--- /dev/null
+From fc27fe7e8deef2f37cba3f2be2d52b6ca5eb9d57 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 12 Sep 2017 12:41:20 +0200
+Subject: ALSA: seq: Cancel pending autoload work at unbinding device
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit fc27fe7e8deef2f37cba3f2be2d52b6ca5eb9d57 upstream.
+
+ALSA sequencer core has a mechanism to load the enumerated devices
+automatically, and it's performed in an off-load work. This seems
+causing some race when a sequencer is removed while the pending
+autoload work is running. As syzkaller spotted, it may lead to some
+use-after-free:
+ BUG: KASAN: use-after-free in snd_rawmidi_dev_seq_free+0x69/0x70
+ sound/core/rawmidi.c:1617
+ Write of size 8 at addr ffff88006c611d90 by task kworker/2:1/567
+
+ CPU: 2 PID: 567 Comm: kworker/2:1 Not tainted 4.13.0+ #29
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
+ Workqueue: events autoload_drivers
+ Call Trace:
+ __dump_stack lib/dump_stack.c:16 [inline]
+ dump_stack+0x192/0x22c lib/dump_stack.c:52
+ print_address_description+0x78/0x280 mm/kasan/report.c:252
+ kasan_report_error mm/kasan/report.c:351 [inline]
+ kasan_report+0x230/0x340 mm/kasan/report.c:409
+ __asan_report_store8_noabort+0x1c/0x20 mm/kasan/report.c:435
+ snd_rawmidi_dev_seq_free+0x69/0x70 sound/core/rawmidi.c:1617
+ snd_seq_dev_release+0x4f/0x70 sound/core/seq_device.c:192
+ device_release+0x13f/0x210 drivers/base/core.c:814
+ kobject_cleanup lib/kobject.c:648 [inline]
+ kobject_release lib/kobject.c:677 [inline]
+ kref_put include/linux/kref.h:70 [inline]
+ kobject_put+0x145/0x240 lib/kobject.c:694
+ put_device+0x25/0x30 drivers/base/core.c:1799
+ klist_devices_put+0x36/0x40 drivers/base/bus.c:827
+ klist_next+0x264/0x4a0 lib/klist.c:403
+ next_device drivers/base/bus.c:270 [inline]
+ bus_for_each_dev+0x17e/0x210 drivers/base/bus.c:312
+ autoload_drivers+0x3b/0x50 sound/core/seq_device.c:117
+ process_one_work+0x9fb/0x1570 kernel/workqueue.c:2097
+ worker_thread+0x1e4/0x1350 kernel/workqueue.c:2231
+ kthread+0x324/0x3f0 kernel/kthread.c:231
+ ret_from_fork+0x25/0x30 arch/x86/entry/entry_64.S:425
+
+The fix is simply to assure canceling the autoload work at removing
+the device.
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/seq_device.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/core/seq_device.c
++++ b/sound/core/seq_device.c
+@@ -148,8 +148,10 @@ void snd_seq_device_load_drivers(void)
+ flush_work(&autoload_work);
+ }
+ EXPORT_SYMBOL(snd_seq_device_load_drivers);
++#define cancel_autoload_drivers() cancel_work_sync(&autoload_work)
+ #else
+ #define queue_autoload_drivers() /* NOP */
++#define cancel_autoload_drivers() /* NOP */
+ #endif
+
+ /*
+@@ -159,6 +161,7 @@ static int snd_seq_device_dev_free(struc
+ {
+ struct snd_seq_device *dev = device->device_data;
+
++ cancel_autoload_drivers();
+ put_device(&dev->dev);
+ return 0;
+ }
--- /dev/null
+From a8394090a9129b40f9d90dcb7f4a49d60c727ca6 Mon Sep 17 00:00:00 2001
+From: Tang Junhui <tang.junhui@zte.com.cn>
+Date: Wed, 6 Sep 2017 14:25:56 +0800
+Subject: bcache: correct cache_dirty_target in __update_writeback_rate()
+
+From: Tang Junhui <tang.junhui@zte.com.cn>
+
+commit a8394090a9129b40f9d90dcb7f4a49d60c727ca6 upstream.
+
+__update_write_rate() uses a Proportion-Differentiation Controller
+algorithm to control writeback rate. A dirty target number is used in
+this PD controller to control writeback rate. A larger target number
+will make the writeback rate smaller, on the versus, a smaller target
+number will make the writeback rate larger.
+
+bcache uses the following steps to calculate the target number,
+1) cache_sectors = all-buckets-of-cache-set * buckets-size
+2) cache_dirty_target = cache_sectors * cached-device-writeback_percent
+3) target = cache_dirty_target *
+(sectors-of-cached-device/sectors-of-all-cached-devices-of-this-cache-set)
+
+The calculation at step 1) for cache_sectors is incorrect, which does
+not consider dirty blocks occupied by flash only volume.
+
+A flash only volume can be took as a bcache device without cached
+device. All data sectors allocated for it are persistent on cache device
+and marked dirty, they are not touched by bcache writeback and garbage
+collection code. So data blocks of flash only volume should be ignore
+when calculating cache_sectors of cache set.
+
+Current code does not subtract dirty sectors of flash only volume, which
+results a larger target number from the above 3 steps. And in sequence
+the cache device's writeback rate is smaller then a correct value,
+writeback speed is slower on all cached devices.
+
+This patch fixes the incorrect slower writeback rate by subtracting
+dirty sectors of flash only volumes in __update_writeback_rate().
+
+(Commit log composed by Coly Li to pass checkpatch.pl checking)
+
+Signed-off-by: Tang Junhui <tang.junhui@zte.com.cn>
+Reviewed-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/writeback.c | 3 ++-
+ drivers/md/bcache/writeback.h | 19 +++++++++++++++++++
+ 2 files changed, 21 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -21,7 +21,8 @@
+ static void __update_writeback_rate(struct cached_dev *dc)
+ {
+ struct cache_set *c = dc->disk.c;
+- uint64_t cache_sectors = c->nbuckets * c->sb.bucket_size;
++ uint64_t cache_sectors = c->nbuckets * c->sb.bucket_size -
++ bcache_flash_devs_sectors_dirty(c);
+ uint64_t cache_dirty_target =
+ div_u64(cache_sectors * dc->writeback_percent, 100);
+
+--- a/drivers/md/bcache/writeback.h
++++ b/drivers/md/bcache/writeback.h
+@@ -14,6 +14,25 @@ static inline uint64_t bcache_dev_sector
+ return ret;
+ }
+
++static inline uint64_t bcache_flash_devs_sectors_dirty(struct cache_set *c)
++{
++ uint64_t i, ret = 0;
++
++ mutex_lock(&bch_register_lock);
++
++ for (i = 0; i < c->nr_uuids; i++) {
++ struct bcache_device *d = c->devices[i];
++
++ if (!d || !UUID_FLASH_ONLY(&c->uuids[i]))
++ continue;
++ ret += bcache_dev_sectors_dirty(d);
++ }
++
++ mutex_unlock(&bch_register_lock);
++
++ return ret;
++}
++
+ static inline unsigned offset_to_stripe(struct bcache_device *d,
+ uint64_t offset)
+ {
--- /dev/null
+From 77fa100f27475d08a569b9d51c17722130f089e7 Mon Sep 17 00:00:00 2001
+From: Tony Asleson <tasleson@redhat.com>
+Date: Wed, 6 Sep 2017 14:25:57 +0800
+Subject: bcache: Correct return value for sysfs attach errors
+
+From: Tony Asleson <tasleson@redhat.com>
+
+commit 77fa100f27475d08a569b9d51c17722130f089e7 upstream.
+
+If you encounter any errors in bch_cached_dev_attach it will return
+a negative error code. The variable 'v' which stores the result is
+unsigned, thus user space sees a very large value returned for bytes
+written which can cause incorrect user space behavior. Utilize 1
+signed variable to use throughout the function to preserve error return
+capability.
+
+Signed-off-by: Tony Asleson <tasleson@redhat.com>
+Acked-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/sysfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -192,7 +192,7 @@ STORE(__cached_dev)
+ {
+ struct cached_dev *dc = container_of(kobj, struct cached_dev,
+ disk.kobj);
+- unsigned v = size;
++ ssize_t v = size;
+ struct cache_set *c;
+ struct kobj_uevent_env *env;
+
+@@ -227,7 +227,7 @@ STORE(__cached_dev)
+ bch_cached_dev_run(dc);
+
+ if (attr == &sysfs_cache_mode) {
+- ssize_t v = bch_read_string_list(buf, bch_cache_modes + 1);
++ v = bch_read_string_list(buf, bch_cache_modes + 1);
+
+ if (v < 0)
+ return v;
--- /dev/null
+From 69daf03adef5f7bc13e0ac86b4b8007df1767aab Mon Sep 17 00:00:00 2001
+From: Tang Junhui <tang.junhui@zte.com.cn>
+Date: Wed, 6 Sep 2017 14:25:53 +0800
+Subject: bcache: do not subtract sectors_to_gc for bypassed IO
+
+From: Tang Junhui <tang.junhui@zte.com.cn>
+
+commit 69daf03adef5f7bc13e0ac86b4b8007df1767aab upstream.
+
+Since bypassed IOs use no bucket, so do not subtract sectors_to_gc to
+trigger gc thread.
+
+Signed-off-by: tang.junhui <tang.junhui@zte.com.cn>
+Acked-by: Coly Li <colyli@suse.de>
+Reviewed-by: Eric Wheeler <bcache@linux.ewheeler.net>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/request.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -196,12 +196,12 @@ static void bch_data_insert_start(struct
+ struct data_insert_op *op = container_of(cl, struct data_insert_op, cl);
+ struct bio *bio = op->bio, *n;
+
+- if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0)
+- wake_up_gc(op->c);
+-
+ if (op->bypass)
+ return bch_data_invalidate(cl);
+
++ if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0)
++ wake_up_gc(op->c);
++
+ /*
+ * Journal writes are marked REQ_PREFLUSH; if the original write was a
+ * flush, it'll wait on the journal write.
--- /dev/null
+From 9276717b9e297a62d1151a43d1cd286213f68eb7 Mon Sep 17 00:00:00 2001
+From: Michael Lyle <mlyle@lyle.org>
+Date: Wed, 6 Sep 2017 14:26:02 +0800
+Subject: bcache: fix bch_hprint crash and improve output
+
+From: Michael Lyle <mlyle@lyle.org>
+
+commit 9276717b9e297a62d1151a43d1cd286213f68eb7 upstream.
+
+Most importantly, solve a crash where %llu was used to format signed
+numbers. This would cause a buffer overflow when reading sysfs
+writeback_rate_debug, as only 20 bytes were allocated for this and
+%llu writes 20 characters plus a null.
+
+Always use the units mechanism rather than having different output
+paths for simplicity.
+
+Also, correct problems with display output where 1.10 was a larger
+number than 1.09, by multiplying by 10 and then dividing by 1024 instead
+of dividing by 100. (Remainders of >= 1000 would print as .10).
+
+Minor changes: Always display the decimal point instead of trying to
+omit it based on number of digits shown. Decide what units to use
+based on 1000 as a threshold, not 1024 (in other words, always print
+at most 3 digits before the decimal point).
+
+Signed-off-by: Michael Lyle <mlyle@lyle.org>
+Reported-by: Dmitry Yu Okunev <dyokunev@ut.mephi.ru>
+Acked-by: Kent Overstreet <kent.overstreet@gmail.com>
+Reviewed-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/util.c | 46 +++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 33 insertions(+), 13 deletions(-)
+
+--- a/drivers/md/bcache/util.c
++++ b/drivers/md/bcache/util.c
+@@ -74,24 +74,44 @@ STRTO_H(strtouint, unsigned int)
+ STRTO_H(strtoll, long long)
+ STRTO_H(strtoull, unsigned long long)
+
++/**
++ * bch_hprint() - formats @v to human readable string for sysfs.
++ *
++ * @v - signed 64 bit integer
++ * @buf - the (at least 8 byte) buffer to format the result into.
++ *
++ * Returns the number of bytes used by format.
++ */
+ ssize_t bch_hprint(char *buf, int64_t v)
+ {
+ static const char units[] = "?kMGTPEZY";
+- char dec[4] = "";
+- int u, t = 0;
++ int u = 0, t;
+
+- for (u = 0; v >= 1024 || v <= -1024; u++) {
+- t = v & ~(~0 << 10);
+- v >>= 10;
+- }
++ uint64_t q;
+
+- if (!u)
+- return sprintf(buf, "%llu", v);
+-
+- if (v < 100 && v > -100)
+- snprintf(dec, sizeof(dec), ".%i", t / 100);
+-
+- return sprintf(buf, "%lli%s%c", v, dec, units[u]);
++ if (v < 0)
++ q = -v;
++ else
++ q = v;
++
++ /* For as long as the number is more than 3 digits, but at least
++ * once, shift right / divide by 1024. Keep the remainder for
++ * a digit after the decimal point.
++ */
++ do {
++ u++;
++
++ t = q & ~(~0 << 10);
++ q >>= 10;
++ } while (q >= 1000);
++
++ if (v < 0)
++ /* '-', up to 3 digits, '.', 1 digit, 1 character, null;
++ * yields 8 bytes.
++ */
++ return sprintf(buf, "-%llu.%i%c", q, t * 10 / 1024, units[u]);
++ else
++ return sprintf(buf, "%llu.%i%c", q, t * 10 / 1024, units[u]);
+ }
+
+ ssize_t bch_snprint_string_list(char *buf, size_t size, const char * const list[],
--- /dev/null
+From 9baf30972b5568d8b5bc8b3c46a6ec5b58100463 Mon Sep 17 00:00:00 2001
+From: Tang Junhui <tang.junhui@zte.com.cn>
+Date: Wed, 6 Sep 2017 14:25:59 +0800
+Subject: bcache: fix for gc and write-back race
+
+From: Tang Junhui <tang.junhui@zte.com.cn>
+
+commit 9baf30972b5568d8b5bc8b3c46a6ec5b58100463 upstream.
+
+gc and write-back get raced (see the email "bcache get stucked" I sended
+before):
+gc thread write-back thread
+| |bch_writeback_thread()
+|bch_gc_thread() |
+| |==>read_dirty()
+|==>bch_btree_gc() |
+|==>btree_root() //get btree root |
+| //node write locker |
+|==>bch_btree_gc_root() |
+| |==>read_dirty_submit()
+| |==>write_dirty()
+| |==>continue_at(cl,
+| | write_dirty_finish,
+| | system_wq);
+| |==>write_dirty_finish()//excute
+| | //in system_wq
+| |==>bch_btree_insert()
+| |==>bch_btree_map_leaf_nodes()
+| |==>__bch_btree_map_nodes()
+| |==>btree_root //try to get btree
+| | //root node read
+| | //lock
+| |-----stuck here
+|==>bch_btree_set_root()
+|==>bch_journal_meta()
+|==>bch_journal()
+|==>journal_try_write()
+|==>journal_write_unlocked() //journal_full(&c->journal)
+| //condition satisfied
+|==>continue_at(cl, journal_write, system_wq); //try to excute
+| //journal_write in system_wq
+| //but work queue is excuting
+| //write_dirty_finish()
+|==>closure_sync(); //wait journal_write execute
+| //over and wake up gc,
+|-------------stuck here
+|==>release root node write locker
+
+This patch alloc a separate work-queue for write-back thread to avoid such
+race.
+
+(Commit log re-organized by Coly Li to pass checkpatch.pl checking)
+
+Signed-off-by: Tang Junhui <tang.junhui@zte.com.cn>
+Acked-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/bcache.h | 1 +
+ drivers/md/bcache/super.c | 2 ++
+ drivers/md/bcache/writeback.c | 9 +++++++--
+ 3 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -333,6 +333,7 @@ struct cached_dev {
+ /* Limit number of writeback bios in flight */
+ struct semaphore in_flight;
+ struct task_struct *writeback_thread;
++ struct workqueue_struct *writeback_write_wq;
+
+ struct keybuf writeback_keys;
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1059,6 +1059,8 @@ static void cached_dev_free(struct closu
+ cancel_delayed_work_sync(&dc->writeback_rate_update);
+ if (!IS_ERR_OR_NULL(dc->writeback_thread))
+ kthread_stop(dc->writeback_thread);
++ if (dc->writeback_write_wq)
++ destroy_workqueue(dc->writeback_write_wq);
+
+ mutex_lock(&bch_register_lock);
+
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -187,7 +187,7 @@ static void write_dirty(struct closure *
+
+ closure_bio_submit(&io->bio, cl);
+
+- continue_at(cl, write_dirty_finish, system_wq);
++ continue_at(cl, write_dirty_finish, io->dc->writeback_write_wq);
+ }
+
+ static void read_dirty_endio(struct bio *bio)
+@@ -207,7 +207,7 @@ static void read_dirty_submit(struct clo
+
+ closure_bio_submit(&io->bio, cl);
+
+- continue_at(cl, write_dirty, system_wq);
++ continue_at(cl, write_dirty, io->dc->writeback_write_wq);
+ }
+
+ static void read_dirty(struct cached_dev *dc)
+@@ -517,6 +517,11 @@ void bch_cached_dev_writeback_init(struc
+
+ int bch_cached_dev_writeback_start(struct cached_dev *dc)
+ {
++ dc->writeback_write_wq = alloc_workqueue("bcache_writeback_wq",
++ WQ_MEM_RECLAIM, 0);
++ if (!dc->writeback_write_wq)
++ return -ENOMEM;
++
+ dc->writeback_thread = kthread_create(bch_writeback_thread, dc,
+ "bcache_writeback");
+ if (IS_ERR(dc->writeback_thread))
--- /dev/null
+From 4b758df21ee7081ab41448d21d60367efaa625b3 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 6 Sep 2017 14:25:51 +0800
+Subject: bcache: Fix leak of bdev reference
+
+From: Jan Kara <jack@suse.cz>
+
+commit 4b758df21ee7081ab41448d21d60367efaa625b3 upstream.
+
+If blkdev_get_by_path() in register_bcache() fails, we try to lookup the
+block device using lookup_bdev() to detect which situation we are in to
+properly report error. However we never drop the reference returned to
+us from lookup_bdev(). Fix that.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Acked-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/super.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1965,6 +1965,8 @@ static ssize_t register_bcache(struct ko
+ else
+ err = "device busy";
+ mutex_unlock(&bch_register_lock);
++ if (!IS_ERR(bdev))
++ bdput(bdev);
+ if (attr == &ksysfs_register_quiet)
+ goto out;
+ }
--- /dev/null
+From c81ffa32a214c84b08900fbc9d432187bd948eba Mon Sep 17 00:00:00 2001
+From: Tang Junhui <tang.junhui@zte.com.cn>
+Date: Wed, 6 Sep 2017 14:25:52 +0800
+Subject: bcache: fix sequential large write IO bypass
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tang Junhui <tang.junhui@zte.com.cn>
+
+commit c81ffa32a214c84b08900fbc9d432187bd948eba upstream.
+
+Sequential write IOs were tested with bs=1M by FIO in writeback cache
+mode, these IOs were expected to be bypassed, but actually they did not.
+We debug the code, and find in check_should_bypass():
+ if (!congested &&
+ mode == CACHE_MODE_WRITEBACK &&
+ op_is_write(bio_op(bio)) &&
+ (bio-＞bi_opf & REQ_SYNC))
+ goto rescale
+that means, If in writeback mode, a write IO with REQ_SYNC flag will not
+be bypassed though it is a sequential large IO, It's not a correct thing
+to do actually, so this patch remove these codes.
+
+Signed-off-by: tang.junhui <tang.junhui@zte.com.cn>
+Reviewed-by: Kent Overstreet <kent.overstreet@gmail.com>
+Reviewed-by: Eric Wheeler <bcache@linux.ewheeler.net>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/request.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -400,12 +400,6 @@ static bool check_should_bypass(struct c
+ if (!congested && !dc->sequential_cutoff)
+ goto rescale;
+
+- if (!congested &&
+- mode == CACHE_MODE_WRITEBACK &&
+- op_is_write(bio->bi_opf) &&
+- op_is_sync(bio->bi_opf))
+- goto rescale;
+-
+ spin_lock(&dc->io_lock);
+
+ hlist_for_each_entry(i, iohash(dc, bio->bi_iter.bi_sector), hash)
--- /dev/null
+From 175206cf9ab63161dec74d9cd7f9992e062491f5 Mon Sep 17 00:00:00 2001
+From: Tang Junhui <tang.junhui@zte.com.cn>
+Date: Thu, 7 Sep 2017 01:28:53 +0800
+Subject: bcache: initialize dirty stripes in flash_dev_run()
+
+From: Tang Junhui <tang.junhui@zte.com.cn>
+
+commit 175206cf9ab63161dec74d9cd7f9992e062491f5 upstream.
+
+bcache uses a Proportion-Differentiation Controller algorithm to control
+writeback rate to cached devices. In the PD controller algorithm, dirty
+stripes of thin flash device should not be counted in, because flash only
+volumes never write back dirty data.
+
+Currently dirty stripe counter for thin flash device is not initialized
+when the thin flash device starts. Which means the following calculation
+in PD controller will reference an undefined dirty stripes number, and
+all cached devices attached to the same cache set where the thin flash
+device lies on may have an inaccurate writeback rate.
+
+This patch calles bch_sectors_dirty_init() in flash_dev_run(), to
+correctly initialize dirty stripe counter when the thin flash device
+starts to run. This patch also does following parameter data type change,
+ -void bch_sectors_dirty_init(struct cached_dev *dc);
+ +void bch_sectors_dirty_init(struct bcache_device *);
+to call this function conveniently in flash_dev_run().
+
+(Commit log is composed by Coly Li)
+
+Signed-off-by: Tang Junhui <tang.junhui@zte.com.cn>
+Reviewed-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/super.c | 3 ++-
+ drivers/md/bcache/writeback.c | 8 ++++----
+ drivers/md/bcache/writeback.h | 2 +-
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1026,7 +1026,7 @@ int bch_cached_dev_attach(struct cached_
+ }
+
+ if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) {
+- bch_sectors_dirty_init(dc);
++ bch_sectors_dirty_init(&dc->disk);
+ atomic_set(&dc->has_dirty, 1);
+ atomic_inc(&dc->count);
+ bch_writeback_queue(dc);
+@@ -1228,6 +1228,7 @@ static int flash_dev_run(struct cache_se
+ goto err;
+
+ bcache_device_attach(d, c, u - c->uuids);
++ bch_sectors_dirty_init(d);
+ bch_flash_dev_request_init(d);
+ add_disk(d->disk);
+
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -482,17 +482,17 @@ static int sectors_dirty_init_fn(struct
+ return MAP_CONTINUE;
+ }
+
+-void bch_sectors_dirty_init(struct cached_dev *dc)
++void bch_sectors_dirty_init(struct bcache_device *d)
+ {
+ struct sectors_dirty_init op;
+
+ bch_btree_op_init(&op.op, -1);
+- op.inode = dc->disk.id;
++ op.inode = d->id;
+
+- bch_btree_map_keys(&op.op, dc->disk.c, &KEY(op.inode, 0, 0),
++ bch_btree_map_keys(&op.op, d->c, &KEY(op.inode, 0, 0),
+ sectors_dirty_init_fn, 0);
+
+- dc->disk.sectors_dirty_last = bcache_dev_sectors_dirty(&dc->disk);
++ d->sectors_dirty_last = bcache_dev_sectors_dirty(d);
+ }
+
+ void bch_cached_dev_writeback_init(struct cached_dev *dc)
+--- a/drivers/md/bcache/writeback.h
++++ b/drivers/md/bcache/writeback.h
+@@ -84,7 +84,7 @@ static inline void bch_writeback_add(str
+
+ void bcache_dev_sectors_dirty_add(struct cache_set *, unsigned, uint64_t, int);
+
+-void bch_sectors_dirty_init(struct cached_dev *dc);
++void bch_sectors_dirty_init(struct bcache_device *);
+ void bch_cached_dev_writeback_init(struct cached_dev *);
+ int bch_cached_dev_writeback_start(struct cached_dev *);
+
--- /dev/null
+From 281ddc3cdc10413b98531d701ab5323c4f3ff1f4 Mon Sep 17 00:00:00 2001
+From: Ulrich Hecht <ulrich.hecht+renesas@gmail.com>
+Date: Mon, 3 Jul 2017 04:43:33 -0400
+Subject: media: adv7180: add missing adv7180cp, adv7180st i2c device IDs
+
+From: Ulrich Hecht <ulrich.hecht+renesas@gmail.com>
+
+commit 281ddc3cdc10413b98531d701ab5323c4f3ff1f4 upstream.
+
+Fixes a crash on Renesas R8A7793 Gose board that uses these "compatible"
+entries.
+
+Signed-off-by: Ulrich Hecht <ulrich.hecht+renesas@gmail.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/adv7180.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -1402,6 +1402,8 @@ static int adv7180_remove(struct i2c_cli
+
+ static const struct i2c_device_id adv7180_id[] = {
+ { "adv7180", (kernel_ulong_t)&adv7180_info },
++ { "adv7180cp", (kernel_ulong_t)&adv7180_info },
++ { "adv7180st", (kernel_ulong_t)&adv7180_info },
+ { "adv7182", (kernel_ulong_t)&adv7182_info },
+ { "adv7280", (kernel_ulong_t)&adv7280_info },
+ { "adv7280-m", (kernel_ulong_t)&adv7280_m_info },
--- /dev/null
+From a607f51e5a4c421e2097077db88105402099c528 Mon Sep 17 00:00:00 2001
+From: Sean Young <sean@mess.org>
+Date: Fri, 4 Aug 2017 10:12:03 -0400
+Subject: media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls"
+
+From: Sean Young <sean@mess.org>
+
+commit a607f51e5a4c421e2097077db88105402099c528 upstream.
+
+This reverts commit 5be2b76a9ca4ea5fd3e221114d62eeb0d78267ca.
+
+Only when the lirc device is freed, should we drop our reference to
+rc_dev, else we the rc_dev is freed to early. If userspace has
+a file descriptor open during unplug, it goes bang.
+
+==================================================================
+BUG: KASAN: use-after-free in __lock_acquire+0x7bb/0x1e10
+Read of size 8 at addr ffff8801d7d61ed0 by task ir-rec/2609
+
+-snip-
+ mutex_lock_nested+0x1b/0x20
+ ? mutex_lock_nested+0x1b/0x20
+ rc_close.part.6+0x20/0x60 [rc_core]
+ rc_close+0x13/0x20 [rc_core]
+ lirc_dev_fop_close+0x62/0xd0 [lirc_dev]
+ __fput+0x236/0x410
+ ? fput+0xb0/0xb0
+ ? do_raw_spin_trylock+0x110/0x110
+ ? set_rq_offline.part.70+0xa0/0xa0
+ ____fput+0xe/0x10
+ task_work_run+0x116/0x180
+ ? task_work_cancel+0x170/0x170
+ ? _raw_spin_unlock+0x27/0x40
+ ? switch_task_namespaces+0x5f/0x90
+ do_exit+0x68b/0xe80
+
+Fixes: 5be2b76a9ca4 ("[media] lirc_dev: remove superfluous get/put_device() calls")
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/lirc_dev.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/rc/lirc_dev.c
++++ b/drivers/media/rc/lirc_dev.c
+@@ -59,6 +59,8 @@ static void lirc_release(struct device *
+ {
+ struct irctl *ir = container_of(ld, struct irctl, dev);
+
++ put_device(ir->dev.parent);
++
+ if (ir->buf_internal) {
+ lirc_buffer_free(ir->buf);
+ kfree(ir->buf);
+@@ -218,6 +220,8 @@ int lirc_register_driver(struct lirc_dri
+
+ mutex_unlock(&lirc_dev_lock);
+
++ get_device(ir->dev.parent);
++
+ dev_info(ir->d.dev, "lirc_dev: driver %s registered at minor = %d\n",
+ ir->d.name, ir->d.minor);
+
--- /dev/null
+From 7e09f7d5c790278ab98e5f2c22307ebe8ad6e8ba Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 8 Aug 2017 08:56:21 -0400
+Subject: media: uvcvideo: Prevent heap overflow when accessing mapped controls
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 7e09f7d5c790278ab98e5f2c22307ebe8ad6e8ba upstream.
+
+The size of uvc_control_mapping is user controlled leading to a
+potential heap overflow in the uvc driver. This adds a check to verify
+the user provided size fits within the bounds of the defined buffer
+size.
+
+Originally-from: Richard Simmons <rssimmo@amazon.com>
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/uvc/uvc_ctrl.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -2002,6 +2002,13 @@ int uvc_ctrl_add_mapping(struct uvc_vide
+ goto done;
+ }
+
++ /* Validate the user-provided bit-size and offset */
++ if (mapping->size > 32 ||
++ mapping->offset + mapping->size > ctrl->info.size * 8) {
++ ret = -EINVAL;
++ goto done;
++ }
++
+ list_for_each_entry(map, &ctrl->info.mappings, list) {
+ if (mapping->id == map->id) {
+ uvc_trace(UVC_TRACE_CONTROL, "Can't add mapping '%s', "
--- /dev/null
+From 9c7ba1d7634cef490b85bc64c4091ff004821bfd Mon Sep 17 00:00:00 2001
+From: Daniel Mentz <danielmentz@google.com>
+Date: Wed, 2 Aug 2017 23:42:17 -0400
+Subject: media: v4l2-compat-ioctl32: Fix timespec conversion
+
+From: Daniel Mentz <danielmentz@google.com>
+
+commit 9c7ba1d7634cef490b85bc64c4091ff004821bfd upstream.
+
+Certain syscalls like recvmmsg support 64 bit timespec values for the
+X32 ABI. The helper function compat_put_timespec converts a timespec
+value to a 32 bit or 64 bit value depending on what ABI is used. The
+v4l2 compat layer, however, is not designed to support 64 bit timespec
+values and always uses 32 bit values. Hence, compat_put_timespec must
+not be used.
+
+Without this patch, user space will be provided with bad timestamp
+values from the VIDIOC_DQEVENT ioctl. Also, fields of the struct
+v4l2_event32 that come immediately after timestamp get overwritten,
+namely the field named id.
+
+Fixes: 81993e81a994 ("compat: Get rid of (get|put)_compat_time(val|spec)")
+Cc: H. Peter Anvin <hpa@linux.intel.com>
+Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Cc: Tiffany Lin <tiffany.lin@mediatek.com>
+Cc: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Cc: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Daniel Mentz <danielmentz@google.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+@@ -796,7 +796,8 @@ static int put_v4l2_event32(struct v4l2_
+ copy_to_user(&up->u, &kp->u, sizeof(kp->u)) ||
+ put_user(kp->pending, &up->pending) ||
+ put_user(kp->sequence, &up->sequence) ||
+- compat_put_timespec(&kp->timestamp, &up->timestamp) ||
++ put_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) ||
++ put_user(kp->timestamp.tv_nsec, &up->timestamp.tv_nsec) ||
+ put_user(kp->id, &up->id) ||
+ copy_to_user(up->reserved, kp->reserved, 8 * sizeof(__u32)))
+ return -EFAULT;
--- /dev/null
+From 0de0ef6c3f2dd7e9965270683445917e10384ab0 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Fri, 18 Aug 2017 12:07:19 -0400
+Subject: media: venus: fix copy/paste error in return_buf_error
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+commit 0de0ef6c3f2dd7e9965270683445917e10384ab0 upstream.
+
+Call function v4l2_m2m_dst_buf_remove_by_buf() instead of
+v4l2_m2m_src_buf_remove_by_buf()
+
+Addresses-Coverity-ID: 1415317
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Acked-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Hans Verkuil <hansverk@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/qcom/venus/helpers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/qcom/venus/helpers.c
++++ b/drivers/media/platform/qcom/venus/helpers.c
+@@ -243,7 +243,7 @@ static void return_buf_error(struct venu
+ if (vbuf->vb2_buf.type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
+ v4l2_m2m_src_buf_remove_by_buf(m2m_ctx, vbuf);
+ else
+- v4l2_m2m_src_buf_remove_by_buf(m2m_ctx, vbuf);
++ v4l2_m2m_dst_buf_remove_by_buf(m2m_ctx, vbuf);
+
+ v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR);
+ }
--- /dev/null
+From 9e14de1077e9c34f141cf98bdba60cdd5193d962 Mon Sep 17 00:00:00 2001
+From: Chanwoo Choi <cw00.choi@samsung.com>
+Date: Thu, 24 Aug 2017 10:42:48 +0900
+Subject: PM / devfreq: Fix memory leak when fail to register device
+
+From: Chanwoo Choi <cw00.choi@samsung.com>
+
+commit 9e14de1077e9c34f141cf98bdba60cdd5193d962 upstream.
+
+When the devfreq_add_device fails to register deivce, the memory
+leak of devfreq instance happen. So, this patch fix the memory
+leak issue. Before freeing the devfreq instance checks whether
+devfreq instance is NULL or not because the device_unregister()
+frees the devfreq instance when jumping to the 'err_init'.
+It is to prevent the duplicate the kfee(devfreq).
+
+Fixes: ac4b281176a5 ("PM / devfreq: fix duplicated kfree on devfreq pointer")
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/devfreq/devfreq.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -564,7 +564,7 @@ struct devfreq *devfreq_add_device(struc
+ err = device_register(&devfreq->dev);
+ if (err) {
+ mutex_unlock(&devfreq->lock);
+- goto err_out;
++ goto err_dev;
+ }
+
+ devfreq->trans_table = devm_kzalloc(&devfreq->dev,
+@@ -610,6 +610,9 @@ err_init:
+ mutex_unlock(&devfreq_list_lock);
+
+ device_unregister(&devfreq->dev);
++err_dev:
++ if (devfreq)
++ kfree(devfreq);
+ err_out:
+ return ERR_PTR(err);
+ }
--- /dev/null
+From 50e76632339d4655859523a39249dd95ee5e93e7 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 7 Sep 2017 11:13:38 +0200
+Subject: sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 50e76632339d4655859523a39249dd95ee5e93e7 upstream.
+
+Cpusets vs. suspend-resume is _completely_ broken. And it got noticed
+because it now resulted in non-cpuset usage breaking too.
+
+On suspend cpuset_cpu_inactive() doesn't call into
+cpuset_update_active_cpus() because it doesn't want to move tasks about,
+there is no need, all tasks are frozen and won't run again until after
+we've resumed everything.
+
+But this means that when we finally do call into
+cpuset_update_active_cpus() after resuming the last frozen cpu in
+cpuset_cpu_active(), the top_cpuset will not have any difference with
+the cpu_active_mask and this it will not in fact do _anything_.
+
+So the cpuset configuration will not be restored. This was largely
+hidden because we would unconditionally create identity domains and
+mobile users would not in fact use cpusets much. And servers what do use
+cpusets tend to not suspend-resume much.
+
+An addition problem is that we'd not in fact wait for the cpuset work to
+finish before resuming the tasks, allowing spurious migrations outside
+of the specified domains.
+
+Fix the rebuild by introducing cpuset_force_rebuild() and fix the
+ordering with cpuset_wait_for_hotplug().
+
+Reported-by: Andy Lutomirski <luto@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Mike Galbraith <efault@gmx.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Rafael J. Wysocki <rjw@rjwysocki.net>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: deb7aa308ea2 ("cpuset: reorganize CPU / memory hotplug handling")
+Link: http://lkml.kernel.org/r/20170907091338.orwxrqkbfkki3c24@hirez.programming.kicks-ass.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/cpuset.h | 6 ++++++
+ kernel/cgroup/cpuset.c | 16 +++++++++++++++-
+ kernel/power/process.c | 5 ++++-
+ kernel/sched/core.c | 7 +++----
+ 4 files changed, 28 insertions(+), 6 deletions(-)
+
+--- a/include/linux/cpuset.h
++++ b/include/linux/cpuset.h
+@@ -57,7 +57,9 @@ static inline void cpuset_dec(void)
+
+ extern int cpuset_init(void);
+ extern void cpuset_init_smp(void);
++extern void cpuset_force_rebuild(void);
+ extern void cpuset_update_active_cpus(void);
++extern void cpuset_wait_for_hotplug(void);
+ extern void cpuset_cpus_allowed(struct task_struct *p, struct cpumask *mask);
+ extern void cpuset_cpus_allowed_fallback(struct task_struct *p);
+ extern nodemask_t cpuset_mems_allowed(struct task_struct *p);
+@@ -170,11 +172,15 @@ static inline bool cpusets_enabled(void)
+ static inline int cpuset_init(void) { return 0; }
+ static inline void cpuset_init_smp(void) {}
+
++static inline void cpuset_force_rebuild(void) { }
++
+ static inline void cpuset_update_active_cpus(void)
+ {
+ partition_sched_domains(1, NULL, NULL);
+ }
+
++static inline void cpuset_wait_for_hotplug(void) { }
++
+ static inline void cpuset_cpus_allowed(struct task_struct *p,
+ struct cpumask *mask)
+ {
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -2260,6 +2260,13 @@ retry:
+ mutex_unlock(&cpuset_mutex);
+ }
+
++static bool force_rebuild;
++
++void cpuset_force_rebuild(void)
++{
++ force_rebuild = true;
++}
++
+ /**
+ * cpuset_hotplug_workfn - handle CPU/memory hotunplug for a cpuset
+ *
+@@ -2334,8 +2341,10 @@ static void cpuset_hotplug_workfn(struct
+ }
+
+ /* rebuild sched domains if cpus_allowed has changed */
+- if (cpus_updated)
++ if (cpus_updated || force_rebuild) {
++ force_rebuild = false;
+ rebuild_sched_domains();
++ }
+ }
+
+ void cpuset_update_active_cpus(void)
+@@ -2354,6 +2363,11 @@ void cpuset_update_active_cpus(void)
+ schedule_work(&cpuset_hotplug_work);
+ }
+
++void cpuset_wait_for_hotplug(void)
++{
++ flush_work(&cpuset_hotplug_work);
++}
++
+ /*
+ * Keep top_cpuset.mems_allowed tracking node_states[N_MEMORY].
+ * Call this routine anytime after node_states[N_MEMORY] changes.
+--- a/kernel/power/process.c
++++ b/kernel/power/process.c
+@@ -20,8 +20,9 @@
+ #include <linux/workqueue.h>
+ #include <linux/kmod.h>
+ #include <trace/events/power.h>
++#include <linux/cpuset.h>
+
+-/*
++/*
+ * Timeout for stopping processes
+ */
+ unsigned int __read_mostly freeze_timeout_msecs = 20 * MSEC_PER_SEC;
+@@ -202,6 +203,8 @@ void thaw_processes(void)
+ __usermodehelper_set_disable_depth(UMH_FREEZING);
+ thaw_workqueues();
+
++ cpuset_wait_for_hotplug();
++
+ read_lock(&tasklist_lock);
+ for_each_process_thread(g, p) {
+ /* No other threads should have PF_SUSPEND_TASK set */
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5538,16 +5538,15 @@ static void cpuset_cpu_active(void)
+ * operation in the resume sequence, just build a single sched
+ * domain, ignoring cpusets.
+ */
+- num_cpus_frozen--;
+- if (likely(num_cpus_frozen)) {
+- partition_sched_domains(1, NULL, NULL);
++ partition_sched_domains(1, NULL, NULL);
++ if (--num_cpus_frozen)
+ return;
+- }
+ /*
+ * This is the last CPU online operation. So fall through and
+ * restore the original sched domains by considering the
+ * cpuset configurations.
+ */
++ cpuset_force_rebuild();
+ }
+ cpuset_update_active_cpus();
+ }
net-netfilter-nf_conntrack_core-fix-net_conntrack_lock.patch
s390-mm-fix-local-tlb-flushing-vs.-detach-of-an-mm-address-space.patch
s390-mm-fix-race-on-mm-context.flush_mm.patch
+media-v4l2-compat-ioctl32-fix-timespec-conversion.patch
+media-revert-lirc_dev-remove-superfluous-get-put_device-calls.patch
+media-venus-fix-copy-paste-error-in-return_buf_error.patch
+media-uvcvideo-prevent-heap-overflow-when-accessing-mapped-controls.patch
+media-adv7180-add-missing-adv7180cp-adv7180st-i2c-device-ids.patch
+pm-devfreq-fix-memory-leak-when-fail-to-register-device.patch
+alsa-seq-cancel-pending-autoload-work-at-unbinding-device.patch
+bcache-initialize-dirty-stripes-in-flash_dev_run.patch
+bcache-fix-leak-of-bdev-reference.patch
+bcache-do-not-subtract-sectors_to_gc-for-bypassed-io.patch
+bcache-correct-cache_dirty_target-in-__update_writeback_rate.patch
+bcache-correct-return-value-for-sysfs-attach-errors.patch
+bcache-fix-sequential-large-write-io-bypass.patch
+bcache-fix-for-gc-and-write-back-race.patch
+bcache-fix-bch_hprint-crash-and-improve-output.patch
+sched-cpuset-pm-fix-cpuset-vs.-suspend-resume-bugs.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
