--- /dev/null
+From 4abb951b73ff0a8a979113ef185651aa3c8da19b Mon Sep 17 00:00:00 2001
+From: Erik Schmauss <erik.schmauss@intel.com>
+Date: Wed, 17 Oct 2018 14:09:35 -0700
+Subject: ACPICA: AML interpreter: add region addresses in global list during initialization
+
+From: Erik Schmauss <erik.schmauss@intel.com>
+
+commit 4abb951b73ff0a8a979113ef185651aa3c8da19b upstream.
+
+The table load process omitted adding the operation region address
+range to the global list. This omission is problematic because the OS
+queries the global list to check for address range conflicts before
+deciding which drivers to load. This commit may result in warning
+messages that look like the following:
+
+[ 7.871761] ACPI Warning: system_IO range 0x00000428-0x0000042F conflicts with op_region 0x00000400-0x0000047F (\PMIO) (20180531/utaddress-213)
+[ 7.871769] ACPI: If an ACPI driver is available for this device, you should use it instead of the native driver
+
+However, these messages do not signify regressions. It is a result of
+properly adding address ranges within the global address list.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=200011
+Tested-by: Jean-Marc Lenoir <archlinux@jihemel.com>
+Signed-off-by: Erik Schmauss <erik.schmauss@intel.com>
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpica/dsopcode.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -452,6 +452,10 @@ acpi_ds_eval_region_operands(struct acpi
+ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
++ status = acpi_ut_add_address_range(obj_desc->region.space_id,
++ obj_desc->region.address,
++ obj_desc->region.length, node);
++
+ /* Now the address and length are valid for this opregion */
+
+ obj_desc->region.flags |= AOPOBJ_DATA_VALID;
--- /dev/null
+From 2d6cb6edd2c7fb4f40998895bda45006281b1ac5 Mon Sep 17 00:00:00 2001
+From: Tang Junhui <tang.junhui.linux@gmail.com>
+Date: Mon, 8 Oct 2018 20:41:14 +0800
+Subject: bcache: fix miss key refill->end in writeback
+
+From: Tang Junhui <tang.junhui.linux@gmail.com>
+
+commit 2d6cb6edd2c7fb4f40998895bda45006281b1ac5 upstream.
+
+refill->end record the last key of writeback, for example, at the first
+time, keys (1,128K) to (1,1024K) are flush to the backend device, but
+the end key (1,1024K) is not included, since the bellow code:
+ if (bkey_cmp(k, refill->end) >= 0) {
+ ret = MAP_DONE;
+ goto out;
+ }
+And in the next time when we refill writeback keybuf again, we searched
+key start from (1,1024K), and got a key bigger than it, so the key
+(1,1024K) missed.
+This patch modify the above code, and let the end key to be included to
+the writeback key buffer.
+
+Signed-off-by: Tang Junhui <tang.junhui.linux@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/btree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -2367,7 +2367,7 @@ static int refill_keybuf_fn(struct btree
+ struct keybuf *buf = refill->buf;
+ int ret = MAP_CONTINUE;
+
+- if (bkey_cmp(k, refill->end) >= 0) {
++ if (bkey_cmp(k, refill->end) > 0) {
+ ret = MAP_DONE;
+ goto out;
+ }
--- /dev/null
+From 34ffec60b27aa81d04e274e71e4c6ef740f75fc7 Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@redhat.com>
+Date: Mon, 29 Oct 2018 20:57:19 +0800
+Subject: block: make sure writesame bio is aligned with logical block size
+
+From: Ming Lei <ming.lei@redhat.com>
+
+commit 34ffec60b27aa81d04e274e71e4c6ef740f75fc7 upstream.
+
+Obviously the created writesame bio has to be aligned with logical block
+size, and use bio_allowed_max_sectors() to retrieve this number.
+
+Cc: stable@vger.kernel.org
+Cc: Mike Snitzer <snitzer@redhat.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Xiao Ni <xni@redhat.com>
+Cc: Mariusz Dabrowski <mariusz.dabrowski@intel.com>
+Fixes: b49a0871be31a745b2ef ("block: remove split code in blkdev_issue_{discard,write_same}")
+Tested-by: Rui Salvaterra <rsalvaterra@gmail.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -165,7 +165,7 @@ int blkdev_issue_write_same(struct block
+ return -EINVAL;
+
+ /* Ensure that max_write_same_sectors doesn't overflow bi_size */
+- max_write_same_sectors = UINT_MAX >> 9;
++ max_write_same_sectors = bio_allowed_max_sectors(q);
+
+ while (nr_sects) {
+ bio = next_bio(bio, 1, gfp_mask);
--- /dev/null
+From e7c6a55606b5c46b449d76588968b4d8caae903f Mon Sep 17 00:00:00 2001
+From: Dmitry Bazhenov <bazhenov.dn@gmail.com>
+Date: Mon, 15 Oct 2018 14:21:22 +0500
+Subject: hwmon: (pmbus) Fix page count auto-detection.
+
+From: Dmitry Bazhenov <bazhenov.dn@gmail.com>
+
+commit e7c6a55606b5c46b449d76588968b4d8caae903f upstream.
+
+Devices with compatible="pmbus" field have zero initial page count,
+and pmbus_clear_faults() being called before the page count auto-
+detection does not actually clear faults because it depends on the
+page count. Non-cleared faults in its turn may fail the subsequent
+page count auto-detection.
+
+This patch fixes this problem by calling pmbus_clear_fault_page()
+for currently set page and calling pmbus_clear_faults() after the
+page count was detected.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Bazhenov <bazhenov.dn@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/pmbus/pmbus.c | 2 ++
+ drivers/hwmon/pmbus/pmbus_core.c | 5 ++++-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwmon/pmbus/pmbus.c
++++ b/drivers/hwmon/pmbus/pmbus.c
+@@ -118,6 +118,8 @@ static int pmbus_identify(struct i2c_cli
+ } else {
+ info->pages = 1;
+ }
++
++ pmbus_clear_faults(client);
+ }
+
+ if (pmbus_check_byte_register(client, 0, PMBUS_VOUT_MODE)) {
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -1759,7 +1759,10 @@ static int pmbus_init_common(struct i2c_
+ if (ret >= 0 && (ret & PB_CAPABILITY_ERROR_CHECK))
+ client->flags |= I2C_CLIENT_PEC;
+
+- pmbus_clear_faults(client);
++ if (data->info->pages)
++ pmbus_clear_faults(client);
++ else
++ pmbus_clear_fault_page(client, -1);
+
+ if (info->identify) {
+ ret = (*info->identify)(client, info);
--- /dev/null
+From 0711e8c1b4572d076264e71b0002d223f2666ed7 Mon Sep 17 00:00:00 2001
+From: Jan Glauber <jglauber@cavium.com>
+Date: Thu, 11 Oct 2018 12:13:01 +0200
+Subject: ipmi: Fix timer race with module unload
+
+From: Jan Glauber <jglauber@cavium.com>
+
+commit 0711e8c1b4572d076264e71b0002d223f2666ed7 upstream.
+
+Please note that below oops is from an older kernel, but the same
+race seems to be present in the upstream kernel too.
+
+---8<---
+
+The following panic was encountered during removing the ipmi_ssif
+module:
+
+[ 526.352555] Unable to handle kernel paging request at virtual address ffff000006923090
+[ 526.360464] Mem abort info:
+[ 526.363257] ESR = 0x86000007
+[ 526.366304] Exception class = IABT (current EL), IL = 32 bits
+[ 526.372221] SET = 0, FnV = 0
+[ 526.375269] EA = 0, S1PTW = 0
+[ 526.378405] swapper pgtable: 4k pages, 48-bit VAs, pgd = 000000008ae60416
+[ 526.385185] [ffff000006923090] *pgd=000000bffcffe803, *pud=000000bffcffd803, *pmd=0000009f4731a003, *pte=0000000000000000
+[ 526.396141] Internal error: Oops: 86000007 [#1] SMP
+[ 526.401008] Modules linked in: nls_iso8859_1 ipmi_devintf joydev input_leds ipmi_msghandler shpchp sch_fq_codel ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear i2c_smbus hid_generic usbhid uas hid usb_storage ast aes_ce_blk i2c_algo_bit aes_ce_cipher qede ttm crc32_ce ptp crct10dif_ce drm_kms_helper ghash_ce syscopyarea sha2_ce sysfillrect sysimgblt pps_core fb_sys_fops sha256_arm64 sha1_ce mpt3sas qed drm raid_class ahci scsi_transport_sas libahci gpio_xlp i2c_xlp9xx aes_neon_bs aes_neon_blk crypto_simd cryptd aes_arm64 [last unloaded: ipmi_ssif]
+[ 526.468085] CPU: 125 PID: 0 Comm: swapper/125 Not tainted 4.15.0-35-generic #38~lp1775396+build.1
+[ 526.476942] Hardware name: To be filled by O.E.M. Saber/Saber, BIOS 0ACKL022 08/14/2018
+[ 526.484932] pstate: 00400009 (nzcv daif +PAN -UAO)
+[ 526.489713] pc : 0xffff000006923090
+[ 526.493198] lr : call_timer_fn+0x34/0x178
+[ 526.497194] sp : ffff000009b0bdd0
+[ 526.500496] x29: ffff000009b0bdd0 x28: 0000000000000082
+[ 526.505796] x27: 0000000000000002 x26: ffff000009515188
+[ 526.511096] x25: ffff000009515180 x24: ffff0000090f1018
+[ 526.516396] x23: ffff000009519660 x22: dead000000000200
+[ 526.521696] x21: ffff000006923090 x20: 0000000000000100
+[ 526.526995] x19: ffff809eeb466a40 x18: 0000000000000000
+[ 526.532295] x17: 000000000000000e x16: 0000000000000007
+[ 526.537594] x15: 0000000000000000 x14: 071c71c71c71c71c
+[ 526.542894] x13: 0000000000000000 x12: 0000000000000000
+[ 526.548193] x11: 0000000000000001 x10: ffff000009b0be88
+[ 526.553493] x9 : 0000000000000000 x8 : 0000000000000005
+[ 526.558793] x7 : ffff80befc1f8528 x6 : 0000000000000020
+[ 526.564092] x5 : 0000000000000040 x4 : 0000000020001b20
+[ 526.569392] x3 : 0000000000000000 x2 : ffff809eeb466a40
+[ 526.574692] x1 : ffff000006923090 x0 : ffff809eeb466a40
+[ 526.579992] Process swapper/125 (pid: 0, stack limit = 0x000000002eb50acc)
+[ 526.586854] Call trace:
+[ 526.589289] 0xffff000006923090
+[ 526.592419] expire_timers+0xc8/0x130
+[ 526.596070] run_timer_softirq+0xec/0x1b0
+[ 526.600070] __do_softirq+0x134/0x328
+[ 526.603726] irq_exit+0xc8/0xe0
+[ 526.606857] __handle_domain_irq+0x6c/0xc0
+[ 526.610941] gic_handle_irq+0x84/0x188
+[ 526.614679] el1_irq+0xe8/0x180
+[ 526.617822] cpuidle_enter_state+0xa0/0x328
+[ 526.621993] cpuidle_enter+0x34/0x48
+[ 526.625564] call_cpuidle+0x44/0x70
+[ 526.629040] do_idle+0x1b8/0x1f0
+[ 526.632256] cpu_startup_entry+0x2c/0x30
+[ 526.636174] secondary_start_kernel+0x11c/0x130
+[ 526.640694] Code: bad PC value
+[ 526.643800] ---[ end trace d020b0b8417c2498 ]---
+[ 526.648404] Kernel panic - not syncing: Fatal exception in interrupt
+[ 526.654778] SMP: stopping secondary CPUs
+[ 526.658734] Kernel Offset: disabled
+[ 526.662211] CPU features: 0x5800c38
+[ 526.665688] Memory Limit: none
+[ 526.668768] ---[ end Kernel panic - not syncing: Fatal exception in interrupt
+
+Prevent mod_timer from arming a timer that was already removed by
+del_timer during module unload.
+
+Signed-off-by: Jan Glauber <jglauber@cavium.com>
+Cc: <stable@vger.kernel.org> # 3.19
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/ipmi/ipmi_ssif.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -617,8 +617,9 @@ static void msg_done_handler(struct ssif
+ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+ ssif_info->waiting_alert = true;
+ ssif_info->rtc_us_timer = SSIF_MSG_USEC;
+- mod_timer(&ssif_info->retry_timer,
+- jiffies + SSIF_MSG_JIFFIES);
++ if (!ssif_info->stopping)
++ mod_timer(&ssif_info->retry_timer,
++ jiffies + SSIF_MSG_JIFFIES);
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ return;
+ }
+@@ -950,8 +951,9 @@ static void msg_written_handler(struct s
+ ssif_info->waiting_alert = true;
+ ssif_info->retries_left = SSIF_RECV_RETRIES;
+ ssif_info->rtc_us_timer = SSIF_MSG_PART_USEC;
+- mod_timer(&ssif_info->retry_timer,
+- jiffies + SSIF_MSG_PART_JIFFIES);
++ if (!ssif_info->stopping)
++ mod_timer(&ssif_info->retry_timer,
++ jiffies + SSIF_MSG_PART_JIFFIES);
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ }
+ }
--- /dev/null
+From 92e2921f7eee63450a5f953f4b15dc6210219430 Mon Sep 17 00:00:00 2001
+From: Hou Tao <houtao1@huawei.com>
+Date: Sat, 6 Oct 2018 17:09:35 +0800
+Subject: jffs2: free jffs2_sb_info through jffs2_kill_sb()
+
+From: Hou Tao <houtao1@huawei.com>
+
+commit 92e2921f7eee63450a5f953f4b15dc6210219430 upstream.
+
+When an invalid mount option is passed to jffs2, jffs2_parse_options()
+will fail and jffs2_sb_info will be freed, but then jffs2_sb_info will
+be used (use-after-free) and freeed (double-free) in jffs2_kill_sb().
+
+Fix it by removing the buggy invocation of kfree() when getting invalid
+mount options.
+
+Fixes: 92abc475d8de ("jffs2: implement mount option parsing and compression overriding")
+Cc: stable@kernel.org
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Reviewed-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jffs2/super.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -285,10 +285,8 @@ static int jffs2_fill_super(struct super
+ sb->s_fs_info = c;
+
+ ret = jffs2_parse_options(c, data);
+- if (ret) {
+- kfree(c);
++ if (ret)
+ return -EINVAL;
+- }
+
+ /* Initialize JFFS2 superblock locks, the further initialization will
+ * be done later */
--- /dev/null
+From 95691e3eddc41da2d1cd3cca51fecdfb46bd85bc Mon Sep 17 00:00:00 2001
+From: "Maciej S. Szmigiero" <mail@maciej.szmigiero.name>
+Date: Sun, 9 Sep 2018 01:21:06 +0200
+Subject: pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
+
+From: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
+
+commit 95691e3eddc41da2d1cd3cca51fecdfb46bd85bc upstream.
+
+Currently, "disable_clkrun" yenta_socket module parameter is only
+implemented for TI CardBus bridges.
+Add also an implementation for Ricoh bridges that have the necessary
+setting documented in publicly available datasheets.
+
+Tested on a RL5C476II with a Sunrich C-160 CardBus NIC that doesn't work
+correctly unless the CLKRUN protocol is disabled.
+
+Let's also make it clear in its description that the "disable_clkrun"
+module parameter only works on these two previously mentioned brands of
+CardBus bridges.
+
+Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pcmcia/ricoh.h | 35 +++++++++++++++++++++++++++++++++++
+ drivers/pcmcia/yenta_socket.c | 3 ++-
+ 2 files changed, 37 insertions(+), 1 deletion(-)
+
+--- a/drivers/pcmcia/ricoh.h
++++ b/drivers/pcmcia/ricoh.h
+@@ -119,6 +119,10 @@
+ #define RL5C4XX_MISC_CONTROL 0x2F /* 8 bit */
+ #define RL5C4XX_ZV_ENABLE 0x08
+
++/* Misc Control 3 Register */
++#define RL5C4XX_MISC3 0x00A2 /* 16 bit */
++#define RL5C47X_MISC3_CB_CLKRUN_DIS BIT(1)
++
+ #ifdef __YENTA_H
+
+ #define rl_misc(socket) ((socket)->private[0])
+@@ -156,6 +160,35 @@ static void ricoh_set_zv(struct yenta_so
+ }
+ }
+
++static void ricoh_set_clkrun(struct yenta_socket *socket, bool quiet)
++{
++ u16 misc3;
++
++ /*
++ * RL5C475II likely has this setting, too, however no datasheet
++ * is publicly available for this chip
++ */
++ if (socket->dev->device != PCI_DEVICE_ID_RICOH_RL5C476 &&
++ socket->dev->device != PCI_DEVICE_ID_RICOH_RL5C478)
++ return;
++
++ if (socket->dev->revision < 0x80)
++ return;
++
++ misc3 = config_readw(socket, RL5C4XX_MISC3);
++ if (misc3 & RL5C47X_MISC3_CB_CLKRUN_DIS) {
++ if (!quiet)
++ dev_dbg(&socket->dev->dev,
++ "CLKRUN feature already disabled\n");
++ } else if (disable_clkrun) {
++ if (!quiet)
++ dev_info(&socket->dev->dev,
++ "Disabling CLKRUN feature\n");
++ misc3 |= RL5C47X_MISC3_CB_CLKRUN_DIS;
++ config_writew(socket, RL5C4XX_MISC3, misc3);
++ }
++}
++
+ static void ricoh_save_state(struct yenta_socket *socket)
+ {
+ rl_misc(socket) = config_readw(socket, RL5C4XX_MISC);
+@@ -172,6 +205,7 @@ static void ricoh_restore_state(struct y
+ config_writew(socket, RL5C4XX_16BIT_IO_0, rl_io(socket));
+ config_writew(socket, RL5C4XX_16BIT_MEM_0, rl_mem(socket));
+ config_writew(socket, RL5C4XX_CONFIG, rl_config(socket));
++ ricoh_set_clkrun(socket, true);
+ }
+
+
+@@ -197,6 +231,7 @@ static int ricoh_override(struct yenta_s
+ config_writew(socket, RL5C4XX_CONFIG, config);
+
+ ricoh_set_zv(socket);
++ ricoh_set_clkrun(socket, false);
+
+ return 0;
+ }
+--- a/drivers/pcmcia/yenta_socket.c
++++ b/drivers/pcmcia/yenta_socket.c
+@@ -26,7 +26,8 @@
+
+ static bool disable_clkrun;
+ module_param(disable_clkrun, bool, 0444);
+-MODULE_PARM_DESC(disable_clkrun, "If PC card doesn't function properly, please try this option");
++MODULE_PARM_DESC(disable_clkrun,
++ "If PC card doesn't function properly, please try this option (TI and Ricoh bridges only)");
+
+ static bool isa_probe = 1;
+ module_param(isa_probe, bool, 0444);
projects / thirdparty / kernel / stable-queue.git / commitdiff
