--- /dev/null
+From eceb05965489784f24bbf4d61ba60e475a983016 Mon Sep 17 00:00:00 2001
+From: Dexuan Cui <decui@microsoft.com>
+Date: Mon, 26 Nov 2018 02:29:56 +0000
+Subject: Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
+
+From: Dexuan Cui <decui@microsoft.com>
+
+commit eceb05965489784f24bbf4d61ba60e475a983016 upstream.
+
+This is a longstanding issue: if the vmbus upper-layer drivers try to
+consume too many GPADLs, the host may return with an error
+0xC0000044 (STATUS_QUOTA_EXCEEDED), but currently we forget to check
+the creation_status, and hence we can pass an invalid GPADL handle
+into the OPEN_CHANNEL message, and get an error code 0xc0000225 in
+open_info->response.open_result.status, and finally we hang in
+vmbus_open() -> "goto error_free_info" -> vmbus_teardown_gpadl().
+
+With this patch, we can exit gracefully on STATUS_QUOTA_EXCEEDED.
+
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Cc: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/channel.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -448,6 +448,14 @@ int vmbus_establish_gpadl(struct vmbus_c
+ }
+ wait_for_completion(&msginfo->waitevent);
+
++ if (msginfo->response.gpadl_created.creation_status != 0) {
++ pr_err("Failed to establish GPADL: err = 0x%x\n",
++ msginfo->response.gpadl_created.creation_status);
++
++ ret = -EDQUOT;
++ goto cleanup;
++ }
++
+ if (channel->rescind) {
+ ret = -ENODEV;
+ goto cleanup;
--- /dev/null
+From fe5192ac81ad0d4dfe1395d11f393f0513c15f7f Mon Sep 17 00:00:00 2001
+From: Martin Kelly <martin@martingkelly.com>
+Date: Sun, 28 Oct 2018 20:18:53 -0700
+Subject: iio:st_magn: Fix enable device after trigger
+
+From: Martin Kelly <martin@martingkelly.com>
+
+commit fe5192ac81ad0d4dfe1395d11f393f0513c15f7f upstream.
+
+Currently, we enable the device before we enable the device trigger. At
+high frequencies, this can cause interrupts that don't yet have a poll
+function associated with them and are thus treated as spurious. At high
+frequencies with level interrupts, this can even cause an interrupt storm
+of repeated spurious interrupts (~100,000 on my Beagleboard with the
+LSM9DS1 magnetometer). If these repeat too much, the interrupt will get
+disabled and the device will stop functioning.
+
+To prevent these problems, enable the device prior to enabling the device
+trigger, and disable the divec prior to disabling the trigger. This means
+there's no window of time during which the device creates interrupts but we
+have no trigger to answer them.
+
+Fixes: 90efe055629 ("iio: st_sensors: harden interrupt handling")
+Signed-off-by: Martin Kelly <martin@martingkelly.com>
+Tested-by: Denis Ciocca <denis.ciocca@st.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/magnetometer/st_magn_buffer.c | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+--- a/drivers/iio/magnetometer/st_magn_buffer.c
++++ b/drivers/iio/magnetometer/st_magn_buffer.c
+@@ -30,11 +30,6 @@ int st_magn_trig_set_state(struct iio_tr
+ return st_sensors_set_dataready_irq(indio_dev, state);
+ }
+
+-static int st_magn_buffer_preenable(struct iio_dev *indio_dev)
+-{
+- return st_sensors_set_enable(indio_dev, true);
+-}
+-
+ static int st_magn_buffer_postenable(struct iio_dev *indio_dev)
+ {
+ int err;
+@@ -50,7 +45,7 @@ static int st_magn_buffer_postenable(str
+ if (err < 0)
+ goto st_magn_buffer_postenable_error;
+
+- return err;
++ return st_sensors_set_enable(indio_dev, true);
+
+ st_magn_buffer_postenable_error:
+ kfree(mdata->buffer_data);
+@@ -63,11 +58,11 @@ static int st_magn_buffer_predisable(str
+ int err;
+ struct st_sensor_data *mdata = iio_priv(indio_dev);
+
+- err = iio_triggered_buffer_predisable(indio_dev);
++ err = st_sensors_set_enable(indio_dev, false);
+ if (err < 0)
+ goto st_magn_buffer_predisable_error;
+
+- err = st_sensors_set_enable(indio_dev, false);
++ err = iio_triggered_buffer_predisable(indio_dev);
+
+ st_magn_buffer_predisable_error:
+ kfree(mdata->buffer_data);
+@@ -75,7 +70,6 @@ st_magn_buffer_predisable_error:
+ }
+
+ static const struct iio_buffer_setup_ops st_magn_buffer_setup_ops = {
+- .preenable = &st_magn_buffer_preenable,
+ .postenable = &st_magn_buffer_postenable,
+ .predisable = &st_magn_buffer_predisable,
+ };
--- /dev/null
+From 6484a677294aa5d08c0210f2f387ebb9be646115 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 14 Nov 2018 01:57:03 +0000
+Subject: misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+commit 6484a677294aa5d08c0210f2f387ebb9be646115 upstream.
+
+gcc '-Wunused-but-set-variable' warning:
+
+drivers/misc/mic/scif/scif_rma.c: In function 'scif_create_remote_lookup':
+drivers/misc/mic/scif/scif_rma.c:373:25: warning:
+ variable 'vmalloc_num_pages' set but not used [-Wunused-but-set-variable]
+
+'vmalloc_num_pages' should be used to determine if the address is
+within the vmalloc range.
+
+Fixes: ba612aa8b487 ("misc: mic: SCIF memory registration and unregistration")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mic/scif/scif_rma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/mic/scif/scif_rma.c
++++ b/drivers/misc/mic/scif/scif_rma.c
+@@ -414,7 +414,7 @@ static int scif_create_remote_lookup(str
+ if (err)
+ goto error_window;
+ err = scif_map_page(&window->num_pages_lookup.lookup[j],
+- vmalloc_dma_phys ?
++ vmalloc_num_pages ?
+ vmalloc_to_page(&window->num_pages[i]) :
+ virt_to_page(&window->num_pages[i]),
+ remote_dev);
--- /dev/null
+From c1cb20d43728aa9b5393bd8d489bc85c142949b2 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Fri, 30 Nov 2018 14:09:03 -0800
+Subject: mm: use swp_offset as key in shmem_replace_page()
+
+From: Yu Zhao <yuzhao@google.com>
+
+commit c1cb20d43728aa9b5393bd8d489bc85c142949b2 upstream.
+
+We changed the key of swap cache tree from swp_entry_t.val to
+swp_offset. We need to do so in shmem_replace_page() as well.
+
+Hugh said:
+ "shmem_replace_page() has been wrong since the day I wrote it: good
+ enough to work on swap "type" 0, which is all most people ever use
+ (especially those few who need shmem_replace_page() at all), but
+ broken once there are any non-0 swp_type bits set in the higher order
+ bits"
+
+Link: http://lkml.kernel.org/r/20181121215442.138545-1-yuzhao@google.com
+Fixes: f6ab1f7f6b2d ("mm, swap: use offset of swap entry as key of swap cache")
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Reviewed-by: Matthew Wilcox <willy@infradead.org>
+Acked-by: Hugh Dickins <hughd@google.com>
+Cc: <stable@vger.kernel.org> [4.9+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/shmem.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1494,11 +1494,13 @@ static int shmem_replace_page(struct pag
+ {
+ struct page *oldpage, *newpage;
+ struct address_space *swap_mapping;
++ swp_entry_t entry;
+ pgoff_t swap_index;
+ int error;
+
+ oldpage = *pagep;
+- swap_index = page_private(oldpage);
++ entry.val = page_private(oldpage);
++ swap_index = swp_offset(entry);
+ swap_mapping = page_mapping(oldpage);
+
+ /*
+@@ -1517,7 +1519,7 @@ static int shmem_replace_page(struct pag
+ __SetPageLocked(newpage);
+ __SetPageSwapBacked(newpage);
+ SetPageUptodate(newpage);
+- set_page_private(newpage, swap_index);
++ set_page_private(newpage, entry.val);
+ SetPageSwapCache(newpage);
+
+ /*
--- /dev/null
+From 38317f5c0f2faae5110854f36edad810f841d62f Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Mon, 19 Nov 2018 08:34:04 +0200
+Subject: Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid"
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit 38317f5c0f2faae5110854f36edad810f841d62f upstream.
+
+This reverts commit ffb80fc672c3a7b6afd0cefcb1524fb99917b2f3.
+
+Turns out that commit is wrong. Host controllers are allowed to use
+Clear Feature HALT as means to sync data toggle between host and
+periperal.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1280,9 +1280,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc
+ unsigned transfer_in_flight;
+ unsigned started;
+
+- if (dep->flags & DWC3_EP_STALL)
+- return 0;
+-
+ if (dep->number > 1)
+ trb = dwc3_ep_prev_trb(dep, dep->trb_enqueue);
+ else
+@@ -1307,8 +1304,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc
+ else
+ dep->flags |= DWC3_EP_STALL;
+ } else {
+- if (!(dep->flags & DWC3_EP_STALL))
+- return 0;
+
+ ret = dwc3_send_clear_stall_ep_cmd(dep);
+ if (ret)
dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch
dmaengine-at_hdmac-fix-module-unloading.patch
btrfs-release-metadata-before-running-delayed-refs.patch
+usb-usb-storage-add-new-ids-to-ums-realtek.patch
+usb-core-quirks-add-reset_resume-quirk-for-cherry-g230-stream-series.patch
+revert-usb-dwc3-gadget-skip-set-clear-halt-when-invalid.patch
+iio-st_magn-fix-enable-device-after-trigger.patch
+mm-use-swp_offset-as-key-in-shmem_replace_page.patch
+drivers-hv-vmbus-check-the-creation_status-in-vmbus_establish_gpadl.patch
+misc-mic-scif-fix-copy-paste-error-in-scif_create_remote_lookup.patch
--- /dev/null
+From effd14f66cc1ef6701a19c5a56e39c35f4d395a5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20Niew=C3=B6hner?= <linux@mniewoehner.de>
+Date: Sun, 25 Nov 2018 17:57:33 +0100
+Subject: usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Niewöhner <linux@mniewoehner.de>
+
+commit effd14f66cc1ef6701a19c5a56e39c35f4d395a5 upstream.
+
+Cherry G230 Stream 2.0 (G85-231) and 3.0 (G85-232) need this quirk to
+function correctly. This fixes a but where double pressing numlock locks
+up the device completely with need to replug the keyboard.
+
+Signed-off-by: Michael Niewöhner <linux@mniewoehner.de>
+Tested-by: Michael Niewöhner <linux@mniewoehner.de>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -64,6 +64,9 @@ static const struct usb_device_id usb_qu
+ /* Microsoft LifeCam-VX700 v2.0 */
+ { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */
++ { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
+ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
--- /dev/null
+From a84a1bcc992f0545a51d2e120b8ca2ef20e2ea97 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Fri, 23 Nov 2018 08:42:19 +0000
+Subject: USB: usb-storage: Add new IDs to ums-realtek
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit a84a1bcc992f0545a51d2e120b8ca2ef20e2ea97 upstream.
+
+There are two new Realtek card readers require ums-realtek to work
+correctly.
+
+Add the new IDs to support them.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_realtek.h | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/usb/storage/unusual_realtek.h
++++ b/drivers/usb/storage/unusual_realtek.h
+@@ -39,4 +39,14 @@ UNUSUAL_DEV(0x0bda, 0x0159, 0x0000, 0x99
+ "USB Card Reader",
+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+
++UNUSUAL_DEV(0x0bda, 0x0177, 0x0000, 0x9999,
++ "Realtek",
++ "USB Card Reader",
++ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
++
++UNUSUAL_DEV(0x0bda, 0x0184, 0x0000, 0x9999,
++ "Realtek",
++ "USB Card Reader",
++ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
++
+ #endif /* defined(CONFIG_USB_STORAGE_REALTEK) || ... */
projects / thirdparty / kernel / stable-queue.git / commitdiff
