]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.14-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 24 Mar 2019 19:36:54 +0000 (20:36 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 24 Mar 2019 19:36:54 +0000 (20:36 +0100)
added patches:
drm-vmwgfx-don-t-double-free-the-mode-stored-in-par-set_mode.patch
iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size.patch
libceph-wait-for-latest-osdmap-in-ceph_monc_blacklist_add.patch
mips-ensure-elf-appended-dtb-is-relocated.patch
mips-fix-kernel-crash-for-r6-in-jump-label-branch-function.patch
mips-loongson64-lemote-2f-add-irqf_no_suspend-to-cascade-irqaction.patch
mmc-pxamci-fix-enum-type-confusion.patch
udf-fix-crash-on-io-error-during-truncate.patch

queue-4.14/drm-vmwgfx-don-t-double-free-the-mode-stored-in-par-set_mode.patch [new file with mode: 0644]
queue-4.14/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size.patch [new file with mode: 0644]
queue-4.14/libceph-wait-for-latest-osdmap-in-ceph_monc_blacklist_add.patch [new file with mode: 0644]
queue-4.14/mips-ensure-elf-appended-dtb-is-relocated.patch [new file with mode: 0644]
queue-4.14/mips-fix-kernel-crash-for-r6-in-jump-label-branch-function.patch [new file with mode: 0644]
queue-4.14/mips-loongson64-lemote-2f-add-irqf_no_suspend-to-cascade-irqaction.patch [new file with mode: 0644]
queue-4.14/mmc-pxamci-fix-enum-type-confusion.patch [new file with mode: 0644]
queue-4.14/udf-fix-crash-on-io-error-during-truncate.patch [new file with mode: 0644]

diff --git a/queue-4.14/drm-vmwgfx-don-t-double-free-the-mode-stored-in-par-set_mode.patch b/queue-4.14/drm-vmwgfx-don-t-double-free-the-mode-stored-in-par-set_mode.patch
new file mode 100644 (file)
index 0000000..dbda65d
--- /dev/null
@@ -0,0 +1,64 @@
+From c2d311553855395764e2e5bf401d987ba65c2056 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Mon, 18 Mar 2019 15:47:58 +0100
+Subject: drm/vmwgfx: Don't double-free the mode stored in par->set_mode
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit c2d311553855395764e2e5bf401d987ba65c2056 upstream.
+
+When calling vmw_fb_set_par(), the mode stored in par->set_mode gets free'd
+twice. The first free is in vmw_fb_kms_detach(), the second is near the
+end of vmw_fb_set_par() under the name of 'old_mode'. The mode-setting code
+only works correctly if the mode doesn't actually change. Removing
+'old_mode' in favor of using par->set_mode directly fixes the problem.
+
+Cc: <stable@vger.kernel.org>
+Fixes: a278724aa23c ("drm/vmwgfx: Implement fbdev on kms v2")
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Deepak Rawat <drawat@vmware.com>
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_fb.c |   12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -588,11 +588,9 @@ static int vmw_fb_set_par(struct fb_info
+               0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+               DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
+       };
+-      struct drm_display_mode *old_mode;
+       struct drm_display_mode *mode;
+       int ret;
+-      old_mode = par->set_mode;
+       mode = drm_mode_duplicate(vmw_priv->dev, &new_mode);
+       if (!mode) {
+               DRM_ERROR("Could not create new fb mode.\n");
+@@ -603,11 +601,7 @@ static int vmw_fb_set_par(struct fb_info
+       mode->vdisplay = var->yres;
+       vmw_guess_mode_timing(mode);
+-      if (old_mode && drm_mode_equal(old_mode, mode)) {
+-              drm_mode_destroy(vmw_priv->dev, mode);
+-              mode = old_mode;
+-              old_mode = NULL;
+-      } else if (!vmw_kms_validate_mode_vram(vmw_priv,
++      if (!vmw_kms_validate_mode_vram(vmw_priv,
+                                       mode->hdisplay *
+                                       DIV_ROUND_UP(var->bits_per_pixel, 8),
+                                       mode->vdisplay)) {
+@@ -677,8 +671,8 @@ static int vmw_fb_set_par(struct fb_info
+       schedule_delayed_work(&par->local_work, 0);
+ out_unlock:
+-      if (old_mode)
+-              drm_mode_destroy(vmw_priv->dev, old_mode);
++      if (par->set_mode)
++              drm_mode_destroy(vmw_priv->dev, par->set_mode);
+       par->set_mode = mode;
+       drm_modeset_unlock_all(vmw_priv->dev);
diff --git a/queue-4.14/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size.patch b/queue-4.14/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size.patch
new file mode 100644 (file)
index 0000000..d95e55f
--- /dev/null
@@ -0,0 +1,78 @@
+From 4e50ce03976fbc8ae995a000c4b10c737467beaa Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 13 Mar 2019 10:03:17 +0100
+Subject: iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 4e50ce03976fbc8ae995a000c4b10c737467beaa upstream.
+
+Take into account that sg->offset can be bigger than PAGE_SIZE when
+setting segment sg->dma_address. Otherwise sg->dma_address will point
+at diffrent page, what makes DMA not possible with erros like this:
+
+xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa70c0 flags=0x0020]
+xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7040 flags=0x0020]
+xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7080 flags=0x0020]
+xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7100 flags=0x0020]
+xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7000 flags=0x0020]
+
+Additinally with wrong sg->dma_address unmap_sg will free wrong pages,
+what what can cause crashes like this:
+
+Feb 28 19:27:45 kernel: BUG: Bad page state in process cinnamon  pfn:39e8b1
+Feb 28 19:27:45 kernel: Disabling lock debugging due to kernel taint
+Feb 28 19:27:45 kernel: flags: 0x2ffff0000000000()
+Feb 28 19:27:45 kernel: raw: 02ffff0000000000 0000000000000000 ffffffff00000301 0000000000000000
+Feb 28 19:27:45 kernel: raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
+Feb 28 19:27:45 kernel: page dumped because: nonzero _refcount
+Feb 28 19:27:45 kernel: Modules linked in: ccm fuse arc4 nct6775 hwmon_vid amdgpu nls_iso8859_1 nls_cp437 edac_mce_amd vfat fat kvm_amd ccp rng_core kvm mt76x0u mt76x0_common mt76x02_usb irqbypass mt76_usb mt76x02_lib mt76 crct10dif_pclmul crc32_pclmul chash mac80211 amd_iommu_v2 ghash_clmulni_intel gpu_sched i2c_algo_bit ttm wmi_bmof snd_hda_codec_realtek snd_hda_codec_generic drm_kms_helper snd_hda_codec_hdmi snd_hda_intel drm snd_hda_codec aesni_intel snd_hda_core snd_hwdep aes_x86_64 crypto_simd snd_pcm cfg80211 cryptd mousedev snd_timer glue_helper pcspkr r8169 input_leds realtek agpgart libphy rfkill snd syscopyarea sysfillrect sysimgblt fb_sys_fops soundcore sp5100_tco k10temp i2c_piix4 wmi evdev gpio_amdpt pinctrl_amd mac_hid pcc_cpufreq acpi_cpufreq sg ip_tables x_tables ext4(E) crc32c_generic(E) crc16(E) mbcache(E) jbd2(E) fscrypto(E) sd_mod(E) hid_generic(E) usbhid(E) hid(E) dm_mod(E) serio_raw(E) atkbd(E) libps2(E) crc32c_intel(E) ahci(E) libahci(E) libata(E) xhci_pci(E) xhci_hcd(E)
+Feb 28 19:27:45 kernel:  scsi_mod(E) i8042(E) serio(E) bcache(E) crc64(E)
+Feb 28 19:27:45 kernel: CPU: 2 PID: 896 Comm: cinnamon Tainted: G    B   W   E     4.20.12-arch1-1-custom #1
+Feb 28 19:27:45 kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./B450M Pro4, BIOS P1.20 06/26/2018
+Feb 28 19:27:45 kernel: Call Trace:
+Feb 28 19:27:45 kernel:  dump_stack+0x5c/0x80
+Feb 28 19:27:45 kernel:  bad_page.cold.29+0x7f/0xb2
+Feb 28 19:27:45 kernel:  __free_pages_ok+0x2c0/0x2d0
+Feb 28 19:27:45 kernel:  skb_release_data+0x96/0x180
+Feb 28 19:27:45 kernel:  __kfree_skb+0xe/0x20
+Feb 28 19:27:45 kernel:  tcp_recvmsg+0x894/0xc60
+Feb 28 19:27:45 kernel:  ? reuse_swap_page+0x120/0x340
+Feb 28 19:27:45 kernel:  ? ptep_set_access_flags+0x23/0x30
+Feb 28 19:27:45 kernel:  inet_recvmsg+0x5b/0x100
+Feb 28 19:27:45 kernel:  __sys_recvfrom+0xc3/0x180
+Feb 28 19:27:45 kernel:  ? handle_mm_fault+0x10a/0x250
+Feb 28 19:27:45 kernel:  ? syscall_trace_enter+0x1d3/0x2d0
+Feb 28 19:27:45 kernel:  ? __audit_syscall_exit+0x22a/0x290
+Feb 28 19:27:45 kernel:  __x64_sys_recvfrom+0x24/0x30
+Feb 28 19:27:45 kernel:  do_syscall_64+0x5b/0x170
+Feb 28 19:27:45 kernel:  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Cc: stable@vger.kernel.org
+Reported-and-tested-by: Jan Viktorin <jan.viktorin@gmail.com>
+Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Fixes: 80187fd39dcb ('iommu/amd: Optimize map_sg and unmap_sg')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2548,7 +2548,12 @@ static int map_sg(struct device *dev, st
+       /* Everything is mapped - write the right values into s->dma_address */
+       for_each_sg(sglist, s, nelems, i) {
+-              s->dma_address += address + s->offset;
++              /*
++               * Add in the remaining piece of the scatter-gather offset that
++               * was masked out when we were determining the physical address
++               * via (sg_phys(s) & PAGE_MASK) earlier.
++               */
++              s->dma_address += address + (s->offset & ~PAGE_MASK);
+               s->dma_length   = s->length;
+       }
diff --git a/queue-4.14/libceph-wait-for-latest-osdmap-in-ceph_monc_blacklist_add.patch b/queue-4.14/libceph-wait-for-latest-osdmap-in-ceph_monc_blacklist_add.patch
new file mode 100644 (file)
index 0000000..1c9e406
--- /dev/null
@@ -0,0 +1,95 @@
+From bb229bbb3bf63d23128e851a1f3b85c083178fa1 Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Wed, 20 Mar 2019 09:46:58 +0100
+Subject: libceph: wait for latest osdmap in ceph_monc_blacklist_add()
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit bb229bbb3bf63d23128e851a1f3b85c083178fa1 upstream.
+
+Because map updates are distributed lazily, an OSD may not know about
+the new blacklist for quite some time after "osd blacklist add" command
+is completed.  This makes it possible for a blacklisted but still alive
+client to overwrite a post-blacklist update, resulting in data
+corruption.
+
+Waiting for latest osdmap in ceph_monc_blacklist_add() and thus using
+the post-blacklist epoch for all post-blacklist requests ensures that
+all such requests "wait" for the blacklist to come into force on their
+respective OSDs.
+
+Cc: stable@vger.kernel.org
+Fixes: 6305a3b41515 ("libceph: support for blacklisting clients")
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Reviewed-by: Jason Dillaman <dillaman@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/ceph/libceph.h |    2 ++
+ net/ceph/ceph_common.c       |   18 +++++++++++++++++-
+ net/ceph/mon_client.c        |    9 +++++++++
+ 3 files changed, 28 insertions(+), 1 deletion(-)
+
+--- a/include/linux/ceph/libceph.h
++++ b/include/linux/ceph/libceph.h
+@@ -291,6 +291,8 @@ extern void ceph_destroy_client(struct c
+ extern int __ceph_open_session(struct ceph_client *client,
+                              unsigned long started);
+ extern int ceph_open_session(struct ceph_client *client);
++int ceph_wait_for_latest_osdmap(struct ceph_client *client,
++                              unsigned long timeout);
+ /* pagevec.c */
+ extern void ceph_release_page_vector(struct page **pages, int num_pages);
+--- a/net/ceph/ceph_common.c
++++ b/net/ceph/ceph_common.c
+@@ -720,7 +720,6 @@ int __ceph_open_session(struct ceph_clie
+ }
+ EXPORT_SYMBOL(__ceph_open_session);
+-
+ int ceph_open_session(struct ceph_client *client)
+ {
+       int ret;
+@@ -736,6 +735,23 @@ int ceph_open_session(struct ceph_client
+ }
+ EXPORT_SYMBOL(ceph_open_session);
++int ceph_wait_for_latest_osdmap(struct ceph_client *client,
++                              unsigned long timeout)
++{
++      u64 newest_epoch;
++      int ret;
++
++      ret = ceph_monc_get_version(&client->monc, "osdmap", &newest_epoch);
++      if (ret)
++              return ret;
++
++      if (client->osdc.osdmap->epoch >= newest_epoch)
++              return 0;
++
++      ceph_osdc_maybe_request_map(&client->osdc);
++      return ceph_monc_wait_osdmap(&client->monc, newest_epoch, timeout);
++}
++EXPORT_SYMBOL(ceph_wait_for_latest_osdmap);
+ static int __init init_ceph_lib(void)
+ {
+--- a/net/ceph/mon_client.c
++++ b/net/ceph/mon_client.c
+@@ -922,6 +922,15 @@ int ceph_monc_blacklist_add(struct ceph_
+       mutex_unlock(&monc->mutex);
+       ret = wait_generic_request(req);
++      if (!ret)
++              /*
++               * Make sure we have the osdmap that includes the blacklist
++               * entry.  This is needed to ensure that the OSDs pick up the
++               * new blacklist before processing any future requests from
++               * this client.
++               */
++              ret = ceph_wait_for_latest_osdmap(monc->client, 0);
++
+ out:
+       put_generic_request(req);
+       return ret;
diff --git a/queue-4.14/mips-ensure-elf-appended-dtb-is-relocated.patch b/queue-4.14/mips-ensure-elf-appended-dtb-is-relocated.patch
new file mode 100644 (file)
index 0000000..c6cbe48
--- /dev/null
@@ -0,0 +1,61 @@
+From 3f0a53bc6482fb09770982a8447981260ea258dc Mon Sep 17 00:00:00 2001
+From: Yasha Cherikovsky <yasha.che3@gmail.com>
+Date: Fri, 8 Mar 2019 14:58:51 +0200
+Subject: MIPS: Ensure ELF appended dtb is relocated
+
+From: Yasha Cherikovsky <yasha.che3@gmail.com>
+
+commit 3f0a53bc6482fb09770982a8447981260ea258dc upstream.
+
+This fixes booting with the combination of CONFIG_RELOCATABLE=y
+and CONFIG_MIPS_ELF_APPENDED_DTB=y.
+
+Sections that appear after the relocation table are not relocated
+on system boot (except .bss, which has special handling).
+
+With CONFIG_MIPS_ELF_APPENDED_DTB, the dtb is part of the
+vmlinux ELF, so it must be relocated together with everything else.
+
+Fixes: 069fd766271d ("MIPS: Reserve space for relocation table")
+Signed-off-by: Yasha Cherikovsky <yasha.che3@gmail.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Paul Burton <paul.burton@mips.com>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Cc: stable@vger.kernel.org # v4.7+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/vmlinux.lds.S |   12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/arch/mips/kernel/vmlinux.lds.S
++++ b/arch/mips/kernel/vmlinux.lds.S
+@@ -140,6 +140,13 @@ SECTIONS
+       PERCPU_SECTION(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
+ #endif
++#ifdef CONFIG_MIPS_ELF_APPENDED_DTB
++      .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) {
++              *(.appended_dtb)
++              KEEP(*(.appended_dtb))
++      }
++#endif
++
+ #ifdef CONFIG_RELOCATABLE
+       . = ALIGN(4);
+@@ -164,11 +171,6 @@ SECTIONS
+       __appended_dtb = .;
+       /* leave space for appended DTB */
+       . += 0x100000;
+-#elif defined(CONFIG_MIPS_ELF_APPENDED_DTB)
+-      .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) {
+-              *(.appended_dtb)
+-              KEEP(*(.appended_dtb))
+-      }
+ #endif
+       /*
+        * Align to 64K in attempt to eliminate holes before the
diff --git a/queue-4.14/mips-fix-kernel-crash-for-r6-in-jump-label-branch-function.patch b/queue-4.14/mips-fix-kernel-crash-for-r6-in-jump-label-branch-function.patch
new file mode 100644 (file)
index 0000000..b87e0f3
--- /dev/null
@@ -0,0 +1,51 @@
+From 47c25036b60f27b86ab44b66a8861bcf81cde39b Mon Sep 17 00:00:00 2001
+From: Archer Yan <ayan@wavecomp.com>
+Date: Fri, 8 Mar 2019 03:29:19 +0000
+Subject: MIPS: Fix kernel crash for R6 in jump label branch function
+
+From: Archer Yan <ayan@wavecomp.com>
+
+commit 47c25036b60f27b86ab44b66a8861bcf81cde39b upstream.
+
+Insert Branch instruction instead of NOP to make sure assembler don't
+patch code in forbidden slot. In jump label function, it might
+be possible to patch Control Transfer Instructions(CTIs) into
+forbidden slot, which will generate Reserved Instruction exception
+in MIPS release 6.
+
+Signed-off-by: Archer Yan <ayan@wavecomp.com>
+Reviewed-by: Paul Burton <paul.burton@mips.com>
+[paul.burton@mips.com:
+  - Add MIPS prefix to subject.
+  - Mark for stable from v4.0, which introduced r6 support, onwards.]
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: linux-mips@vger.kernel.org
+Cc: stable@vger.kernel.org # v4.0+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/include/asm/jump_label.h |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/mips/include/asm/jump_label.h
++++ b/arch/mips/include/asm/jump_label.h
+@@ -21,15 +21,15 @@
+ #endif
+ #ifdef CONFIG_CPU_MICROMIPS
+-#define NOP_INSN "nop32"
++#define B_INSN "b32"
+ #else
+-#define NOP_INSN "nop"
++#define B_INSN "b"
+ #endif
+ static __always_inline bool arch_static_branch(struct static_key *key, bool branch)
+ {
+-      asm_volatile_goto("1:\t" NOP_INSN "\n\t"
+-              "nop\n\t"
++      asm_volatile_goto("1:\t" B_INSN " 2f\n\t"
++              "2:\tnop\n\t"
+               ".pushsection __jump_table,  \"aw\"\n\t"
+               WORD_INSN " 1b, %l[l_yes], %0\n\t"
+               ".popsection\n\t"
diff --git a/queue-4.14/mips-loongson64-lemote-2f-add-irqf_no_suspend-to-cascade-irqaction.patch b/queue-4.14/mips-loongson64-lemote-2f-add-irqf_no_suspend-to-cascade-irqaction.patch
new file mode 100644 (file)
index 0000000..bd77afa
--- /dev/null
@@ -0,0 +1,49 @@
+From 5f5f67da9781770df0403269bc57d7aae608fecd Mon Sep 17 00:00:00 2001
+From: Yifeng Li <tomli@tomli.me>
+Date: Tue, 5 Mar 2019 06:00:22 +0800
+Subject: mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction.
+
+From: Yifeng Li <tomli@tomli.me>
+
+commit 5f5f67da9781770df0403269bc57d7aae608fecd upstream.
+
+Timekeeping IRQs from CS5536 MFGPT are routed to i8259, which then
+triggers the "cascade" IRQ on MIPS CPU. Without IRQF_NO_SUSPEND in
+cascade_irqaction, MFGPT interrupts will be masked in suspend mode,
+and the machine would be unable to resume once suspended.
+
+Previously, MIPS IRQs were not disabled properly, so the original
+code appeared to work. Commit a3e6c1eff5 ("MIPS: IRQ: Fix disable_irq on
+CPU IRQs") uncovers the bug. To fix it, add IRQF_NO_SUSPEND to
+cascade_irqaction.
+
+This commit is functionally identical to 0add9c2f1cff ("MIPS:
+Loongson-3: Add IRQF_NO_SUSPEND to Cascade irqaction"), but it forgot
+to apply the same fix to Loongson2.
+
+Signed-off-by: Yifeng Li <tomli@tomli.me>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: linux-mips@vger.kernel.org
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-kernel@vger.kernel.org
+Cc: stable@vger.kernel.org # v3.19+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/loongson64/lemote-2f/irq.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/loongson64/lemote-2f/irq.c
++++ b/arch/mips/loongson64/lemote-2f/irq.c
+@@ -103,7 +103,7 @@ static struct irqaction ip6_irqaction =
+ static struct irqaction cascade_irqaction = {
+       .handler = no_action,
+       .name = "cascade",
+-      .flags = IRQF_NO_THREAD,
++      .flags = IRQF_NO_THREAD | IRQF_NO_SUSPEND,
+ };
+ void __init mach_init_irq(void)
diff --git a/queue-4.14/mmc-pxamci-fix-enum-type-confusion.patch b/queue-4.14/mmc-pxamci-fix-enum-type-confusion.patch
new file mode 100644 (file)
index 0000000..0b0ed09
--- /dev/null
@@ -0,0 +1,47 @@
+From e60a582bcde01158a64ff948fb799f21f5d31a11 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 7 Mar 2019 11:09:19 +0100
+Subject: mmc: pxamci: fix enum type confusion
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit e60a582bcde01158a64ff948fb799f21f5d31a11 upstream.
+
+clang points out several instances of mismatched types in this drivers,
+all coming from a single declaration:
+
+drivers/mmc/host/pxamci.c:193:15: error: implicit conversion from enumeration type 'enum dma_transfer_direction' to
+      different enumeration type 'enum dma_data_direction' [-Werror,-Wenum-conversion]
+                direction = DMA_DEV_TO_MEM;
+                          ~ ^~~~~~~~~~~~~~
+drivers/mmc/host/pxamci.c:212:62: error: implicit conversion from enumeration type 'enum dma_data_direction' to
+      different enumeration type 'enum dma_transfer_direction' [-Werror,-Wenum-conversion]
+        tx = dmaengine_prep_slave_sg(chan, data->sg, host->dma_len, direction,
+
+The behavior is correct, so this must be a simply typo from
+dma_data_direction and dma_transfer_direction being similarly named
+types with a similar purpose.
+
+Fixes: 6464b7140951 ("mmc: pxamci: switch over to dmaengine use")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/pxamci.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/pxamci.c
++++ b/drivers/mmc/host/pxamci.c
+@@ -181,7 +181,7 @@ static void pxamci_dma_irq(void *param);
+ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
+ {
+       struct dma_async_tx_descriptor *tx;
+-      enum dma_data_direction direction;
++      enum dma_transfer_direction direction;
+       struct dma_slave_config config;
+       struct dma_chan *chan;
+       unsigned int nob = data->blocks;
diff --git a/queue-4.14/udf-fix-crash-on-io-error-during-truncate.patch b/queue-4.14/udf-fix-crash-on-io-error-during-truncate.patch
new file mode 100644 (file)
index 0000000..56ca15c
--- /dev/null
@@ -0,0 +1,38 @@
+From d3ca4651d05c0ff7259d087d8c949bcf3e14fb46 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Mon, 11 Mar 2019 15:04:18 +0100
+Subject: udf: Fix crash on IO error during truncate
+
+From: Jan Kara <jack@suse.cz>
+
+commit d3ca4651d05c0ff7259d087d8c949bcf3e14fb46 upstream.
+
+When truncate(2) hits IO error when reading indirect extent block the
+code just bugs with:
+
+kernel BUG at linux-4.15.0/fs/udf/truncate.c:249!
+...
+
+Fix the problem by bailing out cleanly in case of IO error.
+
+CC: stable@vger.kernel.org
+Reported-by: jean-luc malet <jeanluc.malet@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/udf/truncate.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/udf/truncate.c
++++ b/fs/udf/truncate.c
+@@ -260,6 +260,9 @@ void udf_truncate_extents(struct inode *
+                       epos.block = eloc;
+                       epos.bh = udf_tread(sb,
+                                       udf_get_lb_pblock(sb, &eloc, 0));
++                      /* Error reading indirect block? */
++                      if (!epos.bh)
++                              return;
+                       if (elen)
+                               indirect_ext_len =
+                                       (elen + sb->s_blocksize - 1) >>