--- /dev/null
+From f77288797b4b4ef6e4fc188bc811b711be6345f1 Mon Sep 17 00:00:00 2001
+From: Qian Cai <cai@lca.pw>
+Date: Tue, 30 Jul 2019 17:23:48 -0400
+Subject: arm64/efi: fix variable 'si' set but not used
+
+[ Upstream commit f1d4836201543e88ebe70237e67938168d5fab19 ]
+
+GCC throws out this warning on arm64.
+
+drivers/firmware/efi/libstub/arm-stub.c: In function 'efi_entry':
+drivers/firmware/efi/libstub/arm-stub.c:132:22: warning: variable 'si'
+set but not used [-Wunused-but-set-variable]
+
+Fix it by making free_screen_info() a static inline function.
+
+Acked-by: Will Deacon <will@kernel.org>
+Signed-off-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/efi.h | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
+index 65615820155e6..65db124a44bff 100644
+--- a/arch/arm64/include/asm/efi.h
++++ b/arch/arm64/include/asm/efi.h
+@@ -52,7 +52,11 @@ int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md);
+ #define efi_is_64bit() (true)
+
+ #define alloc_screen_info(x...) &screen_info
+-#define free_screen_info(x...)
++
++static inline void free_screen_info(efi_system_table_t *sys_table_arg,
++ struct screen_info *si)
++{
++}
+
+ /* redeclare as 'hidden' so the compiler will generate relative references */
+ extern struct screen_info screen_info __attribute__((__visibility__("hidden")));
+--
+2.20.1
+
--- /dev/null
+From 5fc95ddd3acd42a050d29a1ddb88e442cfabbd5f Mon Sep 17 00:00:00 2001
+From: Qian Cai <cai@lca.pw>
+Date: Wed, 31 Jul 2019 16:05:45 -0400
+Subject: arm64/mm: fix variable 'pud' set but not used
+
+[ Upstream commit 7d4e2dcf311d3b98421d1f119efe5964cafa32fc ]
+
+GCC throws a warning,
+
+arch/arm64/mm/mmu.c: In function 'pud_free_pmd_page':
+arch/arm64/mm/mmu.c:1033:8: warning: variable 'pud' set but not used
+[-Wunused-but-set-variable]
+ pud_t pud;
+ ^~~
+
+because pud_table() is a macro and compiled away. Fix it by making it a
+static inline function and for pud_sect() as well.
+
+Signed-off-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/pgtable.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 73e3718356b05..edb2c359480db 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -387,8 +387,8 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
+ PMD_TYPE_SECT)
+
+ #if defined(CONFIG_ARM64_64K_PAGES) || CONFIG_PGTABLE_LEVELS < 3
+-#define pud_sect(pud) (0)
+-#define pud_table(pud) (1)
++static inline bool pud_sect(pud_t pud) { return false; }
++static inline bool pud_table(pud_t pud) { return true; }
+ #else
+ #define pud_sect(pud) ((pud_val(pud) & PUD_TYPE_MASK) == \
+ PUD_TYPE_SECT)
+--
+2.20.1
+
--- /dev/null
+From 2713db9dfc660fe911f143f3f2906d07b29f898e Mon Sep 17 00:00:00 2001
+From: Qian Cai <cai@lca.pw>
+Date: Fri, 2 Aug 2019 21:49:19 -0700
+Subject: asm-generic: fix -Wtype-limits compiler warnings
+
+[ Upstream commit cbedfe11347fe418621bd188d58a206beb676218 ]
+
+Commit d66acc39c7ce ("bitops: Optimise get_order()") introduced a
+compilation warning because "rx_frag_size" is an "ushort" while
+PAGE_SHIFT here is 16.
+
+The commit changed the get_order() to be a multi-line macro where
+compilers insist to check all statements in the macro even when
+__builtin_constant_p(rx_frag_size) will return false as "rx_frag_size"
+is a module parameter.
+
+In file included from ./arch/powerpc/include/asm/page_64.h:107,
+ from ./arch/powerpc/include/asm/page.h:242,
+ from ./arch/powerpc/include/asm/mmu.h:132,
+ from ./arch/powerpc/include/asm/lppaca.h:47,
+ from ./arch/powerpc/include/asm/paca.h:17,
+ from ./arch/powerpc/include/asm/current.h:13,
+ from ./include/linux/thread_info.h:21,
+ from ./arch/powerpc/include/asm/processor.h:39,
+ from ./include/linux/prefetch.h:15,
+ from drivers/net/ethernet/emulex/benet/be_main.c:14:
+drivers/net/ethernet/emulex/benet/be_main.c: In function 'be_rx_cqs_create':
+./include/asm-generic/getorder.h:54:9: warning: comparison is always
+true due to limited range of data type [-Wtype-limits]
+ (((n) < (1UL << PAGE_SHIFT)) ? 0 : \
+ ^
+drivers/net/ethernet/emulex/benet/be_main.c:3138:33: note: in expansion
+of macro 'get_order'
+ adapter->big_page_size = (1 << get_order(rx_frag_size)) * PAGE_SIZE;
+ ^~~~~~~~~
+
+Fix it by moving all of this multi-line macro into a proper function,
+and killing __get_order() off.
+
+[akpm@linux-foundation.org: remove __get_order() altogether]
+[cai@lca.pw: v2]
+ Link: http://lkml.kernel.org/r/1564000166-31428-1-git-send-email-cai@lca.pw
+Link: http://lkml.kernel.org/r/1563914986-26502-1-git-send-email-cai@lca.pw
+Fixes: d66acc39c7ce ("bitops: Optimise get_order()")
+Signed-off-by: Qian Cai <cai@lca.pw>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: David Howells <dhowells@redhat.com>
+Cc: Jakub Jelinek <jakub@redhat.com>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: James Y Knight <jyknight@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/getorder.h | 50 ++++++++++++++--------------------
+ 1 file changed, 20 insertions(+), 30 deletions(-)
+
+diff --git a/include/asm-generic/getorder.h b/include/asm-generic/getorder.h
+index 65e4468ac53da..52fbf236a90ea 100644
+--- a/include/asm-generic/getorder.h
++++ b/include/asm-generic/getorder.h
+@@ -6,24 +6,6 @@
+ #include <linux/compiler.h>
+ #include <linux/log2.h>
+
+-/*
+- * Runtime evaluation of get_order()
+- */
+-static inline __attribute_const__
+-int __get_order(unsigned long size)
+-{
+- int order;
+-
+- size--;
+- size >>= PAGE_SHIFT;
+-#if BITS_PER_LONG == 32
+- order = fls(size);
+-#else
+- order = fls64(size);
+-#endif
+- return order;
+-}
+-
+ /**
+ * get_order - Determine the allocation order of a memory size
+ * @size: The size for which to get the order
+@@ -42,19 +24,27 @@ int __get_order(unsigned long size)
+ * to hold an object of the specified size.
+ *
+ * The result is undefined if the size is 0.
+- *
+- * This function may be used to initialise variables with compile time
+- * evaluations of constants.
+ */
+-#define get_order(n) \
+-( \
+- __builtin_constant_p(n) ? ( \
+- ((n) == 0UL) ? BITS_PER_LONG - PAGE_SHIFT : \
+- (((n) < (1UL << PAGE_SHIFT)) ? 0 : \
+- ilog2((n) - 1) - PAGE_SHIFT + 1) \
+- ) : \
+- __get_order(n) \
+-)
++static inline __attribute_const__ int get_order(unsigned long size)
++{
++ if (__builtin_constant_p(size)) {
++ if (!size)
++ return BITS_PER_LONG - PAGE_SHIFT;
++
++ if (size < (1UL << PAGE_SHIFT))
++ return 0;
++
++ return ilog2((size) - 1) - PAGE_SHIFT + 1;
++ }
++
++ size--;
++ size >>= PAGE_SHIFT;
++#if BITS_PER_LONG == 32
++ return fls(size);
++#else
++ return fls64(size);
++#endif
++}
+
+ #endif /* __ASSEMBLY__ */
+
+--
+2.20.1
+
--- /dev/null
+From f883eaed96eb6e9a2090ac84e055bd3d387060fb Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Wed, 31 Jul 2019 14:26:51 +0200
+Subject: ata: libahci: do not complain in case of deferred probe
+
+[ Upstream commit 090bb803708198e5ab6b0046398c7ed9f4d12d6b ]
+
+Retrieving PHYs can defer the probe, do not spawn an error when
+-EPROBE_DEFER is returned, it is normal behavior.
+
+Fixes: b1a9edbda040 ("ata: libahci: allow to use multiple PHYs")
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libahci_platform.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
+index cd2eab6aa92ea..65371e1befe8a 100644
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -300,6 +300,9 @@ static int ahci_platform_get_phy(struct ahci_host_priv *hpriv, u32 port,
+ hpriv->phys[port] = NULL;
+ rc = 0;
+ break;
++ case -EPROBE_DEFER:
++ /* Do not complain yet */
++ break;
+
+ default:
+ dev_err(dev,
+--
+2.20.1
+
--- /dev/null
+From 1fc8a4c52e0a776f2dd9ab33c851ea29c8035615 Mon Sep 17 00:00:00 2001
+From: Christian Brauner <christian@brauner.io>
+Date: Mon, 29 Jul 2019 17:48:24 +0200
+Subject: exit: make setting exit_state consistent
+
+[ Upstream commit 30b692d3b390c6fe78a5064be0c4bbd44a41be59 ]
+
+Since commit b191d6491be6 ("pidfd: fix a poll race when setting exit_state")
+we unconditionally set exit_state to EXIT_ZOMBIE before calling into
+do_notify_parent(). This was done to eliminate a race when querying
+exit_state in do_notify_pidfd().
+Back then we decided to do the absolute minimal thing to fix this and
+not touch the rest of the exit_notify() function where exit_state is
+set.
+Since this fix has not caused any issues change the setting of
+exit_state to EXIT_DEAD in the autoreap case to account for the fact hat
+exit_state is set to EXIT_ZOMBIE unconditionally. This fix was planned
+but also explicitly requested in [1] and makes the whole code more
+consistent.
+
+/* References */
+[1]: https://lore.kernel.org/lkml/CAHk-=wigcxGFR2szue4wavJtH5cYTTeNES=toUBVGsmX0rzX+g@mail.gmail.com
+
+Signed-off-by: Christian Brauner <christian@brauner.io>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/exit.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/exit.c b/kernel/exit.c
+index d9394fcd0e2c3..d8fee3e1ec1f2 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -694,9 +694,10 @@ static void exit_notify(struct task_struct *tsk, int group_dead)
+ autoreap = true;
+ }
+
+- tsk->exit_state = autoreap ? EXIT_DEAD : EXIT_ZOMBIE;
+- if (tsk->exit_state == EXIT_DEAD)
++ if (autoreap) {
++ tsk->exit_state = EXIT_DEAD;
+ list_add(&tsk->ptrace_entry, &dead);
++ }
+
+ /* mt-exec, de_thread() is waiting for group leader */
+ if (unlikely(tsk->signal->notify_count < 0))
+--
+2.20.1
+
--- /dev/null
+From 9f62726bec2178c39dd9a62ca2b0c0dac308ed30 Mon Sep 17 00:00:00 2001
+From: "Luck, Tony" <tony.luck@intel.com>
+Date: Tue, 30 Jul 2019 21:39:57 -0700
+Subject: IB/core: Add mitigation for Spectre V1
+
+[ Upstream commit 61f259821dd3306e49b7d42a3f90fb5a4ff3351b ]
+
+Some processors may mispredict an array bounds check and
+speculatively access memory that they should not. With
+a user supplied array index we like to play things safe
+by masking the value with the array size before it is
+used as an index.
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/r/20190731043957.GA1600@agluck-desk2.amr.corp.intel.com
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/user_mad.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
+index 415a3185cde7f..cf93a96b63249 100644
+--- a/drivers/infiniband/core/user_mad.c
++++ b/drivers/infiniband/core/user_mad.c
+@@ -49,6 +49,7 @@
+ #include <linux/sched.h>
+ #include <linux/semaphore.h>
+ #include <linux/slab.h>
++#include <linux/nospec.h>
+
+ #include <asm/uaccess.h>
+
+@@ -843,11 +844,14 @@ static int ib_umad_unreg_agent(struct ib_umad_file *file, u32 __user *arg)
+
+ if (get_user(id, arg))
+ return -EFAULT;
++ if (id >= IB_UMAD_MAX_AGENTS)
++ return -EINVAL;
+
+ mutex_lock(&file->port->file_mutex);
+ mutex_lock(&file->mutex);
+
+- if (id >= IB_UMAD_MAX_AGENTS || !__get_agent(file, id)) {
++ id = array_index_nospec(id, IB_UMAD_MAX_AGENTS);
++ if (!__get_agent(file, id)) {
+ ret = -EINVAL;
+ goto out;
+ }
+--
+2.20.1
+
--- /dev/null
+From 6d0be3d53dbaca2c3b1670430914651ab3babf71 Mon Sep 17 00:00:00 2001
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Date: Thu, 1 Aug 2019 15:14:49 +0300
+Subject: IB/mad: Fix use-after-free in ib mad completion handling
+
+[ Upstream commit 770b7d96cfff6a8bf6c9f261ba6f135dc9edf484 ]
+
+We encountered a use-after-free bug when unloading the driver:
+
+[ 3562.116059] BUG: KASAN: use-after-free in ib_mad_post_receive_mads+0xddc/0xed0 [ib_core]
+[ 3562.117233] Read of size 4 at addr ffff8882ca5aa868 by task kworker/u13:2/23862
+[ 3562.118385]
+[ 3562.119519] CPU: 2 PID: 23862 Comm: kworker/u13:2 Tainted: G OE 5.1.0-for-upstream-dbg-2019-05-19_16-44-30-13 #1
+[ 3562.121806] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu2 04/01/2014
+[ 3562.123075] Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core]
+[ 3562.124383] Call Trace:
+[ 3562.125640] dump_stack+0x9a/0xeb
+[ 3562.126911] print_address_description+0xe3/0x2e0
+[ 3562.128223] ? ib_mad_post_receive_mads+0xddc/0xed0 [ib_core]
+[ 3562.129545] __kasan_report+0x15c/0x1df
+[ 3562.130866] ? ib_mad_post_receive_mads+0xddc/0xed0 [ib_core]
+[ 3562.132174] kasan_report+0xe/0x20
+[ 3562.133514] ib_mad_post_receive_mads+0xddc/0xed0 [ib_core]
+[ 3562.134835] ? find_mad_agent+0xa00/0xa00 [ib_core]
+[ 3562.136158] ? qlist_free_all+0x51/0xb0
+[ 3562.137498] ? mlx4_ib_sqp_comp_worker+0x1970/0x1970 [mlx4_ib]
+[ 3562.138833] ? quarantine_reduce+0x1fa/0x270
+[ 3562.140171] ? kasan_unpoison_shadow+0x30/0x40
+[ 3562.141522] ib_mad_recv_done+0xdf6/0x3000 [ib_core]
+[ 3562.142880] ? _raw_spin_unlock_irqrestore+0x46/0x70
+[ 3562.144277] ? ib_mad_send_done+0x1810/0x1810 [ib_core]
+[ 3562.145649] ? mlx4_ib_destroy_cq+0x2a0/0x2a0 [mlx4_ib]
+[ 3562.147008] ? _raw_spin_unlock_irqrestore+0x46/0x70
+[ 3562.148380] ? debug_object_deactivate+0x2b9/0x4a0
+[ 3562.149814] __ib_process_cq+0xe2/0x1d0 [ib_core]
+[ 3562.151195] ib_cq_poll_work+0x45/0xf0 [ib_core]
+[ 3562.152577] process_one_work+0x90c/0x1860
+[ 3562.153959] ? pwq_dec_nr_in_flight+0x320/0x320
+[ 3562.155320] worker_thread+0x87/0xbb0
+[ 3562.156687] ? __kthread_parkme+0xb6/0x180
+[ 3562.158058] ? process_one_work+0x1860/0x1860
+[ 3562.159429] kthread+0x320/0x3e0
+[ 3562.161391] ? kthread_park+0x120/0x120
+[ 3562.162744] ret_from_fork+0x24/0x30
+...
+[ 3562.187615] Freed by task 31682:
+[ 3562.188602] save_stack+0x19/0x80
+[ 3562.189586] __kasan_slab_free+0x11d/0x160
+[ 3562.190571] kfree+0xf5/0x2f0
+[ 3562.191552] ib_mad_port_close+0x200/0x380 [ib_core]
+[ 3562.192538] ib_mad_remove_device+0xf0/0x230 [ib_core]
+[ 3562.193538] remove_client_context+0xa6/0xe0 [ib_core]
+[ 3562.194514] disable_device+0x14e/0x260 [ib_core]
+[ 3562.195488] __ib_unregister_device+0x79/0x150 [ib_core]
+[ 3562.196462] ib_unregister_device+0x21/0x30 [ib_core]
+[ 3562.197439] mlx4_ib_remove+0x162/0x690 [mlx4_ib]
+[ 3562.198408] mlx4_remove_device+0x204/0x2c0 [mlx4_core]
+[ 3562.199381] mlx4_unregister_interface+0x49/0x1d0 [mlx4_core]
+[ 3562.200356] mlx4_ib_cleanup+0xc/0x1d [mlx4_ib]
+[ 3562.201329] __x64_sys_delete_module+0x2d2/0x400
+[ 3562.202288] do_syscall_64+0x95/0x470
+[ 3562.203277] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+The problem was that the MAD PD was deallocated before the MAD CQ.
+There was completion work pending for the CQ when the PD got deallocated.
+When the mad completion handling reached procedure
+ib_mad_post_receive_mads(), we got a use-after-free bug in the following
+line of code in that procedure:
+ sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey;
+(the pd pointer in the above line is no longer valid, because the
+pd has been deallocated).
+
+We fix this by allocating the PD before the CQ in procedure
+ib_mad_port_open(), and deallocating the PD after freeing the CQ
+in procedure ib_mad_port_close().
+
+Since the CQ completion work queue is flushed during ib_free_cq(),
+no completions will be pending for that CQ when the PD is later
+deallocated.
+
+Note that freeing the CQ before deallocating the PD is the practice
+in the ULPs.
+
+Fixes: 4be90bc60df4 ("IB/mad: Remove ib_get_dma_mr calls")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Link: https://lore.kernel.org/r/20190801121449.24973-1-leon@kernel.org
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/mad.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index 3e2ab04201e2c..25a28e7060725 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -3155,18 +3155,18 @@ static int ib_mad_port_open(struct ib_device *device,
+ if (has_smi)
+ cq_size *= 2;
+
++ port_priv->pd = ib_alloc_pd(device, 0);
++ if (IS_ERR(port_priv->pd)) {
++ dev_err(&device->dev, "Couldn't create ib_mad PD\n");
++ ret = PTR_ERR(port_priv->pd);
++ goto error3;
++ }
++
+ port_priv->cq = ib_alloc_cq(port_priv->device, port_priv, cq_size, 0,
+ IB_POLL_WORKQUEUE);
+ if (IS_ERR(port_priv->cq)) {
+ dev_err(&device->dev, "Couldn't create ib_mad CQ\n");
+ ret = PTR_ERR(port_priv->cq);
+- goto error3;
+- }
+-
+- port_priv->pd = ib_alloc_pd(device, 0);
+- if (IS_ERR(port_priv->pd)) {
+- dev_err(&device->dev, "Couldn't create ib_mad PD\n");
+- ret = PTR_ERR(port_priv->pd);
+ goto error4;
+ }
+
+@@ -3209,11 +3209,11 @@ error8:
+ error7:
+ destroy_mad_qp(&port_priv->qp_info[0]);
+ error6:
+- ib_dealloc_pd(port_priv->pd);
+-error4:
+ ib_free_cq(port_priv->cq);
+ cleanup_recv_queue(&port_priv->qp_info[1]);
+ cleanup_recv_queue(&port_priv->qp_info[0]);
++error4:
++ ib_dealloc_pd(port_priv->pd);
+ error3:
+ kfree(port_priv);
+
+@@ -3243,8 +3243,8 @@ static int ib_mad_port_close(struct ib_device *device, int port_num)
+ destroy_workqueue(port_priv->wq);
+ destroy_mad_qp(&port_priv->qp_info[1]);
+ destroy_mad_qp(&port_priv->qp_info[0]);
+- ib_dealloc_pd(port_priv->pd);
+ ib_free_cq(port_priv->cq);
++ ib_dealloc_pd(port_priv->pd);
+ cleanup_recv_queue(&port_priv->qp_info[1]);
+ cleanup_recv_queue(&port_priv->qp_info[0]);
+ /* XXX: Handle deallocation of MAD registration tables */
+--
+2.20.1
+
--- /dev/null
+From b67468200e876946af1bcc98b566b38eb58ac92c Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Fri, 12 Jul 2019 15:29:05 +0200
+Subject: irqchip/irq-imx-gpcv2: Forward irq type to parent
+
+[ Upstream commit 9a446ef08f3bfc0c3deb9c6be840af2528ef8cf8 ]
+
+The GPCv2 is a stacked IRQ controller below the ARM GIC. It doesn't
+care about the IRQ type itself, but needs to forward the type to the
+parent IRQ controller, so this one can be configured correctly.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-imx-gpcv2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c
+index 2d203b422129e..c56da0b13da5d 100644
+--- a/drivers/irqchip/irq-imx-gpcv2.c
++++ b/drivers/irqchip/irq-imx-gpcv2.c
+@@ -145,6 +145,7 @@ static struct irq_chip gpcv2_irqchip_data_chip = {
+ .irq_unmask = imx_gpcv2_irq_unmask,
+ .irq_set_wake = imx_gpcv2_irq_set_wake,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
++ .irq_set_type = irq_chip_set_type_parent,
+ #ifdef CONFIG_SMP
+ .irq_set_affinity = irq_chip_set_affinity_parent,
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 33729616366a8f495aa983e2661142f123f478b4 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Wed, 31 Jul 2019 00:59:00 +0900
+Subject: kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external
+ modules
+
+[ Upstream commit cb4819934a7f9b87876f11ed05b8624c0114551b ]
+
+KBUILD_EXTRA_SYMBOLS makes sense only when building external modules.
+Moreover, the modpost sets 'external_module' if the -e option is given.
+
+I replaced $(patsubst %, -e %,...) with simpler $(addprefix -e,...)
+while I was here.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.modpost | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
+index 16923ba4b5b10..8cb7971b3f25c 100644
+--- a/scripts/Makefile.modpost
++++ b/scripts/Makefile.modpost
+@@ -74,7 +74,7 @@ modpost = scripts/mod/modpost \
+ $(if $(CONFIG_MODULE_SRCVERSION_ALL),-a,) \
+ $(if $(KBUILD_EXTMOD),-i,-o) $(kernelsymfile) \
+ $(if $(KBUILD_EXTMOD),-I $(modulesymfile)) \
+- $(if $(KBUILD_EXTRA_SYMBOLS), $(patsubst %, -e %,$(KBUILD_EXTRA_SYMBOLS))) \
++ $(if $(KBUILD_EXTMOD),$(addprefix -e ,$(KBUILD_EXTRA_SYMBOLS))) \
+ $(if $(KBUILD_EXTMOD),-o $(modulesymfile)) \
+ $(if $(CONFIG_DEBUG_SECTION_MISMATCH),,-S) \
+ $(if $(CONFIG_SECTION_MISMATCH_WARN_ONLY),,-E) \
+--
+2.20.1
+
--- /dev/null
+From 9cd0f3a8a932d9923e2cd400b1a7ff7c8a58ed90 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Mon, 29 Jul 2019 14:47:22 -0700
+Subject: libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
+
+[ Upstream commit 71d6c505b4d9e6f76586350450e785e3d452b346 ]
+
+Jeffrin reported a KASAN issue:
+
+ BUG: KASAN: global-out-of-bounds in ata_exec_internal_sg+0x50f/0xc70
+ Read of size 16 at addr ffffffff91f41f80 by task scsi_eh_1/149
+ ...
+ The buggy address belongs to the variable:
+ cdb.48319+0x0/0x40
+
+Much like commit 18c9a99bce2a ("libata: zpodd: small read overflow in
+eject_tray()"), this fixes a cdb[] buffer length, this time in
+zpodd_get_mech_type():
+
+We read from the cdb[] buffer in ata_exec_internal_sg(). It has to be
+ATAPI_CDB_LEN (16) bytes long, but this buffer is only 12 bytes.
+
+Reported-by: Jeffrin Jose T <jeffrin@rajagiritech.edu.in>
+Fixes: afe759511808c ("libata: identify and init ZPODD devices")
+Link: https://lore.kernel.org/lkml/201907181423.E808958@keescook/
+Tested-by: Jeffrin Jose T <jeffrin@rajagiritech.edu.in>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-zpodd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
+index 7017a81d53cf2..083856272e92a 100644
+--- a/drivers/ata/libata-zpodd.c
++++ b/drivers/ata/libata-zpodd.c
+@@ -55,7 +55,7 @@ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
+ unsigned int ret;
+ struct rm_feature_desc *desc;
+ struct ata_taskfile tf;
+- static const char cdb[] = { GPCMD_GET_CONFIGURATION,
++ static const char cdb[ATAPI_CDB_LEN] = { GPCMD_GET_CONFIGURATION,
+ 2, /* only 1 feature descriptor requested */
+ 0, 3, /* 3, removable medium feature */
+ 0, 0, 0,/* reserved */
+--
+2.20.1
+
--- /dev/null
+From 4217fa1f6a51bbfb2b2b29c107996446af7a2e0e Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 2 Aug 2019 21:48:40 -0700
+Subject: ocfs2: remove set but not used variable 'last_hash'
+
+[ Upstream commit 7bc36e3ce91471b6377c8eadc0a2f220a2280083 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+ fs/ocfs2/xattr.c: In function ocfs2_xattr_bucket_find:
+ fs/ocfs2/xattr.c:3828:6: warning: variable last_hash set but not used [-Wunused-but-set-variable]
+
+It's never used and can be removed.
+
+Link: http://lkml.kernel.org/r/20190716132110.34836-1-yuehaibing@huawei.com
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/xattr.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
+index 01932763b4d10..e108c945ac1f8 100644
+--- a/fs/ocfs2/xattr.c
++++ b/fs/ocfs2/xattr.c
+@@ -3832,7 +3832,6 @@ static int ocfs2_xattr_bucket_find(struct inode *inode,
+ u16 blk_per_bucket = ocfs2_blocks_per_xattr_bucket(inode->i_sb);
+ int low_bucket = 0, bucket, high_bucket;
+ struct ocfs2_xattr_bucket *search;
+- u32 last_hash;
+ u64 blkno, lower_blkno = 0;
+
+ search = ocfs2_xattr_bucket_new(inode);
+@@ -3876,8 +3875,6 @@ static int ocfs2_xattr_bucket_find(struct inode *inode,
+ if (xh->xh_count)
+ xe = &xh->xh_entries[le16_to_cpu(xh->xh_count) - 1];
+
+- last_hash = le32_to_cpu(xe->xe_name_hash);
+-
+ /* record lower_blkno which may be the insert place. */
+ lower_blkno = blkno;
+
+--
+2.20.1
+
--- /dev/null
+From 9cc7c59a075cfdc4f15f3d9274cc690aab80ad68 Mon Sep 17 00:00:00 2001
+From: Vince Weaver <vincent.weaver@maine.edu>
+Date: Tue, 23 Jul 2019 11:06:01 -0400
+Subject: perf header: Fix divide by zero error if f_header.attr_size==0
+
+[ Upstream commit 7622236ceb167aa3857395f9bdaf871442aa467e ]
+
+So I have been having lots of trouble with hand-crafted perf.data files
+causing segfaults and the like, so I have started fuzzing the perf tool.
+
+First issue found:
+
+If f_header.attr_size is 0 in the perf.data file, then perf will crash
+with a divide-by-zero error.
+
+Committer note:
+
+Added a pr_err() to tell the user why the command failed.
+
+Signed-off-by: Vince Weaver <vincent.weaver@maine.edu>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1907231100440.14532@macbook-air
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/header.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index 283148104ffbe..693dcd4ea6a38 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -2854,6 +2854,13 @@ int perf_session__read_header(struct perf_session *session)
+ file->path);
+ }
+
++ if (f_header.attr_size == 0) {
++ pr_err("ERROR: The %s file's attr size field is 0 which is unexpected.\n"
++ "Was the 'perf record' command properly terminated?\n",
++ data->file.path);
++ return -EINVAL;
++ }
++
+ nr_attrs = f_header.attrs.size / f_header.attr_size;
+ lseek(fd, f_header.attrs.offset, SEEK_SET);
+
+--
+2.20.1
+
--- /dev/null
+From 8d31f1e46f345098b4dc24753107d603fbee77bb Mon Sep 17 00:00:00 2001
+From: Numfor Mbiziwo-Tiapo <nums@google.com>
+Date: Wed, 24 Jul 2019 16:44:58 -0700
+Subject: perf header: Fix use of unitialized value warning
+
+[ Upstream commit 20f9781f491360e7459c589705a2e4b1f136bee9 ]
+
+When building our local version of perf with MSAN (Memory Sanitizer) and
+running the perf record command, MSAN throws a use of uninitialized
+value warning in "tools/perf/util/util.c:333:6".
+
+This warning stems from the "buf" variable being passed into "write".
+It originated as the variable "ev" with the type union perf_event*
+defined in the "perf_event__synthesize_attr" function in
+"tools/perf/util/header.c".
+
+In the "perf_event__synthesize_attr" function they allocate space with a malloc
+call using ev, then go on to only assign some of the member variables before
+passing "ev" on as a parameter to the "process" function therefore "ev"
+contains uninitialized memory. Changing the malloc call to zalloc to initialize
+all the members of "ev" which gets rid of the warning.
+
+To reproduce this warning, build perf by running:
+make -C tools/perf CLANG=1 CC=clang EXTRA_CFLAGS="-fsanitize=memory\
+ -fsanitize-memory-track-origins"
+
+(Additionally, llvm might have to be installed and clang might have to
+be specified as the compiler - export CC=/usr/bin/clang)
+
+then running:
+tools/perf/perf record -o - ls / | tools/perf/perf --no-pager annotate\
+ -i - --stdio
+
+Please see the cover letter for why false positive warnings may be
+generated.
+
+Signed-off-by: Numfor Mbiziwo-Tiapo <nums@google.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Drayton <mbd@fb.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lkml.kernel.org/r/20190724234500.253358-2-nums@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/header.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index 693dcd4ea6a38..61e3c482935ad 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -2943,7 +2943,7 @@ int perf_event__synthesize_attr(struct perf_tool *tool,
+ size += sizeof(struct perf_event_header);
+ size += ids * sizeof(u64);
+
+- ev = malloc(size);
++ ev = zalloc(size);
+
+ if (ev == NULL)
+ return -ENOMEM;
+--
+2.20.1
+
--- /dev/null
+From 19454aa29c04e3ed14b499fa5908a43e78f60979 Mon Sep 17 00:00:00 2001
+From: Don Brace <don.brace@microsemi.com>
+Date: Wed, 24 Jul 2019 17:08:06 -0500
+Subject: scsi: hpsa: correct scsi command status issue after reset
+
+[ Upstream commit eeebce1862970653cdf5c01e98bc669edd8f529a ]
+
+Reviewed-by: Bader Ali - Saleh <bader.alisaleh@microsemi.com>
+Reviewed-by: Scott Teel <scott.teel@microsemi.com>
+Reviewed-by: Scott Benesh <scott.benesh@microsemi.com>
+Reviewed-by: Kevin Barnett <kevin.barnett@microsemi.com>
+Signed-off-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hpsa.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 9f98c7211ec24..b82df8cdf9626 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -2236,6 +2236,8 @@ static int handle_ioaccel_mode2_error(struct ctlr_info *h,
+ case IOACCEL2_SERV_RESPONSE_COMPLETE:
+ switch (c2->error_data.status) {
+ case IOACCEL2_STATUS_SR_TASK_COMP_GOOD:
++ if (cmd)
++ cmd->result = 0;
+ break;
+ case IOACCEL2_STATUS_SR_TASK_COMP_CHK_COND:
+ cmd->result |= SAM_STAT_CHECK_CONDITION;
+@@ -2423,8 +2425,10 @@ static void process_ioaccel2_completion(struct ctlr_info *h,
+
+ /* check for good status */
+ if (likely(c2->error_data.serv_response == 0 &&
+- c2->error_data.status == 0))
++ c2->error_data.status == 0)) {
++ cmd->result = 0;
+ return hpsa_cmd_free_and_done(h, c, cmd);
++ }
+
+ /*
+ * Any RAID offload error results in retry which will use
+@@ -5511,6 +5515,12 @@ static int hpsa_scsi_queue_command(struct Scsi_Host *sh, struct scsi_cmnd *cmd)
+ }
+ c = cmd_tagged_alloc(h, cmd);
+
++ /*
++ * This is necessary because the SML doesn't zero out this field during
++ * error recovery.
++ */
++ cmd->result = 0;
++
+ /*
+ * Call alternate submit routine for I/O accelerated commands.
+ * Retries always go down the normal I/O path.
+--
+2.20.1
+
input-kbtab-sanity-check-for-endpoint-type.patch
input-iforce-add-sanity-checks.patch
net-usb-pegasus-fix-improper-read-if-get_registers-fail.patch
+xen-pciback-remove-set-but-not-used-variable-old_sta.patch
+irqchip-irq-imx-gpcv2-forward-irq-type-to-parent.patch
+perf-header-fix-divide-by-zero-error-if-f_header.att.patch
+perf-header-fix-use-of-unitialized-value-warning.patch
+libata-zpodd-fix-small-read-overflow-in-zpodd_get_me.patch
+scsi-hpsa-correct-scsi-command-status-issue-after-re.patch
+exit-make-setting-exit_state-consistent.patch
+ata-libahci-do-not-complain-in-case-of-deferred-prob.patch
+kbuild-modpost-handle-kbuild_extra_symbols-only-for-.patch
+arm64-efi-fix-variable-si-set-but-not-used.patch
+arm64-mm-fix-variable-pud-set-but-not-used.patch
+ib-core-add-mitigation-for-spectre-v1.patch
+ib-mad-fix-use-after-free-in-ib-mad-completion-handl.patch
+ocfs2-remove-set-but-not-used-variable-last_hash.patch
+asm-generic-fix-wtype-limits-compiler-warnings.patch
--- /dev/null
+From d43617a128832b9a0989428018efce5b1b0cccef Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 24 Jul 2019 22:08:50 +0800
+Subject: xen/pciback: remove set but not used variable 'old_state'
+
+[ Upstream commit 09e088a4903bd0dd911b4f1732b250130cdaffed ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/xen/xen-pciback/conf_space_capability.c: In function pm_ctrl_write:
+drivers/xen/xen-pciback/conf_space_capability.c:119:25: warning:
+ variable old_state set but not used [-Wunused-but-set-variable]
+
+It is never used so can be removed.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xen-pciback/conf_space_capability.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c
+index 7f83e9083e9dd..b1a1d7de0894e 100644
+--- a/drivers/xen/xen-pciback/conf_space_capability.c
++++ b/drivers/xen/xen-pciback/conf_space_capability.c
+@@ -115,13 +115,12 @@ static int pm_ctrl_write(struct pci_dev *dev, int offset, u16 new_value,
+ {
+ int err;
+ u16 old_value;
+- pci_power_t new_state, old_state;
++ pci_power_t new_state;
+
+ err = pci_read_config_word(dev, offset, &old_value);
+ if (err)
+ goto out;
+
+- old_state = (pci_power_t)(old_value & PCI_PM_CTRL_STATE_MASK);
+ new_state = (pci_power_t)(new_value & PCI_PM_CTRL_STATE_MASK);
+
+ new_value &= PM_OK_BITS;
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
