--- /dev/null
+From 80d680fdccba214e8106dc1aa33de5207ad75394 Mon Sep 17 00:00:00 2001
+From: Roger Quadros <rogerq@kernel.org>
+Date: Thu, 2 Sep 2021 12:58:28 +0300
+Subject: ARM: dts: omap3430-sdp: Fix NAND device node
+
+From: Roger Quadros <rogerq@kernel.org>
+
+commit 80d680fdccba214e8106dc1aa33de5207ad75394 upstream.
+
+Nand is on CS1 so reg properties first field should be 1 not 0.
+
+Fixes: 44e4716499b8 ("ARM: dts: omap3: Fix NAND device nodes")
+Cc: stable@vger.kernel.org # v4.6+
+Signed-off-by: Roger Quadros <rogerq@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/omap3430-sdp.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/omap3430-sdp.dts
++++ b/arch/arm/boot/dts/omap3430-sdp.dts
+@@ -104,7 +104,7 @@
+
+ nand@1,0 {
+ compatible = "ti,omap2-nand";
+- reg = <0 0 4>; /* CS0, offset 0, IO size 4 */
++ reg = <1 0 4>; /* CS1, offset 0, IO size 4 */
+ interrupt-parent = <&gpmc>;
+ interrupts = <0 IRQ_TYPE_NONE>, /* fifoevent */
+ <1 IRQ_TYPE_NONE>; /* termcount */
--- /dev/null
+From f5c03f131dae3f06d08464e6157dd461200f78d9 Mon Sep 17 00:00:00 2001
+From: David Heidelberg <david@ixit.cz>
+Date: Wed, 18 Aug 2021 08:53:17 +0200
+Subject: ARM: dts: qcom: apq8064: use compatible which contains chipid
+
+From: David Heidelberg <david@ixit.cz>
+
+commit f5c03f131dae3f06d08464e6157dd461200f78d9 upstream.
+
+Also resolves these kernel warnings for APQ8064:
+adreno 4300000.adreno-3xx: Using legacy qcom,chipid binding!
+adreno 4300000.adreno-3xx: Use compatible qcom,adreno-320.2 instead.
+
+Tested on Nexus 7 2013, no functional changes.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: David Heidelberg <david@ixit.cz>
+Link: https://lore.kernel.org/r/20210818065317.19822-1-david@ixit.cz
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/qcom-apq8064.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
+@@ -1182,7 +1182,7 @@
+ };
+
+ gpu: adreno-3xx@4300000 {
+- compatible = "qcom,adreno-3xx";
++ compatible = "qcom,adreno-320.2", "qcom,adreno";
+ reg = <0x04300000 0x20000>;
+ reg-names = "kgsl_3d0_reg_memory";
+ interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
+@@ -1197,7 +1197,6 @@
+ <&mmcc GFX3D_AHB_CLK>,
+ <&mmcc GFX3D_AXI_CLK>,
+ <&mmcc MMSS_IMEM_AHB_CLK>;
+- qcom,chipid = <0x03020002>;
+
+ iommus = <&gfx3d 0
+ &gfx3d 1
--- /dev/null
+From f2e717d655040d632c9015f19aa4275f8b16e7f2 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Thu, 30 Sep 2021 15:44:41 -0400
+Subject: nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit f2e717d655040d632c9015f19aa4275f8b16e7f2 upstream.
+
+RFC3530 notes that the 'dircount' field may be zero, in which case the
+recommendation is to ignore it, and only enforce the 'maxcount' field.
+In RFC5661, this recommendation to ignore a zero valued field becomes a
+requirement.
+
+Fixes: aee377644146 ("nfsd4: fix rd_dircount enforcement")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfsd/nfs4xdr.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -3124,15 +3124,18 @@ nfsd4_encode_dirent(void *ccdv, const ch
+ goto fail;
+ cd->rd_maxcount -= entry_bytes;
+ /*
+- * RFC 3530 14.2.24 describes rd_dircount as only a "hint", so
+- * let's always let through the first entry, at least:
++ * RFC 3530 14.2.24 describes rd_dircount as only a "hint", and
++ * notes that it could be zero. If it is zero, then the server
++ * should enforce only the rd_maxcount value.
+ */
+- if (!cd->rd_dircount)
+- goto fail;
+- name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8;
+- if (name_and_cookie > cd->rd_dircount && cd->cookie_offset)
+- goto fail;
+- cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie);
++ if (cd->rd_dircount) {
++ name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8;
++ if (name_and_cookie > cd->rd_dircount && cd->cookie_offset)
++ goto fail;
++ cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie);
++ if (!cd->rd_dircount)
++ cd->rd_maxcount = 0;
++ }
+
+ cd->cookie_offset = cookie_offset;
+ skip_entry:
--- /dev/null
+From a295aef603e109a47af355477326bd41151765b6 Mon Sep 17 00:00:00 2001
+From: Zheng Liang <zhengliang6@huawei.com>
+Date: Fri, 24 Sep 2021 09:16:27 +0800
+Subject: ovl: fix missing negative dentry check in ovl_rename()
+
+From: Zheng Liang <zhengliang6@huawei.com>
+
+commit a295aef603e109a47af355477326bd41151765b6 upstream.
+
+The following reproducer
+
+ mkdir lower upper work merge
+ touch lower/old
+ touch lower/new
+ mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge
+ rm merge/new
+ mv merge/old merge/new & unlink upper/new
+
+may result in this race:
+
+PROCESS A:
+ rename("merge/old", "merge/new");
+ overwrite=true,ovl_lower_positive(old)=true,
+ ovl_dentry_is_whiteout(new)=true -> flags |= RENAME_EXCHANGE
+
+PROCESS B:
+ unlink("upper/new");
+
+PROCESS A:
+ lookup newdentry in new_upperdir
+ call vfs_rename() with negative newdentry and RENAME_EXCHANGE
+
+Fix by adding the missing check for negative newdentry.
+
+Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
+Fixes: e9be9d5e76e3 ("overlay filesystem")
+Cc: <stable@vger.kernel.org> # v3.18
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/overlayfs/dir.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -1166,9 +1166,13 @@ static int ovl_rename(struct inode *oldd
+ goto out_dput;
+ }
+ } else {
+- if (!d_is_negative(newdentry) &&
+- (!new_opaque || !ovl_is_whiteout(newdentry)))
+- goto out_dput;
++ if (!d_is_negative(newdentry)) {
++ if (!new_opaque || !ovl_is_whiteout(newdentry))
++ goto out_dput;
++ } else {
++ if (flags & RENAME_EXCHANGE)
++ goto out_dput;
++ }
+ }
+
+ if (olddentry == trap)
usb-cdc-acm-fix-racy-tty-buffer-accesses.patch
usb-cdc-acm-fix-break-reporting.patch
xen-privcmd-fix-error-handling-in-mmap-resource-processing.patch
+ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch
+nfsd4-handle-the-nfsv4-readdir-dircount-hint-being-zero.patch
+xen-balloon-fix-cancelled-balloon-action.patch
+arm-dts-omap3430-sdp-fix-nand-device-node.patch
+arm-dts-qcom-apq8064-use-compatible-which-contains-chipid.patch
--- /dev/null
+From 319933a80fd4f07122466a77f93e5019d71be74c Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Tue, 5 Oct 2021 15:34:33 +0200
+Subject: xen/balloon: fix cancelled balloon action
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juergen Gross <jgross@suse.com>
+
+commit 319933a80fd4f07122466a77f93e5019d71be74c upstream.
+
+In case a ballooning action is cancelled the new kernel thread handling
+the ballooning might end up in a busy loop.
+
+Fix that by handling the cancelled action gracefully.
+
+While at it introduce a short wait for the BP_WAIT case.
+
+Cc: stable@vger.kernel.org
+Fixes: 8480ed9c2bbd56 ("xen/balloon: use a kernel thread instead a workqueue")
+Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Tested-by: Jason Andryuk <jandryuk@gmail.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Link: https://lore.kernel.org/r/20211005133433.32008-1-jgross@suse.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/balloon.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -508,12 +508,12 @@ static enum bp_state decrease_reservatio
+ }
+
+ /*
+- * Stop waiting if either state is not BP_EAGAIN and ballooning action is
+- * needed, or if the credit has changed while state is BP_EAGAIN.
++ * Stop waiting if either state is BP_DONE and ballooning action is
++ * needed, or if the credit has changed while state is not BP_DONE.
+ */
+ static bool balloon_thread_cond(enum bp_state state, long credit)
+ {
+- if (state != BP_EAGAIN)
++ if (state == BP_DONE)
+ credit = 0;
+
+ return current_credit() != credit || kthread_should_stop();
+@@ -533,10 +533,19 @@ static int balloon_thread(void *unused)
+
+ set_freezable();
+ for (;;) {
+- if (state == BP_EAGAIN)
+- timeout = balloon_stats.schedule_delay * HZ;
+- else
++ switch (state) {
++ case BP_DONE:
++ case BP_ECANCELED:
+ timeout = 3600 * HZ;
++ break;
++ case BP_EAGAIN:
++ timeout = balloon_stats.schedule_delay * HZ;
++ break;
++ case BP_WAIT:
++ timeout = HZ;
++ break;
++ }
++
+ credit = current_credit();
+
+ wait_event_freezable_timeout(balloon_thread_wq,
projects / thirdparty / kernel / stable-queue.git / commitdiff
