From: Sasha Levin Date: Wed, 19 Dec 2018 15:15:53 +0000 (-0500) Subject: patches for 3.18 X-Git-Tag: v4.19.11~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7c7393a9978f7d4b7db364eb020ecb0f22aa121f;p=thirdparty%2Fkernel%2Fstable-queue.git patches for 3.18 Signed-off-by: Sasha Levin --- diff --git a/queue-3.18/arm-8814-1-mm-improve-fix-arm-v7_dma_inv_range-unali.patch b/queue-3.18/arm-8814-1-mm-improve-fix-arm-v7_dma_inv_range-unali.patch new file mode 100644 index 00000000000..6452aeb3a43 --- /dev/null +++ b/queue-3.18/arm-8814-1-mm-improve-fix-arm-v7_dma_inv_range-unali.patch @@ -0,0 +1,74 @@ +From bd9a6acf2bf40c544cff8eb0809a16ff93303f7b Mon Sep 17 00:00:00 2001 +From: Chris Cole +Date: Fri, 23 Nov 2018 12:20:45 +0100 +Subject: ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address + handling + +[ Upstream commit a1208f6a822ac29933e772ef1f637c5d67838da9 ] + +This patch addresses possible memory corruption when +v7_dma_inv_range(start_address, end_address) address parameters are not +aligned to whole cache lines. This function issues "invalidate" cache +management operations to all cache lines from start_address (inclusive) +to end_address (exclusive). When start_address and/or end_address are +not aligned, the start and/or end cache lines are first issued "clean & +invalidate" operation. The assumption is this is done to ensure that any +dirty data addresses outside the address range (but part of the first or +last cache lines) are cleaned/flushed so that data is not lost, which +could happen if just an invalidate is issued. + +The problem is that these first/last partial cache lines are issued +"clean & invalidate" and then "invalidate". This second "invalidate" is +not required and worse can cause "lost" writes to addresses outside the +address range but part of the cache line. If another component writes to +its part of the cache line between the "clean & invalidate" and +"invalidate" operations, the write can get lost. This fix is to remove +the extra "invalidate" operation when unaligned addressed are used. + +A kernel module is available that has a stress test to reproduce the +issue and a unit test of the updated v7_dma_inv_range(). It can be +downloaded from +http://ftp.sageembedded.com/outgoing/linux/cache-test-20181107.tgz. + +v7_dma_inv_range() is call by dmac_[un]map_area(addr, len, direction) +when the direction is DMA_FROM_DEVICE. One can (I believe) successfully +argue that DMA from a device to main memory should use buffers aligned +to cache line size, because the "clean & invalidate" might overwrite +data that the device just wrote using DMA. But if a driver does use +unaligned buffers, at least this fix will prevent memory corruption +outside the buffer. + +Signed-off-by: Chris Cole +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/mm/cache-v7.S | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S +index b966656d2c2d..7e98fecff55a 100644 +--- a/arch/arm/mm/cache-v7.S ++++ b/arch/arm/mm/cache-v7.S +@@ -359,14 +359,16 @@ v7_dma_inv_range: + ALT_UP(W(nop)) + #endif + mcrne p15, 0, r0, c7, c14, 1 @ clean & invalidate D / U line ++ addne r0, r0, r2 + + tst r1, r3 + bic r1, r1, r3 + mcrne p15, 0, r1, c7, c14, 1 @ clean & invalidate D / U line +-1: +- mcr p15, 0, r0, c7, c6, 1 @ invalidate D / U line +- add r0, r0, r2 + cmp r0, r1 ++1: ++ mcrlo p15, 0, r0, c7, c6, 1 @ invalidate D / U line ++ addlo r0, r0, r2 ++ cmplo r0, r1 + blo 1b + dsb st + ret lr +-- +2.19.1 + diff --git a/queue-3.18/bonding-fix-802.3ad-state-sent-to-partner-when-unbin.patch b/queue-3.18/bonding-fix-802.3ad-state-sent-to-partner-when-unbin.patch new file mode 100644 index 00000000000..a7b573c0d94 --- /dev/null +++ b/queue-3.18/bonding-fix-802.3ad-state-sent-to-partner-when-unbin.patch @@ -0,0 +1,60 @@ +From 0f946650760191f5fdb0a3d8426234866e38b0a8 Mon Sep 17 00:00:00 2001 +From: Toni Peltonen +Date: Tue, 27 Nov 2018 16:56:57 +0200 +Subject: bonding: fix 802.3ad state sent to partner when unbinding slave + +[ Upstream commit 3b5b3a3331d141e8f2a7aaae3a94dfa1e61ecbe4 ] + +Previously when unbinding a slave the 802.3ad implementation only told +partner that the port is not suitable for aggregation by setting the port +aggregation state from aggregatable to individual. This is not enough. If the +physical layer still stays up and we only unbinded this port from the bond there +is nothing in the aggregation status alone to prevent the partner from sending +traffic towards us. To ensure that the partner doesn't consider this +port at all anymore we should also disable collecting and distributing to +signal that this actor is going away. Also clear AD_STATE_SYNCHRONIZATION to +ensure partner exits collecting + distributing state. + +I have tested this behaviour againts Arista EOS switches with mlx5 cards +(physical link stays up even when interface is down) and simulated +the same situation virtually Linux <-> Linux with two network namespaces +running two veth device pairs. In both cases setting aggregation to +individual doesn't alone prevent traffic from being to sent towards this +port given that the link stays up in partners end. Partner still keeps +it's end in collecting + distributing state and continues until timeout is +reached. In most cases this means we are losing the traffic partner sends +towards our port while we wait for timeout. This is most visible with slow +periodic time (LACP rate slow). + +Other open source implementations like Open VSwitch and libreswitch, and +vendor implementations like Arista EOS, seem to disable collecting + +distributing to when doing similar port disabling/detaching/removing change. +With this patch kernel implementation would behave the same way and ensure +partner doesn't consider our actor viable anymore. + +Signed-off-by: Toni Peltonen +Signed-off-by: Jay Vosburgh +Acked-by: Jonathan Toppins +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_3ad.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c +index 2110215f3528..371cbaa82608 100644 +--- a/drivers/net/bonding/bond_3ad.c ++++ b/drivers/net/bonding/bond_3ad.c +@@ -1906,6 +1906,9 @@ void bond_3ad_unbind_slave(struct slave *slave) + aggregator->aggregator_identifier); + + /* Tell the partner that this port is not suitable for aggregation */ ++ port->actor_oper_port_state &= ~AD_STATE_SYNCHRONIZATION; ++ port->actor_oper_port_state &= ~AD_STATE_COLLECTING; ++ port->actor_oper_port_state &= ~AD_STATE_DISTRIBUTING; + port->actor_oper_port_state &= ~AD_STATE_AGGREGATION; + __update_lacpdu_from_port(port); + ad_lacpdu_send(port); +-- +2.19.1 + diff --git a/queue-3.18/cifs-in-kconfig-config_cifs_posix-needs-depends-on-l.patch b/queue-3.18/cifs-in-kconfig-config_cifs_posix-needs-depends-on-l.patch new file mode 100644 index 00000000000..4b3f54016c9 --- /dev/null +++ b/queue-3.18/cifs-in-kconfig-config_cifs_posix-needs-depends-on-l.patch @@ -0,0 +1,35 @@ +From 1f45c510363d10089506a34ef849f6e629a989a5 Mon Sep 17 00:00:00 2001 +From: Steve French +Date: Sat, 3 Nov 2018 15:02:44 -0500 +Subject: cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure + cifs) + +[ Upstream commit 6e785302dad32228819d8066e5376acd15d0e6ba ] + +Missing a dependency. Shouldn't show cifs posix extensions +in Kconfig if CONFIG_CIFS_ALLOW_INSECURE_DIALECTS (ie SMB1 +protocol) is disabled. + +Signed-off-by: Steve French +Reviewed-by: Pavel Shilovsky +Signed-off-by: Sasha Levin +--- + fs/cifs/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig +index a2172f3f69e3..35bbf6b64982 100644 +--- a/fs/cifs/Kconfig ++++ b/fs/cifs/Kconfig +@@ -111,7 +111,7 @@ config CIFS_XATTR + + config CIFS_POSIX + bool "CIFS POSIX Extensions" +- depends on CIFS_XATTR ++ depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY && CIFS_XATTR + help + Enabling this option will cause the cifs client to attempt to + negotiate a newer dialect with servers, such as Samba 3.0.5 +-- +2.19.1 + diff --git a/queue-3.18/drivers-sbus-char-add-of_node_put.patch b/queue-3.18/drivers-sbus-char-add-of_node_put.patch new file mode 100644 index 00000000000..1ee064d3c13 --- /dev/null +++ b/queue-3.18/drivers-sbus-char-add-of_node_put.patch @@ -0,0 +1,34 @@ +From 988cb59766cc684f233ed4354228427a92325f5c Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Tue, 20 Nov 2018 08:38:26 -0500 +Subject: drivers/sbus/char: add of_node_put() + +[ Upstream commit 6bd520ab7cf69486ea81fd3cdfd2d5a390ad1100 ] + +use of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/sbus/char/envctrl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c +index af15a2fdab5e..3d36fa025a5a 100644 +--- a/drivers/sbus/char/envctrl.c ++++ b/drivers/sbus/char/envctrl.c +@@ -910,8 +910,10 @@ static void envctrl_init_i2c_child(struct device_node *dp, + for (len = 0; len < PCF8584_MAX_CHANNELS; ++len) { + pchild->mon_type[len] = ENVCTRL_NOMON; + } ++ of_node_put(root_node); + return; + } ++ of_node_put(root_node); + } + + /* Get the monitor channels. */ +-- +2.19.1 + diff --git a/queue-3.18/drivers-tty-add-missing-of_node_put.patch b/queue-3.18/drivers-tty-add-missing-of_node_put.patch new file mode 100644 index 00000000000..af0e08004f6 --- /dev/null +++ b/queue-3.18/drivers-tty-add-missing-of_node_put.patch @@ -0,0 +1,33 @@ +From 61bee96cc0cd02f3c3b1195147257817f0f83c70 Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Wed, 21 Nov 2018 10:22:54 -0500 +Subject: drivers/tty: add missing of_node_put() + +[ Upstream commit dac097c4546e4c5b16dd303a1e97c1d319c8ab3e ] + +of_find_node_by_path() acquires a reference to the node +returned by it and that reference needs to be dropped by its caller. +This place is not doing this, so fix it. + +Signed-off-by: Yangtao Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/suncore.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tty/serial/suncore.c b/drivers/tty/serial/suncore.c +index 6e4ac8db2d79..2b06c1603f23 100644 +--- a/drivers/tty/serial/suncore.c ++++ b/drivers/tty/serial/suncore.c +@@ -112,6 +112,7 @@ void sunserial_console_termios(struct console *con, struct device_node *uart_dp) + mode = of_get_property(dp, mode_prop, NULL); + if (!mode) + mode = "9600,8,n,1,-"; ++ of_node_put(dp); + } + + cflag = CREAD | HUPCL | CLOCAL; +-- +2.19.1 + diff --git a/queue-3.18/i2c-scmi-fix-probe-error-on-devices-with-an-empty-sm.patch b/queue-3.18/i2c-scmi-fix-probe-error-on-devices-with-an-empty-sm.patch new file mode 100644 index 00000000000..c78b3c866c9 --- /dev/null +++ b/queue-3.18/i2c-scmi-fix-probe-error-on-devices-with-an-empty-sm.patch @@ -0,0 +1,72 @@ +From e5c7684c2fc12278b6553f0ab40a553424be66aa Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 21 Nov 2018 10:19:55 +0100 +Subject: i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI + device node + +[ Upstream commit 0544ee4b1ad574aec3b6379af5f5cdee42840971 ] + +Some AMD based HP laptops have a SMB0001 ACPI device node which does not +define any methods. + +This leads to the following error in dmesg: + +[ 5.222731] cmi: probe of SMB0001:00 failed with error -5 + +This commit makes acpi_smbus_cmi_add() return -ENODEV instead in this case +silencing the error. In case of a failure of the i2c_add_adapter() call +this commit now propagates the error from that call instead of -EIO. + +Signed-off-by: Hans de Goede +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-scmi.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c +index efefcfa24a4c..d2178f701b41 100644 +--- a/drivers/i2c/busses/i2c-scmi.c ++++ b/drivers/i2c/busses/i2c-scmi.c +@@ -364,6 +364,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device) + { + struct acpi_smbus_cmi *smbus_cmi; + const struct acpi_device_id *id; ++ int ret; + + smbus_cmi = kzalloc(sizeof(struct acpi_smbus_cmi), GFP_KERNEL); + if (!smbus_cmi) +@@ -385,8 +386,10 @@ static int acpi_smbus_cmi_add(struct acpi_device *device) + acpi_walk_namespace(ACPI_TYPE_METHOD, smbus_cmi->handle, 1, + acpi_smbus_cmi_query_methods, NULL, smbus_cmi, NULL); + +- if (smbus_cmi->cap_info == 0) ++ if (smbus_cmi->cap_info == 0) { ++ ret = -ENODEV; + goto err; ++ } + + snprintf(smbus_cmi->adapter.name, sizeof(smbus_cmi->adapter.name), + "SMBus CMI adapter %s", +@@ -397,7 +400,8 @@ static int acpi_smbus_cmi_add(struct acpi_device *device) + smbus_cmi->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD; + smbus_cmi->adapter.dev.parent = &device->dev; + +- if (i2c_add_adapter(&smbus_cmi->adapter)) { ++ ret = i2c_add_adapter(&smbus_cmi->adapter); ++ if (ret) { + dev_err(&device->dev, "Couldn't register adapter!\n"); + goto err; + } +@@ -407,7 +411,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device) + err: + kfree(smbus_cmi); + device->driver_data = NULL; +- return -EIO; ++ return ret; + } + + static int acpi_smbus_cmi_remove(struct acpi_device *device) +-- +2.19.1 + diff --git a/queue-3.18/ide-pmac-add-of_node_put.patch b/queue-3.18/ide-pmac-add-of_node_put.patch new file mode 100644 index 00000000000..87ba09b2f89 --- /dev/null +++ b/queue-3.18/ide-pmac-add-of_node_put.patch @@ -0,0 +1,31 @@ +From d4e1332b3425e8497f5ab33fb9f8fd4004f5a7ec Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Tue, 20 Nov 2018 08:02:49 -0500 +Subject: ide: pmac: add of_node_put() + +[ Upstream commit a51921c0db3fd26c4ed83dc0ec5d32988fa02aa5 ] + +use of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/ide/pmac.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c +index 2db803cd095c..57a0bd00789f 100644 +--- a/drivers/ide/pmac.c ++++ b/drivers/ide/pmac.c +@@ -920,6 +920,7 @@ static u8 pmac_ide_cable_detect(ide_hwif_t *hwif) + struct device_node *root = of_find_node_by_path("/"); + const char *model = of_get_property(root, "model", NULL); + ++ of_node_put(root); + /* Get cable type from device-tree. */ + if (cable && !strncmp(cable, "80-", 3)) { + /* Some drives fail to detect 80c cable in PowerBook */ +-- +2.19.1 + diff --git a/queue-3.18/input-omap-keypad-fix-keyboard-debounce-configuratio.patch b/queue-3.18/input-omap-keypad-fix-keyboard-debounce-configuratio.patch new file mode 100644 index 00000000000..b0e4ba69e0d --- /dev/null +++ b/queue-3.18/input-omap-keypad-fix-keyboard-debounce-configuratio.patch @@ -0,0 +1,67 @@ +From e4ee87750d3c4a38fe304e88168f576bc16d474d Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Mon, 3 Dec 2018 11:24:30 -0800 +Subject: Input: omap-keypad - fix keyboard debounce configuration + +[ Upstream commit 6c3516fed7b61a3527459ccfa67fab130d910610 ] + +I noticed that the Android v3.0.8 kernel on droid4 is using different +keypad values from the mainline kernel and does not have issues with +keys occasionally being stuck until pressed again. Turns out there was +an earlier patch posted to fix this as "Input: omap-keypad: errata i689: +Correct debounce time", but it was never reposted to fix use macros +for timing calculations. + +This updated version is using macros, and also fixes the use of the +input clock rate to use 32768KiHz instead of 32000KiHz. And we want to +use the known good Android kernel values of 3 and 6 instead of 2 and 6 +in the earlier patch. + +Reported-by: Pavel Machek +Signed-off-by: Tony Lindgren +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/omap4-keypad.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c +index 3ab045369c0c..1739221aa5fa 100644 +--- a/drivers/input/keyboard/omap4-keypad.c ++++ b/drivers/input/keyboard/omap4-keypad.c +@@ -60,8 +60,18 @@ + + /* OMAP4 values */ + #define OMAP4_VAL_IRQDISABLE 0x0 +-#define OMAP4_VAL_DEBOUNCINGTIME 0x7 +-#define OMAP4_VAL_PVT 0x7 ++ ++/* ++ * Errata i689: If a key is released for a time shorter than debounce time, ++ * the keyboard will idle and never detect the key release. The workaround ++ * is to use at least a 12ms debounce time. See omap5432 TRM chapter ++ * "26.4.6.2 Keyboard Controller Timer" for more information. ++ */ ++#define OMAP4_KEYPAD_PTV_DIV_128 0x6 ++#define OMAP4_KEYPAD_DEBOUNCINGTIME_MS(dbms, ptv) \ ++ ((((dbms) * 1000) / ((1 << ((ptv) + 1)) * (1000000 / 32768))) - 1) ++#define OMAP4_VAL_DEBOUNCINGTIME_16MS \ ++ OMAP4_KEYPAD_DEBOUNCINGTIME_MS(16, OMAP4_KEYPAD_PTV_DIV_128) + + enum { + KBD_REVISION_OMAP4 = 0, +@@ -181,9 +191,9 @@ static int omap4_keypad_open(struct input_dev *input) + + kbd_writel(keypad_data, OMAP4_KBD_CTRL, + OMAP4_DEF_CTRL_NOSOFTMODE | +- (OMAP4_VAL_PVT << OMAP4_DEF_CTRL_PTV_SHIFT)); ++ (OMAP4_KEYPAD_PTV_DIV_128 << OMAP4_DEF_CTRL_PTV_SHIFT)); + kbd_writel(keypad_data, OMAP4_KBD_DEBOUNCINGTIME, +- OMAP4_VAL_DEBOUNCINGTIME); ++ OMAP4_VAL_DEBOUNCINGTIME_16MS); + /* clear pending interrupts */ + kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS, + kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)); +-- +2.19.1 + diff --git a/queue-3.18/libata-whitelist-all-samsung-mz7km-solid-state-disks.patch b/queue-3.18/libata-whitelist-all-samsung-mz7km-solid-state-disks.patch new file mode 100644 index 00000000000..e6ff109b415 --- /dev/null +++ b/queue-3.18/libata-whitelist-all-samsung-mz7km-solid-state-disks.patch @@ -0,0 +1,34 @@ +From 50b1693dc846f21374a8d7857cdd1a728b99934f Mon Sep 17 00:00:00 2001 +From: Juha-Matti Tilli +Date: Sun, 2 Dec 2018 12:47:08 +0200 +Subject: libata: whitelist all SAMSUNG MZ7KM* solid-state disks + +[ Upstream commit fd6f32f78645db32b6b95a42e45da2ddd6de0e67 ] + +These devices support read zero after trim (RZAT), as they advertise to +the OS. However, the OS doesn't believe the SSDs unless they are +explicitly whitelisted. + +Acked-by: Martin K. Petersen +Signed-off-by: Juha-Matti Tilli +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 6629a5deccbd..e155998e4696 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4295,6 +4295,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "SSD*INTEL*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Samsung*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "SAMSUNG*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "SAMSUNG*MZ7KM*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "ST[1248][0248]0[FH]*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, + + /* devices that don't properly handle TRIM commands */ +-- +2.19.1 + diff --git a/queue-3.18/sbus-char-add-of_node_put.patch b/queue-3.18/sbus-char-add-of_node_put.patch new file mode 100644 index 00000000000..41d556114bb --- /dev/null +++ b/queue-3.18/sbus-char-add-of_node_put.patch @@ -0,0 +1,31 @@ +From 8f225156c3c435c3df3392fe7915b06faee702d6 Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Tue, 20 Nov 2018 08:30:40 -0500 +Subject: sbus: char: add of_node_put() + +[ Upstream commit 87d81a23e24f24ebe014891e8bdf3ff8785031e8 ] + +use of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/sbus/char/display7seg.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/sbus/char/display7seg.c b/drivers/sbus/char/display7seg.c +index 2b0ce7c350ee..98661714688b 100644 +--- a/drivers/sbus/char/display7seg.c ++++ b/drivers/sbus/char/display7seg.c +@@ -221,6 +221,7 @@ static int d7s_probe(struct platform_device *op) + dev_set_drvdata(&op->dev, p); + d7s_device = p; + err = 0; ++ of_node_put(opts); + + out: + return err; +-- +2.19.1 + diff --git a/queue-3.18/scsi-libiscsi-fix-null-pointer-dereference-in-iscsi_.patch b/queue-3.18/scsi-libiscsi-fix-null-pointer-dereference-in-iscsi_.patch new file mode 100644 index 00000000000..b589d42dc0d --- /dev/null +++ b/queue-3.18/scsi-libiscsi-fix-null-pointer-dereference-in-iscsi_.patch @@ -0,0 +1,39 @@ +From 92037f1e7a303cc0ecdf1a890ace1bb9732537d7 Mon Sep 17 00:00:00 2001 +From: Fred Herard +Date: Tue, 20 Nov 2018 20:22:45 -0500 +Subject: scsi: libiscsi: Fix NULL pointer dereference in + iscsi_eh_session_reset + +[ Upstream commit 5db6dd14b31397e8cccaaddab2ff44ebec1acf25 ] + +This commit addresses NULL pointer dereference in iscsi_eh_session_reset. +Reference should not be made to session->leadconn when session->state is +set to ISCSI_STATE_TERMINATE. + +Signed-off-by: Fred Herard +Reviewed-by: Konrad Rzeszutek Wilk +Reviewed-by: Lee Duncan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libiscsi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 857bf9417817..56441a5ec3d7 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -2433,8 +2433,8 @@ int iscsi_eh_session_reset(struct scsi_cmnd *sc) + failed: + ISCSI_DBG_EH(session, + "failing session reset: Could not log back into " +- "%s, %s [age %d]\n", session->targetname, +- conn->persistent_address, session->age); ++ "%s [age %d]\n", session->targetname, ++ session->age); + spin_unlock_bh(&session->frwd_lock); + mutex_unlock(&session->eh_mutex); + return FAILED; +-- +2.19.1 + diff --git a/queue-3.18/scsi-vmw_pscsi-rearrange-code-to-avoid-multiple-call.patch b/queue-3.18/scsi-vmw_pscsi-rearrange-code-to-avoid-multiple-call.patch new file mode 100644 index 00000000000..5c44ef10fe2 --- /dev/null +++ b/queue-3.18/scsi-vmw_pscsi-rearrange-code-to-avoid-multiple-call.patch @@ -0,0 +1,55 @@ +From 184f67c7d65fe34ad0c83aa2a4287b8c7d9c2484 Mon Sep 17 00:00:00 2001 +From: Cathy Avery +Date: Tue, 27 Nov 2018 14:28:53 -0500 +Subject: scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq + during unload + +[ Upstream commit 02f425f811cefcc4d325d7a72272651e622dc97e ] + +Currently pvscsi_remove calls free_irq more than once as +pvscsi_release_resources and __pvscsi_shutdown both call +pvscsi_shutdown_intr. This results in a 'Trying to free already-free IRQ' +warning and stack trace. To solve the problem pvscsi_shutdown_intr has been +moved out of pvscsi_release_resources. + +Signed-off-by: Cathy Avery +Reviewed-by: Ewan D. Milne +Reviewed-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/vmw_pvscsi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c +index d5dd70049f81..25119780edae 100644 +--- a/drivers/scsi/vmw_pvscsi.c ++++ b/drivers/scsi/vmw_pvscsi.c +@@ -1225,8 +1225,6 @@ static void pvscsi_shutdown_intr(struct pvscsi_adapter *adapter) + + static void pvscsi_release_resources(struct pvscsi_adapter *adapter) + { +- pvscsi_shutdown_intr(adapter); +- + if (adapter->workqueue) + destroy_workqueue(adapter->workqueue); + +@@ -1555,6 +1553,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const struct pci_device_id *id) + out_reset_adapter: + ll_adapter_reset(adapter); + out_release_resources: ++ pvscsi_shutdown_intr(adapter); + pvscsi_release_resources(adapter); + scsi_host_put(host); + out_disable_device: +@@ -1563,6 +1562,7 @@ out_disable_device: + return error; + + out_release_resources_and_disable: ++ pvscsi_shutdown_intr(adapter); + pvscsi_release_resources(adapter); + goto out_disable_device; + } +-- +2.19.1 + diff --git a/queue-3.18/series b/queue-3.18/series index c4a2de9aff4..522981d85dc 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -9,3 +9,17 @@ mmc-omap-fix-broken-mmc-on-omap15xx-omap5910-omap310.patch tracing-fix-memory-leak-in-set_trigger_filter.patch tracing-fix-memory-leak-of-instance-function-hash-filters.patch powerpc-look-for-stdout-path-when-setting-up-legacy-consoles.patch +scsi-libiscsi-fix-null-pointer-dereference-in-iscsi_.patch +scsi-vmw_pscsi-rearrange-code-to-avoid-multiple-call.patch +x86-earlyprintk-efi-fix-infinite-loop-on-some-screen.patch +bonding-fix-802.3ad-state-sent-to-partner-when-unbin.patch +sunrpc-fix-a-potential-race-in-xprt_connect.patch +sbus-char-add-of_node_put.patch +drivers-sbus-char-add-of_node_put.patch +drivers-tty-add-missing-of_node_put.patch +ide-pmac-add-of_node_put.patch +input-omap-keypad-fix-keyboard-debounce-configuratio.patch +libata-whitelist-all-samsung-mz7km-solid-state-disks.patch +arm-8814-1-mm-improve-fix-arm-v7_dma_inv_range-unali.patch +cifs-in-kconfig-config_cifs_posix-needs-depends-on-l.patch +i2c-scmi-fix-probe-error-on-devices-with-an-empty-sm.patch diff --git a/queue-3.18/sunrpc-fix-a-potential-race-in-xprt_connect.patch b/queue-3.18/sunrpc-fix-a-potential-race-in-xprt_connect.patch new file mode 100644 index 00000000000..b728a4543ee --- /dev/null +++ b/queue-3.18/sunrpc-fix-a-potential-race-in-xprt_connect.patch @@ -0,0 +1,46 @@ +From b201685c89a77ed0168c0a3a7c296721e3a171cd Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 1 Dec 2018 23:18:00 -0500 +Subject: SUNRPC: Fix a potential race in xprt_connect() + +[ Upstream commit 0a9a4304f3614e25d9de9b63502ca633c01c0d70 ] + +If an asynchronous connection attempt completes while another task is +in xprt_connect(), then the call to rpc_sleep_on() could end up +racing with the call to xprt_wake_pending_tasks(). +So add a second test of the connection state after we've put the +task to sleep and set the XPRT_CONNECTING flag, when we know that there +can be no asynchronous connection attempts still in progress. + +Fixes: 0b9e79431377d ("SUNRPC: Move the test for XPRT_CONNECTING into...") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprt.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c +index 56e4e150e80e..dca234b1f77d 100644 +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -721,8 +721,15 @@ void xprt_connect(struct rpc_task *task) + return; + if (xprt_test_and_set_connecting(xprt)) + return; +- xprt->stat.connect_start = jiffies; +- xprt->ops->connect(xprt, task); ++ /* Race breaker */ ++ if (!xprt_connected(xprt)) { ++ xprt->stat.connect_start = jiffies; ++ xprt->ops->connect(xprt, task); ++ } else { ++ xprt_clear_connecting(xprt); ++ task->tk_status = 0; ++ rpc_wake_up_queued_task(&xprt->pending, task); ++ } + } + } + +-- +2.19.1 + diff --git a/queue-3.18/x86-earlyprintk-efi-fix-infinite-loop-on-some-screen.patch b/queue-3.18/x86-earlyprintk-efi-fix-infinite-loop-on-some-screen.patch new file mode 100644 index 00000000000..e7f51deca5b --- /dev/null +++ b/queue-3.18/x86-earlyprintk-efi-fix-infinite-loop-on-some-screen.patch @@ -0,0 +1,63 @@ +From b1feb9e1534c228f3ba39facbf9273f11e2419f1 Mon Sep 17 00:00:00 2001 +From: YiFei Zhu +Date: Thu, 29 Nov 2018 18:12:30 +0100 +Subject: x86/earlyprintk/efi: Fix infinite loop on some screen widths + +[ Upstream commit 79c2206d369b87b19ac29cb47601059b6bf5c291 ] + +An affected screen resolution is 1366 x 768, which width is not +divisible by 8, the default font width. On such screens, when longer +lines are earlyprintk'ed, overflow-to-next-line can never trigger, +due to the left-most x-coordinate of the next character always less +than the screen width. Earlyprintk will infinite loop in trying to +print the rest of the string but unable to, due to the line being +full. + +This patch makes the trigger consider the right-most x-coordinate, +instead of left-most, as the value to compare against the screen +width threshold. + +Signed-off-by: YiFei Zhu +Signed-off-by: Ard Biesheuvel +Cc: Andy Lutomirski +Cc: Arend van Spriel +Cc: Bhupesh Sharma +Cc: Borislav Petkov +Cc: Dave Hansen +Cc: Eric Snowberg +Cc: Hans de Goede +Cc: Joe Perches +Cc: Jon Hunter +Cc: Julien Thierry +Cc: Linus Torvalds +Cc: Marc Zyngier +Cc: Matt Fleming +Cc: Nathan Chancellor +Cc: Peter Zijlstra +Cc: Sai Praneeth Prakhya +Cc: Sedat Dilek +Cc: Thomas Gleixner +Cc: linux-efi@vger.kernel.org +Link: http://lkml.kernel.org/r/20181129171230.18699-12-ard.biesheuvel@linaro.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/platform/efi/early_printk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/platform/efi/early_printk.c b/arch/x86/platform/efi/early_printk.c +index 524142117296..82324fc25d5e 100644 +--- a/arch/x86/platform/efi/early_printk.c ++++ b/arch/x86/platform/efi/early_printk.c +@@ -179,7 +179,7 @@ early_efi_write(struct console *con, const char *str, unsigned int num) + num--; + } + +- if (efi_x >= si->lfb_width) { ++ if (efi_x + font->width > si->lfb_width) { + efi_x = 0; + efi_y += font->height; + } +-- +2.19.1 +