--- /dev/null
+From c2d65263a14f978cdaa07ca2d9a1dbff398c06bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Apr 2020 15:36:22 +0800
+Subject: drm/amdgpu: drop redundant cg/pg ungate on runpm enter
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit f7b52890daba570bc8162d43c96b5583bbdd4edd ]
+
+CG/PG ungate is already performed in ip_suspend_phase1. Otherwise,
+the CG/PG ungate will be performed twice. That will cause gfxoff
+disablement is performed twice also on runpm enter while gfxoff
+enablemnt once on rump exit. That will put gfxoff into disabled
+state.
+
+Fixes: b2a7e9735ab286 ("drm/amdgpu: fix the hw hang during perform system reboot and reset")
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 1ddf2460cf834..5fcbacddb9b0e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -3325,9 +3325,6 @@ int amdgpu_device_suspend(struct drm_device *dev, bool fbcon)
+ }
+ }
+
+- amdgpu_device_set_pg_state(adev, AMD_PG_STATE_UNGATE);
+- amdgpu_device_set_cg_state(adev, AMD_CG_STATE_UNGATE);
+-
+ amdgpu_ras_suspend(adev);
+
+ r = amdgpu_device_ip_suspend_phase1(adev);
+--
+2.20.1
+
--- /dev/null
+From 8ec7f26eb97a41d780c232f27815e8ada52ea33b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Apr 2020 15:32:41 +0800
+Subject: drm/amdgpu: move kfd suspend after ip_suspend_phase1
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit c457a273e118bb96e1db8d1825f313e6cafe4258 ]
+
+This sequence change should be safe as what did in ip_suspend_phase1
+is to suspend DCE only. And this is a prerequisite for coming
+redundant cg/pg ungate dropping.
+
+Fixes: 487eca11a321ef ("drm/amdgpu: fix gfx hang during suspend with video playback (v2)")
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index f184cdca938de..1ddf2460cf834 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -3328,12 +3328,12 @@ int amdgpu_device_suspend(struct drm_device *dev, bool fbcon)
+ amdgpu_device_set_pg_state(adev, AMD_PG_STATE_UNGATE);
+ amdgpu_device_set_cg_state(adev, AMD_CG_STATE_UNGATE);
+
+- amdgpu_amdkfd_suspend(adev);
+-
+ amdgpu_ras_suspend(adev);
+
+ r = amdgpu_device_ip_suspend_phase1(adev);
+
++ amdgpu_amdkfd_suspend(adev);
++
+ /* evict vram memory */
+ amdgpu_bo_evict_vram(adev);
+
+--
+2.20.1
+
--- /dev/null
+From b0550d427ec3d9c1d31824d9b7507bceb56c09fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Mar 2020 11:00:28 -0400
+Subject: ext4: disable dioread_nolock whenever delayed allocation is disabled
+
+From: Eric Whitney <enwlinux@gmail.com>
+
+[ Upstream commit c8980e1980ccdc2229aa2218d532ddc62e0aabe5 ]
+
+The patch "ext4: make dioread_nolock the default" (244adf6426ee) causes
+generic/422 to fail when run in kvm-xfstests' ext3conv test case. This
+applies both the dioread_nolock and nodelalloc mount options, a
+combination not previously tested by kvm-xfstests. The failure occurs
+because the dioread_nolock code path splits a previously fallocated
+multiblock extent into a series of single block extents when overwriting
+a portion of that extent. That causes allocation of an extent tree leaf
+node and a reshuffling of extents. Once writeback is completed, the
+individual extents are recombined into a single extent, the extent is
+moved again, and the leaf node is deleted. The difference in block
+utilization before and after writeback due to the leaf node triggers the
+failure.
+
+The original reason for this behavior was to avoid ENOSPC when handling
+I/O completions during writeback in the dioread_nolock code paths when
+delayed allocation is disabled. It may no longer be necessary, because
+code was added in the past to reserve extra space to solve this problem
+when delayed allocation is enabled, and this code may also apply when
+delayed allocation is disabled. Until this can be verified, don't use
+the dioread_nolock code paths if delayed allocation is disabled.
+
+Signed-off-by: Eric Whitney <enwlinux@gmail.com>
+Link: https://lore.kernel.org/r/20200319150028.24592-1-enwlinux@gmail.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ext4_jbd2.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
+index 7ea4f6fa173b4..4b9002f0e84c0 100644
+--- a/fs/ext4/ext4_jbd2.h
++++ b/fs/ext4/ext4_jbd2.h
+@@ -512,6 +512,9 @@ static inline int ext4_should_dioread_nolock(struct inode *inode)
+ return 0;
+ if (ext4_should_journal_data(inode))
+ return 0;
++ /* temporary fix to prevent generic/422 test failures */
++ if (!test_opt(inode->i_sb, DELALLOC))
++ return 0;
+ return 1;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From fe771a96ae617aff0809831c213c4b264fe44aec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Mar 2020 01:37:44 +0530
+Subject: ext4: don't set dioread_nolock by default for blocksize < pagesize
+
+From: Ritesh Harjani <riteshh@linux.ibm.com>
+
+Currently on calling echo 3 > drop_caches on host machine, we see
+FS corruption in the guest. This happens on Power machine where
+blocksize < pagesize.
+
+So as a temporary workaound don't enable dioread_nolock by default
+for blocksize < pagesize until we identify the root cause.
+
+Also emit a warning msg in case if this mount option is manually
+enabled for blocksize < pagesize.
+
+Reported-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Link: https://lore.kernel.org/r/20200327200744.12473-1-riteshh@linux.ibm.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+---
+ fs/ext4/super.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 446158ab507dd..70796de7c4682 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2181,6 +2181,14 @@ static int parse_options(char *options, struct super_block *sb,
+ }
+ }
+ #endif
++ if (test_opt(sb, DIOREAD_NOLOCK)) {
++ int blocksize =
++ BLOCK_SIZE << le32_to_cpu(sbi->s_es->s_log_block_size);
++ if (blocksize < PAGE_SIZE)
++ ext4_msg(sb, KERN_WARNING, "Warning: mounting with an "
++ "experimental mount option 'dioread_nolock' "
++ "for blocksize < PAGE_SIZE");
++ }
+ return 1;
+ }
+
+@@ -3787,7 +3795,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ set_opt(sb, NO_UID32);
+ /* xattr user namespace & acls are now defaulted on */
+ set_opt(sb, XATTR_USER);
+- set_opt(sb, DIOREAD_NOLOCK);
+ #ifdef CONFIG_EXT4_FS_POSIX_ACL
+ set_opt(sb, POSIX_ACL);
+ #endif
+@@ -3837,6 +3844,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ sbi->s_li_wait_mult = EXT4_DEF_LI_WAIT_MULT;
+
+ blocksize = BLOCK_SIZE << le32_to_cpu(es->s_log_block_size);
++
++ if (blocksize == PAGE_SIZE)
++ set_opt(sb, DIOREAD_NOLOCK);
++
+ if (blocksize < EXT4_MIN_BLOCK_SIZE ||
+ blocksize > EXT4_MAX_BLOCK_SIZE) {
+ ext4_msg(sb, KERN_ERR,
+--
+2.20.1
+
--- /dev/null
+From c57723f0d7214c3c40b02d0f29e8102e39ed45e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 13:51:20 +0300
+Subject: net: macb: Fix runtime PM refcounting
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 0ce205d4660c312cdeb4a81066616dcc6f3799c4 ]
+
+The commit e6a41c23df0d, while trying to fix an issue,
+
+ ("net: macb: ensure interface is not suspended on at91rm9200")
+
+introduced a refcounting regression, because in error case refcounter
+must be balanced. Fix it by calling pm_runtime_put_noidle() in error case.
+
+While here, fix the same mistake in other couple of places.
+
+Fixes: e6a41c23df0d ("net: macb: ensure interface is not suspended on at91rm9200")
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index b3a51935e8e0b..1fc83cd31cf28 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -334,8 +334,10 @@ static int macb_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
+ int status;
+
+ status = pm_runtime_get_sync(&bp->pdev->dev);
+- if (status < 0)
++ if (status < 0) {
++ pm_runtime_put_noidle(&bp->pdev->dev);
+ goto mdio_pm_exit;
++ }
+
+ status = macb_mdio_wait_for_idle(bp);
+ if (status < 0)
+@@ -386,8 +388,10 @@ static int macb_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
+ int status;
+
+ status = pm_runtime_get_sync(&bp->pdev->dev);
+- if (status < 0)
++ if (status < 0) {
++ pm_runtime_put_noidle(&bp->pdev->dev);
+ goto mdio_pm_exit;
++ }
+
+ status = macb_mdio_wait_for_idle(bp);
+ if (status < 0)
+@@ -3803,8 +3807,10 @@ static int at91ether_open(struct net_device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(&lp->pdev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(&lp->pdev->dev);
+ return ret;
++ }
+
+ /* Clear internal statistics */
+ ctl = macb_readl(lp, NCR);
+--
+2.20.1
+
--- /dev/null
+From 5968f4d962352db059102fad48687b4b4f2034d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 May 2020 15:44:02 -0700
+Subject: nvme: fix possible hang when ns scanning fails during error recovery
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 59c7c3caaaf8750df4ec3255082f15eb4e371514 ]
+
+When the controller is reconnecting, the host fails I/O and admin
+commands as the host cannot reach the controller. ns scanning may
+revalidate namespaces during that period and it is wrong to remove
+namespaces due to these failures as we may hang (see 205da2434301).
+
+One command that may fail is nvme_identify_ns_descs. Since we return
+success due to having ns identify descriptor list optional, we continue
+to compare ns identifiers in nvme_revalidate_disk, obviously fail and
+return -ENODEV to nvme_validate_ns, which will remove the namespace.
+
+Exactly what we don't want to happen.
+
+Fixes: 22802bf742c2 ("nvme: Namepace identification descriptor list is optional")
+Tested-by: Anton Eidelman <anton@lightbitslabs.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 545e9e5f1b737..84f20369d8467 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1082,7 +1082,7 @@ static int nvme_identify_ns_descs(struct nvme_ctrl *ctrl, unsigned nsid,
+ * Don't treat an error as fatal, as we potentially already
+ * have a NGUID or EUI-64.
+ */
+- if (status > 0)
++ if (status > 0 && !(status & NVME_SC_DNR))
+ status = 0;
+ goto free_data;
+ }
+--
+2.20.1
+
--- /dev/null
+From 10dfca40e76ee7460a17142ea325cc1ab0b1cb56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Mar 2020 14:19:35 +0100
+Subject: nvme: refactor nvme_identify_ns_descs error handling
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit fb314eb0cbb2e11540d1ae1a7b28346397f621ef ]
+
+Move the handling of an error into the function from the caller, and
+only do it for an actual error on the admin command itself, not the
+command parsing, as that should be enough to deal with devices claiming
+a bogus version compliance.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 28 +++++++++++++---------------
+ 1 file changed, 13 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index fb4c35a430650..545e9e5f1b737 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1075,8 +1075,17 @@ static int nvme_identify_ns_descs(struct nvme_ctrl *ctrl, unsigned nsid,
+
+ status = nvme_submit_sync_cmd(ctrl->admin_q, &c, data,
+ NVME_IDENTIFY_DATA_SIZE);
+- if (status)
++ if (status) {
++ dev_warn(ctrl->device,
++ "Identify Descriptors failed (%d)\n", status);
++ /*
++ * Don't treat an error as fatal, as we potentially already
++ * have a NGUID or EUI-64.
++ */
++ if (status > 0)
++ status = 0;
+ goto free_data;
++ }
+
+ for (pos = 0; pos < NVME_IDENTIFY_DATA_SIZE; pos += len) {
+ struct nvme_ns_id_desc *cur = data + pos;
+@@ -1734,26 +1743,15 @@ static void nvme_config_write_zeroes(struct gendisk *disk, struct nvme_ns *ns)
+ static int nvme_report_ns_ids(struct nvme_ctrl *ctrl, unsigned int nsid,
+ struct nvme_id_ns *id, struct nvme_ns_ids *ids)
+ {
+- int ret = 0;
+-
+ memset(ids, 0, sizeof(*ids));
+
+ if (ctrl->vs >= NVME_VS(1, 1, 0))
+ memcpy(ids->eui64, id->eui64, sizeof(id->eui64));
+ if (ctrl->vs >= NVME_VS(1, 2, 0))
+ memcpy(ids->nguid, id->nguid, sizeof(id->nguid));
+- if (ctrl->vs >= NVME_VS(1, 3, 0)) {
+- /* Don't treat error as fatal we potentially
+- * already have a NGUID or EUI-64
+- */
+- ret = nvme_identify_ns_descs(ctrl, nsid, ids);
+- if (ret)
+- dev_warn(ctrl->device,
+- "Identify Descriptors failed (%d)\n", ret);
+- if (ret > 0)
+- ret = 0;
+- }
+- return ret;
++ if (ctrl->vs >= NVME_VS(1, 3, 0))
++ return nvme_identify_ns_descs(ctrl, nsid, ids);
++ return 0;
+ }
+
+ static bool nvme_ns_ids_valid(struct nvme_ns_ids *ids)
+--
+2.20.1
+
thunderbolt-check-return-value-of-tb_sw_read-in-usb4_switch_op.patch
usb-serial-qcserial-add-dw5816e-support.patch
+drm-amdgpu-move-kfd-suspend-after-ip_suspend_phase1.patch
+drm-amdgpu-drop-redundant-cg-pg-ungate-on-runpm-ente.patch
+vt-fix-unicode-console-freeing-with-a-common-interfa.patch
+tty-xilinx_uartps-fix-missing-id-assignment-to-the-c.patch
+ext4-don-t-set-dioread_nolock-by-default-for-blocksi.patch
+ext4-disable-dioread_nolock-whenever-delayed-allocat.patch
+nvme-refactor-nvme_identify_ns_descs-error-handling.patch
+nvme-fix-possible-hang-when-ns-scanning-fails-during.patch
+tracing-kprobes-fix-a-double-initialization-typo.patch
+net-macb-fix-runtime-pm-refcounting.patch
--- /dev/null
+From f05bbae12a2b2748e32d838e5c11e769db164402 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Apr 2020 14:49:09 +0900
+Subject: tracing/kprobes: Fix a double initialization typo
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit dcbd21c9fca5e954fd4e3d91884907eb6d47187e ]
+
+Fix a typo that resulted in an unnecessary double
+initialization to addr.
+
+Link: http://lkml.kernel.org/r/158779374968.6082.2337484008464939919.stgit@devnote2
+
+Cc: Tom Zanussi <zanussi@kernel.org>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: stable@vger.kernel.org
+Fixes: c7411a1a126f ("tracing/kprobe: Check whether the non-suffixed symbol is notrace")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_kprobe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index d0568af4a0ef6..0d9300c3b0846 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -453,7 +453,7 @@ static bool __within_notrace_func(unsigned long addr)
+
+ static bool within_notrace_func(struct trace_kprobe *tk)
+ {
+- unsigned long addr = addr = trace_kprobe_address(tk);
++ unsigned long addr = trace_kprobe_address(tk);
+ char symname[KSYM_NAME_LEN], *p;
+
+ if (!__within_notrace_func(addr))
+--
+2.20.1
+
--- /dev/null
+From cd7aadc849bbdd4f3e95ed5c9896905284713c5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 May 2020 16:27:28 +0200
+Subject: tty: xilinx_uartps: Fix missing id assignment to the console
+
+From: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
+
+[ Upstream commit 2ae11c46d5fdc46cb396e35911c713d271056d35 ]
+
+When serial console has been assigned to ttyPS1 (which is serial1 alias)
+console index is not updated property and pointing to index -1 (statically
+initialized) which ends up in situation where nothing has been printed on
+the port.
+
+The commit 18cc7ac8a28e ("Revert "serial: uartps: Register own uart console
+and driver structures"") didn't contain this line which was removed by
+accident.
+
+Fixes: 18cc7ac8a28e ("Revert "serial: uartps: Register own uart console and driver structures"")
+Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Link: https://lore.kernel.org/r/ed3111533ef5bd342ee5ec504812240b870f0853.1588602446.git.michal.simek@xilinx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/xilinx_uartps.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index 7a9b360b04386..1d8b6993a4357 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1471,6 +1471,7 @@ static int cdns_uart_probe(struct platform_device *pdev)
+ cdns_uart_uart_driver.nr = CDNS_UART_NR_PORTS;
+ #ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE
+ cdns_uart_uart_driver.cons = &cdns_uart_console;
++ cdns_uart_console.index = id;
+ #endif
+
+ rc = uart_register_driver(&cdns_uart_uart_driver);
+--
+2.20.1
+
--- /dev/null
+From de05d9beb7ab08492400392817b519edfbe3d624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 May 2020 11:01:07 -0400
+Subject: vt: fix unicode console freeing with a common interface
+
+From: Nicolas Pitre <nico@fluxnic.net>
+
+[ Upstream commit 57d38f26d81e4275748b69372f31df545dcd9b71 ]
+
+By directly using kfree() in different places we risk missing one if
+it is switched to using vfree(), especially if the corresponding
+vmalloc() is hidden away within a common abstraction.
+
+Oh wait, that's exactly what happened here.
+
+So let's fix this by creating a common abstraction for the free case
+as well.
+
+Signed-off-by: Nicolas Pitre <nico@fluxnic.net>
+Reported-by: syzbot+0bfda3ade1ee9288a1be@syzkaller.appspotmail.com
+Fixes: 9a98e7a80f95 ("vt: don't use kmalloc() for the unicode screen buffer")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://lore.kernel.org/r/nycvar.YSQ.7.76.2005021043110.2671@knanqh.ubzr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/vt/vt.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index cc1a041913654..699d8b56cbe75 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -365,9 +365,14 @@ static struct uni_screen *vc_uniscr_alloc(unsigned int cols, unsigned int rows)
+ return uniscr;
+ }
+
++static void vc_uniscr_free(struct uni_screen *uniscr)
++{
++ vfree(uniscr);
++}
++
+ static void vc_uniscr_set(struct vc_data *vc, struct uni_screen *new_uniscr)
+ {
+- vfree(vc->vc_uni_screen);
++ vc_uniscr_free(vc->vc_uni_screen);
+ vc->vc_uni_screen = new_uniscr;
+ }
+
+@@ -1230,7 +1235,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ err = resize_screen(vc, new_cols, new_rows, user);
+ if (err) {
+ kfree(newscreen);
+- kfree(new_uniscr);
++ vc_uniscr_free(new_uniscr);
+ return err;
+ }
+
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
