+ {
+ struct atl1e_adapter *adapter = netdev_priv(netdev);
+
+- atl1e_write_phy_reg(&adapter->hw, reg_num & MDIO_REG_ADDR_MASK, val);
++ if (atl1e_write_phy_reg(&adapter->hw,
++ reg_num & MDIO_REG_ADDR_MASK, val))
++ netdev_err(netdev, "write phy register failed\n");
+ }
+
+ static int atl1e_mii_ioctl(struct net_device *netdev,
+--
+2.20.1
+
--- /dev/null
+From b93b74ed84a0a42a0ccb886ab6d427188b11198d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 10:48:47 +0300
+Subject: block: drbd: remove a stray unlock in __drbd_send_protocol()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8e9c523016cf9983b295e4bc659183d1fa6ef8e0 ]
+
+There are two callers of this function and they both unlock the mutex so
+this ends up being a double unlock.
+
+Fixes: 44ed167da748 ("drbd: rcu_read_lock() and rcu_dereference() for tconn->net_conf")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index 1d58854c4a9fa..385ec4ae33945 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -792,7 +792,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm
+
+ if (nc->tentative && connection->agreed_pro_version < 92) {
+ rcu_read_unlock();
+- mutex_unlock(&sock->mutex);
+ drbd_err(connection, "--dry-run is not supported by peer");
+ return -EOPNOTSUPP;
+ }
+--
+2.20.1
+
--- /dev/null
+From c313821949674bf152d07b8a39d259b4b2aae19e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 10:20:32 -0500
+Subject: btrfs: only track ref_heads in delayed_ref_updates
+
+From: Josef Bacik <jbacik@fb.com>
+
+[ Upstream commit 158ffa364bf723fa1ef128060646d23dc3942994 ]
+
+We use this number to figure out how many delayed refs to run, but
+__btrfs_run_delayed_refs really only checks every time we need a new
+delayed ref head, so we always run at least one ref head completely no
+matter what the number of items on it. Fix the accounting to only be
+adjusted when we add/remove a ref head.
+
+In addition to using this number to limit the number of delayed refs
+run, a future patch is also going to use it to calculate the amount of
+space required for delayed refs space reservation.
+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/delayed-ref.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index e06dd75ad13f9..a2f165029ee62 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -193,8 +193,6 @@ static inline void drop_delayed_ref(struct btrfs_trans_handle *trans,
+ ref->in_tree = 0;
+ btrfs_put_delayed_ref(ref);
+ atomic_dec(&delayed_refs->num_entries);
+- if (trans->delayed_ref_updates)
+- trans->delayed_ref_updates--;
+ }
+
+ static bool merge_ref(struct btrfs_trans_handle *trans,
+@@ -444,7 +442,6 @@ add_delayed_ref_tail_merge(struct btrfs_trans_handle *trans,
+ add_tail:
+ list_add_tail(&ref->list, &href->ref_list);
+ atomic_inc(&root->num_entries);
+- trans->delayed_ref_updates++;
+ spin_unlock(&href->lock);
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From a0a0283bfa1479a7e67e027726042e283f5c5be6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 21:01:20 +0000
+Subject: can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on
+ open
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit 23c5a9488f076bab336177cd1d1a366bd8ddf087 ]
+
+When the CAN interface is closed it the hardwre is put in power down
+mode, but does not reset the error counters / state. Reset the D_CAN on
+open, so the reported state and the actual state match.
+
+According to [1], the C_CAN module doesn't have the software reset.
+
+[1] http://www.bosch-semiconductors.com/media/ip_modules/pdf_2/c_can_fd8/users_manual_c_can_fd8_r210_1.pdf
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/c_can/c_can.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 7d35f6737499c..4ead5a18b7940 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -52,6 +52,7 @@
+ #define CONTROL_EX_PDR BIT(8)
+
+ /* control register */
++#define CONTROL_SWR BIT(15)
+ #define CONTROL_TEST BIT(7)
+ #define CONTROL_CCE BIT(6)
+ #define CONTROL_DISABLE_AR BIT(5)
+@@ -572,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ IF_MCONT_RCV_EOB);
+ }
+
++static int c_can_software_reset(struct net_device *dev)
++{
++ struct c_can_priv *priv = netdev_priv(dev);
++ int retry = 0;
++
++ if (priv->type != BOSCH_D_CAN)
++ return 0;
++
++ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT);
++ while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) {
++ msleep(20);
++ if (retry++ > 100) {
++ netdev_err(dev, "CCTRL: software reset failed\n");
++ return -EIO;
++ }
++ }
++
++ return 0;
++}
++
+ /*
+ * Configure C_CAN chip:
+ * - enable/disable auto-retransmission
+@@ -581,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ static int c_can_chip_config(struct net_device *dev)
+ {
+ struct c_can_priv *priv = netdev_priv(dev);
++ int err;
++
++ err = c_can_software_reset(dev);
++ if (err)
++ return err;
+
+ /* enable automatic retransmission */
+ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR);
+--
+2.20.1
+
--- /dev/null
+From 10dafc5ae4b29f0ccaea5114ad5b3c1f9753be5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 08:58:45 +0000
+Subject: can: peak_usb: report bus recovery as well
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit 128a1b87d3ceb2ba449d5aadb222fe22395adeb0 ]
+
+While the state changes are reported when the error counters increase
+and decrease, there is no event when the bus recovers and the error
+counters decrease again. So add those as well.
+
+Change the state going downward to be ERROR_PASSIVE -> ERROR_WARNING ->
+ERROR_ACTIVE instead of directly to ERROR_ACTIVE again.
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Cc: Stephane Grosjean <s.grosjean@peak-system.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/peak_usb/pcan_usb.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
+index e626c2afbbb11..0e1fc6c4360e7 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
+@@ -441,8 +441,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ }
+ if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) {
+ /* no error (back to active state) */
+- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+- return 0;
++ new_state = CAN_STATE_ERROR_ACTIVE;
++ break;
+ }
+ break;
+
+@@ -465,9 +465,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ }
+
+ if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) {
+- /* no error (back to active state) */
+- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+- return 0;
++ /* no error (back to warning state) */
++ new_state = CAN_STATE_ERROR_WARNING;
++ break;
+ }
+ break;
+
+@@ -506,6 +506,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ mc->pdev->dev.can.can_stats.error_warning++;
+ break;
+
++ case CAN_STATE_ERROR_ACTIVE:
++ cf->can_id |= CAN_ERR_CRTL;
++ cf->data[1] = CAN_ERR_CRTL_ACTIVE;
++ break;
++
+ default:
+ /* CAN_STATE_MAX (trick to handle other errors) */
+ cf->can_id |= CAN_ERR_CRTL;
+--
+2.20.1
+
--- /dev/null
+From c10f1a56950f78a49fb4ff43ce1e665066f2bf38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 11:02:01 +0200
+Subject: clk: samsung: exynos5420: Preserve PLL configuration during
+ suspend/resume
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit e9323b664ce29547d996195e8a6129a351c39108 ]
+
+Properly save and restore all top PLL related configuration registers
+during suspend/resume cycle. So far driver only handled EPLL and RPLL
+clocks, all other were reset to default values after suspend/resume cycle.
+This caused for example lower G3D (MALI Panfrost) performance after system
+resume, even if performance governor has been selected.
+
+Reported-by: Reported-by: Marian Mihailescu <mihailescu2m@gmail.com>
+Fixes: 773424326b51 ("clk: samsung: exynos5420: add more registers to restore list")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos5420.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index bde71b07f15e7..c94de13ce3627 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -166,12 +166,18 @@ static unsigned long exynos5x_clk_regs[] __initdata = {
+ GATE_BUS_CPU,
+ GATE_SCLK_CPU,
+ CLKOUT_CMU_CPU,
++ CPLL_CON0,
++ DPLL_CON0,
+ EPLL_CON0,
+ EPLL_CON1,
+ EPLL_CON2,
+ RPLL_CON0,
+ RPLL_CON1,
+ RPLL_CON2,
++ IPLL_CON0,
++ SPLL_CON0,
++ VPLL_CON0,
++ MPLL_CON0,
+ SRC_TOP0,
+ SRC_TOP1,
+ SRC_TOP2,
+--
+2.20.1
+
--- /dev/null
+From cb0c10d503e24eac7d1e76fb48a32131309a80d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 15:55:41 -0800
+Subject: crypto: user - support incremental algorithm dumps
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 0ac6b8fb23c724b015d9ca70a89126e8d1563166 ]
+
+CRYPTO_MSG_GETALG in NLM_F_DUMP mode sometimes doesn't return all
+registered crypto algorithms, because it doesn't support incremental
+dumps. crypto_dump_report() only permits itself to be called once, yet
+the netlink subsystem allocates at most ~64 KiB for the skb being dumped
+to. Thus only the first recvmsg() returns data, and it may only include
+a subset of the crypto algorithms even if the user buffer passed to
+recvmsg() is large enough to hold all of them.
+
+Fix this by using one of the arguments in the netlink_callback structure
+to keep track of the current position in the algorithm list. Then
+userspace can do multiple recvmsg() on the socket after sending the dump
+request. This is the way netlink dumps work elsewhere in the kernel;
+it's unclear why this was different (probably just an oversight).
+
+Also fix an integer overflow when calculating the dump buffer size hint.
+
+Fixes: a38f7907b926 ("crypto: Add userspace configuration API")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/crypto_user.c | 37 ++++++++++++++++++++-----------------
+ 1 file changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index b93c6db18ed3a..f18dc2d045c2a 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -257,30 +257,33 @@ drop_alg:
+
+ static int crypto_dump_report(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+- struct crypto_alg *alg;
++ const size_t start_pos = cb->args[0];
++ size_t pos = 0;
+ struct crypto_dump_info info;
+- int err;
+-
+- if (cb->args[0])
+- goto out;
+-
+- cb->args[0] = 1;
++ struct crypto_alg *alg;
++ int res;
+
+ info.in_skb = cb->skb;
+ info.out_skb = skb;
+ info.nlmsg_seq = cb->nlh->nlmsg_seq;
+ info.nlmsg_flags = NLM_F_MULTI;
+
++ down_read(&crypto_alg_sem);
+ list_for_each_entry(alg, &crypto_alg_list, cra_list) {
+- err = crypto_report_alg(alg, &info);
+- if (err)
+- goto out_err;
++ if (pos >= start_pos) {
++ res = crypto_report_alg(alg, &info);
++ if (res == -EMSGSIZE)
++ break;
++ if (res)
++ goto out;
++ }
++ pos++;
+ }
+-
++ cb->args[0] = pos;
++ res = skb->len;
+ out:
+- return skb->len;
+-out_err:
+- return err;
++ up_read(&crypto_alg_sem);
++ return res;
+ }
+
+ static int crypto_dump_report_done(struct netlink_callback *cb)
+@@ -498,7 +501,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) &&
+ (nlh->nlmsg_flags & NLM_F_DUMP))) {
+ struct crypto_alg *alg;
+- u16 dump_alloc = 0;
++ unsigned long dump_alloc = 0;
+
+ if (link->dump == NULL)
+ return -EINVAL;
+@@ -506,16 +509,16 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ down_read(&crypto_alg_sem);
+ list_for_each_entry(alg, &crypto_alg_list, cra_list)
+ dump_alloc += CRYPTO_REPORT_MAXSIZE;
++ up_read(&crypto_alg_sem);
+
+ {
+ struct netlink_dump_control c = {
+ .dump = link->dump,
+ .done = link->done,
+- .min_dump_alloc = dump_alloc,
++ .min_dump_alloc = min(dump_alloc, 65535UL),
+ };
+ err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
+ }
+- up_read(&crypto_alg_sem);
+
+ return err;
+ }
+--
+2.20.1
+
--- /dev/null
+From 0542d19fd20ffb6b9611c151919040a2c12efef6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jan 2019 21:12:19 +0100
+Subject: decnet: fix DN_IFREQ_SIZE
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 50c2936634bcb1db78a8ca63249236810c11a80f ]
+
+Digging through the ioctls with Al because of the previous
+patches, we found that on 64-bit decnet's dn_dev_ioctl()
+is wrong, because struct ifreq::ifr_ifru is actually 24
+bytes (not 16 as expected from struct sockaddr) due to the
+ifru_map and ifru_settings members.
+
+Clearly, decnet expects the ioctl to be called with a struct
+like
+ struct ifreq_dn {
+ char ifr_name[IFNAMSIZ];
+ struct sockaddr_dn ifr_addr;
+ };
+
+since it does
+ struct ifreq *ifr = ...;
+ struct sockaddr_dn *sdn = (struct sockaddr_dn *)&ifr->ifr_addr;
+
+This means that DN_IFREQ_SIZE is too big for what it wants on
+64-bit, as it is
+ sizeof(struct ifreq) - sizeof(struct sockaddr) +
+ sizeof(struct sockaddr_dn)
+
+This assumes that sizeof(struct sockaddr) is the size of ifr_ifru
+but that isn't true.
+
+Fix this to use offsetof(struct ifreq, ifr_ifru).
+
+This indeed doesn't really matter much - the result is that we
+copy in/out 8 bytes more than we should on 64-bit platforms. In
+case the "struct ifreq_dn" lands just on the end of a page though
+it might lead to faults.
+
+As far as I can tell, it has been like this forever, so it seems
+very likely that nobody cares.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/decnet/dn_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
+index b2c26b081134a..80554e7e9a0f6 100644
+--- a/net/decnet/dn_dev.c
++++ b/net/decnet/dn_dev.c
+@@ -55,7 +55,7 @@
+ #include <net/dn_neigh.h>
+ #include <net/dn_fib.h>
+
+-#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn))
++#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn))
+
+ static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00};
+ static char dn_rt_all_rt_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x03,0x00,0x00};
+--
+2.20.1
+
--- /dev/null
+From 0c6a13858389317851326953236aab46c381a6a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:39 +0100
+Subject: drbd: fix print_st_err()'s prototype to match the definition
+
+From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+
+[ Upstream commit 2c38f035117331eb78d0504843c79ea7c7fabf37 ]
+
+print_st_err() is defined with its 4th argument taking an
+'enum drbd_state_rv' but its prototype use an int for it.
+
+Fix this by using 'enum drbd_state_rv' in the prototype too.
+
+Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Signed-off-by: Roland Kammerer <roland.kammerer@linbit.com>
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_state.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h
+index 7f53c40823cd5..75219cd2534aa 100644
+--- a/drivers/block/drbd/drbd_state.h
++++ b/drivers/block/drbd/drbd_state.h
+@@ -126,7 +126,7 @@ extern enum drbd_state_rv __drbd_set_state(struct drbd_device *, union drbd_stat
+ enum chg_state_flags,
+ struct completion *done);
+ extern void print_st_err(struct drbd_device *, union drbd_state,
+- union drbd_state, int);
++ union drbd_state, enum drbd_state_rv);
+
+ enum drbd_state_rv
+ _conn_request_state(struct drbd_connection *connection, union drbd_state mask, union drbd_state val,
+--
+2.20.1
+
--- /dev/null
+From 8f78060df0a3090bd955e310d5c6a12868def478 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:35 +0100
+Subject: drbd: reject attach of unsuitable uuids even if connected
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit fe43ed97bba3b11521abd934b83ed93143470e4f ]
+
+Multiple failure scenario:
+a) all good
+ Connected Primary/Secondary UpToDate/UpToDate
+b) lose disk on Primary,
+ Connected Primary/Secondary Diskless/UpToDate
+c) continue to write to the device,
+ changes only make it to the Secondary storage.
+d) lose disk on Secondary,
+ Connected Primary/Secondary Diskless/Diskless
+e) now try to re-attach on Primary
+
+This would have succeeded before, even though that is clearly the
+wrong data set to attach to (missing the modifications from c).
+Because we only compared our "effective" and the "to-be-attached"
+data generation uuid tags if (device->state.conn < C_CONNECTED).
+
+Fix: change that constraint to (device->state.pdsk != D_UP_TO_DATE)
+compare the uuids, and reject the attach.
+
+This patch also tries to improve the reverse scenario:
+first lose Secondary, then Primary disk,
+then try to attach the disk on Secondary.
+
+Before this patch, the attach on the Secondary succeeds, but since commit
+drbd: disconnect, if the wrong UUIDs are attached on a connected peer
+the Primary will notice unsuitable data, and drop the connection hard.
+
+Though unfortunately at a point in time during the handshake where
+we cannot easily abort the attach on the peer without more
+refactoring of the handshake.
+
+We now reject any attach to "unsuitable" uuids,
+as long as we can see a Primary role,
+unless we already have access to "good" data.
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_nl.c | 6 +++---
+ drivers/block/drbd/drbd_receiver.c | 19 +++++++++++++++++++
+ 2 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index 27e1abcf57100..4adbf4c8d532c 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -1685,9 +1685,9 @@ int drbd_adm_attach(struct sk_buff *skb, struct genl_info *info)
+ }
+ }
+
+- if (device->state.conn < C_CONNECTED &&
+- device->state.role == R_PRIMARY && device->ed_uuid &&
+- (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) {
++ if (device->state.pdsk != D_UP_TO_DATE && device->ed_uuid &&
++ (device->state.role == R_PRIMARY || device->state.peer == R_PRIMARY) &&
++ (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) {
+ drbd_err(device, "Can only attach to data with current UUID=%016llX\n",
+ (unsigned long long)device->ed_uuid);
+ retcode = ERR_DATA_NOT_CURRENT;
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index b1ee358edd3b4..afd8f315d29b1 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -4116,6 +4116,25 @@ static int receive_state(struct drbd_connection *connection, struct packet_info
+ if (peer_state.conn == C_AHEAD)
+ ns.conn = C_BEHIND;
+
++ /* TODO:
++ * if (primary and diskless and peer uuid != effective uuid)
++ * abort attach on peer;
++ *
++ * If this node does not have good data, was already connected, but
++ * the peer did a late attach only now, trying to "negotiate" with me,
++ * AND I am currently Primary, possibly frozen, with some specific
++ * "effective" uuid, this should never be reached, really, because
++ * we first send the uuids, then the current state.
++ *
++ * In this scenario, we already dropped the connection hard
++ * when we received the unsuitable uuids (receive_uuids().
++ *
++ * Should we want to change this, that is: not drop the connection in
++ * receive_uuids() already, then we would need to add a branch here
++ * that aborts the attach of "unsuitable uuids" on the peer in case
++ * this node is currently Diskless Primary.
++ */
++
+ if (device->p_uuid && peer_state.disk >= D_NEGOTIATING &&
+ get_ldev_if_state(device, D_NEGOTIATING)) {
+ int cr; /* consider resync */
+--
+2.20.1
+
--- /dev/null
+From 44fd2960fef01d210f2b322a65eaea42632f0dee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 23:04:13 -0600
+Subject: drivers/regulator: fix a missing check of return value
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 966e927bf8cc6a44f8b72582a1d6d3ffc73b12ad ]
+
+If palmas_smps_read() fails, we should not use the read data in "reg"
+which may contain random value. The fix inserts a check for the return
+value of palmas_smps_read(): If it fails, we return the error code
+upstream and stop using "reg".
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/palmas-regulator.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
+index 8217613807d37..4a4766c43e616 100644
+--- a/drivers/regulator/palmas-regulator.c
++++ b/drivers/regulator/palmas-regulator.c
+@@ -435,13 +435,16 @@ static int palmas_ldo_write(struct palmas *palmas, unsigned int reg,
+ static int palmas_set_mode_smps(struct regulator_dev *dev, unsigned int mode)
+ {
+ int id = rdev_get_id(dev);
++ int ret;
+ struct palmas_pmic *pmic = rdev_get_drvdata(dev);
+ struct palmas_pmic_driver_data *ddata = pmic->palmas->pmic_ddata;
+ struct palmas_regs_info *rinfo = &ddata->palmas_regs_info[id];
+ unsigned int reg;
+ bool rail_enable = true;
+
+- palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®);
++ ret = palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®);
++ if (ret)
++ return ret;
+
+ reg &= ~PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK;
+
+--
+2.20.1
+
--- /dev/null
+From 192060071f0e2a25bd6bd9f9d6d99750e1575f84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 08:29:32 -0600
+Subject: gfs2: take jdata unstuff into account in do_grow
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit bc0205612bbd4dd4026d4ba6287f5643c37366ec ]
+
+Before this patch, function do_grow would not reserve enough journal
+blocks in the transaction to unstuff jdata files while growing them.
+This patch adds the logic to add one more block if the file to grow
+is jdata.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Reviewed-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/bmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 09476bb8f6cd0..f0302e09eff99 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -1235,6 +1235,8 @@ static int do_grow(struct inode *inode, u64 size)
+ }
+
+ error = gfs2_trans_begin(sdp, RES_DINODE + RES_STATFS + RES_RG_BIT +
++ (unstuff &&
++ gfs2_is_jdata(ip) ? RES_JDATA : 0) +
+ (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF ?
+ 0 : RES_QUOTA), 0);
+ if (error)
+--
+2.20.1
+
--- /dev/null
+From a870c6fb2badda3f084d464c9e55cf4bb0809e40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 10:45:49 +0100
+Subject: gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit c5510b8dafce5f3f5a039c9b262ebcae0092c462 ]
+
+If CONFIG_GPOILIB is not set, the stub of gpio_to_desc() should return
+the same type of error as regular version: NULL. All the callers
+compare the return value of gpio_to_desc() against NULL, so returned
+ERR_PTR would be treated as non-error case leading to dereferencing of
+error value.
+
+Fixes: 79a9becda894 ("gpiolib: export descriptor-based GPIO interface")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/gpio/consumer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
+index fb0fde686cb1f..4a9838feb0866 100644
+--- a/include/linux/gpio/consumer.h
++++ b/include/linux/gpio/consumer.h
+@@ -398,7 +398,7 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc)
+
+ static inline struct gpio_desc *gpio_to_desc(unsigned gpio)
+ {
+- return ERR_PTR(-EINVAL);
++ return NULL;
+ }
+
+ static inline int desc_to_gpio(const struct gpio_desc *desc)
+--
+2.20.1
+
--- /dev/null
+From 8e6efa334bfe42da1e9543026ea740d7ad58860f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 11:28:51 +1000
+Subject: HID: doc: fix wrong data structure reference for UHID_OUTPUT
+
+From: Peter Hutterer <peter.hutterer@who-t.net>
+
+[ Upstream commit 46b14eef59a8157138dc02f916a7f97c73b3ec53 ]
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/hid/uhid.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/hid/uhid.txt b/Documentation/hid/uhid.txt
+index c8656dd029a91..958fff9453044 100644
+--- a/Documentation/hid/uhid.txt
++++ b/Documentation/hid/uhid.txt
+@@ -160,7 +160,7 @@ them but you should handle them according to your needs.
+ UHID_OUTPUT:
+ This is sent if the HID device driver wants to send raw data to the I/O
+ device on the interrupt channel. You should read the payload and forward it to
+- the device. The payload is of type "struct uhid_data_req".
++ the device. The payload is of type "struct uhid_output_req".
+ This may be received even though you haven't received UHID_OPEN, yet.
+
+ UHID_GET_REPORT:
+--
+2.20.1
+
--- /dev/null
+From 4770b817fbb299bd1d38bd815521df1bd5e89fc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 10:05:36 +0300
+Subject: IB/qib: Fix an error code in qib_sdma_verbs_send()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5050ae5fa3d54c8e83e1e447cc7e3591110a7f57 ]
+
+We accidentally return success on this error path.
+
+Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qib/qib_sdma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/qib/qib_sdma.c b/drivers/infiniband/hw/qib/qib_sdma.c
+index c6d6a54d2e19d..1c9a3e8752012 100644
+--- a/drivers/infiniband/hw/qib/qib_sdma.c
++++ b/drivers/infiniband/hw/qib/qib_sdma.c
+@@ -597,8 +597,10 @@ retry:
+ dw = (len + 3) >> 2;
+ addr = dma_map_single(&ppd->dd->pcidev->dev, sge->vaddr,
+ dw << 2, DMA_TO_DEVICE);
+- if (dma_mapping_error(&ppd->dd->pcidev->dev, addr))
++ if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) {
++ ret = -ENOMEM;
+ goto unmap;
++ }
+ sdmadesc[0] = 0;
+ make_sdma_desc(ppd, sdmadesc, (u64) addr, dw, dwoffset);
+ /* SDmaUseLargeBuf has to be set in every descriptor */
+--
+2.20.1
+
--- /dev/null
+From 23317a43725c7d1c3c1d99178ea3c38a3731dd37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 15:32:06 +0100
+Subject: KVM: s390: unregister debug feature on failing arch init
+
+From: Michael Mueller <mimu@linux.ibm.com>
+
+[ Upstream commit 308c3e6673b012beecb96ef04cc65f4a0e7cdd99 ]
+
+Make sure the debug feature and its allocated resources get
+released upon unsuccessful architecture initialization.
+
+A related indication of the issue will be reported as kernel
+message.
+
+Signed-off-by: Michael Mueller <mimu@linux.ibm.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Message-Id: <20181130143215.69496-2-mimu@linux.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/kvm-s390.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 3e46f62d32adf..b4032d625d225 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -185,17 +185,28 @@ void kvm_arch_hardware_unsetup(void)
+
+ int kvm_arch_init(void *opaque)
+ {
++ int rc;
++
+ kvm_s390_dbf = debug_register("kvm-trace", 32, 1, 7 * sizeof(long));
+ if (!kvm_s390_dbf)
+ return -ENOMEM;
+
+ if (debug_register_view(kvm_s390_dbf, &debug_sprintf_view)) {
+- debug_unregister(kvm_s390_dbf);
+- return -ENOMEM;
++ rc = -ENOMEM;
++ goto out_debug_unreg;
+ }
+
+ /* Register floating interrupt controller interface. */
+- return kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
++ rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
++ if (rc) {
++ pr_err("Failed to register FLIC rc=%d\n", rc);
++ goto out_debug_unreg;
++ }
++ return 0;
++
++out_debug_unreg:
++ debug_unregister(kvm_s390_dbf);
++ return rc;
+ }
+
+ void kvm_arch_exit(void)
+--
+2.20.1
+
--- /dev/null
+From 092a677e96dde06bbeab753da4de05c14b56575f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 13:21:18 -0800
+Subject: lib/genalloc.c: include vmalloc.h
+
+From: Olof Johansson <olof@lixom.net>
+
+[ Upstream commit 35004f2e55807a1a1491db24ab512dd2f770a130 ]
+
+Fixes build break on most ARM/ARM64 defconfigs:
+
+ lib/genalloc.c: In function 'gen_pool_add_virt':
+ lib/genalloc.c:190:10: error: implicit declaration of function 'vzalloc_node'; did you mean 'kzalloc_node'?
+ lib/genalloc.c:190:8: warning: assignment to 'struct gen_pool_chunk *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
+ lib/genalloc.c: In function 'gen_pool_destroy':
+ lib/genalloc.c:254:3: error: implicit declaration of function 'vfree'; did you mean 'kfree'?
+
+Fixes: 6862d2fc8185 ('lib/genalloc.c: use vzalloc_node() to allocate the bitmap')
+Cc: Huang Shijie <sjhuang@iluvatar.ai>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexey Skidanov <alexey.skidanov@intel.com>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/genalloc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index 38764572ddde8..e3a475b14e260 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -35,6 +35,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/genalloc.h>
+ #include <linux/of_device.h>
++#include <linux/vmalloc.h>
+
+ static inline size_t chunk_size(const struct gen_pool_chunk *chunk)
+ {
+--
+2.20.1
+
--- /dev/null
+From e58441b73bf7ae8a8278873095fa266da2fc2af3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:26:51 -0800
+Subject: lib/genalloc.c: use vzalloc_node() to allocate the bitmap
+
+From: Huang Shijie <sjhuang@iluvatar.ai>
+
+[ Upstream commit 6862d2fc81859f88c1f3f660886427893f2b4f3f ]
+
+Some devices may have big memory on chip, such as over 1G. In some
+cases, the nbytes maybe bigger then 4M which is the bounday of the
+memory buddy system (4K default).
+
+So use vzalloc_node() to allocate the bitmap. Also use vfree to free
+it.
+
+Link: http://lkml.kernel.org/r/20181225015701.6289-1-sjhuang@iluvatar.ai
+Signed-off-by: Huang Shijie <sjhuang@iluvatar.ai>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexey Skidanov <alexey.skidanov@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/genalloc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index e4303fb2a7b28..38764572ddde8 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -187,7 +187,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy
+ int nbytes = sizeof(struct gen_pool_chunk) +
+ BITS_TO_LONGS(nbits) * sizeof(long);
+
+- chunk = kzalloc_node(nbytes, GFP_KERNEL, nid);
++ chunk = vzalloc_node(nbytes, nid);
+ if (unlikely(chunk == NULL))
+ return -ENOMEM;
+
+@@ -251,7 +251,7 @@ void gen_pool_destroy(struct gen_pool *pool)
+ bit = find_next_bit(chunk->bits, end_bit, 0);
+ BUG_ON(bit < end_bit);
+
+- kfree(chunk);
++ vfree(chunk);
+ }
+ kfree_const(pool->name);
+ kfree(pool);
+--
+2.20.1
+
--- /dev/null
+From bd7f86af0b60c37270161efdb5f5dc910b3ea745 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 20:33:52 +0900
+Subject: microblaze: adjust the help to the real behavior
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit bafcc61d998c1ca18f556d92a0e95335ac68c7da ]
+
+"make ARCH=microblaze help" mentions simpleImage.<dt>.unstrip,
+but it is not a real Make target. It does not work because Makefile
+assumes "system.unstrip" is the name of DT.
+
+$ make ARCH=microblaze CROSS_COMPILE=microblaze-linux- simpleImage.system.unstrip
+ [ snip ]
+make[1]: *** No rule to make target 'arch/microblaze/boot/dts/system.unstrip.dtb', needed by 'arch/microblaze/boot/dts/system.dtb'. Stop.
+make: *** [Makefile;1060: arch/microblaze/boot/dts] Error 2
+make: *** Waiting for unfinished jobs....
+
+simpleImage.<dt> works like a phony target that generates multiple
+images. Reflect the real behavior. I removed the DT directory path
+information because it is already explained a few lines below.
+
+While I am here, I deleted the redundant *_defconfig explanation.
+
+The top-level Makefile caters to list available defconfig files:
+
+ mmu_defconfig - Build for mmu
+ nommu_defconfig - Build for nommu
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/Makefile | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index 740f2b82a182a..5e1e18540a571 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -83,11 +83,11 @@ define archhelp
+ echo '* linux.bin - Create raw binary'
+ echo ' linux.bin.gz - Create compressed raw binary'
+ echo ' linux.bin.ub - Create U-Boot wrapped raw binary'
+- echo ' simpleImage.<dt> - ELF image with $(arch)/boot/dts/<dt>.dts linked in'
+- echo ' - stripped elf with fdt blob'
+- echo ' simpleImage.<dt>.unstrip - full ELF image with fdt blob'
+- echo ' *_defconfig - Select default config from arch/microblaze/configs'
+- echo ''
++ echo ' simpleImage.<dt> - Create the following images with <dt>.dtb linked in'
++ echo ' simpleImage.<dt> : raw image'
++ echo ' simpleImage.<dt>.ub : raw image with U-Boot header'
++ echo ' simpleImage.<dt>.unstrip: ELF (identical to vmlinux)'
++ echo ' simpleImage.<dt>.strip : stripped ELF'
+ echo ' Targets with <dt> embed a device tree blob inside the image'
+ echo ' These targets support board with firmware that does not'
+ echo ' support passing a device tree directly. Replace <dt> with the'
+--
+2.20.1
+
--- /dev/null
+From 8114667786942615b75af988784038c76fe05794 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 20:33:53 +0900
+Subject: microblaze: move "... is ready" messages to arch/microblaze/Makefile
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 2e14f94cf4bc2f15ca5362e81ca3a987c79e3062 ]
+
+To prepare for more fixes, move this to arch/microblaze/Makefile.
+Otherwise, the same "... is ready" would be printed multiple times.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/Makefile | 2 ++
+ arch/microblaze/boot/Makefile | 4 ----
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index 5e1e18540a571..491676a6cde57 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -75,9 +75,11 @@ archclean:
+
+ linux.bin linux.bin.gz linux.bin.ub: vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+
+ simpleImage.%: vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+
+ define archhelp
+ echo '* linux.bin - Create raw binary'
+diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile
+index 0f3fe6a151dce..22bed08ec7f28 100644
+--- a/arch/microblaze/boot/Makefile
++++ b/arch/microblaze/boot/Makefile
+@@ -8,15 +8,12 @@ OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary
+
+ $(obj)/linux.bin: vmlinux FORCE
+ $(call if_changed,objcopy)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ $(obj)/linux.bin.ub: $(obj)/linux.bin FORCE
+ $(call if_changed,uimage)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE
+ $(call if_changed,gzip)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ quiet_cmd_cp = CP $< $@$2
+ cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
+@@ -34,6 +31,5 @@ $(obj)/simpleImage.%: vmlinux FORCE
+ $(call if_changed,objcopy)
+ $(call if_changed,uimage)
+ $(call if_changed,strip,.strip)
+- @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')'
+
+ clean-files += simpleImage.*.unstrip linux.bin.ub dts/*.dtb
+--
+2.20.1
+
--- /dev/null
+From ebb864001e1230475f96e492fb71fbb3b1472de1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jan 2019 15:36:54 +0100
+Subject: mtd: Check add_mtd_device() ret code
+
+From: Boris Brezillon <bbrezillon@kernel.org>
+
+[ Upstream commit 2b6f0090a3335b7bdd03ca520c35591159463041 ]
+
+add_mtd_device() can fail. We should always check its return value
+and gracefully handle the failure case. Fix the call sites where this
+not done (in mtdpart.c) and add a __must_check attribute to the
+prototype to avoid this kind of mistakes.
+
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdcore.h | 2 +-
+ drivers/mtd/mtdpart.c | 36 +++++++++++++++++++++++++++++++-----
+ 2 files changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mtd/mtdcore.h b/drivers/mtd/mtdcore.h
+index 7b0353399a106..b837f44716820 100644
+--- a/drivers/mtd/mtdcore.h
++++ b/drivers/mtd/mtdcore.h
+@@ -6,7 +6,7 @@
+ extern struct mutex mtd_table_mutex;
+
+ struct mtd_info *__mtd_next_device(int i);
+-int add_mtd_device(struct mtd_info *mtd);
++int __must_check add_mtd_device(struct mtd_info *mtd);
+ int del_mtd_device(struct mtd_info *mtd);
+ int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int);
+ int del_mtd_partitions(struct mtd_info *);
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index f8ba153f63bfe..9b48be05cd1af 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -610,10 +610,22 @@ int mtd_add_partition(struct mtd_info *master, const char *name,
+ list_add(&new->list, &mtd_partitions);
+ mutex_unlock(&mtd_partitions_mutex);
+
+- add_mtd_device(&new->mtd);
++ ret = add_mtd_device(&new->mtd);
++ if (ret)
++ goto err_remove_part;
+
+ mtd_add_partition_attrs(new);
+
++ return 0;
++
++err_remove_part:
++ mutex_lock(&mtd_partitions_mutex);
++ list_del(&new->list);
++ mutex_unlock(&mtd_partitions_mutex);
++
++ free_partition(new);
++ pr_info("%s:%i\n", __func__, __LINE__);
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(mtd_add_partition);
+@@ -658,28 +670,42 @@ int add_mtd_partitions(struct mtd_info *master,
+ {
+ struct mtd_part *slave;
+ uint64_t cur_offset = 0;
+- int i;
++ int i, ret;
+
+ printk(KERN_NOTICE "Creating %d MTD partitions on \"%s\":\n", nbparts, master->name);
+
+ for (i = 0; i < nbparts; i++) {
+ slave = allocate_partition(master, parts + i, i, cur_offset);
+ if (IS_ERR(slave)) {
+- del_mtd_partitions(master);
+- return PTR_ERR(slave);
++ ret = PTR_ERR(slave);
++ goto err_del_partitions;
+ }
+
+ mutex_lock(&mtd_partitions_mutex);
+ list_add(&slave->list, &mtd_partitions);
+ mutex_unlock(&mtd_partitions_mutex);
+
+- add_mtd_device(&slave->mtd);
++ ret = add_mtd_device(&slave->mtd);
++ if (ret) {
++ mutex_lock(&mtd_partitions_mutex);
++ list_del(&slave->list);
++ mutex_unlock(&mtd_partitions_mutex);
++
++ free_partition(slave);
++ goto err_del_partitions;
++ }
++
+ mtd_add_partition_attrs(slave);
+
+ cur_offset = slave->offset + slave->mtd.size;
+ }
+
+ return 0;
++
++err_del_partitions:
++ del_mtd_partitions(master);
++
++ return ret;
+ }
+
+ static DEFINE_SPINLOCK(part_parser_lock);
+--
+2.20.1
+
--- /dev/null
+From 697470f88964704ae92023f8c05a805012119e32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 09:47:00 +0100
+Subject: mtd: Remove a debug trace in mtdpart.c
+
+From: Boris Brezillon <bbrezillon@kernel.org>
+
+[ Upstream commit bda2ab56356b9acdfab150f31c4bac9846253092 ]
+
+Commit 2b6f0090a333 ("mtd: Check add_mtd_device() ret code") contained
+a leftover of the debug session that led to this bug fix. Remove this
+pr_info().
+
+Fixes: 2b6f0090a333 ("mtd: Check add_mtd_device() ret code")
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdpart.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index 9b48be05cd1af..59772510452a5 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -624,7 +624,6 @@ err_remove_part:
+ mutex_unlock(&mtd_partitions_mutex);
+
+ free_partition(new);
+- pr_info("%s:%i\n", __func__, __LINE__);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 67f4b42df3f23586320754e32c93141689f247b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 14:26:55 -0800
+Subject: mwifiex: debugfs: correct histogram spacing, formatting
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit 4cb777c64e030778c569f605398d7604d8aabc0f ]
+
+Currently, snippets of this file look like:
+
+rx rates (in Mbps): 0=1M 1=2M2=5.5M 3=11M 4=6M 5=9M 6=12M
+7=18M 8=24M 9=36M 10=48M 11=54M12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)
+44-53=MCS0-9(VHT:BW20)54-63=MCS0-9(VHT:BW40)64-73=MCS0-9(VHT:BW80)
+...
+noise_flr[--96dBm] = 22
+noise_flr[--95dBm] = 149
+noise_flr[--94dBm] = 9
+noise_flr[--93dBm] = 2
+
+We're missing some spaces, and we're adding a minus sign ('-') on values
+that are already negative signed integers.
+
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mwifiex/debugfs.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c
+index 45d97b64ef84b..f72c4f8853111 100644
+--- a/drivers/net/wireless/mwifiex/debugfs.c
++++ b/drivers/net/wireless/mwifiex/debugfs.c
+@@ -295,15 +295,13 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ "total samples = %d\n",
+ atomic_read(&phist_data->num_samples));
+
+- p += sprintf(p, "rx rates (in Mbps): 0=1M 1=2M");
+- p += sprintf(p, "2=5.5M 3=11M 4=6M 5=9M 6=12M\n");
+- p += sprintf(p, "7=18M 8=24M 9=36M 10=48M 11=54M");
+- p += sprintf(p, "12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
++ p += sprintf(p,
++ "rx rates (in Mbps): 0=1M 1=2M 2=5.5M 3=11M 4=6M 5=9M 6=12M\n"
++ "7=18M 8=24M 9=36M 10=48M 11=54M 12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
+
+ if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) {
+- p += sprintf(p, "44-53=MCS0-9(VHT:BW20)");
+- p += sprintf(p, "54-63=MCS0-9(VHT:BW40)");
+- p += sprintf(p, "64-73=MCS0-9(VHT:BW80)\n\n");
++ p += sprintf(p,
++ "44-53=MCS0-9(VHT:BW20) 54-63=MCS0-9(VHT:BW40) 64-73=MCS0-9(VHT:BW80)\n\n");
+ } else {
+ p += sprintf(p, "\n");
+ }
+@@ -332,7 +330,7 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ for (i = 0; i < MWIFIEX_MAX_NOISE_FLR; i++) {
+ value = atomic_read(&phist_data->noise_flr[i]);
+ if (value)
+- p += sprintf(p, "noise_flr[-%02ddBm] = %d\n",
++ p += sprintf(p, "noise_flr[%02ddBm] = %d\n",
+ (int)(i-128), value);
+ }
+ for (i = 0; i < MWIFIEX_MAX_SIG_STRENGTH; i++) {
+--
+2.20.1
+
--- /dev/null
+From 57bcaa7dd803472abfa48e15a8e41f389c34485e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 18:25:19 +0800
+Subject: mwifiex: fix potential NULL dereference and use after free
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 1dcd9429212b98bea87fc6ec92fb50bf5953eb47 ]
+
+There are two defects: (1) passing a NULL bss to
+mwifiex_save_hidden_ssid_channels will result in NULL dereference,
+(2) using bss after dropping the reference to it via cfg80211_put_bss.
+To fix them, the patch moves the buggy code to the branch that bss is
+not NULL and puts it before cfg80211_put_bss.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mwifiex/scan.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
+index b3fa3e4bed052..39b78dc1bd92b 100644
+--- a/drivers/net/wireless/mwifiex/scan.c
++++ b/drivers/net/wireless/mwifiex/scan.c
+@@ -1873,15 +1873,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
+ ETH_ALEN))
+ mwifiex_update_curr_bss_params(priv,
+ bss);
+- cfg80211_put_bss(priv->wdev.wiphy, bss);
+- }
+
+- if ((chan->flags & IEEE80211_CHAN_RADAR) ||
+- (chan->flags & IEEE80211_CHAN_NO_IR)) {
+- mwifiex_dbg(adapter, INFO,
+- "radar or passive channel %d\n",
+- channel);
+- mwifiex_save_hidden_ssid_channels(priv, bss);
++ if ((chan->flags & IEEE80211_CHAN_RADAR) ||
++ (chan->flags & IEEE80211_CHAN_NO_IR)) {
++ mwifiex_dbg(adapter, INFO,
++ "radar or passive channel %d\n",
++ channel);
++ mwifiex_save_hidden_ssid_channels(priv,
++ bss);
++ }
++
++ cfg80211_put_bss(priv->wdev.wiphy, bss);
+ }
+ }
+ } else {
+--
+2.20.1
+
--- /dev/null
+From 37d0b2cfbe5e1583780adfaa3c0adbe6316a4348 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jan 2019 13:38:43 +0300
+Subject: net/core/neighbour: fix kmemleak minimal reference count for hash
+ tables
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 01b833ab44c9e484060aad72267fc7e71beb559b ]
+
+This should be 1 for normal allocations, 0 disables leak reporting.
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Reported-by: Cong Wang <xiyou.wangcong@gmail.com>
+Fixes: 85704cb8dcfd ("net/core/neighbour: tell kmemleak about hash tables")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index bba672482a0ef..8aef689b8f32d 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -332,7 +332,7 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
+ buckets = (struct neighbour __rcu **)
+ __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
+ get_order(size));
+- kmemleak_alloc(buckets, size, 0, GFP_ATOMIC);
++ kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
+ }
+ if (!buckets) {
+ kfree(ret);
+--
+2.20.1
+
--- /dev/null
+From 2de274a05d92f62d187920617e18037642fc1cfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jan 2019 12:30:00 +0300
+Subject: net/core/neighbour: tell kmemleak about hash tables
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 85704cb8dcfd88d351bfc87faaeba1c8214f3177 ]
+
+This fixes false-positive kmemleak reports about leaked neighbour entries:
+
+unreferenced object 0xffff8885c6e4d0a8 (size 1024):
+ comm "softirq", pid 0, jiffies 4294922664 (age 167640.804s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 20 2c f3 83 ff ff ff ff ........ ,......
+ 08 c0 ef 5f 84 88 ff ff 01 8c 7d 02 01 00 00 00 ..._......}.....
+ backtrace:
+ [<00000000748509fe>] ip6_finish_output2+0x887/0x1e40
+ [<0000000036d7a0d8>] ip6_output+0x1ba/0x600
+ [<0000000027ea7dba>] ip6_send_skb+0x92/0x2f0
+ [<00000000d6e2111d>] udp_v6_send_skb.isra.24+0x680/0x15e0
+ [<000000000668a8be>] udpv6_sendmsg+0x18c9/0x27a0
+ [<000000004bd5fa90>] sock_sendmsg+0xb3/0xf0
+ [<000000008227b29f>] ___sys_sendmsg+0x745/0x8f0
+ [<000000008698009d>] __sys_sendmsg+0xde/0x170
+ [<00000000889dacf1>] do_syscall_64+0x9b/0x400
+ [<0000000081cdb353>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [<000000005767ed39>] 0xffffffffffffffff
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index b3b242f7ecfd2..bba672482a0ef 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -18,6 +18,7 @@
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+ #include <linux/slab.h>
++#include <linux/kmemleak.h>
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+@@ -325,12 +326,14 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
+ ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
+ if (!ret)
+ return NULL;
+- if (size <= PAGE_SIZE)
++ if (size <= PAGE_SIZE) {
+ buckets = kzalloc(size, GFP_ATOMIC);
+- else
++ } else {
+ buckets = (struct neighbour __rcu **)
+ __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
+ get_order(size));
++ kmemleak_alloc(buckets, size, 0, GFP_ATOMIC);
++ }
+ if (!buckets) {
+ kfree(ret);
+ return NULL;
+@@ -350,10 +353,12 @@ static void neigh_hash_free_rcu(struct rcu_head *head)
+ size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
+ struct neighbour __rcu **buckets = nht->hash_buckets;
+
+- if (size <= PAGE_SIZE)
++ if (size <= PAGE_SIZE) {
+ kfree(buckets);
+- else
++ } else {
++ kmemleak_free(buckets);
+ free_pages((unsigned long)buckets, get_order(size));
++ }
+ kfree(nht);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 5ba92e3ad7c967c9e489ef66391d382a66b10ff4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Feb 2019 13:37:26 +0300
+Subject: net: dev: Use unsigned integer as an argument to left-shift
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit f4d7b3e23d259c44f1f1c39645450680fcd935d6 ]
+
+1 << 31 is Undefined Behaviour according to the C standard.
+Use U type modifier to avoid theoretical overflow.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 0b211d482c961..861b71377e5e1 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -3298,7 +3298,7 @@ static inline u32 netif_msg_init(int debug_value, int default_msg_enable_bits)
+ if (debug_value == 0) /* no output */
+ return 0;
+ /* set low N bits */
+- return (1 << debug_value) - 1;
++ return (1U << debug_value) - 1;
+ }
+
+ static inline void __netif_tx_lock(struct netdev_queue *txq, int cpu)
+--
+2.20.1
+
--- /dev/null
+From 9baf4e93a86d5510170fff5e477801bc81816176 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 12:26:27 -0800
+Subject: net: fix possible overflow in __sk_mem_raise_allocated()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5bf325a53202b8728cf7013b72688c46071e212e ]
+
+With many active TCP sockets, fat TCP sockets could fool
+__sk_mem_raise_allocated() thanks to an overflow.
+
+They would increase their share of the memory, instead
+of decreasing it.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sock.h | 2 +-
+ net/core/sock.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 5ed4786a2058b..de4434284a34b 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1282,7 +1282,7 @@ static inline void sk_sockets_allocated_inc(struct sock *sk)
+ percpu_counter_inc(prot->sockets_allocated);
+ }
+
+-static inline int
++static inline u64
+ sk_sockets_allocated_read_positive(struct sock *sk)
+ {
+ struct proto *prot = sk->sk_prot;
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 8aa4a5f895723..0f4c15fcd87d3 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2122,7 +2122,7 @@ int __sk_mem_schedule(struct sock *sk, int size, int kind)
+ }
+
+ if (sk_has_memory_pressure(sk)) {
+- int alloc;
++ u64 alloc;
+
+ if (!sk_under_memory_pressure(sk))
+ return 1;
+--
+2.20.1
+
--- /dev/null
+From 03cde07150caadf20c765d1f30731a05399eea08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Dec 2018 19:42:38 -0600
+Subject: net/net_namespace: Check the return value of register_pernet_subsys()
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 0eb987c874dc93f9c9d85a6465dbde20fdd3884c ]
+
+In net_ns_init(), register_pernet_subsys() could fail while registering
+network namespace subsystems. The fix checks the return value and
+sends a panic() on failure.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/net_namespace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 087ce1598b746..01bfe28b20a19 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -778,7 +778,8 @@ static int __init net_ns_init(void)
+
+ mutex_unlock(&net_mutex);
+
+- register_pernet_subsys(&net_ns_ops);
++ if (register_pernet_subsys(&net_ns_ops))
++ panic("Could not register network namespace subsystems");
+
+ rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL, NULL);
+ rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid,
+--
+2.20.1
+
--- /dev/null
+From e7bf02e1e22ef860ae0192e61ee49a3542606bb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 20:57:14 -0600
+Subject: net: stmicro: fix a missing check of clk_prepare
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit f86a3b83833e7cfe558ca4d70b64ebc48903efec ]
+
+clk_prepare() could fail, so let's check its status, and if it fails,
+return its error code upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+index adff46375a322..6e56c4e5ecec5 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+@@ -59,7 +59,9 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
+ gmac->clk_enabled = 1;
+ } else {
+ clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
+- clk_prepare(gmac->tx_clk);
++ ret = clk_prepare(gmac->tx_clk);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 13b34c831c292834a81b8e957c9c30d7a1a70aba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:32:53 -0800
+Subject: ocfs2: clear journal dirty flag after shutdown journal
+
+From: Junxiao Bi <junxiao.bi@oracle.com>
+
+[ Upstream commit d85400af790dba2aa294f0a77e712f166681f977 ]
+
+Dirty flag of the journal should be cleared at the last stage of umount,
+if do it before jbd2_journal_destroy(), then some metadata in uncommitted
+transaction could be lost due to io error, but as dirty flag of journal
+was already cleared, we can't find that until run a full fsck. This may
+cause system panic or other corruption.
+
+Link: http://lkml.kernel.org/r/20181121020023.3034-3-junxiao.bi@oracle.com
+Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
+Reviewed-by: Yiwen Jiang <jiangyiwen@huawei.com>
+Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Cc: Changwei Ge <ge.changwei@h3c.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Mark Fasheh <mfasheh@versity.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/journal.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
+index 722eb5bc9b8f0..2301011428a1d 100644
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -1017,7 +1017,8 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
+ mlog_errno(status);
+ }
+
+- if (status == 0) {
++ /* Shutdown the kernel journal system */
++ if (!jbd2_journal_destroy(journal->j_journal) && !status) {
+ /*
+ * Do not toggle if flush was unsuccessful otherwise
+ * will leave dirty metadata in a "clean" journal
+@@ -1026,9 +1027,6 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
+ if (status < 0)
+ mlog_errno(status);
+ }
+-
+- /* Shutdown the kernel journal system */
+- jbd2_journal_destroy(journal->j_journal);
+ journal->j_journal = NULL;
+
+ OCFS2_I(inode)->ip_open_count--;
+--
+2.20.1
+
--- /dev/null
+From 4d0efaf00a28f74f50245bcf5e9870a26f7cab4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 13:20:47 +0100
+Subject: openrisc: Fix broken paths to arch/or32
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 57ce8ba0fd3a95bf29ed741df1c52bd591bf43ff ]
+
+OpenRISC was mainlined as "openrisc", not "or32".
+vmlinux.lds is generated from vmlinux.lds.S.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/entry.S | 2 +-
+ arch/openrisc/kernel/head.S | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index fec8bf97d8064..c17e8451d9978 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -179,7 +179,7 @@ handler: ;\
+ * occured. in fact they never do. if you need them use
+ * values saved on stack (for SPR_EPC, SPR_ESR) or content
+ * of r4 (for SPR_EEAR). for details look at EXCEPTION_HANDLE()
+- * in 'arch/or32/kernel/head.S'
++ * in 'arch/openrisc/kernel/head.S'
+ */
+
+ /* =====================================================[ exceptions] === */
+diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S
+index f14793306b03f..98dd6860bc0b9 100644
+--- a/arch/openrisc/kernel/head.S
++++ b/arch/openrisc/kernel/head.S
+@@ -1596,7 +1596,7 @@ _string_esr_irq_bug:
+
+ /*
+ * .data section should be page aligned
+- * (look into arch/or32/kernel/vmlinux.lds)
++ * (look into arch/openrisc/kernel/vmlinux.lds.S)
+ */
+ .section .data,"aw"
+ .align 8192
+--
+2.20.1
+
--- /dev/null
+From 5e29f0540c3adb2a4164435555ca8e698b3fb327 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 21:06:34 +0100
+Subject: parisc: Fix HP SDC hpa address output
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit c4bff35ca1bfba886da6223c9fed76a2b1382b8e ]
+
+Show the hpa address of the HP SDC instead of a hashed value, e.g.:
+HP SDC: HP SDC at 0xf0201000, IRQ 23 (NMI IRQ 24)
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/hp_sdc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
+index 852858e5d8d08..92f541db98a09 100644
+--- a/drivers/input/serio/hp_sdc.c
++++ b/drivers/input/serio/hp_sdc.c
+@@ -887,8 +887,8 @@ static int __init hp_sdc_init(void)
+ "HP SDC NMI", &hp_sdc))
+ goto err2;
+
+- printk(KERN_INFO PREFIX "HP SDC at 0x%p, IRQ %d (NMI IRQ %d)\n",
+- (void *)hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi);
++ pr_info(PREFIX "HP SDC at 0x%08lx, IRQ %d (NMI IRQ %d)\n",
++ hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi);
+
+ hp_sdc_status_in8();
+ hp_sdc_data_in8();
+--
+2.20.1
+
--- /dev/null
+From 413090c8b5396f7c99e12bdf2b46ec627473197b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 21:09:59 +0100
+Subject: parisc: Fix serio address output
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 785145171d17af2554128becd6a7c8f89e101141 ]
+
+We want the hpa addresses printed in the serio modules, not some
+virtual ioremap()ed address, e.g.:
+
+ serio: gsc-ps2-keyboard port at 0xf0108000 irq 22 @ 2:0:11
+ serio: gsc-ps2-mouse port at 0xf0108100 irq 22 @ 2:0:12
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/gscps2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c
+index ecba666afadb7..cca26e6f38b36 100644
+--- a/drivers/input/serio/gscps2.c
++++ b/drivers/input/serio/gscps2.c
+@@ -382,9 +382,9 @@ static int gscps2_probe(struct parisc_device *dev)
+ goto fail;
+ #endif
+
+- printk(KERN_INFO "serio: %s port at 0x%p irq %d @ %s\n",
++ pr_info("serio: %s port at 0x%08lx irq %d @ %s\n",
+ ps2port->port->name,
+- ps2port->addr,
++ hpa,
+ ps2port->padev->irq,
+ ps2port->port->phys);
+
+--
+2.20.1
+
--- /dev/null
+From 996fa59da7a8d47f4a0d46ecc761d536d1aae8c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:09:56 +0100
+Subject: pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1b99d0c80bbe1810572c2cb77b90f67886adfa8d ]
+
+The Port F Control Register 3 (PFCR3) contains only a single field.
+However, counting from left to right, it is the fourth field, not the
+first field.
+Insert the missing dummy configuration values (3 fields of 16 values) to
+fix this.
+
+The descriptor for the Port F Control Register 0 (PFCR0) lacks the
+description for the 4th field (PF0 Mode, PF0MD[2:0]).
+Add the missing configuration values to fix this.
+
+Fixes: a8d42fc4217b1ea1 ("sh-pfc: Add sh7264 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7264.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+index 8070765311dbf..e1c34e19222ee 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+@@ -1716,6 +1716,9 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ },
+
+ { PINMUX_CFG_REG("PFCR3", 0xfffe38a8, 16, 4) {
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ PF12MD_000, PF12MD_001, 0, PF12MD_011,
+ PF12MD_100, PF12MD_101, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0 }
+@@ -1759,8 +1762,10 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 0, 0, 0, 0, 0, 0, 0, 0,
+ PF1MD_000, PF1MD_001, PF1MD_010, PF1MD_011,
+ PF1MD_100, PF1MD_101, 0, 0,
+- 0, 0, 0, 0, 0, 0, 0, 0
+- }
++ 0, 0, 0, 0, 0, 0, 0, 0,
++ PF0MD_000, PF0MD_001, PF0MD_010, PF0MD_011,
++ PF0MD_100, PF0MD_101, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0 }
+ },
+
+ { PINMUX_CFG_REG("PFIOR0", 0xfffe38b2, 16, 1) {
+--
+2.20.1
+
--- /dev/null
+From 1fec45b2fcfbc616f3288acf85f176813a454818 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:41:11 +0100
+Subject: pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 054f2400f706327f96770219c3065b5131f8f154 ]
+
+Some values in the Peripheral Function Select Register 10 descriptor are
+shifted by one position, which may cause a peripheral function to be
+programmed incorrectly.
+
+Fixing this makes all HSCIF0 pins use Function 4 (value 3), like was
+already the case for the HSCK0 pin in field IP10[5:3].
+
+Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 9842bb1067969..c691b2e343746 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2218,22 +2218,22 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ /* IP10_22 [1] */
+ FN_CAN_CLK_A, FN_RX4_D,
+ /* IP10_21_19 [3] */
+- FN_AUDIO_CLKOUT, FN_TX1_E, FN_HRTS0_C, FN_FSE_B,
+- FN_LCD_M_DISP_B, 0, 0, 0,
++ FN_AUDIO_CLKOUT, FN_TX1_E, 0, FN_HRTS0_C, FN_FSE_B,
++ FN_LCD_M_DISP_B, 0, 0,
+ /* IP10_18_16 [3] */
+- FN_AUDIO_CLKC, FN_SCK1_E, FN_HCTS0_C, FN_FRB_B,
+- FN_LCD_VEPWC_B, 0, 0, 0,
++ FN_AUDIO_CLKC, FN_SCK1_E, 0, FN_HCTS0_C, FN_FRB_B,
++ FN_LCD_VEPWC_B, 0, 0,
+ /* IP10_15 [1] */
+ FN_AUDIO_CLKB_A, FN_LCD_CLK_B,
+ /* IP10_14_12 [3] */
+ FN_AUDIO_CLKA_A, FN_VI1_CLK_B, FN_SCK1_D, FN_IECLK_B,
+ FN_LCD_FLM_B, 0, 0, 0,
+ /* IP10_11_9 [3] */
+- FN_SSI_SDATA3, FN_VI1_7_B, FN_HTX0_C, FN_FWE_B,
+- FN_LCD_CL2_B, 0, 0, 0,
++ FN_SSI_SDATA3, FN_VI1_7_B, 0, FN_HTX0_C, FN_FWE_B,
++ FN_LCD_CL2_B, 0, 0,
+ /* IP10_8_6 [3] */
+- FN_SSI_SDATA2, FN_VI1_6_B, FN_HRX0_C, FN_FRE_B,
+- FN_LCD_CL1_B, 0, 0, 0,
++ FN_SSI_SDATA2, FN_VI1_6_B, 0, FN_HRX0_C, FN_FRE_B,
++ FN_LCD_CL1_B, 0, 0,
+ /* IP10_5_3 [3] */
+ FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
+ FN_LCD_DON_B, 0, 0, 0,
+--
+2.20.1
+
--- /dev/null
+From 223cb5a3f1d041cf45418da0ae1bcb155044e5f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Dec 2018 21:52:11 +0100
+Subject: PM / AVS: SmartReflex: NULL check before some freeing functions is
+ not needed
+
+From: Thomas Meyer <thomas@m3y3r.de>
+
+[ Upstream commit 14d338a857f05f894ba3badd9e6d3039c68b8180 ]
+
+NULL check before some freeing functions is not needed.
+
+Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/avs/smartreflex.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/power/avs/smartreflex.c b/drivers/power/avs/smartreflex.c
+index db9973bb53f19..ecc59798fd0aa 100644
+--- a/drivers/power/avs/smartreflex.c
++++ b/drivers/power/avs/smartreflex.c
+@@ -1001,8 +1001,7 @@ static int omap_sr_remove(struct platform_device *pdev)
+
+ if (sr_info->autocomp_active)
+ sr_stop_vddautocomp(sr_info);
+- if (sr_info->dbg_dir)
+- debugfs_remove_recursive(sr_info->dbg_dir);
++ debugfs_remove_recursive(sr_info->dbg_dir);
+
+ pm_runtime_disable(&pdev->dev);
+ list_del(&sr_info->node);
+--
+2.20.1
+
--- /dev/null
+From 6f6319714ada7365f208b71e59607bac16dc37ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 13:27:33 +1100
+Subject: powerpc/44x/bamboo: Fix PCI range
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+[ Upstream commit 3cfb9ebe906b51f2942b1e251009bb251efd2ba6 ]
+
+The bamboo dts has a bug: it uses a non-naturally aligned range
+for PCI memory space. This isnt' supported by the code, thus
+causing PCI to break on this system.
+
+This is due to the fact that while the chip memory map has 1G
+reserved for PCI memory, it's only 512M aligned. The code doesn't
+know how to split that into 2 different PMMs and fails, so limit
+the region to 512M.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/bamboo.dts | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/boot/dts/bamboo.dts b/arch/powerpc/boot/dts/bamboo.dts
+index aa68911f6560a..084b82ba74933 100644
+--- a/arch/powerpc/boot/dts/bamboo.dts
++++ b/arch/powerpc/boot/dts/bamboo.dts
+@@ -268,8 +268,10 @@
+ /* Outbound ranges, one memory and one IO,
+ * later cannot be changed. Chip supports a second
+ * IO range but we don't use it for now
++ * The chip also supports a larger memory range but
++ * it's not naturally aligned, so our code will break
+ */
+- ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x40000000
++ ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x20000000
+ 0x02000000 0x00000000 0x00000000 0x00000000 0xe0000000 0x00000000 0x00100000
+ 0x01000000 0x00000000 0x00000000 0x00000000 0xe8000000 0x00000000 0x00010000>;
+
+--
+2.20.1
+
--- /dev/null
+From 1b8ece315aab9749db519ff12109fd40612da74d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 17:27:42 +0000
+Subject: powerpc/book3s/32: fix number of bats in p/v_block_mapped()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit e93ba1b7eb5b188c749052df7af1c90821c5f320 ]
+
+This patch fixes the loop in p_block_mapped() and v_block_mapped()
+to scan the entire bat_addrs[] array.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/ppc_mmu_32.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/ppc_mmu_32.c b/arch/powerpc/mm/ppc_mmu_32.c
+index 6b2f3e457171a..ae0f157d201c6 100644
+--- a/arch/powerpc/mm/ppc_mmu_32.c
++++ b/arch/powerpc/mm/ppc_mmu_32.c
+@@ -52,7 +52,7 @@ struct batrange { /* stores address ranges mapped by BATs */
+ phys_addr_t v_mapped_by_bats(unsigned long va)
+ {
+ int b;
+- for (b = 0; b < 4; ++b)
++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b)
+ if (va >= bat_addrs[b].start && va < bat_addrs[b].limit)
+ return bat_addrs[b].phys + (va - bat_addrs[b].start);
+ return 0;
+@@ -64,7 +64,7 @@ phys_addr_t v_mapped_by_bats(unsigned long va)
+ unsigned long p_mapped_by_bats(phys_addr_t pa)
+ {
+ int b;
+- for (b = 0; b < 4; ++b)
++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b)
+ if (pa >= bat_addrs[b].phys
+ && pa < (bat_addrs[b].limit-bat_addrs[b].start)
+ +bat_addrs[b].phys)
+--
+2.20.1
+
--- /dev/null
+From e8446da2973a09dd836f94678556e259e3bf7e50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 15:23:33 +0000
+Subject: powerpc/mm: Make NULL pointer deferences explicit on bad page faults.
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 49a502ea23bf9dec47f8f3c3960909ff409cd1bb ]
+
+As several other arches including x86, this patch makes it explicit
+that a bad page fault is a NULL pointer dereference when the fault
+address is lower than PAGE_SIZE
+
+In the mean time, this page makes all bad_page_fault() messages
+shorter so that they remain on one single line. And it prefixes them
+by "BUG: " so that they get easily grepped.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[mpe: Avoid pr_cont()]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/fault.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index d154e333f76b7..d1f860ca03ade 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -521,21 +521,22 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
+ switch (regs->trap) {
+ case 0x300:
+ case 0x380:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "data at address 0x%08lx\n", regs->dar);
++ pr_alert("BUG: %s at 0x%08lx\n",
++ regs->dar < PAGE_SIZE ? "Kernel NULL pointer dereference" :
++ "Unable to handle kernel data access", regs->dar);
+ break;
+ case 0x400:
+ case 0x480:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "instruction fetch\n");
++ pr_alert("BUG: Unable to handle kernel instruction fetch%s",
++ regs->nip < PAGE_SIZE ? " (NULL pointer?)\n" : "\n");
+ break;
+ case 0x600:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "unaligned access at address 0x%08lx\n", regs->dar);
++ pr_alert("BUG: Unable to handle kernel unaligned access at 0x%08lx\n",
++ regs->dar);
+ break;
+ default:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "unknown fault\n");
++ pr_alert("BUG: Unable to handle unknown paging fault at 0x%08lx\n",
++ regs->dar);
+ break;
+ }
+ printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n",
+--
+2.20.1
+
--- /dev/null
+From 2192245c7c85254b38651c79315cf8ce8e9a9d2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 10:27:47 +0000
+Subject: powerpc/prom: fix early DEBUG messages
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit b18f0ae92b0a1db565c3e505fa87b6971ad3b641 ]
+
+This patch fixes early DEBUG messages in prom.c:
+- Use %px instead of %p to see the addresses
+- Cast memblock_phys_mem_size() with (unsigned long long) to
+avoid build failure when phys_addr_t is not 64 bits.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/prom.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index a15fe1d4e84ae..04a27307a2c4d 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -125,7 +125,7 @@ static void __init move_device_tree(void)
+ p = __va(memblock_alloc(size, PAGE_SIZE));
+ memcpy(p, initial_boot_params, size);
+ initial_boot_params = p;
+- DBG("Moved device tree to 0x%p\n", p);
++ DBG("Moved device tree to 0x%px\n", p);
+ }
+
+ DBG("<- move_device_tree\n");
+@@ -647,7 +647,7 @@ void __init early_init_devtree(void *params)
+ {
+ phys_addr_t limit;
+
+- DBG(" -> early_init_devtree(%p)\n", params);
++ DBG(" -> early_init_devtree(%px)\n", params);
+
+ /* Too early to BUG_ON(), do it by hand */
+ if (!early_init_dt_verify(params))
+@@ -707,7 +707,7 @@ void __init early_init_devtree(void *params)
+ memblock_allow_resize();
+ memblock_dump_all();
+
+- DBG("Phys. mem: %llx\n", memblock_phys_mem_size());
++ DBG("Phys. mem: %llx\n", (unsigned long long)memblock_phys_mem_size());
+
+ /* We may need to relocate the flat tree, do it now.
+ * FIXME .. and the initrd too? */
+--
+2.20.1
+
--- /dev/null
+From de574e202ac3c995b47cc3ef9630913aa76849cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 May 2019 10:42:40 +0800
+Subject: powerpc/pseries/dlpar: Fix a missing check in
+ dlpar_parse_cc_property()
+
+From: Gen Zhang <blackgod016574@gmail.com>
+
+[ Upstream commit efa9ace68e487ddd29c2b4d6dd23242158f1f607 ]
+
+In dlpar_parse_cc_property(), 'prop->name' is allocated by kstrdup().
+kstrdup() may return NULL, so it should be checked and handle error.
+And prop should be freed if 'prop->name' is NULL.
+
+Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/dlpar.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index a8efed3b46916..551ba5b35df9d 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -55,6 +55,10 @@ static struct property *dlpar_parse_cc_property(struct cc_workarea *ccwa)
+
+ name = (char *)ccwa + be32_to_cpu(ccwa->name_offset);
+ prop->name = kstrdup(name, GFP_KERNEL);
++ if (!prop->name) {
++ dlpar_free_cc_property(prop);
++ return NULL;
++ }
+
+ prop->length = be32_to_cpu(ccwa->prop_length);
+ value = (char *)ccwa + be32_to_cpu(ccwa->prop_offset);
+--
+2.20.1
+
--- /dev/null
+From b4bf9b58c32446d8342a8b11b36bd181cc837828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 17:31:08 +0000
+Subject: powerpc/xmon: fix dump_segments()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 32c8c4c621897199e690760c2d57054f8b84b6e6 ]
+
+mfsrin() takes segment num from bits 31-28 (IBM bits 0-3).
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[mpe: Clarify bit numbering]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/xmon/xmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 83619ebede93d..dc2ebc20a96f8 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -2840,7 +2840,7 @@ void dump_segments(void)
+
+ printf("sr0-15 =");
+ for (i = 0; i < 16; ++i)
+- printf(" %x", mfsrin(i));
++ printf(" %x", mfsrin(i << 28));
+ printf("\n");
+ }
+ #endif
+--
+2.20.1
+
--- /dev/null
+From fb17934ec5920c5e628680f402d6846bb436eed3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 13:20:36 -0800
+Subject: RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 2ee00f6a98c36f7e4ba07cc33f24cc5a69060cc9 ]
+
+This patch avoids that the SCSI mid-layer keeps retrying forever if
+ib_post_send() fails. This was discovered while testing immediate
+data support and passing a too large num_sge value to ib_post_send().
+
+Cc: Sergey Gorenko <sergeygo@mellanox.com>
+Cc: Max Gurtovoy <maxg@mellanox.com>
+Cc: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 3dbc3ed263c21..3b4188efc2835 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2135,6 +2135,7 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
+
+ if (srp_post_send(ch, iu, len)) {
+ shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n");
++ scmnd->result = DID_ERROR << 16;
+ goto err_unmap;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a3bff1f86aee78184b8d083714a5483189ff768e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 00:29:19 -0600
+Subject: regulator: tps65910: fix a missing check of return value
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit cd07e3701fa6a4c68f8493ee1d12caa18d46ec6a ]
+
+tps65910_reg_set_bits() may fail. The fix checks if it fails, and if so,
+returns with its error code.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps65910-regulator.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
+index 696116ebdf50a..9cde7b0757011 100644
+--- a/drivers/regulator/tps65910-regulator.c
++++ b/drivers/regulator/tps65910-regulator.c
+@@ -1102,8 +1102,10 @@ static int tps65910_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, pmic);
+
+ /* Give control of all register to control port */
+- tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL,
++ err = tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL,
+ DEVCTRL_SR_CTL_I2C_SEL_MASK);
++ if (err < 0)
++ return err;
+
+ switch (tps65910_chip_id(tps65910)) {
+ case TPS65910:
+--
+2.20.1
+
--- /dev/null
+From ce0533f1f18821bdca7f46f4e777b7520a7d0f07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 20:57:06 -0700
+Subject: reset: fix reset_control_ops kerneldoc comment
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit f430c7ed8bc22992ed528b518da465b060b9223f ]
+
+Add a missing short description to the reset_control_ops documentation.
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[p.zabel@pengutronix.de: rebased and updated commit message]
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/reset-controller.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h
+index ce6b962ffed43..842f70fcfc486 100644
+--- a/include/linux/reset-controller.h
++++ b/include/linux/reset-controller.h
+@@ -6,7 +6,7 @@
+ struct reset_controller_dev;
+
+ /**
+- * struct reset_control_ops
++ * struct reset_control_ops - reset controller driver callbacks
+ *
+ * @reset: for self-deasserting resets, does all necessary
+ * things to reset the device
+--
+2.20.1
+
--- /dev/null
+From 3af5e23e3fefb16b1cb5e85d9c420c8772f46748 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 18:48:10 +0800
+Subject: rtl818x: fix potential use after free
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit afbb1947db94eacc5a13302eee88a9772fb78935 ]
+
+entry is released via usb_put_urb just after calling usb_submit_urb.
+However, entry is used if the submission fails, resulting in a use after
+free bug. The patch fixes this.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+index b3691712df610..60e77eaa4ce94 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+@@ -446,12 +446,13 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
+ skb_queue_tail(&priv->rx_queue, skb);
+ usb_anchor_urb(entry, &priv->anchored);
+ ret = usb_submit_urb(entry, GFP_KERNEL);
+- usb_put_urb(entry);
+ if (ret) {
+ skb_unlink(skb, &priv->rx_queue);
+ usb_unanchor_urb(entry);
++ usb_put_urb(entry);
+ goto err;
+ }
++ usb_put_urb(entry);
+ }
+ return ret;
+
+--
+2.20.1
+
--- /dev/null
+From 5e736451a8e61c8d03cc7063b9afab9177c5d0c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 21:17:06 -0800
+Subject: scripts/gdb: fix debugging modules compiled with hot/cold
+ partitioning
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 8731acc5068eb3f422a45c760d32198175c756f8 ]
+
+gcc's -freorder-blocks-and-partition option makes it group frequently
+and infrequently used code in .text.hot and .text.unlikely sections
+respectively. At least when building modules on s390, this option is
+used by default.
+
+gdb assumes that all code is located in .text section, and that .text
+section is located at module load address. With such modules this is no
+longer the case: there is code in .text.hot and .text.unlikely, and
+either of them might precede .text.
+
+Fix by explicitly telling gdb the addresses of code sections.
+
+It might be tempting to do this for all sections, not only the ones in
+the white list. Unfortunately, gdb appears to have an issue, when
+telling it about e.g. loadable .note.gnu.build-id section causes it to
+think that non-loadable .note.Linux section is loaded at address 0,
+which in turn causes NULL pointers to be resolved to bogus symbols. So
+keep using the white list approach for the time being.
+
+Link: http://lkml.kernel.org/r/20191028152734.13065-1-iii@linux.ibm.com
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/symbols.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
+index 627750cb420d0..9b71c65504a38 100644
+--- a/scripts/gdb/linux/symbols.py
++++ b/scripts/gdb/linux/symbols.py
+@@ -99,7 +99,8 @@ lx-symbols command."""
+ attrs[n]['name'].string(): attrs[n]['address']
+ for n in range(int(sect_attrs['nsections']))}
+ args = []
+- for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]:
++ for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
++ ".text", ".text.hot", ".text.unlikely"]:
+ address = section_name_to_address.get(section_name)
+ if address:
+ args.append(" -s {name} {addr}".format(
+--
+2.20.1
+
--- /dev/null
+From 3b451f65b13388ec33146eed8f0af90dad83d5d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 15:42:50 +0530
+Subject: scsi: csiostor: fix incorrect dma device in case of vport
+
+From: Varun Prakash <varun@chelsio.com>
+
+[ Upstream commit 9934613edcb40b92a216122876cd3b7e76d08390 ]
+
+In case of ->vport_create() call scsi_add_host_with_dma() instead of
+scsi_add_host() to pass correct dma device.
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/csiostor/csio_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
+index dbe416ff46c27..776b992786881 100644
+--- a/drivers/scsi/csiostor/csio_init.c
++++ b/drivers/scsi/csiostor/csio_init.c
+@@ -648,7 +648,7 @@ csio_shost_init(struct csio_hw *hw, struct device *dev,
+ if (csio_lnode_init(ln, hw, pln))
+ goto err_shost_put;
+
+- if (scsi_add_host(shost, dev))
++ if (scsi_add_host_with_dma(shost, dev, &hw->pdev->dev))
+ goto err_lnode_exit;
+
+ return ln;
+--
+2.20.1
+
--- /dev/null
+From 1dc0424f7ceeb6c715b069f3879dbb199763067f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 00:01:27 +0800
+Subject: scsi: libsas: Check SMP PHY control function result
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 01929a65dfa13e18d89264ab1378854a91857e59 ]
+
+Currently the SMP PHY control execution result is checked, however the
+function result for the command is not.
+
+As such, we may be missing all potential errors, like SMP FUNCTION FAILED,
+INVALID REQUEST FRAME LENGTH, etc., meaning the PHY control request has
+failed.
+
+In some scenarios we need to ensure the function result is accepted, so add
+a check for this.
+
+Tested-by: Jian Luo <luojian5@huawei.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index b7e4493d3dc16..7e8274938a3ee 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -603,7 +603,14 @@ int sas_smp_phy_control(struct domain_device *dev, int phy_id,
+ }
+
+ res = smp_execute_task(dev, pc_req, PC_REQ_SIZE, pc_resp,PC_RESP_SIZE);
+-
++ if (res) {
++ pr_err("ex %016llx phy%02d PHY control failed: %d\n",
++ SAS_ADDR(dev->sas_addr), phy_id, res);
++ } else if (pc_resp[2] != SMP_RESP_FUNC_ACC) {
++ pr_err("ex %016llx phy%02d PHY control failed: function result 0x%x\n",
++ SAS_ADDR(dev->sas_addr), phy_id, pc_resp[2]);
++ res = pc_resp[2];
++ }
+ kfree(pc_resp);
+ kfree(pc_req);
+ return res;
+--
+2.20.1
+
--- /dev/null
+From 12ee49a8894cc34be6c3d0b6242092e8597353dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 00:01:28 +0800
+Subject: scsi: libsas: Support SATA PHY connection rate unmatch fixing during
+ discovery
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit cec9771d2e954650095aa37a6a97722c8194e7d2 ]
+
+ +----------+ +----------+
+ | | | |
+ | |--- 3.0 G ---| |--- 6.0 G --- SAS disk
+ | | | |
+ | |--- 3.0 G ---| |--- 6.0 G --- SAS disk
+ |initiator | | |
+ | device |--- 3.0 G ---| Expander |--- 6.0 G --- SAS disk
+ | | | |
+ | |--- 3.0 G ---| |--- 6.0 G --- SATA disk -->failed to connect
+ | | | |
+ | | | |--- 6.0 G --- SATA disk -->failed to connect
+ | | | |
+ +----------+ +----------+
+
+According to Serial Attached SCSI - 1.1 (SAS-1.1):
+If an expander PHY attached to a SATA PHY is using a physical link rate
+greater than the maximum connection rate supported by the pathway from an
+STP initiator port, a management application client should use the SMP PHY
+CONTROL function (see 10.4.3.10) to set the PROGRAMMED MAXIMUM PHYSICAL
+LINK RATE field of the expander PHY to the maximum connection rate
+supported by the pathway from that STP initiator port.
+
+Currently libsas does not support checking if this condition occurs, nor
+rectifying when it does.
+
+Such a condition is not at all common, however it has been seen on some
+pre-silicon environments where the initiator PHY only supports a 1.5 Gbit
+maximum linkrate, mated with 12G expander PHYs and 3/6G SATA phy.
+
+This patch adds support for checking and rectifying this condition during
+initial device discovery only.
+
+We do support checking min pathway connection rate during revalidation phase,
+when new devices can be detected in the topology. However we do not
+support in the case of the the user reprogramming PHY linkrates, such that
+min pathway condition is not met/maintained.
+
+A note on root port PHY rates:
+The libsas root port PHY rates calculation is broken. Libsas sets the
+rates (min, max, and current linkrate) of a root port to the same linkrate
+of the first PHY member of that same port. In doing so, it assumes that
+all other PHYs which subsequently join the port to have the same
+negotiated linkrate, when they could actually be different.
+
+In practice this doesn't happen, as initiator and expander PHYs are
+normally initialised with consistent min/max linkrates.
+
+This has not caused an issue so far, so leave alone for now.
+
+Tested-by: Jian Luo <luojian5@huawei.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index d44f18f773c0f..b7e4493d3dc16 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -806,6 +806,26 @@ static struct domain_device *sas_ex_discover_end_dev(
+
+ #ifdef CONFIG_SCSI_SAS_ATA
+ if ((phy->attached_tproto & SAS_PROTOCOL_STP) || phy->attached_sata_dev) {
++ if (child->linkrate > parent->min_linkrate) {
++ struct sas_phy_linkrates rates = {
++ .maximum_linkrate = parent->min_linkrate,
++ .minimum_linkrate = parent->min_linkrate,
++ };
++ int ret;
++
++ pr_notice("ex %016llx phy%02d SATA device linkrate > min pathway connection rate, attempting to lower device linkrate\n",
++ SAS_ADDR(child->sas_addr), phy_id);
++ ret = sas_smp_phy_control(parent, phy_id,
++ PHY_FUNC_LINK_RESET, &rates);
++ if (ret) {
++ pr_err("ex %016llx phy%02d SATA device could not set linkrate (%d)\n",
++ SAS_ADDR(child->sas_addr), phy_id, ret);
++ goto out_free;
++ }
++ pr_notice("ex %016llx phy%02d SATA device set linkrate successfully\n",
++ SAS_ADDR(child->sas_addr), phy_id);
++ child->linkrate = child->min_linkrate;
++ }
+ res = sas_get_ata_info(child, phy);
+ if (res)
+ goto out_free;
+--
+2.20.1
+
--- /dev/null
+From d79b120c6a55aed95e1bb8c496b5e1ccfd5e45c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 16:09:40 -0800
+Subject: scsi: lpfc: Fix dif and first burst use in write commands
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 7c4042a4d0b7532cfbc90478fd3084b2dab5849e ]
+
+When dif and first burst is used in a write command wqe, the driver was not
+properly setting fields in the io command request. This resulted in no dif
+bytes being sent and invalid xfer_rdy's, resulting in the io being aborted
+by the hardware.
+
+Correct the wqe initializaton when both dif and first burst are used.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index bae36cc3740b6..ab6bff60478f9 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -2707,6 +2707,7 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba,
+ int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction;
+ int prot_group_type = 0;
+ int fcpdl;
++ struct lpfc_vport *vport = phba->pport;
+
+ /*
+ * Start the lpfc command prep by bumping the bpl beyond fcp_cmnd
+@@ -2812,6 +2813,14 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba,
+ */
+ iocb_cmd->un.fcpi.fcpi_parm = fcpdl;
+
++ /*
++ * For First burst, we may need to adjust the initial transfer
++ * length for DIF
++ */
++ if (iocb_cmd->un.fcpi.fcpi_XRdy &&
++ (fcpdl < vport->cfg_first_burst_size))
++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl;
++
+ return 0;
+ err:
+ if (lpfc_cmd->seg_cnt)
+@@ -3361,6 +3370,7 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba,
+ int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction;
+ int prot_group_type = 0;
+ int fcpdl;
++ struct lpfc_vport *vport = phba->pport;
+
+ /*
+ * Start the lpfc command prep by bumping the sgl beyond fcp_cmnd
+@@ -3476,6 +3486,14 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba,
+ */
+ iocb_cmd->un.fcpi.fcpi_parm = fcpdl;
+
++ /*
++ * For First burst, we may need to adjust the initial transfer
++ * length for DIF
++ */
++ if (iocb_cmd->un.fcpi.fcpi_XRdy &&
++ (fcpdl < vport->cfg_first_burst_size))
++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl;
++
+ /*
+ * If the OAS driver feature is enabled and the lun is enabled for
+ * OAS, set the oas iocb related flags.
+--
+2.20.1
+
--- /dev/null
+From 98918648fa863ebdffaa227ce7d1f6945f2fcc85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 16:48:45 -0700
+Subject: scsi: qla2xxx: deadlock by configfs_depend_item
+
+From: Anatoliy Glagolev <glagolig@gmail.com>
+
+[ Upstream commit 17b18eaa6f59044a5172db7d07149e31ede0f920 ]
+
+The intent of invoking configfs_depend_item in commit 7474f52a82d51
+("tcm_qla2xxx: Perform configfs depend/undepend for base_tpg")
+was to prevent a physical Fibre Channel port removal when
+virtual (NPIV) ports announced through that physical port are active.
+The change does not work as expected: it makes enabled physical port
+dependent on target configfs subsystem (the port's parent), something
+the configfs guarantees anyway.
+
+Besides, scheduling work in a worker thread and waiting for the work's
+completion is not really a valid workaround for the requirement not to call
+configfs_depend_item from a configfs callback: the call occasionally
+deadlocks.
+
+Thus, removing configfs_depend_item calls does not break anything and fixes
+the deadlock problem.
+
+Signed-off-by: Anatoliy Glagolev <glagolig@gmail.com>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/tcm_qla2xxx.c | 48 +++++-------------------------
+ drivers/scsi/qla2xxx/tcm_qla2xxx.h | 3 --
+ 2 files changed, 8 insertions(+), 43 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 81af294f15a7d..b1233ce6cb475 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -793,38 +793,14 @@ static ssize_t tcm_qla2xxx_tpg_enable_show(struct config_item *item,
+ atomic_read(&tpg->lport_tpg_enabled));
+ }
+
+-static void tcm_qla2xxx_depend_tpg(struct work_struct *work)
+-{
+- struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+- struct tcm_qla2xxx_tpg, tpg_base_work);
+- struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+-
+- if (!target_depend_item(&se_tpg->tpg_group.cg_item)) {
+- atomic_set(&base_tpg->lport_tpg_enabled, 1);
+- qlt_enable_vha(base_vha);
+- }
+- complete(&base_tpg->tpg_base_comp);
+-}
+-
+-static void tcm_qla2xxx_undepend_tpg(struct work_struct *work)
+-{
+- struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+- struct tcm_qla2xxx_tpg, tpg_base_work);
+- struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+-
+- if (!qlt_stop_phase1(base_vha->vha_tgt.qla_tgt)) {
+- atomic_set(&base_tpg->lport_tpg_enabled, 0);
+- target_undepend_item(&se_tpg->tpg_group.cg_item);
+- }
+- complete(&base_tpg->tpg_base_comp);
+-}
+-
+ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ const char *page, size_t count)
+ {
+ struct se_portal_group *se_tpg = to_tpg(item);
++ struct se_wwn *se_wwn = se_tpg->se_tpg_wwn;
++ struct tcm_qla2xxx_lport *lport = container_of(se_wwn,
++ struct tcm_qla2xxx_lport, lport_wwn);
++ struct scsi_qla_host *vha = lport->qla_vha;
+ struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
+ struct tcm_qla2xxx_tpg, se_tpg);
+ unsigned long op;
+@@ -843,24 +819,16 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ if (atomic_read(&tpg->lport_tpg_enabled))
+ return -EEXIST;
+
+- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_depend_tpg);
++ atomic_set(&tpg->lport_tpg_enabled, 1);
++ qlt_enable_vha(vha);
+ } else {
+ if (!atomic_read(&tpg->lport_tpg_enabled))
+ return count;
+
+- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_undepend_tpg);
++ atomic_set(&tpg->lport_tpg_enabled, 0);
++ qlt_stop_phase1(vha->vha_tgt.qla_tgt);
+ }
+- init_completion(&tpg->tpg_base_comp);
+- schedule_work(&tpg->tpg_base_work);
+- wait_for_completion(&tpg->tpg_base_comp);
+
+- if (op) {
+- if (!atomic_read(&tpg->lport_tpg_enabled))
+- return -ENODEV;
+- } else {
+- if (atomic_read(&tpg->lport_tpg_enabled))
+- return -EPERM;
+- }
+ return count;
+ }
+
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+index 3bbf4cb6fd97e..344f4eab5403c 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+@@ -47,9 +47,6 @@ struct tcm_qla2xxx_tpg {
+ struct tcm_qla2xxx_tpg_attrib tpg_attrib;
+ /* Returned by tcm_qla2xxx_make_tpg() */
+ struct se_portal_group se_tpg;
+- /* Items for dealing with configfs_depend_item */
+- struct completion tpg_base_comp;
+- struct work_struct tpg_base_work;
+ };
+
+ struct tcm_qla2xxx_fc_loopid {
+--
+2.20.1
+
--- /dev/null
+From 854fd8eac9e9905991dc18d1a756688da2f0c852 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 14:19:20 +0300
+Subject: serial: max310x: Fix tx_empty() callback
+
+From: Alexander Shiyan <shc_work@mail.ru>
+
+[ Upstream commit a8da3c7873ea57acb8f9cea58c0af477522965aa ]
+
+Function max310x_tx_empty() accesses the IRQSTS register, which is
+cleared by IC when reading, so if there is an interrupt status, we
+will lose it. This patch implement the transmitter check only by
+the current FIFO level.
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index a66fb7afecc71..e13e95733fa3c 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -763,12 +763,9 @@ static void max310x_start_tx(struct uart_port *port)
+
+ static unsigned int max310x_tx_empty(struct uart_port *port)
+ {
+- unsigned int lvl, sts;
++ u8 lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG);
+
+- lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG);
+- sts = max310x_port_read(port, MAX310X_IRQSTS_REG);
+-
+- return ((sts & MAX310X_IRQ_TXEMPTY_BIT) && !lvl) ? TIOCSER_TEMT : 0;
++ return lvl ? 0 : TIOCSER_TEMT;
+ }
+
+ static unsigned int max310x_get_mctrl(struct uart_port *port)
+--
+2.20.1
+
--- /dev/null
+asoc-compress-fix-unsigned-integer-overflow-check.patch
+asoc-kirkwood-fix-external-clock-probe-defer.patch
+clk-samsung-exynos5420-preserve-pll-configuration-du.patch
+reset-fix-reset_control_ops-kerneldoc-comment.patch
+can-peak_usb-report-bus-recovery-as-well.patch
+can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch
+scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch
+block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch
+scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch
+arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch
+arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch
+parisc-fix-serio-address-output.patch
+parisc-fix-hp-sdc-hpa-address-output.patch
+arm64-smp-handle-errors-reported-by-the-firmware.patch
+pm-avs-smartreflex-null-check-before-some-freeing-fu.patch
+arm-ks8695-fix-section-mismatch-warning.patch
+acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch
+crypto-user-support-incremental-algorithm-dumps.patch
+mwifiex-fix-potential-null-dereference-and-use-after.patch
+mwifiex-debugfs-correct-histogram-spacing-formatting.patch
+rtl818x-fix-potential-use-after-free.patch
+xfs-require-both-realtime-inodes-to-mount.patch
+ubi-put-mtd-device-after-it-is-not-used.patch
+ubi-do-not-drop-ubi-device-reference-before-using.patch
+microblaze-adjust-the-help-to-the-real-behavior.patch
+microblaze-move-.-is-ready-messages-to-arch-microbla.patch
+gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch
+vsock-bind-to-random-port-for-vmaddr_port_any.patch
+btrfs-only-track-ref_heads-in-delayed_ref_updates.patch
+xen-pciback-check-dev_data-before-using-it.patch
+kvm-s390-unregister-debug-feature-on-failing-arch-in.patch
+pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch
+pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch
+hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch
+gfs2-take-jdata-unstuff-into-account-in-do_grow.patch
+xfs-align-compat-attrlist_by_handle-with-native-impl.patch
+ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch
+powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch
+powerpc-xmon-fix-dump_segments.patch
+drivers-regulator-fix-a-missing-check-of-return-valu.patch
+serial-max310x-fix-tx_empty-callback.patch
+openrisc-fix-broken-paths-to-arch-or32.patch
+rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch
+scsi-qla2xxx-deadlock-by-configfs_depend_item.patch
+scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch
+ath6kl-only-use-match-sets-when-firmware-supports-it.patch
+ath6kl-fix-off-by-one-error-in-scan-completion.patch
+powerpc-prom-fix-early-debug-messages.patch
+powerpc-mm-make-null-pointer-deferences-explicit-on-.patch
+powerpc-44x-bamboo-fix-pci-range.patch
+drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch
+drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch
+regulator-tps65910-fix-a-missing-check-of-return-val.patch
+net-net_namespace-check-the-return-value-of-register.patch
+um-make-gcov-depend-on-kcov.patch
+net-stmicro-fix-a-missing-check-of-clk_prepare.patch
+atl1e-checking-the-status-of-atl1e_write_phy_reg.patch
+tipc-fix-a-missing-check-of-genlmsg_put.patch
+ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch
+lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch
+lib-genalloc.c-include-vmalloc.h.patch
+mtd-check-add_mtd_device-ret-code.patch
+tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch
+net-core-neighbour-tell-kmemleak-about-hash-tables.patch
+net-core-neighbour-fix-kmemleak-minimal-reference-co.patch
+sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch
+decnet-fix-dn_ifreq_size.patch
+tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch
+sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch
+net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch
+net-dev-use-unsigned-integer-as-an-argument-to-left-.patch
+scsi-libsas-support-sata-phy-connection-rate-unmatch.patch
+acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch
+scsi-libsas-check-smp-phy-control-function-result.patch
+powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch
+mtd-remove-a-debug-trace-in-mtdpart.c.patch
--- /dev/null
+From 204df591ca544a28f77624750847500a4c0ff558 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 13:10:00 +0000
+Subject: sfc: initialise found bitmap in efx_ef10_mtd_probe
+
+From: Bert Kenward <bkenward@solarflare.com>
+
+[ Upstream commit c65285428b6e7797f1bb063f33b0ae7e93397b7b ]
+
+The bitmap of found partitions in efx_ef10_mtd_probe was not
+initialised, causing partitions to be suppressed based off whatever
+value was in the bitmap at the start.
+
+Fixes: 3366463513f5 ("sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe")
+Signed-off-by: Bert Kenward <bkenward@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 79a1031c3ef77..6dcd436e6e323 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -4499,7 +4499,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ {
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
+- DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT) = { 0 };
+ struct efx_mcdi_mtd_partition *parts;
+ size_t outlen, n_parts_total, i, n_parts;
+ unsigned int type;
+--
+2.20.1
+
--- /dev/null
+From f0106b64c72905e41b3bf22076d37bba8133baf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jan 2019 19:02:17 +0000
+Subject: sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
+
+From: Edward Cree <ecree@solarflare.com>
+
+[ Upstream commit 3366463513f544c12c6b88c13da4462ee9e7a1a1 ]
+
+Use a bitmap to keep track of which partition types we've already seen;
+ for duplicates, return -EEXIST from efx_ef10_mtd_probe_partition() and
+ thus skip adding that partition.
+Duplicate partitions occur because of the A/B backup scheme used by newer
+ sfc NICs. Prior to this patch they cause sysfs_warn_dup errors because
+ they have the same name, causing us not to expose any MTDs at all.
+
+Signed-off-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 063aca17e698b..79a1031c3ef77 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -4433,22 +4433,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = {
+ { NVRAM_PARTITION_TYPE_LICENSE, 0, 0, "sfc_license" },
+ { NVRAM_PARTITION_TYPE_PHY_MIN, 0xff, 0, "sfc_phy_fw" },
+ };
++#define EF10_NVRAM_PARTITION_COUNT ARRAY_SIZE(efx_ef10_nvram_types)
+
+ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ struct efx_mcdi_mtd_partition *part,
+- unsigned int type)
++ unsigned int type,
++ unsigned long *found)
+ {
+ MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN);
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX);
+ const struct efx_ef10_nvram_type_info *info;
+ size_t size, erase_size, outlen;
++ int type_idx = 0;
+ bool protected;
+ int rc;
+
+- for (info = efx_ef10_nvram_types; ; info++) {
+- if (info ==
+- efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types))
++ for (type_idx = 0; ; type_idx++) {
++ if (type_idx == EF10_NVRAM_PARTITION_COUNT)
+ return -ENODEV;
++ info = efx_ef10_nvram_types + type_idx;
+ if ((type & ~info->type_mask) == info->type)
+ break;
+ }
+@@ -4461,6 +4464,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ if (protected)
+ return -ENODEV; /* hide it */
+
++ /* If we've already exposed a partition of this type, hide this
++ * duplicate. All operations on MTDs are keyed by the type anyway,
++ * so we can't act on the duplicate.
++ */
++ if (__test_and_set_bit(type_idx, found))
++ return -EEXIST;
++
+ part->nvram_type = type;
+
+ MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type);
+@@ -4489,6 +4499,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ {
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
+ struct efx_mcdi_mtd_partition *parts;
+ size_t outlen, n_parts_total, i, n_parts;
+ unsigned int type;
+@@ -4517,11 +4528,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ for (i = 0; i < n_parts_total; i++) {
+ type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID,
+ i);
+- rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type);
+- if (rc == 0)
+- n_parts++;
+- else if (rc != -ENODEV)
++ rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type,
++ found);
++ if (rc == -EEXIST || rc == -ENODEV)
++ continue;
++ if (rc)
+ goto fail;
++ n_parts++;
+ }
+
+ rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts));
+--
+2.20.1
+
--- /dev/null
+From 060821663ded213f21ed7276e1390aa66b4dea68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 00:09:04 -0600
+Subject: tipc: fix a missing check of genlmsg_put
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 46273cf7e009231d2b6bc10a926e82b8928a9fb2 ]
+
+genlmsg_put could fail. The fix inserts a check of its return value, and
+if it fails, returns -EMSGSIZE.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index d2bf92e711505..4f6fbd2f29add 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -926,6 +926,8 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
+
+ hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
+ TIPC_NL_PUBL_GET);
++ if (!hdr)
++ return -EMSGSIZE;
+
+ nest = nla_nest_start(args, TIPC_NLA_SOCK);
+ if (!nest) {
+--
+2.20.1
+
--- /dev/null
+From 07c73b33e8b23b1640e0a1d3b61f0580efb0e659 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 10:52:23 -0600
+Subject: tipc: fix memory leak in tipc_nl_compat_publ_dump
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit f87d8ad9233f115db92c6c087d58403b0009ed36 ]
+
+There is a memory leak in case genlmsg_put fails.
+
+Fix this by freeing *args* before return.
+
+Addresses-Coverity-ID: 1476406 ("Resource leak")
+Fixes: 46273cf7e009 ("tipc: fix a missing check of genlmsg_put")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 4f6fbd2f29add..392d72d65e602 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -926,8 +926,10 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
+
+ hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
+ TIPC_NL_PUBL_GET);
+- if (!hdr)
++ if (!hdr) {
++ kfree_skb(args);
+ return -EMSGSIZE;
++ }
+
+ nest = nla_nest_start(args, TIPC_NLA_SOCK);
+ if (!nest) {
+--
+2.20.1
+
--- /dev/null
+From 18c7085ad0eaec0eec7f2dbb6cbb9612a6e9e172 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 09:18:28 +0700
+Subject: tipc: fix skb may be leaky in tipc_link_input
+
+From: Hoang Le <hoang.h.le@dektech.com.au>
+
+[ Upstream commit 7384b538d3aed2ed49d3575483d17aeee790fb06 ]
+
+When we free skb at tipc_data_input, we return a 'false' boolean.
+Then, skb passed to subcalling tipc_link_input in tipc_link_rcv,
+
+<snip>
+1303 int tipc_link_rcv:
+...
+1354 if (!tipc_data_input(l, skb, l->inputq))
+1355 rc |= tipc_link_input(l, skb, l->inputq);
+</snip>
+
+Fix it by simple changing to a 'true' boolean when skb is being free-ed.
+Then, tipc_link_rcv will bypassed to subcalling tipc_link_input as above
+condition.
+
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Acked-by: Jon Maloy <maloy@donjonn.com>
+Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/link.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 736fffb28ab6f..0080699b7cd1b 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -883,7 +883,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
+ default:
+ pr_warn("Dropping received illegal msg type\n");
+ kfree_skb(skb);
+- return false;
++ return true;
+ };
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 64f2af2320873d8acc11c0d59adfcc5bbca562b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 11:20:03 +0800
+Subject: ubi: Do not drop UBI device reference before using
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit e542087701f09418702673631a908429feb3eae0 ]
+
+The UBI device reference is dropped but then the device is used as a
+parameter of ubi_err. The bug is introduced in changing ubi_err's
+behavior. The old ubi_err does not require a UBI device as its first
+parameter, but the new one does.
+
+Fixes: 32608703310 ("UBI: Extend UBI layer debug/messaging capabilities")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/kapi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
+index e844887732fbd..1db375caef71b 100644
+--- a/drivers/mtd/ubi/kapi.c
++++ b/drivers/mtd/ubi/kapi.c
+@@ -227,9 +227,9 @@ out_unlock:
+ out_free:
+ kfree(desc);
+ out_put_ubi:
+- ubi_put_device(ubi);
+ ubi_err(ubi, "cannot open device %d, volume %d, error %d",
+ ubi_num, vol_id, err);
++ ubi_put_device(ubi);
+ return ERR_PTR(err);
+ }
+ EXPORT_SYMBOL_GPL(ubi_open_volume);
+--
+2.20.1
+
--- /dev/null
+From d7f81790cfeed6ddbdc6506363959259a125389a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:57:33 +0800
+Subject: ubi: Put MTD device after it is not used
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit b95f83ab762dd6211351b9140f99f43644076ca8 ]
+
+The MTD device reference is dropped via put_mtd_device, however its
+field ->index is read and passed to ubi_msg. To fix this, the patch
+moves the reference dropping after calling ubi_msg.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/build.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index c9f5ae424af75..ae8e55b4f6f93 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -1141,10 +1141,10 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
+ ubi_wl_close(ubi);
+ ubi_free_internal_volumes(ubi);
+ vfree(ubi->vtbl);
+- put_mtd_device(ubi->mtd);
+ vfree(ubi->peb_buf);
+ vfree(ubi->fm_buf);
+ ubi_msg(ubi, "mtd%d is detached", ubi->mtd->index);
++ put_mtd_device(ubi->mtd);
+ put_device(&ubi->dev);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From c5a03cf13c995c2f68df55286a2296dfbefb225e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 12:58:12 +0100
+Subject: um: Make GCOV depend on !KCOV
+
+From: Richard Weinberger <richard@nod.at>
+
+[ Upstream commit 550ed0e2036663b35cec12374b835444f9c60454 ]
+
+Both do more or less the same thing and are mutually exclusive.
+If both are enabled the build will fail.
+Sooner or later we can kill UML's GCOV.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/Kconfig.debug | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/um/Kconfig.debug b/arch/um/Kconfig.debug
+index 68205fd3b08c8..6ae7f0f434a9c 100644
+--- a/arch/um/Kconfig.debug
++++ b/arch/um/Kconfig.debug
+@@ -18,6 +18,7 @@ config GPROF
+ config GCOV
+ bool "Enable gcov support"
+ depends on DEBUG_INFO
++ depends on !KCOV
+ help
+ This option allows developers to retrieve coverage data from a UML
+ session.
+--
+2.20.1
+
--- /dev/null
+From bd8b041c30cab6728edca1c85c518d92dd647dbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 11:12:55 -0800
+Subject: VSOCK: bind to random port for VMADDR_PORT_ANY
+
+From: Lepton Wu <ytht.net@gmail.com>
+
+[ Upstream commit 8236b08cf50f85bbfaf48910a0b3ee68318b7c4b ]
+
+The old code always starts from fixed port for VMADDR_PORT_ANY. Sometimes
+when VMM crashed, there is still orphaned vsock which is waiting for
+close timer, then it could cause connection time out for new started VM
+if they are trying to connect to same port with same guest cid since the
+new packets could hit that orphaned vsock. We could also fix this by doing
+more in vhost_vsock_reset_orphans, but any way, it should be better to start
+from a random local port instead of a fixed one.
+
+Signed-off-by: Lepton Wu <ytht.net@gmail.com>
+Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/af_vsock.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 7f1d166ce6128..412d56614fd5e 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -89,6 +89,7 @@
+ #include <linux/mutex.h>
+ #include <linux/net.h>
+ #include <linux/poll.h>
++#include <linux/random.h>
+ #include <linux/skbuff.h>
+ #include <linux/smp.h>
+ #include <linux/socket.h>
+@@ -483,9 +484,13 @@ out:
+ static int __vsock_bind_stream(struct vsock_sock *vsk,
+ struct sockaddr_vm *addr)
+ {
+- static u32 port = LAST_RESERVED_PORT + 1;
++ static u32 port = 0;
+ struct sockaddr_vm new_addr;
+
++ if (!port)
++ port = LAST_RESERVED_PORT + 1 +
++ prandom_u32_max(U32_MAX - LAST_RESERVED_PORT);
++
+ vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port);
+
+ if (addr->svm_port == VMADDR_PORT_ANY) {
+--
+2.20.1
+
--- /dev/null
+From 982504a1f08408b26e0b465a6bea8c0a42f40344 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 12:55:45 +0000
+Subject: xen/pciback: Check dev_data before using it
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+[ Upstream commit 1669907e3d1abfa3f7586e2d55dbbc117b5adba2 ]
+
+If pcistub_init_device fails, the release function will be called with
+dev_data set to NULL. Check it before using it to avoid a NULL pointer
+dereference.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xen-pciback/pci_stub.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
+index 258b7c3256499..47c6df53cabfb 100644
+--- a/drivers/xen/xen-pciback/pci_stub.c
++++ b/drivers/xen/xen-pciback/pci_stub.c
+@@ -104,7 +104,8 @@ static void pcistub_device_release(struct kref *kref)
+ * is called from "unbind" which takes a device_lock mutex.
+ */
+ __pci_reset_function_locked(dev);
+- if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
++ if (dev_data &&
++ pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
+ dev_info(&dev->dev, "Could not reload PCI state\n");
+ else
+ pci_restore_state(dev);
+--
+2.20.1
+
--- /dev/null
+From 37363a839ee76daa85f9e21b6d994f789c7b2ca9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 09:35:27 -0800
+Subject: xfs: Align compat attrlist_by_handle with native implementation.
+
+From: Nick Bowler <nbowler@draconx.ca>
+
+[ Upstream commit c456d64449efe37da50832b63d91652a85ea1d20 ]
+
+While inspecting the ioctl implementations, I noticed that the compat
+implementation of XFS_IOC_ATTRLIST_BY_HANDLE does not do exactly the
+same thing as the native implementation. Specifically, the "cursor"
+does not appear to be written out to userspace on the compat path,
+like it is on the native path.
+
+This adjusts the compat implementation to copy out the cursor just
+like the native implementation does. The attrlist cursor does not
+require any special compat handling. This fixes xfstests xfs/269
+on both IA-32 and x32 userspace, when running on an amd64 kernel.
+
+Signed-off-by: Nick Bowler <nbowler@draconx.ca>
+Fixes: 0facef7fb053b ("xfs: in _attrlist_by_handle, copy the cursor back to userspace")
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_ioctl32.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
+index 1a05d8ae327db..e7372cef5ac33 100644
+--- a/fs/xfs/xfs_ioctl32.c
++++ b/fs/xfs/xfs_ioctl32.c
+@@ -346,6 +346,7 @@ xfs_compat_attrlist_by_handle(
+ {
+ int error;
+ attrlist_cursor_kern_t *cursor;
++ compat_xfs_fsop_attrlist_handlereq_t __user *p = arg;
+ compat_xfs_fsop_attrlist_handlereq_t al_hreq;
+ struct dentry *dentry;
+ char *kbuf;
+@@ -380,6 +381,11 @@ xfs_compat_attrlist_by_handle(
+ if (error)
+ goto out_kfree;
+
++ if (copy_to_user(&p->pos, cursor, sizeof(attrlist_cursor_kern_t))) {
++ error = -EFAULT;
++ goto out_kfree;
++ }
++
+ if (copy_to_user(compat_ptr(al_hreq.buffer), kbuf, al_hreq.buflen))
+ error = -EFAULT;
+
+--
+2.20.1
+
--- /dev/null
+From 86b06b3315af91d25b9226b82bd6e3dc86f956c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 15:18:52 -0800
+Subject: xfs: require both realtime inodes to mount
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 64bafd2f1e484e27071e7584642005d56516cb77 ]
+
+Since mkfs always formats the filesystem with the realtime bitmap and
+summary inodes immediately after the root directory, we should expect
+that both of them are present and loadable, even if there isn't a
+realtime volume attached. There's no reason to skip this if rbmino ==
+NULLFSINO; in fact, this causes an immediate crash if the there /is/ a
+realtime volume and someone writes to it.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Bill O'Donnell <billodo@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_rtalloc.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
+index ab1bac6a3a1c0..919b6544b61a3 100644
+--- a/fs/xfs/xfs_rtalloc.c
++++ b/fs/xfs/xfs_rtalloc.c
+@@ -1225,13 +1225,11 @@ xfs_rtmount_inodes(
+ xfs_sb_t *sbp;
+
+ sbp = &mp->m_sb;
+- if (sbp->sb_rbmino == NULLFSINO)
+- return 0;
+ error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip);
+ if (error)
+ return error;
+ ASSERT(mp->m_rbmip != NULL);
+- ASSERT(sbp->sb_rsumino != NULLFSINO);
++
+ error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip);
+ if (error) {
+ IRELE(mp->m_rbmip);
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
