--- /dev/null
+From f2e0ea861117bda073d1d7ffbd3120c07c0d5d34 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Fri, 6 Mar 2015 10:49:21 +0000
+Subject: Change email address for 8250_pci
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit f2e0ea861117bda073d1d7ffbd3120c07c0d5d34 upstream.
+
+I'm still receiving reports to my email address, so let's point this
+at the linux-serial mailing list instead.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -66,7 +66,7 @@ static void moan_device(const char *str,
+ "Please send the output of lspci -vv, this\n"
+ "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
+ "manufacturer and name of serial board or\n"
+- "modem board to rmk+serial@arm.linux.org.uk.\n",
++ "modem board to <linux-serial@vger.kernel.org>.\n",
+ pci_name(dev), str, dev->vendor, dev->device,
+ dev->subsystem_vendor, dev->subsystem_device);
+ }
--- /dev/null
+From 30a22c215a0007603ffc08021f2e8b64018517dd Mon Sep 17 00:00:00 2001
+From: Peter Hurley <peter@hurleysoftware.com>
+Date: Sun, 1 Mar 2015 10:11:05 -0500
+Subject: console: Fix console name size mismatch
+
+From: Peter Hurley <peter@hurleysoftware.com>
+
+commit 30a22c215a0007603ffc08021f2e8b64018517dd upstream.
+
+commit 6ae9200f2cab7 ("enlarge console.name") increased the storage
+for the console name to 16 bytes, but not the corresponding
+struct console_cmdline::name storage. Console names longer than
+8 bytes cause read beyond end-of-string and failure to match
+console; I'm not sure if there are other unexpected consequences.
+
+Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/printk/console_cmdline.h | 2 +-
+ kernel/printk/printk.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/printk/console_cmdline.h
++++ b/kernel/printk/console_cmdline.h
+@@ -3,7 +3,7 @@
+
+ struct console_cmdline
+ {
+- char name[8]; /* Name of the driver */
++ char name[16]; /* Name of the driver */
+ int index; /* Minor dev. to use */
+ char *options; /* Options for the driver */
+ #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2280,6 +2280,7 @@ void register_console(struct console *ne
+ for (i = 0, c = console_cmdline;
+ i < MAX_CMDLINECONSOLES && c->name[0];
+ i++, c++) {
++ BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name));
+ if (strcmp(c->name, newcon->name) != 0)
+ continue;
+ if (newcon->index >= 0 &&
--- /dev/null
+From cffefd9bb31cd35ab745d3b49005d10616d25bdc Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Mar 2015 20:45:24 -0500
+Subject: drm/radeon: do a posting read in cik_set_irq
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit cffefd9bb31cd35ab745d3b49005d10616d25bdc upstream.
+
+To make sure the writes go through the pci bridge.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=90741
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/cik.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -7069,6 +7069,9 @@ int cik_irq_set(struct radeon_device *rd
+ WREG32(DC_HPD5_INT_CONTROL, hpd5);
+ WREG32(DC_HPD6_INT_CONTROL, hpd6);
+
++ /* posting read */
++ RREG32(SRBM_STATUS);
++
+ return 0;
+ }
+
--- /dev/null
+From c320bb5f6dc0cb88a811cbaf839303e0a3916a92 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Mar 2015 20:42:53 -0500
+Subject: drm/radeon: do a posting read in evergreen_set_irq
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit c320bb5f6dc0cb88a811cbaf839303e0a3916a92 upstream.
+
+To make sure the writes go through the pci bridge.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=90741
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/evergreen.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -4596,6 +4596,9 @@ int evergreen_irq_set(struct radeon_devi
+ WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5);
+ WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6);
+
++ /* posting read */
++ RREG32(SRBM_STATUS);
++
+ return 0;
+ }
+
--- /dev/null
+From f957063fee6392bb9365370db6db74dc0b2dce0a Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Mar 2015 20:36:26 -0500
+Subject: drm/radeon: do a posting read in r100_set_irq
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit f957063fee6392bb9365370db6db74dc0b2dce0a upstream.
+
+To make sure the writes go through the pci bridge.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=90741
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/r100.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -742,6 +742,10 @@ int r100_irq_set(struct radeon_device *r
+ tmp |= RADEON_FP2_DETECT_MASK;
+ }
+ WREG32(RADEON_GEN_INT_CNTL, tmp);
++
++ /* read back to post the write */
++ RREG32(RADEON_GEN_INT_CNTL);
++
+ return 0;
+ }
+
--- /dev/null
+From 9d1393f23d5656cdd5f368efd60694d4aeed81d3 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Mar 2015 20:41:31 -0500
+Subject: drm/radeon: do a posting read in r600_set_irq
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 9d1393f23d5656cdd5f368efd60694d4aeed81d3 upstream.
+
+To make sure the writes go through the pci bridge.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=90741
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/r600.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3647,6 +3647,9 @@ int r600_irq_set(struct radeon_device *r
+ WREG32(RV770_CG_THERMAL_INT, thermal_int);
+ }
+
++ /* posting read */
++ RREG32(R_000E50_SRBM_STATUS);
++
+ return 0;
+ }
+
--- /dev/null
+From 54acf107e4e66d1f4a697e08a7f60dba9fcf07c3 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Mar 2015 20:39:56 -0500
+Subject: drm/radeon: do a posting read in rs600_set_irq
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 54acf107e4e66d1f4a697e08a7f60dba9fcf07c3 upstream.
+
+To make sure the writes go through the pci bridge.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=90741
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/rs600.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -700,6 +700,10 @@ int rs600_irq_set(struct radeon_device *
+ WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
+ if (ASIC_IS_DCE2(rdev))
+ WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0);
++
++ /* posting read */
++ RREG32(R_000040_GEN_INT_CNTL);
++
+ return 0;
+ }
+
--- /dev/null
+From 0586915ec10d0ae60de5cd3381ad25a704760402 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Mar 2015 20:43:53 -0500
+Subject: drm/radeon: do a posting read in si_set_irq
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 0586915ec10d0ae60de5cd3381ad25a704760402 upstream.
+
+To make sure the writes go through the pci bridge.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=90741
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -5958,6 +5958,9 @@ int si_irq_set(struct radeon_device *rde
+
+ WREG32(CG_THERMAL_INT, thermal_int);
+
++ /* posting read */
++ RREG32(SRBM_STATUS);
++
+ return 0;
+ }
+
--- /dev/null
+From a17d4996e051e78d164989b894608cf37cd5110b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Thu, 19 Feb 2015 09:40:28 +0100
+Subject: drm/radeon: drop setting UPLL to sleep mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+
+commit a17d4996e051e78d164989b894608cf37cd5110b upstream.
+
+Just keep it working, seems to fix some PLL problems.
+
+Bug: https://bugs.freedesktop.org/show_bug.cgi?id=73378
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -6878,8 +6878,7 @@ int si_set_uvd_clocks(struct radeon_devi
+ WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
+
+ if (!vclk || !dclk) {
+- /* keep the Bypass mode, put PLL to sleep */
+- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
++ /* keep the Bypass mode */
+ return 0;
+ }
+
+@@ -6895,8 +6894,7 @@ int si_set_uvd_clocks(struct radeon_devi
+ /* set VCO_MODE to 1 */
+ WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
+
+- /* toggle UPLL_SLEEP to 1 then back to 0 */
+- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
++ /* disable sleep mode */
+ WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
+
+ /* deassert UPLL_RESET */
--- /dev/null
+From a28b2a47edcd0cb7c051b445f71a426000394606 Mon Sep 17 00:00:00 2001
+From: Tommi Rantala <tt.rantala@gmail.com>
+Date: Mon, 2 Mar 2015 21:36:07 +0200
+Subject: drm/radeon: fix DRM_IOCTL_RADEON_CS oops
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tommi Rantala <tt.rantala@gmail.com>
+
+commit a28b2a47edcd0cb7c051b445f71a426000394606 upstream.
+
+Passing zeroed drm_radeon_cs struct to DRM_IOCTL_RADEON_CS produces the
+following oops.
+
+Fix by always calling INIT_LIST_HEAD() to avoid the crash in list_sort().
+
+----------------------------------
+
+ #include <stdint.h>
+ #include <fcntl.h>
+ #include <unistd.h>
+ #include <sys/ioctl.h>
+ #include <drm/radeon_drm.h>
+
+ static const struct drm_radeon_cs cs;
+
+ int main(int argc, char **argv)
+ {
+ return ioctl(open(argv[1], O_RDWR), DRM_IOCTL_RADEON_CS, &cs);
+ }
+
+----------------------------------
+
+[ttrantal@test2 ~]$ ./main /dev/dri/card0
+[ 46.904650] BUG: unable to handle kernel NULL pointer dereference at (null)
+[ 46.905022] IP: [<ffffffff814d6df2>] list_sort+0x42/0x240
+[ 46.905022] PGD 68f29067 PUD 688b5067 PMD 0
+[ 46.905022] Oops: 0002 [#1] SMP
+[ 46.905022] CPU: 0 PID: 2413 Comm: main Not tainted 4.0.0-rc1+ #58
+[ 46.905022] Hardware name: Hewlett-Packard HP Compaq dc5750 Small Form Factor/0A64h, BIOS 786E3 v02.10 01/25/2007
+[ 46.905022] task: ffff880058e2bcc0 ti: ffff880058e64000 task.ti: ffff880058e64000
+[ 46.905022] RIP: 0010:[<ffffffff814d6df2>] [<ffffffff814d6df2>] list_sort+0x42/0x240
+[ 46.905022] RSP: 0018:ffff880058e67998 EFLAGS: 00010246
+[ 46.905022] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+[ 46.905022] RDX: ffffffff81644410 RSI: ffff880058e67b40 RDI: ffff880058e67a58
+[ 46.905022] RBP: ffff880058e67a88 R08: 0000000000000000 R09: 0000000000000000
+[ 46.905022] R10: ffff880058e2bcc0 R11: ffffffff828e6ca0 R12: ffffffff81644410
+[ 46.905022] R13: ffff8800694b8018 R14: 0000000000000000 R15: ffff880058e679b0
+[ 46.905022] FS: 00007fdc65a65700(0000) GS:ffff88006d600000(0000) knlGS:0000000000000000
+[ 46.905022] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 46.905022] CR2: 0000000000000000 CR3: 0000000058dd9000 CR4: 00000000000006f0
+[ 46.905022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 46.905022] DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
+[ 46.905022] Stack:
+[ 46.905022] ffff880058e67b40 ffff880058e2bcc0 ffff880058e67a78 0000000000000000
+[ 46.905022] 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+[ 46.905022] 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+[ 46.905022] Call Trace:
+[ 46.905022] [<ffffffff81644a65>] radeon_cs_parser_fini+0x195/0x220
+[ 46.905022] [<ffffffff81645069>] radeon_cs_ioctl+0xa9/0x960
+[ 46.905022] [<ffffffff815e1f7c>] drm_ioctl+0x19c/0x640
+[ 46.905022] [<ffffffff810f8fdd>] ? trace_hardirqs_on_caller+0xfd/0x1c0
+[ 46.905022] [<ffffffff810f90ad>] ? trace_hardirqs_on+0xd/0x10
+[ 46.905022] [<ffffffff8160c066>] radeon_drm_ioctl+0x46/0x80
+[ 46.905022] [<ffffffff81211868>] do_vfs_ioctl+0x318/0x570
+[ 46.905022] [<ffffffff81462ef6>] ? selinux_file_ioctl+0x56/0x110
+[ 46.905022] [<ffffffff81211b41>] SyS_ioctl+0x81/0xa0
+[ 46.905022] [<ffffffff81dc6312>] system_call_fastpath+0x12/0x17
+[ 46.905022] Code: 48 89 b5 10 ff ff ff 0f 84 03 01 00 00 4c 8d bd 28 ff ff
+ff 31 c0 48 89 fb b9 15 00 00 00 49 89 d4 4c 89 ff f3 48 ab 48 8b 46 08 <48> c7
+00 00 00 00 00 48 8b 0e 48 85 c9 0f 84 7d 00 00 00 c7 85
+[ 46.905022] RIP [<ffffffff814d6df2>] list_sort+0x42/0x240
+[ 46.905022] RSP <ffff880058e67998>
+[ 46.905022] CR2: 0000000000000000
+[ 47.149253] ---[ end trace 09576b4e8b2c20b8 ]---
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_cs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_cs.c
++++ b/drivers/gpu/drm/radeon/radeon_cs.c
+@@ -179,11 +179,13 @@ int radeon_cs_parser_init(struct radeon_
+ u32 ring = RADEON_CS_RING_GFX;
+ s32 priority = 0;
+
++ INIT_LIST_HEAD(&p->validated);
++
+ if (!cs->num_chunks) {
+ return 0;
+ }
++
+ /* get chunks */
+- INIT_LIST_HEAD(&p->validated);
+ p->idx = 0;
+ p->ib.sa_bo = NULL;
+ p->ib.semaphore = NULL;
--- /dev/null
+From 77ae5f4b48a0445426c9c1ef7c0f28b717e35d55 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 3 Mar 2015 17:00:43 -0500
+Subject: drm/radeon: fix interlaced modes on DCE8
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 77ae5f4b48a0445426c9c1ef7c0f28b717e35d55 upstream.
+
+Need to double the viewport height.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1306,6 +1306,9 @@ static int dce4_crtc_do_set_base(struct
+ (x << 16) | y);
+ viewport_w = crtc->mode.hdisplay;
+ viewport_h = (crtc->mode.vdisplay + 1) & ~1;
++ if ((rdev->family >= CHIP_BONAIRE) &&
++ (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE))
++ viewport_h *= 2;
+ WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+ (viewport_w << 16) | viewport_h);
+
--- /dev/null
+From 0d2783626a53d4c922f82d51fa675cb5d13f0d36 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Thu, 26 Feb 2015 11:45:47 +0100
+Subject: fuse: notify: don't move pages
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit 0d2783626a53d4c922f82d51fa675cb5d13f0d36 upstream.
+
+fuse_try_move_page() is not prepared for replacing pages that have already
+been read.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/dev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -1726,6 +1726,9 @@ copy_finish:
+ static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
+ unsigned int size, struct fuse_copy_state *cs)
+ {
++ /* Don't try to move pages (yet) */
++ cs->move_pages = 0;
++
+ switch (code) {
+ case FUSE_NOTIFY_POLL:
+ return fuse_notify_poll(fc, size, cs);
--- /dev/null
+From aa991b3b267e24f578bac7b09cc57579b660304b Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Thu, 26 Feb 2015 11:45:47 +0100
+Subject: fuse: set stolen page uptodate
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit aa991b3b267e24f578bac7b09cc57579b660304b upstream.
+
+Regular pipe buffers' ->steal method (generic_pipe_buf_steal()) doesn't set
+PG_uptodate.
+
+Don't warn on this condition, just set the uptodate flag.
+
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/dev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -819,8 +819,8 @@ static int fuse_try_move_page(struct fus
+
+ newpage = buf->page;
+
+- if (WARN_ON(!PageUptodate(newpage)))
+- return -EIO;
++ if (!PageUptodate(newpage))
++ SetPageUptodate(newpage);
+
+ ClearPageMappedToDisk(newpage);
+
--- /dev/null
+From d5e7cafd69da24e6d6cc988fab6ea313a2577efc Mon Sep 17 00:00:00 2001
+From: JeHyeon Yeon <tom.yeon@windriver.com>
+Date: Mon, 16 Mar 2015 01:03:19 +0000
+Subject: LZ4 : fix the data abort issue
+
+From: JeHyeon Yeon <tom.yeon@windriver.com>
+
+commit d5e7cafd69da24e6d6cc988fab6ea313a2577efc upstream.
+
+If the part of the compression data are corrupted, or the compression
+data is totally fake, the memory access over the limit is possible.
+
+This is the log from my system usning lz4 decompression.
+ [6502]data abort, halting
+ [6503]r0 0x00000000 r1 0x00000000 r2 0xdcea0ffc r3 0xdcea0ffc
+ [6509]r4 0xb9ab0bfd r5 0xdcea0ffc r6 0xdcea0ff8 r7 0xdce80000
+ [6515]r8 0x00000000 r9 0x00000000 r10 0x00000000 r11 0xb9a98000
+ [6522]r12 0xdcea1000 usp 0x00000000 ulr 0x00000000 pc 0x820149bc
+ [6528]spsr 0x400001f3
+and the memory addresses of some variables at the moment are
+ ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000
+
+As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory
+over @oend.
+
+Signed-off-by: JeHyeon Yeon <tom.yeon@windriver.com>
+Reviewed-by: David Sterba <dsterba@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/lz4/lz4_decompress.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/lib/lz4/lz4_decompress.c
++++ b/lib/lz4/lz4_decompress.c
+@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *so
+ /* Error: request to write beyond destination buffer */
+ if (cpy > oend)
+ goto _output_error;
++ if ((ref + COPYLENGTH) > oend ||
++ (op + COPYLENGTH) > oend)
++ goto _output_error;
+ LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
+ while (op < cpy)
+ *op++ = *ref++;
tcp-fix-tcp-fin-memory-accounting.patch
net-compat-update-get_compat_msghdr-to-match-copy_msghdr_from_user-behaviour.patch
tcp-make-connect-mem-charging-friendly.patch
+drm-radeon-fix-drm_ioctl_radeon_cs-oops.patch
+drm-radeon-do-a-posting-read-in-evergreen_set_irq.patch
+drm-radeon-do-a-posting-read-in-r100_set_irq.patch
+drm-radeon-do-a-posting-read-in-r600_set_irq.patch
+drm-radeon-do-a-posting-read-in-cik_set_irq.patch
+drm-radeon-do-a-posting-read-in-si_set_irq.patch
+drm-radeon-do-a-posting-read-in-rs600_set_irq.patch
+drm-radeon-fix-interlaced-modes-on-dce8.patch
+drm-radeon-drop-setting-upll-to-sleep-mode.patch
+lz4-fix-the-data-abort-issue.patch
+fuse-set-stolen-page-uptodate.patch
+fuse-notify-don-t-move-pages.patch
+console-fix-console-name-size-mismatch.patch
+virtio_console-init-work-unconditionally.patch
+virtio_console-avoid-config-access-from-irq.patch
+change-email-address-for-8250_pci.patch
--- /dev/null
+From eeb8a7e8bb123e84daeef84f5a2eab99ad2839a2 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Thu, 5 Mar 2015 10:45:49 +1030
+Subject: virtio_console: avoid config access from irq
+
+From: "Michael S. Tsirkin" <mst@redhat.com>
+
+commit eeb8a7e8bb123e84daeef84f5a2eab99ad2839a2 upstream.
+
+when multiport is off, virtio console invokes config access from irq
+context, config access is blocking on s390.
+Fix this up by scheduling work from config irq - similar to what we do
+for multiport configs.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/virtio_console.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -142,6 +142,7 @@ struct ports_device {
+ * notification
+ */
+ struct work_struct control_work;
++ struct work_struct config_work;
+
+ struct list_head ports;
+
+@@ -1832,10 +1833,21 @@ static void config_intr(struct virtio_de
+
+ portdev = vdev->priv;
+
++ if (!use_multiport(portdev))
++ schedule_work(&portdev->config_work);
++}
++
++static void config_work_handler(struct work_struct *work)
++{
++ struct ports_device *portdev;
++
++ portdev = container_of(work, struct ports_device, control_work);
+ if (!use_multiport(portdev)) {
++ struct virtio_device *vdev;
+ struct port *port;
+ u16 rows, cols;
+
++ vdev = portdev->vdev;
+ virtio_cread(vdev, struct virtio_console_config, cols, &cols);
+ virtio_cread(vdev, struct virtio_console_config, rows, &rows);
+
+@@ -2024,6 +2036,7 @@ static int virtcons_probe(struct virtio_
+ spin_lock_init(&portdev->ports_lock);
+ INIT_LIST_HEAD(&portdev->ports);
+
++ INIT_WORK(&portdev->config_work, &config_work_handler);
+ INIT_WORK(&portdev->control_work, &control_work_handler);
+
+ if (multiport) {
+@@ -2098,6 +2111,8 @@ static void virtcons_remove(struct virti
+ /* Finish up work that's lined up */
+ if (use_multiport(portdev))
+ cancel_work_sync(&portdev->control_work);
++ else
++ cancel_work_sync(&portdev->config_work);
+
+ list_for_each_entry_safe(port, port2, &portdev->ports, list)
+ unplug_port(port);
+@@ -2149,6 +2164,7 @@ static int virtcons_freeze(struct virtio
+
+ virtqueue_disable_cb(portdev->c_ivq);
+ cancel_work_sync(&portdev->control_work);
++ cancel_work_sync(&portdev->config_work);
+ /*
+ * Once more: if control_work_handler() was running, it would
+ * enable the cb as the last step.
--- /dev/null
+From 4f6e24ed9de8634d6471ef86b382cba6d4e57ca8 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Thu, 5 Mar 2015 10:45:30 +1030
+Subject: virtio_console: init work unconditionally
+
+From: "Michael S. Tsirkin" <mst@redhat.com>
+
+commit 4f6e24ed9de8634d6471ef86b382cba6d4e57ca8 upstream.
+
+when multiport is off, we don't initialize config work,
+but we then cancel uninitialized control_work on freeze.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/virtio_console.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -2024,12 +2024,13 @@ static int virtcons_probe(struct virtio_
+ spin_lock_init(&portdev->ports_lock);
+ INIT_LIST_HEAD(&portdev->ports);
+
++ INIT_WORK(&portdev->control_work, &control_work_handler);
++
+ if (multiport) {
+ unsigned int nr_added_bufs;
+
+ spin_lock_init(&portdev->c_ivq_lock);
+ spin_lock_init(&portdev->c_ovq_lock);
+- INIT_WORK(&portdev->control_work, &control_work_handler);
+
+ nr_added_bufs = fill_queue(portdev->c_ivq,
+ &portdev->c_ivq_lock);
projects / thirdparty / kernel / stable-queue.git / commitdiff
