--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Bob Moore <robert.moore@intel.com>
+Date: Mon, 5 Jun 2017 16:40:34 +0800
+Subject: ACPICA: Disassembler: Abort on an invalid/unknown AML opcode
+
+From: Bob Moore <robert.moore@intel.com>
+
+
+[ Upstream commit 6f0527b77d9e0129dd8e50945b0d610ed943d6b2 ]
+
+ACPICA commit ed0389cb11a61e63c568ac1f67948fc6a7bd1aeb
+
+An invalid opcode indicates something seriously wrong with the
+input AML file. The AML parser is immediately confused and lost,
+causing the resulting parse tree to be ill-formed. The actual
+disassembly can then cause numerous unrelated errors and faults.
+
+This change aborts the disassembly upon discovery of such an
+opcode during the AML parse phase.
+
+Link: https://github.com/acpica/acpica/commit/ed0389cb
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/acpica/psobject.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/acpi/acpica/psobject.c
++++ b/drivers/acpi/acpica/psobject.c
+@@ -121,6 +121,9 @@ static acpi_status acpi_ps_get_aml_opcod
+ (u32)(aml_offset +
+ sizeof(struct acpi_table_header)));
+
++ ACPI_ERROR((AE_INFO,
++ "Aborting disassembly, AML byte code is corrupt"));
++
+ /* Dump the context surrounding the invalid opcode */
+
+ acpi_ut_dump_buffer(((u8 *)walk_state->parser_state.
+@@ -129,6 +132,14 @@ static acpi_status acpi_ps_get_aml_opcod
+ sizeof(struct acpi_table_header) -
+ 16));
+ acpi_os_printf(" */\n");
++
++ /*
++ * Just abort the disassembly, cannot continue because the
++ * parser is essentially lost. The disassembler can then
++ * randomly fail because an ill-constructed parse tree
++ * can result.
++ */
++ return_ACPI_STATUS(AE_AML_BAD_OPCODE);
+ #endif
+ }
+
+@@ -293,6 +304,9 @@ acpi_ps_create_op(struct acpi_walk_state
+ if (status == AE_CTRL_PARSE_CONTINUE) {
+ return_ACPI_STATUS(AE_CTRL_PARSE_CONTINUE);
+ }
++ if (ACPI_FAILURE(status)) {
++ return_ACPI_STATUS(status);
++ }
+
+ /* Create Op structure and append to parent's argument list */
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Lv Zheng <lv.zheng@intel.com>
+Date: Mon, 5 Jun 2017 16:40:02 +0800
+Subject: ACPICA: Events: Add runtime stub support for event APIs
+
+From: Lv Zheng <lv.zheng@intel.com>
+
+
+[ Upstream commit 861ba6351c520328e94a78c923b415faa9116287 ]
+
+ACPICA commit 99bc3beca92c6574ea1d69de42e54f872e6373ce
+
+It is reported that on Linux, RTC driver complains wrong errors on
+hardware reduced platform:
+ [ 4.085420] ACPI Warning: Could not enable fixed event - real_time_clock (4) (20160422/evxface-654)
+
+This patch fixes this by correctly adding runtime reduced hardware check.
+Reported by Chandan Tagore, fixed by Lv Zheng.
+
+Link: https://github.com/acpica/acpica/commit/99bc3bec
+Tested-by: Chandan Tagore <tagore.chandan@gmail.com>
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/acpica/evxfevnt.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/acpi/acpica/evxfevnt.c
++++ b/drivers/acpi/acpica/evxfevnt.c
+@@ -180,6 +180,12 @@ acpi_status acpi_enable_event(u32 event,
+
+ ACPI_FUNCTION_TRACE(acpi_enable_event);
+
++ /* If Hardware Reduced flag is set, there are no fixed events */
++
++ if (acpi_gbl_reduced_hardware) {
++ return_ACPI_STATUS(AE_OK);
++ }
++
+ /* Decode the Fixed Event */
+
+ if (event > ACPI_EVENT_MAX) {
+@@ -237,6 +243,12 @@ acpi_status acpi_disable_event(u32 event
+
+ ACPI_FUNCTION_TRACE(acpi_disable_event);
+
++ /* If Hardware Reduced flag is set, there are no fixed events */
++
++ if (acpi_gbl_reduced_hardware) {
++ return_ACPI_STATUS(AE_OK);
++ }
++
+ /* Decode the Fixed Event */
+
+ if (event > ACPI_EVENT_MAX) {
+@@ -290,6 +302,12 @@ acpi_status acpi_clear_event(u32 event)
+
+ ACPI_FUNCTION_TRACE(acpi_clear_event);
+
++ /* If Hardware Reduced flag is set, there are no fixed events */
++
++ if (acpi_gbl_reduced_hardware) {
++ return_ACPI_STATUS(AE_OK);
++ }
++
+ /* Decode the Fixed Event */
+
+ if (event > ACPI_EVENT_MAX) {
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Fri, 5 May 2017 07:40:42 +0200
+Subject: af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+
+[ Upstream commit d90c902449a7561f1b1d58ba5a0d11728ce8b0b2 ]
+
+The sadb_x_sec_len is stored in the unit 'byte divided by eight'.
+So we have to multiply this value by eight before we can do
+size checks. Otherwise we may get a slab-out-of-bounds when
+we memcpy the user sec_ctx.
+
+Fixes: df71837d502 ("[LSM-IPSec]: Security association restriction.")
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/key/af_key.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -3305,7 +3305,7 @@ static struct xfrm_policy *pfkey_compile
+ p += pol->sadb_x_policy_len*8;
+ sec_ctx = (struct sadb_x_sec_ctx *)p;
+ if (len < pol->sadb_x_policy_len*8 +
+- sec_ctx->sadb_x_sec_len) {
++ sec_ctx->sadb_x_sec_len*8) {
+ *dir = -EINVAL;
+ goto out;
+ }
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Suman Anna <s-anna@ti.com>
+Date: Tue, 16 May 2017 17:13:45 -0500
+Subject: ARM: davinci: da8xx: Create DSP device only when assigned memory
+
+From: Suman Anna <s-anna@ti.com>
+
+
+[ Upstream commit f97f03578b997a8ec2b9bc4928f958a865137268 ]
+
+The DSP device on Davinci platforms does not have an MMU and requires
+specific DDR memory to boot. This memory is reserved using the rproc_mem
+kernel boot parameter and is assigned to the device on non-DT boots.
+The remoteproc core uses the DMA API and so will fall back to assigning
+random memory if this memory is not assigned to the device, but the DSP
+remote processor boot will not be successful in such cases. So, check
+that memory has been reserved and assigned to the device specifically
+before even creating the DSP device.
+
+Signed-off-by: Suman Anna <s-anna@ti.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-davinci/devices-da8xx.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/arch/arm/mach-davinci/devices-da8xx.c
++++ b/arch/arm/mach-davinci/devices-da8xx.c
+@@ -795,6 +795,8 @@ static struct platform_device da8xx_dsp
+ .resource = da8xx_rproc_resources,
+ };
+
++static bool rproc_mem_inited __initdata;
++
+ #if IS_ENABLED(CONFIG_DA8XX_REMOTEPROC)
+
+ static phys_addr_t rproc_base __initdata;
+@@ -833,6 +835,8 @@ void __init da8xx_rproc_reserve_cma(void
+ ret = dma_declare_contiguous(&da8xx_dsp.dev, rproc_size, rproc_base, 0);
+ if (ret)
+ pr_err("%s: dma_declare_contiguous failed %d\n", __func__, ret);
++ else
++ rproc_mem_inited = true;
+ }
+
+ #else
+@@ -847,6 +851,12 @@ int __init da8xx_register_rproc(void)
+ {
+ int ret;
+
++ if (!rproc_mem_inited) {
++ pr_warn("%s: memory not reserved for DSP, not registering DSP device\n",
++ __func__);
++ return -ENOMEM;
++ }
++
+ ret = platform_device_register(&da8xx_dsp);
+ if (ret)
+ pr_err("%s: can't register DSP device: %d\n", __func__, ret);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Wed, 12 Apr 2017 18:31:18 -0300
+Subject: ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+
+[ Upstream commit 2fe4bff3516924a37e083e3211364abe59db1161 ]
+
+Currently the following errors are seen:
+
+[ 14.015056] mc13xxx 0-0008: Failed to read IRQ status: -6
+[ 27.321093] mc13xxx 0-0008: Failed to read IRQ status: -6
+[ 27.411681] mc13xxx 0-0008: Failed to read IRQ status: -6
+[ 27.456281] mc13xxx 0-0008: Failed to read IRQ status: -6
+[ 30.527106] mc13xxx 0-0008: Failed to read IRQ status: -6
+[ 36.596900] mc13xxx 0-0008: Failed to read IRQ status: -6
+
+Also when reading the interrupts via 'cat /proc/interrupts' the
+PMIC GPIO interrupt counter does not stop increasing.
+
+The reason for the storm of interrupts is that the PUS field of
+register IOMUXC_SW_PAD_CTL_PAD_CSI0_DAT5 is currently configured as:
+10 : 100k pullup
+
+and the PMIC interrupt is being registered as IRQ_TYPE_LEVEL_HIGH type,
+which is the correct type as per the MC34708 datasheet.
+
+Use the default power on value for the IOMUX, which sets PUS field as:
+00: 360k pull down
+
+This prevents the spurious PMIC interrupts from happening.
+
+Commit e1ffceb078c6 ("ARM: imx53: qsrb: fix PMIC interrupt level")
+correctly described the irq type as IRQ_TYPE_LEVEL_HIGH, but
+missed to update the IOMUX of the PMIC GPIO as pull down.
+
+Fixes: e1ffceb078c6 ("ARM: imx53: qsrb: fix PMIC interrupt level")
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/imx53-qsrb.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx53-qsrb.dts
++++ b/arch/arm/boot/dts/imx53-qsrb.dts
+@@ -23,7 +23,7 @@
+ imx53-qsrb {
+ pinctrl_pmic: pmicgrp {
+ fsl,pins = <
+- MX53_PAD_CSI0_DAT5__GPIO5_23 0x1e4 /* IRQ */
++ MX53_PAD_CSI0_DAT5__GPIO5_23 0x1c4 /* IRQ */
+ >;
+ };
+ };
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Sun, 14 May 2017 11:50:50 -0300
+Subject: ARM: dts: imx6qdl-wandboard: Fix audio channel swap
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+
+[ Upstream commit 79935915300c5eb88a0e94fa9148a7505c14a02a ]
+
+When running a stress playback/stop loop test on a mx6wandboard channel
+swaps can be noticed randomly.
+
+Increasing the SGTL5000 LRCLK pad strength to its maximum value fixes
+the issue, so add the 'lrclk-strength' property to avoid the audio
+channel swaps.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/imx6qdl-wandboard.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
+@@ -88,6 +88,7 @@
+ clocks = <&clks 201>;
+ VDDA-supply = <®_2p5v>;
+ VDDIO-supply = <®_3p3v>;
++ lrclk-strength = <3>;
+ };
+ };
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Date: Thu, 16 Nov 2017 13:15:26 +0100
+Subject: ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node
+
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+
+
+[ Upstream commit d5c7b4d5ac2237a6da7ced3adfe6b8bf769f8cc6 ]
+
+Commit a22950c888e3 (mmc: sdhci-of-esdhc: add quirk
+SDHCI_QUIRK_BROKEN_TIMEOUT_VAL for ls1021a) added logic to the driver to
+enable the broken timeout val quirk for ls1021a, but did not add the
+corresponding compatible string to the device tree, so it didn't really
+have any effect. Fix that.
+
+Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/ls1021a.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -132,7 +132,7 @@
+ };
+
+ esdhc: esdhc@1560000 {
+- compatible = "fsl,esdhc";
++ compatible = "fsl,ls1021a-esdhc", "fsl,esdhc";
+ reg = <0x0 0x1560000 0x0 0x10000>;
+ interrupts = <GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH>;
+ clock-frequency = <0>;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Leonard Crestez <leonard.crestez@nxp.com>
+Date: Tue, 6 Jun 2017 20:50:42 +0300
+Subject: ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+
+[ Upstream commit b3ea575770c7eeb259c77b6861cd14d00eb309df ]
+
+Support for imx6ull is already present but it's based on
+of_machine_is_compatible("fsl,imx6ull") checks. Add it to the MXC_CPU_*
+enumeration as well.
+
+This also fixes /sys/devices/soc0/soc_id reading "Unknown".
+
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-imx/cpu.c | 3 +++
+ arch/arm/mach-imx/mxc.h | 6 ++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/arch/arm/mach-imx/cpu.c
++++ b/arch/arm/mach-imx/cpu.c
+@@ -133,6 +133,9 @@ struct device * __init imx_soc_device_in
+ case MXC_CPU_IMX6UL:
+ soc_id = "i.MX6UL";
+ break;
++ case MXC_CPU_IMX6ULL:
++ soc_id = "i.MX6ULL";
++ break;
+ case MXC_CPU_IMX7D:
+ soc_id = "i.MX7D";
+ break;
+--- a/arch/arm/mach-imx/mxc.h
++++ b/arch/arm/mach-imx/mxc.h
+@@ -39,6 +39,7 @@
+ #define MXC_CPU_IMX6SX 0x62
+ #define MXC_CPU_IMX6Q 0x63
+ #define MXC_CPU_IMX6UL 0x64
++#define MXC_CPU_IMX6ULL 0x65
+ #define MXC_CPU_IMX7D 0x72
+
+ #define IMX_DDR_TYPE_LPDDR2 1
+@@ -171,6 +172,11 @@ static inline bool cpu_is_imx6ul(void)
+ return __mxc_cpu_type == MXC_CPU_IMX6UL;
+ }
+
++static inline bool cpu_is_imx6ull(void)
++{
++ return __mxc_cpu_type == MXC_CPU_IMX6ULL;
++}
++
+ static inline bool cpu_is_imx6q(void)
+ {
+ return __mxc_cpu_type == MXC_CPU_IMX6Q;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Will Deacon <will.deacon@arm.com>
+Date: Wed, 5 Apr 2017 11:14:05 +0100
+Subject: arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage
+
+From: Will Deacon <will.deacon@arm.com>
+
+
+[ Upstream commit 5f16a046f8e144c294ef98cd29d9458b5f8273e5 ]
+
+FUTEX_OP_OPARG_SHIFT instructs the futex code to treat the 12-bit oparg
+field as a shift value, potentially leading to a left shift value that
+is negative or with an absolute value that is significantly larger then
+the size of the type. UBSAN chokes with:
+
+================================================================================
+UBSAN: Undefined behaviour in ./arch/arm64/include/asm/futex.h:60:13
+shift exponent -1 is negative
+CPU: 1 PID: 1449 Comm: syz-executor0 Not tainted 4.11.0-rc4-00005-g977eb52-dirty #11
+Hardware name: linux,dummy-virt (DT)
+Call trace:
+[<ffff200008094778>] dump_backtrace+0x0/0x538 arch/arm64/kernel/traps.c:73
+[<ffff200008094cd0>] show_stack+0x20/0x30 arch/arm64/kernel/traps.c:228
+[<ffff200008c194a8>] __dump_stack lib/dump_stack.c:16 [inline]
+[<ffff200008c194a8>] dump_stack+0x120/0x188 lib/dump_stack.c:52
+[<ffff200008cc24b8>] ubsan_epilogue+0x18/0x98 lib/ubsan.c:164
+[<ffff200008cc3098>] __ubsan_handle_shift_out_of_bounds+0x250/0x294 lib/ubsan.c:421
+[<ffff20000832002c>] futex_atomic_op_inuser arch/arm64/include/asm/futex.h:60 [inline]
+[<ffff20000832002c>] futex_wake_op kernel/futex.c:1489 [inline]
+[<ffff20000832002c>] do_futex+0x137c/0x1740 kernel/futex.c:3231
+[<ffff200008320504>] SYSC_futex kernel/futex.c:3281 [inline]
+[<ffff200008320504>] SyS_futex+0x114/0x268 kernel/futex.c:3249
+[<ffff200008084770>] el0_svc_naked+0x24/0x28
+================================================================================
+syz-executor1 uses obsolete (PF_INET,SOCK_PACKET)
+sock: process `syz-executor0' is using obsolete setsockopt SO_BSDCOMPAT
+
+This patch attempts to fix some of this by:
+
+ * Making encoded_op an unsigned type, so we can shift it left even if
+ the top bit is set.
+
+ * Casting to signed prior to shifting right when extracting oparg
+ and cmparg
+
+ * Consider only the bottom 5 bits of oparg when using it as a left-shift
+ value.
+
+Whilst I think this catches all of the issues, I'd much prefer to remove
+this stuff, as I think it's unused and the bugs are copy-pasted between
+a bunch of architectures.
+
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/futex.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/include/asm/futex.h
++++ b/arch/arm64/include/asm/futex.h
+@@ -53,16 +53,16 @@
+ : "memory")
+
+ static inline int
+-futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
++futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr)
+ {
+ int op = (encoded_op >> 28) & 7;
+ int cmp = (encoded_op >> 24) & 15;
+- int oparg = (encoded_op << 8) >> 20;
+- int cmparg = (encoded_op << 20) >> 20;
++ int oparg = (int)(encoded_op << 8) >> 20;
++ int cmparg = (int)(encoded_op << 20) >> 20;
+ int oldval = 0, ret, tmp;
+
+ if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
+- oparg = 1 << oparg;
++ oparg = 1U << (oparg & 0x1f);
+
+ if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
+ return -EFAULT;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Ihar Hrachyshka <ihrachys@redhat.com>
+Date: Tue, 16 May 2017 07:53:43 -0700
+Subject: arp: honour gratuitous ARP _replies_
+
+From: Ihar Hrachyshka <ihrachys@redhat.com>
+
+
+[ Upstream commit 23d268eb240954e6e78f7cfab04f2b1e79f84489 ]
+
+When arp_accept is 1, gratuitous ARPs are supposed to override matching
+entries irrespective of whether they arrive during locktime. This was
+implemented in commit 56022a8fdd87 ("ipv4: arp: update neighbour address
+when a gratuitous arp is received and arp_accept is set")
+
+There is a glitch in the patch though. RFC 2002, section 4.6, "ARP,
+Proxy ARP, and Gratuitous ARP", defines gratuitous ARPs so that they can
+be either of Request or Reply type. Those Reply gratuitous ARPs can be
+triggered with standard tooling, for example, arping -A option does just
+that.
+
+This patch fixes the glitch, making both Request and Reply flavours of
+gratuitous ARPs to behave identically.
+
+As per RFC, if gratuitous ARPs are of Reply type, their Target Hardware
+Address field should also be set to the link-layer address to which this
+cache entry should be updated. The field is present in ARP over Ethernet
+but not in IEEE 1394. In this patch, I don't consider any broadcasted
+ARP replies as gratuitous if the field is not present, to conform the
+standard. It's not clear whether there is such a thing for IEEE 1394 as
+a gratuitous ARP reply; until it's cleared up, we will ignore such
+broadcasts. Note that they will still update existing ARP cache entries,
+assuming they arrive out of locktime time interval.
+
+Signed-off-by: Ihar Hrachyshka <ihrachys@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/arp.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -658,6 +658,7 @@ static int arp_process(struct net *net,
+ unsigned char *arp_ptr;
+ struct rtable *rt;
+ unsigned char *sha;
++ unsigned char *tha = NULL;
+ __be32 sip, tip;
+ u16 dev_type = dev->type;
+ int addr_type;
+@@ -729,6 +730,7 @@ static int arp_process(struct net *net,
+ break;
+ #endif
+ default:
++ tha = arp_ptr;
+ arp_ptr += dev->addr_len;
+ }
+ memcpy(&tip, arp_ptr, 4);
+@@ -839,8 +841,18 @@ static int arp_process(struct net *net,
+ It is possible, that this option should be enabled for some
+ devices (strip is candidate)
+ */
+- is_garp = arp->ar_op == htons(ARPOP_REQUEST) && tip == sip &&
+- addr_type == RTN_UNICAST;
++ is_garp = tip == sip && addr_type == RTN_UNICAST;
++
++ /* Unsolicited ARP _replies_ also require target hwaddr to be
++ * the same as source.
++ */
++ if (is_garp && arp->ar_op == htons(ARPOP_REPLY))
++ is_garp =
++ /* IPv4 over IEEE 1394 doesn't provide target
++ * hardware address field in its ARP payload.
++ */
++ tha &&
++ !memcmp(tha, sha, dev->addr_len);
+
+ if (!n &&
+ ((arp->ar_op == htons(ARPOP_REPLY) &&
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 2 Jan 2018 19:53:14 +0100
+Subject: ASoC: Intel: cht_bsw_rt5645: Analog Mic support
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+
+[ Upstream commit b70b309950418437bbd2a30afd169c4f09dee3e5 ]
+
+Various Cherry Trail boards with a rt5645 codec have an analog mic
+connected to IN2P + IN2N. The mic on this boards also needs micbias to
+be enabled, on some boards micbias1 is used and on others micbias2, so
+we enable both.
+
+This commit adds a new "Int Analog Mic" DAPM widget for this, so that we
+do not end up enabling micbias on boards with a digital mic which uses
+the already present "Int Mic" widget. Some existing UCM files already
+refer to "Int Mic" for their "Internal Analog Microphones" SectionDevice,
+but these don't work anyways since they enable the RECMIX BST1 Switch
+instead of the BST2 switch.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/intel/boards/cht_bsw_rt5645.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/sound/soc/intel/boards/cht_bsw_rt5645.c
++++ b/sound/soc/intel/boards/cht_bsw_rt5645.c
+@@ -96,6 +96,7 @@ static const struct snd_soc_dapm_widget
+ SND_SOC_DAPM_HP("Headphone", NULL),
+ SND_SOC_DAPM_MIC("Headset Mic", NULL),
+ SND_SOC_DAPM_MIC("Int Mic", NULL),
++ SND_SOC_DAPM_MIC("Int Analog Mic", NULL),
+ SND_SOC_DAPM_SPK("Ext Spk", NULL),
+ SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0,
+ platform_clock_control, SND_SOC_DAPM_POST_PMD),
+@@ -106,6 +107,8 @@ static const struct snd_soc_dapm_route c
+ {"IN1N", NULL, "Headset Mic"},
+ {"DMIC L1", NULL, "Int Mic"},
+ {"DMIC R1", NULL, "Int Mic"},
++ {"IN2P", NULL, "Int Analog Mic"},
++ {"IN2N", NULL, "Int Analog Mic"},
+ {"Headphone", NULL, "HPOL"},
+ {"Headphone", NULL, "HPOR"},
+ {"Ext Spk", NULL, "SPOL"},
+@@ -119,6 +122,9 @@ static const struct snd_soc_dapm_route c
+ {"Headphone", NULL, "Platform Clock"},
+ {"Headset Mic", NULL, "Platform Clock"},
+ {"Int Mic", NULL, "Platform Clock"},
++ {"Int Analog Mic", NULL, "Platform Clock"},
++ {"Int Analog Mic", NULL, "micbias1"},
++ {"Int Analog Mic", NULL, "micbias2"},
+ {"Ext Spk", NULL, "Platform Clock"},
+ };
+
+@@ -147,6 +153,7 @@ static const struct snd_kcontrol_new cht
+ SOC_DAPM_PIN_SWITCH("Headphone"),
+ SOC_DAPM_PIN_SWITCH("Headset Mic"),
+ SOC_DAPM_PIN_SWITCH("Int Mic"),
++ SOC_DAPM_PIN_SWITCH("Int Analog Mic"),
+ SOC_DAPM_PIN_SWITCH("Ext Spk"),
+ };
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sat, 6 Jan 2018 21:18:24 +0100
+Subject: ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit eaadb1caa966a91128297b754e90b7c92b350a00 ]
+
+In some error handling paths, an error code is assiegned to 'ret'.
+However, the function always return 0.
+
+Fix it and return the error code if such an error paths is taken.
+
+Fixes: 3d9ff34622ba ("ASoC: Intel: sst: add stream operations")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/intel/atom/sst/sst_stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/intel/atom/sst/sst_stream.c
++++ b/sound/soc/intel/atom/sst/sst_stream.c
+@@ -221,7 +221,7 @@ int sst_send_byte_stream_mrfld(struct in
+ sst_free_block(sst_drv_ctx, block);
+ out:
+ test_and_clear_bit(pvt_id, &sst_drv_ctx->pvt_id);
+- return 0;
++ return ret;
+ }
+
+ /*
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Wed, 24 May 2017 01:17:10 +0000
+Subject: ASoC: rsnd: SSI PIO adjust to 24bit mode
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+
+[ Upstream commit 7819a942de7b993771bd9377babc80485fe7606b ]
+
+commit 90431eb49bff ("ASoC: rsnd: don't use PDTA bit for 24bit on SSI")
+fixups 24bit mode data alignment, but PIO was not cared.
+This patch fixes PIO mode 24bit data alignment
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sh/rcar/ssi.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -453,6 +453,13 @@ static void __rsnd_ssi_interrupt(struct
+ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+ u32 *buf = (u32 *)(runtime->dma_area +
+ rsnd_dai_pointer_offset(io, 0));
++ int shift = 0;
++
++ switch (runtime->sample_bits) {
++ case 32:
++ shift = 8;
++ break;
++ }
+
+ /*
+ * 8/16/32 data can be assesse to TDR/RDR register
+@@ -460,9 +467,9 @@ static void __rsnd_ssi_interrupt(struct
+ * see rsnd_ssi_init()
+ */
+ if (rsnd_io_is_play(io))
+- rsnd_mod_write(mod, SSITDR, *buf);
++ rsnd_mod_write(mod, SSITDR, (*buf) << shift);
+ else
+- *buf = rsnd_mod_read(mod, SSIRDR);
++ *buf = (rsnd_mod_read(mod, SSIRDR) >> shift);
+
+ elapsed = rsnd_dai_pointer_update(io, sizeof(*buf));
+ }
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Anup Patel <anup.patel@broadcom.com>
+Date: Mon, 15 May 2017 10:34:53 +0530
+Subject: async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome()
+
+From: Anup Patel <anup.patel@broadcom.com>
+
+
+[ Upstream commit baae03a0e2497f49704628fd0aaf993cf98e1b99 ]
+
+The DMA_PREP_FENCE is to be used when preparing Tx descriptor if output
+of Tx descriptor is to be used by next/dependent Tx descriptor.
+
+The DMA_PREP_FENSE will not be set correctly in do_async_gen_syndrome()
+when calling dma->device_prep_dma_pq() under following conditions:
+1. ASYNC_TX_FENCE not set in submit->flags
+2. DMA_PREP_FENCE not set in dma_flags
+3. src_cnt (= (disks - 2)) is greater than dma_maxpq(dma, dma_flags)
+
+This patch fixes DMA_PREP_FENCE usage in do_async_gen_syndrome() taking
+inspiration from do_async_xor() implementation.
+
+Signed-off-by: Anup Patel <anup.patel@broadcom.com>
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Reviewed-by: Scott Branden <scott.branden@broadcom.com>
+Acked-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/async_tx/async_pq.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/crypto/async_tx/async_pq.c
++++ b/crypto/async_tx/async_pq.c
+@@ -62,9 +62,6 @@ do_async_gen_syndrome(struct dma_chan *c
+ dma_addr_t dma_dest[2];
+ int src_off = 0;
+
+- if (submit->flags & ASYNC_TX_FENCE)
+- dma_flags |= DMA_PREP_FENCE;
+-
+ while (src_cnt > 0) {
+ submit->flags = flags_orig;
+ pq_src_cnt = min(src_cnt, dma_maxpq(dma, dma_flags));
+@@ -83,6 +80,8 @@ do_async_gen_syndrome(struct dma_chan *c
+ if (cb_fn_orig)
+ dma_flags |= DMA_PREP_INTERRUPT;
+ }
++ if (submit->flags & ASYNC_TX_FENCE)
++ dma_flags |= DMA_PREP_FENCE;
+
+ /* Drivers force forward progress in case they can not provide
+ * a descriptor
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Tue, 16 May 2017 14:06:12 +0200
+Subject: ata: libahci: properly propagate return value of platform_get_irq()
+
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+
+[ Upstream commit c034640a32f8456018d9c8c83799ead683046b95 ]
+
+When platform_get_irq() fails, it returns an error code, which
+libahci_platform and replaces it by -EINVAL. This commit fixes that by
+propagating the error code. It fixes the situation where
+platform_get_irq() returns -EPROBE_DEFER because the interrupt
+controller is not available yet, and generally looks like the right
+thing to do.
+
+We pay attention to not show the "no irq" message when we are in an
+EPROBE_DEFER situation, because the driver probing will be retried
+later on, once the interrupt controller becomes available to provide
+the interrupt.
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libahci_platform.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -514,8 +514,9 @@ int ahci_platform_init_host(struct platf
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq <= 0) {
+- dev_err(dev, "no irq\n");
+- return -EINVAL;
++ if (irq != -EPROBE_DEFER)
++ dev_err(dev, "no irq\n");
++ return irq;
+ }
+
+ hpriv->irq = irq;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 3 May 2017 15:26:00 +0100
+Subject: ath5k: fix memory leak on buf on failed eeprom read
+
+From: Colin Ian King <colin.king@canonical.com>
+
+
+[ Upstream commit 8fed6823e06e43ee9cf7c0ffecec2f9111ce6201 ]
+
+The AR5K_EEPROM_READ macro returns with -EIO if a read error
+occurs causing a memory leak on the allocated buffer buf. Fix
+this by explicitly calling ath5k_hw_nvram_read and exiting on
+the via the freebuf label that performs the necessary free'ing
+of buf when a read error occurs.
+
+Detected by CoverityScan, CID#1248782 ("Resource Leak")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath5k/debug.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath5k/debug.c
++++ b/drivers/net/wireless/ath/ath5k/debug.c
+@@ -939,7 +939,10 @@ static int open_file_eeprom(struct inode
+ }
+
+ for (i = 0; i < eesize; ++i) {
+- AR5K_EEPROM_READ(i, val);
++ if (!ath5k_hw_nvram_read(ah, i, &val)) {
++ ret = -EIO;
++ goto freebuf;
++ }
+ buf[i] = val;
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Tang Junhui <tang.junhui@zte.com.cn>
+Date: Mon, 8 Jan 2018 12:21:21 -0800
+Subject: bcache: segregate flash only volume write streams
+
+From: Tang Junhui <tang.junhui@zte.com.cn>
+
+
+[ Upstream commit 4eca1cb28d8b0574ca4f1f48e9331c5f852d43b9 ]
+
+In such scenario that there are some flash only volumes
+, and some cached devices, when many tasks request these devices in
+writeback mode, the write IOs may fall to the same bucket as bellow:
+| cached data | flash data | cached data | cached data| flash data|
+then after writeback of these cached devices, the bucket would
+be like bellow bucket:
+| free | flash data | free | free | flash data |
+
+So, there are many free space in this bucket, but since data of flash
+only volumes still exists, so this bucket cannot be reclaimable,
+which would cause waste of bucket space.
+
+In this patch, we segregate flash only volume write streams from
+cached devices, so data from flash only volumes and cached devices
+can store in different buckets.
+
+Compare to v1 patch, this patch do not add a additionally open bucket
+list, and it is try best to segregate flash only volume write streams
+from cached devices, sectors of flash only volumes may still be mixed
+with dirty sectors of cached device, but the number is very small.
+
+[mlyle: fixed commit log formatting, permissions, line endings]
+
+Signed-off-by: Tang Junhui <tang.junhui@zte.com.cn>
+Reviewed-by: Michael Lyle <mlyle@lyle.org>
+Signed-off-by: Michael Lyle <mlyle@lyle.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/bcache/alloc.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -514,15 +514,21 @@ struct open_bucket {
+
+ /*
+ * We keep multiple buckets open for writes, and try to segregate different
+- * write streams for better cache utilization: first we look for a bucket where
+- * the last write to it was sequential with the current write, and failing that
+- * we look for a bucket that was last used by the same task.
++ * write streams for better cache utilization: first we try to segregate flash
++ * only volume write streams from cached devices, secondly we look for a bucket
++ * where the last write to it was sequential with the current write, and
++ * failing that we look for a bucket that was last used by the same task.
+ *
+ * The ideas is if you've got multiple tasks pulling data into the cache at the
+ * same time, you'll get better cache utilization if you try to segregate their
+ * data and preserve locality.
+ *
+- * For example, say you've starting Firefox at the same time you're copying a
++ * For example, dirty sectors of flash only volume is not reclaimable, if their
++ * dirty sectors mixed with dirty sectors of cached device, such buckets will
++ * be marked as dirty and won't be reclaimed, though the dirty data of cached
++ * device have been written back to backend device.
++ *
++ * And say you've starting Firefox at the same time you're copying a
+ * bunch of files. Firefox will likely end up being fairly hot and stay in the
+ * cache awhile, but the data you copied might not be; if you wrote all that
+ * data to the same buckets it'd get invalidated at the same time.
+@@ -539,7 +545,10 @@ static struct open_bucket *pick_data_buc
+ struct open_bucket *ret, *ret_task = NULL;
+
+ list_for_each_entry_reverse(ret, &c->data_buckets, list)
+- if (!bkey_cmp(&ret->key, search))
++ if (UUID_FLASH_ONLY(&c->uuids[KEY_INODE(&ret->key)]) !=
++ UUID_FLASH_ONLY(&c->uuids[KEY_INODE(search)]))
++ continue;
++ else if (!bkey_cmp(&ret->key, search))
+ goto found;
+ else if (ret->last_write_point == write_point)
+ ret_task = ret;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Tang Junhui <tang.junhui@zte.com.cn>
+Date: Mon, 8 Jan 2018 12:21:19 -0800
+Subject: bcache: stop writeback thread after detaching
+
+From: Tang Junhui <tang.junhui@zte.com.cn>
+
+
+[ Upstream commit 8d29c4426b9f8afaccf28de414fde8a722b35fdf ]
+
+Currently, when a cached device detaching from cache, writeback thread is
+not stopped, and writeback_rate_update work is not canceled. For example,
+after the following command:
+echo 1 >/sys/block/sdb/bcache/detach
+you can still see the writeback thread. Then you attach the device to the
+cache again, bcache will create another writeback thread, for example,
+after below command:
+echo ba0fb5cd-658a-4533-9806-6ce166d883b9 > /sys/block/sdb/bcache/attach
+then you will see 2 writeback threads.
+This patch stops writeback thread and cancels writeback_rate_update work
+when cached device detaching from cache.
+
+Compare with patch v1, this v2 patch moves code down into the register
+lock for safety in case of any future changes as Coly and Mike suggested.
+
+[edit by mlyle: commit log spelling/formatting]
+
+Signed-off-by: Tang Junhui <tang.junhui@zte.com.cn>
+Reviewed-by: Michael Lyle <mlyle@lyle.org>
+Signed-off-by: Michael Lyle <mlyle@lyle.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/bcache/super.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -890,6 +890,12 @@ static void cached_dev_detach_finish(str
+
+ mutex_lock(&bch_register_lock);
+
++ cancel_delayed_work_sync(&dc->writeback_rate_update);
++ if (!IS_ERR_OR_NULL(dc->writeback_thread)) {
++ kthread_stop(dc->writeback_thread);
++ dc->writeback_thread = NULL;
++ }
++
+ memset(&dc->sb.set_uuid, 0, 16);
+ SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE);
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Dmitry Monakhov <dmonakhov@openvz.org>
+Date: Wed, 10 May 2017 19:20:44 +0400
+Subject: bio-integrity: Do not allocate integrity context for bio w/o data
+
+From: Dmitry Monakhov <dmonakhov@openvz.org>
+
+
+[ Upstream commit 3116a23bb30272d74ea81baf5d0ee23f602dd15b ]
+
+If bio has no data, such as ones from blkdev_issue_flush(),
+then we have nothing to protect.
+
+This patch prevent bugon like follows:
+
+kfree_debugcheck: out of range ptr ac1fa1d106742a5ah
+kernel BUG at mm/slab.c:2773!
+invalid opcode: 0000 [#1] SMP
+Modules linked in: bcache
+CPU: 0 PID: 4428 Comm: xfs_io Tainted: G W 4.11.0-rc4-ext4-00041-g2ef0043-dirty #43
+Hardware name: Virtuozzo KVM, BIOS seabios-1.7.5-11.vz7.4 04/01/2014
+task: ffff880137786440 task.stack: ffffc90000ba8000
+RIP: 0010:kfree_debugcheck+0x25/0x2a
+RSP: 0018:ffffc90000babde0 EFLAGS: 00010082
+RAX: 0000000000000034 RBX: ac1fa1d106742a5a RCX: 0000000000000007
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88013f3ccb40
+RBP: ffffc90000babde8 R08: 0000000000000000 R09: 0000000000000000
+R10: 00000000fcb76420 R11: 00000000725172ed R12: 0000000000000282
+R13: ffffffff8150e766 R14: ffff88013a145e00 R15: 0000000000000001
+FS: 00007fb09384bf40(0000) GS:ffff88013f200000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007fd0172f9e40 CR3: 0000000137fa9000 CR4: 00000000000006f0
+Call Trace:
+ kfree+0xc8/0x1b3
+ bio_integrity_free+0xc3/0x16b
+ bio_free+0x25/0x66
+ bio_put+0x14/0x26
+ blkdev_issue_flush+0x7a/0x85
+ blkdev_fsync+0x35/0x42
+ vfs_fsync_range+0x8e/0x9f
+ vfs_fsync+0x1c/0x1e
+ do_fsync+0x31/0x4a
+ SyS_fsync+0x10/0x14
+ entry_SYSCALL_64_fastpath+0x1f/0xc2
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/bio-integrity.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -175,6 +175,9 @@ bool bio_integrity_enabled(struct bio *b
+ if (!bio_is_rw(bio))
+ return false;
+
++ if (!bio_sectors(bio))
++ return false;
++
+ /* Already protected? */
+ if (bio_integrity(bio))
+ return false;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Ming Lei <ming.lei@redhat.com>
+Date: Tue, 9 Jan 2018 21:28:29 +0800
+Subject: blk-mq: fix kernel oops in blk_mq_tag_idle()
+
+From: Ming Lei <ming.lei@redhat.com>
+
+
+[ Upstream commit 8ab0b7dc73e1b3e2987d42554b2bff503f692772 ]
+
+HW queues may be unmapped in some cases, such as blk_mq_update_nr_hw_queues(),
+then we need to check it before calling blk_mq_tag_idle(), otherwise
+the following kernel oops can be triggered, so fix it by checking if
+the hw queue is unmapped since it doesn't make sense to idle the tags
+any more after hw queues are unmapped.
+
+[ 440.771298] Workqueue: nvme-wq nvme_rdma_del_ctrl_work [nvme_rdma]
+[ 440.779104] task: ffff894bae755ee0 ti: ffff893bf9bc8000 task.ti: ffff893bf9bc8000
+[ 440.788359] RIP: 0010:[<ffffffffb730e2b4>] [<ffffffffb730e2b4>] __blk_mq_tag_idle+0x24/0x40
+[ 440.798697] RSP: 0018:ffff893bf9bcbd10 EFLAGS: 00010286
+[ 440.805538] RAX: 0000000000000000 RBX: ffff895bb131dc00 RCX: 000000000000011f
+[ 440.814426] RDX: 00000000ffffffff RSI: 0000000000000120 RDI: ffff895bb131dc00
+[ 440.823301] RBP: ffff893bf9bcbd10 R08: 000000000001b860 R09: 4a51d361c00c0000
+[ 440.832193] R10: b5907f32b4cc7003 R11: ffffd6cabfb57000 R12: ffff894bafd1e008
+[ 440.841091] R13: 0000000000000001 R14: ffff895baf770000 R15: 0000000000000080
+[ 440.849988] FS: 0000000000000000(0000) GS:ffff894bbdcc0000(0000) knlGS:0000000000000000
+[ 440.859955] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 440.867274] CR2: 0000000000000008 CR3: 000000103d098000 CR4: 00000000001407e0
+[ 440.876169] Call Trace:
+[ 440.879818] [<ffffffffb7309d68>] blk_mq_exit_hctx+0xd8/0xe0
+[ 440.887051] [<ffffffffb730dc40>] blk_mq_free_queue+0xf0/0x160
+[ 440.894465] [<ffffffffb72ff679>] blk_cleanup_queue+0xd9/0x150
+[ 440.901881] [<ffffffffc08a802b>] nvme_ns_remove+0x5b/0xb0 [nvme_core]
+[ 440.910068] [<ffffffffc08a811b>] nvme_remove_namespaces+0x3b/0x60 [nvme_core]
+[ 440.919026] [<ffffffffc08b817b>] __nvme_rdma_remove_ctrl+0x2b/0xb0 [nvme_rdma]
+[ 440.928079] [<ffffffffc08b8237>] nvme_rdma_del_ctrl_work+0x17/0x20 [nvme_rdma]
+[ 440.937126] [<ffffffffb70ab58a>] process_one_work+0x17a/0x440
+[ 440.944517] [<ffffffffb70ac3a8>] worker_thread+0x278/0x3c0
+[ 440.951607] [<ffffffffb70ac130>] ? manage_workers.isra.24+0x2a0/0x2a0
+[ 440.959760] [<ffffffffb70b352f>] kthread+0xcf/0xe0
+[ 440.966055] [<ffffffffb70b3460>] ? insert_kthread_work+0x40/0x40
+[ 440.973715] [<ffffffffb76d8658>] ret_from_fork+0x58/0x90
+[ 440.980586] [<ffffffffb70b3460>] ? insert_kthread_work+0x40/0x40
+[ 440.988229] Code: 5b 41 5c 5d c3 66 90 0f 1f 44 00 00 48 8b 87 20 01 00 00 f0 0f ba 77 40 01 19 d2 85 d2 75 08 c3 0f 1f 80 00 00 00 00 55 48 89 e5 <f0> ff 48 08 48 8d 78 10 e8 7f 0f 05 00 5d c3 0f 1f 00 66 2e 0f
+[ 441.011620] RIP [<ffffffffb730e2b4>] __blk_mq_tag_idle+0x24/0x40
+[ 441.019301] RSP <ffff893bf9bcbd10>
+[ 441.024052] CR2: 0000000000000008
+
+Reported-by: Zhang Yi <yizhan@redhat.com>
+Tested-by: Zhang Yi <yizhan@redhat.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-mq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1634,7 +1634,8 @@ static void blk_mq_exit_hctx(struct requ
+ {
+ unsigned flush_start_tag = set->queue_depth;
+
+- blk_mq_tag_idle(hctx);
++ if (blk_mq_hw_queue_mapped(hctx))
++ blk_mq_tag_idle(hctx);
+
+ if (set->ops->exit_request)
+ set->ops->exit_request(set->driver_data,
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Wen Xiong <wenxiong@linux.vnet.ibm.com>
+Date: Wed, 10 May 2017 08:54:11 -0500
+Subject: blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op
+
+From: Wen Xiong <wenxiong@linux.vnet.ibm.com>
+
+
+[ Upstream commit f36ea50ca0043e7b1204feaf1d2ba6bd68c08d36 ]
+
+When formatting NVMe to 512B/4K + T10 DIf/DIX, dd with split op returns
+"Input/output error". Looks block layer split the bio after calling
+bio_integrity_prep(bio). This patch fixes the issue.
+
+Below is how we debug this issue:
+(1)format nvme to 4K block # size with type 2 DIF
+(2)dd with block size bigger than 1024k.
+oflag=direct
+dd: error writing '/dev/nvme0n1': Input/output error
+
+We added some debug code in nvme device driver. It showed us the first
+op and the second op have the same bi and pi address. This is not
+correct.
+
+1st op: nvme0n1 Op:Wr slba 0x505 length 0x100, PI ctrl=0x1400,
+ dsmgmt=0x0, AT=0x0 & RT=0x505
+ Guard 0x00b1, AT 0x0000, RT physical 0x00000505 RT virtual 0x00002828
+
+2nd op: nvme0n1 Op:Wr slba 0x605 length 0x1, PI ctrl=0x1400, dsmgmt=0x0,
+ AT=0x0 & RT=0x605 ==> This op fails and subsequent 5 retires..
+ Guard 0x00b1, AT 0x0000, RT physical 0x00000605 RT virtual 0x00002828
+
+With the fix, It showed us both of the first op and the second op have
+correct bi and pi address.
+
+1st op: nvme2n1 Op:Wr slba 0x505 length 0x100, PI ctrl=0x1400,
+ dsmgmt=0x0, AT=0x0 & RT=0x505
+ Guard 0x5ccb, AT 0x0000, RT physical 0x00000505 RT virtual
+ 0x00002828
+2nd op: nvme2n1 Op:Wr slba 0x605 length 0x1, PI ctrl=0x1400, dsmgmt=0x0,
+ AT=0x0 & RT=0x605
+ Guard 0xab4c, AT 0x0000, RT physical 0x00000605 RT virtual
+ 0x00003028
+
+Signed-off-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-mq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1252,13 +1252,13 @@ static blk_qc_t blk_mq_make_request(stru
+
+ blk_queue_bounce(q, &bio);
+
++ blk_queue_split(q, &bio, q->bio_split);
++
+ if (bio_integrity_enabled(bio) && bio_integrity_prep(bio)) {
+ bio_io_error(bio);
+ return BLK_QC_T_NONE;
+ }
+
+- blk_queue_split(q, &bio, q->bio_split);
+-
+ if (!is_flush_fua && !blk_queue_nomerges(q) &&
+ blk_attempt_plug_merge(q, bio, &request_count, &same_queue_rq))
+ return BLK_QC_T_NONE;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 23 May 2017 17:28:36 +0300
+Subject: block: fix an error code in add_partition()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit 7bd897cfce1eb373892d35d7f73201b0f9b221c4 ]
+
+We don't set an error code on this path. It means that we return NULL
+instead of an error pointer and the caller does a NULL dereference.
+
+Fixes: 6d1d8050b4bc ("block, partition: add partition_meta_info to hd_struct")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/partition-generic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/block/partition-generic.c
++++ b/block/partition-generic.c
+@@ -309,8 +309,10 @@ struct hd_struct *add_partition(struct g
+
+ if (info) {
+ struct partition_meta_info *pinfo = alloc_part_info(disk);
+- if (!pinfo)
++ if (!pinfo) {
++ err = -ENOMEM;
+ goto out_free_stats;
++ }
+ memcpy(pinfo, info, sizeof(*info));
+ p->info = pinfo;
+ }
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Fri, 9 Jun 2017 18:43:56 +0200
+Subject: Bluetooth: Send HCI Set Event Mask Page 2 command only when needed
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+
+[ Upstream commit 313f6888c8fbb1bc8b36c9012ce4e1de848df696 ]
+
+The Broadcom BCM20702 Bluetooth controller in ThinkPad-T530 devices
+report support for the Set Event Mask Page 2 command, but actually do
+return an error when trying to use it.
+
+ < HCI Command: Read Local Supported Commands (0x04|0x0002) plen 0
+ > HCI Event: Command Complete (0x0e) plen 68
+ Read Local Supported Commands (0x04|0x0002) ncmd 1
+ Status: Success (0x00)
+ Commands: 162 entries
+ ...
+ Set Event Mask Page 2 (Octet 22 - Bit 2)
+ ...
+
+ < HCI Command: Set Event Mask Page 2 (0x03|0x0063) plen 8
+ Mask: 0x0000000000000000
+ > HCI Event: Command Complete (0x0e) plen 4
+ Set Event Mask Page 2 (0x03|0x0063) ncmd 1
+ Status: Unknown HCI Command (0x01)
+
+Since these controllers do not support any feature that would require
+the event mask page 2 to be modified, it is safe to not send this
+command at all. The default value is all bits set to zero.
+
+T: Bus=01 Lev=02 Prnt=02 Port=03 Cnt=03 Dev#= 9 Spd=12 MxCh= 0
+D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0a5c ProdID=21e6 Rev= 1.12
+S: Manufacturer=Broadcom Corp
+S: Product=BCM20702A0
+S: SerialNumber=F82FA8E8CFC0
+C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=btusb
+E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
+Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
+Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hci_core.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -716,6 +716,7 @@ static void hci_set_event_mask_page_2(st
+ {
+ struct hci_dev *hdev = req->hdev;
+ u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
++ bool changed = false;
+
+ /* If Connectionless Slave Broadcast master role is supported
+ * enable all necessary events for it.
+@@ -725,6 +726,7 @@ static void hci_set_event_mask_page_2(st
+ events[1] |= 0x80; /* Synchronization Train Complete */
+ events[2] |= 0x10; /* Slave Page Response Timeout */
+ events[2] |= 0x20; /* CSB Channel Map Change */
++ changed = true;
+ }
+
+ /* If Connectionless Slave Broadcast slave role is supported
+@@ -735,13 +737,24 @@ static void hci_set_event_mask_page_2(st
+ events[2] |= 0x02; /* CSB Receive */
+ events[2] |= 0x04; /* CSB Timeout */
+ events[2] |= 0x08; /* Truncated Page Complete */
++ changed = true;
+ }
+
+ /* Enable Authenticated Payload Timeout Expired event if supported */
+- if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
++ if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
+ events[2] |= 0x80;
++ changed = true;
++ }
+
+- hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
++ /* Some Broadcom based controllers indicate support for Set Event
++ * Mask Page 2 command, but then actually do not support it. Since
++ * the default value is all bits set to zero, the command is only
++ * required if the event mask has to be changed. In case no change
++ * to the event mask is needed, skip this command.
++ */
++ if (changed)
++ hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2,
++ sizeof(events), events);
+ }
+
+ static void hci_init3_req(struct hci_request *req, unsigned long opt)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Kees Cook <keescook@chromium.org>
+Date: Fri, 5 May 2017 15:25:32 -0700
+Subject: bna: Avoid reading past end of buffer
+
+From: Kees Cook <keescook@chromium.org>
+
+
+[ Upstream commit 9e4eb1ce472fbf7b007f23c88ec11c37265e401c ]
+
+Using memcpy() from a string that is shorter than the length copied means
+the destination buffer is being filled with arbitrary data from the kernel
+rodata segment. Instead, use strncpy() which will fill the trailing bytes
+with zeros.
+
+This was found with the future CONFIG_FORTIFY_SOURCE feature.
+
+Cc: Daniel Micay <danielmicay@gmail.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/brocade/bna/bfa_ioc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c
++++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
+@@ -2845,7 +2845,7 @@ bfa_ioc_get_adapter_optrom_ver(struct bf
+ static void
+ bfa_ioc_get_adapter_manufacturer(struct bfa_ioc *ioc, char *manufacturer)
+ {
+- memcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
++ strncpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
+ }
+
+ static void
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
+Date: Fri, 9 Jun 2017 17:17:01 +0300
+Subject: bnx2x: Allow vfs to disable txvlan offload
+
+From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
+
+
+[ Upstream commit 92f85f05caa51d844af6ea14ffbc7a786446a644 ]
+
+VF clients are configured as enforced, meaning firmware is validating
+the correctness of their ethertype/vid during transmission.
+Once txvlan is disabled, VF would start getting SKBs for transmission
+here vlan is on the payload - but it'll pass the packet's ethertype
+instead of the vid, leading to firmware declaring it as malicious.
+
+Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -3943,15 +3943,26 @@ netdev_tx_t bnx2x_start_xmit(struct sk_b
+ /* when transmitting in a vf, start bd must hold the ethertype
+ * for fw to enforce it
+ */
++ u16 vlan_tci = 0;
+ #ifndef BNX2X_STOP_ON_ERROR
+- if (IS_VF(bp))
++ if (IS_VF(bp)) {
+ #endif
+- tx_start_bd->vlan_or_ethertype =
+- cpu_to_le16(ntohs(eth->h_proto));
++ /* Still need to consider inband vlan for enforced */
++ if (__vlan_get_tag(skb, &vlan_tci)) {
++ tx_start_bd->vlan_or_ethertype =
++ cpu_to_le16(ntohs(eth->h_proto));
++ } else {
++ tx_start_bd->bd_flags.as_bitfield |=
++ (X_ETH_INBAND_VLAN <<
++ ETH_TX_BD_FLAGS_VLAN_MODE_SHIFT);
++ tx_start_bd->vlan_or_ethertype =
++ cpu_to_le16(vlan_tci);
++ }
+ #ifndef BNX2X_STOP_ON_ERROR
+- else
++ } else {
+ /* used by FW for packet accounting */
+ tx_start_bd->vlan_or_ethertype = cpu_to_le16(pkt_prod);
++ }
+ #endif
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Nithin Sujir <nsujir@tintri.com>
+Date: Wed, 24 May 2017 19:45:17 -0700
+Subject: bonding: Don't update slave->link until ready to commit
+
+From: Nithin Sujir <nsujir@tintri.com>
+
+
+[ Upstream commit 797a93647a48d6cb8a20641a86a71713a947f786 ]
+
+In the loadbalance arp monitoring scheme, when a slave link change is
+detected, the slave->link is immediately updated and slave_state_changed
+is set. Later down the function, the rtnl_lock is acquired and the
+changes are committed, updating the bond link state.
+
+However, the acquisition of the rtnl_lock can fail. The next time the
+monitor runs, since slave->link is already updated, it determines that
+link is unchanged. This results in the bond link state permanently out
+of sync with the slave link.
+
+This patch modifies bond_loadbalance_arp_mon() to handle link changes
+identical to bond_ab_arp_{inspect/commit}(). The new link state is
+maintained in slave->new_link until we're ready to commit at which point
+it's copied into slave->link.
+
+NOTE: miimon_{inspect/commit}() has a more complex state machine
+requiring the use of the bond_{propose,commit}_link_state() functions
+which maintains the intermediate state in slave->link_new_state. The arp
+monitors don't require that.
+
+Testing: This bug is very easy to reproduce with the following steps.
+1. In a loop, toggle a slave link of a bond slave interface.
+2. In a separate loop, do ifconfig up/down of an unrelated interface to
+create contention for rtnl_lock.
+Within a few iterations, the bond link goes out of sync with the slave
+link.
+
+Signed-off-by: Nithin Nayak Sujir <nsujir@tintri.com>
+Cc: Mahesh Bandewar <maheshb@google.com>
+Cc: Jay Vosburgh <jay.vosburgh@canonical.com>
+Acked-by: Mahesh Bandewar <maheshb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2555,11 +2555,13 @@ static void bond_loadbalance_arp_mon(str
+ bond_for_each_slave_rcu(bond, slave, iter) {
+ unsigned long trans_start = dev_trans_start(slave->dev);
+
++ slave->new_link = BOND_LINK_NOCHANGE;
++
+ if (slave->link != BOND_LINK_UP) {
+ if (bond_time_in_interval(bond, trans_start, 1) &&
+ bond_time_in_interval(bond, slave->last_rx, 1)) {
+
+- slave->link = BOND_LINK_UP;
++ slave->new_link = BOND_LINK_UP;
+ slave_state_changed = 1;
+
+ /* primary_slave has no meaning in round-robin
+@@ -2586,7 +2588,7 @@ static void bond_loadbalance_arp_mon(str
+ if (!bond_time_in_interval(bond, trans_start, 2) ||
+ !bond_time_in_interval(bond, slave->last_rx, 2)) {
+
+- slave->link = BOND_LINK_DOWN;
++ slave->new_link = BOND_LINK_DOWN;
+ slave_state_changed = 1;
+
+ if (slave->link_failure_count < UINT_MAX)
+@@ -2617,6 +2619,11 @@ static void bond_loadbalance_arp_mon(str
+ if (!rtnl_trylock())
+ goto re_arm;
+
++ bond_for_each_slave(bond, slave, iter) {
++ if (slave->new_link != BOND_LINK_NOCHANGE)
++ slave->link = slave->new_link;
++ }
++
+ if (slave_state_changed) {
+ bond_slave_state_change(bond);
+ if (BOND_MODE(bond) == BOND_MODE_XOR)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 9 May 2017 18:14:01 +0100
+Subject: btrfs: fix incorrect error return ret being passed to mapping_set_error
+
+From: Colin Ian King <colin.king@canonical.com>
+
+
+[ Upstream commit bff5baf8aa37a97293725a16c03f49872249c07e ]
+
+The setting of return code ret should be based on the error code
+passed into function end_extent_writepage and not on ret. Thanks
+to Liu Bo for spotting this mistake in the original fix I submitted.
+
+Detected by CoverityScan, CID#1414312 ("Logically dead code")
+
+Fixes: 5dca6eea91653e ("Btrfs: mark mapping with error flag to report errors to userspace")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/extent_io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -2534,7 +2534,7 @@ int end_extent_writepage(struct page *pa
+ if (!uptodate) {
+ ClearPageUptodate(page);
+ SetPageError(page);
+- ret = ret < 0 ? ret : -EIO;
++ ret = err < 0 ? err : -EIO;
+ mapping_set_error(page->mapping, ret);
+ }
+ return 0;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Doug Berger <opendmb@gmail.com>
+Date: Wed, 29 Mar 2017 17:29:10 -0700
+Subject: bus: brcmstb_gisb: correct support for 64-bit address output
+
+From: Doug Berger <opendmb@gmail.com>
+
+
+[ Upstream commit 0c2aa0e4b308815e877601845c1a89913f9bd2b9 ]
+
+The GISB bus can support addresses beyond 32-bits. So this commit
+corrects support for reading a captured 64-bit address into a 64-bit
+variable by obtaining the high bits from the ARB_ERR_CAP_HI_ADDR
+register (when present) and then outputting the full 64-bit value.
+
+It also removes unused definitions.
+
+Fixes: 44127b771d9c ("bus: add Broadcom GISB bus arbiter timeout/error handler")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Gregory Fong <gregory.0xf0@gmail.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/brcmstb_gisb.c | 36 ++++++++++++++++++++----------------
+ 1 file changed, 20 insertions(+), 16 deletions(-)
+
+--- a/drivers/bus/brcmstb_gisb.c
++++ b/drivers/bus/brcmstb_gisb.c
+@@ -33,8 +33,6 @@
+ #define ARB_ERR_CAP_CLEAR (1 << 0)
+ #define ARB_ERR_CAP_STATUS_TIMEOUT (1 << 12)
+ #define ARB_ERR_CAP_STATUS_TEA (1 << 11)
+-#define ARB_ERR_CAP_STATUS_BS_SHIFT (1 << 2)
+-#define ARB_ERR_CAP_STATUS_BS_MASK 0x3c
+ #define ARB_ERR_CAP_STATUS_WRITE (1 << 1)
+ #define ARB_ERR_CAP_STATUS_VALID (1 << 0)
+
+@@ -43,7 +41,6 @@ enum {
+ ARB_ERR_CAP_CLR,
+ ARB_ERR_CAP_HI_ADDR,
+ ARB_ERR_CAP_ADDR,
+- ARB_ERR_CAP_DATA,
+ ARB_ERR_CAP_STATUS,
+ ARB_ERR_CAP_MASTER,
+ };
+@@ -53,7 +50,6 @@ static const int gisb_offsets_bcm7038[]
+ [ARB_ERR_CAP_CLR] = 0x0c4,
+ [ARB_ERR_CAP_HI_ADDR] = -1,
+ [ARB_ERR_CAP_ADDR] = 0x0c8,
+- [ARB_ERR_CAP_DATA] = 0x0cc,
+ [ARB_ERR_CAP_STATUS] = 0x0d0,
+ [ARB_ERR_CAP_MASTER] = -1,
+ };
+@@ -63,7 +59,6 @@ static const int gisb_offsets_bcm7400[]
+ [ARB_ERR_CAP_CLR] = 0x0c8,
+ [ARB_ERR_CAP_HI_ADDR] = -1,
+ [ARB_ERR_CAP_ADDR] = 0x0cc,
+- [ARB_ERR_CAP_DATA] = 0x0d0,
+ [ARB_ERR_CAP_STATUS] = 0x0d4,
+ [ARB_ERR_CAP_MASTER] = 0x0d8,
+ };
+@@ -73,7 +68,6 @@ static const int gisb_offsets_bcm7435[]
+ [ARB_ERR_CAP_CLR] = 0x168,
+ [ARB_ERR_CAP_HI_ADDR] = -1,
+ [ARB_ERR_CAP_ADDR] = 0x16c,
+- [ARB_ERR_CAP_DATA] = 0x170,
+ [ARB_ERR_CAP_STATUS] = 0x174,
+ [ARB_ERR_CAP_MASTER] = 0x178,
+ };
+@@ -83,7 +77,6 @@ static const int gisb_offsets_bcm7445[]
+ [ARB_ERR_CAP_CLR] = 0x7e4,
+ [ARB_ERR_CAP_HI_ADDR] = 0x7e8,
+ [ARB_ERR_CAP_ADDR] = 0x7ec,
+- [ARB_ERR_CAP_DATA] = 0x7f0,
+ [ARB_ERR_CAP_STATUS] = 0x7f4,
+ [ARB_ERR_CAP_MASTER] = 0x7f8,
+ };
+@@ -105,9 +98,13 @@ static u32 gisb_read(struct brcmstb_gisb
+ {
+ int offset = gdev->gisb_offsets[reg];
+
+- /* return 1 if the hardware doesn't have ARB_ERR_CAP_MASTER */
+- if (offset == -1)
+- return 1;
++ if (offset < 0) {
++ /* return 1 if the hardware doesn't have ARB_ERR_CAP_MASTER */
++ if (reg == ARB_ERR_CAP_MASTER)
++ return 1;
++ else
++ return 0;
++ }
+
+ if (gdev->big_endian)
+ return ioread32be(gdev->base + offset);
+@@ -115,6 +112,16 @@ static u32 gisb_read(struct brcmstb_gisb
+ return ioread32(gdev->base + offset);
+ }
+
++static u64 gisb_read_address(struct brcmstb_gisb_arb_device *gdev)
++{
++ u64 value;
++
++ value = gisb_read(gdev, ARB_ERR_CAP_ADDR);
++ value |= (u64)gisb_read(gdev, ARB_ERR_CAP_HI_ADDR) << 32;
++
++ return value;
++}
++
+ static void gisb_write(struct brcmstb_gisb_arb_device *gdev, u32 val, int reg)
+ {
+ int offset = gdev->gisb_offsets[reg];
+@@ -181,7 +188,7 @@ static int brcmstb_gisb_arb_decode_addr(
+ const char *reason)
+ {
+ u32 cap_status;
+- unsigned long arb_addr;
++ u64 arb_addr;
+ u32 master;
+ const char *m_name;
+ char m_fmt[11];
+@@ -193,10 +200,7 @@ static int brcmstb_gisb_arb_decode_addr(
+ return 1;
+
+ /* Read the address and master */
+- arb_addr = gisb_read(gdev, ARB_ERR_CAP_ADDR) & 0xffffffff;
+-#if (IS_ENABLED(CONFIG_PHYS_ADDR_T_64BIT))
+- arb_addr |= (u64)gisb_read(gdev, ARB_ERR_CAP_HI_ADDR) << 32;
+-#endif
++ arb_addr = gisb_read_address(gdev);
+ master = gisb_read(gdev, ARB_ERR_CAP_MASTER);
+
+ m_name = brcmstb_gisb_master_to_str(gdev, master);
+@@ -205,7 +209,7 @@ static int brcmstb_gisb_arb_decode_addr(
+ m_name = m_fmt;
+ }
+
+- pr_crit("%s: %s at 0x%lx [%c %s], core: %s\n",
++ pr_crit("%s: %s at 0x%llx [%c %s], core: %s\n",
+ __func__, reason, arb_addr,
+ cap_status & ARB_ERR_CAP_STATUS_WRITE ? 'W' : 'R',
+ cap_status & ARB_ERR_CAP_STATUS_TIMEOUT ? "timeout" : "",
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Doug Berger <opendmb@gmail.com>
+Date: Wed, 29 Mar 2017 17:29:09 -0700
+Subject: bus: brcmstb_gisb: Use register offsets with writes too
+
+From: Doug Berger <opendmb@gmail.com>
+
+
+[ Upstream commit 856c7ccb9ce7a061f04bdf586f649cb93654e294 ]
+
+This commit corrects the bug introduced in commit f80835875d3d
+("bus: brcmstb_gisb: Look up register offsets in a table") such
+that gisb_write() translates the register enumeration into an
+offset from the base address for writes as well as reads.
+
+Fixes: f80835875d3d ("bus: brcmstb_gisb: Look up register offsets in a table")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Gregory Fong <gregory.0xf0@gmail.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/brcmstb_gisb.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/bus/brcmstb_gisb.c
++++ b/drivers/bus/brcmstb_gisb.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (C) 2014 Broadcom Corporation
++ * Copyright (C) 2014-2017 Broadcom
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -123,9 +123,9 @@ static void gisb_write(struct brcmstb_gi
+ return;
+
+ if (gdev->big_endian)
+- iowrite32be(val, gdev->base + reg);
++ iowrite32be(val, gdev->base + offset);
+ else
+- iowrite32(val, gdev->base + reg);
++ iowrite32(val, gdev->base + offset);
+ }
+
+ static ssize_t gisb_arb_get_timeout(struct device *dev,
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 4 May 2017 08:42:30 +0200
+Subject: cfg80211: make RATE_INFO_BW_20 the default
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+
+[ Upstream commit 842be75c77cb72ee546a2b19da9c285fb3ded660 ]
+
+Due to the way I did the RX bitrate conversions in mac80211 with
+spatch, going setting flags to setting the value, many drivers now
+don't set the bandwidth value for 20 MHz, since with the flags it
+wasn't necessary to (there was no 20 MHz flag, only the others.)
+
+Rather than go through and try to fix up all the drivers, instead
+renumber the enum so that 20 MHz, which is the typical bandwidth,
+actually has the value 0, making those drivers all work again.
+
+If VHT was hit used with a driver not reporting it, e.g. iwlmvm,
+this manifested in hitting the bandwidth warning in
+cfg80211_calculate_bitrate_vht().
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Tested-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/cfg80211.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -933,9 +933,9 @@ enum rate_info_flags {
+ * @RATE_INFO_BW_160: 160 MHz bandwidth
+ */
+ enum rate_info_bw {
++ RATE_INFO_BW_20 = 0,
+ RATE_INFO_BW_5,
+ RATE_INFO_BW_10,
+- RATE_INFO_BW_20,
+ RATE_INFO_BW_40,
+ RATE_INFO_BW_80,
+ RATE_INFO_BW_160,
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Rabin Vincent <rabinv@axis.com>
+Date: Wed, 3 May 2017 17:17:21 +0200
+Subject: CIFS: silence lockdep splat in cifs_relock_file()
+
+From: Rabin Vincent <rabinv@axis.com>
+
+
+[ Upstream commit 560d388950ceda5e7c7cdef7f3d9a8ff297bbf9d ]
+
+cifs_relock_file() can perform a down_write() on the inode's lock_sem even
+though it was already performed in cifs_strict_readv(). Lockdep complains
+about this. AFAICS, there is no problem here, and lockdep just needs to be
+told that this nesting is OK.
+
+ =============================================
+ [ INFO: possible recursive locking detected ]
+ 4.11.0+ #20 Not tainted
+ ---------------------------------------------
+ cat/701 is trying to acquire lock:
+ (&cifsi->lock_sem){++++.+}, at: cifs_reopen_file+0x7a7/0xc00
+
+ but task is already holding lock:
+ (&cifsi->lock_sem){++++.+}, at: cifs_strict_readv+0x177/0x310
+
+ other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(&cifsi->lock_sem);
+ lock(&cifsi->lock_sem);
+
+ *** DEADLOCK ***
+
+ May be due to missing lock nesting notation
+
+ 1 lock held by cat/701:
+ #0: (&cifsi->lock_sem){++++.+}, at: cifs_strict_readv+0x177/0x310
+
+ stack backtrace:
+ CPU: 0 PID: 701 Comm: cat Not tainted 4.11.0+ #20
+ Call Trace:
+ dump_stack+0x85/0xc2
+ __lock_acquire+0x17dd/0x2260
+ ? trace_hardirqs_on_thunk+0x1a/0x1c
+ ? preempt_schedule_irq+0x6b/0x80
+ lock_acquire+0xcc/0x260
+ ? lock_acquire+0xcc/0x260
+ ? cifs_reopen_file+0x7a7/0xc00
+ down_read+0x2d/0x70
+ ? cifs_reopen_file+0x7a7/0xc00
+ cifs_reopen_file+0x7a7/0xc00
+ ? printk+0x43/0x4b
+ cifs_readpage_worker+0x327/0x8a0
+ cifs_readpage+0x8c/0x2a0
+ generic_file_read_iter+0x692/0xd00
+ cifs_strict_readv+0x29f/0x310
+ generic_file_splice_read+0x11c/0x1c0
+ do_splice_to+0xa5/0xc0
+ splice_direct_to_actor+0xfa/0x350
+ ? generic_pipe_buf_nosteal+0x10/0x10
+ do_splice_direct+0xb5/0xe0
+ do_sendfile+0x278/0x3a0
+ SyS_sendfile64+0xc4/0xe0
+ entry_SYSCALL_64_fastpath+0x1f/0xbe
+
+Signed-off-by: Rabin Vincent <rabinv@axis.com>
+Acked-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Steve French <smfrench@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -589,7 +589,7 @@ cifs_relock_file(struct cifsFileInfo *cf
+ struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
+ int rc = 0;
+
+- down_read(&cinode->lock_sem);
++ down_read_nested(&cinode->lock_sem, SINGLE_DEPTH_NESTING);
+ if (cinode->can_cache_brlcks) {
+ /* can cache locks - no need to relock */
+ up_read(&cinode->lock_sem);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+Date: Mon, 15 May 2017 11:58:59 +0100
+Subject: clk: Fix __set_clk_rates error print-string
+
+From: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+
+
+[ Upstream commit ee177c5d6369f8e5d3e4793dce501cf4431313a1 ]
+
+When failing to set a clock the printout emitted is incorrect.
+"u32 rate" is formatted as %d and should be %u whereas "unsigned long
+clk_set_rate()" is formatted as %ld and should be %lu as per
+Documentation/printk-formats.txt.
+
+Fixes: 2885c3b2a3da ("clk: Show correct information when fail to set clock rate")
+Signed-off-by: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/clk-conf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/clk-conf.c
++++ b/drivers/clk/clk-conf.c
+@@ -106,7 +106,7 @@ static int __set_clk_rates(struct device
+
+ rc = clk_set_rate(clk, rate);
+ if (rc < 0)
+- pr_err("clk: couldn't set %s clk rate to %d (%d), current rate: %ld\n",
++ pr_err("clk: couldn't set %s clk rate to %u (%d), current rate: %lu\n",
+ __clk_get_name(clk), rate, rc,
+ clk_get_rate(clk));
+ clk_put(clk);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Sudeep Holla <sudeep.holla@arm.com>
+Date: Thu, 18 May 2017 17:19:28 +0100
+Subject: clk: scpi: fix return type of __scpi_dvfs_round_rate
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+
+[ Upstream commit 7374aec95636ca39409545eba4ef5ff3125c2346 ]
+
+The frequencies above the maximum value of signed integer(i.e. 2^31 -1)
+will overflow with the current code.
+
+This patch fixes the return type of __scpi_dvfs_round_rate from 'int'
+to 'unsigned long'.
+
+Fixes: cd52c2a4b5c4 ("clk: add support for clocks provided by SCP(System Control Processor)")
+Cc: Michael Turquette <mturquette@baylibre.com>
+Cc: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/clk-scpi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/clk-scpi.c
++++ b/drivers/clk/clk-scpi.c
+@@ -71,15 +71,15 @@ static const struct clk_ops scpi_clk_ops
+ };
+
+ /* find closest match to given frequency in OPP table */
+-static int __scpi_dvfs_round_rate(struct scpi_clk *clk, unsigned long rate)
++static long __scpi_dvfs_round_rate(struct scpi_clk *clk, unsigned long rate)
+ {
+ int idx;
+- u32 fmin = 0, fmax = ~0, ftmp;
++ unsigned long fmin = 0, fmax = ~0, ftmp;
+ const struct scpi_opp *opp = clk->info->opps;
+
+ for (idx = 0; idx < clk->info->count; idx++, opp++) {
+ ftmp = opp->freq;
+- if (ftmp >= (u32)rate) {
++ if (ftmp >= rate) {
+ if (ftmp <= fmax)
+ fmax = ftmp;
+ break;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
+Date: Sun, 11 Jun 2017 14:28:54 +0200
+Subject: cpuidle: dt: Add missing 'of_node_put()'
+
+From: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit b2cdd8e1b54849477a32d820acc2e87828a38f3d ]
+
+'of_node_put()' should be called on pointer returned by
+'of_parse_phandle()' when done. In this function this is done in all path
+except this 'continue', so add it.
+
+Fixes: 97735da074fd (drivers: cpuidle: Add status property to ARM idle states)
+Signed-off-by: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpuidle/dt_idle_states.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/cpuidle/dt_idle_states.c
++++ b/drivers/cpuidle/dt_idle_states.c
+@@ -174,8 +174,10 @@ int dt_init_idle_driver(struct cpuidle_d
+ if (!state_node)
+ break;
+
+- if (!of_device_is_available(state_node))
++ if (!of_device_is_available(state_node)) {
++ of_node_put(state_node);
+ continue;
++ }
+
+ if (!idle_state_valid(state_node, i, cpumask)) {
+ pr_warn("%s idle state not valid, bailing out\n",
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Pan Bian <bianpan2016@163.com>
+Date: Sun, 23 Apr 2017 10:06:36 -0300
+Subject: [media] cx25840: fix unchecked return values
+
+From: Pan Bian <bianpan2016@163.com>
+
+
+[ Upstream commit 35378ce143071c2a6bad4b59a000e9b9f8f6ea67 ]
+
+In functions cx25840_initialize(), cx231xx_initialize(), and
+cx23885_initialize(), the return value of create_singlethread_workqueue()
+is used without validation. This may result in NULL dereference and cause
+kernel crash. This patch fixes it.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/cx25840/cx25840-core.c | 36 ++++++++++++++++++-------------
+ 1 file changed, 21 insertions(+), 15 deletions(-)
+
+--- a/drivers/media/i2c/cx25840/cx25840-core.c
++++ b/drivers/media/i2c/cx25840/cx25840-core.c
+@@ -420,11 +420,13 @@ static void cx25840_initialize(struct i2
+ INIT_WORK(&state->fw_work, cx25840_work_handler);
+ init_waitqueue_head(&state->fw_wait);
+ q = create_singlethread_workqueue("cx25840_fw");
+- prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE);
+- queue_work(q, &state->fw_work);
+- schedule();
+- finish_wait(&state->fw_wait, &wait);
+- destroy_workqueue(q);
++ if (q) {
++ prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE);
++ queue_work(q, &state->fw_work);
++ schedule();
++ finish_wait(&state->fw_wait, &wait);
++ destroy_workqueue(q);
++ }
+
+ /* 6. */
+ cx25840_write(client, 0x115, 0x8c);
+@@ -631,11 +633,13 @@ static void cx23885_initialize(struct i2
+ INIT_WORK(&state->fw_work, cx25840_work_handler);
+ init_waitqueue_head(&state->fw_wait);
+ q = create_singlethread_workqueue("cx25840_fw");
+- prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE);
+- queue_work(q, &state->fw_work);
+- schedule();
+- finish_wait(&state->fw_wait, &wait);
+- destroy_workqueue(q);
++ if (q) {
++ prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE);
++ queue_work(q, &state->fw_work);
++ schedule();
++ finish_wait(&state->fw_wait, &wait);
++ destroy_workqueue(q);
++ }
+
+ /* Call the cx23888 specific std setup func, we no longer rely on
+ * the generic cx24840 func.
+@@ -746,11 +750,13 @@ static void cx231xx_initialize(struct i2
+ INIT_WORK(&state->fw_work, cx25840_work_handler);
+ init_waitqueue_head(&state->fw_wait);
+ q = create_singlethread_workqueue("cx25840_fw");
+- prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE);
+- queue_work(q, &state->fw_work);
+- schedule();
+- finish_wait(&state->fw_wait, &wait);
+- destroy_workqueue(q);
++ if (q) {
++ prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE);
++ queue_work(q, &state->fw_work);
++ schedule();
++ finish_wait(&state->fw_wait, &wait);
++ destroy_workqueue(q);
++ }
+
+ cx25840_std_setup(client);
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+Date: Wed, 31 May 2017 19:10:21 +0530
+Subject: cxgb4: fix incorrect cim_la output for T6
+
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+
+
+[ Upstream commit a97051f4553551d13e586ab3cb6ae13093a44a81 ]
+
+take care of UpDbgLaRdPtr[0-3] restriction for T6.
+
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -7711,7 +7711,16 @@ int t4_cim_read_la(struct adapter *adap,
+ ret = t4_cim_read(adap, UP_UP_DBG_LA_DATA_A, 1, &la_buf[i]);
+ if (ret)
+ break;
+- idx = (idx + 1) & UPDBGLARDPTR_M;
++
++ /* Bits 0-3 of UpDbgLaRdPtr can be between 0000 to 1001 to
++ * identify the 32-bit portion of the full 312-bit data
++ */
++ if (is_t6(adap->params.chip) && (idx & 0xf) >= 9)
++ idx = (idx & 0xff0) + 0x10;
++ else
++ idx++;
++ /* address can't exceed 0xfff */
++ idx &= UPDBGLARDPTR_M;
+ }
+ restart:
+ if (cfg & UPDBGLAEN_F) {
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Arjun Vynipadath <arjun@chelsio.com>
+Date: Tue, 30 May 2017 18:06:06 +0530
+Subject: cxgb4: FW upgrade fixes
+
+From: Arjun Vynipadath <arjun@chelsio.com>
+
+
+[ Upstream commit 26747211486c5bc7dd014c3caab206576e00c0d0 ]
+
+Disable FW_OK flag while flashing Firmware. This will help to fix any
+potential mailbox timeouts during Firmware flash.
+
+Grab new devlog parameters after Firmware restart. When we FLASH new
+Firmware onto an adapter, the new Firmware may have the Firmware Device Log
+located at a different memory address or have a different size for it.
+
+Signed-off-by: Arjun Vynipadath <arjun@chelsio.com>
+Signed-off-by: Casey Leedom <leedom@chelsio.com>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -6076,13 +6076,18 @@ int t4_fw_upgrade(struct adapter *adap,
+ if (!t4_fw_matches_chip(adap, fw_hdr))
+ return -EINVAL;
+
++ /* Disable FW_OK flag so that mbox commands with FW_OK flag set
++ * wont be sent when we are flashing FW.
++ */
++ adap->flags &= ~FW_OK;
++
+ ret = t4_fw_halt(adap, mbox, force);
+ if (ret < 0 && !force)
+- return ret;
++ goto out;
+
+ ret = t4_load_fw(adap, fw_data, size);
+ if (ret < 0)
+- return ret;
++ goto out;
+
+ /*
+ * Older versions of the firmware don't understand the new
+@@ -6093,7 +6098,17 @@ int t4_fw_upgrade(struct adapter *adap,
+ * its header flags to see if it advertises the capability.
+ */
+ reset = ((be32_to_cpu(fw_hdr->flags) & FW_HDR_FLAGS_RESET_HALT) == 0);
+- return t4_fw_restart(adap, mbox, reset);
++ ret = t4_fw_restart(adap, mbox, reset);
++
++ /* Grab potentially new Firmware Device Log parameters so we can see
++ * how healthy the new Firmware is. It's okay to contact the new
++ * Firmware for these parameters even though, as far as it's
++ * concerned, we've never said "HELLO" to it ...
++ */
++ (void)t4_init_devlog_params(adap);
++out:
++ adap->flags |= FW_OK;
++ return ret;
+ }
+
+ /**
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Arjun Vynipadath <arjun@chelsio.com>
+Date: Wed, 10 Jan 2018 12:02:13 +0530
+Subject: cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages
+
+From: Arjun Vynipadath <arjun@chelsio.com>
+
+
+[ Upstream commit ea0a42109aee7b92e631c4eb3f2219fadf58acdd ]
+
+We'd come in with SGE_FL_BUFFER_SIZE[0] and [1] both equal to 64KB and
+the extant logic would flag that as an error. This was already fixed in
+cxgb4 driver with "92ddcc7 cxgb4: Fix some small bugs in
+t4_sge_init_soft() when our Page Size is 64KB".
+
+Original Work by: Casey Leedom <leedom@chelsio.com>
+Signed-off-by: Arjun Vynipadath <arjun@chelsio.com>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4vf/sge.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+@@ -2604,8 +2604,8 @@ void t4vf_sge_stop(struct adapter *adapt
+ int t4vf_sge_init(struct adapter *adapter)
+ {
+ struct sge_params *sge_params = &adapter->params.sge;
+- u32 fl0 = sge_params->sge_fl_buffer_size[0];
+- u32 fl1 = sge_params->sge_fl_buffer_size[1];
++ u32 fl_small_pg = sge_params->sge_fl_buffer_size[0];
++ u32 fl_large_pg = sge_params->sge_fl_buffer_size[1];
+ struct sge *s = &adapter->sge;
+ unsigned int ingpadboundary, ingpackboundary;
+
+@@ -2614,9 +2614,20 @@ int t4vf_sge_init(struct adapter *adapte
+ * the Physical Function Driver. Ideally we should be able to deal
+ * with _any_ configuration. Practice is different ...
+ */
+- if (fl0 != PAGE_SIZE || (fl1 != 0 && fl1 <= fl0)) {
++
++ /* We only bother using the Large Page logic if the Large Page Buffer
++ * is larger than our Page Size Buffer.
++ */
++ if (fl_large_pg <= fl_small_pg)
++ fl_large_pg = 0;
++
++ /* The Page Size Buffer must be exactly equal to our Page Size and the
++ * Large Page Size Buffer should be 0 (per above) or a power of 2.
++ */
++ if (fl_small_pg != PAGE_SIZE ||
++ (fl_large_pg & (fl_large_pg - 1)) != 0) {
+ dev_err(adapter->pdev_dev, "bad SGE FL buffer sizes [%d, %d]\n",
+- fl0, fl1);
++ fl_small_pg, fl_large_pg);
+ return -EINVAL;
+ }
+ if ((sge_params->sge_control & RXPKTCPLMODE_F) == 0) {
+@@ -2627,8 +2638,8 @@ int t4vf_sge_init(struct adapter *adapte
+ /*
+ * Now translate the adapter parameters into our internal forms.
+ */
+- if (fl1)
+- s->fl_pg_order = ilog2(fl1) - PAGE_SHIFT;
++ if (fl_large_pg)
++ s->fl_pg_order = ilog2(fl_large_pg) - PAGE_SHIFT;
+ s->stat_len = ((sge_params->sge_control & EGRSTATUSPAGESIZE_F)
+ ? 128 : 64);
+ s->pktshift = PKTSHIFT_G(sge_params->sge_control);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Date: Wed, 24 May 2017 12:09:53 +0530
+Subject: dmaengine: imx-sdma: Handle return value of clk_prepare_enable
+
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+
+
+[ Upstream commit fb9caf370f4d0457789d13a1a1b110a8db846e5e ]
+
+clk_prepare_enable() can fail here and we must check its return value.
+
+Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/imx-sdma.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -1722,17 +1722,24 @@ static int sdma_probe(struct platform_de
+ if (IS_ERR(sdma->clk_ahb))
+ return PTR_ERR(sdma->clk_ahb);
+
+- clk_prepare(sdma->clk_ipg);
+- clk_prepare(sdma->clk_ahb);
++ ret = clk_prepare(sdma->clk_ipg);
++ if (ret)
++ return ret;
++
++ ret = clk_prepare(sdma->clk_ahb);
++ if (ret)
++ goto err_clk;
+
+ ret = devm_request_irq(&pdev->dev, irq, sdma_int_handler, 0, "sdma",
+ sdma);
+ if (ret)
+- return ret;
++ goto err_irq;
+
+ sdma->script_addrs = kzalloc(sizeof(*sdma->script_addrs), GFP_KERNEL);
+- if (!sdma->script_addrs)
+- return -ENOMEM;
++ if (!sdma->script_addrs) {
++ ret = -ENOMEM;
++ goto err_irq;
++ }
+
+ /* initially no scripts available */
+ saddr_arr = (s32 *)sdma->script_addrs;
+@@ -1847,6 +1854,10 @@ err_register:
+ dma_async_device_unregister(&sdma->dma_device);
+ err_init:
+ kfree(sdma->script_addrs);
++err_irq:
++ clk_unprepare(sdma->clk_ahb);
++err_clk:
++ clk_unprepare(sdma->clk_ipg);
+ return ret;
+ }
+
+@@ -1857,6 +1868,8 @@ static int sdma_remove(struct platform_d
+
+ dma_async_device_unregister(&sdma->dma_device);
+ kfree(sdma->script_addrs);
++ clk_unprepare(sdma->clk_ahb);
++ clk_unprepare(sdma->clk_ipg);
+ /* Kill the tasklet */
+ for (i = 0; i < MAX_DMA_CHANNELS; i++) {
+ struct sdma_channel *sdmac = &sdma->channel[i];
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 8 May 2017 15:55:14 -0700
+Subject: drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit 146180c052a00172f4dc08eaade836fd02f61fb5 ]
+
+The "DIV_ROUND_UP(size, PAGE_SIZE)" operation can overflow if "size" is
+more than ULLONG_MAX - PAGE_SIZE.
+
+Link: http://lkml.kernel.org/r/20170322111950.GA11279@mwanda
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Jorgen Hansen <jhansen@vmware.com>
+Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+@@ -298,8 +298,11 @@ static void *qp_alloc_queue(u64 size, u3
+ size_t pas_size;
+ size_t vas_size;
+ size_t queue_size = sizeof(*queue) + sizeof(*queue->kernel_if);
+- const u64 num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
++ u64 num_pages;
+
++ if (size > SIZE_MAX - PAGE_SIZE)
++ return NULL;
++ num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
+ if (num_pages >
+ (SIZE_MAX - queue_size) /
+ (sizeof(*queue->kernel_if->u.g.pas) +
+@@ -624,9 +627,12 @@ static struct vmci_queue *qp_host_alloc_
+ {
+ struct vmci_queue *queue;
+ size_t queue_page_size;
+- const u64 num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
++ u64 num_pages;
+ const size_t queue_size = sizeof(*queue) + sizeof(*(queue->kernel_if));
+
++ if (size > SIZE_MAX - PAGE_SIZE)
++ return NULL;
++ num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
+ if (num_pages > (SIZE_MAX - queue_size) /
+ sizeof(*queue->kernel_if->u.h.page))
+ return NULL;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Thu, 18 May 2017 11:51:51 +0300
+Subject: drm/omap: fix tiled buffer stride calculations
+
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+
+
+[ Upstream commit cc8dd7661ccc2d8dc88921da8e6cc7c2fcdb0341 ]
+
+omap_gem uses page alignment for buffer stride. The related calculations
+are a bit off, though, as byte stride of 4096 gets aligned to 8192,
+instead of 4096.
+
+This patch changes the code to use DIV_ROUND_UP(), which fixes those
+calculations and makes them more readable.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/omapdrm/omap_gem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/omapdrm/omap_gem.c
++++ b/drivers/gpu/drm/omapdrm/omap_gem.c
+@@ -158,7 +158,7 @@ static void evict_entry(struct drm_gem_o
+ size_t size = PAGE_SIZE * n;
+ loff_t off = mmap_offset(obj) +
+ (entry->obj_pgoff << PAGE_SHIFT);
+- const int m = 1 + ((omap_obj->width << fmt) / PAGE_SIZE);
++ const int m = DIV_ROUND_UP(omap_obj->width << fmt, PAGE_SIZE);
+
+ if (m > 1) {
+ int i;
+@@ -415,7 +415,7 @@ static int fault_2d(struct drm_gem_objec
+ * into account in some of the math, so figure out virtual stride
+ * in pages
+ */
+- const int m = 1 + ((omap_obj->width << fmt) / PAGE_SIZE);
++ const int m = DIV_ROUND_UP(omap_obj->width << fmt, PAGE_SIZE);
+
+ /* We don't use vmf->pgoff since that has the fake offset: */
+ pgoff = ((unsigned long)vmf->virtual_address -
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Wed, 3 May 2017 10:28:50 -0700
+Subject: e1000e: fix race condition around skb_tstamp_tx()
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+
+[ Upstream commit 5012863b7347866764c4a4e58b62fb05346b0d06 ]
+
+The e1000e driver and related hardware has a limitation on Tx PTP
+packets which requires we limit to timestamping a single packet at once.
+We do this by verifying that we never request a new Tx timestamp while
+we still have a tx_hwtstamp_skb pointer.
+
+Unfortunately the driver suffers from a race condition around this. The
+tx_hwtstamp_skb pointer is not set to NULL until after skb_tstamp_tx()
+is called. This function notifies the stack and applications of a new
+timestamp. Even a well behaved application that only sends a new request
+when the first one is finished might be woken up and possibly send
+a packet before we can free the timestamp in the driver again. The
+result is that we needlessly ignore some Tx timestamp requests in this
+corner case.
+
+Fix this by assigning the tx_hwtstamp_skb pointer prior to calling
+skb_tstamp_tx() and use a temporary pointer to hold the timestamped skb
+until that function finishes. This ensures that the application is not
+woken up until the driver is ready to begin timestamping a new packet.
+
+This ensures that well behaved applications do not accidentally race
+with condition to skip Tx timestamps. Obviously an application which
+sends multiple Tx timestamp requests at once will still only timestamp
+one packet at a time. Unfortunately there is nothing we can do about
+this.
+
+Reported-by: David Mirabito <davidm@metamako.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000e/netdev.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -1182,6 +1182,7 @@ static void e1000e_tx_hwtstamp_work(stru
+ struct e1000_hw *hw = &adapter->hw;
+
+ if (er32(TSYNCTXCTL) & E1000_TSYNCTXCTL_VALID) {
++ struct sk_buff *skb = adapter->tx_hwtstamp_skb;
+ struct skb_shared_hwtstamps shhwtstamps;
+ u64 txstmp;
+
+@@ -1190,9 +1191,14 @@ static void e1000e_tx_hwtstamp_work(stru
+
+ e1000e_systim_to_hwtstamp(adapter, &shhwtstamps, txstmp);
+
+- skb_tstamp_tx(adapter->tx_hwtstamp_skb, &shhwtstamps);
+- dev_kfree_skb_any(adapter->tx_hwtstamp_skb);
++ /* Clear the global tx_hwtstamp_skb pointer and force writes
++ * prior to notifying the stack of a Tx timestamp.
++ */
+ adapter->tx_hwtstamp_skb = NULL;
++ wmb(); /* force write prior to skb_tstamp_tx */
++
++ skb_tstamp_tx(skb, &shhwtstamps);
++ dev_kfree_skb_any(skb);
+ } else if (time_after(jiffies, adapter->tx_hwtstamp_start
+ + adapter->tx_timeout_factor * HZ)) {
+ dev_kfree_skb_any(adapter->tx_hwtstamp_skb);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Wed, 31 May 2017 18:50:43 +0300
+Subject: e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+
+[ Upstream commit 833521ebc65b1c3092e5c0d8a97092f98eec595d ]
+
+An error during suspend (e100e_pm_suspend),
+
+[ 429.994338] ACPI : EC: event blocked
+[ 429.994633] e1000e: EEE TX LPI TIMER: 00000011
+[ 430.955451] pci_pm_suspend(): e1000e_pm_suspend+0x0/0x30 [e1000e] returns -2
+[ 430.955454] dpm_run_callback(): pci_pm_suspend+0x0/0x140 returns -2
+[ 430.955458] PM: Device 0000:00:19.0 failed to suspend async: error -2
+[ 430.955581] PM: Some devices failed to suspend, or early wake event detected
+[ 430.957709] ACPI : EC: event unblocked
+
+lead to complete failure:
+
+[ 432.585002] ------------[ cut here ]------------
+[ 432.585013] WARNING: CPU: 3 PID: 8372 at kernel/irq/manage.c:1478 __free_irq+0x9f/0x280
+[ 432.585015] Trying to free already-free IRQ 20
+[ 432.585016] Modules linked in: cdc_ncm usbnet x86_pkg_temp_thermal intel_powerclamp coretemp mii crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep lpc_ich snd_hda_core snd_pcm mei_me mei sdhci_pci sdhci i915 mmc_core e1000e ptp pps_core prime_numbers
+[ 432.585042] CPU: 3 PID: 8372 Comm: kworker/u16:40 Tainted: G U 4.10.0-rc8-CI-Patchwork_3870+ #1
+[ 432.585044] Hardware name: LENOVO 2356GCG/2356GCG, BIOS G7ET31WW (1.13 ) 07/02/2012
+[ 432.585050] Workqueue: events_unbound async_run_entry_fn
+[ 432.585051] Call Trace:
+[ 432.585058] dump_stack+0x67/0x92
+[ 432.585062] __warn+0xc6/0xe0
+[ 432.585065] warn_slowpath_fmt+0x4a/0x50
+[ 432.585070] ? _raw_spin_lock_irqsave+0x49/0x60
+[ 432.585072] __free_irq+0x9f/0x280
+[ 432.585075] free_irq+0x34/0x80
+[ 432.585089] e1000_free_irq+0x65/0x70 [e1000e]
+[ 432.585098] e1000e_pm_freeze+0x7a/0xb0 [e1000e]
+[ 432.585106] e1000e_pm_suspend+0x21/0x30 [e1000e]
+[ 432.585113] pci_pm_suspend+0x71/0x140
+[ 432.585118] dpm_run_callback+0x6f/0x330
+[ 432.585122] ? pci_pm_freeze+0xe0/0xe0
+[ 432.585125] __device_suspend+0xea/0x330
+[ 432.585128] async_suspend+0x1a/0x90
+[ 432.585132] async_run_entry_fn+0x34/0x160
+[ 432.585137] process_one_work+0x1f4/0x6d0
+[ 432.585140] ? process_one_work+0x16e/0x6d0
+[ 432.585143] worker_thread+0x49/0x4a0
+[ 432.585145] kthread+0x107/0x140
+[ 432.585148] ? process_one_work+0x6d0/0x6d0
+[ 432.585150] ? kthread_create_on_node+0x40/0x40
+[ 432.585154] ret_from_fork+0x2e/0x40
+[ 432.585156] ---[ end trace 6712df7f8c4b9124 ]---
+
+The unwind failures stems from commit 2800209994f8 ("e1000e: Refactor PM
+flows"), but it may be a later patch that introduced the non-recoverable
+behaviour.
+
+Fixes: 2800209994f8 ("e1000e: Refactor PM flows")
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99847
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000e/netdev.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -6595,12 +6595,17 @@ static int e1000e_pm_thaw(struct device
+ static int e1000e_pm_suspend(struct device *dev)
+ {
+ struct pci_dev *pdev = to_pci_dev(dev);
++ int rc;
+
+ e1000e_flush_lpic(pdev);
+
+ e1000e_pm_freeze(dev);
+
+- return __e1000_shutdown(pdev, false);
++ rc = __e1000_shutdown(pdev, false);
++ if (rc)
++ e1000e_pm_thaw(dev);
++
++ return rc;
+ }
+
+ static int e1000e_pm_resume(struct device *dev)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 7 Jan 2018 21:54:00 +0100
+Subject: EDAC, mv64x60: Fix an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit 68fa24f9121c04ef146b5158f538c8b32f285be5 ]
+
+We should not call edac_mc_del_mc() if a corresponding call to
+edac_mc_add_mc() has not been performed yet.
+
+So here, we should go to err instead of err2 to branch at the right
+place of the error handling path.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20180107205400.14068-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/edac/mv64x60_edac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/edac/mv64x60_edac.c
++++ b/drivers/edac/mv64x60_edac.c
+@@ -763,7 +763,7 @@ static int mv64x60_mc_err_probe(struct p
+ /* Non-ECC RAM? */
+ printk(KERN_WARNING "%s: No ECC DIMMs discovered\n", __func__);
+ res = -ENODEV;
+- goto err2;
++ goto err;
+ }
+
+ edac_dbg(3, "init mci\n");
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Eryu Guan <eguan@redhat.com>
+Date: Wed, 24 May 2017 18:02:20 -0400
+Subject: ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff()
+
+From: Eryu Guan <eguan@redhat.com>
+
+
+[ Upstream commit 624327f8794704c5066b11a52f9da6a09dce7f9a ]
+
+ext4_find_unwritten_pgoff() is used to search for offset of hole or
+data in page range [index, end] (both inclusive), and the max number
+of pages to search should be at least one, if end == index.
+Otherwise the only page is missed and no hole or data is found,
+which is not correct.
+
+When block size is smaller than page size, this can be demonstrated
+by preallocating a file with size smaller than page size and writing
+data to the last block. E.g. run this xfs_io command on a 1k block
+size ext4 on x86_64 host.
+
+ # xfs_io -fc "falloc 0 3k" -c "pwrite 2k 1k" \
+ -c "seek -d 0" /mnt/ext4/testfile
+ wrote 1024/1024 bytes at offset 2048
+ 1 KiB, 1 ops; 0.0000 sec (42.459 MiB/sec and 43478.2609 ops/sec)
+ Whence Result
+ DATA EOF
+
+Data at offset 2k was missed, and lseek(2) returned ENXIO.
+
+This is unconvered by generic/285 subtest 07 and 08 on ppc64 host,
+where pagesize is 64k. Because a recent change to generic/285
+reduced the preallocated file size to smaller than 64k.
+
+Signed-off-by: Eryu Guan <eguan@redhat.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -460,7 +460,7 @@ static int ext4_find_unwritten_pgoff(str
+ int i, num;
+ unsigned long nr_pages;
+
+- num = min_t(pgoff_t, end - index, PAGEVEC_SIZE);
++ num = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1;
+ nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index,
+ (pgoff_t)num);
+ if (nr_pages == 0)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Date: Sun, 21 May 2017 22:35:23 -0400
+Subject: ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+
+[ Upstream commit 9651e6b2e20648d04d5e1fe6479a3056047e8781 ]
+
+I've got another report about breaking ext4 by ENOMEM error returned from
+ext4_mb_load_buddy() caused by memory shortage in memory cgroup.
+This time inside ext4_discard_preallocations().
+
+This patch replaces ext4_error() with ext4_warning() where errors returned
+from ext4_mb_load_buddy() are not fatal and handled by caller:
+* ext4_mb_discard_group_preallocations() - called before generating ENOSPC,
+ we'll try to discard other group or return ENOSPC into user-space.
+* ext4_trim_all_free() - just stop trimming and return ENOMEM from ioctl.
+
+Some callers cannot handle errors, thus __GFP_NOFAIL is used for them:
+* ext4_discard_preallocations()
+* ext4_mb_discard_lg_preallocations()
+
+Fixes: adb7ef600cc9 ("ext4: use __GFP_NOFAIL in ext4_free_blocks()")
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/mballoc.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -3874,7 +3874,8 @@ ext4_mb_discard_group_preallocations(str
+
+ err = ext4_mb_load_buddy(sb, group, &e4b);
+ if (err) {
+- ext4_error(sb, "Error loading buddy information for %u", group);
++ ext4_warning(sb, "Error %d loading buddy information for %u",
++ err, group);
+ put_bh(bitmap_bh);
+ return 0;
+ }
+@@ -4031,10 +4032,11 @@ repeat:
+ BUG_ON(pa->pa_type != MB_INODE_PA);
+ group = ext4_get_group_number(sb, pa->pa_pstart);
+
+- err = ext4_mb_load_buddy(sb, group, &e4b);
++ err = ext4_mb_load_buddy_gfp(sb, group, &e4b,
++ GFP_NOFS|__GFP_NOFAIL);
+ if (err) {
+- ext4_error(sb, "Error loading buddy information for %u",
+- group);
++ ext4_error(sb, "Error %d loading buddy information for %u",
++ err, group);
+ continue;
+ }
+
+@@ -4290,11 +4292,14 @@ ext4_mb_discard_lg_preallocations(struct
+ spin_unlock(&lg->lg_prealloc_lock);
+
+ list_for_each_entry_safe(pa, tmp, &discard_list, u.pa_tmp_list) {
++ int err;
+
+ group = ext4_get_group_number(sb, pa->pa_pstart);
+- if (ext4_mb_load_buddy(sb, group, &e4b)) {
+- ext4_error(sb, "Error loading buddy information for %u",
+- group);
++ err = ext4_mb_load_buddy_gfp(sb, group, &e4b,
++ GFP_NOFS|__GFP_NOFAIL);
++ if (err) {
++ ext4_error(sb, "Error %d loading buddy information for %u",
++ err, group);
+ continue;
+ }
+ ext4_lock_group(sb, group);
+@@ -5116,8 +5121,8 @@ ext4_trim_all_free(struct super_block *s
+
+ ret = ext4_mb_load_buddy(sb, group, &e4b);
+ if (ret) {
+- ext4_error(sb, "Error in loading buddy "
+- "information for %u", group);
++ ext4_warning(sb, "Error %d loading buddy information for %u",
++ ret, group);
+ return ret;
+ }
+ bitmap = e4b.bd_bitmap;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: James Wang <jnwang@suse.com>
+Date: Thu, 8 Jun 2017 14:52:51 +0800
+Subject: Fix loop device flush before configure v3
+
+From: James Wang <jnwang@suse.com>
+
+
+[ Upstream commit 6460495709aeb651896bc8e5c134b2e4ca7d34a8 ]
+
+While installing SLES-12 (based on v4.4), I found that the installer
+will stall for 60+ seconds during LVM disk scan. The root cause was
+determined to be the removal of a bound device check in loop_flush()
+by commit b5dd2f6047ca ("block: loop: improve performance via blk-mq").
+
+Restoring this check, examining ->lo_state as set by loop_set_fd()
+eliminates the bad behavior.
+
+Test method:
+modprobe loop max_loop=64
+dd if=/dev/zero of=disk bs=512 count=200K
+for((i=0;i<4;i++))do losetup -f disk; done
+mkfs.ext4 -F /dev/loop0
+for((i=0;i<4;i++))do mkdir t$i; mount /dev/loop$i t$i;done
+for f in `ls /dev/loop[0-9]*|sort`; do \
+ echo $f; dd if=$f of=/dev/null bs=512 count=1; \
+ done
+
+Test output: stock patched
+/dev/loop0 18.1217e-05 8.3842e-05
+/dev/loop1 6.1114e-05 0.000147979
+/dev/loop10 0.414701 0.000116564
+/dev/loop11 0.7474 6.7942e-05
+/dev/loop12 0.747986 8.9082e-05
+/dev/loop13 0.746532 7.4799e-05
+/dev/loop14 0.480041 9.3926e-05
+/dev/loop15 1.26453 7.2522e-05
+
+Note that from loop10 onward, the device is not mounted, yet the
+stock kernel consumes several orders of magnitude more wall time
+than it does for a mounted device.
+(Thanks for Mike Galbraith <efault@gmx.de>, give a changelog review.)
+
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: James Wang <jnwang@suse.com>
+Fixes: b5dd2f6047ca ("block: loop: improve performance via blk-mq")
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/loop.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -623,6 +623,9 @@ static int loop_switch(struct loop_devic
+ */
+ static int loop_flush(struct loop_device *lo)
+ {
++ /* loop not yet configured, no running thread, nothing to flush */
++ if (lo->lo_state != Lo_bound)
++ return 0;
+ return loop_switch(lo, NULL);
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Michael Schmitz <schmitzmic@gmail.com>
+Date: Sun, 30 Apr 2017 19:49:21 +1200
+Subject: fix race in drivers/char/random.c:get_reg()
+
+From: Michael Schmitz <schmitzmic@gmail.com>
+
+
+[ Upstream commit 9dfa7bba35ac08a63565d58c454dccb7e1bb0a08 ]
+
+get_reg() can be reentered on architectures with prioritized interrupts
+(m68k in this case), causing f->reg_index to be incremented after the
+range check. Out of bounds memory access past the pt_regs struct results.
+This will go mostly undetected unless access is beyond end of memory.
+
+Prevent the race by disabling interrupts in get_reg().
+
+Tested on m68k (Atari Falcon, and ARAnyM emulator).
+
+Kudos to Geert Uytterhoeven for helping to trace this race.
+
+Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/random.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -886,12 +886,16 @@ static void add_interrupt_bench(cycles_t
+ static __u32 get_reg(struct fast_pool *f, struct pt_regs *regs)
+ {
+ __u32 *ptr = (__u32 *) regs;
++ unsigned long flags;
+
+ if (regs == NULL)
+ return 0;
++ local_irq_save(flags);
+ if (f->reg_idx >= sizeof(struct pt_regs) / sizeof(__u32))
+ f->reg_idx = 0;
+- return *(ptr + f->reg_idx++);
++ ptr += f->reg_idx++;
++ local_irq_restore(flags);
++ return *ptr;
+ }
+
+ void add_interrupt_randomness(int irq, int irq_flags)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Date: Wed, 31 May 2017 22:21:03 +0200
+Subject: Fix serial console on SNI RM400 machines
+
+From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+
+
+[ Upstream commit e279e6d98e0cf2c2fe008b3c29042b92f0e17b1d ]
+
+sccnxp driver doesn't get the correct uart clock rate, if CONFIG_HAVE_CLOCK
+is disabled. Correct usage of clk API to make it work with/without it.
+
+Fixes: 90efa75f7ab0 (serial: sccnxp: Using CLK API for getting UART clock)
+
+Suggested-by: Russell King - ARM Linux <linux@armlinux.org.uk>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/sccnxp.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/tty/serial/sccnxp.c
++++ b/drivers/tty/serial/sccnxp.c
+@@ -884,14 +884,19 @@ static int sccnxp_probe(struct platform_
+
+ clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(clk)) {
+- if (PTR_ERR(clk) == -EPROBE_DEFER) {
+- ret = -EPROBE_DEFER;
++ ret = PTR_ERR(clk);
++ if (ret == -EPROBE_DEFER)
+ goto err_out;
+- }
++ uartclk = 0;
++ } else {
++ clk_prepare_enable(clk);
++ uartclk = clk_get_rate(clk);
++ }
++
++ if (!uartclk) {
+ dev_notice(&pdev->dev, "Using default clock frequency\n");
+ uartclk = s->chip->freq_std;
+- } else
+- uartclk = clk_get_rate(clk);
++ }
+
+ /* Check input frequency */
+ if ((uartclk < s->chip->freq_min) || (uartclk > s->chip->freq_max)) {
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Thu, 4 Jan 2018 22:31:11 +0100
+Subject: gpio: label descriptors using the device name
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+
+[ Upstream commit 24e78079bf2250874e33da2e7cfbb6db72d3caf4 ]
+
+Some GPIO lines appear named "?" in the lsgpio dump due to their
+requesting drivers not passing a reasonable label.
+
+Most typically this happens if a device tree node just defines
+gpios = <...> and not foo-gpios = <...>, the former gets named
+"foo" and the latter gets named "?".
+
+However the struct device passed in is always valid so let's
+just label the GPIO with dev_name() on the device if no proper
+label was passed.
+
+Cc: Reported-by: Jason Kridner <jkridner@beagleboard.org>
+Reported-by: Jason Kridner <jkridner@beagleboard.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpiolib.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2145,7 +2145,8 @@ struct gpio_desc *__must_check gpiod_get
+ return desc;
+ }
+
+- status = gpiod_request(desc, con_id);
++ /* If a connection label was passed use that, else use the device name as label */
++ status = gpiod_request(desc, con_id ? con_id : dev_name(dev));
+ if (status < 0)
+ return ERR_PTR(status);
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Firo Yang <firogm@gmail.com>
+Date: Fri, 26 May 2017 22:37:38 +0800
+Subject: hdlcdrv: Fix divide by zero in hdlcdrv_ioctl
+
+From: Firo Yang <firogm@gmail.com>
+
+
+[ Upstream commit fb3ce90b7d7761b6f7f28f0ff5c456ef6b5229a1 ]
+
+syszkaller fuzzer triggered a divide by zero, when set calibration
+through ioctl().
+
+To fix it, test 'bitrate' if it is negative or 0, just return -EINVAL.
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Firo Yang <firogm@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/hamradio/hdlcdrv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/hamradio/hdlcdrv.c
++++ b/drivers/net/hamradio/hdlcdrv.c
+@@ -574,6 +574,8 @@ static int hdlcdrv_ioctl(struct net_devi
+ case HDLCDRVCTL_CALIBRATE:
+ if(!capable(CAP_SYS_RAWIO))
+ return -EPERM;
++ if (s->par.bitrate <= 0)
++ return -EINVAL;
+ if (bi.data.calibrate > INT_MAX / s->par.bitrate)
+ return -EINVAL;
+ s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Maciej Purski <m.purski@samsung.com>
+Date: Wed, 22 Nov 2017 16:32:15 +0100
+Subject: hwmon: (ina2xx) Make calibration register value fixed
+
+From: Maciej Purski <m.purski@samsung.com>
+
+
+[ Upstream commit 5d389b125186cf254ad5b8015763ac07c151aea4 ]
+
+Calibration register is used for calculating current register in
+hardware according to datasheet:
+current = shunt_volt * calib_register / 2048 (ina 226)
+current = shunt_volt * calib_register / 4096 (ina 219)
+
+Fix calib_register value to 2048 for ina226 and 4096 for ina 219 in
+order to avoid truncation error and provide best precision allowed
+by shunt_voltage measurement. Make current scale value follow changes
+of shunt_resistor from sysfs as calib_register value is now fixed.
+
+Power_lsb value should also follow shunt_resistor changes as stated in
+datasheet:
+power_lsb = 25 * current_lsb (ina 226)
+power_lsb = 20 * current_lsb (ina 219)
+
+Signed-off-by: Maciej Purski <m.purski@samsung.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/ina2xx.c | 87 ++++++++++++++++++++++++++++---------------------
+ 1 file changed, 50 insertions(+), 37 deletions(-)
+
+--- a/drivers/hwmon/ina2xx.c
++++ b/drivers/hwmon/ina2xx.c
+@@ -94,18 +94,20 @@ enum ina2xx_ids { ina219, ina226 };
+
+ struct ina2xx_config {
+ u16 config_default;
+- int calibration_factor;
++ int calibration_value;
+ int registers;
+ int shunt_div;
+ int bus_voltage_shift;
+ int bus_voltage_lsb; /* uV */
+- int power_lsb; /* uW */
++ int power_lsb_factor;
+ };
+
+ struct ina2xx_data {
+ const struct ina2xx_config *config;
+
+ long rshunt;
++ long current_lsb_uA;
++ long power_lsb_uW;
+ struct mutex config_lock;
+ struct regmap *regmap;
+
+@@ -115,21 +117,21 @@ struct ina2xx_data {
+ static const struct ina2xx_config ina2xx_config[] = {
+ [ina219] = {
+ .config_default = INA219_CONFIG_DEFAULT,
+- .calibration_factor = 40960000,
++ .calibration_value = 4096,
+ .registers = INA219_REGISTERS,
+ .shunt_div = 100,
+ .bus_voltage_shift = 3,
+ .bus_voltage_lsb = 4000,
+- .power_lsb = 20000,
++ .power_lsb_factor = 20,
+ },
+ [ina226] = {
+ .config_default = INA226_CONFIG_DEFAULT,
+- .calibration_factor = 5120000,
++ .calibration_value = 2048,
+ .registers = INA226_REGISTERS,
+ .shunt_div = 400,
+ .bus_voltage_shift = 0,
+ .bus_voltage_lsb = 1250,
+- .power_lsb = 25000,
++ .power_lsb_factor = 25,
+ },
+ };
+
+@@ -168,12 +170,16 @@ static u16 ina226_interval_to_reg(int in
+ return INA226_SHIFT_AVG(avg_bits);
+ }
+
++/*
++ * Calibration register is set to the best value, which eliminates
++ * truncation errors on calculating current register in hardware.
++ * According to datasheet (eq. 3) the best values are 2048 for
++ * ina226 and 4096 for ina219. They are hardcoded as calibration_value.
++ */
+ static int ina2xx_calibrate(struct ina2xx_data *data)
+ {
+- u16 val = DIV_ROUND_CLOSEST(data->config->calibration_factor,
+- data->rshunt);
+-
+- return regmap_write(data->regmap, INA2XX_CALIBRATION, val);
++ return regmap_write(data->regmap, INA2XX_CALIBRATION,
++ data->config->calibration_value);
+ }
+
+ /*
+@@ -186,10 +192,6 @@ static int ina2xx_init(struct ina2xx_dat
+ if (ret < 0)
+ return ret;
+
+- /*
+- * Set current LSB to 1mA, shunt is in uOhms
+- * (equation 13 in datasheet).
+- */
+ return ina2xx_calibrate(data);
+ }
+
+@@ -267,15 +269,15 @@ static int ina2xx_get_value(struct ina2x
+ val = DIV_ROUND_CLOSEST(val, 1000);
+ break;
+ case INA2XX_POWER:
+- val = regval * data->config->power_lsb;
++ val = regval * data->power_lsb_uW;
+ break;
+ case INA2XX_CURRENT:
+- /* signed register, LSB=1mA (selected), in mA */
+- val = (s16)regval;
++ /* signed register, result in mA */
++ val = regval * data->current_lsb_uA;
++ val = DIV_ROUND_CLOSEST(val, 1000);
+ break;
+ case INA2XX_CALIBRATION:
+- val = DIV_ROUND_CLOSEST(data->config->calibration_factor,
+- regval);
++ val = regval;
+ break;
+ default:
+ /* programmer goofed */
+@@ -303,9 +305,32 @@ static ssize_t ina2xx_show_value(struct
+ ina2xx_get_value(data, attr->index, regval));
+ }
+
+-static ssize_t ina2xx_set_shunt(struct device *dev,
+- struct device_attribute *da,
+- const char *buf, size_t count)
++/*
++ * In order to keep calibration register value fixed, the product
++ * of current_lsb and shunt_resistor should also be fixed and equal
++ * to shunt_voltage_lsb = 1 / shunt_div multiplied by 10^9 in order
++ * to keep the scale.
++ */
++static int ina2xx_set_shunt(struct ina2xx_data *data, long val)
++{
++ unsigned int dividend = DIV_ROUND_CLOSEST(1000000000,
++ data->config->shunt_div);
++ if (val <= 0 || val > dividend)
++ return -EINVAL;
++
++ mutex_lock(&data->config_lock);
++ data->rshunt = val;
++ data->current_lsb_uA = DIV_ROUND_CLOSEST(dividend, val);
++ data->power_lsb_uW = data->config->power_lsb_factor *
++ data->current_lsb_uA;
++ mutex_unlock(&data->config_lock);
++
++ return 0;
++}
++
++static ssize_t ina2xx_store_shunt(struct device *dev,
++ struct device_attribute *da,
++ const char *buf, size_t count)
+ {
+ unsigned long val;
+ int status;
+@@ -315,18 +340,9 @@ static ssize_t ina2xx_set_shunt(struct d
+ if (status < 0)
+ return status;
+
+- if (val == 0 ||
+- /* Values greater than the calibration factor make no sense. */
+- val > data->config->calibration_factor)
+- return -EINVAL;
+-
+- mutex_lock(&data->config_lock);
+- data->rshunt = val;
+- status = ina2xx_calibrate(data);
+- mutex_unlock(&data->config_lock);
++ status = ina2xx_set_shunt(data, val);
+ if (status < 0)
+ return status;
+-
+ return count;
+ }
+
+@@ -386,7 +402,7 @@ static SENSOR_DEVICE_ATTR(power1_input,
+
+ /* shunt resistance */
+ static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR,
+- ina2xx_show_value, ina2xx_set_shunt,
++ ina2xx_show_value, ina2xx_store_shunt,
+ INA2XX_CALIBRATION);
+
+ /* update interval (ina226 only) */
+@@ -441,10 +457,7 @@ static int ina2xx_probe(struct i2c_clien
+ val = INA2XX_RSHUNT_DEFAULT;
+ }
+
+- if (val <= 0 || val > data->config->calibration_factor)
+- return -ENODEV;
+-
+- data->rshunt = val;
++ ina2xx_set_shunt(data, val);
+
+ ina2xx_regmap_config.max_register = data->config->registers;
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Thu, 4 May 2017 15:50:53 -0700
+Subject: IB/srpt: Fix abort handling
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+
+[ Upstream commit 55d694275f41a1c0eef4ef49044ff29bc3999490 ]
+
+Let the target core check the CMD_T_ABORTED flag instead of the SRP
+target driver. Hence remove the transport_check_aborted_status()
+call. Since state == SRPT_STATE_CMD_RSP_SENT is something that really
+should not happen, do not try to recover if srpt_queue_response() is
+called for an I/O context that is in that state. This patch is a bug
+fix because the srpt_abort_cmd() call is misplaced - if that function
+is called from srpt_queue_response() it should either be called
+before the command state is changed or after the response has been
+sent.
+
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Cc: Doug Ledford <dledford@redhat.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Andy Grover <agrover@redhat.com>
+Cc: David Disseldorp <ddiss@suse.de>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2974,12 +2974,8 @@ static void srpt_queue_response(struct s
+ }
+ spin_unlock_irqrestore(&ioctx->spinlock, flags);
+
+- if (unlikely(transport_check_aborted_status(&ioctx->cmd, false)
+- || WARN_ON_ONCE(state == SRPT_STATE_CMD_RSP_SENT))) {
+- atomic_inc(&ch->req_lim_delta);
+- srpt_abort_cmd(ioctx);
++ if (unlikely(WARN_ON_ONCE(state == SRPT_STATE_CMD_RSP_SENT)))
+ return;
+- }
+
+ dir = ioctx->cmd.data_direction;
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+Date: Fri, 19 May 2017 17:48:00 +0300
+Subject: iio: hi8435: avoid garbage event at first enable
+
+From: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+
+
+[ Upstream commit ee19ac340c5fdfd89c6348be4563453c61ab54a9 ]
+
+Currently, driver generates events for channels if new reading differs
+from previous one. This "previous value" is initialized to zero, which
+results into event if value is constant-one.
+
+Fix that by initializing "previous value" by reading at event enable
+time.
+
+This provides reliable sequence for userspace:
+- enable event,
+- AFTER THAT read current value,
+- AFTER THAT each event will correspond to change.
+
+Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/hi8435.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/adc/hi8435.c
++++ b/drivers/iio/adc/hi8435.c
+@@ -121,10 +121,21 @@ static int hi8435_write_event_config(str
+ enum iio_event_direction dir, int state)
+ {
+ struct hi8435_priv *priv = iio_priv(idev);
++ int ret;
++ u32 tmp;
++
++ if (state) {
++ ret = hi8435_readl(priv, HI8435_SO31_0_REG, &tmp);
++ if (ret < 0)
++ return ret;
++ if (tmp & BIT(chan->channel))
++ priv->event_prev_val |= BIT(chan->channel);
++ else
++ priv->event_prev_val &= ~BIT(chan->channel);
+
+- priv->event_scan_mask &= ~BIT(chan->channel);
+- if (state)
+ priv->event_scan_mask |= BIT(chan->channel);
++ } else
++ priv->event_scan_mask &= ~BIT(chan->channel);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+Date: Fri, 19 May 2017 17:48:02 +0300
+Subject: iio: hi8435: cleanup reset gpio
+
+From: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+
+
+[ Upstream commit 61305664a542f874283f74bf0b27ddb31f5045d7 ]
+
+Reset GPIO is active low.
+
+Currently driver uses gpiod_set_value(1) to clean reset, which depends
+on device tree to contain GPIO_ACTIVE_HIGH - that does not match reality.
+
+This fixes driver to use _raw version of gpiod_set_value() to enforce
+active-low semantics despite of what's written in device tree. Allowing
+device tree to override that only opens possibility for errors and does
+not add any value.
+
+Additionally, use _cansleep version to make things work with i2c-gpio
+and other sleeping gpio drivers.
+
+Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/hi8435.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/iio/adc/hi8435.c
++++ b/drivers/iio/adc/hi8435.c
+@@ -453,13 +453,15 @@ static int hi8435_probe(struct spi_devic
+ priv->spi = spi;
+
+ reset_gpio = devm_gpiod_get(&spi->dev, NULL, GPIOD_OUT_LOW);
+- if (IS_ERR(reset_gpio)) {
+- /* chip s/w reset if h/w reset failed */
++ if (!IS_ERR(reset_gpio)) {
++ /* need >=100ns low pulse to reset chip */
++ gpiod_set_raw_value_cansleep(reset_gpio, 0);
++ udelay(1);
++ gpiod_set_raw_value_cansleep(reset_gpio, 1);
++ } else {
++ /* s/w reset chip if h/w reset is not available */
+ hi8435_writeb(priv, HI8435_CTRL_REG, HI8435_CTRL_SRST);
+ hi8435_writeb(priv, HI8435_CTRL_REG, 0);
+- } else {
+- udelay(5);
+- gpiod_set_value(reset_gpio, 1);
+ }
+
+ spi_set_drvdata(spi, idev);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+Date: Tue, 6 Jun 2017 22:51:24 +0200
+Subject: iio: magnetometer: st_magn_spi: fix spi_device_id table
+
+From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+
+
+[ Upstream commit c83761ff0aac954aa368c623bb0f0d1a3214e834 ]
+
+Remove LSM303DLHC, LSM303DLM from st_magn_id_table since LSM303DL series
+does not support spi interface
+
+Fixes: 872e79add756 (iio: magn: Add STMicroelectronics magn driver)
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@st.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/magnetometer/st_magn_spi.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/iio/magnetometer/st_magn_spi.c
++++ b/drivers/iio/magnetometer/st_magn_spi.c
+@@ -48,8 +48,6 @@ static int st_magn_spi_remove(struct spi
+ }
+
+ static const struct spi_device_id st_magn_id_table[] = {
+- { LSM303DLHC_MAGN_DEV_NAME },
+- { LSM303DLM_MAGN_DEV_NAME },
+ { LIS3MDL_MAGN_DEV_NAME },
+ { LSM303AGR_MAGN_DEV_NAME },
+ {},
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Fri, 19 Dec 2014 12:57:49 -0800
+Subject: Input: elan_i2c - check if device is there before really probing
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+
+[ Upstream commit c5928551fd41b2eecdad78fa2be2a4a13ed5fde9 ]
+
+Before trying to properly initialize the touchpad and generate bunch of
+errors, let's first see it there is anything at the given address. If we
+get error, fail silently with -ENXIO.
+
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/mouse/elan_i2c_core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1082,6 +1082,13 @@ static int elan_probe(struct i2c_client
+ return error;
+ }
+
++ /* Make sure there is something at this address */
++ error = i2c_smbus_read_byte(client);
++ if (error < 0) {
++ dev_dbg(&client->dev, "nothing at this address: %d\n", error);
++ return -ENXIO;
++ }
++
+ /* Initialize the touchpad. */
+ error = elan_initialize(data);
+ if (error)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: KT Liao <kt.liao@emc.com.tw>
+Date: Thu, 25 May 2017 10:06:21 -0700
+Subject: Input: elan_i2c - clear INT before resetting controller
+
+From: KT Liao <kt.liao@emc.com.tw>
+
+
+[ Upstream commit 4b3c7dbbfff0673e8a89575414b864d8b001d3bb ]
+
+Some old touchpad FWs need to have interrupt cleared before issuing reset
+command after updating firmware. We clear interrupt by attempting to read
+full report from the controller, and discarding any data read.
+
+Signed-off-by: KT Liao <kt.liao@emc.com.tw>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/mouse/elan_i2c_i2c.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/mouse/elan_i2c_i2c.c
++++ b/drivers/input/mouse/elan_i2c_i2c.c
+@@ -557,7 +557,14 @@ static int elan_i2c_finish_fw_update(str
+ long ret;
+ int error;
+ int len;
+- u8 buffer[ETP_I2C_INF_LENGTH];
++ u8 buffer[ETP_I2C_REPORT_LEN];
++
++ len = i2c_master_recv(client, buffer, ETP_I2C_REPORT_LEN);
++ if (len != ETP_I2C_REPORT_LEN) {
++ error = len < 0 ? len : -EIO;
++ dev_warn(dev, "failed to read I2C data after FW WDT reset: %d (%d)\n",
++ error, len);
++ }
+
+ reinit_completion(completion);
+ enable_irq(client->irq);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: KT Liao <kt.liao@emc.com.tw>
+Date: Mon, 12 Dec 2016 11:03:42 -0800
+Subject: Input: elantech - force relative mode on a certain module
+
+From: KT Liao <kt.liao@emc.com.tw>
+
+
+[ Upstream commit d899520b0431e70279bfb5066ecb6dc91d0b7072 ]
+
+One of Elan modules with sample version is 0x74 and hw_version is 0x03 has
+a bug in absolute mode implementation, so let it run in default PS/2
+relative mode.
+
+Signed-off-by: KT Liao <kt.liao@emc.com.tw>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/mouse/elantech.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1715,6 +1715,17 @@ int elantech_init(struct psmouse *psmous
+ etd->samples[0], etd->samples[1], etd->samples[2]);
+ }
+
++ if (etd->samples[1] == 0x74 && etd->hw_version == 0x03) {
++ /*
++ * This module has a bug which makes absolute mode
++ * unusable, so let's abort so we'll be using standard
++ * PS/2 protocol.
++ */
++ psmouse_info(psmouse,
++ "absolute mode broken, forcing standard PS/2 protocol\n");
++ goto init_fail;
++ }
++
+ if (elantech_set_absolute_mode(psmouse)) {
+ psmouse_err(psmouse,
+ "failed to put touchpad into absolute mode.\n");
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 5 May 2017 08:33:24 +0300
+Subject: ipmi_ssif: unlock on allocation failure
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit cf9806f32ef63b745f2486e0dbb2ac21f4ca44f0 ]
+
+We should unlock and re-enable IRQs if this allocation fails.
+
+Fixes: 259307074bfc ("ipmi: Add SMBus interface driver (SSIF) ")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/ipmi/ipmi_ssif.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -409,6 +409,7 @@ static void start_event_fetch(struct ssi
+ msg = ipmi_alloc_smi_msg();
+ if (!msg) {
+ ssif_info->ssif_state = SSIF_NORMAL;
++ ipmi_ssif_unlock_cond(ssif_info, flags);
+ return;
+ }
+
+@@ -431,6 +432,7 @@ static void start_recv_msg_fetch(struct
+ msg = ipmi_alloc_smi_msg();
+ if (!msg) {
+ ssif_info->ssif_state = SSIF_NORMAL;
++ ipmi_ssif_unlock_cond(ssif_info, flags);
+ return;
+ }
+
--- /dev/null
+From 3f29770723fe498a5c5f57c3a31a996ebdde03e1 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Sun, 4 Jun 2017 04:16:23 +0200
+Subject: ipsec: check return value of skb_to_sgvec always
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit 3f29770723fe498a5c5f57c3a31a996ebdde03e1 upstream.
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[natechancellor: Adjusted context due to lack of fca11ebde3f0]
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ah4.c | 8 ++++++--
+ net/ipv4/esp4.c | 13 ++++++++-----
+ net/ipv6/ah6.c | 8 ++++++--
+ net/ipv6/esp6.c | 12 ++++++++----
+ 4 files changed, 28 insertions(+), 13 deletions(-)
+
+--- a/net/ipv4/ah4.c
++++ b/net/ipv4/ah4.c
+@@ -220,7 +220,9 @@ static int ah_output(struct xfrm_state *
+ ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
+
+ sg_init_table(sg, nfrags + sglists);
+- skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ if (unlikely(err < 0))
++ goto out_free;
+
+ if (x->props.flags & XFRM_STATE_ESN) {
+ /* Attach seqhi sg right after packet payload */
+@@ -393,7 +395,9 @@ static int ah_input(struct xfrm_state *x
+ skb_push(skb, ihl);
+
+ sg_init_table(sg, nfrags + sglists);
+- skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ if (unlikely(err < 0))
++ goto out_free;
+
+ if (x->props.flags & XFRM_STATE_ESN) {
+ /* Attach seqhi sg right after packet payload */
+--- a/net/ipv4/esp4.c
++++ b/net/ipv4/esp4.c
+@@ -268,10 +268,11 @@ static int esp_output(struct xfrm_state
+ esph->spi = x->id.spi;
+
+ sg_init_table(sg, nfrags);
+- skb_to_sgvec(skb, sg,
+- (unsigned char *)esph - skb->data,
+- assoclen + ivlen + clen + alen);
+-
++ err = skb_to_sgvec(skb, sg,
++ (unsigned char *)esph - skb->data,
++ assoclen + ivlen + clen + alen);
++ if (unlikely(err < 0))
++ goto error;
+ aead_request_set_crypt(req, sg, sg, ivlen + clen, iv);
+ aead_request_set_ad(req, assoclen);
+
+@@ -481,7 +482,9 @@ static int esp_input(struct xfrm_state *
+ }
+
+ sg_init_table(sg, nfrags);
+- skb_to_sgvec(skb, sg, 0, skb->len);
++ err = skb_to_sgvec(skb, sg, 0, skb->len);
++ if (unlikely(err < 0))
++ goto out;
+
+ aead_request_set_crypt(req, sg, sg, elen + ivlen, iv);
+ aead_request_set_ad(req, assoclen);
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -423,7 +423,9 @@ static int ah6_output(struct xfrm_state
+ ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
+
+ sg_init_table(sg, nfrags + sglists);
+- skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ if (unlikely(err < 0))
++ goto out_free;
+
+ if (x->props.flags & XFRM_STATE_ESN) {
+ /* Attach seqhi sg right after packet payload */
+@@ -603,7 +605,9 @@ static int ah6_input(struct xfrm_state *
+ ip6h->hop_limit = 0;
+
+ sg_init_table(sg, nfrags + sglists);
+- skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ if (unlikely(err < 0))
++ goto out_free;
+
+ if (x->props.flags & XFRM_STATE_ESN) {
+ /* Attach seqhi sg right after packet payload */
+--- a/net/ipv6/esp6.c
++++ b/net/ipv6/esp6.c
+@@ -248,9 +248,11 @@ static int esp6_output(struct xfrm_state
+ esph->spi = x->id.spi;
+
+ sg_init_table(sg, nfrags);
+- skb_to_sgvec(skb, sg,
+- (unsigned char *)esph - skb->data,
+- assoclen + ivlen + clen + alen);
++ err = skb_to_sgvec(skb, sg,
++ (unsigned char *)esph - skb->data,
++ assoclen + ivlen + clen + alen);
++ if (unlikely(err < 0))
++ goto error;
+
+ aead_request_set_crypt(req, sg, sg, ivlen + clen, iv);
+ aead_request_set_ad(req, assoclen);
+@@ -423,7 +425,9 @@ static int esp6_input(struct xfrm_state
+ }
+
+ sg_init_table(sg, nfrags);
+- skb_to_sgvec(skb, sg, 0, skb->len);
++ ret = skb_to_sgvec(skb, sg, 0, skb->len);
++ if (unlikely(ret < 0))
++ goto out;
+
+ aead_request_set_crypt(req, sg, sg, elen + ivlen, iv);
+ aead_request_set_ad(req, assoclen);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Mahesh Bandewar <maheshb@google.com>
+Date: Fri, 12 May 2017 17:03:39 -0700
+Subject: ipv6: avoid dad-failures for addresses with NODAD
+
+From: Mahesh Bandewar <maheshb@google.com>
+
+
+[ Upstream commit 66eb9f86e50547ec2a8ff7a75997066a74ef584b ]
+
+Every address gets added with TENTATIVE flag even for the addresses with
+IFA_F_NODAD flag and dad-work is scheduled for them. During this DAD process
+we realize it's an address with NODAD and complete the process without
+sending any probe. However the TENTATIVE flags stays on the
+address for sometime enough to cause misinterpretation when we receive a NS.
+While processing NS, if the address has TENTATIVE flag, we mark it DADFAILED
+and endup with an address that was originally configured as NODAD with
+DADFAILED.
+
+We can't avoid scheduling dad_work for addresses with NODAD but we can
+avoid adding TENTATIVE flag to avoid this racy situation.
+
+Signed-off-by: Mahesh Bandewar <maheshb@google.com>
+Acked-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/addrconf.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -957,7 +957,10 @@ ipv6_add_addr(struct inet6_dev *idev, co
+ INIT_HLIST_NODE(&ifa->addr_lst);
+ ifa->scope = scope;
+ ifa->prefix_len = pfxlen;
+- ifa->flags = flags | IFA_F_TENTATIVE;
++ ifa->flags = flags;
++ /* No need to add the TENTATIVE flag for addresses with NODAD */
++ if (!(flags & IFA_F_NODAD))
++ ifa->flags |= IFA_F_TENTATIVE;
+ ifa->valid_lft = valid_lft;
+ ifa->prefered_lft = prefered_lft;
+ ifa->cstamp = ifa->tstamp = jiffies;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: "Jan H. Schönherr" <jschoenh@amazon.de>
+Date: Sat, 20 May 2017 13:22:56 +0200
+Subject: KVM: nVMX: Fix handling of lmsw instruction
+
+From: "Jan H. Schönherr" <jschoenh@amazon.de>
+
+
+[ Upstream commit e1d39b17e044e8ae819827810d87d809ba5f58c0 ]
+
+The decision whether or not to exit from L2 to L1 on an lmsw instruction is
+based on bogus values: instead of using the information encoded within the
+exit qualification, it uses the data also used for the mov-to-cr
+instruction, which boils down to using whatever is in %eax at that point.
+
+Use the correct values instead.
+
+Without this fix, an L1 may not get notified when a 32-bit Linux L2
+switches its secondary CPUs to protected mode; the L1 is only notified on
+the next modification of CR0. This short time window poses a problem, when
+there is some other reason to exit to L1 in between. Then, L2 will be
+resumed in real mode and chaos ensues.
+
+Signed-off-by: Jan H. Schönherr <jschoenh@amazon.de>
+Reviewed-by: Wanpeng Li <wanpeng.li@hotmail.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/vmx.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -7657,11 +7657,13 @@ static bool nested_vmx_exit_handled_cr(s
+ {
+ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+ int cr = exit_qualification & 15;
+- int reg = (exit_qualification >> 8) & 15;
+- unsigned long val = kvm_register_readl(vcpu, reg);
++ int reg;
++ unsigned long val;
+
+ switch ((exit_qualification >> 4) & 3) {
+ case 0: /* mov to cr */
++ reg = (exit_qualification >> 8) & 15;
++ val = kvm_register_readl(vcpu, reg);
+ switch (cr) {
+ case 0:
+ if (vmcs12->cr0_guest_host_mask &
+@@ -7716,6 +7718,7 @@ static bool nested_vmx_exit_handled_cr(s
+ * lmsw can change bits 1..3 of cr0, and only set bit 0 of
+ * cr0. Other attempted changes are ignored, with no exit.
+ */
++ val = (exit_qualification >> LMSW_SOURCE_DATA_SHIFT) & 0x0f;
+ if (vmcs12->cr0_guest_host_mask & 0xe &
+ (val ^ vmcs12->cr0_read_shadow))
+ return true;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Thu, 11 May 2017 11:33:30 +1000
+Subject: KVM: PPC: Book3S PR: Check copy_to/from_user return values
+
+From: Paul Mackerras <paulus@ozlabs.org>
+
+
+[ Upstream commit 67325e988faea735d663799b6d152b5f4254093c ]
+
+The PR KVM implementation of the PAPR HPT hypercalls (H_ENTER etc.)
+access an image of the HPT in userspace memory using copy_from_user
+and copy_to_user. Recently, the declarations of those functions were
+annotated to indicate that the return value must be checked. Since
+this code doesn't currently check the return value, this causes
+compile warnings like the ones shown below, and since on PPC the
+default is to compile arch/powerpc with -Werror, this causes the
+build to fail.
+
+To fix this, we check the return values, and if non-zero, fail the
+hypercall being processed with a H_FUNCTION error return value.
+There is really no good error return value to use since PAPR didn't
+envisage the possibility that the hypervisor may not be able to access
+the guest's HPT, and H_FUNCTION (function not supported) seems as
+good as any.
+
+The typical compile warnings look like this:
+
+ CC arch/powerpc/kvm/book3s_pr_papr.o
+/home/paulus/kernel/kvm/arch/powerpc/kvm/book3s_pr_papr.c: In function ‘kvmppc_h_pr_enter’:
+/home/paulus/kernel/kvm/arch/powerpc/kvm/book3s_pr_papr.c:53:2: error: ignoring return value of ‘copy_from_user’, declared with attribute warn_unused_result [-Werror=unused-result]
+ copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg));
+ ^
+/home/paulus/kernel/kvm/arch/powerpc/kvm/book3s_pr_papr.c:74:2: error: ignoring return value of ‘copy_to_user’, declared with attribute warn_unused_result [-Werror=unused-result]
+ copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE);
+ ^
+
+... etc.
+
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kvm/book3s_pr_papr.c | 34 ++++++++++++++++++++++++++--------
+ 1 file changed, 26 insertions(+), 8 deletions(-)
+
+--- a/arch/powerpc/kvm/book3s_pr_papr.c
++++ b/arch/powerpc/kvm/book3s_pr_papr.c
+@@ -50,7 +50,9 @@ static int kvmppc_h_pr_enter(struct kvm_
+ pteg_addr = get_pteg_addr(vcpu, pte_index);
+
+ mutex_lock(&vcpu->kvm->arch.hpt_mutex);
+- copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg));
++ ret = H_FUNCTION;
++ if (copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg)))
++ goto done;
+ hpte = pteg;
+
+ ret = H_PTEG_FULL;
+@@ -71,7 +73,9 @@ static int kvmppc_h_pr_enter(struct kvm_
+ hpte[0] = cpu_to_be64(kvmppc_get_gpr(vcpu, 6));
+ hpte[1] = cpu_to_be64(kvmppc_get_gpr(vcpu, 7));
+ pteg_addr += i * HPTE_SIZE;
+- copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE);
++ ret = H_FUNCTION;
++ if (copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE))
++ goto done;
+ kvmppc_set_gpr(vcpu, 4, pte_index | i);
+ ret = H_SUCCESS;
+
+@@ -93,7 +97,9 @@ static int kvmppc_h_pr_remove(struct kvm
+
+ pteg = get_pteg_addr(vcpu, pte_index);
+ mutex_lock(&vcpu->kvm->arch.hpt_mutex);
+- copy_from_user(pte, (void __user *)pteg, sizeof(pte));
++ ret = H_FUNCTION;
++ if (copy_from_user(pte, (void __user *)pteg, sizeof(pte)))
++ goto done;
+ pte[0] = be64_to_cpu((__force __be64)pte[0]);
+ pte[1] = be64_to_cpu((__force __be64)pte[1]);
+
+@@ -103,7 +109,9 @@ static int kvmppc_h_pr_remove(struct kvm
+ ((flags & H_ANDCOND) && (pte[0] & avpn) != 0))
+ goto done;
+
+- copy_to_user((void __user *)pteg, &v, sizeof(v));
++ ret = H_FUNCTION;
++ if (copy_to_user((void __user *)pteg, &v, sizeof(v)))
++ goto done;
+
+ rb = compute_tlbie_rb(pte[0], pte[1], pte_index);
+ vcpu->arch.mmu.tlbie(vcpu, rb, rb & 1 ? true : false);
+@@ -171,7 +179,10 @@ static int kvmppc_h_pr_bulk_remove(struc
+ }
+
+ pteg = get_pteg_addr(vcpu, tsh & H_BULK_REMOVE_PTEX);
+- copy_from_user(pte, (void __user *)pteg, sizeof(pte));
++ if (copy_from_user(pte, (void __user *)pteg, sizeof(pte))) {
++ ret = H_FUNCTION;
++ break;
++ }
+ pte[0] = be64_to_cpu((__force __be64)pte[0]);
+ pte[1] = be64_to_cpu((__force __be64)pte[1]);
+
+@@ -184,7 +195,10 @@ static int kvmppc_h_pr_bulk_remove(struc
+ tsh |= H_BULK_REMOVE_NOT_FOUND;
+ } else {
+ /* Splat the pteg in (userland) hpt */
+- copy_to_user((void __user *)pteg, &v, sizeof(v));
++ if (copy_to_user((void __user *)pteg, &v, sizeof(v))) {
++ ret = H_FUNCTION;
++ break;
++ }
+
+ rb = compute_tlbie_rb(pte[0], pte[1],
+ tsh & H_BULK_REMOVE_PTEX);
+@@ -211,7 +225,9 @@ static int kvmppc_h_pr_protect(struct kv
+
+ pteg = get_pteg_addr(vcpu, pte_index);
+ mutex_lock(&vcpu->kvm->arch.hpt_mutex);
+- copy_from_user(pte, (void __user *)pteg, sizeof(pte));
++ ret = H_FUNCTION;
++ if (copy_from_user(pte, (void __user *)pteg, sizeof(pte)))
++ goto done;
+ pte[0] = be64_to_cpu((__force __be64)pte[0]);
+ pte[1] = be64_to_cpu((__force __be64)pte[1]);
+
+@@ -234,7 +250,9 @@ static int kvmppc_h_pr_protect(struct kv
+ vcpu->arch.mmu.tlbie(vcpu, rb, rb & 1 ? true : false);
+ pte[0] = (__force u64)cpu_to_be64(pte[0]);
+ pte[1] = (__force u64)cpu_to_be64(pte[1]);
+- copy_to_user((void __user *)pteg, pte, sizeof(pte));
++ ret = H_FUNCTION;
++ if (copy_to_user((void __user *)pteg, pte, sizeof(pte)))
++ goto done;
+ ret = H_SUCCESS;
+
+ done:
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Roman Pen <roman.penyaev@profitbricks.com>
+Date: Thu, 1 Jun 2017 10:55:03 +0200
+Subject: KVM: SVM: do not zero out segment attributes if segment is unusable or not present
+
+From: Roman Pen <roman.penyaev@profitbricks.com>
+
+
+[ Upstream commit d9c1b5431d5f0e07575db785a022bce91051ac1d ]
+
+This is a fix for the problem [1], where VMCB.CPL was set to 0 and interrupt
+was taken on userspace stack. The root cause lies in the specific AMD CPU
+behaviour which manifests itself as unusable segment attributes on SYSRET.
+The corresponding work around for the kernel is the following:
+
+61f01dd941ba ("x86_64, asm: Work around AMD SYSRET SS descriptor attribute issue")
+
+In other turn virtualization side treated unusable segment incorrectly and
+restored CPL from SS attributes, which were zeroed out few lines above.
+
+In current patch it is assured only that P bit is cleared in VMCB.save state
+and segment attributes are not zeroed out if segment is not presented or is
+unusable, therefore CPL can be safely restored from DPL field.
+
+This is only one part of the fix, since QEMU side should be fixed accordingly
+not to zero out attributes on its side. Corresponding patch will follow.
+
+[1] Message id: CAJrWOzD6Xq==b-zYCDdFLgSRMPM-NkNuTSDFEtX=7MreT45i7Q@mail.gmail.com
+
+Signed-off-by: Roman Pen <roman.penyaev@profitbricks.com>
+Signed-off-by: Mikhail Sennikovskii <mikhail.sennikovskii@profitbricks.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Radim KrÄmář <rkrcmar@redhat.com>
+Cc: kvm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/svm.c | 24 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1386,6 +1386,7 @@ static void svm_get_segment(struct kvm_v
+ */
+ if (var->unusable)
+ var->db = 0;
++ /* This is symmetric with svm_set_segment() */
+ var->dpl = to_svm(vcpu)->vmcb->save.cpl;
+ break;
+ }
+@@ -1531,18 +1532,14 @@ static void svm_set_segment(struct kvm_v
+ s->base = var->base;
+ s->limit = var->limit;
+ s->selector = var->selector;
+- if (var->unusable)
+- s->attrib = 0;
+- else {
+- s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
+- s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
+- s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
+- s->attrib |= (var->present & 1) << SVM_SELECTOR_P_SHIFT;
+- s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
+- s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
+- s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
+- s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
+- }
++ s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
++ s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
++ s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
++ s->attrib |= ((var->present & 1) && !var->unusable) << SVM_SELECTOR_P_SHIFT;
++ s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
++ s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
++ s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
++ s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
+
+ /*
+ * This is always accurate, except if SYSRET returned to a segment
+@@ -1551,7 +1548,8 @@ static void svm_set_segment(struct kvm_v
+ * would entail passing the CPL to userspace and back.
+ */
+ if (seg == VCPU_SREG_SS)
+- svm->vmcb->save.cpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3;
++ /* This is symmetric with svm_get_segment() */
++ svm->vmcb->save.cpl = (var->dpl & 3);
+
+ mark_dirty(svm->vmcb, VMCB_SEG);
+ }
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Fri, 22 Dec 2017 15:10:17 +0100
+Subject: l2tp: fix missing print session offset info
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+
+[ Upstream commit 820da5357572715c6235ba3b3daa2d5b43a1198f ]
+
+Report offset parameter in L2TP_CMD_SESSION_GET command if
+it has been configured by userspace
+
+Fixes: 309795f4bec ("l2tp: Add netlink control API for L2TP")
+Reported-by: Jianlin Shi <jishi@redhat.com>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/l2tp/l2tp_netlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/l2tp/l2tp_netlink.c
++++ b/net/l2tp/l2tp_netlink.c
+@@ -732,6 +732,8 @@ static int l2tp_nl_session_send(struct s
+
+ if ((session->ifname[0] &&
+ nla_put_string(skb, L2TP_ATTR_IFNAME, session->ifname)) ||
++ (session->offset &&
++ nla_put_u16(skb, L2TP_ATTR_OFFSET, session->offset)) ||
+ (session->cookie_len &&
+ nla_put(skb, L2TP_ATTR_COOKIE, session->cookie_len,
+ &session->cookie[0])) ||
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Tin Huynh <tnhuynh@apm.com>
+Date: Mon, 22 May 2017 16:19:20 +0700
+Subject: leds: pca955x: Correct I2C Functionality
+
+From: Tin Huynh <tnhuynh@apm.com>
+
+
+[ Upstream commit aace34c0bb8ea3c8bdcec865b6a4be4db0a68e33 ]
+
+The driver checks an incorrect flag of functionality of adapter.
+When a driver requires i2c_smbus_read_byte_data and
+i2c_smbus_write_byte_data, it should check I2C_FUNC_SMBUS_BYTE_DATA
+instead I2C_FUNC_I2C.
+This patch fixes the problem.
+
+Signed-off-by: Tin Huynh <tnhuynh@apm.com>
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/leds/leds-pca955x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/leds/leds-pca955x.c
++++ b/drivers/leds/leds-pca955x.c
+@@ -281,7 +281,7 @@ static int pca955x_probe(struct i2c_clie
+ "slave address 0x%02x\n",
+ id->name, chip->bits, client->addr);
+
+- if (!i2c_check_functionality(adapter, I2C_FUNC_I2C))
++ if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+ return -EIO;
+
+ if (pdata) {
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 23 May 2017 17:25:10 +0300
+Subject: libceph: NULL deref on crush_decode() error path
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit 293dffaad8d500e1a5336eeb90d544cf40d4fbd8 ]
+
+If there is not enough space then ceph_decode_32_safe() does a goto bad.
+We need to return an error code in that situation. The current code
+returns ERR_PTR(0) which is NULL. The callers are not expecting that
+and it results in a NULL dereference.
+
+Fixes: f24e9980eb86 ("ceph: OSD client")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ceph/osdmap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -295,6 +295,7 @@ static struct crush_map *crush_decode(vo
+ u32 yes;
+ struct crush_rule *r;
+
++ err = -EINVAL;
+ ceph_decode_32_safe(p, end, yes, bad);
+ if (!yes) {
+ dout("crush_decode NO rule %d off %x %p to %p\n",
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 28 Mar 2017 21:25:08 -0400
+Subject: lockd: fix lockd shutdown race
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+
+[ Upstream commit efda760fe95ea15291853c8fa9235c32d319cd98 ]
+
+As reported by David Jeffery: "a signal was sent to lockd while lockd
+was shutting down from a request to stop nfs. The signal causes lockd
+to call restart_grace() which puts the lockd_net structure on the grace
+list. If this signal is received at the wrong time, it will occur after
+lockd_down_net() has called locks_end_grace() but before
+lockd_down_net() stops the lockd thread. This leads to lockd putting
+the lockd_net structure back on the grace list, then exiting without
+anything removing it from the list."
+
+So, perform the final locks_end_grace() from the the lockd thread; this
+ensures it's serialized with respect to restart_grace().
+
+Reported-by: David Jeffery <djeffery@redhat.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/lockd/svc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/lockd/svc.c
++++ b/fs/lockd/svc.c
+@@ -129,6 +129,8 @@ lockd(void *vrqstp)
+ {
+ int err = 0;
+ struct svc_rqst *rqstp = vrqstp;
++ struct net *net = &init_net;
++ struct lockd_net *ln = net_generic(net, lockd_net_id);
+
+ /* try_to_freeze() is called from svc_recv() */
+ set_freezable();
+@@ -173,6 +175,8 @@ lockd(void *vrqstp)
+ if (nlmsvc_ops)
+ nlmsvc_invalidate_all();
+ nlm_shutdown_hosts();
++ cancel_delayed_work_sync(&ln->grace_period_end);
++ locks_end_grace(&ln->lockd_manager);
+ return 0;
+ }
+
+@@ -267,8 +271,6 @@ static void lockd_down_net(struct svc_se
+ if (ln->nlmsvc_users) {
+ if (--ln->nlmsvc_users == 0) {
+ nlm_shutdown_hosts_net(net);
+- cancel_delayed_work_sync(&ln->grace_period_end);
+- locks_end_grace(&ln->lockd_manager);
+ svc_shutdown_net(serv, net);
+ dprintk("lockd_down_net: per-net data destroyed; net=%p\n", net);
+ }
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Tue, 2 May 2017 17:56:21 +0300
+Subject: mac80211: bail out from prep_connection() if a reconfig is ongoing
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+
+[ Upstream commit f8860ce836f2d502b07ef99559707fe55d90f5bc ]
+
+If ieee80211_hw_restart() is called during authentication, the
+authentication process will continue, causing the driver to be called
+in a wrong state. This ultimately causes an oops in the iwlwifi
+driver (at least).
+
+This fixes bugzilla 195299 partly.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195299
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/mlme.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -4326,6 +4326,10 @@ static int ieee80211_prep_connection(str
+ if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
+ return -EINVAL;
+
++ /* If a reconfig is happening, bail out */
++ if (local->in_reconfig)
++ return -EBUSY;
++
+ if (assoc) {
+ rcu_read_lock();
+ have_sta = sta_info_get(sdata, cbss->bssid);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: A Sun <as1033x@comcast.net>
+Date: Sun, 26 Mar 2017 15:33:07 -0300
+Subject: [media] mceusb: sporadic RX truncation corruption fix
+
+From: A Sun <as1033x@comcast.net>
+
+
+[ Upstream commit 8e175b22e8640bf3a58e071af54190b909e4a944 ]
+
+Intermittent RX truncation and loss of IR received data. This resulted
+in receive stream synchronization errors where driver attempted to
+incorrectly parse IR data (eg 0x90 below) as command response.
+
+[ 3969.139898] mceusb 1-1.2:1.0: processed IR data
+[ 3969.151315] mceusb 1-1.2:1.0: rx data: 00 90 (length=2)
+[ 3969.151321] mceusb 1-1.2:1.0: Unknown command 0x00 0x90
+[ 3969.151336] mceusb 1-1.2:1.0: rx data: 98 0a 8d 0a 8e 0a 8e 0a 8e 0a 8e 0a 9a 0a 8e 0a 0b 3a 8e 00 80 41 59 00 00 (length=25)
+[ 3969.151341] mceusb 1-1.2:1.0: Raw IR data, 24 pulse/space samples
+[ 3969.151348] mceusb 1-1.2:1.0: Storing space with duration 500000
+
+Bug trigger appears to be normal, but heavy, IR receiver use.
+
+Signed-off-by: A Sun <as1033x@comcast.net>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/rc/mceusb.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/rc/mceusb.c
++++ b/drivers/media/rc/mceusb.c
+@@ -1370,8 +1370,13 @@ static int mceusb_dev_probe(struct usb_i
+ goto rc_dev_fail;
+
+ /* wire up inbound data handler */
+- usb_fill_int_urb(ir->urb_in, dev, pipe, ir->buf_in, maxp,
+- mceusb_dev_recv, ir, ep_in->bInterval);
++ if (usb_endpoint_xfer_int(ep_in))
++ usb_fill_int_urb(ir->urb_in, dev, pipe, ir->buf_in, maxp,
++ mceusb_dev_recv, ir, ep_in->bInterval);
++ else
++ usb_fill_bulk_urb(ir->urb_in, dev, pipe, ir->buf_in, maxp,
++ mceusb_dev_recv, ir);
++
+ ir->urb_in->transfer_dma = ir->dma_in;
+ ir->urb_in->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Guoqing Jiang <gqjiang@suse.com>
+Date: Tue, 16 May 2017 14:01:25 +0800
+Subject: md-cluster: fix potential lock issue in add_new_disk
+
+From: Guoqing Jiang <gqjiang@suse.com>
+
+
+[ Upstream commit 2dffdc0724004f38f5e39907747b53e4b0d80e59 ]
+
+The add_new_disk returns with communication locked if
+__sendmsg returns failure, fix it with call unlock_comm
+before return.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+CC: Goldwyn Rodrigues <rgoldwyn@suse.com>
+Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/md-cluster.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -945,8 +945,10 @@ static int add_new_disk(struct mddev *md
+ cmsg.raid_slot = cpu_to_le32(rdev->desc_nr);
+ lock_comm(cinfo);
+ ret = __sendmsg(cinfo, &cmsg);
+- if (ret)
++ if (ret) {
++ unlock_comm(cinfo);
+ return ret;
++ }
+ cinfo->no_new_dev_lockres->flags |= DLM_LKF_NOQUEUE;
+ ret = dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_EX);
+ cinfo->no_new_dev_lockres->flags &= ~DLM_LKF_NOQUEUE;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Julia Cartwright <julia@ni.com>
+Date: Fri, 28 Apr 2017 12:41:02 -0500
+Subject: md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock
+
+From: Julia Cartwright <julia@ni.com>
+
+
+[ Upstream commit 3d05f3aed5d721c2c77d20288c29ab26c6193ed5 ]
+
+On mainline, there is no functional difference, just less code, and
+symmetric lock/unlock paths.
+
+On PREEMPT_RT builds, this fixes the following warning, seen by
+Alexander GQ Gerasiov, due to the sleeping nature of spinlocks.
+
+ BUG: sleeping function called from invalid context at kernel/locking/rtmutex.c:993
+ in_atomic(): 0, irqs_disabled(): 1, pid: 58, name: kworker/u12:1
+ CPU: 5 PID: 58 Comm: kworker/u12:1 Tainted: G W 4.9.20-rt16-stand6-686 #1
+ Hardware name: Supermicro SYS-5027R-WRF/X9SRW-F, BIOS 3.2a 10/28/2015
+ Workqueue: writeback wb_workfn (flush-253:0)
+ Call Trace:
+ dump_stack+0x47/0x68
+ ? migrate_enable+0x4a/0xf0
+ ___might_sleep+0x101/0x180
+ rt_spin_lock+0x17/0x40
+ add_stripe_bio+0x4e3/0x6c0 [raid456]
+ ? preempt_count_add+0x42/0xb0
+ raid5_make_request+0x737/0xdd0 [raid456]
+
+Reported-by: Alexander GQ Gerasiov <gq@redlab-i.ru>
+Tested-by: Alexander GQ Gerasiov <gq@redlab-i.ru>
+Signed-off-by: Julia Cartwright <julia@ni.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/raid5.c | 17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -110,8 +110,7 @@ static inline void unlock_device_hash_lo
+ static inline void lock_all_device_hash_locks_irq(struct r5conf *conf)
+ {
+ int i;
+- local_irq_disable();
+- spin_lock(conf->hash_locks);
++ spin_lock_irq(conf->hash_locks);
+ for (i = 1; i < NR_STRIPE_HASH_LOCKS; i++)
+ spin_lock_nest_lock(conf->hash_locks + i, conf->hash_locks);
+ spin_lock(&conf->device_lock);
+@@ -121,9 +120,9 @@ static inline void unlock_all_device_has
+ {
+ int i;
+ spin_unlock(&conf->device_lock);
+- for (i = NR_STRIPE_HASH_LOCKS; i; i--)
+- spin_unlock(conf->hash_locks + i - 1);
+- local_irq_enable();
++ for (i = NR_STRIPE_HASH_LOCKS - 1; i; i--)
++ spin_unlock(conf->hash_locks + i);
++ spin_unlock_irq(conf->hash_locks);
+ }
+
+ /* bio's attached to a stripe+device for I/O are linked together in bi_sector
+@@ -726,12 +725,11 @@ static bool is_full_stripe_write(struct
+
+ static void lock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2)
+ {
+- local_irq_disable();
+ if (sh1 > sh2) {
+- spin_lock(&sh2->stripe_lock);
++ spin_lock_irq(&sh2->stripe_lock);
+ spin_lock_nested(&sh1->stripe_lock, 1);
+ } else {
+- spin_lock(&sh1->stripe_lock);
++ spin_lock_irq(&sh1->stripe_lock);
+ spin_lock_nested(&sh2->stripe_lock, 1);
+ }
+ }
+@@ -739,8 +737,7 @@ static void lock_two_stripes(struct stri
+ static void unlock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2)
+ {
+ spin_unlock(&sh1->stripe_lock);
+- spin_unlock(&sh2->stripe_lock);
+- local_irq_enable();
++ spin_unlock_irq(&sh2->stripe_lock);
+ }
+
+ /* Only freshly new full stripe normal write stripe can be added to a batch list */
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Date: Thu, 28 Dec 2017 09:16:47 -0500
+Subject: media: videobuf2-core: don't go out of the buffer range
+
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+
+
+[ Upstream commit df93dc61b0d8b19a5c9db545cf3fcc24f88dfde4 ]
+
+Currently, there's no check if an invalid buffer range
+is passed. However, while testing DVB memory mapped apps,
+I got this:
+
+ videobuf2_core: VB: num_buffers -2143943680, buffer 33, index -2143943647
+ unable to handle kernel paging request at ffff888b773c0890
+ IP: __vb2_queue_alloc+0x134/0x4e0 [videobuf2_core]
+ PGD 4142c7067 P4D 4142c7067 PUD 0
+ Oops: 0002 [#1] SMP
+ Modules linked in: xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill ecdh_generic binfmt_misc rc_dvbsky sp2 ts2020 intel_rapl x86_pkg_temp_thermal dvb_usb_dvbsky intel_powerclamp dvb_usb_v2 coretemp m88ds3103 kvm_intel i2c_mux dvb_core snd_hda_codec_hdmi crct10dif_pclmul crc32_pclmul videobuf2_vmalloc videobuf2_memops snd_hda_intel ghash_clmulni_intel videobuf2_core snd_hda_codec rc_core mei_me intel_cstate snd_hwdep snd_hda_core videodev intel_uncore snd_pcm mei media tpm_tis tpm_tis_core intel_rapl_perf tpm snd_timer lpc_ich snd soundcore kvm irqbypass libcrc32c i915 i2c_algo_bit drm_kms_helper
+ e1000e ptp drm crc32c_intel video pps_core
+ CPU: 3 PID: 1776 Comm: dvbv5-zap Not tainted 4.14.0+ #78
+ Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
+ task: ffff88877c73bc80 task.stack: ffffb7c402418000
+ RIP: 0010:__vb2_queue_alloc+0x134/0x4e0 [videobuf2_core]
+ RSP: 0018:ffffb7c40241bc60 EFLAGS: 00010246
+ RAX: 0000000080360421 RBX: 0000000000000021 RCX: 000000000000000a
+ RDX: ffffb7c40241bcf4 RSI: ffff888780362c60 RDI: ffff888796d8e130
+ RBP: ffffb7c40241bcc8 R08: 0000000000000316 R09: 0000000000000004
+ R10: ffff888780362c00 R11: 0000000000000001 R12: 000000000002f000
+ R13: ffff8887758be700 R14: 0000000000021000 R15: 0000000000000001
+ FS: 00007f2849024740(0000) GS:ffff888796d80000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: ffff888b773c0890 CR3: 000000043beb2005 CR4: 00000000003606e0
+ Call Trace:
+ vb2_core_reqbufs+0x226/0x420 [videobuf2_core]
+ dvb_vb2_reqbufs+0x2d/0xc0 [dvb_core]
+ dvb_dvr_do_ioctl+0x98/0x1d0 [dvb_core]
+ dvb_usercopy+0x53/0x1b0 [dvb_core]
+ ? dvb_demux_ioctl+0x20/0x20 [dvb_core]
+ ? tty_ldisc_deref+0x16/0x20
+ ? tty_write+0x1f9/0x310
+ ? process_echoes+0x70/0x70
+ dvb_dvr_ioctl+0x15/0x20 [dvb_core]
+ do_vfs_ioctl+0xa5/0x600
+ SyS_ioctl+0x79/0x90
+ entry_SYSCALL_64_fastpath+0x1a/0xa5
+ RIP: 0033:0x7f28486f7ea7
+ RSP: 002b:00007ffc13b2db18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+ RAX: ffffffffffffffda RBX: 000055b10fc06130 RCX: 00007f28486f7ea7
+ RDX: 00007ffc13b2db48 RSI: 00000000c0086f3c RDI: 0000000000000007
+ RBP: 0000000000000203 R08: 000055b10df1e02c R09: 000000000000002e
+ R10: 0036b42415108357 R11: 0000000000000246 R12: 0000000000000000
+ R13: 00007f2849062f60 R14: 00000000000001f1 R15: 00007ffc13b2da54
+ Code: 74 0a 60 8b 0a 48 83 c0 30 48 83 c2 04 89 48 d0 89 48 d4 48 39 f0 75 eb 41 8b 42 08 83 7d d4 01 41 c7 82 ec 01 00 00 ff ff ff ff <4d> 89 94 c5 88 00 00 00 74 14 83 c3 01 41 39 dc 0f 85 f1 fe ff
+ RIP: __vb2_queue_alloc+0x134/0x4e0 [videobuf2_core] RSP: ffffb7c40241bc60
+ CR2: ffff888b773c0890
+
+So, add a sanity check in order to prevent going past array.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/v4l2-core/videobuf2-core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -205,6 +205,10 @@ static int __vb2_queue_alloc(struct vb2_
+ struct vb2_buffer *vb;
+ int ret;
+
++ /* Ensure that q->num_buffers+num_buffers is below VB2_MAX_FRAME */
++ num_buffers = min_t(unsigned int, num_buffers,
++ VB2_MAX_FRAME - q->num_buffers);
++
+ for (buffer = 0; buffer < num_buffers; ++buffer) {
+ /* Allocate videobuf buffer structures */
+ vb = kzalloc(q->buf_struct_size, GFP_KERNEL);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+Date: Thu, 8 Jun 2017 15:20:32 +0200
+Subject: MIPS: kprobes: flush_insn_slot should flush only if probe initialised
+
+From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+
+
+[ Upstream commit 698b851073ddf5a894910d63ca04605e0473414e ]
+
+When ftrace is used with kprobes, it is possible for a kprobe to contain
+an invalid location (ie. only initialised to 0 and not to a specific
+location in the code). Trying to perform a cache flush on such location
+leads to a crash r4k_flush_icache_range().
+
+Fixes: c1bf207d6ee1 ("MIPS: kprobe: Add support.")
+Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/16296/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/include/asm/kprobes.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/include/asm/kprobes.h
++++ b/arch/mips/include/asm/kprobes.h
+@@ -40,7 +40,8 @@ typedef union mips_instruction kprobe_op
+
+ #define flush_insn_slot(p) \
+ do { \
+- flush_icache_range((unsigned long)p->addr, \
++ if (p->addr) \
++ flush_icache_range((unsigned long)p->addr, \
+ (unsigned long)p->addr + \
+ (MAX_INSN_SIZE * sizeof(kprobe_opcode_t))); \
+ } while (0)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+Date: Tue, 11 Apr 2017 09:00:36 +0200
+Subject: MIPS: mm: adjust PKMAP location
+
+From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+
+
+[ Upstream commit c56e7a4c3e77f6fbd9b55c06c14eda65aae58958 ]
+
+Space reserved for PKMap should span from PKMAP_BASE to FIXADDR_START.
+For large page sizes this is not the case as eg. for 64k pages the range
+currently defined is from 0xfe000000 to 0x102000000(!!) which obviously
+isn't right.
+Remove the hardcoded location and set the BASE address as an offset from
+FIXADDR_START.
+
+Since all PKMAP ptes have to be placed in a contiguous memory, ensure
+that this is the case by placing them all in a single page. This is
+achieved by aligning the end address to pkmap pages count pages.
+
+Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/15950/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/include/asm/pgtable-32.h | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/include/asm/pgtable-32.h
++++ b/arch/mips/include/asm/pgtable-32.h
+@@ -18,6 +18,10 @@
+
+ #include <asm-generic/pgtable-nopmd.h>
+
++#ifdef CONFIG_HIGHMEM
++#include <asm/highmem.h>
++#endif
++
+ extern int temp_tlb_entry;
+
+ /*
+@@ -61,7 +65,8 @@ extern int add_temporary_entry(unsigned
+
+ #define VMALLOC_START MAP_BASE
+
+-#define PKMAP_BASE (0xfe000000UL)
++#define PKMAP_END ((FIXADDR_START) & ~((LAST_PKMAP << PAGE_SHIFT)-1))
++#define PKMAP_BASE (PKMAP_END - PAGE_SIZE * LAST_PKMAP)
+
+ #ifdef CONFIG_HIGHMEM
+ # define VMALLOC_END (PKMAP_BASE-2*PAGE_SIZE)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+Date: Tue, 11 Apr 2017 09:00:34 +0200
+Subject: MIPS: mm: fixed mappings: correct initialisation
+
+From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+
+
+[ Upstream commit 71eb989ab5a110df8bcbb9609bacde73feacbedd ]
+
+fixrange_init operates at PMD-granularity and expects the addresses to
+be PMD-size aligned, but currently that might not be the case for
+PKMAP_BASE unless it is defined properly, so ensure a correct alignment
+is used before passing the address to fixrange_init.
+
+fixed mappings: only align the start address that is passed to
+fixrange_init rather than the value before adding the size, as we may
+end up with uninitialised upper part of the range.
+
+Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/15948/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/mm/pgtable-32.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/mips/mm/pgtable-32.c
++++ b/arch/mips/mm/pgtable-32.c
+@@ -51,15 +51,15 @@ void __init pagetable_init(void)
+ /*
+ * Fixed mappings:
+ */
+- vaddr = __fix_to_virt(__end_of_fixed_addresses - 1) & PMD_MASK;
+- fixrange_init(vaddr, vaddr + FIXADDR_SIZE, pgd_base);
++ vaddr = __fix_to_virt(__end_of_fixed_addresses - 1);
++ fixrange_init(vaddr & PMD_MASK, vaddr + FIXADDR_SIZE, pgd_base);
+
+ #ifdef CONFIG_HIGHMEM
+ /*
+ * Permanent kmaps:
+ */
+ vaddr = PKMAP_BASE;
+- fixrange_init(vaddr, vaddr + PAGE_SIZE*LAST_PKMAP, pgd_base);
++ fixrange_init(vaddr & PMD_MASK, vaddr + PAGE_SIZE*LAST_PKMAP, pgd_base);
+
+ pgd = swapper_pg_dir + __pgd_offset(vaddr);
+ pud = pud_offset(pgd, vaddr);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Jia-Ju Bai <baijiaju1990@163.com>
+Date: Wed, 31 May 2017 15:08:25 +0800
+Subject: mISDN: Fix a sleep-in-atomic bug
+
+From: Jia-Ju Bai <baijiaju1990@163.com>
+
+
+[ Upstream commit 93818da5eed63fbc17b64080406ea53b86b23309 ]
+
+The driver may sleep under a read spin lock, and the function call path is:
+send_socklist (acquire the lock by read_lock)
+ skb_copy(GFP_KERNEL) --> may sleep
+
+To fix it, the "GFP_KERNEL" is replaced with "GFP_ATOMIC".
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/isdn/mISDN/stack.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/isdn/mISDN/stack.c
++++ b/drivers/isdn/mISDN/stack.c
+@@ -72,7 +72,7 @@ send_socklist(struct mISDN_sock_list *sl
+ if (sk->sk_state != MISDN_BOUND)
+ continue;
+ if (!cskb)
+- cskb = skb_copy(skb, GFP_KERNEL);
++ cskb = skb_copy(skb, GFP_ATOMIC);
+ if (!cskb) {
+ printk(KERN_WARNING "%s no skb\n", __func__);
+ break;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+Date: Mon, 22 May 2017 20:13:07 +0200
+Subject: mlx5: fix bug reading rss_hash_type from CQE
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+
+[ Upstream commit 12e8b570e732eaa5eae3a2895ba3fbcf91bde2b4 ]
+
+Masks for extracting part of the Completion Queue Entry (CQE)
+field rss_hash_type was swapped, namely CQE_RSS_HTYPE_IP and
+CQE_RSS_HTYPE_L4.
+
+The bug resulted in setting skb->l4_hash, even-though the
+rss_hash_type indicated that hash was NOT computed over the
+L4 (UDP or TCP) part of the packet.
+
+Added comments from the datasheet, to make it more clear what
+these masks are selecting.
+
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Acked-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/mlx5/device.h | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/include/linux/mlx5/device.h
++++ b/include/linux/mlx5/device.h
+@@ -635,8 +635,14 @@ enum {
+ };
+
+ enum {
+- CQE_RSS_HTYPE_IP = 0x3 << 6,
+- CQE_RSS_HTYPE_L4 = 0x3 << 2,
++ CQE_RSS_HTYPE_IP = 0x3 << 2,
++ /* cqe->rss_hash_type[3:2] - IP destination selected for hash
++ * (00 = none, 01 = IPv4, 10 = IPv6, 11 = Reserved)
++ */
++ CQE_RSS_HTYPE_L4 = 0x3 << 6,
++ /* cqe->rss_hash_type[7:6] - L4 destination selected for hash
++ * (00 = none, 01 = TCP. 10 = UDP, 11 = IPSEC.SPI
++ */
+ };
+
+ enum {
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+Date: Mon, 10 Apr 2017 10:35:17 +0200
+Subject: mtd: nand: gpmi: Fix gpmi_nand_init() error path
+
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+
+
+[ Upstream commit 4d02423e9afe6c46142ce98bbcaf5167316dbfbf ]
+
+The GPMI driver is wrongly assuming that nand_release() can safely be
+called on an uninitialized/unregistered NAND device.
+
+Add a new err_nand_cleanup label in the error path and only execute if
+nand_scan_tail() succeeded.
+
+Note that we now call nand_cleanup() instead of nand_release()
+(nand_release() is actually grouping the mtd_device_unregister() and
+nand_cleanup() in one call) because there's no point in trying to
+unregister a device that has never been registered.
+
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Reviewed-by: Marek Vasut <marek.vasut@gmail.com>
+Acked-by: Han Xu <han.xu@nxp.com>
+Reviewed-by: Marek Vasut <marek.vasut@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+@@ -1949,19 +1949,21 @@ static int gpmi_nand_init(struct gpmi_na
+
+ ret = nand_boot_init(this);
+ if (ret)
+- goto err_out;
++ goto err_nand_cleanup;
+ ret = chip->scan_bbt(mtd);
+ if (ret)
+- goto err_out;
++ goto err_nand_cleanup;
+
+ ppdata.of_node = this->pdev->dev.of_node;
+ ret = mtd_device_parse_register(mtd, NULL, &ppdata, NULL, 0);
+ if (ret)
+- goto err_out;
++ goto err_nand_cleanup;
+ return 0;
+
++err_nand_cleanup:
++ nand_cleanup(chip);
+ err_out:
+- gpmi_nand_exit(this);
++ gpmi_free_dma_buffer(this);
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Ihar Hrachyshka <ihrachys@redhat.com>
+Date: Tue, 16 May 2017 08:44:24 -0700
+Subject: neighbour: update neigh timestamps iff update is effective
+
+From: Ihar Hrachyshka <ihrachys@redhat.com>
+
+
+[ Upstream commit 77d7123342dcf6442341b67816321d71da8b2b16 ]
+
+It's a common practice to send gratuitous ARPs after moving an
+IP address to another device to speed up healing of a service. To
+fulfill service availability constraints, the timing of network peers
+updating their caches to point to a new location of an IP address can be
+particularly important.
+
+Sometimes neigh_update calls won't touch neither lladdr nor state, for
+example if an update arrives in locktime interval. The neigh->updated
+value is tested by the protocol specific neigh code, which in turn
+will influence whether NEIGH_UPDATE_F_OVERRIDE gets set in the
+call to neigh_update() or not. As a result, we may effectively ignore
+the update request, bailing out of touching the neigh entry, except that
+we still bump its timestamps inside neigh_update.
+
+This may be a problem for updates arriving in quick succession. For
+example, consider the following scenario:
+
+A service is moved to another device with its IP address. The new device
+sends three gratuitous ARP requests into the network with ~1 seconds
+interval between them. Just before the first request arrives to one of
+network peer nodes, its neigh entry for the IP address transitions from
+STALE to DELAY. This transition, among other things, updates
+neigh->updated. Once the kernel receives the first gratuitous ARP, it
+ignores it because its arrival time is inside the locktime interval. The
+kernel still bumps neigh->updated. Then the second gratuitous ARP
+request arrives, and it's also ignored because it's still in the (new)
+locktime interval. Same happens for the third request. The node
+eventually heals itself (after delay_first_probe_time seconds since the
+initial transition to DELAY state), but it just wasted some time and
+require a new ARP request/reply round trip. This unfortunate behaviour
+both puts more load on the network, as well as reduces service
+availability.
+
+This patch changes neigh_update so that it bumps neigh->updated (as well
+as neigh->confirmed) only once we are sure that either lladdr or entry
+state will change). In the scenario described above, it means that the
+second gratuitous ARP request will actually update the entry lladdr.
+
+Ideally, we would update the neigh entry on the very first gratuitous
+ARP request. The locktime mechanism is designed to ignore ARP updates in
+a short timeframe after a previous ARP update was honoured by the kernel
+layer. This would require tracking timestamps for state transitions
+separately from timestamps when actual updates are received. This would
+probably involve changes in neighbour struct. Therefore, the patch
+doesn't tackle the issue of the first gratuitous APR ignored, leaving
+it for a follow-up.
+
+Signed-off-by: Ihar Hrachyshka <ihrachys@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/neighbour.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1132,10 +1132,6 @@ int neigh_update(struct neighbour *neigh
+ lladdr = neigh->ha;
+ }
+
+- if (new & NUD_CONNECTED)
+- neigh->confirmed = jiffies;
+- neigh->updated = jiffies;
+-
+ /* If entry was valid and address is not changed,
+ do not change entry state, if new one is STALE.
+ */
+@@ -1159,6 +1155,16 @@ int neigh_update(struct neighbour *neigh
+ }
+ }
+
++ /* Update timestamps only once we know we will make a change to the
++ * neighbour entry. Otherwise we risk to move the locktime window with
++ * noop updates and ignore relevant ARP updates.
++ */
++ if (new != old || lladdr != neigh->ha) {
++ if (new & NUD_CONNECTED)
++ neigh->confirmed = jiffies;
++ neigh->updated = jiffies;
++ }
++
+ if (new != old) {
+ neigh_del_timer(neigh);
+ if (new & NUD_PROBE)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Jim Baxter <jim_baxter@mentor.com>
+Date: Mon, 8 May 2017 13:49:57 +0100
+Subject: net: cdc_ncm: Fix TX zero padding
+
+From: Jim Baxter <jim_baxter@mentor.com>
+
+
+[ Upstream commit aeca3a77b1e0ed06a095933b89c86aed007383eb ]
+
+The zero padding that is added to NTB's does
+not zero the memory correctly.
+This is because the skb_put modifies the value
+of skb_out->len which results in the memset
+command not setting any memory to zero as
+(ctx->tx_max - skb_out->len) == 0.
+
+I have resolved this by storing the size of
+the memory to be zeroed before the skb_put
+and using this in the memset call.
+
+Signed-off-by: Jim Baxter <jim_baxter@mentor.com>
+Reviewed-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/cdc_ncm.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1069,6 +1069,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev
+ u16 n = 0, index, ndplen;
+ u8 ready2send = 0;
+ u32 delayed_ndp_size;
++ size_t padding_count;
+
+ /* When our NDP gets written in cdc_ncm_ndp(), then skb_out->len gets updated
+ * accordingly. Otherwise, we should check here.
+@@ -1225,11 +1226,13 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev
+ * a ZLP after full sized NTBs.
+ */
+ if (!(dev->driver_info->flags & FLAG_SEND_ZLP) &&
+- skb_out->len > ctx->min_tx_pkt)
+- memset(skb_put(skb_out, ctx->tx_max - skb_out->len), 0,
+- ctx->tx_max - skb_out->len);
+- else if (skb_out->len < ctx->tx_max && (skb_out->len % dev->maxpacket) == 0)
++ skb_out->len > ctx->min_tx_pkt) {
++ padding_count = ctx->tx_max - skb_out->len;
++ memset(skb_put(skb_out, padding_count), 0, padding_count);
++ } else if (skb_out->len < ctx->tx_max &&
++ (skb_out->len % dev->maxpacket) == 0) {
+ *skb_put(skb_out, 1) = 0; /* force short packet */
++ }
+
+ /* set final frame length */
+ nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Wed, 7 Jun 2017 15:51:15 +0200
+Subject: net: emac: fix reset timeout with AR8035 phy
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+
+[ Upstream commit 19d90ece81da802207a9b91ce95a29fbdc40626e ]
+
+This patch fixes a problem where the AR8035 PHY can't be
+detected on an Cisco Meraki MR24, if the ethernet cable is
+not connected on boot.
+
+Russell Senior provided steps to reproduce the issue:
+|Disconnect ethernet cable, apply power, wait until device has booted,
+|plug in ethernet, check for interfaces, no eth0 is listed.
+|
+|This appears to be a problem during probing of the AR8035 Phy chip.
+|When ethernet has no link, the phy detection fails, and eth0 is not
+|created. Plugging ethernet later has no effect, because there is no
+|interface as far as the kernel is concerned. The relevant part of
+|the boot log looks like this:
+|this is the failing case:
+|
+|[ 0.876611] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
+|[ 0.882532] /plb/opb/ethernet@ef600c00: reset timeout
+|[ 0.888546] /plb/opb/ethernet@ef600c00: can't find PHY!
+|and the succeeding case:
+|
+|[ 0.876672] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
+|[ 0.883952] eth0: EMAC-0 /plb/opb/ethernet@ef600c00, MAC 00:01:..
+|[ 0.890822] eth0: found Atheros 8035 Gigabit Ethernet PHY (0x01)
+
+Based on the comment and the commit message of
+commit 23fbb5a87c56 ("emac: Fix EMAC soft reset on 460EX/GT").
+This is because the AR8035 PHY doesn't provide the TX Clock,
+if the ethernet cable is not attached. This causes the reset
+to timeout and the PHY detection code in emac_init_phy() is
+unable to detect the AR8035 PHY. As a result, the emac driver
+bails out early and the user left with no ethernet.
+
+In order to stay compatible with existing configurations, the driver
+tries the current reset approach at first. Only if the first attempt
+timed out, it does perform one more retry with the clock temporarily
+switched to the internal source for just the duration of the reset.
+
+LEDE-Bug: #687 <https://bugs.lede-project.org/index.php?do=details&task_id=687>
+
+Cc: Chris Blake <chrisrblake93@gmail.com>
+Reported-by: Russell Senior <russell@personaltelco.net>
+Fixes: 23fbb5a87c56e98 ("emac: Fix EMAC soft reset on 460EX/GT")
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ibm/emac/core.c | 26 ++++++++++++++++++++++----
+ 1 file changed, 22 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/ibm/emac/core.c
++++ b/drivers/net/ethernet/ibm/emac/core.c
+@@ -342,6 +342,7 @@ static int emac_reset(struct emac_instan
+ {
+ struct emac_regs __iomem *p = dev->emacp;
+ int n = 20;
++ bool __maybe_unused try_internal_clock = false;
+
+ DBG(dev, "reset" NL);
+
+@@ -354,6 +355,7 @@ static int emac_reset(struct emac_instan
+ }
+
+ #ifdef CONFIG_PPC_DCR_NATIVE
++do_retry:
+ /*
+ * PPC460EX/GT Embedded Processor Advanced User's Manual
+ * section 28.10.1 Mode Register 0 (EMACx_MR0) states:
+@@ -361,10 +363,19 @@ static int emac_reset(struct emac_instan
+ * of the EMAC. If none is present, select the internal clock
+ * (SDR0_ETH_CFG[EMACx_PHY_CLK] = 1).
+ * After a soft reset, select the external clock.
++ *
++ * The AR8035-A PHY Meraki MR24 does not provide a TX Clk if the
++ * ethernet cable is not attached. This causes the reset to timeout
++ * and the PHY detection code in emac_init_phy() is unable to
++ * communicate and detect the AR8035-A PHY. As a result, the emac
++ * driver bails out early and the user has no ethernet.
++ * In order to stay compatible with existing configurations, the
++ * driver will temporarily switch to the internal clock, after
++ * the first reset fails.
+ */
+ if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
+- if (dev->phy_address == 0xffffffff &&
+- dev->phy_map == 0xffffffff) {
++ if (try_internal_clock || (dev->phy_address == 0xffffffff &&
++ dev->phy_map == 0xffffffff)) {
+ /* No PHY: select internal loop clock before reset */
+ dcri_clrset(SDR0, SDR0_ETH_CFG,
+ 0, SDR0_ETH_CFG_ECS << dev->cell_index);
+@@ -382,8 +393,15 @@ static int emac_reset(struct emac_instan
+
+ #ifdef CONFIG_PPC_DCR_NATIVE
+ if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
+- if (dev->phy_address == 0xffffffff &&
+- dev->phy_map == 0xffffffff) {
++ if (!n && !try_internal_clock) {
++ /* first attempt has timed out. */
++ n = 20;
++ try_internal_clock = true;
++ goto do_retry;
++ }
++
++ if (try_internal_clock || (dev->phy_address == 0xffffffff &&
++ dev->phy_map == 0xffffffff)) {
+ /* No PHY: restore external clock source after reset */
+ dcri_clrset(SDR0, SDR0_ETH_CFG,
+ SDR0_ETH_CFG_ECS << dev->cell_index, 0);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Mon, 8 May 2017 14:21:21 -0500
+Subject: net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+
+[ Upstream commit 48f5bccc60675f8426a6159935e8636a1fd89f56 ]
+
+When users set flow control using ethtool the bits are set properly in the
+CPGMAC_SL MACCONTROL register, but the FIFO depth in the respective Port n
+Maximum FIFO Blocks (Pn_MAX_BLKS) registers remains set to the minimum size
+reset value. When receive flow control is enabled on a port, the port's
+associated FIFO block allocation must be adjusted. The port RX allocation
+must increase to accommodate the flow control runout. The TRM recommends
+numbers of 5 or 6.
+
+Hence, apply required Port FIFO configuration to
+Pn_MAX_BLKS.Pn_TX_MAX_BLKS=0xF and Pn_MAX_BLKS.Pn_RX_MAX_BLKS=0x5 during
+interface initialization.
+
+Cc: Schuyler Patton <spatton@ti.com>
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/cpsw.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -280,6 +280,10 @@ struct cpsw_ss_regs {
+ /* Bit definitions for the CPSW1_TS_SEQ_LTYPE register */
+ #define CPSW_V1_SEQ_ID_OFS_SHIFT 16
+
++#define CPSW_MAX_BLKS_TX 15
++#define CPSW_MAX_BLKS_TX_SHIFT 4
++#define CPSW_MAX_BLKS_RX 5
++
+ struct cpsw_host_regs {
+ u32 max_blks;
+ u32 blk_cnt;
+@@ -1127,11 +1131,23 @@ static void cpsw_slave_open(struct cpsw_
+ switch (priv->version) {
+ case CPSW_VERSION_1:
+ slave_write(slave, TX_PRIORITY_MAPPING, CPSW1_TX_PRI_MAP);
++ /* Increase RX FIFO size to 5 for supporting fullduplex
++ * flow control mode
++ */
++ slave_write(slave,
++ (CPSW_MAX_BLKS_TX << CPSW_MAX_BLKS_TX_SHIFT) |
++ CPSW_MAX_BLKS_RX, CPSW1_MAX_BLKS);
+ break;
+ case CPSW_VERSION_2:
+ case CPSW_VERSION_3:
+ case CPSW_VERSION_4:
+ slave_write(slave, TX_PRIORITY_MAPPING, CPSW2_TX_PRI_MAP);
++ /* Increase RX FIFO size to 5 for supporting fullduplex
++ * flow control mode
++ */
++ slave_write(slave,
++ (CPSW_MAX_BLKS_TX << CPSW_MAX_BLKS_TX_SHIFT) |
++ CPSW_MAX_BLKS_RX, CPSW2_MAX_BLKS);
+ break;
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
+Date: Tue, 30 May 2017 17:38:43 -0500
+Subject: net: freescale: fix potential null pointer dereference
+
+From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
+
+
+[ Upstream commit 06d2d6431bc8d41ef5ffd8bd4b52cea9f72aed22 ]
+
+Add NULL check before dereferencing pointer _id_ in order to avoid
+a potential NULL pointer dereference.
+
+Addresses-Coverity-ID: 1397995
+Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/fsl_pq_mdio.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+@@ -382,7 +382,7 @@ static int fsl_pq_mdio_probe(struct plat
+ {
+ const struct of_device_id *id =
+ of_match_device(fsl_pq_mdio_match, &pdev->dev);
+- const struct fsl_pq_mdio_data *data = id->data;
++ const struct fsl_pq_mdio_data *data;
+ struct device_node *np = pdev->dev.of_node;
+ struct resource res;
+ struct device_node *tbi;
+@@ -390,6 +390,13 @@ static int fsl_pq_mdio_probe(struct plat
+ struct mii_bus *new_bus;
+ int err;
+
++ if (!id) {
++ dev_err(&pdev->dev, "Failed to match device\n");
++ return -ENODEV;
++ }
++
++ data = id->data;
++
+ dev_dbg(&pdev->dev, "found %s compatible node\n", id->compatible);
+
+ new_bus = mdiobus_alloc_size(sizeof(*priv));
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Lin Zhang <xiaolou4617@gmail.com>
+Date: Tue, 23 May 2017 13:29:39 +0800
+Subject: net: ieee802154: fix net_device reference release too early
+
+From: Lin Zhang <xiaolou4617@gmail.com>
+
+
+[ Upstream commit a611c58b3d42a92e6b23423e166dd17c0c7fffce ]
+
+This patch fixes the kernel oops when release net_device reference in
+advance. In function raw_sendmsg(i think the dgram_sendmsg has the same
+problem), there is a race condition between dev_put and dev_queue_xmit
+when the device is gong that maybe lead to dev_queue_ximt to see
+an illegal net_device pointer.
+
+My test kernel is 3.13.0-32 and because i am not have a real 802154
+device, so i change lowpan_newlink function to this:
+
+ /* find and hold real wpan device */
+ real_dev = dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
+ if (!real_dev)
+ return -ENODEV;
+// if (real_dev->type != ARPHRD_IEEE802154) {
+// dev_put(real_dev);
+// return -EINVAL;
+// }
+ lowpan_dev_info(dev)->real_dev = real_dev;
+ lowpan_dev_info(dev)->fragment_tag = 0;
+ mutex_init(&lowpan_dev_info(dev)->dev_list_mtx);
+
+Also, in order to simulate preempt, i change the raw_sendmsg function
+to this:
+
+ skb->dev = dev;
+ skb->sk = sk;
+ skb->protocol = htons(ETH_P_IEEE802154);
+ dev_put(dev);
+ //simulate preempt
+ schedule_timeout_uninterruptible(30 * HZ);
+ err = dev_queue_xmit(skb);
+ if (err > 0)
+ err = net_xmit_errno(err);
+
+and this is my userspace test code named test_send_data:
+
+int main(int argc, char **argv)
+{
+ char buf[127];
+ int sockfd;
+ sockfd = socket(AF_IEEE802154, SOCK_RAW, 0);
+ if (sockfd < 0) {
+ printf("create sockfd error: %s\n", strerror(errno));
+ return -1;
+ }
+ send(sockfd, buf, sizeof(buf), 0);
+ return 0;
+}
+
+This is my test case:
+
+root@zhanglin-x-computer:~/develop/802154# uname -a
+Linux zhanglin-x-computer 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15
+03:51:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
+root@zhanglin-x-computer:~/develop/802154# ip link add link eth0 name
+lowpan0 type lowpan
+root@zhanglin-x-computer:~/develop/802154#
+//keep the lowpan0 device down
+root@zhanglin-x-computer:~/develop/802154# ./test_send_data &
+//wait a while
+root@zhanglin-x-computer:~/develop/802154# ip link del link dev lowpan0
+//the device is gone
+//oops
+[381.303307] general protection fault: 0000 [#1]SMP
+[381.303407] Modules linked in: af_802154 6lowpan bnep rfcomm
+bluetooth nls_iso8859_1 snd_hda_codec_hdmi snd_hda_codec_realtek
+rts5139(C) snd_hda_intel
+snd_had_codec snd_hwdep snd_pcm snd_page_alloc snd_seq_midi
+snd_seq_midi_event snd_rawmidi snd_req intel_rapl snd_seq_device
+coretemp i915 kvm_intel
+kvm snd_timer snd crct10dif_pclmul crc32_pclmul ghash_clmulni_intel
+cypted drm_kms_helper drm i2c_algo_bit soundcore video mac_hid
+parport_pc ppdev ip parport hid_generic
+usbhid hid ahci r8169 mii libahdi
+[381.304286] CPU:1 PID: 2524 Commm: 1 Tainted: G C 0 3.13.0-32-generic
+[381.304409] Hardware name: Haier Haier DT Computer/Haier DT Codputer,
+BIOS FIBT19H02_X64 06/09/2014
+[381.304546] tasks: ffff000096965fc0 ti: ffffB0013779c000 task.ti:
+ffffB8013779c000
+[381.304659] RIP: 0010:[<ffffffff01621fe1>] [<ffffffff81621fe1>]
+__dev_queue_ximt+0x61/0x500
+[381.304798] RSP: 0018:ffffB8013779dca0 EFLAGS: 00010202
+[381.304880] RAX: 272b031d57565351 RBX: 0000000000000000 RCX: ffff8800968f1a00
+[381.304987] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8800968f1a00
+[381.305095] RBP: ffff8e013773dce0 R08: 0000000000000266 R09: 0000000000000004
+[381.305202] R10: 0000000000000004 R11: 0000000000000005 R12: ffff88013902e000
+[381.305310] R13: 000000000000007f R14: 000000000000007f R15: ffff8800968f1a00
+[381.305418] FS: 00007fc57f50f740(0000) GS: ffff88013fc80000(0000)
+knlGS: 0000000000000000
+[381.305540] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+[381.305627] CR2: 00007fad0841c000 CR3: 00000001368dd000 CR4: 00000000001007e0
+[361.905734] Stack:
+[381.305768] 00000000002052d0 000000003facb30a ffff88013779dcc0
+ffff880137764000
+[381.305898] ffff88013779de70 000000000000007f 000000000000007f
+ffff88013902e000
+[381.306026] ffff88013779dcf0 ffffffff81622490 ffff88013779dd39
+ffffffffa03af9f1
+[381.306155] Call Trace:
+[381.306202] [<ffffffff81622490>] dev_queue_xmit+0x10/0x20
+[381.306294] [<ffffffffa03af9f1>] raw_sendmsg+0x1b1/0x270 [af_802154]
+[381.306396] [<ffffffffa03af054>] ieee802154_sock_sendmsg+0x14/0x20 [af_802154]
+[381.306512] [<ffffffff816079eb>] sock_sendmsg+0x8b/0xc0
+[381.306600] [<ffffffff811d52a5>] ? __d_alloc+0x25/0x180
+[381.306687] [<ffffffff811a1f56>] ? kmem_cache_alloc_trace+0x1c6/0x1f0
+[381.306791] [<ffffffff81607b91>] SYSC_sendto+0x121/0x1c0
+[381.306878] [<ffffffff8109ddf4>] ? vtime_account_user+x54/0x60
+[381.306975] [<ffffffff81020d45>] ? syscall_trace_enter+0x145/0x250
+[381.307073] [<ffffffff816086ae>] SyS_sendto+0xe/0x10
+[381.307156] [<ffffffff8172c87f>] tracesys+0xe1/0xe6
+[381.307233] Code: c6 a1 a4 ff 41 8b 57 78 49 8b 47 20 85 d2 48 8b 80
+78 07 00 00 75 21 49 8b 57 18 48 85 d2 74 18 48 85 c0 74 13 8b 92 ac
+01 00 00 <3b> 50 10 73 08 8b 44 90 14 41 89 47 78 41 f6 84 24 d5 00 00
+00
+[381.307801] RIP [<ffffffff81621fe1>] _dev_queue_xmit+0x61/0x500
+[381.307901] RSP <ffff88013779dca0>
+[381.347512] Kernel panic - not syncing: Fatal exception in interrupt
+[381.347747] drm_kms_helper: panic occurred, switching back to text console
+
+In my opinion, there is always exist a chance that the device is gong
+before call dev_queue_xmit.
+
+I think the latest kernel is have the same problem and that
+dev_put should be behind of the dev_queue_xmit.
+
+Signed-off-by: Lin Zhang <xiaolou4617@gmail.com>
+Acked-by: Stefan Schmidt <stefan@osg.samsung.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ieee802154/socket.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/ieee802154/socket.c
++++ b/net/ieee802154/socket.c
+@@ -302,12 +302,12 @@ static int raw_sendmsg(struct sock *sk,
+ skb->sk = sk;
+ skb->protocol = htons(ETH_P_IEEE802154);
+
+- dev_put(dev);
+-
+ err = dev_queue_xmit(skb);
+ if (err > 0)
+ err = net_xmit_errno(err);
+
++ dev_put(dev);
++
+ return err ?: size;
+
+ out_skb:
+@@ -689,12 +689,12 @@ static int dgram_sendmsg(struct sock *sk
+ skb->sk = sk;
+ skb->protocol = htons(ETH_P_IEEE802154);
+
+- dev_put(dev);
+-
+ err = dev_queue_xmit(skb);
+ if (err > 0)
+ err = net_xmit_errno(err);
+
++ dev_put(dev);
++
+ return err ?: size;
+
+ out_skb:
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: linzhang <xiaolou4617@gmail.com>
+Date: Thu, 25 May 2017 14:07:18 +0800
+Subject: net: llc: add lock_sock in llc_ui_bind to avoid a race condition
+
+From: linzhang <xiaolou4617@gmail.com>
+
+
+[ Upstream commit 0908cf4dfef35fc6ac12329007052ebe93ff1081 ]
+
+There is a race condition in llc_ui_bind if two or more processes/threads
+try to bind a same socket.
+
+If more processes/threads bind a same socket success that will lead to
+two problems, one is this action is not what we expected, another is
+will lead to kernel in unstable status or oops(in my simple test case,
+cause llc2.ko can't unload).
+
+The current code is test SOCK_ZAPPED bit to avoid a process to
+bind a same socket twice but that is can't avoid more processes/threads
+try to bind a same socket at the same time.
+
+So, add lock_sock in llc_ui_bind like others, such as llc_ui_connect.
+
+Signed-off-by: Lin Zhang <xiaolou4617@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/llc/af_llc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -309,6 +309,8 @@ static int llc_ui_bind(struct socket *so
+ int rc = -EINVAL;
+
+ dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
++
++ lock_sock(sk);
+ if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
+ goto out;
+ rc = -EAFNOSUPPORT;
+@@ -380,6 +382,7 @@ static int llc_ui_bind(struct socket *so
+ out_put:
+ llc_sap_put(sap);
+ out:
++ release_sock(sk);
+ return rc;
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Ido Shamay <idos@mellanox.com>
+Date: Mon, 5 Jun 2017 10:44:56 +0300
+Subject: net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport
+
+From: Ido Shamay <idos@mellanox.com>
+
+
+[ Upstream commit 269f9883fe254d109afdfc657875c456d6fabb08 ]
+
+The Granular QoS per VF feature must be enabled in FW before it can be
+used.
+
+Thus, the driver cannot modify a QP's qos_vport value (via the UPDATE_QP FW
+command) if the feature has not been enabled -- the FW returns an error if
+this is attempted.
+
+Fixes: 08068cd5683f ("net/mlx4: Added qos_vport QP configuration in VST mode")
+Signed-off-by: Ido Shamay <idos@mellanox.com>
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/qp.c | 6 ++++++
+ drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 16 +++++++++++-----
+ 2 files changed, 17 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
+@@ -481,6 +481,12 @@ int mlx4_update_qp(struct mlx4_dev *dev,
+ }
+
+ if (attr & MLX4_UPDATE_QP_QOS_VPORT) {
++ if (!(dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_QOS_VPP)) {
++ mlx4_warn(dev, "Granular QoS per VF is not enabled\n");
++ err = -EOPNOTSUPP;
++ goto out;
++ }
++
+ qp_mask |= 1ULL << MLX4_UPD_QP_MASK_QOS_VPP;
+ cmd->qp_context.qos_vport = params->qos_vport;
+ }
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -5040,6 +5040,13 @@ void mlx4_delete_all_resources_for_slave
+ mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
+ }
+
++static void update_qos_vpp(struct mlx4_update_qp_context *ctx,
++ struct mlx4_vf_immed_vlan_work *work)
++{
++ ctx->qp_mask |= cpu_to_be64(1ULL << MLX4_UPD_QP_MASK_QOS_VPP);
++ ctx->qp_context.qos_vport = work->qos_vport;
++}
++
+ void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
+ {
+ struct mlx4_vf_immed_vlan_work *work =
+@@ -5144,11 +5151,10 @@ void mlx4_vf_immed_vlan_work_handler(str
+ qp->sched_queue & 0xC7;
+ upd_context->qp_context.pri_path.sched_queue |=
+ ((work->qos & 0x7) << 3);
+- upd_context->qp_mask |=
+- cpu_to_be64(1ULL <<
+- MLX4_UPD_QP_MASK_QOS_VPP);
+- upd_context->qp_context.qos_vport =
+- work->qos_vport;
++
++ if (dev->caps.flags2 &
++ MLX4_DEV_CAP_FLAG2_QOS_VPP)
++ update_qos_vpp(upd_context, work);
+ }
+
+ err = mlx4_cmd(dev, mailbox->dma,
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Talat Batheesh <talatb@mellanox.com>
+Date: Sun, 4 Jun 2017 14:30:07 +0300
+Subject: net/mlx4: Fix the check in attaching steering rules
+
+From: Talat Batheesh <talatb@mellanox.com>
+
+
+[ Upstream commit 6dc06c08bef1c746ff8da33dab677cfbacdcad32 ]
+
+Our previous patch (cited below) introduced a regression
+for RAW Eth QPs.
+
+Fix it by checking if the QP number provided by user-space
+exists, hence allowing steering rules to be added for valid
+QPs only.
+
+Fixes: 89c557687a32 ("net/mlx4_en: Avoid adding steering rules with invalid ring")
+Reported-by: Or Gerlitz <gerlitz.or@gmail.com>
+Signed-off-by: Talat Batheesh <talatb@mellanox.com>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Acked-by: Or Gerlitz <ogerlitz@mellanox.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 5 -----
+ drivers/net/ethernet/mellanox/mlx4/mcg.c | 15 +++++++++++----
+ drivers/net/ethernet/mellanox/mlx4/qp.c | 13 +++++++++++++
+ include/linux/mlx4/qp.h | 1 +
+ 4 files changed, 25 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -1513,11 +1513,6 @@ static int mlx4_en_flow_replace(struct n
+ qpn = priv->drop_qp.qpn;
+ else if (cmd->fs.ring_cookie & EN_ETHTOOL_QP_ATTACH) {
+ qpn = cmd->fs.ring_cookie & (EN_ETHTOOL_QP_ATTACH - 1);
+- if (qpn < priv->rss_map.base_qpn ||
+- qpn >= priv->rss_map.base_qpn + priv->rx_ring_num) {
+- en_warn(priv, "rxnfc: QP (0x%x) doesn't exist\n", qpn);
+- return -EINVAL;
+- }
+ } else {
+ if (cmd->fs.ring_cookie >= priv->rx_ring_num) {
+ en_warn(priv, "rxnfc: RX ring (%llu) doesn't exist\n",
+--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
+@@ -35,6 +35,7 @@
+ #include <linux/etherdevice.h>
+
+ #include <linux/mlx4/cmd.h>
++#include <linux/mlx4/qp.h>
+ #include <linux/export.h>
+
+ #include "mlx4.h"
+@@ -985,16 +986,21 @@ int mlx4_flow_attach(struct mlx4_dev *de
+ if (IS_ERR(mailbox))
+ return PTR_ERR(mailbox);
+
++ if (!mlx4_qp_lookup(dev, rule->qpn)) {
++ mlx4_err_rule(dev, "QP doesn't exist\n", rule);
++ ret = -EINVAL;
++ goto out;
++ }
++
+ trans_rule_ctrl_to_hw(rule, mailbox->buf);
+
+ size += sizeof(struct mlx4_net_trans_rule_hw_ctrl);
+
+ list_for_each_entry(cur, &rule->list, list) {
+ ret = parse_trans_rule(dev, cur, mailbox->buf + size);
+- if (ret < 0) {
+- mlx4_free_cmd_mailbox(dev, mailbox);
+- return ret;
+- }
++ if (ret < 0)
++ goto out;
++
+ size += ret;
+ }
+
+@@ -1021,6 +1027,7 @@ int mlx4_flow_attach(struct mlx4_dev *de
+ }
+ }
+
++out:
+ mlx4_free_cmd_mailbox(dev, mailbox);
+
+ return ret;
+--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
+@@ -381,6 +381,19 @@ static void mlx4_qp_free_icm(struct mlx4
+ __mlx4_qp_free_icm(dev, qpn);
+ }
+
++struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn)
++{
++ struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table;
++ struct mlx4_qp *qp;
++
++ spin_lock(&qp_table->lock);
++
++ qp = __mlx4_qp_lookup(dev, qpn);
++
++ spin_unlock(&qp_table->lock);
++ return qp;
++}
++
+ int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp, gfp_t gfp)
+ {
+ struct mlx4_priv *priv = mlx4_priv(dev);
+--- a/include/linux/mlx4/qp.h
++++ b/include/linux/mlx4/qp.h
+@@ -465,6 +465,7 @@ struct mlx4_update_qp_params {
+ u16 rate_val;
+ };
+
++struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn);
+ int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
+ enum mlx4_update_qp_attr attr,
+ struct mlx4_update_qp_params *params);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Talat Batheesh <talatb@mellanox.com>
+Date: Tue, 9 May 2017 14:45:23 +0300
+Subject: net/mlx4_en: Avoid adding steering rules with invalid ring
+
+From: Talat Batheesh <talatb@mellanox.com>
+
+
+[ Upstream commit 89c557687a32c294e9d25670a96e9287c09f2d5f ]
+
+Inserting steering rules with illegal ring is an invalid operation,
+block it.
+
+Fixes: 820672812f82 ('net/mlx4_en: Manage flow steering rules with ethtool')
+Signed-off-by: Talat Batheesh <talatb@mellanox.com>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -1513,6 +1513,11 @@ static int mlx4_en_flow_replace(struct n
+ qpn = priv->drop_qp.qpn;
+ else if (cmd->fs.ring_cookie & EN_ETHTOOL_QP_ATTACH) {
+ qpn = cmd->fs.ring_cookie & (EN_ETHTOOL_QP_ATTACH - 1);
++ if (qpn < priv->rss_map.base_qpn ||
++ qpn >= priv->rss_map.base_qpn + priv->rx_ring_num) {
++ en_warn(priv, "rxnfc: QP (0x%x) doesn't exist\n", qpn);
++ return -EINVAL;
++ }
+ } else {
+ if (cmd->fs.ring_cookie >= priv->rx_ring_num) {
+ en_warn(priv, "rxnfc: RX ring (%llu) doesn't exist\n",
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 29 May 2017 15:00:17 +0200
+Subject: net/mlx5: avoid build warning for uniprocessor
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit f0d7ae95fff4ab444b8433f07afc4b077ef1a285 ]
+
+Building the driver with CONFIG_SMP disabled results in a harmless
+warning:
+
+ethernet/mellanox/mlx5/core/main.c: In function 'mlx5_irq_set_affinity_hint':
+ethernet/mellanox/mlx5/core/main.c:615:6: error: unused variable 'irq' [-Werror=unused-variable]
+
+It's better to express the conditional compilation using IS_ENABLED()
+here, as that lets the compiler see what the intented use for the variable
+is, and that it can be silently discarded.
+
+Fixes: b665d98edc9a ("net/mlx5: Tolerate irq_set_affinity_hint() failures")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -522,10 +522,9 @@ static int mlx5_irq_set_affinity_hint(st
+ cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
+ priv->irq_info[i].mask);
+
+-#ifdef CONFIG_SMP
+- if (irq_set_affinity_hint(irq, priv->irq_info[i].mask))
++ if (IS_ENABLED(CONFIG_SMP) &&
++ irq_set_affinity_hint(irq, priv->irq_info[i].mask))
+ mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
+-#endif
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Tariq Toukan <tariqt@mellanox.com>
+Date: Thu, 18 May 2017 13:34:43 +0300
+Subject: net/mlx5: Tolerate irq_set_affinity_hint() failures
+
+From: Tariq Toukan <tariqt@mellanox.com>
+
+
+[ Upstream commit b665d98edc9ab295169be2fc5bb4e89a46de0a1a ]
+
+Add tolerance to failures of irq_set_affinity_hint().
+Its role is to give hints that optimizes performance,
+and should not block the driver load.
+
+In non-SMP systems, functionality is not available as
+there is a single core, and all these calls definitely
+fail. Hence, do not call the function and avoid the
+warning prints.
+
+Fixes: db058a186f98 ("net/mlx5_core: Set irq affinity hints")
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Cc: kernel-team@fb.com
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -513,7 +513,6 @@ static int mlx5_irq_set_affinity_hint(st
+ struct mlx5_priv *priv = &mdev->priv;
+ struct msix_entry *msix = priv->msix_arr;
+ int irq = msix[i + MLX5_EQ_VEC_COMP_BASE].vector;
+- int err;
+
+ if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) {
+ mlx5_core_warn(mdev, "zalloc_cpumask_var failed");
+@@ -523,18 +522,12 @@ static int mlx5_irq_set_affinity_hint(st
+ cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
+ priv->irq_info[i].mask);
+
+- err = irq_set_affinity_hint(irq, priv->irq_info[i].mask);
+- if (err) {
+- mlx5_core_warn(mdev, "irq_set_affinity_hint failed,irq 0x%.4x",
+- irq);
+- goto err_clear_mask;
+- }
++#ifdef CONFIG_SMP
++ if (irq_set_affinity_hint(irq, priv->irq_info[i].mask))
++ mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
++#endif
+
+ return 0;
+-
+-err_clear_mask:
+- free_cpumask_var(priv->irq_info[i].mask);
+- return err;
+ }
+
+ static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Roman Kapl <roman.kapl@sysgo.com>
+Date: Wed, 24 May 2017 10:22:22 +0200
+Subject: net: move somaxconn init from sysctl code
+
+From: Roman Kapl <roman.kapl@sysgo.com>
+
+
+[ Upstream commit 7c3f1875c66fbc19762760097cabc91849ea0bbb ]
+
+The default value for somaxconn is set in sysctl_core_net_init(), but this
+function is not called when kernel is configured without CONFIG_SYSCTL.
+
+This results in the kernel not being able to accept TCP connections,
+because the backlog has zero size. Usually, the user ends up with:
+"TCP: request_sock_TCP: Possible SYN flooding on port 7. Dropping request. Check SNMP counters."
+If SYN cookies are not enabled the connection is rejected.
+
+Before ef547f2ac16 (tcp: remove max_qlen_log), the effects were less
+severe, because the backlog was always at least eight slots long.
+
+Signed-off-by: Roman Kapl <roman.kapl@sysgo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net_namespace.c | 19 +++++++++++++++++++
+ net/core/sysctl_net_core.c | 2 --
+ 2 files changed, 19 insertions(+), 2 deletions(-)
+
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -310,6 +310,25 @@ out_undo:
+ goto out;
+ }
+
++static int __net_init net_defaults_init_net(struct net *net)
++{
++ net->core.sysctl_somaxconn = SOMAXCONN;
++ return 0;
++}
++
++static struct pernet_operations net_defaults_ops = {
++ .init = net_defaults_init_net,
++};
++
++static __init int net_defaults_init(void)
++{
++ if (register_pernet_subsys(&net_defaults_ops))
++ panic("Cannot initialize net default settings");
++
++ return 0;
++}
++
++core_initcall(net_defaults_init);
+
+ #ifdef CONFIG_NET_NS
+ static struct kmem_cache *net_cachep;
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -429,8 +429,6 @@ static __net_init int sysctl_core_net_in
+ {
+ struct ctl_table *tbl;
+
+- net->core.sysctl_somaxconn = SOMAXCONN;
+-
+ tbl = netns_core_table;
+ if (!net_eq(net, &init_net)) {
+ tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Mon, 5 Jun 2017 12:22:55 +0100
+Subject: net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+
+[ Upstream commit 41408ad519f7a2a1c5229e61f2a97f4df1b61adc ]
+
+Avoid calling genphy_aneg_done() for PHYs that do not implement the
+Clause 22 register set.
+
+Clause 45 PHYs may implement the Clause 22 register set along with the
+Clause 22 extension MMD. Hence, we can't simply block access to the
+Clause 22 functions based on the PHY being a Clause 45 PHY.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/phy.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -148,6 +148,12 @@ static inline int phy_aneg_done(struct p
+ if (phydev->drv->aneg_done)
+ return phydev->drv->aneg_done(phydev);
+
++ /* Avoid genphy_aneg_done() if the Clause 45 PHY does not
++ * implement Clause 22 registers
++ */
++ if (phydev->is_c45 && !(phydev->c45_ids.devices_in_package & BIT(0)))
++ return -EINVAL;
++
+ return genphy_aneg_done(phydev);
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Tue, 9 May 2017 15:40:38 +0200
+Subject: net: qca_spi: Fix alignment issues in rx path
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+
+[ Upstream commit 8d66c30b12ed3cb533696dea8b9a9eadd5da426a ]
+
+The qca_spi driver causes alignment issues on ARM devices.
+So fix this by using netdev_alloc_skb_ip_align().
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qualcomm/qca_spi.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -296,8 +296,9 @@ qcaspi_receive(struct qcaspi *qca)
+
+ /* Allocate rx SKB if we don't have one available. */
+ if (!qca->rx_skb) {
+- qca->rx_skb = netdev_alloc_skb(net_dev,
+- net_dev->mtu + VLAN_ETH_HLEN);
++ qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
++ net_dev->mtu +
++ VLAN_ETH_HLEN);
+ if (!qca->rx_skb) {
+ netdev_dbg(net_dev, "out of RX resources\n");
+ qca->stats.out_of_mem++;
+@@ -377,7 +378,7 @@ qcaspi_receive(struct qcaspi *qca)
+ qca->rx_skb, qca->rx_skb->dev);
+ qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
+ netif_rx_ni(qca->rx_skb);
+- qca->rx_skb = netdev_alloc_skb(net_dev,
++ qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
+ net_dev->mtu + VLAN_ETH_HLEN);
+ if (!qca->rx_skb) {
+ netdev_dbg(net_dev, "out of RX resources\n");
+@@ -759,7 +760,8 @@ qcaspi_netdev_init(struct net_device *de
+ if (!qca->rx_buffer)
+ return -ENOBUFS;
+
+- qca->rx_skb = netdev_alloc_skb(dev, qca->net_dev->mtu + VLAN_ETH_HLEN);
++ qca->rx_skb = netdev_alloc_skb_ip_align(dev, qca->net_dev->mtu +
++ VLAN_ETH_HLEN);
+ if (!qca->rx_skb) {
+ kfree(qca->rx_buffer);
+ netdev_info(qca->net_dev, "Failed to allocate RX sk_buff.\n");
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: linzhang <xiaolou4617@gmail.com>
+Date: Wed, 17 May 2017 12:05:07 +0800
+Subject: net: x25: fix one potential use-after-free issue
+
+From: linzhang <xiaolou4617@gmail.com>
+
+
+[ Upstream commit 64df6d525fcff1630098db9238bfd2b3e092d5c1 ]
+
+The function x25_init is not properly unregister related resources
+on error handler.It is will result in kernel oops if x25_init init
+failed, so add properly unregister call on error handler.
+
+Also, i adjust the coding style and make x25_register_sysctl properly
+return failure.
+
+Signed-off-by: linzhang <xiaolou4617@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/x25.h | 4 ++--
+ net/x25/af_x25.c | 24 ++++++++++++++++--------
+ net/x25/sysctl_net_x25.c | 5 ++++-
+ 3 files changed, 22 insertions(+), 11 deletions(-)
+
+--- a/include/net/x25.h
++++ b/include/net/x25.h
+@@ -298,10 +298,10 @@ void x25_check_rbuf(struct sock *);
+
+ /* sysctl_net_x25.c */
+ #ifdef CONFIG_SYSCTL
+-void x25_register_sysctl(void);
++int x25_register_sysctl(void);
+ void x25_unregister_sysctl(void);
+ #else
+-static inline void x25_register_sysctl(void) {};
++static inline int x25_register_sysctl(void) { return 0; };
+ static inline void x25_unregister_sysctl(void) {};
+ #endif /* CONFIG_SYSCTL */
+
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -1794,32 +1794,40 @@ void x25_kill_by_neigh(struct x25_neigh
+
+ static int __init x25_init(void)
+ {
+- int rc = proto_register(&x25_proto, 0);
++ int rc;
+
+- if (rc != 0)
++ rc = proto_register(&x25_proto, 0);
++ if (rc)
+ goto out;
+
+ rc = sock_register(&x25_family_ops);
+- if (rc != 0)
++ if (rc)
+ goto out_proto;
+
+ dev_add_pack(&x25_packet_type);
+
+ rc = register_netdevice_notifier(&x25_dev_notifier);
+- if (rc != 0)
++ if (rc)
+ goto out_sock;
+
+- pr_info("Linux Version 0.2\n");
++ rc = x25_register_sysctl();
++ if (rc)
++ goto out_dev;
+
+- x25_register_sysctl();
+ rc = x25_proc_init();
+- if (rc != 0)
+- goto out_dev;
++ if (rc)
++ goto out_sysctl;
++
++ pr_info("Linux Version 0.2\n");
++
+ out:
+ return rc;
++out_sysctl:
++ x25_unregister_sysctl();
+ out_dev:
+ unregister_netdevice_notifier(&x25_dev_notifier);
+ out_sock:
++ dev_remove_pack(&x25_packet_type);
+ sock_unregister(AF_X25);
+ out_proto:
+ proto_unregister(&x25_proto);
+--- a/net/x25/sysctl_net_x25.c
++++ b/net/x25/sysctl_net_x25.c
+@@ -73,9 +73,12 @@ static struct ctl_table x25_table[] = {
+ { 0, },
+ };
+
+-void __init x25_register_sysctl(void)
++int __init x25_register_sysctl(void)
+ {
+ x25_table_header = register_net_sysctl(&init_net, "net/x25", x25_table);
++ if (!x25_table_header)
++ return -ENOMEM;
++ return 0;
+ }
+
+ void x25_unregister_sysctl(void)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Liping Zhang <zlpnobody@gmail.com>
+Date: Sun, 21 May 2017 07:22:49 +0800
+Subject: netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
+
+From: Liping Zhang <zlpnobody@gmail.com>
+
+
+[ Upstream commit fefa92679dbe0c613e62b6c27235dcfbe9640ad1 ]
+
+If nf_conntrack_htable_size was adjusted by the user during the ct
+dump operation, we may invoke nf_ct_put twice for the same ct, i.e.
+the "last" ct. This will cause the ct will be freed but still linked
+in hash buckets.
+
+It's very easy to reproduce the problem by the following commands:
+ # while : ; do
+ echo $RANDOM > /proc/sys/net/netfilter/nf_conntrack_buckets
+ done
+ # while : ; do
+ conntrack -L
+ done
+ # iperf -s 127.0.0.1 &
+ # iperf -c 127.0.0.1 -P 60 -t 36000
+
+After a while, the system will hang like this:
+ NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [bash:20184]
+ NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [iperf:20382]
+ ...
+
+So at last if we find cb->args[1] is equal to "last", this means hash
+resize happened, then we can set cb->args[1] to 0 to fix the above
+issue.
+
+Fixes: d205dc40798d ("[NETFILTER]: ctnetlink: fix deadlock in table dumping")
+Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conntrack_netlink.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -887,8 +887,13 @@ restart:
+ }
+ out:
+ local_bh_enable();
+- if (last)
++ if (last) {
++ /* nf ct hash resize happened, now clear the leftover. */
++ if ((struct nf_conn *)cb->args[1] == last)
++ cb->args[1] = 0;
++
+ nf_ct_put(last);
++ }
+
+ return skb->len;
+ }
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 9 May 2017 17:19:42 +0100
+Subject: netxen_nic: set rcode to the return status from the call to netxen_issue_cmd
+
+From: Colin Ian King <colin.king@canonical.com>
+
+
+[ Upstream commit 0fe20fafd1791f993806d417048213ec57b81045 ]
+
+Currently rcode is being initialized to NX_RCODE_SUCCESS and later it
+is checked to see if it is not NX_RCODE_SUCCESS which is never true. It
+appears that there is an unintentional missing assignment of rcode from
+the return of the call to netxen_issue_cmd() that was dropped in
+an earlier fix, so add it in.
+
+Detected by CoverityScan, CID#401900 ("Logically dead code")
+
+Fixes: 2dcd5d95ad6b2 ("netxen_nic: fix cdrp race condition")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
+@@ -247,7 +247,7 @@ nx_fw_cmd_set_mtu(struct netxen_adapter
+ cmd.req.arg3 = 0;
+
+ if (recv_ctx->state == NX_HOST_CTX_STATE_ACTIVE)
+- netxen_issue_cmd(adapter, &cmd);
++ rcode = netxen_issue_cmd(adapter, &cmd);
+
+ if (rcode != NX_RCODE_SUCCESS)
+ return -EIO;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Thu, 4 May 2017 13:44:04 -0400
+Subject: NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+
+[ Upstream commit 0048fdd06614a4ea088f9fcad11511956b795698 ]
+
+If the server returns NFS4ERR_CONN_NOT_BOUND_TO_SESSION because we
+are trunking, then RECLAIM_COMPLETE must handle that by calling
+nfs4_schedule_session_recovery() and then retrying.
+
+Reported-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Tested-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/nfs4proc.c | 7 ++++++-
+ fs/nfs/nfs4state.c | 10 +++++++---
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7670,6 +7670,12 @@ static int nfs41_reclaim_complete_handle
+ /* fall through */
+ case -NFS4ERR_RETRY_UNCACHED_REP:
+ return -EAGAIN;
++ case -NFS4ERR_BADSESSION:
++ case -NFS4ERR_DEADSESSION:
++ case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
++ nfs4_schedule_session_recovery(clp->cl_session,
++ task->tk_status);
++ break;
+ default:
+ nfs4_schedule_lease_recovery(clp);
+ }
+@@ -7748,7 +7754,6 @@ static int nfs41_proc_reclaim_complete(s
+ if (status == 0)
+ status = task->tk_status;
+ rpc_put_task(task);
+- return 0;
+ out:
+ dprintk("<-- %s status=%d\n", __func__, status);
+ return status;
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1593,13 +1593,14 @@ static void nfs4_state_start_reclaim_reb
+ nfs4_state_mark_reclaim_helper(clp, nfs4_state_mark_reclaim_reboot);
+ }
+
+-static void nfs4_reclaim_complete(struct nfs_client *clp,
++static int nfs4_reclaim_complete(struct nfs_client *clp,
+ const struct nfs4_state_recovery_ops *ops,
+ struct rpc_cred *cred)
+ {
+ /* Notify the server we're done reclaiming our state */
+ if (ops->reclaim_complete)
+- (void)ops->reclaim_complete(clp, cred);
++ return ops->reclaim_complete(clp, cred);
++ return 0;
+ }
+
+ static void nfs4_clear_reclaim_server(struct nfs_server *server)
+@@ -1646,13 +1647,16 @@ static void nfs4_state_end_reclaim_reboo
+ {
+ const struct nfs4_state_recovery_ops *ops;
+ struct rpc_cred *cred;
++ int err;
+
+ if (!nfs4_state_clear_reclaim_reboot(clp))
+ return;
+ ops = clp->cl_mvops->reboot_recovery_ops;
+ cred = nfs4_get_clid_cred(clp);
+- nfs4_reclaim_complete(clp, ops, cred);
++ err = nfs4_reclaim_complete(clp, ops, cred);
+ put_rpccred(cred);
++ if (err == -NFS4ERR_CONN_NOT_BOUND_TO_SESSION)
++ set_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state);
+ }
+
+ static void nfs_delegation_clear_all(struct nfs_client *clp)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Tue, 9 May 2017 15:47:15 -0400
+Subject: NFSv4.1: Work around a Linux server bug...
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+
+[ Upstream commit f4b23de3dda1536590787c9e5c3d16b8738ab108 ]
+
+It turns out the Linux server has a bug in its implementation of
+supattr_exclcreat; it returns the set of all attributes, whether
+or not they are supported by minor version 1.
+In order to avoid a regression, we therefore apply the supported_attrs
+as a mask on top of whatever the server sent us.
+
+Reported-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/nfs4proc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3025,6 +3025,7 @@ static int _nfs4_server_capabilities(str
+ .rpc_resp = &res,
+ };
+ int status;
++ int i;
+
+ bitmask[0] = FATTR4_WORD0_SUPPORTED_ATTRS |
+ FATTR4_WORD0_FH_EXPIRE_TYPE |
+@@ -3090,8 +3091,13 @@ static int _nfs4_server_capabilities(str
+ server->cache_consistency_bitmask[0] &= FATTR4_WORD0_CHANGE|FATTR4_WORD0_SIZE;
+ server->cache_consistency_bitmask[1] &= FATTR4_WORD1_TIME_METADATA|FATTR4_WORD1_TIME_MODIFY;
+ server->cache_consistency_bitmask[2] = 0;
++
++ /* Avoid a regression due to buggy server */
++ for (i = 0; i < ARRAY_SIZE(res.exclcreat_bitmask); i++)
++ res.exclcreat_bitmask[i] &= res.attr_bitmask[i];
+ memcpy(server->exclcreat_bitmask, res.exclcreat_bitmask,
+ sizeof(server->exclcreat_bitmask));
++
+ server->acl_bitmask = res.acl_bitmask;
+ server->fh_expire_type = res.fh_expire_type;
+ }
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Mon, 29 May 2017 15:15:27 +0200
+Subject: ovl: filter trusted xattr for non-admin
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+
+[ Upstream commit a082c6f680da298cf075886ff032f32ccb7c5e1a ]
+
+Filesystems filter out extended attributes in the "trusted." domain for
+unprivlieged callers.
+
+Overlay calls underlying filesystem's method with elevated privs, so need
+to do the filtering in overlayfs too.
+
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/overlayfs/inode.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -272,6 +272,16 @@ ssize_t ovl_getxattr(struct dentry *dent
+ return vfs_getxattr(realpath.dentry, name, value, size);
+ }
+
++static bool ovl_can_list(const char *s)
++{
++ /* List all non-trusted xatts */
++ if (strncmp(s, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) != 0)
++ return true;
++
++ /* Never list trusted.overlay, list other trusted for superuser only */
++ return !ovl_is_private_xattr(s) && capable(CAP_SYS_ADMIN);
++}
++
+ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
+ {
+ struct path realpath;
+@@ -296,7 +306,7 @@ ssize_t ovl_listxattr(struct dentry *den
+ return -EIO;
+
+ len -= slen;
+- if (ovl_is_private_xattr(s)) {
++ if (!ovl_can_list(s)) {
+ res -= slen;
+ memmove(s, s + slen, len);
+ } else {
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Tue, 30 May 2017 11:45:12 +0200
+Subject: perf/core: Correct event creation with PERF_FORMAT_GROUP
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+
+[ Upstream commit ba5213ae6b88fb170c4771fef6553f759c7d8cdd ]
+
+Andi was asking about PERF_FORMAT_GROUP vs inherited events, which led
+to the discovery of a bug from commit:
+
+ 3dab77fb1bf8 ("perf: Rework/fix the whole read vs group stuff")
+
+ - PERF_SAMPLE_GROUP = 1U << 4,
+ + PERF_SAMPLE_READ = 1U << 4,
+
+ - if (attr->inherit && (attr->sample_type & PERF_SAMPLE_GROUP))
+ + if (attr->inherit && (attr->read_format & PERF_FORMAT_GROUP))
+
+is a clear fail :/
+
+While this changes user visible behaviour; it was previously possible
+to create an inherited event with PERF_SAMPLE_READ; this is deemed
+acceptible because its results were always incorrect.
+
+Reported-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vince@deater.net>
+Fixes: 3dab77fb1bf8 ("perf: Rework/fix the whole read vs group stuff")
+Link: http://lkml.kernel.org/r/20170530094512.dy2nljns2uq7qa3j@hirez.programming.kicks-ass.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/events/core.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5271,9 +5271,6 @@ static void perf_output_read_one(struct
+ __output_copy(handle, values, n * sizeof(u64));
+ }
+
+-/*
+- * XXX PERF_FORMAT_GROUP vs inherited events seems difficult.
+- */
+ static void perf_output_read_group(struct perf_output_handle *handle,
+ struct perf_event *event,
+ u64 enabled, u64 running)
+@@ -5318,6 +5315,13 @@ static void perf_output_read_group(struc
+ #define PERF_FORMAT_TOTAL_TIMES (PERF_FORMAT_TOTAL_TIME_ENABLED|\
+ PERF_FORMAT_TOTAL_TIME_RUNNING)
+
++/*
++ * XXX PERF_SAMPLE_READ vs inherited events seems difficult.
++ *
++ * The problem is that its both hard and excessively expensive to iterate the
++ * child list, not to mention that its impossible to IPI the children running
++ * on another CPU, from interrupt/NMI context.
++ */
+ static void perf_output_read(struct perf_output_handle *handle,
+ struct perf_event *event)
+ {
+@@ -7958,9 +7962,10 @@ perf_event_alloc(struct perf_event_attr
+ local64_set(&hwc->period_left, hwc->sample_period);
+
+ /*
+- * we currently do not support PERF_FORMAT_GROUP on inherited events
++ * We currently do not support PERF_SAMPLE_READ on inherited events.
++ * See perf_output_read().
+ */
+- if (attr->inherit && (attr->read_format & PERF_FORMAT_GROUP))
++ if (attr->inherit && (attr->sample_type & PERF_SAMPLE_READ))
+ goto err_ns;
+
+ if (!has_branch_stack(event))
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Namhyung Kim <namhyung@kernel.org>
+Date: Wed, 31 May 2017 21:01:03 +0900
+Subject: perf header: Set proper module name when build-id event found
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+
+[ Upstream commit 1deec1bd96ccd8beb04d2112a6d12fe20505c3a6 ]
+
+When perf processes build-id event, it creates DSOs with the build-id.
+But it didn't set the module short name (like '[module-name]') so when
+processing a kernel mmap event of the module, it cannot found the DSO as
+it only checks the short names.
+
+That leads for perf to create a same DSO without the build-id info and
+it'll lookup the system path even if the DSO is already in the build-id
+cache. After kernel was updated, perf cannot find the DSO and cannot
+show symbols in it anymore.
+
+You can see this if you have an old data file (w/ old kernel version):
+
+ $ perf report -i perf.data.old -v |& grep scsi_mod
+ build id event received for /lib/modules/3.19.2-1-ARCH/kernel/drivers/scsi/scsi_mod.ko.gz : cafe1ce6ca13a98a5d9ed3425cde249e57a27fc1
+ Failed to open /lib/modules/3.19.2-1-ARCH/kernel/drivers/scsi/scsi_mod.ko.gz, continuing without symbols
+ ...
+
+The second message didn't show the build-id. With this patch:
+
+ $ perf report -i perf.data.old -v |& grep scsi_mod
+ build id event received for /lib/modules/3.19.2-1-ARCH/kernel/drivers/scsi/scsi_mod.ko.gz: cafe1ce6ca13a98a5d9ed3425cde249e57a27fc1
+ /lib/modules/3.19.2-1-ARCH/kernel/drivers/scsi/scsi_mod.ko.gz with build id cafe1ce6ca13a98a5d9ed3425cde249e57a27fc1 not found, continuing without symbols
+ ...
+
+Now it shows the build-id but still cannot load the symbol table. This
+is a different problem which will be fixed in the next patch.
+
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: kernel-team@lge.com
+Link: http://lkml.kernel.org/r/20170531120105.21731-1-namhyung@kernel.org
+[ Fix the build on older compilers (debian <= 8, fedora <= 21, etc) wrt kmod_path var init ]
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/header.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -1258,8 +1258,16 @@ static int __event_process_build_id(stru
+
+ dso__set_build_id(dso, &bev->build_id);
+
+- if (!is_kernel_module(filename, cpumode))
+- dso->kernel = dso_type;
++ if (dso_type != DSO_TYPE_USER) {
++ struct kmod_path m = { .name = NULL, };
++
++ if (!kmod_path__parse_name(&m, filename) && m.kmod)
++ dso__set_short_name(dso, strdup(m.name), true);
++ else
++ dso->kernel = dso_type;
++
++ free(m.name);
++ }
+
+ build_id__sprintf(dso->build_id, sizeof(dso->build_id),
+ sbuild_id);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Sat, 9 Dec 2017 01:26:46 +0900
+Subject: perf probe: Add warning message if there is unexpected event name
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+
+[ Upstream commit 9f5c6d8777a2d962b0eeacb2a16f37da6bea545b ]
+
+This improve the error message so that user can know event-name error
+before writing new events to kprobe-events interface.
+
+E.g.
+ ======
+ #./perf probe -x /lib64/libc-2.25.so malloc_get_state*
+ Internal error: "malloc_get_state@GLIBC_2" is an invalid event name.
+ Error: Failed to add events.
+ ======
+
+Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Acked-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Reviewed-by: Thomas Richter <tmricht@linux.vnet.ibm.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Paul Clarke <pc@us.ibm.com>
+Cc: bhargavb <bhargavaramudu@gmail.com>
+Cc: linux-rt-users@vger.kernel.org
+Link: http://lkml.kernel.org/r/151275040665.24652.5188568529237584489.stgit@devbox
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/probe-event.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/tools/perf/util/probe-event.c
++++ b/tools/perf/util/probe-event.c
+@@ -2349,6 +2349,14 @@ static int get_new_event_name(char *buf,
+
+ out:
+ free(nbase);
++
++ /* Final validation */
++ if (ret >= 0 && !is_c_func_name(buf)) {
++ pr_warning("Internal error: \"%s\" is an invalid event name.\n",
++ buf);
++ ret = -EINVAL;
++ }
++
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Milian Wolff <milian.wolff@kdab.com>
+Date: Fri, 2 Jun 2017 16:37:52 +0200
+Subject: perf report: Ensure the perf DSO mapping matches what libdw sees
+
+From: Milian Wolff <milian.wolff@kdab.com>
+
+
+[ Upstream commit 2538b9e2450ae255337c04356e9e0f8cb9ec48d9 ]
+
+In some situations the libdw unwinder stopped working properly. I.e.
+with libunwind we see:
+
+~~~~~
+heaptrack_gui 2228 135073.400112: 641314 cycles:
+ e8ed _dl_fixup (/usr/lib/ld-2.25.so)
+ 15f06 _dl_runtime_resolve_sse_vex (/usr/lib/ld-2.25.so)
+ ed94c KDynamicJobTracker::KDynamicJobTracker (/home/milian/projects/compiled/kf5/lib64/libKF5KIOWidgets.so.5.35.0)
+ 608f3 _GLOBAL__sub_I_kdynamicjobtracker.cpp (/home/milian/projects/compiled/kf5/lib64/libKF5KIOWidgets.so.5.35.0)
+ f199 call_init.part.0 (/usr/lib/ld-2.25.so)
+ f2a5 _dl_init (/usr/lib/ld-2.25.so)
+ db9 _dl_start_user (/usr/lib/ld-2.25.so)
+~~~~~
+
+But with libdw and without this patch this sample is not properly
+unwound:
+
+~~~~~
+heaptrack_gui 2228 135073.400112: 641314 cycles:
+ e8ed _dl_fixup (/usr/lib/ld-2.25.so)
+ 15f06 _dl_runtime_resolve_sse_vex (/usr/lib/ld-2.25.so)
+ ed94c KDynamicJobTracker::KDynamicJobTracker (/home/milian/projects/compiled/kf5/lib64/libKF5KIOWidgets.so.5.35.0)
+~~~~~
+
+Debug output showed me that libdw found a module for the last frame
+address, but it thinks it belongs to /usr/lib/ld-2.25.so. This patch
+double-checks what libdw sees and what perf knows. If the mappings
+mismatch, we now report the elf known to perf. This fixes the situation
+above, and the libdw unwinder produces the same stack as libunwind.
+
+Signed-off-by: Milian Wolff <milian.wolff@kdab.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lkml.kernel.org/r/20170602143753.16907-1-milian.wolff@kdab.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/unwind-libdw.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/tools/perf/util/unwind-libdw.c
++++ b/tools/perf/util/unwind-libdw.c
+@@ -37,6 +37,14 @@ static int __report_module(struct addr_l
+ return 0;
+
+ mod = dwfl_addrmodule(ui->dwfl, ip);
++ if (mod) {
++ Dwarf_Addr s;
++
++ dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL);
++ if (s != al->map->start)
++ mod = 0;
++ }
++
+ if (!mod)
+ mod = dwfl_report_elf(ui->dwfl, dso->short_name,
+ dso->long_name, -1, al->map->start,
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Namhyung Kim <namhyung@kernel.org>
+Date: Thu, 8 Jun 2017 16:31:07 +0900
+Subject: perf tests: Decompress kernel module before objdump
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+
+[ Upstream commit 94df1040b1e6aacd8dec0ba3c61d7e77cd695f26 ]
+
+If a kernel modules is compressed, it should be decompressed before
+running objdump to parse binary data correctly. This fixes a failure of
+object code reading test for me.
+
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Wang Nan <wangnan0@huawei.com>
+Cc: kernel-team@lge.com
+Link: http://lkml.kernel.org/r/20170608073109.30699-8-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/tests/code-reading.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/tests/code-reading.c
++++ b/tools/perf/tests/code-reading.c
+@@ -182,6 +182,8 @@ static int read_object_code(u64 addr, si
+ unsigned char buf2[BUFSZ];
+ size_t ret_len;
+ u64 objdump_addr;
++ const char *objdump_name;
++ char decomp_name[KMOD_DECOMP_LEN];
+ int ret;
+
+ pr_debug("Reading object code for memory address: %#"PRIx64"\n", addr);
+@@ -242,9 +244,25 @@ static int read_object_code(u64 addr, si
+ state->done[state->done_cnt++] = al.map->start;
+ }
+
++ objdump_name = al.map->dso->long_name;
++ if (dso__needs_decompress(al.map->dso)) {
++ if (dso__decompress_kmodule_path(al.map->dso, objdump_name,
++ decomp_name,
++ sizeof(decomp_name)) < 0) {
++ pr_debug("decompression failed\n");
++ return -1;
++ }
++
++ objdump_name = decomp_name;
++ }
++
+ /* Read the object code using objdump */
+ objdump_addr = map__rip_2objdump(al.map, al.addr);
+- ret = read_via_objdump(al.map->dso->long_name, objdump_addr, buf2, len);
++ ret = read_via_objdump(objdump_name, objdump_addr, buf2, len);
++
++ if (dso__needs_decompress(al.map->dso))
++ unlink(objdump_name);
++
+ if (ret > 0) {
+ /*
+ * The kernel maps are inaccurate - assume objdump is right in
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Tue, 9 Jan 2018 14:39:23 +0100
+Subject: perf tools: Fix copyfile_offset update of output offset
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+
+[ Upstream commit fa1195ccc0af2d121abe0fe266a1caee8c265eea ]
+
+We need to increase output offset in each iteration, not decrease it as
+we currently do.
+
+I guess we were lucky to finish in most cases in first iteration, so the
+bug never showed. However it shows a lot when working with big (~4GB)
+size data.
+
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Fixes: 9c9f5a2f1944 ("perf tools: Introduce copyfile_offset() function")
+Link: http://lkml.kernel.org/r/20180109133923.25406-1-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/util/util.c
++++ b/tools/perf/util/util.c
+@@ -162,7 +162,7 @@ int copyfile_offset(int ifd, loff_t off_
+
+ size -= ret;
+ off_in += ret;
+- off_out -= ret;
++ off_out += ret;
+ }
+ munmap(ptr, off_in + size);
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Wed, 31 May 2017 13:35:57 +0200
+Subject: perf trace: Add mmap alias for s390
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+
+[ Upstream commit 54265664c15a68905d8d67d19205e9a767636434 ]
+
+The s390 architecture maps sys_mmap (nr 90) into sys_old_mmap. For this
+reason perf trace can't find the proper syscall event to get args format
+from and displays it wrongly as 'continued'.
+
+To fix that fill the "alias" field with "old_mmap" for trace's mmap record
+to get the correct translation.
+
+Before:
+ 0.042 ( 0.011 ms): vest/43052 fstat(statbuf: 0x3ffff89fd90 ) = 0
+ 0.042 ( 0.028 ms): vest/43052 ... [continued]: mmap()) = 0x3fffd6e2000
+ 0.072 ( 0.025 ms): vest/43052 read(buf: 0x3fffd6e2000, count: 4096 ) = 6
+
+After:
+ 0.045 ( 0.011 ms): fstat(statbuf: 0x3ffff8a0930 ) = 0
+ 0.057 ( 0.018 ms): mmap(arg: 0x3ffff8a0858 ) = 0x3fffd14a000
+ 0.076 ( 0.025 ms): read(buf: 0x3fffd14a000, count: 4096 ) = 6
+
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Link: http://lkml.kernel.org/r/20170531113557.19175-1-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-trace.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -1152,6 +1152,10 @@ static struct syscall_fmt {
+ { .name = "mlockall", .errmsg = true,
+ .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, },
+ { .name = "mmap", .hexret = true,
++/* The standard mmap maps to old_mmap on s390x */
++#if defined(__s390x__)
++ .alias = "old_mmap",
++#endif
+ .arg_scnprintf = { [0] = SCA_HEX, /* addr */
+ [2] = SCA_MMAP_PROT, /* prot */
+ [3] = SCA_MMAP_FLAGS, /* flags */
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Kirill Tkhai <ktkhai@virtuozzo.com>
+Date: Mon, 8 May 2017 15:56:34 -0700
+Subject: pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()
+
+From: Kirill Tkhai <ktkhai@virtuozzo.com>
+
+
+[ Upstream commit 8896c23d2ef803f1883fea73117a435925c2b4c4 ]
+
+alloc_pidmap() advances pid_namespace::last_pid. When first pid
+allocation fails, then next created process will have pid 2 and
+pid_ns_prepare_proc() won't be called. So, pid_namespace::proc_mnt will
+never be initialized (not to mention that there won't be a child
+reaper).
+
+I saw crash stack of such case on kernel 3.10:
+
+ BUG: unable to handle kernel NULL pointer dereference at (null)
+ IP: proc_flush_task+0x8f/0x1b0
+ Call Trace:
+ release_task+0x3f/0x490
+ wait_consider_task.part.10+0x7ff/0xb00
+ do_wait+0x11f/0x280
+ SyS_wait4+0x7d/0x110
+
+We may fix this by restore of last_pid in 0 or by prohibiting of futher
+allocations. Since there was a similar issue in Oleg Nesterov's commit
+314a8ad0f18a ("pidns: fix free_pid() to handle the first fork failure").
+and it was fixed via prohibiting allocation, let's follow this way, and
+do the same.
+
+Link: http://lkml.kernel.org/r/149201021004.4863.6762095011554287922.stgit@localhost.localdomain
+Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
+Cc: Andrei Vagin <avagin@virtuozzo.com>
+Cc: Andreas Gruenbacher <agruenba@redhat.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Michael Kerrisk <mtk.manpages@googlemail.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Paul Moore <paul@paul-moore.com>
+Cc: Eric Biederman <ebiederm@xmission.com>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Serge Hallyn <serge@hallyn.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/pid.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -322,8 +322,10 @@ struct pid *alloc_pid(struct pid_namespa
+ }
+
+ if (unlikely(is_child_reaper(pid))) {
+- if (pid_ns_prepare_proc(ns))
++ if (pid_ns_prepare_proc(ns)) {
++ disable_pid_allocation(ns);
+ goto out_free;
++ }
+ }
+
+ get_pid_ns(ns);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 20 May 2017 00:31:12 +0300
+Subject: pNFS/flexfiles: missing error code in ff_layout_alloc_lseg()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit 662f9a105b4322b8559d448f86110e6ec24b8738 ]
+
+If xdr_inline_decode() fails then we end up returning ERR_PTR(0). The
+caller treats NULL returns as -ENOMEM so it doesn't really hurt runtime,
+but obviously we intended to set an error code here.
+
+Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/flexfilelayout/flexfilelayout.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -461,6 +461,7 @@ ff_layout_alloc_lseg(struct pnfs_layout_
+ goto out_err_free;
+
+ /* fh */
++ rc = -EIO;
+ p = xdr_inline_decode(&stream, 4);
+ if (!p)
+ goto out_err_free;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 10 May 2017 22:40:06 +0300
+Subject: PowerCap: Fix an error code in powercap_register_zone()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit 216c4e9db4c9d1d2a382b42880442dc632cd47d9 ]
+
+In the current code we accidentally return the successful result from
+idr_alloc() instead of a negative error pointer. The caller is looking
+for an error pointer and so it treats the returned value as a valid
+pointer.
+
+This one might be a bit serious because if it lets people get around the
+kernel's protection for remapping NULL. I'm not sure.
+
+Fixes: 75d2364ea0ca (PowerCap: Add class driver)
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/powercap/powercap_sys.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/powercap/powercap_sys.c
++++ b/drivers/powercap/powercap_sys.c
+@@ -538,6 +538,7 @@ struct powercap_zone *powercap_register_
+
+ power_zone->id = result;
+ idr_init(&power_zone->idr);
++ result = -ENOMEM;
+ power_zone->name = kstrdup(name, GFP_KERNEL);
+ if (!power_zone->name)
+ goto err_name_alloc;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Ivan Mikhaylov <ivan@de.ibm.com>
+Date: Fri, 19 May 2017 18:47:05 +0300
+Subject: powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE]
+
+From: Ivan Mikhaylov <ivan@de.ibm.com>
+
+
+[ Upstream commit 6e2f03e292ef46eed2b31b0a344a91d514f9cd81 ]
+
+Prevent a kernel panic caused by unintentionally clearing TCR watchdog
+bits. At this point in the kernel boot, the watchdog may have already
+been enabled by u-boot. The original code's attempt to write to the TCR
+register results in an inadvertent clearing of the watchdog
+configuration bits, causing the 476 to reset.
+
+Signed-off-by: Ivan Mikhaylov <ivan@de.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/time.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -686,12 +686,20 @@ static int __init get_freq(char *name, i
+ static void start_cpu_decrementer(void)
+ {
+ #if defined(CONFIG_BOOKE) || defined(CONFIG_40x)
++ unsigned int tcr;
++
+ /* Clear any pending timer interrupts */
+ mtspr(SPRN_TSR, TSR_ENW | TSR_WIS | TSR_DIS | TSR_FIS);
+
+- /* Enable decrementer interrupt */
+- mtspr(SPRN_TCR, TCR_DIE);
+-#endif /* defined(CONFIG_BOOKE) || defined(CONFIG_40x) */
++ tcr = mfspr(SPRN_TCR);
++ /*
++ * The watchdog may have already been enabled by u-boot. So leave
++ * TRC[WP] (Watchdog Period) alone.
++ */
++ tcr &= TCR_WP_MASK; /* Clear all bits except for TCR[WP] */
++ tcr |= TCR_DIE; /* Enable decrementer */
++ mtspr(SPRN_TCR, tcr);
++#endif
+ }
+
+ void __init generic_calibrate_decr(void)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Thu, 18 May 2017 20:37:31 +1000
+Subject: powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+
+[ Upstream commit e41e53cd4fe331d0d1f06f8e4ed7e2cc63ee2c34 ]
+
+virt_addr_valid() is supposed to tell you if it's OK to call virt_to_page() on
+an address. What this means in practice is that it should only return true for
+addresses in the linear mapping which are backed by a valid PFN.
+
+We are failing to properly check that the address is in the linear mapping,
+because virt_to_pfn() will return a valid looking PFN for more or less any
+address. That bug is actually caused by __pa(), used in virt_to_pfn().
+
+eg: __pa(0xc000000000010000) = 0x10000 # Good
+ __pa(0xd000000000010000) = 0x10000 # Bad!
+ __pa(0x0000000000010000) = 0x10000 # Bad!
+
+This started happening after commit bdbc29c19b26 ("powerpc: Work around gcc
+miscompilation of __pa() on 64-bit") (Aug 2013), where we changed the definition
+of __pa() to work around a GCC bug. Prior to that we subtracted PAGE_OFFSET from
+the value passed to __pa(), meaning __pa() of a 0xd or 0x0 address would give
+you something bogus back.
+
+Until we can verify if that GCC bug is no longer an issue, or come up with
+another solution, this commit does the minimal fix to make virt_addr_valid()
+work, by explicitly checking that the address is in the linear mapping region.
+
+Fixes: bdbc29c19b26 ("powerpc: Work around gcc miscompilation of __pa() on 64-bit")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Reviewed-by: Paul Mackerras <paulus@ozlabs.org>
+Reviewed-by: Balbir Singh <bsingharora@gmail.com>
+Tested-by: Breno Leitao <breno.leitao@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/include/asm/page.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/arch/powerpc/include/asm/page.h
++++ b/arch/powerpc/include/asm/page.h
+@@ -132,7 +132,19 @@ extern long long virt_phys_offset;
+ #define virt_to_pfn(kaddr) (__pa(kaddr) >> PAGE_SHIFT)
+ #define virt_to_page(kaddr) pfn_to_page(virt_to_pfn(kaddr))
+ #define pfn_to_kaddr(pfn) __va((pfn) << PAGE_SHIFT)
++
++#ifdef CONFIG_PPC_BOOK3S_64
++/*
++ * On hash the vmalloc and other regions alias to the kernel region when passed
++ * through __pa(), which virt_to_pfn() uses. That means virt_addr_valid() can
++ * return true for some vmalloc addresses, which is incorrect. So explicitly
++ * check that the address is in the kernel region.
++ */
++#define virt_addr_valid(kaddr) (REGION_ID(kaddr) == KERNEL_REGION_ID && \
++ pfn_valid(virt_to_pfn(kaddr)))
++#else
+ #define virt_addr_valid(kaddr) pfn_valid(virt_to_pfn(kaddr))
++#endif
+
+ /*
+ * On Book-E parts we need __va to parse the device tree and we can't
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Mon, 29 May 2017 20:26:07 +1000
+Subject: powerpc/spufs: Fix coredump of SPU contexts
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+
+[ Upstream commit 99acc9bede06bbb2662aafff51f5b9e529fa845e ]
+
+If a process dumps core while it has SPU contexts active then we have
+code to also dump information about the SPU contexts.
+
+Unfortunately it's been broken for 3 1/2 years, and we didn't notice. In
+commit 7b1f4020d0d1 ("spufs: get rid of dump_emit() wrappers") the nread
+variable was removed and rc used instead. That means when the loop exits
+successfully, rc has the number of bytes read, but it's then used as the
+return value for the function, which should return 0 on success.
+
+So fix it by setting rc = 0 before returning in the success case.
+
+Fixes: 7b1f4020d0d1 ("spufs: get rid of dump_emit() wrappers")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Jeremy Kerr <jk@ozlabs.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/cell/spufs/coredump.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/powerpc/platforms/cell/spufs/coredump.c
++++ b/arch/powerpc/platforms/cell/spufs/coredump.c
+@@ -174,6 +174,8 @@ static int spufs_arch_write_note(struct
+ if (!dump_skip(cprm,
+ roundup(cprm->written - total + sz, 4) - cprm->written))
+ goto Eio;
++
++ rc = 0;
+ out:
+ free_page((unsigned long)buf);
+ return rc;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Jia-Ju Bai <baijiaju1990@163.com>
+Date: Thu, 1 Jun 2017 16:18:10 +0800
+Subject: qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M
+
+From: Jia-Ju Bai <baijiaju1990@163.com>
+
+
+[ Upstream commit 5ea6d691aac6c93b790f0905e3460d44cc4c449b ]
+
+The driver may sleep under a write spin lock, and the function
+call path is:
+qlcnic_82xx_hw_write_wx_2M (acquire the lock by write_lock_irqsave)
+ crb_win_lock
+ qlcnic_pcie_sem_lock
+ usleep_range
+qlcnic_82xx_hw_read_wx_2M (acquire the lock by write_lock_irqsave)
+ crb_win_lock
+ qlcnic_pcie_sem_lock
+ usleep_range
+
+To fix it, the usleep_range is replaced with udelay.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+@@ -341,7 +341,7 @@ qlcnic_pcie_sem_lock(struct qlcnic_adapt
+ }
+ return -EIO;
+ }
+- usleep_range(1000, 1500);
++ udelay(1200);
+ }
+
+ if (id_reg)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Kees Cook <keescook@chromium.org>
+Date: Fri, 5 May 2017 15:34:34 -0700
+Subject: qlge: Avoid reading past end of buffer
+
+From: Kees Cook <keescook@chromium.org>
+
+
+[ Upstream commit df5303a8aa9a0a6934f4cea7427f1edf771f21c2 ]
+
+Using memcpy() from a string that is shorter than the length copied means
+the destination buffer is being filled with arbitrary data from the kernel
+rodata segment. Instead, use strncpy() which will fill the trailing bytes
+with zeros.
+
+This was found with the future CONFIG_FORTIFY_SOURCE feature.
+
+Cc: Daniel Micay <danielmicay@gmail.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qlge/qlge_dbg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
++++ b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
+@@ -765,7 +765,7 @@ int ql_core_dump(struct ql_adapter *qdev
+ sizeof(struct mpi_coredump_global_header);
+ mpi_coredump->mpi_global_header.imageSize =
+ sizeof(struct ql_mpi_coredump);
+- memcpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump",
++ strncpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump",
+ sizeof(mpi_coredump->mpi_global_header.idString));
+
+ /* Get generic NIC reg dump */
+@@ -1255,7 +1255,7 @@ static void ql_gen_reg_dump(struct ql_ad
+ sizeof(struct mpi_coredump_global_header);
+ mpi_coredump->mpi_global_header.imageSize =
+ sizeof(struct ql_reg_dump);
+- memcpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump",
++ strncpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump",
+ sizeof(mpi_coredump->mpi_global_header.idString));
+
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Kees Cook <keescook@chromium.org>
+Date: Fri, 5 May 2017 15:38:41 -0700
+Subject: ray_cs: Avoid reading past end of buffer
+
+From: Kees Cook <keescook@chromium.org>
+
+
+[ Upstream commit e48d661eb13f2f83861428f001c567fdb3f317e8 ]
+
+Using memcpy() from a buffer that is shorter than the length copied means
+the destination buffer is being filled with arbitrary data from the kernel
+rodata segment. In this case, the source was made longer, since it did not
+match the destination structure size. Additionally removes a needless cast.
+
+This was found with the future CONFIG_FORTIFY_SOURCE feature.
+
+Cc: Daniel Micay <danielmicay@gmail.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ray_cs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ray_cs.c
++++ b/drivers/net/wireless/ray_cs.c
+@@ -247,7 +247,10 @@ static const UCHAR b4_default_startup_pa
+ 0x04, 0x08, /* Noise gain, limit offset */
+ 0x28, 0x28, /* det rssi, med busy offsets */
+ 7, /* det sync thresh */
+- 0, 2, 2 /* test mode, min, max */
++ 0, 2, 2, /* test mode, min, max */
++ 0, /* rx/tx delay */
++ 0, 0, 0, 0, 0, 0, /* current BSS id */
++ 0 /* hop set */
+ };
+
+ /*===========================================================================*/
+@@ -598,7 +601,7 @@ static void init_startup_params(ray_dev_
+ * a_beacon_period = hops a_beacon_period = KuS
+ *//* 64ms = 010000 */
+ if (local->fw_ver == 0x55) {
+- memcpy((UCHAR *) &local->sparm.b4, b4_default_startup_parms,
++ memcpy(&local->sparm.b4, b4_default_startup_parms,
+ sizeof(struct b4_startup_params));
+ /* Translate sane kus input values to old build 4/5 format */
+ /* i = hop time in uS truncated to 3 bytes */
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+Date: Fri, 22 Dec 2017 09:38:59 -0800
+Subject: rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
+
+From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+
+
+[ Upstream commit 7ae0c649c47f1c5d2db8cee6dd75855970af1669 ]
+
+If the rds_sock is not added to the bind_hash_table, we must
+reset rs_bound_addr so that rds_remove_bound will not trip on
+this rds_sock.
+
+rds_add_bound() does a rds_sock_put() in this failure path, so
+failing to reset rs_bound_addr will result in a socket refcount
+bug, and will trigger a WARN_ON with the stack shown below when
+the application subsequently tries to close the PF_RDS socket.
+
+ WARNING: CPU: 20 PID: 19499 at net/rds/af_rds.c:496 \
+ rds_sock_destruct+0x15/0x30 [rds]
+ :
+ __sk_destruct+0x21/0x190
+ rds_remove_bound.part.13+0xb6/0x140 [rds]
+ rds_release+0x71/0x120 [rds]
+ sock_release+0x1a/0x70
+ sock_close+0xe/0x20
+ __fput+0xd5/0x210
+ task_work_run+0x82/0xa0
+ do_exit+0x2ce/0xb30
+ ? syscall_trace_enter+0x1cc/0x2b0
+ do_group_exit+0x39/0xa0
+ SyS_exit_group+0x10/0x10
+ do_syscall_64+0x61/0x1a0
+
+Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rds/bind.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/rds/bind.c
++++ b/net/rds/bind.c
+@@ -108,6 +108,7 @@ static int rds_add_bound(struct rds_sock
+ rs, &addr, (int)ntohs(*port));
+ break;
+ } else {
++ rs->rs_bound_addr = 0;
+ rds_sock_put(rs);
+ ret = -ENOMEM;
+ break;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
+Date: Fri, 19 May 2017 22:18:55 +0530
+Subject: rtc: interface: Validate alarm-time before handling rollover
+
+From: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
+
+
+[ Upstream commit da96aea0ed177105cb13ee83b328f6c61e061d3f ]
+
+In function __rtc_read_alarm() its possible for an alarm time-stamp to
+be invalid even after replacing missing components with current
+time-stamp. The condition 'alarm->time.tm_year < 70' will trigger this
+case and will cause the call to 'rtc_tm_to_time64(&alarm->time)'
+return a negative value for variable t_alm.
+
+While handling alarm rollover this negative t_alm (assumed to seconds
+offset from '1970-01-01 00:00:00') is converted back to rtc_time via
+rtc_time64_to_tm() which results in this error log with seemingly
+garbage values:
+
+"rtc rtc0: invalid alarm value: -2-1--1041528741
+2005511117:71582844:32"
+
+This error was generated when the rtc driver (rtc-opal in this case)
+returned an alarm time-stamp of '00-00-00 00:00:00' to indicate that
+the alarm is disabled. Though I have submitted a separate fix for the
+rtc-opal driver, this issue may potentially impact other
+existing/future rtc drivers.
+
+To fix this issue the patch validates the alarm time-stamp just after
+filling up the missing datetime components and if rtc_valid_tm() still
+reports it to be invalid then bails out of the function without
+handling the rollover.
+
+Reported-by: Steve Best <sbest@redhat.com>
+Signed-off-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/interface.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -217,6 +217,13 @@ int __rtc_read_alarm(struct rtc_device *
+ missing = year;
+ }
+
++ /* Can't proceed if alarm is still invalid after replacing
++ * missing fields.
++ */
++ err = rtc_valid_tm(&alarm->time);
++ if (err)
++ goto done;
++
+ /* with luck, no rollover is needed */
+ t_now = rtc_tm_to_time64(&now);
+ t_alm = rtc_tm_to_time64(&alarm->time);
+@@ -268,9 +275,9 @@ int __rtc_read_alarm(struct rtc_device *
+ dev_warn(&rtc->dev, "alarm rollover not handled\n");
+ }
+
+-done:
+ err = rtc_valid_tm(&alarm->time);
+
++done:
+ if (err) {
+ dev_warn(&rtc->dev, "invalid alarm value: %d-%d-%d %d:%d:%d\n",
+ alarm->time.tm_year + 1900, alarm->time.tm_mon + 1,
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
+Date: Fri, 19 May 2017 15:35:09 +0530
+Subject: rtc: opal: Handle disabled TPO in opal_get_tpo_time()
+
+From: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
+
+
+[ Upstream commit 6dc1cf6f932bb0ea4d8f5e913a0a401ecacd2f03 ]
+
+On PowerNV platform when Timed-Power-On(TPO) is disabled, read of
+stored TPO yields value with all date components set to '0' inside
+opal_get_tpo_time(). The function opal_to_tm() then converts it to an
+offset from year 1900 yielding alarm-time == "1900-00-01
+00:00:00". This causes problems with __rtc_read_alarm() that
+expecting an offset from "1970-00-01 00:00:00" and returned alarm-time
+results in a -ve value for time64_t. Which ultimately results in this
+error reported in kernel logs with a seemingly garbage value:
+
+"rtc rtc0: invalid alarm value: -2-1--1041528741
+2005511117:71582844:32"
+
+We fix this by explicitly handling the case of all alarm date-time
+components being '0' inside opal_get_tpo_time() and returning -ENOENT
+in such a case. This signals generic rtc that no alarm is set and it
+bails out from the alarm initialization flow without reporting the
+above error.
+
+Signed-off-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
+Reported-by: Steve Best <sbest@redhat.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-opal.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/rtc/rtc-opal.c
++++ b/drivers/rtc/rtc-opal.c
+@@ -150,6 +150,16 @@ static int opal_get_tpo_time(struct devi
+
+ y_m_d = be32_to_cpu(__y_m_d);
+ h_m_s_ms = ((u64)be32_to_cpu(__h_m) << 32);
++
++ /* check if no alarm is set */
++ if (y_m_d == 0 && h_m_s_ms == 0) {
++ pr_debug("No alarm is set\n");
++ rc = -ENOENT;
++ goto exit;
++ } else {
++ pr_debug("Alarm set to %x %llx\n", y_m_d, h_m_s_ms);
++ }
++
+ opal_to_tm(y_m_d, h_m_s_ms, &alarm->time);
+
+ exit:
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Pan Bian <bianpan2016@163.com>
+Date: Sun, 23 Apr 2017 13:43:24 +0800
+Subject: rtc: snvs: fix an incorrect check of return value
+
+From: Pan Bian <bianpan2016@163.com>
+
+
+[ Upstream commit 758929005f06f954b7e1c87a1c9fdb44157b228f ]
+
+Function devm_regmap_init_mmio() returns an ERR_PTR on error. However,
+in function snvs_rtc_probe() its return value is checked against NULL.
+This patch fixes it by checking the return value with IS_ERR().
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-snvs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/rtc/rtc-snvs.c
++++ b/drivers/rtc/rtc-snvs.c
+@@ -257,7 +257,7 @@ static int snvs_rtc_probe(struct platfor
+ of_property_read_u32(pdev->dev.of_node, "offset", &data->offset);
+ }
+
+- if (!data->regmap) {
++ if (IS_ERR(data->regmap)) {
+ dev_err(&pdev->dev, "Can't find snvs syscon\n");
+ return -ENODEV;
+ }
--- /dev/null
+From 89a5ea99662505d2d61f2a3030a6896c2cb3cdb0 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Sun, 4 Jun 2017 04:16:24 +0200
+Subject: rxrpc: check return value of skb_to_sgvec always
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit 89a5ea99662505d2d61f2a3030a6896c2cb3cdb0 upstream.
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Acked-by: David Howells <dhowells@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[natechancellor: backport to 4.4]
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/rxkad.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/net/rxrpc/rxkad.c
++++ b/net/rxrpc/rxkad.c
+@@ -209,7 +209,7 @@ static int rxkad_secure_packet_encrypt(c
+ struct sk_buff *trailer;
+ unsigned int len;
+ u16 check;
+- int nsg;
++ int nsg, err;
+
+ sp = rxrpc_skb(skb);
+
+@@ -240,7 +240,9 @@ static int rxkad_secure_packet_encrypt(c
+ len &= ~(call->conn->size_align - 1);
+
+ sg_init_table(sg, nsg);
+- skb_to_sgvec(skb, sg, 0, len);
++ err = skb_to_sgvec(skb, sg, 0, len);
++ if (unlikely(err < 0))
++ return err;
+ crypto_blkcipher_encrypt_iv(&desc, sg, sg, len);
+
+ _leave(" = 0");
+@@ -336,7 +338,7 @@ static int rxkad_verify_packet_auth(cons
+ struct sk_buff *trailer;
+ u32 data_size, buf;
+ u16 check;
+- int nsg;
++ int nsg, ret;
+
+ _enter("");
+
+@@ -348,7 +350,9 @@ static int rxkad_verify_packet_auth(cons
+ goto nomem;
+
+ sg_init_table(sg, nsg);
+- skb_to_sgvec(skb, sg, 0, 8);
++ ret = skb_to_sgvec(skb, sg, 0, 8);
++ if (unlikely(ret < 0))
++ return ret;
+
+ /* start the decryption afresh */
+ memset(&iv, 0, sizeof(iv));
+@@ -411,7 +415,7 @@ static int rxkad_verify_packet_encrypt(c
+ struct sk_buff *trailer;
+ u32 data_size, buf;
+ u16 check;
+- int nsg;
++ int nsg, ret;
+
+ _enter(",{%d}", skb->len);
+
+@@ -430,7 +434,12 @@ static int rxkad_verify_packet_encrypt(c
+ }
+
+ sg_init_table(sg, nsg);
+- skb_to_sgvec(skb, sg, 0, skb->len);
++ ret = skb_to_sgvec(skb, sg, 0, skb->len);
++ if (unlikely(ret < 0)) {
++ if (sg != _sg)
++ kfree(sg);
++ return ret;
++ }
+
+ /* decrypt from the session key */
+ token = call->conn->key->payload.data[0];
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+Date: Thu, 18 May 2017 13:24:45 +0200
+Subject: s390/dasd: fix hanging safe offline
+
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+
+
+[ Upstream commit e8ac01555d9e464249e8bb122337d6d6e5589ccc ]
+
+The safe offline processing may hang forever because it waits for I/O
+which can not be started because of the offline flag that prevents new
+I/O from being started.
+
+Allow I/O to be started during safe offline processing because in this
+special case we take care that the queues are empty before throwing away
+the device.
+
+Signed-off-by: Stefan Haberland <sth@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/block/dasd.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -1881,8 +1881,12 @@ static int __dasd_device_is_unusable(str
+ {
+ int mask = ~(DASD_STOPPED_DC_WAIT | DASD_UNRESUMED_PM);
+
+- if (test_bit(DASD_FLAG_OFFLINE, &device->flags)) {
+- /* dasd is being set offline. */
++ if (test_bit(DASD_FLAG_OFFLINE, &device->flags) &&
++ !test_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags)) {
++ /*
++ * dasd is being set offline
++ * but it is no safe offline where we have to allow I/O
++ */
+ return 1;
+ }
+ if (device->stopped) {
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Thu, 4 May 2017 09:42:22 +0200
+Subject: s390: move _text symbol to address higher than zero
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+
+[ Upstream commit d04a4c76f71dd5335f8e499b59617382d84e2b8d ]
+
+The perf tool assumes that kernel symbols are never present at address
+zero. In fact it assumes if functions that map symbols to addresses
+return zero, that the symbol was not found.
+
+Given that s390's _text symbol historically is located at address zero
+this yields at least a couple of false errors and warnings in one of
+perf's test cases about not present symbols ("perf test 1").
+
+To fix this simply move the _text symbol to address 0x200, just behind
+the initial psw and channel program located at the beginning of the
+kernel image. This is now hard coded within the linker script.
+
+I tried a nicer solution which moves the initial psw and channel
+program into an own section. However that would move the symbols
+within the "real" head.text section to different addresses, since the
+".org" statements within head.S are relative to the head.text
+section. If there is a new section in front, everything else will be
+moved. Alternatively I could have adjusted all ".org" statements. But
+this current solution seems to be the easiest one, since nobody really
+cares where the _text symbol is actually located.
+
+Reported-by: Zvonko Kosic <zkosic@linux.vnet.ibm.com>
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/kernel/vmlinux.lds.S | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -21,8 +21,14 @@ SECTIONS
+ {
+ . = 0x00000000;
+ .text : {
+- _text = .; /* Text and read-only data */
++ /* Text and read-only data */
+ HEAD_TEXT
++ /*
++ * E.g. perf doesn't like symbols starting at address zero,
++ * therefore skip the initial PSW and channel program located
++ * at address zero and let _text start at 0x200.
++ */
++ _text = 0x200;
+ TEXT_TEXT
+ SCHED_TEXT
+ LOCK_TEXT
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Vlastimil Babka <vbabka@suse.cz>
+Date: Mon, 15 May 2017 15:13:16 +0200
+Subject: sched/numa: Use down_read_trylock() for the mmap_sem
+
+From: Vlastimil Babka <vbabka@suse.cz>
+
+
+[ Upstream commit 8655d5497735b288f8a9b458bd22e7d1bf95bb61 ]
+
+A customer has reported a soft-lockup when running an intensive
+memory stress test, where the trace on multiple CPU's looks like this:
+
+ RIP: 0010:[<ffffffff810c53fe>]
+ [<ffffffff810c53fe>] native_queued_spin_lock_slowpath+0x10e/0x190
+...
+ Call Trace:
+ [<ffffffff81182d07>] queued_spin_lock_slowpath+0x7/0xa
+ [<ffffffff811bc331>] change_protection_range+0x3b1/0x930
+ [<ffffffff811d4be8>] change_prot_numa+0x18/0x30
+ [<ffffffff810adefe>] task_numa_work+0x1fe/0x310
+ [<ffffffff81098322>] task_work_run+0x72/0x90
+
+Further investigation showed that the lock contention here is pmd_lock().
+
+The task_numa_work() function makes sure that only one thread is let to perform
+the work in a single scan period (via cmpxchg), but if there's a thread with
+mmap_sem locked for writing for several periods, multiple threads in
+task_numa_work() can build up a convoy waiting for mmap_sem for read and then
+all get unblocked at once.
+
+This patch changes the down_read() to the trylock version, which prevents the
+build up. For a workload experiencing mmap_sem contention, it's probably better
+to postpone the NUMA balancing work anyway. This seems to have fixed the soft
+lockups involving pmd_lock(), which is in line with the convoy theory.
+
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Rik van Riel <riel@redhat.com>
+Acked-by: Mel Gorman <mgorman@techsingularity.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20170515131316.21909-1-vbabka@suse.cz
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/fair.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -2223,7 +2223,8 @@ void task_numa_work(struct callback_head
+ return;
+
+
+- down_read(&mm->mmap_sem);
++ if (!down_read_trylock(&mm->mmap_sem))
++ return;
+ vma = find_vma(mm, start);
+ if (!vma) {
+ reset_ptenuma_scan(p);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Maurizio Lombardi <mlombard@redhat.com>
+Date: Wed, 24 May 2017 14:09:44 +0200
+Subject: scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats()
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+
+[ Upstream commit c2dd893a3b0772d1c680e109b9d5715d7f73022b ]
+
+If multiple tasks attempt to read the stats, it may happen that the
+start_req_done completion is re-initialized while still being used by
+another task, causing a list corruption.
+
+This patch fixes the bug by adding a mutex to serialize the calls to
+bnx2fc_get_host_stats().
+
+WARNING: at lib/list_debug.c:48 list_del+0x6e/0xa0() (Not tainted)
+Hardware name: PowerEdge R820
+list_del corruption. prev->next should be ffff882035627d90, but was ffff884069541588
+
+Pid: 40267, comm: perl Not tainted 2.6.32-642.3.1.el6.x86_64 #1
+Call Trace:
+ [<ffffffff8107c691>] ? warn_slowpath_common+0x91/0xe0
+ [<ffffffff8107c796>] ? warn_slowpath_fmt+0x46/0x60
+ [<ffffffff812ad16e>] ? list_del+0x6e/0xa0
+ [<ffffffff81547eed>] ? wait_for_common+0x14d/0x180
+ [<ffffffff8106c4a0>] ? default_wake_function+0x0/0x20
+ [<ffffffff81547fd3>] ? wait_for_completion_timeout+0x13/0x20
+ [<ffffffffa05410b1>] ? bnx2fc_get_host_stats+0xa1/0x280 [bnx2fc]
+ [<ffffffffa04cf630>] ? fc_stat_show+0x90/0xc0 [scsi_transport_fc]
+ [<ffffffffa04cf8b6>] ? show_fcstat_tx_frames+0x16/0x20 [scsi_transport_fc]
+ [<ffffffff8137c647>] ? dev_attr_show+0x27/0x50
+ [<ffffffff8113b9be>] ? __get_free_pages+0xe/0x50
+ [<ffffffff812170e1>] ? sysfs_read_file+0x111/0x200
+ [<ffffffff8119a305>] ? vfs_read+0xb5/0x1a0
+ [<ffffffff8119b0b6>] ? fget_light_pos+0x16/0x50
+ [<ffffffff8119a651>] ? sys_read+0x51/0xb0
+ [<ffffffff810ee1fe>] ? __audit_syscall_exit+0x25e/0x290
+ [<ffffffff8100b0d2>] ? system_call_fastpath+0x16/0x1b
+
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Acked-by: Chad Dupuis <chad.dupuis@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/bnx2fc/bnx2fc.h | 1 +
+ drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 10 ++++++++--
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/bnx2fc/bnx2fc.h
++++ b/drivers/scsi/bnx2fc/bnx2fc.h
+@@ -191,6 +191,7 @@ struct bnx2fc_hba {
+ struct bnx2fc_cmd_mgr *cmd_mgr;
+ spinlock_t hba_lock;
+ struct mutex hba_mutex;
++ struct mutex hba_stats_mutex;
+ unsigned long adapter_state;
+ #define ADAPTER_STATE_UP 0
+ #define ADAPTER_STATE_GOING_DOWN 1
+--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+@@ -641,15 +641,17 @@ static struct fc_host_statistics *bnx2fc
+ if (!fw_stats)
+ return NULL;
+
++ mutex_lock(&hba->hba_stats_mutex);
++
+ bnx2fc_stats = fc_get_host_stats(shost);
+
+ init_completion(&hba->stat_req_done);
+ if (bnx2fc_send_stat_req(hba))
+- return bnx2fc_stats;
++ goto unlock_stats_mutex;
+ rc = wait_for_completion_timeout(&hba->stat_req_done, (2 * HZ));
+ if (!rc) {
+ BNX2FC_HBA_DBG(lport, "FW stat req timed out\n");
+- return bnx2fc_stats;
++ goto unlock_stats_mutex;
+ }
+ BNX2FC_STATS(hba, rx_stat2, fc_crc_cnt);
+ bnx2fc_stats->invalid_crc_count += hba->bfw_stats.fc_crc_cnt;
+@@ -671,6 +673,9 @@ static struct fc_host_statistics *bnx2fc
+
+ memcpy(&hba->prev_stats, hba->stats_buffer,
+ sizeof(struct fcoe_statistics_params));
++
++unlock_stats_mutex:
++ mutex_unlock(&hba->hba_stats_mutex);
+ return bnx2fc_stats;
+ }
+
+@@ -1302,6 +1307,7 @@ static struct bnx2fc_hba *bnx2fc_hba_cre
+ }
+ spin_lock_init(&hba->hba_lock);
+ mutex_init(&hba->hba_mutex);
++ mutex_init(&hba->hba_stats_mutex);
+
+ hba->cnic = cnic;
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Varun Prakash <varun@chelsio.com>
+Date: Wed, 17 May 2017 20:30:43 +0530
+Subject: scsi: csiostor: fix use after free in csio_hw_use_fwconfig()
+
+From: Varun Prakash <varun@chelsio.com>
+
+
+[ Upstream commit a351e40b6de550049423a26f7ded7b639e363d89 ]
+
+mbp pointer is passed to csio_hw_validate_caps() so call mempool_free()
+after calling csio_hw_validate_caps().
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Fixes: 541c571fa2fd ("csiostor:Use firmware version from cxgb4/t4fw_version.h")
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/csiostor/csio_hw.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/csiostor/csio_hw.c
++++ b/drivers/scsi/csiostor/csio_hw.c
+@@ -1769,7 +1769,6 @@ csio_hw_use_fwconfig(struct csio_hw *hw,
+ goto bye;
+ }
+
+- mempool_free(mbp, hw->mb_mempool);
+ if (finicsum != cfcsum) {
+ csio_warn(hw,
+ "Config File checksum mismatch: csum=%#x, computed=%#x\n",
+@@ -1780,6 +1779,10 @@ csio_hw_use_fwconfig(struct csio_hw *hw,
+ rv = csio_hw_validate_caps(hw, mbp);
+ if (rv != 0)
+ goto bye;
++
++ mempool_free(mbp, hw->mb_mempool);
++ mbp = NULL;
++
+ /*
+ * Note that we're operating with parameters
+ * not supplied by the driver, rather than from hard-wired
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Rafael David Tinoco <rafael.tinoco@canonical.com>
+Date: Thu, 7 Dec 2017 19:59:13 -0200
+Subject: scsi: libiscsi: Allow sd_shutdown on bad transport
+
+From: Rafael David Tinoco <rafael.tinoco@canonical.com>
+
+
+[ Upstream commit d754941225a7dbc61f6dd2173fa9498049f9a7ee ]
+
+If, for any reason, userland shuts down iscsi transport interfaces
+before proper logouts - like when logging in to LUNs manually, without
+logging out on server shutdown, or when automated scripts can't
+umount/logout from logged LUNs - kernel will hang forever on its
+sd_sync_cache() logic, after issuing the SYNCHRONIZE_CACHE cmd to all
+still existent paths.
+
+PID: 1 TASK: ffff8801a69b8000 CPU: 1 COMMAND: "systemd-shutdow"
+ #0 [ffff8801a69c3a30] __schedule at ffffffff8183e9ee
+ #1 [ffff8801a69c3a80] schedule at ffffffff8183f0d5
+ #2 [ffff8801a69c3a98] schedule_timeout at ffffffff81842199
+ #3 [ffff8801a69c3b40] io_schedule_timeout at ffffffff8183e604
+ #4 [ffff8801a69c3b70] wait_for_completion_io_timeout at ffffffff8183fc6c
+ #5 [ffff8801a69c3bd0] blk_execute_rq at ffffffff813cfe10
+ #6 [ffff8801a69c3c88] scsi_execute at ffffffff815c3fc7
+ #7 [ffff8801a69c3cc8] scsi_execute_req_flags at ffffffff815c60fe
+ #8 [ffff8801a69c3d30] sd_sync_cache at ffffffff815d37d7
+ #9 [ffff8801a69c3da8] sd_shutdown at ffffffff815d3c3c
+
+This happens because iscsi_eh_cmd_timed_out(), the transport layer
+timeout helper, would tell the queue timeout function (scsi_times_out)
+to reset the request timer over and over, until the session state is
+back to logged in state. Unfortunately, during server shutdown, this
+might never happen again.
+
+Other option would be "not to handle" the issue in the transport
+layer. That would trigger the error handler logic, which would also need
+the session state to be logged in again.
+
+Best option, for such case, is to tell upper layers that the command was
+handled during the transport layer error handler helper, marking it as
+DID_NO_CONNECT, which will allow completion and inform about the
+problem.
+
+After the session was marked as ISCSI_STATE_FAILED, due to the first
+timeout during the server shutdown phase, all subsequent cmds will fail
+to be queued, allowing upper logic to fail faster.
+
+Signed-off-by: Rafael David Tinoco <rafael.tinoco@canonical.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/libiscsi.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -1695,6 +1695,15 @@ int iscsi_queuecommand(struct Scsi_Host
+ */
+ switch (session->state) {
+ case ISCSI_STATE_FAILED:
++ /*
++ * cmds should fail during shutdown, if the session
++ * state is bad, allowing completion to happen
++ */
++ if (unlikely(system_state != SYSTEM_RUNNING)) {
++ reason = FAILURE_SESSION_FAILED;
++ sc->result = DID_NO_CONNECT << 16;
++ break;
++ }
+ case ISCSI_STATE_IN_RECOVERY:
+ reason = FAILURE_SESSION_IN_RECOVERY;
+ sc->result = DID_IMM_RETRY << 16;
+@@ -1980,6 +1989,19 @@ static enum blk_eh_timer_return iscsi_eh
+
+ if (session->state != ISCSI_STATE_LOGGED_IN) {
+ /*
++ * During shutdown, if session is prematurely disconnected,
++ * recovery won't happen and there will be hung cmds. Not
++ * handling cmds would trigger EH, also bad in this case.
++ * Instead, handle cmd, allow completion to happen and let
++ * upper layer to deal with the result.
++ */
++ if (unlikely(system_state != SYSTEM_RUNNING)) {
++ sc->result = DID_NO_CONNECT << 16;
++ ISCSI_DBG_EH(session, "sc on shutdown, handled\n");
++ rc = BLK_EH_HANDLED;
++ goto done;
++ }
++ /*
+ * We are probably in the middle of iscsi recovery so let
+ * that complete and handle the error.
+ */
+@@ -2083,7 +2105,7 @@ done:
+ task->last_timeout = jiffies;
+ spin_unlock(&session->frwd_lock);
+ ISCSI_DBG_EH(session, "return %s\n", rc == BLK_EH_RESET_TIMER ?
+- "timer reset" : "nh");
++ "timer reset" : "shutdown or nh");
+ return rc;
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Jason Yan <yanaijie@huawei.com>
+Date: Thu, 4 Jan 2018 21:04:32 +0800
+Subject: scsi: libsas: fix error when getting phy events
+
+From: Jason Yan <yanaijie@huawei.com>
+
+
+[ Upstream commit 2b23d9509fd7174b362482cf5f3b5f9a2265bc33 ]
+
+The intend purpose here was to goto out if smp_execute_task() returned
+error. Obviously something got screwed up. We will never get these link
+error statistics below:
+
+~:/sys/class/sas_phy/phy-1:0:12 # cat invalid_dword_count
+0
+~:/sys/class/sas_phy/phy-1:0:12 # cat running_disparity_error_count
+0
+~:/sys/class/sas_phy/phy-1:0:12 # cat loss_of_dword_sync_count
+0
+~:/sys/class/sas_phy/phy-1:0:12 # cat phy_reset_problem_count
+0
+
+Obviously we should goto error handler if smp_execute_task() returns
+non-zero.
+
+Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver")
+Signed-off-by: Jason Yan <yanaijie@huawei.com>
+CC: John Garry <john.garry@huawei.com>
+CC: chenqilin <chenqilin2@huawei.com>
+CC: chenxiang <chenxiang66@hisilicon.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -675,7 +675,7 @@ int sas_smp_get_phy_events(struct sas_ph
+ res = smp_execute_task(dev, req, RPEL_REQ_SIZE,
+ resp, RPEL_RESP_SIZE);
+
+- if (!res)
++ if (res)
+ goto out;
+
+ phy->invalid_dword_count = scsi_to_u32(&resp[12]);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Jason Yan <yanaijie@huawei.com>
+Date: Thu, 4 Jan 2018 21:04:31 +0800
+Subject: scsi: libsas: fix memory leak in sas_smp_get_phy_events()
+
+From: Jason Yan <yanaijie@huawei.com>
+
+
+[ Upstream commit 4a491b1ab11ca0556d2fda1ff1301e862a2d44c4 ]
+
+We've got a memory leak with the following producer:
+
+while true;
+do cat /sys/class/sas_phy/phy-1:0:12/invalid_dword_count >/dev/null;
+done
+
+The buffer req is allocated and not freed after we return. Fix it.
+
+Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver")
+Signed-off-by: Jason Yan <yanaijie@huawei.com>
+CC: John Garry <john.garry@huawei.com>
+CC: chenqilin <chenqilin2@huawei.com>
+CC: chenxiang <chenxiang66@hisilicon.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -684,6 +684,7 @@ int sas_smp_get_phy_events(struct sas_ph
+ phy->phy_reset_problem_count = scsi_to_u32(&resp[24]);
+
+ out:
++ kfree(req);
+ kfree(resp);
+ return res;
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: chenxiang <chenxiang66@hisilicon.com>
+Date: Thu, 4 Jan 2018 21:04:33 +0800
+Subject: scsi: libsas: initialize sas_phy status according to response of DISCOVER
+
+From: chenxiang <chenxiang66@hisilicon.com>
+
+
+[ Upstream commit affc67788fe5dfffad5cda3d461db5cf2b2ff2b0 ]
+
+The status of SAS PHY is in sas_phy->enabled. There is an issue that the
+status of a remote SAS PHY may be initialized incorrectly: if disable
+remote SAS PHY through sysfs interface (such as echo 0 >
+/sys/class/sas_phy/phy-1:0:0/enable), then reboot the system, and we
+will find the status of remote SAS PHY which is disabled before is
+1 (cat /sys/class/sas_phy/phy-1:0:0/enable). But actually the status of
+remote SAS PHY is disabled and the device attached is not found.
+
+In SAS protocol, NEGOTIATED LOGICAL LINK RATE field of DISCOVER response
+is 0x1 when remote SAS PHY is disabled. So initialize sas_phy->enabled
+according to the value of NEGOTIATED LOGICAL LINK RATE field.
+
+Signed-off-by: chenxiang <chenxiang66@hisilicon.com>
+Reviewed-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -282,6 +282,7 @@ static void sas_set_ex_phy(struct domain
+ phy->phy->minimum_linkrate = dr->pmin_linkrate;
+ phy->phy->maximum_linkrate = dr->pmax_linkrate;
+ phy->phy->negotiated_linkrate = phy->linkrate;
++ phy->phy->enabled = (phy->linkrate != SAS_PHY_DISABLED);
+
+ skip:
+ if (new_phy)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Chaitra P B <chaitra.basappa@broadcom.com>
+Date: Wed, 27 Dec 2017 23:09:11 -0800
+Subject: scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag.
+
+From: Chaitra P B <chaitra.basappa@broadcom.com>
+
+
+[ Upstream commit f49d4aed1315a7b766d855f1367142e682b0cc87 ]
+
+1. In IO path, setting of "ATA command pending" flag early before device
+ removal, invalid device handle etc., checks causes any new commands
+ to be always returned with SAM_STAT_BUSY and when the driver removes
+ the drive the SML issues SYNC Cache command and that command is
+ always returned with SAM_STAT_BUSY and thus making SYNC Cache command
+ to requeued.
+
+2. If the driver gets an ATA PT command for a SATA drive then the driver
+ set "ATA command pending" flag in device specific data structure not
+ to allow any further commands until the ATA PT command is completed.
+ However, after setting the flag if the driver decides to return the
+ command back to upper layers without actually issuing to the firmware
+ (i.e., returns from qcmd failure return paths) then the corresponding
+ flag is not cleared and this prevents the driver from sending any new
+ commands to the drive.
+
+This patch fixes above two issues by setting of "ATA command pending"
+flag after checking for whether device deleted, invalid device handle,
+device busy with task management. And by setting "ATA command pending"
+flag to false in all of the qcmd failure return paths after setting the
+flag.
+
+Signed-off-by: Chaitra P B <chaitra.basappa@broadcom.com>
+Signed-off-by: Suganath Prabu S <suganath-prabu.subramani@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -3886,19 +3886,6 @@ scsih_qcmd(struct Scsi_Host *shost, stru
+ return 0;
+ }
+
+- /*
+- * Bug work around for firmware SATL handling. The loop
+- * is based on atomic operations and ensures consistency
+- * since we're lockless at this point
+- */
+- do {
+- if (test_bit(0, &sas_device_priv_data->ata_command_pending)) {
+- scmd->result = SAM_STAT_BUSY;
+- scmd->scsi_done(scmd);
+- return 0;
+- }
+- } while (_scsih_set_satl_pending(scmd, true));
+-
+ sas_target_priv_data = sas_device_priv_data->sas_target;
+
+ /* invalid device handle */
+@@ -3924,6 +3911,19 @@ scsih_qcmd(struct Scsi_Host *shost, stru
+ sas_device_priv_data->block)
+ return SCSI_MLQUEUE_DEVICE_BUSY;
+
++ /*
++ * Bug work around for firmware SATL handling. The loop
++ * is based on atomic operations and ensures consistency
++ * since we're lockless at this point
++ */
++ do {
++ if (test_bit(0, &sas_device_priv_data->ata_command_pending)) {
++ scmd->result = SAM_STAT_BUSY;
++ scmd->scsi_done(scmd);
++ return 0;
++ }
++ } while (_scsih_set_satl_pending(scmd, true));
++
+ if (scmd->sc_data_direction == DMA_FROM_DEVICE)
+ mpi_control = MPI2_SCSIIO_CONTROL_READ;
+ else if (scmd->sc_data_direction == DMA_TO_DEVICE)
+@@ -3945,6 +3945,7 @@ scsih_qcmd(struct Scsi_Host *shost, stru
+ if (!smid) {
+ pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n",
+ ioc->name, __func__);
++ _scsih_set_satl_pending(scmd, false);
+ goto out;
+ }
+ mpi_request = mpt3sas_base_get_msg_frame(ioc, smid);
+@@ -3975,6 +3976,7 @@ scsih_qcmd(struct Scsi_Host *shost, stru
+ if (mpi_request->DataLength) {
+ if (ioc->build_sg_scmd(ioc, scmd, smid)) {
+ mpt3sas_base_free_smid(ioc, smid);
++ _scsih_set_satl_pending(scmd, false);
+ goto out;
+ }
+ } else
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Xin Long <lucien.xin@gmail.com>
+Date: Sat, 10 Jun 2017 14:56:56 +0800
+Subject: sctp: fix recursive locking warning in sctp_do_peeloff
+
+From: Xin Long <lucien.xin@gmail.com>
+
+
+[ Upstream commit 6dfe4b97e08ec3d1a593fdaca099f0ef0a3a19e6 ]
+
+Dmitry got the following recursive locking report while running syzkaller
+fuzzer, the Call Trace:
+ __dump_stack lib/dump_stack.c:16 [inline]
+ dump_stack+0x2ee/0x3ef lib/dump_stack.c:52
+ print_deadlock_bug kernel/locking/lockdep.c:1729 [inline]
+ check_deadlock kernel/locking/lockdep.c:1773 [inline]
+ validate_chain kernel/locking/lockdep.c:2251 [inline]
+ __lock_acquire+0xef2/0x3430 kernel/locking/lockdep.c:3340
+ lock_acquire+0x2a1/0x630 kernel/locking/lockdep.c:3755
+ lock_sock_nested+0xcb/0x120 net/core/sock.c:2536
+ lock_sock include/net/sock.h:1460 [inline]
+ sctp_close+0xcd/0x9d0 net/sctp/socket.c:1497
+ inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425
+ inet6_release+0x50/0x70 net/ipv6/af_inet6.c:432
+ sock_release+0x8d/0x1e0 net/socket.c:597
+ __sock_create+0x38b/0x870 net/socket.c:1226
+ sock_create+0x7f/0xa0 net/socket.c:1237
+ sctp_do_peeloff+0x1a2/0x440 net/sctp/socket.c:4879
+ sctp_getsockopt_peeloff net/sctp/socket.c:4914 [inline]
+ sctp_getsockopt+0x111a/0x67e0 net/sctp/socket.c:6628
+ sock_common_getsockopt+0x95/0xd0 net/core/sock.c:2690
+ SYSC_getsockopt net/socket.c:1817 [inline]
+ SyS_getsockopt+0x240/0x380 net/socket.c:1799
+ entry_SYSCALL_64_fastpath+0x1f/0xc2
+
+This warning is caused by the lock held by sctp_getsockopt() is on one
+socket, while the other lock that sctp_close() is getting later is on
+the newly created (which failed) socket during peeloff operation.
+
+This patch is to avoid this warning by use lock_sock with subclass
+SINGLE_DEPTH_NESTING as Wang Cong and Marcelo's suggestion.
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Suggested-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/socket.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1518,7 +1518,7 @@ static void sctp_close(struct sock *sk,
+
+ pr_debug("%s: sk:%p, timeout:%ld\n", __func__, sk, timeout);
+
+- lock_sock(sk);
++ lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
+ sk->sk_shutdown = SHUTDOWN_MASK;
+ sk->sk_state = SCTP_SS_CLOSING;
+
+@@ -1569,7 +1569,7 @@ static void sctp_close(struct sock *sk,
+ * held and that should be grabbed before socket lock.
+ */
+ spin_lock_bh(&net->sctp.addr_wq_lock);
+- bh_lock_sock(sk);
++ bh_lock_sock_nested(sk);
+
+ /* Hold the sock, since sk_common_release() will put sock_put()
+ * and we have just a little more cleanup.
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Fri, 19 May 2017 11:29:04 +1000
+Subject: selftests/powerpc: Fix TM resched DSCR test with some compilers
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+
+[ Upstream commit fe06fe860250a4f01d0eaf70a2563b1997174a74 ]
+
+The tm-resched-dscr test has started failing sometimes, depending on
+what compiler it's built with, eg:
+
+ test: tm_resched_dscr
+ Check DSCR TM context switch: tm-resched-dscr: tm-resched-dscr.c:76: test_body: Assertion `rv' failed.
+ !! child died by signal 6
+
+When it fails we see that the compiler doesn't initialise rv to 1 before
+entering the inline asm block. Although that's counter intuitive, it
+is allowed because we tell the compiler that the inline asm will write
+to rv (using "=r"), meaning the original value is irrelevant.
+
+Marking it as a read/write parameter would presumably work, but it seems
+simpler to fix it by setting the initial value of rv in the inline asm.
+
+Fixes: 96d016108640 ("powerpc: Correct DSCR during TM context switch")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michael Neuling <mikey@neuling.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/powerpc/tm/tm-resched-dscr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
++++ b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
+@@ -45,12 +45,12 @@ int test_body(void)
+ printf("Check DSCR TM context switch: ");
+ fflush(stdout);
+ for (;;) {
+- rv = 1;
+ asm __volatile__ (
+ /* set a known value into the DSCR */
+ "ld 3, %[dscr1];"
+ "mtspr %[sprn_dscr], 3;"
+
++ "li %[rv], 1;"
+ /* start and suspend a transaction */
+ TBEGIN
+ "beq 1f;"
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Stephen Smalley <sds@tycho.nsa.gov>
+Date: Fri, 12 May 2017 12:41:24 -0400
+Subject: selinux: do not check open permission on sockets
+
+From: Stephen Smalley <sds@tycho.nsa.gov>
+
+
+[ Upstream commit ccb544781d34afdb73a9a73ae53035d824d193bf ]
+
+open permission is currently only defined for files in the kernel
+(COMMON_FILE_PERMS rather than COMMON_FILE_SOCK_PERMS). Construction of
+an artificial test case that tries to open a socket via /proc/pid/fd will
+generate a recvfrom avc denial because recvfrom and open happen to map to
+the same permission bit in socket vs file classes.
+
+open of a socket via /proc/pid/fd is not supported by the kernel regardless
+and will ultimately return ENXIO. But we hit the permission check first and
+can thus produce these odd/misleading denials. Omit the open check when
+operating on a socket.
+
+Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/selinux/hooks.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1942,8 +1942,9 @@ static inline u32 file_to_av(struct file
+ static inline u32 open_file_to_av(struct file *file)
+ {
+ u32 av = file_to_av(file);
++ struct inode *inode = file_inode(file);
+
+- if (selinux_policycap_openperm)
++ if (selinux_policycap_openperm && inode->i_sb->s_magic != SOCKFS_MAGIC)
+ av |= FILE__OPEN;
+
+ return av;
+@@ -2912,6 +2913,7 @@ static int selinux_inode_permission(stru
+ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
+ {
+ const struct cred *cred = current_cred();
++ struct inode *inode = d_backing_inode(dentry);
+ unsigned int ia_valid = iattr->ia_valid;
+ __u32 av = FILE__WRITE;
+
+@@ -2927,8 +2929,10 @@ static int selinux_inode_setattr(struct
+ ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
+ return dentry_has_perm(cred, dentry, FILE__SETATTR);
+
+- if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
+- && !(ia_valid & ATTR_FILE))
++ if (selinux_policycap_openperm &&
++ inode->i_sb->s_magic != SOCKFS_MAGIC &&
++ (ia_valid & ATTR_SIZE) &&
++ !(ia_valid & ATTR_FILE))
+ av |= FILE__OPEN;
+
+ return dentry_has_perm(cred, dentry, av);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Vignesh R <vigneshr@ti.com>
+Date: Sat, 22 Apr 2017 18:37:19 +0530
+Subject: serial: 8250: omap: Disable DMA for console UART
+
+From: Vignesh R <vigneshr@ti.com>
+
+
+[ Upstream commit 84b40e3b57eef1417479c00490dd4c9f6e5ffdbc ]
+
+Kernel always writes log messages to console via
+serial8250_console_write()->serial8250_console_putchar() which directly
+accesses UART_TX register _without_ using DMA.
+
+But, if other processes like systemd using same UART port, then these
+writes are handled by a different code flow using 8250_omap driver where
+there is provision to use DMA.
+
+It seems that it is possible that both DMA and CPU might simultaneously
+put data to UART FIFO and lead to potential loss of data due to FIFO
+overflow and weird data corruption. This happens when both kernel
+console and userspace tries to write simultaneously to the same UART
+port. Therefore, disable DMA on kernel console port to avoid potential
+race between CPU and DMA.
+
+Signed-off-by: Vignesh R <vigneshr@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -608,6 +608,10 @@ static int omap_8250_startup(struct uart
+ up->lsr_saved_flags = 0;
+ up->msr_saved_flags = 0;
+
++ /* Disable DMA for console UART */
++ if (uart_console(port))
++ up->dma = NULL;
++
+ if (up->dma) {
+ ret = serial8250_request_dma(up);
+ if (ret) {
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 25 Apr 2017 20:15:35 +0200
+Subject: serial: sh-sci: Fix race condition causing garbage during shutdown
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit 1cf4a7efdc71cab84c42cfea7200608711ea954f ]
+
+If DMA is enabled and used, a burst of old data may be seen on the
+serial console during "poweroff" or "reboot". uart_flush_buffer()
+clears the circular buffer, but sci_port.tx_dma_len is not reset.
+This leads to a circular buffer overflow, dumping (UART_XMIT_SIZE -
+sci_port.tx_dma_len) bytes.
+
+To fix this, add a .flush_buffer() callback that resets
+sci_port.tx_dma_len.
+
+Inspired by commit 31ca2c63fdc0aee7 ("tty/serial: atmel: fix race
+condition (TX+DMA)").
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/sh-sci.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1457,7 +1457,16 @@ static void sci_free_dma(struct uart_por
+ if (s->chan_rx)
+ sci_rx_dma_release(s, false);
+ }
+-#else
++
++static void sci_flush_buffer(struct uart_port *port)
++{
++ /*
++ * In uart_flush_buffer(), the xmit circular buffer has just been
++ * cleared, so we have to reset tx_dma_len accordingly.
++ */
++ to_sci_port(port)->tx_dma_len = 0;
++}
++#else /* !CONFIG_SERIAL_SH_SCI_DMA */
+ static inline void sci_request_dma(struct uart_port *port)
+ {
+ }
+@@ -1465,7 +1474,9 @@ static inline void sci_request_dma(struc
+ static inline void sci_free_dma(struct uart_port *port)
+ {
+ }
+-#endif
++
++#define sci_flush_buffer NULL
++#endif /* !CONFIG_SERIAL_SH_SCI_DMA */
+
+ static irqreturn_t sci_rx_interrupt(int irq, void *ptr)
+ {
+@@ -2205,6 +2216,7 @@ static struct uart_ops sci_uart_ops = {
+ .break_ctl = sci_break_ctl,
+ .startup = sci_startup,
+ .shutdown = sci_shutdown,
++ .flush_buffer = sci_flush_buffer,
+ .set_termios = sci_set_termios,
+ .pm = sci_pm,
+ .type = sci_type,
--- /dev/null
+cfg80211-make-rate_info_bw_20-the-default.patch
+md-raid5-make-use-of-spin_lock_irq-over-local_irq_disable-spin_lock.patch
+rtc-snvs-fix-an-incorrect-check-of-return-value.patch
+x86-asm-don-t-use-rbp-as-a-temporary-register-in-csum_partial_copy_generic.patch
+nfsv4.1-reclaim_complete-must-handle-nfs4err_conn_not_bound_to_session.patch
+ib-srpt-fix-abort-handling.patch
+af_key-fix-slab-out-of-bounds-in-pfkey_compile_policy.patch
+mac80211-bail-out-from-prep_connection-if-a-reconfig-is-ongoing.patch
+bna-avoid-reading-past-end-of-buffer.patch
+qlge-avoid-reading-past-end-of-buffer.patch
+ipmi_ssif-unlock-on-allocation-failure.patch
+net-cdc_ncm-fix-tx-zero-padding.patch
+net-ethernet-ti-cpsw-adjust-cpsw-fifos-depth-for-fullduplex-flow-control.patch
+lockd-fix-lockd-shutdown-race.patch
+drivers-misc-vmw_vmci-vmci_queue_pair.c-fix-a-couple-integer-overflow-tests.patch
+pidns-disable-pid-allocation-if-pid_ns_prepare_proc-is-failed-in-alloc_pid.patch
+s390-move-_text-symbol-to-address-higher-than-zero.patch
+net-mlx4_en-avoid-adding-steering-rules-with-invalid-ring.patch
+nfsv4.1-work-around-a-linux-server-bug.patch
+cifs-silence-lockdep-splat-in-cifs_relock_file.patch
+blk-mq-nvme-512b-4k-t10-dif-dix-format-returns-i-o-error-on-dd-with-split-op.patch
+net-qca_spi-fix-alignment-issues-in-rx-path.patch
+netxen_nic-set-rcode-to-the-return-status-from-the-call-to-netxen_issue_cmd.patch
+input-elan_i2c-check-if-device-is-there-before-really-probing.patch
+input-elantech-force-relative-mode-on-a-certain-module.patch
+kvm-ppc-book3s-pr-check-copy_to-from_user-return-values.patch
+vmxnet3-ensure-that-adapter-is-in-proper-state-during-force_close.patch
+smb2-fix-share-type-handling.patch
+bus-brcmstb_gisb-use-register-offsets-with-writes-too.patch
+bus-brcmstb_gisb-correct-support-for-64-bit-address-output.patch
+powercap-fix-an-error-code-in-powercap_register_zone.patch
+arm-dts-imx53-qsrb-pulldown-pmic-irq-pin.patch
+staging-wlan-ng-prism2mgmt.c-fixed-a-double-endian-conversion-before-calling-hfa384x_drvr_setconfig16-also-fixes-relative-sparse-warning.patch
+x86-tsc-provide-tsc-unstable-boot-parameter.patch
+arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch
+ipv6-avoid-dad-failures-for-addresses-with-nodad.patch
+async_tx-fix-dma_prep_fence-usage-in-do_async_gen_syndrome.patch
+usb-dwc3-keystone-check-return-value.patch
+btrfs-fix-incorrect-error-return-ret-being-passed-to-mapping_set_error.patch
+ata-libahci-properly-propagate-return-value-of-platform_get_irq.patch
+neighbour-update-neigh-timestamps-iff-update-is-effective.patch
+arp-honour-gratuitous-arp-_replies_.patch
+usb-chipidea-properly-handle-host-or-gadget-initialization-failure.patch
+usb-ene_usb6250-fix-first-command-execution.patch
+net-x25-fix-one-potential-use-after-free-issue.patch
+usb-ene_usb6250-fix-scsi-residue-overwriting.patch
+serial-8250-omap-disable-dma-for-console-uart.patch
+serial-sh-sci-fix-race-condition-causing-garbage-during-shutdown.patch
+sh_eth-use-platform-device-for-printing-before-register_netdev.patch
+scsi-csiostor-fix-use-after-free-in-csio_hw_use_fwconfig.patch
+powerpc-mm-fix-virt_addr_valid-etc.-on-64-bit-hash.patch
+ath5k-fix-memory-leak-on-buf-on-failed-eeprom-read.patch
+selftests-powerpc-fix-tm-resched-dscr-test-with-some-compilers.patch
+xfrm-fix-state-migration-copy-replay-sequence-numbers.patch
+iio-hi8435-avoid-garbage-event-at-first-enable.patch
+iio-hi8435-cleanup-reset-gpio.patch
+ext4-handle-the-rest-of-ext4_mb_load_buddy-enomem-errors.patch
+md-cluster-fix-potential-lock-issue-in-add_new_disk.patch
+arm-davinci-da8xx-create-dsp-device-only-when-assigned-memory.patch
+ray_cs-avoid-reading-past-end-of-buffer.patch
+leds-pca955x-correct-i2c-functionality.patch
+sched-numa-use-down_read_trylock-for-the-mmap_sem.patch
+net-mlx5-tolerate-irq_set_affinity_hint-failures.patch
+selinux-do-not-check-open-permission-on-sockets.patch
+block-fix-an-error-code-in-add_partition.patch
+mlx5-fix-bug-reading-rss_hash_type-from-cqe.patch
+net-ieee802154-fix-net_device-reference-release-too-early.patch
+libceph-null-deref-on-crush_decode-error-path.patch
+netfilter-ctnetlink-fix-incorrect-nf_ct_put-during-hash-resize.patch
+pnfs-flexfiles-missing-error-code-in-ff_layout_alloc_lseg.patch
+asoc-rsnd-ssi-pio-adjust-to-24bit-mode.patch
+scsi-bnx2fc-fix-race-condition-in-bnx2fc_get_host_stats.patch
+fix-race-in-drivers-char-random.c-get_reg.patch
+ext4-fix-off-by-one-on-max-nr_pages-in-ext4_find_unwritten_pgoff.patch
+tcp-better-validation-of-received-ack-sequences.patch
+net-move-somaxconn-init-from-sysctl-code.patch
+input-elan_i2c-clear-int-before-resetting-controller.patch
+bonding-don-t-update-slave-link-until-ready-to-commit.patch
+kvm-nvmx-fix-handling-of-lmsw-instruction.patch
+net-llc-add-lock_sock-in-llc_ui_bind-to-avoid-a-race-condition.patch
+arm-dts-ls1021a-add-fsl-ls1021a-esdhc-compatible-string-to-esdhc-node.patch
+thermal-power_allocator-fix-one-race-condition-issue-for-thermal_instances-list.patch
+perf-probe-add-warning-message-if-there-is-unexpected-event-name.patch
+l2tp-fix-missing-print-session-offset-info.patch
+rds-reset-rs-rs_bound_addr-in-rds_add_bound-failure-path.patch
+hwmon-ina2xx-make-calibration-register-value-fixed.patch
+media-videobuf2-core-don-t-go-out-of-the-buffer-range.patch
+asoc-intel-cht_bsw_rt5645-analog-mic-support.patch
+scsi-libiscsi-allow-sd_shutdown-on-bad-transport.patch
+scsi-mpt3sas-proper-handling-of-set-clear-of-ata-command-pending-flag.patch
+vfb-fix-video-mode-and-line_length-being-set-when-loaded.patch
+gpio-label-descriptors-using-the-device-name.patch
+asoc-intel-sst-fix-the-return-value-of-sst_send_byte_stream_mrfld.patch
+wl1251-check-return-from-call-to-wl1251_acx_arp_ip_filter.patch
+hdlcdrv-fix-divide-by-zero-in-hdlcdrv_ioctl.patch
+ovl-filter-trusted-xattr-for-non-admin.patch
+powerpc-don-t-clobber-tcr-when-setting-tcr.patch
+dmaengine-imx-sdma-handle-return-value-of-clk_prepare_enable.patch
+arm64-futex-fix-undefined-behaviour-with-futex_op_oparg_shift-usage.patch
+net-mlx5-avoid-build-warning-for-uniprocessor.patch
+cxgb4-fw-upgrade-fixes.patch
+rtc-opal-handle-disabled-tpo-in-opal_get_tpo_time.patch
+rtc-interface-validate-alarm-time-before-handling-rollover.patch
+sunrpc-ensure-correct-error-is-reported-by-xs_tcp_setup_socket.patch
+net-freescale-fix-potential-null-pointer-dereference.patch
+mtd-nand-gpmi-fix-gpmi_nand_init-error-path.patch
+kvm-svm-do-not-zero-out-segment-attributes-if-segment-is-unusable-or-not-present.patch
+clk-scpi-fix-return-type-of-__scpi_dvfs_round_rate.patch
+clk-fix-__set_clk_rates-error-print-string.patch
+powerpc-spufs-fix-coredump-of-spu-contexts.patch
+perf-trace-add-mmap-alias-for-s390.patch
+qlcnic-fix-a-sleep-in-atomic-bug-in-qlcnic_82xx_hw_write_wx_2m-and-qlcnic_82xx_hw_read_wx_2m.patch
+misdn-fix-a-sleep-in-atomic-bug.patch
+drm-omap-fix-tiled-buffer-stride-calculations.patch
+cxgb4-fix-incorrect-cim_la-output-for-t6.patch
+fix-serial-console-on-sni-rm400-machines.patch
+bio-integrity-do-not-allocate-integrity-context-for-bio-w-o-data.patch
+skbuff-return-emsgsize-in-skb_to_sgvec-to-prevent-overflow.patch
+sit-reload-iphdr-in-ipip6_rcv.patch
+net-mlx4-fix-the-check-in-attaching-steering-rules.patch
+net-mlx4-check-if-granular-qos-per-vf-has-been-enabled-before-updating-qp-qos_vport.patch
+perf-header-set-proper-module-name-when-build-id-event-found.patch
+perf-report-ensure-the-perf-dso-mapping-matches-what-libdw-sees.patch
+tags-honor-compiled_source-with-apart-output-directory.patch
+e1000e-fix-race-condition-around-skb_tstamp_tx.patch
+cx25840-fix-unchecked-return-values.patch
+mceusb-sporadic-rx-truncation-corruption-fix.patch
+net-phy-avoid-genphy_aneg_done-for-phys-without-clause-22-support.patch
+arm-imx-add-mxc_cpu_imx6ull-and-cpu_is_imx6ull.patch
+e1000e-undo-e1000e_pm_freeze-if-__e1000_shutdown-fails.patch
+perf-core-correct-event-creation-with-perf_format_group.patch
+mips-mm-fixed-mappings-correct-initialisation.patch
+mips-mm-adjust-pkmap-location.patch
+mips-kprobes-flush_insn_slot-should-flush-only-if-probe-initialised.patch
+fix-loop-device-flush-before-configure-v3.patch
+net-emac-fix-reset-timeout-with-ar8035-phy.patch
+perf-tests-decompress-kernel-module-before-objdump.patch
+skbuff-only-inherit-relevant-tx_flags.patch
+xen-avoid-type-warning-in-xchg_xen_ulong.patch
+bnx2x-allow-vfs-to-disable-txvlan-offload.patch
+sctp-fix-recursive-locking-warning-in-sctp_do_peeloff.patch
+sparc64-ldc-abort-during-vds-iso-boot.patch
+iio-magnetometer-st_magn_spi-fix-spi_device_id-table.patch
+bluetooth-send-hci-set-event-mask-page-2-command-only-when-needed.patch
+cpuidle-dt-add-missing-of_node_put.patch
+acpica-events-add-runtime-stub-support-for-event-apis.patch
+acpica-disassembler-abort-on-an-invalid-unknown-aml-opcode.patch
+s390-dasd-fix-hanging-safe-offline.patch
+vxlan-dont-migrate-permanent-fdb-entries-during-learn.patch
+bcache-stop-writeback-thread-after-detaching.patch
+bcache-segregate-flash-only-volume-write-streams.patch
+scsi-libsas-fix-memory-leak-in-sas_smp_get_phy_events.patch
+scsi-libsas-fix-error-when-getting-phy-events.patch
+scsi-libsas-initialize-sas_phy-status-according-to-response-of-discover.patch
+blk-mq-fix-kernel-oops-in-blk_mq_tag_idle.patch
+tty-n_gsm-allow-adm-response-in-addition-to-ua-for-control-dlci.patch
+edac-mv64x60-fix-an-error-handling-path.patch
+cxgb4vf-fix-sge-fl-buffer-initialization-logic-for-64k-pages.patch
+perf-tools-fix-copyfile_offset-update-of-output-offset.patch
+signal-metag-document-a-conflict-with-si_user-with-sigfpe.patch
+signal-powerpc-document-conflicts-with-si_user-and-sigfpe-and-sigtrap.patch
+signal-arm-document-conflicts-with-si_user-and-sigfpe.patch
+ipsec-check-return-value-of-skb_to_sgvec-always.patch
+rxrpc-check-return-value-of-skb_to_sgvec-always.patch
+virtio_net-check-return-value-of-skb_to_sgvec-always.patch
+virtio_net-check-return-value-of-skb_to_sgvec-in-one-more-location.patch
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Thu, 18 May 2017 15:01:34 +0200
+Subject: sh_eth: Use platform device for printing before register_netdev()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit 5f5c5449acad0cd3322e53e1ac68c044483b0aa5 ]
+
+The MDIO initialization failure message is printed using the network
+device, before it has been registered, leading to:
+
+ (null): failed to initialise MDIO
+
+Use the platform device instead to fix this:
+
+ sh-eth ee700000.ethernet: failed to initialise MDIO
+
+Fixes: daacf03f0bbfefee ("sh_eth: Register MDIO bus before registering the network device")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -3222,7 +3222,7 @@ static int sh_eth_drv_probe(struct platf
+ /* MDIO bus init */
+ ret = sh_mdio_init(mdp, pd);
+ if (ret) {
+- dev_err(&ndev->dev, "failed to initialise MDIO\n");
++ dev_err(&pdev->dev, "failed to initialise MDIO\n");
+ goto out_release;
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Thu, 17 Aug 2017 17:07:46 -0500
+Subject: signal/arm: Document conflicts with SI_USER and SIGFPE
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+
+[ Upstream commit 7771c66457004977b616bab785209f49d164f527 ]
+
+Setting si_code to 0 results in a userspace seeing an si_code of 0.
+This is the same si_code as SI_USER. Posix and common sense requires
+that SI_USER not be a signal specific si_code. As such this use of 0
+for the si_code is a pretty horribly broken ABI.
+
+Further use of si_code == 0 guaranteed that copy_siginfo_to_user saw a
+value of __SI_KILL and now sees a value of SIL_KILL with the result
+that uid and pid fields are copied and which might copying the si_addr
+field by accident but certainly not by design. Making this a very
+flakey implementation.
+
+Utilizing FPE_FIXME, siginfo_layout will now return SIL_FAULT and the
+appropriate fields will be reliably copied.
+
+Possible ABI fixes includee:
+- Send the signal without siginfo
+- Don't generate a signal
+- Possibly assign and use an appropriate si_code
+- Don't handle cases which can't happen
+
+Cc: Russell King <rmk@flint.arm.linux.org.uk>
+Cc: linux-arm-kernel@lists.infradead.org
+Ref: 451436b7bbb2 ("[ARM] Add support code for ARM hardware vector floating point")
+History Tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/include/uapi/asm/siginfo.h | 13 +++++++++++++
+ arch/arm/vfp/vfpmodule.c | 2 +-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+ create mode 100644 arch/arm/include/uapi/asm/siginfo.h
+
+--- /dev/null
++++ b/arch/arm/include/uapi/asm/siginfo.h
+@@ -0,0 +1,13 @@
++#ifndef __ASM_SIGINFO_H
++#define __ASM_SIGINFO_H
++
++#include <asm-generic/siginfo.h>
++
++/*
++ * SIGFPE si_codes
++ */
++#ifdef __KERNEL__
++#define FPE_FIXME 0 /* Broken dup of SI_USER */
++#endif /* __KERNEL__ */
++
++#endif
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -261,7 +261,7 @@ static void vfp_raise_exceptions(u32 exc
+
+ if (exceptions == VFP_EXCEPTION_ERROR) {
+ vfp_panic("unhandled bounce", inst);
+- vfp_raise_sigfpe(0, regs);
++ vfp_raise_sigfpe(FPE_FIXME, regs);
+ return;
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Tue, 1 Aug 2017 10:37:40 -0500
+Subject: signal/metag: Document a conflict with SI_USER with SIGFPE
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+
+[ Upstream commit b80328be53c215346b153769267b38f531d89b4f ]
+
+Setting si_code to 0 results in a userspace seeing an si_code of 0.
+This is the same si_code as SI_USER. Posix and common sense requires
+that SI_USER not be a signal specific si_code. As such this use of 0
+for the si_code is a pretty horribly broken ABI.
+
+Further use of si_code == 0 guaranteed that copy_siginfo_to_user saw a
+value of __SI_KILL and now sees a value of SIL_KILL with the result
+hat uid and pid fields are copied and which might copying the si_addr
+field by accident but certainly not by design. Making this a very
+flakey implementation.
+
+Utilizing FPE_FIXME siginfo_layout will now return SIL_FAULT and the
+appropriate fields will reliably be copied.
+
+Possible ABI fixes includee:
+ - Send the signal without siginfo
+ - Don't generate a signal
+ - Possibly assign and use an appropriate si_code
+ - Don't handle cases which can't happen
+
+Cc: James Hogan <james.hogan@imgtec.com>
+Cc: linux-metag@vger.kernel.org
+Ref: ac919f0883e5 ("metag: Traps")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/metag/include/uapi/asm/siginfo.h | 7 +++++++
+ arch/metag/kernel/traps.c | 2 +-
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/arch/metag/include/uapi/asm/siginfo.h
++++ b/arch/metag/include/uapi/asm/siginfo.h
+@@ -5,4 +5,11 @@
+
+ #include <asm-generic/siginfo.h>
+
++/*
++ * SIGFPE si_codes
++ */
++#ifdef __KERNEL__
++#define FPE_FIXME 0 /* Broken dup of SI_USER */
++#endif /* __KERNEL__ */
++
+ #endif
+--- a/arch/metag/kernel/traps.c
++++ b/arch/metag/kernel/traps.c
+@@ -732,7 +732,7 @@ TBIRES fpe_handler(TBIRES State, int Sig
+ else if (error_state & TXSTAT_FPE_INEXACT_BIT)
+ info.si_code = FPE_FLTRES;
+ else
+- info.si_code = 0;
++ info.si_code = FPE_FIXME;
+ info.si_errno = 0;
+ info.si_addr = (__force void __user *)regs->ctx.CurrPC;
+ force_sig_info(SIGFPE, &info, current);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Sat, 19 Aug 2017 15:26:01 -0500
+Subject: signal/powerpc: Document conflicts with SI_USER and SIGFPE and SIGTRAP
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+
+[ Upstream commit cf4674c46c66e45f238f8f7e81af2a444b970c0a ]
+
+Setting si_code to 0 results in a userspace seeing an si_code of 0.
+This is the same si_code as SI_USER. Posix and common sense requires
+that SI_USER not be a signal specific si_code. As such this use of 0
+for the si_code is a pretty horribly broken ABI.
+
+Further use of si_code == 0 guaranteed that copy_siginfo_to_user saw a
+value of __SI_KILL and now sees a value of SIL_KILL with the result
+that uid and pid fields are copied and which might copying the si_addr
+field by accident but certainly not by design. Making this a very
+flakey implementation.
+
+Utilizing FPE_FIXME and TRAP_FIXME, siginfo_layout() will now return
+SIL_FAULT and the appropriate fields will be reliably copied.
+
+Possible ABI fixes includee:
+- Send the signal without siginfo
+- Don't generate a signal
+- Possibly assign and use an appropriate si_code
+- Don't handle cases which can't happen
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Kumar Gala <kumar.gala@freescale.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: linuxppc-dev@lists.ozlabs.org
+Ref: 9bad068c24d7 ("[PATCH] ppc32: support for e500 and 85xx")
+Ref: 0ed70f6105ef ("PPC32: Provide proper siginfo information on various exceptions.")
+History Tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/include/uapi/asm/siginfo.h | 15 +++++++++++++++
+ arch/powerpc/kernel/traps.c | 10 +++++-----
+ 2 files changed, 20 insertions(+), 5 deletions(-)
+
+--- a/arch/powerpc/include/uapi/asm/siginfo.h
++++ b/arch/powerpc/include/uapi/asm/siginfo.h
+@@ -17,4 +17,19 @@
+ #undef NSIGTRAP
+ #define NSIGTRAP 4
+
++/*
++ * SIGFPE si_codes
++ */
++#ifdef __KERNEL__
++#define FPE_FIXME 0 /* Broken dup of SI_USER */
++#endif /* __KERNEL__ */
++
++/*
++ * SIGTRAP si_codes
++ */
++#ifdef __KERNEL__
++#define TRAP_FIXME 0 /* Broken dup of SI_USER */
++#endif /* __KERNEL__ */
++
++
+ #endif /* _ASM_POWERPC_SIGINFO_H */
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -771,7 +771,7 @@ void unknown_exception(struct pt_regs *r
+ printk("Bad trap at PC: %lx, SR: %lx, vector=%lx\n",
+ regs->nip, regs->msr, regs->trap);
+
+- _exception(SIGTRAP, regs, 0, 0);
++ _exception(SIGTRAP, regs, TRAP_FIXME, 0);
+
+ exception_exit(prev_state);
+ }
+@@ -793,7 +793,7 @@ bail:
+
+ void RunModeException(struct pt_regs *regs)
+ {
+- _exception(SIGTRAP, regs, 0, 0);
++ _exception(SIGTRAP, regs, TRAP_FIXME, 0);
+ }
+
+ void __kprobes single_step_exception(struct pt_regs *regs)
+@@ -828,7 +828,7 @@ static void emulate_single_step(struct p
+
+ static inline int __parse_fpscr(unsigned long fpscr)
+ {
+- int ret = 0;
++ int ret = FPE_FIXME;
+
+ /* Invalid operation */
+ if ((fpscr & FPSCR_VE) && (fpscr & FPSCR_VX))
+@@ -1764,7 +1764,7 @@ void SPEFloatingPointException(struct pt
+ extern int do_spe_mathemu(struct pt_regs *regs);
+ unsigned long spefscr;
+ int fpexc_mode;
+- int code = 0;
++ int code = FPE_FIXME;
+ int err;
+
+ flush_spe_to_thread(current);
+@@ -1833,7 +1833,7 @@ void SPEFloatingPointRoundException(stru
+ printk(KERN_ERR "unrecognized spe instruction "
+ "in %s at %lx\n", current->comm, regs->nip);
+ } else {
+- _exception(SIGFPE, regs, 0, regs->nip);
++ _exception(SIGFPE, regs, FPE_FIXME, regs->nip);
+ return;
+ }
+ }
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
+Date: Sun, 4 Jun 2017 14:43:43 +0800
+Subject: sit: reload iphdr in ipip6_rcv
+
+From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
+
+
+[ Upstream commit b699d0035836f6712917a41e7ae58d84359b8ff9 ]
+
+Since iptunnel_pull_header() can call pskb_may_pull(),
+we must reload any pointer that was related to skb->head.
+
+Fixes: a09a4c8dd1ec ("tunnels: Remove encapsulation offloads on decap")
+Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/sit.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -690,6 +690,7 @@ static int ipip6_rcv(struct sk_buff *skb
+
+ if (iptunnel_pull_header(skb, 0, htons(ETH_P_IPV6)))
+ goto out;
++ iph = ip_hdr(skb);
+
+ err = IP_ECN_decapsulate(iph, skb);
+ if (unlikely(err)) {
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Willem de Bruijn <willemb@google.com>
+Date: Thu, 8 Jun 2017 11:35:03 -0400
+Subject: skbuff: only inherit relevant tx_flags
+
+From: Willem de Bruijn <willemb@google.com>
+
+
+[ Upstream commit fff88030b3ff930ca7a3d74acfee0472f33887ea ]
+
+When inheriting tx_flags from one skbuff to another, always apply a
+mask to avoid overwriting unrelated other bits in the field.
+
+The two SKBTX_SHARED_FRAG cases clears all other bits. In practice,
+tx_flags are zero at this point now. But this is fragile. Timestamp
+flags are set, for instance, if in tcp_gso_segment, after this clear
+in skb_segment.
+
+The SKBTX_ANY_TSTAMP mask in __skb_tstamp_tx ensures that new
+skbs do not accidentally inherit flags such as SKBTX_SHARED_FRAG.
+
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/skbuff.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2551,7 +2551,8 @@ void skb_split(struct sk_buff *skb, stru
+ {
+ int pos = skb_headlen(skb);
+
+- skb_shinfo(skb1)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
++ skb_shinfo(skb1)->tx_flags |= skb_shinfo(skb)->tx_flags &
++ SKBTX_SHARED_FRAG;
+ if (len < pos) /* Split line is inside header. */
+ skb_split_inside_header(skb, skb1, len, pos);
+ else /* Second chunk has no header, nothing to copy. */
+@@ -3115,8 +3116,8 @@ struct sk_buff *skb_segment(struct sk_bu
+ skb_copy_from_linear_data_offset(head_skb, offset,
+ skb_put(nskb, hsize), hsize);
+
+- skb_shinfo(nskb)->tx_flags = skb_shinfo(head_skb)->tx_flags &
+- SKBTX_SHARED_FRAG;
++ skb_shinfo(nskb)->tx_flags |= skb_shinfo(head_skb)->tx_flags &
++ SKBTX_SHARED_FRAG;
+
+ while (pos < offset + len) {
+ if (i >= nfrags) {
+@@ -3734,7 +3735,8 @@ void __skb_tstamp_tx(struct sk_buff *ori
+ return;
+
+ if (tsonly) {
+- skb_shinfo(skb)->tx_flags = skb_shinfo(orig_skb)->tx_flags;
++ skb_shinfo(skb)->tx_flags |= skb_shinfo(orig_skb)->tx_flags &
++ SKBTX_ANY_TSTAMP;
+ skb_shinfo(skb)->tskey = skb_shinfo(orig_skb)->tskey;
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Sun, 4 Jun 2017 04:16:22 +0200
+Subject: skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow
+
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+
+
+[ Upstream commit 48a1df65334b74bd7531f932cca5928932abf769 ]
+
+This is a defense-in-depth measure in response to bugs like
+4d6fa57b4dab ("macsec: avoid heap overflow in skb_to_sgvec"). There's
+not only a potential overflow of sglist items, but also a stack overflow
+potential, so we fix this by limiting the amount of recursion this function
+is allowed to do. Not actually providing a bounded base case is a future
+disaster that we can easily avoid here.
+
+As a small matter of house keeping, we take this opportunity to move the
+documentation comment over the actual function the documentation is for.
+
+While this could be implemented by using an explicit stack of skbuffs,
+when implementing this, the function complexity increased considerably,
+and I don't think such complexity and bloat is actually worth it. So,
+instead I built this and tested it on x86, x86_64, ARM, ARM64, and MIPS,
+and measured the stack usage there. I also reverted the recent MIPS
+changes that give it a separate IRQ stack, so that I could experience
+some worst-case situations. I found that limiting it to 24 layers deep
+yielded a good stack usage with room for safety, as well as being much
+deeper than any driver actually ever creates.
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: David Howells <dhowells@redhat.com>
+Cc: Sabrina Dubroca <sd@queasysnail.net>
+Cc: "Michael S. Tsirkin" <mst@redhat.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/skbuff.h | 8 +++---
+ net/core/skbuff.c | 65 +++++++++++++++++++++++++++++++------------------
+ 2 files changed, 46 insertions(+), 27 deletions(-)
+
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -879,10 +879,10 @@ struct sk_buff *skb_realloc_headroom(str
+ unsigned int headroom);
+ struct sk_buff *skb_copy_expand(const struct sk_buff *skb, int newheadroom,
+ int newtailroom, gfp_t priority);
+-int skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg,
+- int offset, int len);
+-int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset,
+- int len);
++int __must_check skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg,
++ int offset, int len);
++int __must_check skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg,
++ int offset, int len);
+ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer);
+ int skb_pad(struct sk_buff *skb, int pad);
+ #define dev_kfree_skb(a) consume_skb(a)
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3329,24 +3329,18 @@ void __init skb_init(void)
+ NULL);
+ }
+
+-/**
+- * skb_to_sgvec - Fill a scatter-gather list from a socket buffer
+- * @skb: Socket buffer containing the buffers to be mapped
+- * @sg: The scatter-gather list to map into
+- * @offset: The offset into the buffer's contents to start mapping
+- * @len: Length of buffer space to be mapped
+- *
+- * Fill the specified scatter-gather list with mappings/pointers into a
+- * region of the buffer space attached to a socket buffer.
+- */
+ static int
+-__skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
++__skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len,
++ unsigned int recursion_level)
+ {
+ int start = skb_headlen(skb);
+ int i, copy = start - offset;
+ struct sk_buff *frag_iter;
+ int elt = 0;
+
++ if (unlikely(recursion_level >= 24))
++ return -EMSGSIZE;
++
+ if (copy > 0) {
+ if (copy > len)
+ copy = len;
+@@ -3365,6 +3359,8 @@ __skb_to_sgvec(struct sk_buff *skb, stru
+ end = start + skb_frag_size(&skb_shinfo(skb)->frags[i]);
+ if ((copy = end - offset) > 0) {
+ skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
++ if (unlikely(elt && sg_is_last(&sg[elt - 1])))
++ return -EMSGSIZE;
+
+ if (copy > len)
+ copy = len;
+@@ -3379,16 +3375,22 @@ __skb_to_sgvec(struct sk_buff *skb, stru
+ }
+
+ skb_walk_frags(skb, frag_iter) {
+- int end;
++ int end, ret;
+
+ WARN_ON(start > offset + len);
+
+ end = start + frag_iter->len;
+ if ((copy = end - offset) > 0) {
++ if (unlikely(elt && sg_is_last(&sg[elt - 1])))
++ return -EMSGSIZE;
++
+ if (copy > len)
+ copy = len;
+- elt += __skb_to_sgvec(frag_iter, sg+elt, offset - start,
+- copy);
++ ret = __skb_to_sgvec(frag_iter, sg+elt, offset - start,
++ copy, recursion_level + 1);
++ if (unlikely(ret < 0))
++ return ret;
++ elt += ret;
+ if ((len -= copy) == 0)
+ return elt;
+ offset += copy;
+@@ -3399,6 +3401,31 @@ __skb_to_sgvec(struct sk_buff *skb, stru
+ return elt;
+ }
+
++/**
++ * skb_to_sgvec - Fill a scatter-gather list from a socket buffer
++ * @skb: Socket buffer containing the buffers to be mapped
++ * @sg: The scatter-gather list to map into
++ * @offset: The offset into the buffer's contents to start mapping
++ * @len: Length of buffer space to be mapped
++ *
++ * Fill the specified scatter-gather list with mappings/pointers into a
++ * region of the buffer space attached to a socket buffer. Returns either
++ * the number of scatterlist items used, or -EMSGSIZE if the contents
++ * could not fit.
++ */
++int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
++{
++ int nsg = __skb_to_sgvec(skb, sg, offset, len, 0);
++
++ if (nsg <= 0)
++ return nsg;
++
++ sg_mark_end(&sg[nsg - 1]);
++
++ return nsg;
++}
++EXPORT_SYMBOL_GPL(skb_to_sgvec);
++
+ /* As compared with skb_to_sgvec, skb_to_sgvec_nomark only map skb to given
+ * sglist without mark the sg which contain last skb data as the end.
+ * So the caller can mannipulate sg list as will when padding new data after
+@@ -3421,19 +3448,11 @@ __skb_to_sgvec(struct sk_buff *skb, stru
+ int skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg,
+ int offset, int len)
+ {
+- return __skb_to_sgvec(skb, sg, offset, len);
++ return __skb_to_sgvec(skb, sg, offset, len, 0);
+ }
+ EXPORT_SYMBOL_GPL(skb_to_sgvec_nomark);
+
+-int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
+-{
+- int nsg = __skb_to_sgvec(skb, sg, offset, len);
+
+- sg_mark_end(&sg[nsg - 1]);
+-
+- return nsg;
+-}
+-EXPORT_SYMBOL_GPL(skb_to_sgvec);
+
+ /**
+ * skb_cow_data - Check that a socket buffer's data buffers are writable
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Fri, 12 May 2017 17:59:32 +0200
+Subject: SMB2: Fix share type handling
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit cd1230070ae1c12fd34cf6a557bfa81bf9311009 ]
+
+In fs/cifs/smb2pdu.h, we have:
+#define SMB2_SHARE_TYPE_DISK 0x01
+#define SMB2_SHARE_TYPE_PIPE 0x02
+#define SMB2_SHARE_TYPE_PRINT 0x03
+
+Knowing that, with the current code, the SMB2_SHARE_TYPE_PRINT case can
+never trigger and printer share would be interpreted as disk share.
+
+So, test the ShareType value for equality instead.
+
+Fixes: faaf946a7d5b ("CIFS: Add tree connect/disconnect capability for SMB2")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Aurelien Aptel <aaptel@suse.com>
+Signed-off-by: Steve French <smfrench@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/smb2pdu.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -999,15 +999,19 @@ SMB2_tcon(const unsigned int xid, struct
+ goto tcon_exit;
+ }
+
+- if (rsp->ShareType & SMB2_SHARE_TYPE_DISK)
++ switch (rsp->ShareType) {
++ case SMB2_SHARE_TYPE_DISK:
+ cifs_dbg(FYI, "connection to disk share\n");
+- else if (rsp->ShareType & SMB2_SHARE_TYPE_PIPE) {
++ break;
++ case SMB2_SHARE_TYPE_PIPE:
+ tcon->ipc = true;
+ cifs_dbg(FYI, "connection to pipe share\n");
+- } else if (rsp->ShareType & SMB2_SHARE_TYPE_PRINT) {
+- tcon->print = true;
++ break;
++ case SMB2_SHARE_TYPE_PRINT:
++ tcon->ipc = true;
+ cifs_dbg(FYI, "connection to printer\n");
+- } else {
++ break;
++ default:
+ cifs_dbg(VFS, "unknown share type %d\n", rsp->ShareType);
+ rc = -EOPNOTSUPP;
+ goto tcon_error_exit;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Jag Raman <jag.raman@oracle.com>
+Date: Fri, 9 Jun 2017 12:29:31 -0400
+Subject: sparc64: ldc abort during vds iso boot
+
+From: Jag Raman <jag.raman@oracle.com>
+
+
+[ Upstream commit 6c95483b768c62f8ee933ae08a1bdbcb78b5410f ]
+
+Orabug: 20902628
+
+When an ldc control-only packet is received during data exchange in
+read_nonraw(), a new rx head is calculated but the rx queue head is not
+actually advanced (rx_set_head() is not called) and a branch is taken to
+'no_data' at which point two things can happen depending on the value
+of the newly calculated rx head and the current rx tail:
+
+- If the rx queue is determined to be not empty, then the wrong packet
+ is picked up.
+
+- If the rx queue is determined to be empty, then a read error (EAGAIN)
+ is eventually returned since it is falsely assumed that more data was
+ expected.
+
+The fix is to update the rx head and return in case of a control only
+packet during data exchange.
+
+Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
+Reviewed-by: Aaron Young <aaron.young@oracle.com>
+Reviewed-by: Alexandre Chartre <alexandre.chartre@oracle.com>
+Reviewed-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
+Reviewed-by: Liam Merwick <liam.merwick@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/sparc/kernel/ldc.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -1733,9 +1733,14 @@ static int read_nonraw(struct ldc_channe
+
+ lp->rcv_nxt = p->seqid;
+
++ /*
++ * If this is a control-only packet, there is nothing
++ * else to do but advance the rx queue since the packet
++ * was already processed above.
++ */
+ if (!(p->type & LDC_DATA)) {
+ new = rx_advance(lp, new);
+- goto no_data;
++ break;
+ }
+ if (p->stype & (LDC_ACK | LDC_NACK)) {
+ err = data_ack_nack(lp, p);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Andrea della Porta <sfaragnaus@gmail.com>
+Date: Sat, 29 Apr 2017 07:30:23 +0100
+Subject: staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning
+
+From: Andrea della Porta <sfaragnaus@gmail.com>
+
+
+[ Upstream commit dea20579a69ab68cdca6adf79bb7c0c162eb9b72 ]
+
+staging: wlan-ng: prism2mgmt.c: This patches fixes a double endian conversion.
+cpu_to_le16() was called twice first in prism2mgmt_scan and again inside
+hfa384x_drvr_setconfig16() for the same variable, hence it was swapped
+twice. Incidentally, it also fixed the following sparse warning:
+
+drivers/staging/wlan-ng/prism2mgmt.c:173:30: warning: incorrect type in assignment (different base types)
+drivers/staging/wlan-ng/prism2mgmt.c:173:30: expected unsigned short [unsigned] [usertype] word
+drivers/staging/wlan-ng/prism2mgmt.c:173:30: got restricted __le16 [usertype] <noident>
+
+Unfortunately, only compile tested.
+
+Signed-off-by: Andrea della Porta <sfaragnaus@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/wlan-ng/prism2mgmt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/wlan-ng/prism2mgmt.c
++++ b/drivers/staging/wlan-ng/prism2mgmt.c
+@@ -169,7 +169,7 @@ int prism2mgmt_scan(wlandevice_t *wlande
+ hw->ident_sta_fw.variant) >
+ HFA384x_FIRMWARE_VERSION(1, 5, 0)) {
+ if (msg->scantype.data != P80211ENUM_scantype_active)
+- word = cpu_to_le16(msg->maxchanneltime.data);
++ word = msg->maxchanneltime.data;
+ else
+ word = 0;
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: NeilBrown <neilb@suse.com>
+Date: Thu, 25 May 2017 17:00:32 +1000
+Subject: SUNRPC: ensure correct error is reported by xs_tcp_setup_socket()
+
+From: NeilBrown <neilb@suse.com>
+
+
+[ Upstream commit 6ea44adce91526700535b3150f77f8639ae8c82d ]
+
+If you attempt a TCP mount from an host that is unreachable in a way
+that triggers an immediate error from kernel_connect(), that error
+does not propagate up, instead EAGAIN is reported.
+
+This results in call_connect_status receiving the wrong error.
+
+A case that it easy to demonstrate is to attempt to mount from an
+address that results in ENETUNREACH, but first deleting any default
+route.
+Without this patch, the mount.nfs process is persistently runnable
+and is hard to kill. With this patch it exits as it should.
+
+The problem is caused by the fact that xs_tcp_force_close() eventually
+calls
+ xprt_wake_pending_tasks(xprt, -EAGAIN);
+which causes an error return of -EAGAIN. so when xs_tcp_setup_sock()
+calls
+ xprt_wake_pending_tasks(xprt, status);
+the status is ignored.
+
+Fixes: 4efdd92c9211 ("SUNRPC: Remove TCP client connection reset hack")
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sunrpc/xprtsock.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2363,7 +2363,12 @@ static void xs_tcp_setup_socket(struct w
+ case -EHOSTUNREACH:
+ case -EADDRINUSE:
+ case -ENOBUFS:
+- /* retry with existing socket, after a delay */
++ /*
++ * xs_tcp_force_close() wakes tasks with -EIO.
++ * We need to wake them first to ensure the
++ * correct error code.
++ */
++ xprt_wake_pending_tasks(xprt, status);
+ xs_tcp_force_close(xprt);
+ goto out;
+ }
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+Date: Mon, 5 Jun 2017 13:59:15 +0200
+Subject: tags: honor COMPILED_SOURCE with apart output directory
+
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+
+
+[ Upstream commit cbf52a3e6a8a92beec6e0c70abf4111cd8f8faf7 ]
+
+When the kernel is compiled with an "O=" argument, the object files are
+not in the source tree, but in the build tree.
+
+This patch fixes O= build by looking for object files in the build tree.
+
+Fixes: 923e02ecf3f8 ("scripts/tags.sh: Support compiled source")
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/tags.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/scripts/tags.sh
++++ b/scripts/tags.sh
+@@ -106,6 +106,7 @@ all_compiled_sources()
+ case "$i" in
+ *.[cS])
+ j=${i/\.[cS]/\.o}
++ j="${j#$tree}"
+ if [ -e $j ]; then
+ echo $i
+ fi
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 23 May 2017 15:24:46 -0700
+Subject: tcp: better validation of received ack sequences
+
+From: Eric Dumazet <edumazet@google.com>
+
+
+[ Upstream commit d0e1a1b5a833b625c93d3d49847609350ebd79db ]
+
+Paul Fiterau Brostean reported :
+
+<quote>
+Linux TCP stack we analyze exhibits behavior that seems odd to me.
+The scenario is as follows (all packets have empty payloads, no window
+scaling, rcv/snd window size should not be a factor):
+
+ TEST HARNESS (CLIENT) LINUX SERVER
+
+ 1. - LISTEN (server listen,
+then accepts)
+
+ 2. - --> <SEQ=100><CTL=SYN> --> SYN-RECEIVED
+
+ 3. - <-- <SEQ=300><ACK=101><CTL=SYN,ACK> <-- SYN-RECEIVED
+
+ 4. - --> <SEQ=101><ACK=301><CTL=ACK> --> ESTABLISHED
+
+ 5. - <-- <SEQ=301><ACK=101><CTL=FIN,ACK> <-- FIN WAIT-1 (server
+opts to close the data connection calling "close" on the connection
+socket)
+
+ 6. - --> <SEQ=101><ACK=99999><CTL=FIN,ACK> --> CLOSING (client sends
+FIN,ACK with not yet sent acknowledgement number)
+
+ 7. - <-- <SEQ=302><ACK=102><CTL=ACK> <-- CLOSING (ACK is 102
+instead of 101, why?)
+
+... (silence from CLIENT)
+
+ 8. - <-- <SEQ=301><ACK=102><CTL=FIN,ACK> <-- CLOSING
+(retransmission, again ACK is 102)
+
+Now, note that packet 6 while having the expected sequence number,
+acknowledges something that wasn't sent by the server. So I would
+expect
+the packet to maybe prompt an ACK response from the server, and then be
+ignored. Yet it is not ignored and actually leads to an increase of the
+acknowledgement number in the server's retransmission of the FIN,ACK
+packet. The explanation I found is that the FIN in packet 6 was
+processed, despite the acknowledgement number being unacceptable.
+Further experiments indeed show that the server processes this FIN,
+transitioning to CLOSING, then on receiving an ACK for the FIN it had
+send in packet 5, the server (or better said connection) transitions
+from CLOSING to TIME_WAIT (as signaled by netstat).
+
+</quote>
+
+Indeed, tcp_rcv_state_process() calls tcp_ack() but
+does not exploit the @acceptable status but for TCP_SYN_RECV
+state.
+
+What we want here is to send a challenge ACK, if not in TCP_SYN_RECV
+state. TCP_FIN_WAIT1 state is not the only state we should fix.
+
+Add a FLAG_NO_CHALLENGE_ACK so that tcp_rcv_state_process()
+can choose to send a challenge ACK and discard the packet instead
+of wrongly change socket state.
+
+With help from Neal Cardwell.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Paul Fiterau Brostean <p.fiterau-brostean@science.ru.nl>
+Cc: Neal Cardwell <ncardwell@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Cc: Soheil Hassas Yeganeh <soheil@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_input.c | 24 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -117,6 +117,7 @@ int sysctl_tcp_invalid_ratelimit __read_
+ #define FLAG_DSACKING_ACK 0x800 /* SACK blocks contained D-SACK info */
+ #define FLAG_SACK_RENEGING 0x2000 /* snd_una advanced to a sacked seq */
+ #define FLAG_UPDATE_TS_RECENT 0x4000 /* tcp_replace_ts_recent() */
++#define FLAG_NO_CHALLENGE_ACK 0x8000 /* do not call tcp_send_challenge_ack() */
+
+ #define FLAG_ACKED (FLAG_DATA_ACKED|FLAG_SYN_ACKED)
+ #define FLAG_NOT_DUP (FLAG_DATA|FLAG_WIN_UPDATE|FLAG_ACKED)
+@@ -3543,7 +3544,8 @@ static int tcp_ack(struct sock *sk, cons
+ if (before(ack, prior_snd_una)) {
+ /* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */
+ if (before(ack, prior_snd_una - tp->max_window)) {
+- tcp_send_challenge_ack(sk, skb);
++ if (!(flag & FLAG_NO_CHALLENGE_ACK))
++ tcp_send_challenge_ack(sk, skb);
+ return -1;
+ }
+ goto old_ack;
+@@ -5832,13 +5834,17 @@ int tcp_rcv_state_process(struct sock *s
+
+ /* step 5: check the ACK field */
+ acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH |
+- FLAG_UPDATE_TS_RECENT) > 0;
++ FLAG_UPDATE_TS_RECENT |
++ FLAG_NO_CHALLENGE_ACK) > 0;
+
++ if (!acceptable) {
++ if (sk->sk_state == TCP_SYN_RECV)
++ return 1; /* send one RST */
++ tcp_send_challenge_ack(sk, skb);
++ goto discard;
++ }
+ switch (sk->sk_state) {
+ case TCP_SYN_RECV:
+- if (!acceptable)
+- return 1;
+-
+ if (!tp->srtt_us)
+ tcp_synack_rtt_meas(sk, req);
+
+@@ -5907,14 +5913,6 @@ int tcp_rcv_state_process(struct sock *s
+ * our SYNACK so stop the SYNACK timer.
+ */
+ if (req) {
+- /* Return RST if ack_seq is invalid.
+- * Note that RFC793 only says to generate a
+- * DUPACK for it but for TCP Fast Open it seems
+- * better to treat this case like TCP_SYN_RECV
+- * above.
+- */
+- if (!acceptable)
+- return 1;
+ /* We no longer need the request sock. */
+ reqsk_fastopen_remove(sk, req, false);
+ tcp_rearm_rto(sk);
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Yi Zeng <yizeng@asrmicro.com>
+Date: Tue, 26 Dec 2017 19:22:26 +0800
+Subject: thermal: power_allocator: fix one race condition issue for thermal_instances list
+
+From: Yi Zeng <yizeng@asrmicro.com>
+
+
+[ Upstream commit a5de11d67dcd268b8d0beb73dc374de5e97f0caf ]
+
+When invoking allow_maximum_power and traverse tz->thermal_instances,
+we should grab thermal_zone_device->lock to avoid race condition. For
+example, during the system reboot, if the mali GPU device implements
+device shutdown callback and unregister GPU devfreq cooling device,
+the deleted list head may be accessed to cause panic, as the following
+log shows:
+
+[ 33.551070] c3 25 (kworker/3:0) Unable to handle kernel paging request at virtual address dead000000000070
+[ 33.566708] c3 25 (kworker/3:0) pgd = ffffffc0ed290000
+[ 33.572071] c3 25 (kworker/3:0) [dead000000000070] *pgd=00000001ed292003, *pud=00000001ed292003, *pmd=0000000000000000
+[ 33.581515] c3 25 (kworker/3:0) Internal error: Oops: 96000004 [#1] PREEMPT SMP
+[ 33.599761] c3 25 (kworker/3:0) CPU: 3 PID: 25 Comm: kworker/3:0 Not tainted 4.4.35+ #912
+[ 33.614137] c3 25 (kworker/3:0) Workqueue: events_freezable thermal_zone_device_check
+[ 33.620245] c3 25 (kworker/3:0) task: ffffffc0f32e4200 ti: ffffffc0f32f0000 task.ti: ffffffc0f32f0000
+[ 33.629466] c3 25 (kworker/3:0) PC is at power_allocator_throttle+0x7c8/0x8a4
+[ 33.636609] c3 25 (kworker/3:0) LR is at power_allocator_throttle+0x808/0x8a4
+[ 33.643742] c3 25 (kworker/3:0) pc : [<ffffff8008683dd0>] lr : [<ffffff8008683e10>] pstate: 20000145
+[ 33.652874] c3 25 (kworker/3:0) sp : ffffffc0f32f3bb0
+[ 34.468519] c3 25 (kworker/3:0) Process kworker/3:0 (pid: 25, stack limit = 0xffffffc0f32f0020)
+[ 34.477220] c3 25 (kworker/3:0) Stack: (0xffffffc0f32f3bb0 to 0xffffffc0f32f4000)
+[ 34.819822] c3 25 (kworker/3:0) Call trace:
+[ 34.824021] c3 25 (kworker/3:0) Exception stack(0xffffffc0f32f39c0 to 0xffffffc0f32f3af0)
+[ 34.924993] c3 25 (kworker/3:0) [<ffffff8008683dd0>] power_allocator_throttle+0x7c8/0x8a4
+[ 34.933184] c3 25 (kworker/3:0) [<ffffff80086807f4>] handle_thermal_trip.part.25+0x70/0x224
+[ 34.941545] c3 25 (kworker/3:0) [<ffffff8008680a68>] thermal_zone_device_update+0xc0/0x20c
+[ 34.949818] c3 25 (kworker/3:0) [<ffffff8008680bd4>] thermal_zone_device_check+0x20/0x2c
+[ 34.957924] c3 25 (kworker/3:0) [<ffffff80080b93a4>] process_one_work+0x168/0x458
+[ 34.965414] c3 25 (kworker/3:0) [<ffffff80080ba068>] worker_thread+0x13c/0x4b4
+[ 34.972650] c3 25 (kworker/3:0) [<ffffff80080c0a4c>] kthread+0xe8/0xfc
+[ 34.979187] c3 25 (kworker/3:0) [<ffffff8008084e90>] ret_from_fork+0x10/0x40
+[ 34.986244] c3 25 (kworker/3:0) Code: f9405e73 eb1302bf d102e273 54ffc460 (b9402a61)
+[ 34.994339] c3 25 (kworker/3:0) ---[ end trace 32057901e3b7e1db ]---
+
+Signed-off-by: Yi Zeng <yizeng@asrmicro.com>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thermal/power_allocator.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/thermal/power_allocator.c
++++ b/drivers/thermal/power_allocator.c
+@@ -523,6 +523,7 @@ static void allow_maximum_power(struct t
+ struct thermal_instance *instance;
+ struct power_allocator_params *params = tz->governor_data;
+
++ mutex_lock(&tz->lock);
+ list_for_each_entry(instance, &tz->thermal_instances, tz_node) {
+ if ((instance->trip != params->trip_max_desired_temperature) ||
+ (!cdev_is_power_actor(instance->cdev)))
+@@ -532,6 +533,7 @@ static void allow_maximum_power(struct t
+ instance->cdev->updated = false;
+ thermal_cdev_update(instance->cdev);
+ }
++ mutex_unlock(&tz->lock);
+ }
+
+ /**
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Wed, 3 Jan 2018 10:18:03 -0800
+Subject: tty: n_gsm: Allow ADM response in addition to UA for control dlci
+
+From: Tony Lindgren <tony@atomide.com>
+
+
+[ Upstream commit ea3d8465ab9b3e01be329ac5195970a84bef76c5 ]
+
+Some devices have the control dlci stay in ADM mode instead of the UA
+mode. This can seen at least on droid 4 when trying to open the ts
+27.010 mux port. Enabling n_gsm debug mode shows the control dlci
+always respond with DM to SABM instead of UA:
+
+# modprobe n_gsm debug=0xff
+# ldattach -d GSM0710 /dev/ttyS0 &
+gsmld_output: 00000000: f9 03 3f 01 1c f9
+--> 0) C: SABM(P)
+gsmld_receive: 00000000: f9 03 1f 01 36 f9
+<-- 0) C: DM(P)
+...
+$ minicom -D /dev/gsmtty1
+minicom: cannot open /dev/gsmtty1: No error information
+$ strace minicom -D /dev/gsmtty1
+...
+open("/dev/gsmtty1", O_RDWR|O_NOCTTY|O_NONBLOCK|O_LARGEFILE) = -1 EL2HLT
+
+Note that this is different issue from other n_gsm -EL2HLT issues such
+as timeouts when the control dlci does not respond at all.
+
+The ADM mode seems to be a quite common according to "RF Wireless World"
+article "GSM Issue-UE sends SABM and gets a DM response instead of
+UA response":
+
+ This issue is most commonly observed in GSM networks where in UE sends
+ SABM and expects network to send UA response but it ends up receiving
+ DM response from the network. SABM stands for Set asynchronous balanced
+ mode, UA stands for Unnumbered Acknowledge and DA stands for
+ Disconnected Mode.
+
+ An RLP entity can be in one of two modes:
+ - Asynchronous Balanced Mode (ABM)
+ - Asynchronous Disconnected Mode (ADM)
+
+Currently Linux kernel closes the control dlci after several retries
+in gsm_dlci_t1() on DM. This causes n_gsm /dev/gsmtty ports to produce
+error code -EL2HLT when trying to open them as the closing of control
+dlci has already set gsm->dead.
+
+Let's fix the issue by allowing control dlci stay in ADM mode after the
+retries so the /dev/gsmtty ports can be opened and used. It seems that
+it might take several attempts to get any response from the control
+dlci, so it's best to allow ADM mode only after the SABM retries are
+done.
+
+Note that for droid 4 additional patches are needed to mux the ttyS0
+pins and to toggle RTS gpio_149 to wake up the mdm6600 modem are also
+needed to use n_gsm. And the mdm6600 modem needs to be powered on.
+
+Cc: linux-serial@vger.kernel.org
+Cc: Alan Cox <alan@llwyncelyn.cymru>
+Cc: Jiri Prchal <jiri.prchal@aksignal.cz>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Cc: Marcel Partap <mpartap@gmx.net>
+Cc: Michael Scott <michael.scott@linaro.org>
+Cc: Peter Hurley <peter@hurleysoftware.com>
+Cc: Russ Gorby <russ.gorby@intel.com>
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+Cc: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/n_gsm.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -1467,6 +1467,10 @@ static void gsm_dlci_open(struct gsm_dlc
+ * in which case an opening port goes back to closed and a closing port
+ * is simply put into closed state (any further frames from the other
+ * end will get a DM response)
++ *
++ * Some control dlci can stay in ADM mode with other dlci working just
++ * fine. In that case we can just keep the control dlci open after the
++ * DLCI_OPENING retries time out.
+ */
+
+ static void gsm_dlci_t1(unsigned long data)
+@@ -1480,8 +1484,15 @@ static void gsm_dlci_t1(unsigned long da
+ if (dlci->retries) {
+ gsm_command(dlci->gsm, dlci->addr, SABM|PF);
+ mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100);
+- } else
++ } else if (!dlci->addr && gsm->control == (DM | PF)) {
++ if (debug & 8)
++ pr_info("DLCI %d opening in ADM mode.\n",
++ dlci->addr);
++ gsm_dlci_open(dlci);
++ } else {
+ gsm_dlci_close(dlci);
++ }
++
+ break;
+ case DLCI_CLOSING:
+ dlci->retries--;
+@@ -1499,8 +1510,8 @@ static void gsm_dlci_t1(unsigned long da
+ * @dlci: DLCI to open
+ *
+ * Commence opening a DLCI from the Linux side. We issue SABM messages
+- * to the modem which should then reply with a UA, at which point we
+- * will move into open state. Opening is done asynchronously with retry
++ * to the modem which should then reply with a UA or ADM, at which point
++ * we will move into open state. Opening is done asynchronously with retry
+ * running off timers and the responses.
+ */
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Jisheng Zhang <jszhang@marvell.com>
+Date: Wed, 26 Apr 2017 16:59:34 +0800
+Subject: usb: chipidea: properly handle host or gadget initialization failure
+
+From: Jisheng Zhang <jszhang@marvell.com>
+
+
+[ Upstream commit c4a0bbbdb7f6e3c37fa6deb3ef28c5ed99da6175 ]
+
+If ci_hdrc_host_init() or ci_hdrc_gadget_init() returns error and the
+error != -ENXIO, as Peter pointed out, "it stands for initialization
+for host or gadget has failed", so we'd better return failure rather
+continue.
+
+And before destroying the otg, i.e ci_hdrc_otg_destroy(ci), we should
+also check ci->roles[CI_ROLE_GADGET].
+
+Signed-off-by: Jisheng Zhang <jszhang@marvell.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/chipidea/core.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -851,7 +851,7 @@ static inline void ci_role_destroy(struc
+ {
+ ci_hdrc_gadget_destroy(ci);
+ ci_hdrc_host_destroy(ci);
+- if (ci->is_otg)
++ if (ci->is_otg && ci->roles[CI_ROLE_GADGET])
+ ci_hdrc_otg_destroy(ci);
+ }
+
+@@ -951,27 +951,35 @@ static int ci_hdrc_probe(struct platform
+ /* initialize role(s) before the interrupt is requested */
+ if (dr_mode == USB_DR_MODE_OTG || dr_mode == USB_DR_MODE_HOST) {
+ ret = ci_hdrc_host_init(ci);
+- if (ret)
+- dev_info(dev, "doesn't support host\n");
++ if (ret) {
++ if (ret == -ENXIO)
++ dev_info(dev, "doesn't support host\n");
++ else
++ goto deinit_phy;
++ }
+ }
+
+ if (dr_mode == USB_DR_MODE_OTG || dr_mode == USB_DR_MODE_PERIPHERAL) {
+ ret = ci_hdrc_gadget_init(ci);
+- if (ret)
+- dev_info(dev, "doesn't support gadget\n");
++ if (ret) {
++ if (ret == -ENXIO)
++ dev_info(dev, "doesn't support gadget\n");
++ else
++ goto deinit_host;
++ }
+ }
+
+ if (!ci->roles[CI_ROLE_HOST] && !ci->roles[CI_ROLE_GADGET]) {
+ dev_err(dev, "no supported roles\n");
+ ret = -ENODEV;
+- goto deinit_phy;
++ goto deinit_gadget;
+ }
+
+ if (ci->is_otg && ci->roles[CI_ROLE_GADGET]) {
+ ret = ci_hdrc_otg_init(ci);
+ if (ret) {
+ dev_err(dev, "init otg fails, ret = %d\n", ret);
+- goto stop;
++ goto deinit_gadget;
+ }
+ }
+
+@@ -1036,7 +1044,12 @@ static int ci_hdrc_probe(struct platform
+
+ ci_extcon_unregister(ci);
+ stop:
+- ci_role_destroy(ci);
++ if (ci->is_otg && ci->roles[CI_ROLE_GADGET])
++ ci_hdrc_otg_destroy(ci);
++deinit_gadget:
++ ci_hdrc_gadget_destroy(ci);
++deinit_host:
++ ci_hdrc_host_destroy(ci);
+ deinit_phy:
+ ci_usb_phy_exit(ci);
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Pan Bian <bianpan2016@163.com>
+Date: Sun, 23 Apr 2017 13:55:13 +0800
+Subject: usb: dwc3: keystone: check return value
+
+From: Pan Bian <bianpan2016@163.com>
+
+
+[ Upstream commit 018047a1dba7636e1f7fdae2cc290a528991d648 ]
+
+Function devm_clk_get() returns an ERR_PTR when it fails. However, in
+function kdwc3_probe(), its return value is not checked, which may
+result in a bad memory access bug. This patch fixes the bug.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-keystone.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/dwc3/dwc3-keystone.c
++++ b/drivers/usb/dwc3/dwc3-keystone.c
+@@ -112,6 +112,10 @@ static int kdwc3_probe(struct platform_d
+ dev->dma_mask = &kdwc3_dma_mask;
+
+ kdwc->clk = devm_clk_get(kdwc->dev, "usb");
++ if (IS_ERR(kdwc->clk)) {
++ dev_err(kdwc->dev, "unable to get usb clock\n");
++ return PTR_ERR(kdwc->clk);
++ }
+
+ error = clk_prepare_enable(kdwc->clk);
+ if (error < 0) {
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 16 May 2017 11:47:42 -0400
+Subject: USB: ene_usb6250: fix first command execution
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+
+[ Upstream commit 4b309f1c4972c8f09e03ac64fc63510dbf5591a4 ]
+
+In the ene_usb6250 sub-driver for usb-storage, the ene_transport()
+routine is supposed to initialize the driver before executing the
+current command, if the initialization has not already been performed.
+However, a bug in the routine causes it to skip the command after
+doing the initialization. Also, the routine does not return an
+appropriate error code if either the initialization or the command
+fails.
+
+As a result of the first bug, the first command (a SCSI INQUIRY) is
+not carried out. The results can be seen in the system log, in the
+form of a warning message and empty or garbage INQUIRY data:
+
+Apr 18 22:40:08 notebook2 kernel: scsi host6: scsi scan: INQUIRY result too short (5), using 36
+Apr 18 22:40:08 notebook2 kernel: scsi 6:0:0:0: Direct-Access PQ: 0 ANSI: 0
+
+This patch fixes both errors.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: Andreas Hartmann <andihartmann@01019freenet.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/storage/ene_ub6250.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/storage/ene_ub6250.c
++++ b/drivers/usb/storage/ene_ub6250.c
+@@ -2306,21 +2306,22 @@ static int ms_scsi_irp(struct us_data *u
+
+ static int ene_transport(struct scsi_cmnd *srb, struct us_data *us)
+ {
+- int result = 0;
++ int result = USB_STOR_XFER_GOOD;
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra);
+
+ /*US_DEBUG(usb_stor_show_command(us, srb)); */
+ scsi_set_resid(srb, 0);
+- if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready))) {
++ if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready)))
+ result = ene_init(us);
+- } else {
++ if (result == USB_STOR_XFER_GOOD) {
++ result = USB_STOR_TRANSPORT_ERROR;
+ if (info->SD_Status.Ready)
+ result = sd_scsi_irp(us, srb);
+
+ if (info->MS_Status.Ready)
+ result = ms_scsi_irp(us, srb);
+ }
+- return 0;
++ return result;
+ }
+
+ static struct scsi_host_template ene_ub6250_host_template;
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 16 May 2017 11:47:52 -0400
+Subject: USB: ene_usb6250: fix SCSI residue overwriting
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+
+[ Upstream commit aa18c4b6e0e39bfb00af48734ec24bc189ac9909 ]
+
+In the ene_usb6250 sub-driver for usb-storage, the SCSI residue is not
+reported correctly. The residue is initialized to 0, but this value
+is overwritten whenever the driver sends firmware to the card reader
+before performing the current command. As a result, a valid READ or
+WRITE operation appears to have failed, causing the SCSI core to retry
+the command multiple times and eventually fail.
+
+This patch fixes the problem by resetting the SCSI residue to 0 after
+sending firmware to the device.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: Andreas Hartmann <andihartmann@01019freenet.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/storage/ene_ub6250.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/storage/ene_ub6250.c
++++ b/drivers/usb/storage/ene_ub6250.c
+@@ -1953,6 +1953,8 @@ static int ene_load_bincode(struct us_da
+ bcb->CDB[0] = 0xEF;
+
+ result = ene_send_scsi_cmd(us, FDIR_WRITE, buf, 0);
++ if (us->srb != NULL)
++ scsi_set_resid(us->srb, 0);
+ info->BIN_FLAG = flag;
+ kfree(buf);
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: "Pieter \\\"PoroCYon\\\" Sluys" <pcy@national.shitposting.agency>
+Date: Thu, 4 Jan 2018 16:53:50 +0100
+Subject: vfb: fix video mode and line_length being set when loaded
+
+From: "Pieter \\\"PoroCYon\\\" Sluys" <pcy@national.shitposting.agency>
+
+
+[ Upstream commit 7b9faf5df0ac495a1a3d7cdb64921c179f9008ac ]
+
+Currently, when loading the vfb module, the newly created fbdev
+has a line_length of 0, and its video mode would be PSEUDOCOLOR
+regardless of color depth. (The former could be worked around by
+calling the FBIOPUT_VSCREENINFO ioctl with having the FBACTIVIATE_FORCE
+flag set.) This patch automatically sets the line_length correctly,
+and the video mode is derived from the bit depth now as well.
+
+Thanks to Geert Uytterhoeven for confirming the bug and helping me with
+the patch.
+
+Output of `fbset -i' before the patch:
+mode "1366x768-60"
+ # D: 72.432 MHz, H: 47.403 kHz, V: 60.004 Hz
+ geometry 1366 768 1366 768 32
+ timings 13806 120 10 14 3 32 5
+ rgba 8/0,8/8,8/16,8/24
+endmode
+
+Frame buffer device information:
+ Name : Virtual FB
+ Address : 0xffffaa1405d85000
+ Size : 4196352
+ Type : PACKED PIXELS
+ Visual : PSEUDOCOLOR
+ XPanStep : 1
+ YPanStep : 1
+ YWrapStep : 1
+ LineLength : 0 <-- note this
+ Accelerator : No
+
+After:
+mode "1366x768-60"
+ # D: 72.432 MHz, H: 47.403 kHz, V: 60.004 Hz
+ geometry 1366 768 1366 768 32
+ timings 13806 120 10 14 3 32 5
+ rgba 8/0,8/8,8/16,8/24
+endmode
+
+Frame buffer device information:
+ Name : Virtual FB
+ Address : 0xffffaa1405d85000
+ Size : 4196352
+ Type : PACKED PIXELS
+ Visual : TRUECOLOR
+ XPanStep : 1
+ YPanStep : 1
+ YWrapStep : 1
+ LineLength : 5464
+ Accelerator : No
+
+Signed-off-by: "Pieter \"PoroCYon\" Sluys" <pcy@national.shitposting.agency>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+[b.zolnierkie: minor fixups]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/vfb.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/video/fbdev/vfb.c
++++ b/drivers/video/fbdev/vfb.c
+@@ -291,8 +291,23 @@ static int vfb_check_var(struct fb_var_s
+ */
+ static int vfb_set_par(struct fb_info *info)
+ {
++ switch (info->var.bits_per_pixel) {
++ case 1:
++ info->fix.visual = FB_VISUAL_MONO01;
++ break;
++ case 8:
++ info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
++ break;
++ case 16:
++ case 24:
++ case 32:
++ info->fix.visual = FB_VISUAL_TRUECOLOR;
++ break;
++ }
++
+ info->fix.line_length = get_line_length(info->var.xres_virtual,
+ info->var.bits_per_pixel);
++
+ return 0;
+ }
+
+@@ -525,6 +540,8 @@ static int vfb_probe(struct platform_dev
+ goto err2;
+ platform_set_drvdata(dev, info);
+
++ vfb_set_par(info);
++
+ fb_info(info, "Virtual frame buffer device, using %ldK of video memory\n",
+ videomemorysize >> 10);
+ return 0;
--- /dev/null
+From e2fcad58fd230f635a74e4e983c6f4ea893642d2 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Sun, 4 Jun 2017 04:16:26 +0200
+Subject: virtio_net: check return value of skb_to_sgvec always
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit e2fcad58fd230f635a74e4e983c6f4ea893642d2 upstream.
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Cc: "Michael S. Tsirkin" <mst@redhat.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[natechancellor: backport to 4.4]
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/virtio_net.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -858,7 +858,7 @@ static int xmit_skb(struct send_queue *s
+ struct virtio_net_hdr_mrg_rxbuf *hdr;
+ const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;
+ struct virtnet_info *vi = sq->vq->vdev->priv;
+- unsigned num_sg;
++ int num_sg;
+ unsigned hdr_len = vi->hdr_len;
+ bool can_push;
+
+@@ -911,11 +911,16 @@ static int xmit_skb(struct send_queue *s
+ if (can_push) {
+ __skb_push(skb, hdr_len);
+ num_sg = skb_to_sgvec(skb, sq->sg, 0, skb->len);
++ if (unlikely(num_sg < 0))
++ return num_sg;
+ /* Pull header back to avoid skew in tx bytes calculations. */
+ __skb_pull(skb, hdr_len);
+ } else {
+ sg_set_buf(sq->sg, hdr, hdr_len);
+- num_sg = skb_to_sgvec(skb, sq->sg + 1, 0, skb->len) + 1;
++ num_sg = skb_to_sgvec(skb, sq->sg + 1, 0, skb->len);
++ if (unlikely(num_sg < 0))
++ return num_sg;
++ num_sg++;
+ }
+ return virtqueue_add_outbuf(sq->vq, sq->sg, num_sg, skb, GFP_ATOMIC);
+ }
--- /dev/null
+From natechancellor@gmail.com Tue Apr 10 10:36:56 2018
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Mon, 9 Apr 2018 18:21:47 -0700
+Subject: virtio_net: check return value of skb_to_sgvec in one more location
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org
+Cc: Nathan Chancellor <natechancellor@gmail.com>, "Jason A . Donenfeld" <Jason@zx2c4.com>, Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>, "Michael S. Tsirkin" <mst@redhat.com>, Jason Wang <jasowang@redhat.com>, "David S . Miller" <davem@davemloft.net>
+Message-ID: <20180410012150.6573-7-natechancellor@gmail.com>
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+Kernels that do not have f6b10209b90d ("virtio-net: switch to use
+build_skb() for small buffer") will have an extra call to skb_to_sgvec
+that is not handled by e2fcad58fd23 ("virtio_net: check return value of
+skb_to_sgvec always"). Since the former does not appear to be stable
+material, just fix the call up directly.
+
+Cc: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Cc: "Michael S. Tsirkin" <mst@redhat.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/virtio_net.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -556,7 +556,12 @@ static int add_recvbuf_small(struct virt
+ hdr = skb_vnet_hdr(skb);
+ sg_init_table(rq->sg, 2);
+ sg_set_buf(rq->sg, hdr, vi->hdr_len);
+- skb_to_sgvec(skb, rq->sg + 1, 0, skb->len);
++
++ err = skb_to_sgvec(skb, rq->sg + 1, 0, skb->len);
++ if (unlikely(err < 0)) {
++ dev_kfree_skb(skb);
++ return err;
++ }
+
+ err = virtqueue_add_inbuf(rq->vq, rq->sg, 2, skb, gfp);
+ if (err < 0)
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Fri, 12 May 2017 12:00:01 -0400
+Subject: vmxnet3: ensure that adapter is in proper state during force_close
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+
+[ Upstream commit 1c4d5f51a812a82de97beee24f48ed05c65ebda5 ]
+
+There are several paths in vmxnet3, where settings changes cause the
+adapter to be brought down and back up (vmxnet3_set_ringparam among
+them). Should part of the reset operation fail, these paths call
+vmxnet3_force_close, which enables all napi instances prior to calling
+dev_close (with the expectation that vmxnet3_close will then properly
+disable them again). However, vmxnet3_force_close neglects to clear
+VMXNET3_STATE_BIT_QUIESCED prior to calling dev_close. As a result
+vmxnet3_quiesce_dev (called from vmxnet3_close), returns early, and
+leaves all the napi instances in a enabled state while the device itself
+is closed. If a device in this state is activated again, napi_enable
+will be called on already enabled napi_instances, leading to a BUG halt.
+
+The fix is to simply enausre that the QUIESCED bit is cleared in
+vmxnet3_force_close to allow quesence to be completed properly on close.
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+CC: Shrikrishna Khare <skhare@vmware.com>
+CC: "VMware, Inc." <pv-drivers@vmware.com>
+CC: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vmxnet3/vmxnet3_drv.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -2789,6 +2789,11 @@ vmxnet3_force_close(struct vmxnet3_adapt
+ /* we need to enable NAPI, otherwise dev_close will deadlock */
+ for (i = 0; i < adapter->num_rx_queues; i++)
+ napi_enable(&adapter->rx_queue[i].napi);
++ /*
++ * Need to clear the quiesce bit to ensure that vmxnet3_close
++ * can quiesce the device properly
++ */
++ clear_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state);
+ dev_close(adapter->netdev);
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Roopa Prabhu <roopa@cumulusnetworks.com>
+Date: Sun, 11 Jun 2017 16:32:50 -0700
+Subject: vxlan: dont migrate permanent fdb entries during learn
+
+From: Roopa Prabhu <roopa@cumulusnetworks.com>
+
+
+[ Upstream commit e0090a9e979de5202c7d16c635dea2f005221073 ]
+
+This patch fixes vxlan_snoop to not move permanent fdb entries
+on learn events. This is consistent with the bridge fdb
+handling of permanent entries.
+
+Fixes: 26a41ae60438 ("vxlan: only migrate dynamic FDB entries")
+Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vxlan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -962,7 +962,7 @@ static bool vxlan_snoop(struct net_devic
+ return false;
+
+ /* Don't migrate static entries, drop packets */
+- if (f->state & NUD_NOARP)
++ if (f->state & (NUD_PERMANENT | NUD_NOARP))
+ return true;
+
+ if (net_ratelimit())
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 26 Dec 2017 17:33:18 +0000
+Subject: wl1251: check return from call to wl1251_acx_arp_ip_filter
+
+From: Colin Ian King <colin.king@canonical.com>
+
+
+[ Upstream commit ac1181c60822292176ab96912208ec9f9819faf8 ]
+
+Currently the less than zero error check on ret is incorrect
+as it is checking a far earlier ret assignment rather than the
+return from the call to wl1251_acx_arp_ip_filter. Fix this by
+adding in the missing assginment.
+
+Detected by CoverityScan, CID#1164835 ("Logically dead code")
+
+Fixes: 204cc5c44fb6 ("wl1251: implement hardware ARP filtering")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ti/wl1251/main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ti/wl1251/main.c
++++ b/drivers/net/wireless/ti/wl1251/main.c
+@@ -1196,8 +1196,7 @@ static void wl1251_op_bss_info_changed(s
+ WARN_ON(wl->bss_type != BSS_TYPE_STA_BSS);
+
+ enable = bss_conf->arp_addr_cnt == 1 && bss_conf->assoc;
+- wl1251_acx_arp_ip_filter(wl, enable, addr);
+-
++ ret = wl1251_acx_arp_ip_filter(wl, enable, addr);
+ if (ret < 0)
+ goto out_sleep;
+ }
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Thu, 4 May 2017 09:51:40 -0500
+Subject: x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic()
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+
+[ Upstream commit 42fc6c6cb1662ba2fa727dd01c9473c63be4e3b6 ]
+
+Andrey Konovalov reported the following warning while fuzzing the kernel
+with syzkaller:
+
+ WARNING: kernel stack regs at ffff8800686869f8 in a.out:4933 has bad 'bp' value c3fc855a10167ec0
+
+The unwinder dump revealed that RBP had a bad value when an interrupt
+occurred in csum_partial_copy_generic().
+
+That function saves RBP on the stack and then overwrites it, using it as
+a scratch register. That's problematic because it breaks stack traces
+if an interrupt occurs in the middle of the function.
+
+Replace the usage of RBP with another callee-saved register (R15) so
+stack traces are no longer affected.
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Cong Wang <xiyou.wangcong@gmail.com>
+Cc: David S . Miller <davem@davemloft.net>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Kostya Serebryany <kcc@google.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Cc: Neil Horman <nhorman@tuxdriver.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vlad Yasevich <vyasevich@gmail.com>
+Cc: linux-sctp@vger.kernel.org
+Cc: netdev <netdev@vger.kernel.org>
+Cc: syzkaller <syzkaller@googlegroups.com>
+Link: http://lkml.kernel.org/r/4b03a961efda5ec9bfe46b7b9c9ad72d1efad343.1493909486.git.jpoimboe@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/lib/csum-copy_64.S | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/lib/csum-copy_64.S
++++ b/arch/x86/lib/csum-copy_64.S
+@@ -55,7 +55,7 @@ ENTRY(csum_partial_copy_generic)
+ movq %r12, 3*8(%rsp)
+ movq %r14, 4*8(%rsp)
+ movq %r13, 5*8(%rsp)
+- movq %rbp, 6*8(%rsp)
++ movq %r15, 6*8(%rsp)
+
+ movq %r8, (%rsp)
+ movq %r9, 1*8(%rsp)
+@@ -74,7 +74,7 @@ ENTRY(csum_partial_copy_generic)
+ /* main loop. clear in 64 byte blocks */
+ /* r9: zero, r8: temp2, rbx: temp1, rax: sum, rcx: saved length */
+ /* r11: temp3, rdx: temp4, r12 loopcnt */
+- /* r10: temp5, rbp: temp6, r14 temp7, r13 temp8 */
++ /* r10: temp5, r15: temp6, r14 temp7, r13 temp8 */
+ .p2align 4
+ .Lloop:
+ source
+@@ -89,7 +89,7 @@ ENTRY(csum_partial_copy_generic)
+ source
+ movq 32(%rdi), %r10
+ source
+- movq 40(%rdi), %rbp
++ movq 40(%rdi), %r15
+ source
+ movq 48(%rdi), %r14
+ source
+@@ -103,7 +103,7 @@ ENTRY(csum_partial_copy_generic)
+ adcq %r11, %rax
+ adcq %rdx, %rax
+ adcq %r10, %rax
+- adcq %rbp, %rax
++ adcq %r15, %rax
+ adcq %r14, %rax
+ adcq %r13, %rax
+
+@@ -121,7 +121,7 @@ ENTRY(csum_partial_copy_generic)
+ dest
+ movq %r10, 32(%rsi)
+ dest
+- movq %rbp, 40(%rsi)
++ movq %r15, 40(%rsi)
+ dest
+ movq %r14, 48(%rsi)
+ dest
+@@ -203,7 +203,7 @@ ENTRY(csum_partial_copy_generic)
+ movq 3*8(%rsp), %r12
+ movq 4*8(%rsp), %r14
+ movq 5*8(%rsp), %r13
+- movq 6*8(%rsp), %rbp
++ movq 6*8(%rsp), %r15
+ addq $7*8, %rsp
+ ret
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 13 Apr 2017 14:56:44 +0200
+Subject: x86/tsc: Provide 'tsc=unstable' boot parameter
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+
+[ Upstream commit 8309f86cd41e8714526867177facf7a316d9be53 ]
+
+Since the clocksource watchdog will only detect broken TSC after the
+fact, all TSC based clocks will likely have observed non-continuous
+values before/when switching away from TSC.
+
+Therefore only thing to fully avoid random clock movement when your
+BIOS randomly mucks with TSC values from SMI handlers is reporting the
+TSC as unstable at boot.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Mike Galbraith <efault@gmx.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/tsc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -365,6 +365,8 @@ static int __init tsc_setup(char *str)
+ tsc_clocksource_reliable = 1;
+ if (!strncmp(str, "noirqtime", 9))
+ no_sched_irq_time = 1;
++ if (!strcmp(str, "unstable"))
++ mark_tsc_unstable("boot parameter");
+ return 1;
+ }
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 8 Jun 2017 10:53:10 +0200
+Subject: xen: avoid type warning in xchg_xen_ulong
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit 9cc91f212111cdcbefa02dcdb7dd443f224bf52c ]
+
+The improved type-checking version of container_of() triggers a warning for
+xchg_xen_ulong, pointing out that 'xen_ulong_t' is unsigned, but atomic64_t
+contains a signed value:
+
+drivers/xen/events/events_2l.c: In function 'evtchn_2l_handle_events':
+drivers/xen/events/events_2l.c:187:1020: error: call to '__compiletime_assert_187' declared with attribute error: pointer type mismatch in container_of()
+
+This adds a cast to work around the warning.
+
+Cc: Ian Abbott <abbotti@mev.co.uk>
+Fixes: 85323a991d40 ("xen: arm: mandate EABI and use generic atomic operations.")
+Fixes: daa2ac80834d ("kernel.h: handle pointers to arrays better in container_of()")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
+Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
+Acked-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/include/asm/xen/events.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/include/asm/xen/events.h
++++ b/arch/arm/include/asm/xen/events.h
+@@ -16,7 +16,7 @@ static inline int xen_irqs_disabled(stru
+ return raw_irqs_disabled_flags(regs->ARM_cpsr);
+ }
+
+-#define xchg_xen_ulong(ptr, val) atomic64_xchg(container_of((ptr), \
++#define xchg_xen_ulong(ptr, val) atomic64_xchg(container_of((long long*)(ptr),\
+ atomic64_t, \
+ counter), (val))
+
--- /dev/null
+From foo@baz Tue Apr 10 10:31:53 CEST 2018
+From: Antony Antony <antony@phenome.org>
+Date: Fri, 19 May 2017 12:47:00 +0200
+Subject: xfrm: fix state migration copy replay sequence numbers
+
+From: Antony Antony <antony@phenome.org>
+
+
+[ Upstream commit a486cd23661c9387fb076c3f6ae8b2aa9d20d54a ]
+
+During xfrm migration copy replay and preplay sequence numbers
+from the previous state.
+
+Here is a tcpdump output showing the problem.
+10.0.10.46 is running vanilla kernel, is the IKE/IPsec responder.
+After the migration it sent wrong sequence number, reset to 1.
+The migration is from 10.0.0.52 to 10.0.0.53.
+
+IP 10.0.0.52.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7cf), length 136
+IP 10.0.10.46.4500 > 10.0.0.52.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x7cf), length 136
+IP 10.0.0.52.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d0), length 136
+IP 10.0.10.46.4500 > 10.0.0.52.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x7d0), length 136
+
+IP 10.0.0.53.4500 > 10.0.10.46.4500: NONESP-encap: isakmp: child_sa inf2[I]
+IP 10.0.10.46.4500 > 10.0.0.53.4500: NONESP-encap: isakmp: child_sa inf2[R]
+IP 10.0.0.53.4500 > 10.0.10.46.4500: NONESP-encap: isakmp: child_sa inf2[I]
+IP 10.0.10.46.4500 > 10.0.0.53.4500: NONESP-encap: isakmp: child_sa inf2[R]
+
+IP 10.0.0.53.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d1), length 136
+
+NOTE: next sequence is wrong 0x1
+
+IP 10.0.10.46.4500 > 10.0.0.53.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x1), length 136
+IP 10.0.0.53.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d2), length 136
+IP 10.0.10.46.4500 > 10.0.0.53.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x2), length 136
+
+Signed-off-by: Antony Antony <antony@phenome.org>
+Reviewed-by: Richard Guy Briggs <rgb@tricolour.ca>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_state.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -1208,6 +1208,8 @@ static struct xfrm_state *xfrm_state_clo
+ x->curlft.add_time = orig->curlft.add_time;
+ x->km.state = orig->km.state;
+ x->km.seq = orig->km.seq;
++ x->replay = orig->replay;
++ x->preplay = orig->preplay;
+
+ return x;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
