--- /dev/null
+From 3c1392d4c49962a31874af14ae9ff289cb2b3851 Mon Sep 17 00:00:00 2001
+From: "Yan, Zheng" <zyan@redhat.com>
+Date: Thu, 29 Nov 2018 11:22:50 +0800
+Subject: ceph: don't update importing cap's mseq when handing cap export
+
+From: Yan, Zheng <zyan@redhat.com>
+
+commit 3c1392d4c49962a31874af14ae9ff289cb2b3851 upstream.
+
+Updating mseq makes client think importer mds has accepted all prior
+cap messages and importer mds knows what caps client wants. Actually
+some cap messages may have been dropped because of mseq mismatch.
+
+If mseq is left untouched, importing cap's mds_wanted later will get
+reset by cap import message.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ceph/caps.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -3343,7 +3343,6 @@ retry:
+ tcap->cap_id = t_cap_id;
+ tcap->seq = t_seq - 1;
+ tcap->issue_seq = t_seq - 1;
+- tcap->mseq = t_mseq;
+ tcap->issued |= issued;
+ tcap->implemented |= issued;
+ if (cap == ci->i_auth_cap)
--- /dev/null
+From 2b02a05bdc3a62d36e0d0b015351897109e25991 Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@bootlin.com>
+Date: Tue, 9 Oct 2018 15:24:46 +0200
+Subject: drm/vc4: Set ->is_yuv to false when num_planes == 1
+
+From: Boris Brezillon <boris.brezillon@bootlin.com>
+
+commit 2b02a05bdc3a62d36e0d0b015351897109e25991 upstream.
+
+When vc4_plane_state is duplicated ->is_yuv is left assigned to its
+previous value, and we never set it back to false when switching to
+a non-YUV format.
+
+Fix that by setting ->is_yuv to false in the 'num_planes == 1' branch
+of the vc4_plane_setup_clipping_and_scaling() function.
+
+Fixes: fc04023fafecf ("drm/vc4: Add support for YUV planes.")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181009132446.21960-1-boris.brezillon@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -352,6 +352,7 @@ static int vc4_plane_setup_clipping_and_
+ if (vc4_state->is_unity)
+ vc4_state->x_scaling[0] = VC4_SCALING_PPF;
+ } else {
++ vc4_state->is_yuv = false;
+ vc4_state->x_scaling[1] = VC4_SCALING_NONE;
+ vc4_state->y_scaling[1] = VC4_SCALING_NONE;
+ }
--- /dev/null
+From fdd669684655c07dacbdb0d753fd13833de69a33 Mon Sep 17 00:00:00 2001
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+Date: Wed, 12 Dec 2018 14:45:18 +0100
+Subject: genwqe: Fix size check
+
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+
+commit fdd669684655c07dacbdb0d753fd13833de69a33 upstream.
+
+Calling the test program genwqe_cksum with the default buffer size of
+2MB triggers the following kernel warning on s390:
+
+WARNING: CPU: 30 PID: 9311 at mm/page_alloc.c:3189 __alloc_pages_nodemask+0x45c/0xbe0
+CPU: 30 PID: 9311 Comm: genwqe_cksum Kdump: loaded Not tainted 3.10.0-957.el7.s390x #1
+task: 00000005e5d13980 ti: 00000005e7c6c000 task.ti: 00000005e7c6c000
+Krnl PSW : 0704c00180000000 00000000002780ac (__alloc_pages_nodemask+0x45c/0xbe0)
+ R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 EA:3
+Krnl GPRS: 00000000002932b8 0000000000b73d7c 0000000000000010 0000000000000009
+ 0000000000000041 00000005e7c6f9b8 0000000000000001 00000000000080d0
+ 0000000000000000 0000000000b70500 0000000000000001 0000000000000000
+ 0000000000b70528 00000000007682c0 0000000000277df2 00000005e7c6f9a0
+Krnl Code: 000000000027809e: de7195001000 ed 1280(114,%r9),0(%r1)
+ 00000000002780a4: a774fead brc 7,277dfe
+ #00000000002780a8: a7f40001 brc 15,2780aa
+ >00000000002780ac: 92011000 mvi 0(%r1),1
+ 00000000002780b0: a7f4fea7 brc 15,277dfe
+ 00000000002780b4: 9101c6b6 tm 1718(%r12),1
+ 00000000002780b8: a784ff3a brc 8,277f2c
+ 00000000002780bc: a7f4fe2e brc 15,277d18
+Call Trace:
+([<0000000000277df2>] __alloc_pages_nodemask+0x1a2/0xbe0)
+ [<000000000013afae>] s390_dma_alloc+0xfe/0x310
+ [<000003ff8065f362>] __genwqe_alloc_consistent+0xfa/0x148 [genwqe_card]
+ [<000003ff80658f7a>] genwqe_mmap+0xca/0x248 [genwqe_card]
+ [<00000000002b2712>] mmap_region+0x4e2/0x778
+ [<00000000002b2c54>] do_mmap+0x2ac/0x3e0
+ [<0000000000292d7e>] vm_mmap_pgoff+0xd6/0x118
+ [<00000000002b081c>] SyS_mmap_pgoff+0xdc/0x268
+ [<00000000002b0a34>] SyS_old_mmap+0x8c/0xb0
+ [<000000000074e518>] sysc_tracego+0x14/0x1e
+ [<000003ffacf87dc6>] 0x3ffacf87dc6
+
+turns out the check in __genwqe_alloc_consistent uses "> MAX_ORDER"
+while the mm code uses ">= MAX_ORDER". Fix genwqe.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Frank Haverkamp <haver@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/genwqe/card_utils.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -217,7 +217,7 @@ u32 genwqe_crc32(u8 *buff, size_t len, u
+ void *__genwqe_alloc_consistent(struct genwqe_dev *cd, size_t size,
+ dma_addr_t *dma_handle)
+ {
+- if (get_order(size) > MAX_ORDER)
++ if (get_order(size) >= MAX_ORDER)
+ return NULL;
+
+ return dma_zalloc_coherent(&cd->pci_dev->dev, size, dma_handle,
--- /dev/null
+From ec5b5ad6e272d8d6b92d1007f79574919862a2d2 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 19 Dec 2018 17:19:22 +0200
+Subject: intel_th: msu: Fix an off-by-one in attribute store
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit ec5b5ad6e272d8d6b92d1007f79574919862a2d2 upstream.
+
+The 'nr_pages' attribute of the 'msc' subdevices parses a comma-separated
+list of window sizes, passed from userspace. However, there is a bug in
+the string parsing logic wherein it doesn't exclude the comma character
+from the range of characters as it consumes them. This leads to an
+out-of-bounds access given a sufficiently long list. For example:
+
+> # echo 8,8,8,8 > /sys/bus/intel_th/devices/0-msc0/nr_pages
+> ==================================================================
+> BUG: KASAN: slab-out-of-bounds in memchr+0x1e/0x40
+> Read of size 1 at addr ffff8803ffcebcd1 by task sh/825
+>
+> CPU: 3 PID: 825 Comm: npktest.sh Tainted: G W 4.20.0-rc1+
+> Call Trace:
+> dump_stack+0x7c/0xc0
+> print_address_description+0x6c/0x23c
+> ? memchr+0x1e/0x40
+> kasan_report.cold.5+0x241/0x308
+> memchr+0x1e/0x40
+> nr_pages_store+0x203/0xd00 [intel_th_msu]
+
+Fix this by accounting for the comma character.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: ba82664c134ef ("intel_th: Add Memory Storage Unit driver")
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/msu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -1429,7 +1429,8 @@ nr_pages_store(struct device *dev, struc
+ if (!end)
+ break;
+
+- len -= end - p;
++ /* consume the number and the following comma, hence +1 */
++ len -= end - p + 1;
+ p = end + 1;
+ } while (len);
+
--- /dev/null
+From ed54ffbe554f0902689fd6d1712bbacbacd11376 Mon Sep 17 00:00:00 2001
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Fri, 16 Nov 2018 17:23:47 +0100
+Subject: power: supply: olpc_battery: correct the temperature units
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+commit ed54ffbe554f0902689fd6d1712bbacbacd11376 upstream.
+
+According to [1] and [2], the temperature values are in tenths of degree
+Celsius. Exposing the Celsius value makes the battery appear on fire:
+
+ $ upower -i /org/freedesktop/UPower/devices/battery_olpc_battery
+ ...
+ temperature: 236.9 degrees C
+
+Tested on OLPC XO-1 and OLPC XO-1.75 laptops.
+
+[1] include/linux/power_supply.h
+[2] Documentation/power/power_supply_class.txt
+
+Fixes: fb972873a767 ("[BATTERY] One Laptop Per Child power/battery driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/supply/olpc_battery.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/power/supply/olpc_battery.c
++++ b/drivers/power/supply/olpc_battery.c
+@@ -427,14 +427,14 @@ static int olpc_bat_get_property(struct
+ if (ret)
+ return ret;
+
+- val->intval = (s16)be16_to_cpu(ec_word) * 100 / 256;
++ val->intval = (s16)be16_to_cpu(ec_word) * 10 / 256;
+ break;
+ case POWER_SUPPLY_PROP_TEMP_AMBIENT:
+ ret = olpc_ec_cmd(EC_AMB_TEMP, NULL, 0, (void *)&ec_word, 2);
+ if (ret)
+ return ret;
+
+- val->intval = (int)be16_to_cpu(ec_word) * 100 / 256;
++ val->intval = (int)be16_to_cpu(ec_word) * 10 / 256;
+ break;
+ case POWER_SUPPLY_PROP_CHARGE_COUNTER:
+ ret = olpc_ec_cmd(EC_BAT_ACR, NULL, 0, (void *)&ec_word, 2);
9p-net-put-a-lower-bound-on-msize.patch
rxe-fix-error-completion-wr_id-and-qp_num.patch
iommu-vt-d-handle-domain-agaw-being-less-than-iommu-agaw.patch
+ceph-don-t-update-importing-cap-s-mseq-when-handing-cap-export.patch
+genwqe-fix-size-check.patch
+intel_th-msu-fix-an-off-by-one-in-attribute-store.patch
+power-supply-olpc_battery-correct-the-temperature-units.patch
+drm-vc4-set-is_yuv-to-false-when-num_planes-1.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
