--- /dev/null
+From eceb05965489784f24bbf4d61ba60e475a983016 Mon Sep 17 00:00:00 2001
+From: Dexuan Cui <decui@microsoft.com>
+Date: Mon, 26 Nov 2018 02:29:56 +0000
+Subject: Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
+
+From: Dexuan Cui <decui@microsoft.com>
+
+commit eceb05965489784f24bbf4d61ba60e475a983016 upstream.
+
+This is a longstanding issue: if the vmbus upper-layer drivers try to
+consume too many GPADLs, the host may return with an error
+0xC0000044 (STATUS_QUOTA_EXCEEDED), but currently we forget to check
+the creation_status, and hence we can pass an invalid GPADL handle
+into the OPEN_CHANNEL message, and get an error code 0xc0000225 in
+open_info->response.open_result.status, and finally we hang in
+vmbus_open() -> "goto error_free_info" -> vmbus_teardown_gpadl().
+
+With this patch, we can exit gracefully on STATUS_QUOTA_EXCEEDED.
+
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Cc: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/channel.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -454,6 +454,14 @@ int vmbus_establish_gpadl(struct vmbus_c
+ }
+ wait_for_completion(&msginfo->waitevent);
+
++ if (msginfo->response.gpadl_created.creation_status != 0) {
++ pr_err("Failed to establish GPADL: err = 0x%x\n",
++ msginfo->response.gpadl_created.creation_status);
++
++ ret = -EDQUOT;
++ goto cleanup;
++ }
++
+ if (channel->rescind) {
+ ret = -ENODEV;
+ goto cleanup;
--- /dev/null
+From fe5192ac81ad0d4dfe1395d11f393f0513c15f7f Mon Sep 17 00:00:00 2001
+From: Martin Kelly <martin@martingkelly.com>
+Date: Sun, 28 Oct 2018 20:18:53 -0700
+Subject: iio:st_magn: Fix enable device after trigger
+
+From: Martin Kelly <martin@martingkelly.com>
+
+commit fe5192ac81ad0d4dfe1395d11f393f0513c15f7f upstream.
+
+Currently, we enable the device before we enable the device trigger. At
+high frequencies, this can cause interrupts that don't yet have a poll
+function associated with them and are thus treated as spurious. At high
+frequencies with level interrupts, this can even cause an interrupt storm
+of repeated spurious interrupts (~100,000 on my Beagleboard with the
+LSM9DS1 magnetometer). If these repeat too much, the interrupt will get
+disabled and the device will stop functioning.
+
+To prevent these problems, enable the device prior to enabling the device
+trigger, and disable the divec prior to disabling the trigger. This means
+there's no window of time during which the device creates interrupts but we
+have no trigger to answer them.
+
+Fixes: 90efe055629 ("iio: st_sensors: harden interrupt handling")
+Signed-off-by: Martin Kelly <martin@martingkelly.com>
+Tested-by: Denis Ciocca <denis.ciocca@st.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/magnetometer/st_magn_buffer.c | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+--- a/drivers/iio/magnetometer/st_magn_buffer.c
++++ b/drivers/iio/magnetometer/st_magn_buffer.c
+@@ -30,11 +30,6 @@ int st_magn_trig_set_state(struct iio_tr
+ return st_sensors_set_dataready_irq(indio_dev, state);
+ }
+
+-static int st_magn_buffer_preenable(struct iio_dev *indio_dev)
+-{
+- return st_sensors_set_enable(indio_dev, true);
+-}
+-
+ static int st_magn_buffer_postenable(struct iio_dev *indio_dev)
+ {
+ int err;
+@@ -50,7 +45,7 @@ static int st_magn_buffer_postenable(str
+ if (err < 0)
+ goto st_magn_buffer_postenable_error;
+
+- return err;
++ return st_sensors_set_enable(indio_dev, true);
+
+ st_magn_buffer_postenable_error:
+ kfree(mdata->buffer_data);
+@@ -63,11 +58,11 @@ static int st_magn_buffer_predisable(str
+ int err;
+ struct st_sensor_data *mdata = iio_priv(indio_dev);
+
+- err = iio_triggered_buffer_predisable(indio_dev);
++ err = st_sensors_set_enable(indio_dev, false);
+ if (err < 0)
+ goto st_magn_buffer_predisable_error;
+
+- err = st_sensors_set_enable(indio_dev, false);
++ err = iio_triggered_buffer_predisable(indio_dev);
+
+ st_magn_buffer_predisable_error:
+ kfree(mdata->buffer_data);
+@@ -75,7 +70,6 @@ st_magn_buffer_predisable_error:
+ }
+
+ static const struct iio_buffer_setup_ops st_magn_buffer_setup_ops = {
+- .preenable = &st_magn_buffer_preenable,
+ .postenable = &st_magn_buffer_postenable,
+ .predisable = &st_magn_buffer_predisable,
+ };
--- /dev/null
+From 5618cf031fecda63847cafd1091e7b8bd626cdb1 Mon Sep 17 00:00:00 2001
+From: Luis Chamberlain <mcgrof@kernel.org>
+Date: Fri, 30 Nov 2018 14:09:21 -0800
+Subject: lib/test_kmod.c: fix rmmod double free
+
+From: Luis Chamberlain <mcgrof@kernel.org>
+
+commit 5618cf031fecda63847cafd1091e7b8bd626cdb1 upstream.
+
+We free the misc device string twice on rmmod; fix this. Without this
+we cannot remove the module without crashing.
+
+Link: http://lkml.kernel.org/r/20181124050500.5257-1-mcgrof@kernel.org
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: <stable@vger.kernel.org> [4.12+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/test_kmod.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/lib/test_kmod.c
++++ b/lib/test_kmod.c
+@@ -1221,7 +1221,6 @@ void unregister_test_dev_kmod(struct kmo
+
+ dev_info(test_dev->dev, "removing interface\n");
+ misc_deregister(&test_dev->misc_dev);
+- kfree(&test_dev->misc_dev.name);
+
+ mutex_unlock(&test_dev->config_mutex);
+ mutex_unlock(&test_dev->trigger_mutex);
--- /dev/null
+From 6484a677294aa5d08c0210f2f387ebb9be646115 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 14 Nov 2018 01:57:03 +0000
+Subject: misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+commit 6484a677294aa5d08c0210f2f387ebb9be646115 upstream.
+
+gcc '-Wunused-but-set-variable' warning:
+
+drivers/misc/mic/scif/scif_rma.c: In function 'scif_create_remote_lookup':
+drivers/misc/mic/scif/scif_rma.c:373:25: warning:
+ variable 'vmalloc_num_pages' set but not used [-Wunused-but-set-variable]
+
+'vmalloc_num_pages' should be used to determine if the address is
+within the vmalloc range.
+
+Fixes: ba612aa8b487 ("misc: mic: SCIF memory registration and unregistration")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mic/scif/scif_rma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/mic/scif/scif_rma.c
++++ b/drivers/misc/mic/scif/scif_rma.c
+@@ -417,7 +417,7 @@ static int scif_create_remote_lookup(str
+ if (err)
+ goto error_window;
+ err = scif_map_page(&window->num_pages_lookup.lookup[j],
+- vmalloc_dma_phys ?
++ vmalloc_num_pages ?
+ vmalloc_to_page(&window->num_pages[i]) :
+ virt_to_page(&window->num_pages[i]),
+ remote_dev);
--- /dev/null
+From c1cb20d43728aa9b5393bd8d489bc85c142949b2 Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Fri, 30 Nov 2018 14:09:03 -0800
+Subject: mm: use swp_offset as key in shmem_replace_page()
+
+From: Yu Zhao <yuzhao@google.com>
+
+commit c1cb20d43728aa9b5393bd8d489bc85c142949b2 upstream.
+
+We changed the key of swap cache tree from swp_entry_t.val to
+swp_offset. We need to do so in shmem_replace_page() as well.
+
+Hugh said:
+ "shmem_replace_page() has been wrong since the day I wrote it: good
+ enough to work on swap "type" 0, which is all most people ever use
+ (especially those few who need shmem_replace_page() at all), but
+ broken once there are any non-0 swp_type bits set in the higher order
+ bits"
+
+Link: http://lkml.kernel.org/r/20181121215442.138545-1-yuzhao@google.com
+Fixes: f6ab1f7f6b2d ("mm, swap: use offset of swap entry as key of swap cache")
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Reviewed-by: Matthew Wilcox <willy@infradead.org>
+Acked-by: Hugh Dickins <hughd@google.com>
+Cc: <stable@vger.kernel.org> [4.9+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/shmem.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1532,11 +1532,13 @@ static int shmem_replace_page(struct pag
+ {
+ struct page *oldpage, *newpage;
+ struct address_space *swap_mapping;
++ swp_entry_t entry;
+ pgoff_t swap_index;
+ int error;
+
+ oldpage = *pagep;
+- swap_index = page_private(oldpage);
++ entry.val = page_private(oldpage);
++ swap_index = swp_offset(entry);
+ swap_mapping = page_mapping(oldpage);
+
+ /*
+@@ -1555,7 +1557,7 @@ static int shmem_replace_page(struct pag
+ __SetPageLocked(newpage);
+ __SetPageSwapBacked(newpage);
+ SetPageUptodate(newpage);
+- set_page_private(newpage, swap_index);
++ set_page_private(newpage, entry.val);
+ SetPageSwapCache(newpage);
+
+ /*
--- /dev/null
+From 38317f5c0f2faae5110854f36edad810f841d62f Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Mon, 19 Nov 2018 08:34:04 +0200
+Subject: Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid"
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit 38317f5c0f2faae5110854f36edad810f841d62f upstream.
+
+This reverts commit ffb80fc672c3a7b6afd0cefcb1524fb99917b2f3.
+
+Turns out that commit is wrong. Host controllers are allowed to use
+Clear Feature HALT as means to sync data toggle between host and
+periperal.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1511,9 +1511,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc
+ unsigned transfer_in_flight;
+ unsigned started;
+
+- if (dep->flags & DWC3_EP_STALL)
+- return 0;
+-
+ if (dep->number > 1)
+ trb = dwc3_ep_prev_trb(dep, dep->trb_enqueue);
+ else
+@@ -1535,8 +1532,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc
+ else
+ dep->flags |= DWC3_EP_STALL;
+ } else {
+- if (!(dep->flags & DWC3_EP_STALL))
+- return 0;
+
+ ret = dwc3_send_clear_stall_ep_cmd(dep);
+ if (ret)
dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch
dmaengine-at_hdmac-fix-module-unloading.patch
btrfs-release-metadata-before-running-delayed-refs.patch
+staging-vchiq_arm-fix-compat-vchiq_ioc_await_completion.patch
+staging-rtl8723bs-add-missing-return-for-cfg80211_rtw_get_station.patch
+usb-usb-storage-add-new-ids-to-ums-realtek.patch
+usb-core-quirks-add-reset_resume-quirk-for-cherry-g230-stream-series.patch
+revert-usb-dwc3-gadget-skip-set-clear-halt-when-invalid.patch
+iio-st_magn-fix-enable-device-after-trigger.patch
+lib-test_kmod.c-fix-rmmod-double-free.patch
+mm-use-swp_offset-as-key-in-shmem_replace_page.patch
+drivers-hv-vmbus-check-the-creation_status-in-vmbus_establish_gpadl.patch
+misc-mic-scif-fix-copy-paste-error-in-scif_create_remote_lookup.patch
--- /dev/null
+From 8561fb31a1f9594e2807681f5c0721894e367f19 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Thu, 8 Nov 2018 23:30:09 -0600
+Subject: staging: rtl8723bs: Add missing return for cfg80211_rtw_get_station
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 8561fb31a1f9594e2807681f5c0721894e367f19 upstream.
+
+With Androidx86 8.1, wificond returns "failed to get
+nl80211_sta_info_tx_failed" and wificondControl returns "Invalid signal
+poll result from wificond". The fix is to OR sinfo->filled with
+BIT_ULL(NL80211_STA_INFO_TX_FAILED).
+
+This missing bit is apparently not needed with NetworkManager, but it
+does no harm in that case.
+
+Reported-and-Tested-by: youling257 <youling257@gmail.com>
+Cc: linux-wireless@vger.kernel.org
+Cc: youling257 <youling257@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+@@ -1293,7 +1293,7 @@ static int cfg80211_rtw_get_station(stru
+
+ sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
+ sinfo->tx_packets = psta->sta_stats.tx_pkts;
+-
++ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
+ }
+
+ /* for Ad-Hoc/AP mode */
--- /dev/null
+From 5a96b2d38dc054c0bbcbcd585b116566cbd877fe Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <benwolsieffer@gmail.com>
+Date: Sat, 3 Nov 2018 19:32:20 -0400
+Subject: staging: vchiq_arm: fix compat VCHIQ_IOC_AWAIT_COMPLETION
+
+From: Ben Wolsieffer <benwolsieffer@gmail.com>
+
+commit 5a96b2d38dc054c0bbcbcd585b116566cbd877fe upstream.
+
+The compatibility ioctl wrapper for VCHIQ_IOC_AWAIT_COMPLETION assumes that
+the native ioctl always uses a message buffer and decrements msgbufcount.
+Certain message types do not use a message buffer and in this case
+msgbufcount is not decremented, and completion->header for the message is
+NULL. Because the wrapper unconditionally decrements msgbufcount, the
+calling process may assume that a message buffer has been used even when
+it has not.
+
+This results in a memory leak in the userspace code that interfaces with
+this driver. When msgbufcount is decremented, the userspace code assumes
+that the buffer can be freed though the reference in completion->header,
+which cannot happen when the reference is NULL.
+
+This patch causes the wrapper to only decrement msgbufcount when the
+native ioctl decrements it. Note that we cannot simply copy the native
+ioctl's value of msgbufcount, because the wrapper only retrieves messages
+from the native ioctl one at a time, while userspace may request multiple
+messages.
+
+See https://github.com/raspberrypi/linux/pull/2703 for more discussion of
+this patch.
+
+Fixes: 5569a1260933 ("staging: vchiq_arm: Add compatibility wrappers for ioctls")
+Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
+Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -1461,6 +1461,7 @@ vchiq_compat_ioctl_await_completion(stru
+ struct vchiq_await_completion32 args32;
+ struct vchiq_completion_data32 completion32;
+ unsigned int *msgbufcount32;
++ unsigned int msgbufcount_native;
+ compat_uptr_t msgbuf32;
+ void *msgbuf;
+ void **msgbufptr;
+@@ -1572,7 +1573,11 @@ vchiq_compat_ioctl_await_completion(stru
+ sizeof(completion32)))
+ return -EFAULT;
+
+- args32.msgbufcount--;
++ if (get_user(msgbufcount_native, &args->msgbufcount))
++ return -EFAULT;
++
++ if (!msgbufcount_native)
++ args32.msgbufcount--;
+
+ msgbufcount32 =
+ &((struct vchiq_await_completion32 __user *)arg)->msgbufcount;
--- /dev/null
+From effd14f66cc1ef6701a19c5a56e39c35f4d395a5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20Niew=C3=B6hner?= <linux@mniewoehner.de>
+Date: Sun, 25 Nov 2018 17:57:33 +0100
+Subject: usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Niewöhner <linux@mniewoehner.de>
+
+commit effd14f66cc1ef6701a19c5a56e39c35f4d395a5 upstream.
+
+Cherry G230 Stream 2.0 (G85-231) and 3.0 (G85-232) need this quirk to
+function correctly. This fixes a but where double pressing numlock locks
+up the device completely with need to replug the keyboard.
+
+Signed-off-by: Michael Niewöhner <linux@mniewoehner.de>
+Tested-by: Michael Niewöhner <linux@mniewoehner.de>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -64,6 +64,9 @@ static const struct usb_device_id usb_qu
+ /* Microsoft LifeCam-VX700 v2.0 */
+ { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */
++ { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
+ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
--- /dev/null
+From a84a1bcc992f0545a51d2e120b8ca2ef20e2ea97 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Fri, 23 Nov 2018 08:42:19 +0000
+Subject: USB: usb-storage: Add new IDs to ums-realtek
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit a84a1bcc992f0545a51d2e120b8ca2ef20e2ea97 upstream.
+
+There are two new Realtek card readers require ums-realtek to work
+correctly.
+
+Add the new IDs to support them.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_realtek.h | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/usb/storage/unusual_realtek.h
++++ b/drivers/usb/storage/unusual_realtek.h
+@@ -39,4 +39,14 @@ UNUSUAL_DEV(0x0bda, 0x0159, 0x0000, 0x99
+ "USB Card Reader",
+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+
++UNUSUAL_DEV(0x0bda, 0x0177, 0x0000, 0x9999,
++ "Realtek",
++ "USB Card Reader",
++ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
++
++UNUSUAL_DEV(0x0bda, 0x0184, 0x0000, 0x9999,
++ "Realtek",
++ "USB Card Reader",
++ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
++
+ #endif /* defined(CONFIG_USB_STORAGE_REALTEK) || ... */
projects / thirdparty / kernel / stable-queue.git / commitdiff
