Home Home > GIT Browse > SLE12-SP5-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPetr Tesarik <ptesarik@suse.cz>2019-09-05 20:28:54 +0200
committerPetr Tesarik <ptesarik@suse.cz>2019-09-05 20:28:54 +0200
commitb00b9b1a41ea034b4f1d4dd3db08100fc8616673 (patch)
tree6fd4a532bd3e4c05140a6f9b3539f996326265dd
parent45a2564cc128365c4174766549d396fd84e18ce4 (diff)
parenta1da6e968a3fe7251d6b09646c9bdad599198696 (diff)
Merge branch 'SLE15' into SLE15-SP1
Conflicts: patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-_ceph_build_xattrs_blob.patch patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fill_inode.patch patches.suse/ceph-fix-ceph-dir-rctime-vxattr-value.patch patches.suse/drm-amdgpu-psp-move-psp-version-specific-function-po.patch patches.suse/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch patches.suse/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch patches.suse/drm-imx-notify-drm-core-before-sending-event-during-.patch patches.suse/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch patches.suse/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch patches.suse/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch patches.suse/drm-mediatek-clear-num_pipes-when-unbind-driver.patch patches.suse/drm-mediatek-fix-unbind-functions.patch patches.suse/drm-mediatek-mtk_drm_drv.c-Add-of_node_put-before-go.patch patches.suse/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch patches.suse/drm-mediatek-use-correct-device-to-import-PRIME-buff.patch patches.suse/drm-msm-mdp5-Fix-mdp5_cfg_init-error-return.patch patches.suse/drm-rockchip-Suspend-DP-late.patch patches.suse/drm-udl-introduce-a-macro-to-convert-dev-to-udl.patch patches.suse/drm-udl-move-to-embedding-drm-device-inside-udl-devi.patch patches.suse/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch patches.suse/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch patches.suse/gpu-ipu-v3-ipu-ic-Fix-saturation-bit-offset-in-TPMEM.patch
-rw-r--r--blacklist.conf1
-rw-r--r--patches.suse/0001-x86-ptrace-Fix-possible-spectre-v1-in-ptrace_get_deb.patch50
-rw-r--r--patches.suse/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch2
-rw-r--r--patches.suse/Bluetooth-hci_ldisc-Postpone-HCI_UART_PROTO_READY-bi.patch2
-rw-r--r--patches.suse/HID-Add-044f-b320-ThrustMaster-Inc.-2-in-1-DT.patch67
-rw-r--r--patches.suse/HID-hiddev-do-cleanup-in-failure-of-opening-a-device.patch33
-rw-r--r--patches.suse/USB-cdc-wdm-fix-race-between-write-and-disconnect-du.patch69
-rw-r--r--patches.suse/VMCI-Release-resource-if-the-work-is-already-queued.patch96
-rw-r--r--patches.suse/ath6kl-add-some-bounds-checking.patch2
-rw-r--r--patches.suse/batman-adv-Only-read-OGM-tvlv_len-after-buffer-len-c.patch80
-rw-r--r--patches.suse/batman-adv-Only-read-OGM2-tvlv_len-after-buffer-len-.patch68
-rw-r--r--patches.suse/batman-adv-fix-uninit-value-in-batadv_netlink_get_if.patch69
-rw-r--r--patches.suse/btrfs-add-a-helper-to-retrive-extent-inline-ref-type.patch89
-rw-r--r--patches.suse/btrfs-add-one-more-sanity-check-for-shared-ref-type.patch141
-rw-r--r--patches.suse/btrfs-convert-to-use-btrfs_get_extent_inline_ref_type.patch176
-rw-r--r--patches.suse/btrfs-remove-bug-in-add_data_reference.patch35
-rw-r--r--patches.suse/btrfs-remove-bug-in-btrfs_extent_inline_ref_size.patch32
-rw-r--r--patches.suse/btrfs-remove-bug-in-print_extent_item.patch36
-rw-r--r--patches.suse/btrfs-remove-bug_on-in-_add_tree_block.patch54
-rw-r--r--patches.suse/can-peak_usb-force-the-string-buffer-NULL-terminated.patch40
-rw-r--r--patches.suse/can-sja1000-force-the-string-buffer-NULL-terminated.patch40
-rw-r--r--patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-_ceph_build_xattrs_blob.patch29
-rw-r--r--patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fill_inode.patch9
-rw-r--r--patches.suse/ceph-fix-ceph-dir-rctime-vxattr-value.patch5
-rw-r--r--patches.suse/cifs-Fix-use-after-free-in-SMB2_read.patch2
-rw-r--r--patches.suse/cifs-Fix-use-after-free-in-SMB2_write.patch2
-rw-r--r--patches.suse/drm-amdgpu-psp-move-psp-version-specific-function-po.patch16
-rw-r--r--patches.suse/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch20
-rw-r--r--patches.suse/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch22
-rw-r--r--patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch19
-rw-r--r--patches.suse/drm-imx-notify-drm-core-before-sending-event-during-.patch9
-rw-r--r--patches.suse/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch9
-rw-r--r--patches.suse/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch16
-rw-r--r--patches.suse/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch9
-rw-r--r--patches.suse/drm-mediatek-clear-num_pipes-when-unbind-driver.patch16
-rw-r--r--patches.suse/drm-mediatek-fix-unbind-functions.patch9
-rw-r--r--patches.suse/drm-mediatek-mtk_drm_drv.c-Add-of_node_put-before-go.patch9
-rw-r--r--patches.suse/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch18
-rw-r--r--patches.suse/drm-mediatek-use-correct-device-to-import-PRIME-buff.patch9
-rw-r--r--patches.suse/drm-msm-mdp5-Fix-mdp5_cfg_init-error-return.patch14
-rw-r--r--patches.suse/drm-nouveau-Don-t-retry-infinitely-when-receiving-no.patch107
-rw-r--r--patches.suse/drm-rockchip-Suspend-DP-late.patch16
-rw-r--r--patches.suse/drm-udl-introduce-a-macro-to-convert-dev-to-udl.patch48
-rw-r--r--patches.suse/drm-udl-move-to-embedding-drm-device-inside-udl-devi.patch46
-rw-r--r--patches.suse/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch26
-rw-r--r--patches.suse/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch17
-rw-r--r--patches.suse/ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch49
-rw-r--r--patches.suse/ftrace-check-for-successful-allocation-of-hash.patch40
-rw-r--r--patches.suse/ftrace-fix-null-pointer-dereference-in-t_probe_next.patch77
-rw-r--r--patches.suse/genetlink-Fix-a-memory-leak-on-error-path.patch2
-rw-r--r--patches.suse/gpio-mxs-Get-rid-of-external-API-call.patch52
-rw-r--r--patches.suse/gpio-pxa-handle-corner-case-of-unprobed-device.patch55
-rw-r--r--patches.suse/gpu-ipu-v3-ipu-ic-Fix-saturation-bit-offset-in-TPMEM.patch9
-rw-r--r--patches.suse/i2c-qup-fixed-releasing-dma-without-flush-operation-.patch53
-rw-r--r--patches.suse/isdn-hfcsusb-Fix-mISDN-driver-crash-caused-by-transf.patch87
-rw-r--r--patches.suse/isdn-mISDN-hfcsusb-Fix-possible-null-pointer-derefer.patch50
-rw-r--r--patches.suse/kconfig-mn-conf-handle-backspace-H-key.patch67
-rw-r--r--patches.suse/kvm-x86-move-msr_ia32_arch_capabilities-to-array-emulated_msrs37
-rw-r--r--patches.suse/libata-add-SG-safety-checks-in-SFF-pio-transfers.patch48
-rw-r--r--patches.suse/libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch84
-rw-r--r--patches.suse/mac80211-fix-possible-sta-leak.patch51
-rw-r--r--patches.suse/mmc-sdhci-of-at91-add-quirk-for-broken-HS200.patch41
-rw-r--r--patches.suse/mpls-fix-warning-with-multi-label-encap.patch45
-rw-r--r--patches.suse/powerpc-fadump-when-fadump-is-supported-register-the.patch68
-rw-r--r--patches.suse/powerpc-xive-Fix-dump-of-XIVE-interrupt-under-pserie.patch215
-rw-r--r--patches.suse/powerpc-xmon-Add-a-dump-of-all-XIVE-interrupts.patch66
-rw-r--r--patches.suse/powerpc-xmon-Check-for-HV-mode-when-dumping-XIVE-inf.patch59
-rw-r--r--patches.suse/rsi-add-fix-for-crash-during-assertions.patch38
-rw-r--r--patches.suse/rtc-pcf8523-don-t-return-invalid-date-when-battery-i.patch87
-rw-r--r--patches.suse/samples-bpf-fix-to-change-the-buffer-size-for-read.patch45
-rw-r--r--patches.suse/samples-mei-use-dev-mei0-instead-of-dev-mei.patch36
-rw-r--r--patches.suse/scripts-checkstack.pl-Fix-arm64-wrong-or-unknown-arc.patch39
-rw-r--r--patches.suse/scripts-decode_stacktrace-only-strip-base-path-when-.patch49
-rw-r--r--patches.suse/scripts-decode_stacktrace.sh-prefix-addr2line-with-C.patch50
-rw-r--r--patches.suse/scripts-gdb-fix-lx-version-string-output.patch58
-rw-r--r--patches.suse/supported-flag-wildcards1
-rw-r--r--patches.suse/test_firmware-fix-a-memory-leak-bug.patch48
-rw-r--r--patches.suse/usb-host-xhci-rcar-Fix-typo-in-compatible-string-mat.patch40
-rw-r--r--series.conf47
79 files changed, 3218 insertions, 259 deletions
diff --git a/blacklist.conf b/blacklist.conf
index f1ca04d5d4..37833f0d69 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -1314,3 +1314,4 @@ e71769ae52609ea0044a9901709042e5634c2306 # major dependencies needed, bsc#114819
136ac591f047fc356072343eb85687f7c6ea191d # trivial
951531691c4bcaa59f56a316e018bc2ff1ddf855 # no CONFIG_HARDENED_USERCOPY
2c012a4ad1a2cd3fb5a0f9307b9d219f84eda1fa # hack, risk of regression, see bsc#1149215 comment 2
+7d3cd66261665da491d0ee582beabe23df60f983 # not applicable in v4.12: drm/i915: Fix various tracepoints for gen2
diff --git a/patches.suse/0001-x86-ptrace-Fix-possible-spectre-v1-in-ptrace_get_deb.patch b/patches.suse/0001-x86-ptrace-Fix-possible-spectre-v1-in-ptrace_get_deb.patch
new file mode 100644
index 0000000000..ddea858cd5
--- /dev/null
+++ b/patches.suse/0001-x86-ptrace-Fix-possible-spectre-v1-in-ptrace_get_deb.patch
@@ -0,0 +1,50 @@
+From 31a2fbb390fee4231281b939e1979e810f945415 Mon Sep 17 00:00:00 2001
+From: Dianzhang Chen <dianzhangchen0@gmail.com>
+Date: Tue, 25 Jun 2019 23:30:17 +0800
+Subject: [PATCH] x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
+Git-commit: 31a2fbb390fee4231281b939e1979e810f945415
+Patch-mainline: v5.3-rc1
+References: bnc#1149376, CVE-2019-15902
+
+The index to access the threads ptrace_bps is controlled by userspace via
+Syscall: sys_ptrace(), hence leading to a potential exploitation of the
+Spectre variant 1 vulnerability.
+
+The index can be controlled from:
+ ptrace -> arch_ptrace -> ptrace_get_debugreg.
+
+Fix this by sanitizing the user supplied index before using it access
+thread->ptrace_bps.
+
+Signed-off-by: Dianzhang Chen <dianzhangchen0@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: bp@alien8.de
+Cc: hpa@zytor.com
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/1561476617-3759-1-git-send-email-dianzhangchen0@gmail.com
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+
+---
+ arch/x86/kernel/ptrace.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/ptrace.c
++++ b/arch/x86/kernel/ptrace.c
+@@ -24,6 +24,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/export.h>
+ #include <linux/context_tracking.h>
++#include <linux/nospec.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/pgtable.h>
+@@ -653,7 +654,8 @@ static unsigned long ptrace_get_debugreg
+ unsigned long val = 0;
+
+ if (n < HBP_NUM) {
+- struct perf_event *bp = thread->ptrace_bps[n];
++ int index = array_index_nospec(n, HBP_NUM);
++ struct perf_event *bp = thread->ptrace_bps[index];
+
+ if (bp)
+ val = bp->hw.info.address;
diff --git a/patches.suse/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch b/patches.suse/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch
index d0e3a70c51..d9276dc6d6 100644
--- a/patches.suse/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch
+++ b/patches.suse/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch
@@ -4,7 +4,7 @@ Date: Wed, 19 Dec 2018 12:36:27 +0100
Subject: [PATCH 1/9] ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Git-commit: f4351a199cc120ff9d59e06d02e8657d08e6cc46
Patch-mainline: v5.0-rc2
-References: bsc#1051510
+References: bsc#1051510, CVE-2019-15927, bsc#1149522
The parser for the processing unit reads bNrInPins field before the
bLength sanity check, which may lead to an out-of-bound access when a
diff --git a/patches.suse/Bluetooth-hci_ldisc-Postpone-HCI_UART_PROTO_READY-bi.patch b/patches.suse/Bluetooth-hci_ldisc-Postpone-HCI_UART_PROTO_READY-bi.patch
index 513a00a150..0199ab859d 100644
--- a/patches.suse/Bluetooth-hci_ldisc-Postpone-HCI_UART_PROTO_READY-bi.patch
+++ b/patches.suse/Bluetooth-hci_ldisc-Postpone-HCI_UART_PROTO_READY-bi.patch
@@ -4,7 +4,7 @@ Date: Sat, 23 Feb 2019 12:33:27 +0800
Subject: [PATCH] Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()
Git-commit: 56897b217a1d0a91c9920cb418d6b3fe922f590a
Patch-mainline: v5.1-rc1
-References: bsc#1051510
+References: bsc#1051510, CVE-2019-15917, bsc#1149539
task A: task B:
hci_uart_set_proto flush_to_ldisc
diff --git a/patches.suse/HID-Add-044f-b320-ThrustMaster-Inc.-2-in-1-DT.patch b/patches.suse/HID-Add-044f-b320-ThrustMaster-Inc.-2-in-1-DT.patch
new file mode 100644
index 0000000000..677d154b4d
--- /dev/null
+++ b/patches.suse/HID-Add-044f-b320-ThrustMaster-Inc.-2-in-1-DT.patch
@@ -0,0 +1,67 @@
+From 65f11c72780fa9d598df88def045ccb6a885cf80 Mon Sep 17 00:00:00 2001
+From: Ilya Trukhanov <lahvuun@gmail.com>
+Date: Tue, 2 Jul 2019 13:37:16 +0300
+Subject: [PATCH] HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
+Git-commit: 65f11c72780fa9d598df88def045ccb6a885cf80
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+Enable force feedback for the Thrustmaster Dual Trigger 2 in 1 Rumble Force
+gamepad. Compared to other Thrustmaster devices, left and right rumble
+motors here are swapped.
+
+Signed-off-by: Ilya Trukhanov <lahvuun@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/hid-tmff.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c
+index e12f2588ddeb..bdfc5ff3b2c5 100644
+--- a/drivers/hid/hid-tmff.c
++++ b/drivers/hid/hid-tmff.c
+@@ -22,6 +22,8 @@
+
+ #include "hid-ids.h"
+
++#define THRUSTMASTER_DEVICE_ID_2_IN_1_DT 0xb320
++
+ static const signed short ff_rumble[] = {
+ FF_RUMBLE,
+ -1
+@@ -76,6 +78,7 @@ static int tmff_play(struct input_dev *dev, void *data,
+ struct hid_field *ff_field = tmff->ff_field;
+ int x, y;
+ int left, right; /* Rumbling */
++ int motor_swap;
+
+ switch (effect->type) {
+ case FF_CONSTANT:
+@@ -100,6 +103,13 @@ static int tmff_play(struct input_dev *dev, void *data,
+ ff_field->logical_minimum,
+ ff_field->logical_maximum);
+
++ /* 2-in-1 strong motor is left */
++ if (hid->product == THRUSTMASTER_DEVICE_ID_2_IN_1_DT) {
++ motor_swap = left;
++ left = right;
++ right = motor_swap;
++ }
++
+ dbg_hid("(left,right)=(%08x, %08x)\n", left, right);
+ ff_field->value[0] = left;
+ ff_field->value[1] = right;
+@@ -226,6 +236,8 @@ static const struct hid_device_id tm_devices[] = {
+ .driver_data = (unsigned long)ff_rumble },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304), /* FireStorm Dual Power 2 (and 3) */
+ .driver_data = (unsigned long)ff_rumble },
++ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, THRUSTMASTER_DEVICE_ID_2_IN_1_DT), /* Dual Trigger 2-in-1 */
++ .driver_data = (unsigned long)ff_rumble },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323), /* Dual Trigger 3-in-1 (PC Mode) */
+ .driver_data = (unsigned long)ff_rumble },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb324), /* Dual Trigger 3-in-1 (PS3 Mode) */
+--
+2.16.4
+
diff --git a/patches.suse/HID-hiddev-do-cleanup-in-failure-of-opening-a-device.patch b/patches.suse/HID-hiddev-do-cleanup-in-failure-of-opening-a-device.patch
new file mode 100644
index 0000000000..21f42b8721
--- /dev/null
+++ b/patches.suse/HID-hiddev-do-cleanup-in-failure-of-opening-a-device.patch
@@ -0,0 +1,33 @@
+From 6d4472d7bec39917b54e4e80245784ea5d60ce49 Mon Sep 17 00:00:00 2001
+From: Hillf Danton <hdanton@sina.com>
+Date: Tue, 6 Aug 2019 16:40:15 +0800
+Subject: [PATCH] HID: hiddev: do cleanup in failure of opening a device
+Git-commit: 6d4472d7bec39917b54e4e80245784ea5d60ce49
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+Undo what we did for opening before releasing the memory slice.
+
+Reported-by: syzbot <syzbot+62a1e04fd3ec2abf099e@syzkaller.appspotmail.com>
+Cc: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Hillf Danton <hdanton@sina.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/usbhid/hiddev.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -321,6 +321,10 @@ static int hiddev_open(struct inode *ino
+ return 0;
+ bail_unlock:
+ mutex_unlock(&hiddev->existancelock);
++
++ spin_lock_irq(&list->hiddev->list_lock);
++ list_del(&list->node);
++ spin_unlock_irq(&list->hiddev->list_lock);
+ bail:
+ file->private_data = NULL;
+ vfree(list);
diff --git a/patches.suse/USB-cdc-wdm-fix-race-between-write-and-disconnect-du.patch b/patches.suse/USB-cdc-wdm-fix-race-between-write-and-disconnect-du.patch
new file mode 100644
index 0000000000..bcef7aa7f7
--- /dev/null
+++ b/patches.suse/USB-cdc-wdm-fix-race-between-write-and-disconnect-du.patch
@@ -0,0 +1,69 @@
+From 1426bd2c9f7e3126e2678e7469dca9fd9fc6dd3e Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Tue, 27 Aug 2019 12:34:36 +0200
+Subject: [PATCH] USB: cdc-wdm: fix race between write and disconnect due to flag abuse
+Git-commit: 1426bd2c9f7e3126e2678e7469dca9fd9fc6dd3e
+Patch-mainline: v5.3-rc7
+References: bsc#1051510
+
+In case of a disconnect an ongoing flush() has to be made fail.
+Nevertheless we cannot be sure that any pending URB has already
+finished, so although they will never succeed, they still must
+not be touched.
+The clean solution for this is to check for WDM_IN_USE
+and WDM_DISCONNECTED in flush(). There is no point in ever
+clearing WDM_IN_USE, as no further writes make sense.
+
+The issue is as old as the driver.
+
+Fixes: afba937e540c9 ("USB: CDC WDM driver")
+Reported-by: syzbot+d232cca6ec42c2edb3fc@syzkaller.appspotmail.com
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20190827103436.21143-1-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/class/cdc-wdm.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index a7824a51f86d..70afb2ca1eab 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -587,10 +587,20 @@ static int wdm_flush(struct file *file, fl_owner_t id)
+ {
+ struct wdm_device *desc = file->private_data;
+
+- wait_event(desc->wait, !test_bit(WDM_IN_USE, &desc->flags));
++ wait_event(desc->wait,
++ /*
++ * needs both flags. We cannot do with one
++ * because resetting it would cause a race
++ * with write() yet we need to signal
++ * a disconnect
++ */
++ !test_bit(WDM_IN_USE, &desc->flags) ||
++ test_bit(WDM_DISCONNECTING, &desc->flags));
+
+ /* cannot dereference desc->intf if WDM_DISCONNECTING */
+- if (desc->werr < 0 && !test_bit(WDM_DISCONNECTING, &desc->flags))
++ if (test_bit(WDM_DISCONNECTING, &desc->flags))
++ return -ENODEV;
++ if (desc->werr < 0)
+ dev_err(&desc->intf->dev, "Error in flush path: %d\n",
+ desc->werr);
+
+@@ -974,8 +984,6 @@ static void wdm_disconnect(struct usb_interface *intf)
+ spin_lock_irqsave(&desc->iuspin, flags);
+ set_bit(WDM_DISCONNECTING, &desc->flags);
+ set_bit(WDM_READ, &desc->flags);
+- /* to terminate pending flushes */
+- clear_bit(WDM_IN_USE, &desc->flags);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+ wake_up_all(&desc->wait);
+ mutex_lock(&desc->rlock);
+--
+2.16.4
+
diff --git a/patches.suse/VMCI-Release-resource-if-the-work-is-already-queued.patch b/patches.suse/VMCI-Release-resource-if-the-work-is-already-queued.patch
new file mode 100644
index 0000000000..f35707af7e
--- /dev/null
+++ b/patches.suse/VMCI-Release-resource-if-the-work-is-already-queued.patch
@@ -0,0 +1,96 @@
+From ba03a9bbd17b149c373c0ea44017f35fc2cd0f28 Mon Sep 17 00:00:00 2001
+From: Nadav Amit <namit@vmware.com>
+Date: Tue, 20 Aug 2019 13:26:38 -0700
+Subject: [PATCH] VMCI: Release resource if the work is already queued
+Git-commit: ba03a9bbd17b149c373c0ea44017f35fc2cd0f28
+Patch-mainline: v5.3-rc7
+References: bsc#1051510
+
+Francois reported that VMware balloon gets stuck after a balloon reset,
+when the VMCI doorbell is removed. A similar error can occur when the
+balloon driver is removed with the following splat:
+
+[ 1088.622000] INFO: task modprobe:3565 blocked for more than 120 seconds.
+[ 1088.622035] Tainted: G W 5.2.0 #4
+[ 1088.622087] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 1088.622205] modprobe D 0 3565 1450 0x00000000
+[ 1088.622210] Call Trace:
+[ 1088.622246] __schedule+0x2a8/0x690
+[ 1088.622248] schedule+0x2d/0x90
+[ 1088.622250] schedule_timeout+0x1d3/0x2f0
+[ 1088.622252] wait_for_completion+0xba/0x140
+[ 1088.622320] ? wake_up_q+0x80/0x80
+[ 1088.622370] vmci_resource_remove+0xb9/0xc0 [vmw_vmci]
+[ 1088.622373] vmci_doorbell_destroy+0x9e/0xd0 [vmw_vmci]
+[ 1088.622379] vmballoon_vmci_cleanup+0x6e/0xf0 [vmw_balloon]
+[ 1088.622381] vmballoon_exit+0x18/0xcc8 [vmw_balloon]
+[ 1088.622394] __x64_sys_delete_module+0x146/0x280
+[ 1088.622408] do_syscall_64+0x5a/0x130
+[ 1088.622410] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 1088.622415] RIP: 0033:0x7f54f62791b7
+[ 1088.622421] Code: Bad RIP value.
+[ 1088.622421] RSP: 002b:00007fff2a949008 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
+[ 1088.622426] RAX: ffffffffffffffda RBX: 000055dff8b55d00 RCX: 00007f54f62791b7
+[ 1088.622426] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055dff8b55d68
+[ 1088.622427] RBP: 000055dff8b55d00 R08: 00007fff2a947fb1 R09: 0000000000000000
+[ 1088.622427] R10: 00007f54f62f5cc0 R11: 0000000000000206 R12: 000055dff8b55d68
+[ 1088.622428] R13: 0000000000000001 R14: 000055dff8b55d68 R15: 00007fff2a94a3f0
+
+The cause for the bug is that when the "delayed" doorbell is invoked, it
+takes a reference on the doorbell entry and schedules work that is
+supposed to run the appropriate code and drop the doorbell entry
+reference. The code ignores the fact that if the work is already queued,
+it will not be scheduled to run one more time. As a result one of the
+references would not be dropped. When the code waits for the reference
+to get to zero, during balloon reset or module removal, it gets stuck.
+
+Fix it. Drop the reference if schedule_work() indicates that the work is
+already queued.
+
+Note that this bug got more apparent (or apparent at all) due to
+commit ce664331b248 ("vmw_balloon: VMCI_DOORBELL_SET does not check status").
+
+Fixes: 83e2ec765be03 ("VMCI: doorbell implementation.")
+Reported-by: Francois Rigault <rigault.francois@gmail.com>
+Cc: Jorgen Hansen <jhansen@vmware.com>
+Cc: Adit Ranadive <aditr@vmware.com>
+Cc: Alexios Zavras <alexios.zavras@intel.com>
+Cc: Vishnu DASA <vdasa@vmware.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Nadav Amit <namit@vmware.com>
+Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
+Link: https://lore.kernel.org/r/20190820202638.49003-1-namit@vmware.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/misc/vmw_vmci/vmci_doorbell.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/vmw_vmci/vmci_doorbell.c b/drivers/misc/vmw_vmci/vmci_doorbell.c
+index bad89b6e0802..345addd9306d 100644
+--- a/drivers/misc/vmw_vmci/vmci_doorbell.c
++++ b/drivers/misc/vmw_vmci/vmci_doorbell.c
+@@ -310,7 +310,8 @@ int vmci_dbell_host_context_notify(u32 src_cid, struct vmci_handle handle)
+
+ entry = container_of(resource, struct dbell_entry, resource);
+ if (entry->run_delayed) {
+- schedule_work(&entry->work);
++ if (!schedule_work(&entry->work))
++ vmci_resource_put(resource);
+ } else {
+ entry->notify_cb(entry->client_data);
+ vmci_resource_put(resource);
+@@ -361,7 +362,8 @@ static void dbell_fire_entries(u32 notify_idx)
+ atomic_read(&dbell->active) == 1) {
+ if (dbell->run_delayed) {
+ vmci_resource_get(&dbell->resource);
+- schedule_work(&dbell->work);
++ if (!schedule_work(&dbell->work))
++ vmci_resource_put(&dbell->resource);
+ } else {
+ dbell->notify_cb(dbell->client_data);
+ }
+--
+2.16.4
+
diff --git a/patches.suse/ath6kl-add-some-bounds-checking.patch b/patches.suse/ath6kl-add-some-bounds-checking.patch
index f8cfc55857..599d122c81 100644
--- a/patches.suse/ath6kl-add-some-bounds-checking.patch
+++ b/patches.suse/ath6kl-add-some-bounds-checking.patch
@@ -4,7 +4,7 @@ Date: Thu, 4 Apr 2019 11:56:51 +0300
Subject: [PATCH] ath6kl: add some bounds checking
Git-commit: 5d6751eaff672ea77642e74e92e6c0ac7f9709ab
Patch-mainline: v5.3-rc1
-References: bsc#1051510
+References: bsc#1051510, CVE-2019-15926, bsc#1149527
The "ev->traffic_class" and "reply->ac" variables come from the network
and they're used as an offset into the wmi->stream_exist_for_ac[] array.
diff --git a/patches.suse/batman-adv-Only-read-OGM-tvlv_len-after-buffer-len-c.patch b/patches.suse/batman-adv-Only-read-OGM-tvlv_len-after-buffer-len-c.patch
new file mode 100644
index 0000000000..443b5063d1
--- /dev/null
+++ b/patches.suse/batman-adv-Only-read-OGM-tvlv_len-after-buffer-len-c.patch
@@ -0,0 +1,80 @@
+From a15d56a60760aa9dbe26343b9a0ac5228f35d445 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Thu, 22 Aug 2019 08:55:36 +0200
+Subject: [PATCH] batman-adv: Only read OGM tvlv_len after buffer len check
+Git-commit: a15d56a60760aa9dbe26343b9a0ac5228f35d445
+Patch-mainline: v5.3-rc7
+References: bsc#1051510
+
+Multiple batadv_ogm_packet can be stored in an skbuff. The functions
+batadv_iv_ogm_send_to_if()/batadv_iv_ogm_receive() use
+batadv_iv_ogm_aggr_packet() to check if there is another additional
+batadv_ogm_packet in the skb or not before they continue processing the
+packet.
+
+The length for such an OGM is BATADV_OGM_HLEN +
+batadv_ogm_packet->tvlv_len. The check must first check that at least
+BATADV_OGM_HLEN bytes are available before it accesses tvlv_len (which is
+part of the header. Otherwise it might try read outside of the currently
+available skbuff to get the content of tvlv_len.
+
+Fixes: ef26157747d4 ("batman-adv: tvlv - basic infrastructure")
+Reported-by: syzbot+355cab184197dbbfa384@syzkaller.appspotmail.com
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Acked-by: Antonio Quartulli <a@unstable.cc>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/batman-adv/bat_iv_ogm.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/net/batman-adv/bat_iv_ogm.c
++++ b/net/batman-adv/bat_iv_ogm.c
+@@ -454,17 +454,23 @@ static u8 batadv_hop_penalty(u8 tq, cons
+ * batadv_iv_ogm_aggr_packet - checks if there is another OGM attached
+ * @buff_pos: current position in the skb
+ * @packet_len: total length of the skb
+- * @tvlv_len: tvlv length of the previously considered OGM
++ * @ogm_packet: potential OGM in buffer
+ *
+ * Return: true if there is enough space for another OGM, false otherwise.
+ */
+-static bool batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len,
+- __be16 tvlv_len)
++static bool
++batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len,
++ const struct batadv_ogm_packet *ogm_packet)
+ {
+ int next_buff_pos = 0;
+
+- next_buff_pos += buff_pos + BATADV_OGM_HLEN;
+- next_buff_pos += ntohs(tvlv_len);
++ /* check if there is enough space for the header */
++ next_buff_pos += buff_pos + sizeof(*ogm_packet);
++ if (next_buff_pos > packet_len)
++ return false;
++
++ /* check if there is enough space for the optional TVLV */
++ next_buff_pos += ntohs(ogm_packet->tvlv_len);
+
+ return (next_buff_pos <= packet_len) &&
+ (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES);
+@@ -492,7 +498,7 @@ static void batadv_iv_ogm_send_to_if(str
+
+ /* adjust all flags and log packets */
+ while (batadv_iv_ogm_aggr_packet(buff_pos, forw_packet->packet_len,
+- batadv_ogm_packet->tvlv_len)) {
++ batadv_ogm_packet)) {
+ /* we might have aggregated direct link packets with an
+ * ordinary base packet
+ */
+@@ -1843,7 +1849,7 @@ static int batadv_iv_ogm_receive(struct
+
+ /* unpack the aggregated packets and process them one by one */
+ while (batadv_iv_ogm_aggr_packet(ogm_offset, skb_headlen(skb),
+- ogm_packet->tvlv_len)) {
++ ogm_packet)) {
+ batadv_iv_ogm_process(skb, ogm_offset, if_incoming);
+
+ ogm_offset += BATADV_OGM_HLEN;
diff --git a/patches.suse/batman-adv-Only-read-OGM2-tvlv_len-after-buffer-len-.patch b/patches.suse/batman-adv-Only-read-OGM2-tvlv_len-after-buffer-len-.patch
new file mode 100644
index 0000000000..edb503fdfc
--- /dev/null
+++ b/patches.suse/batman-adv-Only-read-OGM2-tvlv_len-after-buffer-len-.patch
@@ -0,0 +1,68 @@
+From 0ff0f15a32c093381ad1abc06abe85afb561ab28 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Thu, 22 Aug 2019 08:55:36 +0200
+Subject: [PATCH] batman-adv: Only read OGM2 tvlv_len after buffer len check
+Git-commit: 0ff0f15a32c093381ad1abc06abe85afb561ab28
+Patch-mainline: v5.3-rc7
+References: bsc#1051510
+
+Multiple batadv_ogm2_packet can be stored in an skbuff. The functions
+batadv_v_ogm_send_to_if() uses batadv_v_ogm_aggr_packet() to check if there
+is another additional batadv_ogm2_packet in the skb or not before they
+continue processing the packet.
+
+The length for such an OGM2 is BATADV_OGM2_HLEN +
+batadv_ogm2_packet->tvlv_len. The check must first check that at least
+BATADV_OGM2_HLEN bytes are available before it accesses tvlv_len (which is
+part of the header. Otherwise it might try read outside of the currently
+available skbuff to get the content of tvlv_len.
+
+Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/batman-adv/bat_v_ogm.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/net/batman-adv/bat_v_ogm.c
++++ b/net/batman-adv/bat_v_ogm.c
+@@ -642,17 +642,23 @@ batadv_v_ogm_process_per_outif(struct ba
+ * batadv_v_ogm_aggr_packet - checks if there is another OGM aggregated
+ * @buff_pos: current position in the skb
+ * @packet_len: total length of the skb
+- * @tvlv_len: tvlv length of the previously considered OGM
++ * @ogm2_packet: potential OGM2 in buffer
+ *
+ * Return: true if there is enough space for another OGM, false otherwise.
+ */
+-static bool batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
+- __be16 tvlv_len)
++static bool
++batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
++ const struct batadv_ogm2_packet *ogm2_packet)
+ {
+ int next_buff_pos = 0;
+
+- next_buff_pos += buff_pos + BATADV_OGM2_HLEN;
+- next_buff_pos += ntohs(tvlv_len);
++ /* check if there is enough space for the header */
++ next_buff_pos += buff_pos + sizeof(*ogm2_packet);
++ if (next_buff_pos > packet_len)
++ return false;
++
++ /* check if there is enough space for the optional TVLV */
++ next_buff_pos += ntohs(ogm2_packet->tvlv_len);
+
+ return (next_buff_pos <= packet_len) &&
+ (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES);
+@@ -829,7 +835,7 @@ int batadv_v_ogm_packet_recv(struct sk_b
+ ogm_packet = (struct batadv_ogm2_packet *)skb->data;
+
+ while (batadv_v_ogm_aggr_packet(ogm_offset, skb_headlen(skb),
+- ogm_packet->tvlv_len)) {
++ ogm_packet)) {
+ batadv_v_ogm_process(skb, ogm_offset, if_incoming);
+
+ ogm_offset += BATADV_OGM2_HLEN;
diff --git a/patches.suse/batman-adv-fix-uninit-value-in-batadv_netlink_get_if.patch b/patches.suse/batman-adv-fix-uninit-value-in-batadv_netlink_get_if.patch
new file mode 100644
index 0000000000..43fa6be362
--- /dev/null
+++ b/patches.suse/batman-adv-fix-uninit-value-in-batadv_netlink_get_if.patch
@@ -0,0 +1,69 @@
+From 3ee1bb7aae97324ec9078da1f00cb2176919563f Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 12 Aug 2019 04:57:27 -0700
+Subject: [PATCH] batman-adv: fix uninit-value in batadv_netlink_get_ifindex()
+Git-commit: 3ee1bb7aae97324ec9078da1f00cb2176919563f
+Patch-mainline: v5.3-rc7
+References: bsc#1051510
+
+batadv_netlink_get_ifindex() needs to make sure user passed
+a correct u32 attribute.
+
+syzbot reported :
+Bug: KMSAN: uninit-value in batadv_netlink_dump_hardif+0x70d/0x880 net/batman-adv/netlink.c:968
+Cpu: 1 PID: 11705 Comm: syz-executor888 Not tainted 5.1.0+ #1
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x191/0x1f0 lib/dump_stack.c:113
+ kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622
+ __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:310
+ batadv_netlink_dump_hardif+0x70d/0x880 net/batman-adv/netlink.c:968
+ genl_lock_dumpit+0xc6/0x130 net/netlink/genetlink.c:482
+ netlink_dump+0xa84/0x1ab0 net/netlink/af_netlink.c:2253
+ __netlink_dump_start+0xa3a/0xb30 net/netlink/af_netlink.c:2361
+ genl_family_rcv_msg net/netlink/genetlink.c:550 [inline]
+ genl_rcv_msg+0xfc1/0x1a40 net/netlink/genetlink.c:627
+ netlink_rcv_skb+0x431/0x620 net/netlink/af_netlink.c:2486
+ genl_rcv+0x63/0x80 net/netlink/genetlink.c:638
+ netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
+ netlink_unicast+0xf3e/0x1020 net/netlink/af_netlink.c:1337
+ netlink_sendmsg+0x127e/0x12f0 net/netlink/af_netlink.c:1926
+ sock_sendmsg_nosec net/socket.c:651 [inline]
+ sock_sendmsg net/socket.c:661 [inline]
+ ___sys_sendmsg+0xcc6/0x1200 net/socket.c:2260
+ __sys_sendmsg net/socket.c:2298 [inline]
+ __do_sys_sendmsg net/socket.c:2307 [inline]
+ __se_sys_sendmsg+0x305/0x460 net/socket.c:2305
+ __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2305
+ do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
+ entry_SYSCALL_64_after_hwframe+0x63/0xe7
+Rip: 0033:0x440209
+
+Fixes: b60620cf567b ("batman-adv: netlink: hardif query")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/batman-adv/netlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c
+index 6f08fd122a8d..7e052d6f759b 100644
+--- a/net/batman-adv/netlink.c
++++ b/net/batman-adv/netlink.c
+@@ -164,7 +164,7 @@ batadv_netlink_get_ifindex(const struct nlmsghdr *nlh, int attrtype)
+ {
+ struct nlattr *attr = nlmsg_find_attr(nlh, GENL_HDRLEN, attrtype);
+
+- return attr ? nla_get_u32(attr) : 0;
++ return (attr && nla_len(attr) == sizeof(u32)) ? nla_get_u32(attr) : 0;
+ }
+
+ /**
+--
+2.16.4
+
diff --git a/patches.suse/btrfs-add-a-helper-to-retrive-extent-inline-ref-type.patch b/patches.suse/btrfs-add-a-helper-to-retrive-extent-inline-ref-type.patch
new file mode 100644
index 0000000000..c90a95e8e3
--- /dev/null
+++ b/patches.suse/btrfs-add-a-helper-to-retrive-extent-inline-ref-type.patch
@@ -0,0 +1,89 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:18 -0600
+Subject: Btrfs: add a helper to retrive extent inline ref type
+Git-commit: 167ce953ca55bdee20fe56c3c0fa51002435f745
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+An invalid value of extent inline ref type may be read from a
+malicious image which may force btrfs to crash.
+
+This adds a helper which does sanity check for the ref type, so we can
+know if it's sane, return he type, otherwise return an error.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ minimal tweak const types, causing warnings due to other cleanup patches ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/ctree.h | 11 +++++++++++
+ fs/btrfs/extent-tree.c | 37 +++++++++++++++++++++++++++++++++++++
+ 2 files changed, 48 insertions(+)
+
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -2587,6 +2587,17 @@ static inline gfp_t btrfs_alloc_write_ma
+
+ /* extent-tree.c */
+
++enum btrfs_inline_ref_type {
++ BTRFS_REF_TYPE_INVALID = 0,
++ BTRFS_REF_TYPE_BLOCK = 1,
++ BTRFS_REF_TYPE_DATA = 2,
++ BTRFS_REF_TYPE_ANY = 3,
++};
++
++int btrfs_get_extent_inline_ref_type(const struct extent_buffer *eb,
++ struct btrfs_extent_inline_ref *iref,
++ enum btrfs_inline_ref_type is_data);
++
+ u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);
+
+ static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1147,6 +1147,43 @@ static int convert_extent_item_v0(struct
+ }
+ #endif
+
++/*
++ * is_data == BTRFS_REF_TYPE_BLOCK, tree block type is required,
++ * is_data == BTRFS_REF_TYPE_DATA, data type is requried,
++ * is_data == BTRFS_REF_TYPE_ANY, either type is OK.
++ */
++int btrfs_get_extent_inline_ref_type(const struct extent_buffer *eb,
++ struct btrfs_extent_inline_ref *iref,
++ enum btrfs_inline_ref_type is_data)
++{
++ int type = btrfs_extent_inline_ref_type(eb, iref);
++
++ if (type == BTRFS_TREE_BLOCK_REF_KEY ||
++ type == BTRFS_SHARED_BLOCK_REF_KEY ||
++ type == BTRFS_SHARED_DATA_REF_KEY ||
++ type == BTRFS_EXTENT_DATA_REF_KEY) {
++ if (is_data == BTRFS_REF_TYPE_BLOCK) {
++ if (type == BTRFS_TREE_BLOCK_REF_KEY ||
++ type == BTRFS_SHARED_BLOCK_REF_KEY)
++ return type;
++ } else if (is_data == BTRFS_REF_TYPE_DATA) {
++ if (type == BTRFS_EXTENT_DATA_REF_KEY ||
++ type == BTRFS_SHARED_DATA_REF_KEY)
++ return type;
++ } else {
++ ASSERT(is_data == BTRFS_REF_TYPE_ANY);
++ return type;
++ }
++ }
++
++ btrfs_print_leaf(eb->fs_info, (struct extent_buffer *) eb);
++ btrfs_err(eb->fs_info, "eb %llu invalid extent inline ref type %d",
++ eb->start, type);
++ WARN_ON(1);
++
++ return BTRFS_REF_TYPE_INVALID;
++}
++
+ static u64 hash_extent_data_ref(u64 root_objectid, u64 owner, u64 offset)
+ {
+ u32 high_crc = ~(u32)0;
diff --git a/patches.suse/btrfs-add-one-more-sanity-check-for-shared-ref-type.patch b/patches.suse/btrfs-add-one-more-sanity-check-for-shared-ref-type.patch
new file mode 100644
index 0000000000..d9970fdd51
--- /dev/null
+++ b/patches.suse/btrfs-add-one-more-sanity-check-for-shared-ref-type.patch
@@ -0,0 +1,141 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:24 -0600
+Subject: Btrfs: add one more sanity check for shared ref type
+Git-commit: 64ecdb647ddb83dcff9c8e2a5c40119f171ea004
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+Every shared ref has a parent tree block, which can be get from
+btrfs_extent_inline_ref_offset(). And the tree block must be aligned
+to the nodesize, so we'd know this inline ref is not valid if this
+block's bytenr is not aligned to the nodesize, in which case, most
+likely the ref type has been misused.
+
+This adds the above mentioned check and also updates
+print_extent_item() called by btrfs_print_leaf() to point out the
+invalid ref while printing the tree structure.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/extent-tree.c | 29 +++++++++++++++++++++++++----
+ fs/btrfs/print-tree.c | 27 +++++++++++++++++++++------
+ 2 files changed, 46 insertions(+), 10 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 51a691532fd8..96e49fd5b888 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1158,19 +1158,40 @@ int btrfs_get_extent_inline_ref_type(const struct extent_buffer *eb,
+ enum btrfs_inline_ref_type is_data)
+ {
+ int type = btrfs_extent_inline_ref_type(eb, iref);
++ u64 offset = btrfs_extent_inline_ref_offset(eb, iref);
+
+ if (type == BTRFS_TREE_BLOCK_REF_KEY ||
+ type == BTRFS_SHARED_BLOCK_REF_KEY ||
+ type == BTRFS_SHARED_DATA_REF_KEY ||
+ type == BTRFS_EXTENT_DATA_REF_KEY) {
+ if (is_data == BTRFS_REF_TYPE_BLOCK) {
+- if (type == BTRFS_TREE_BLOCK_REF_KEY ||
+- type == BTRFS_SHARED_BLOCK_REF_KEY)
++ if (type == BTRFS_TREE_BLOCK_REF_KEY)
+ return type;
++ if (type == BTRFS_SHARED_BLOCK_REF_KEY) {
++ ASSERT(eb->fs_info);
++ /*
++ * Every shared one has parent tree
++ * block, which must be aligned to
++ * nodesize.
++ */
++ if (offset &&
++ IS_ALIGNED(offset, eb->fs_info->nodesize))
++ return type;
++ }
+ } else if (is_data == BTRFS_REF_TYPE_DATA) {
+- if (type == BTRFS_EXTENT_DATA_REF_KEY ||
+- type == BTRFS_SHARED_DATA_REF_KEY)
++ if (type == BTRFS_EXTENT_DATA_REF_KEY)
+ return type;
++ if (type == BTRFS_SHARED_DATA_REF_KEY) {
++ ASSERT(eb->fs_info);
++ /*
++ * Every shared one has parent tree
++ * block, which must be aligned to
++ * nodesize.
++ */
++ if (offset &&
++ IS_ALIGNED(offset, eb->fs_info->nodesize))
++ return type;
++ }
+ } else {
+ ASSERT(is_data == BTRFS_REF_TYPE_ANY);
+ return type;
+diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
+index c1acbdcb476c..569205e651c7 100644
+--- a/fs/btrfs/print-tree.c
++++ b/fs/btrfs/print-tree.c
+@@ -44,7 +44,7 @@ static void print_dev_item(struct extent_buffer *eb,
+ static void print_extent_data_ref(struct extent_buffer *eb,
+ struct btrfs_extent_data_ref *ref)
+ {
+- pr_info("\t\textent data backref root %llu objectid %llu offset %llu count %u\n",
++ pr_cont("extent data backref root %llu objectid %llu offset %llu count %u\n",
+ btrfs_extent_data_ref_root(eb, ref),
+ btrfs_extent_data_ref_objectid(eb, ref),
+ btrfs_extent_data_ref_offset(eb, ref),
+@@ -63,6 +63,7 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
+ u32 item_size = btrfs_item_size_nr(eb, slot);
+ u64 flags;
+ u64 offset;
++ int ref_index = 0;
+
+ if (item_size < sizeof(*ei)) {
+ #ifdef BTRFS_COMPAT_EXTENT_TREE_V0
+@@ -104,12 +105,20 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
+ iref = (struct btrfs_extent_inline_ref *)ptr;
+ type = btrfs_extent_inline_ref_type(eb, iref);
+ offset = btrfs_extent_inline_ref_offset(eb, iref);
++ pr_info("\t\tref#%d: ", ref_index++);
+ switch (type) {
+ case BTRFS_TREE_BLOCK_REF_KEY:
+- pr_info("\t\ttree block backref root %llu\n", offset);
++ pr_cont("tree block backref root %llu\n", offset);
+ break;
+ case BTRFS_SHARED_BLOCK_REF_KEY:
+- pr_info("\t\tshared block backref parent %llu\n", offset);
++ pr_cont("shared block backref parent %llu\n", offset);
++ /*
++ * offset is supposed to be a tree block which
++ * must be aligned to nodesize.
++ */
++ if (!IS_ALIGNED(offset, eb->fs_info->nodesize))
++ pr_info("\t\t\t(parent %llu is NOT ALIGNED to nodesize %llu)\n",
++ offset, (unsigned long long)eb->fs_info->nodesize);
+ break;
+ case BTRFS_EXTENT_DATA_REF_KEY:
+ dref = (struct btrfs_extent_data_ref *)(&iref->offset);
+@@ -117,12 +126,18 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
+ break;
+ case BTRFS_SHARED_DATA_REF_KEY:
+ sref = (struct btrfs_shared_data_ref *)(iref + 1);
+- pr_info("\t\tshared data backref parent %llu count %u\n",
++ pr_cont("shared data backref parent %llu count %u\n",
+ offset, btrfs_shared_data_ref_count(eb, sref));
++ /*
++ * offset is supposed to be a tree block which
++ * must be aligned to nodesize.
++ */
++ if (!IS_ALIGNED(offset, eb->fs_info->nodesize))
++ pr_info("\t\t\t(parent %llu is NOT ALIGNED to nodesize %llu)\n",
++ offset, (unsigned long long)eb->fs_info->nodesize);
+ break;
+ default:
+- btrfs_err(eb->fs_info,
+- "extent %llu has invalid ref type %d",
++ pr_cont("(extent %llu has INVALID ref type %d)\n",
+ eb->start, type);
+ return;
+ }
+
diff --git a/patches.suse/btrfs-convert-to-use-btrfs_get_extent_inline_ref_type.patch b/patches.suse/btrfs-convert-to-use-btrfs_get_extent_inline_ref_type.patch
new file mode 100644
index 0000000000..48bb420eed
--- /dev/null
+++ b/patches.suse/btrfs-convert-to-use-btrfs_get_extent_inline_ref_type.patch
@@ -0,0 +1,176 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:19 -0600
+Subject: Btrfs: convert to use btrfs_get_extent_inline_ref_type
+Git-commit: 3de28d579edbd35294bf44aee8402c804331bc37
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+Since we have a helper which can do sanity check, this converts all
+btrfs_extent_inline_ref_type to it.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/backref.c | 11 +++++++++--
+ fs/btrfs/extent-tree.c | 36 ++++++++++++++++++++++++++++++------
+ fs/btrfs/relocation.c | 13 +++++++++++--
+ 3 files changed, 50 insertions(+), 10 deletions(-)
+
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index 6bae986bfcfb..b517ef1477ea 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -929,7 +929,11 @@ static int add_inline_refs(const struct btrfs_fs_info *fs_info,
+ int type;
+
+ iref = (struct btrfs_extent_inline_ref *)ptr;
+- type = btrfs_extent_inline_ref_type(leaf, iref);
++ type = btrfs_get_extent_inline_ref_type(leaf, iref,
++ BTRFS_REF_TYPE_ANY);
++ if (type == BTRFS_REF_TYPE_INVALID)
++ return -EINVAL;
++
+ offset = btrfs_extent_inline_ref_offset(leaf, iref);
+
+ switch (type) {
+@@ -1776,7 +1780,10 @@ static int get_extent_inline_ref(unsigned long *ptr,
+
+ end = (unsigned long)ei + item_size;
+ *out_eiref = (struct btrfs_extent_inline_ref *)(*ptr);
+- *out_type = btrfs_extent_inline_ref_type(eb, *out_eiref);
++ *out_type = btrfs_get_extent_inline_ref_type(eb, *out_eiref,
++ BTRFS_REF_TYPE_ANY);
++ if (*out_type == BTRFS_REF_TYPE_INVALID)
++ return -EINVAL;
+
+ *ptr += btrfs_extent_inline_ref_size(*out_type);
+ WARN_ON(*ptr > end);
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 794b06dd824a..51a691532fd8 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1454,12 +1454,18 @@ static noinline u32 extent_data_ref_count(struct btrfs_path *path,
+ struct btrfs_extent_data_ref *ref1;
+ struct btrfs_shared_data_ref *ref2;
+ u32 num_refs = 0;
++ int type;
+
+ leaf = path->nodes[0];
+ btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
+ if (iref) {
+- if (btrfs_extent_inline_ref_type(leaf, iref) ==
+- BTRFS_EXTENT_DATA_REF_KEY) {
++ /*
++ * If type is invalid, we should have bailed out earlier than
++ * this call.
++ */
++ type = btrfs_get_extent_inline_ref_type(leaf, iref, BTRFS_REF_TYPE_DATA);
++ ASSERT(type != BTRFS_REF_TYPE_INVALID);
++ if (type == BTRFS_EXTENT_DATA_REF_KEY) {
+ ref1 = (struct btrfs_extent_data_ref *)(&iref->offset);
+ num_refs = btrfs_extent_data_ref_count(leaf, ref1);
+ } else {
+@@ -1620,6 +1626,7 @@ int lookup_inline_extent_backref(struct btrfs_trans_handle *trans,
+ int ret;
+ int err = 0;
+ bool skinny_metadata = btrfs_fs_incompat(fs_info, SKINNY_METADATA);
++ int needed;
+
+ key.objectid = bytenr;
+ key.type = BTRFS_EXTENT_ITEM_KEY;
+@@ -1711,6 +1718,11 @@ int lookup_inline_extent_backref(struct btrfs_trans_handle *trans,
+ BUG_ON(ptr > end);
+ }
+
++ if (owner >= BTRFS_FIRST_FREE_OBJECTID)
++ needed = BTRFS_REF_TYPE_DATA;
++ else
++ needed = BTRFS_REF_TYPE_BLOCK;
++
+ err = -ENOENT;
+ while (1) {
+ if (ptr >= end) {
+@@ -1718,7 +1730,12 @@ int lookup_inline_extent_backref(struct btrfs_trans_handle *trans,
+ break;
+ }
+ iref = (struct btrfs_extent_inline_ref *)ptr;
+- type = btrfs_extent_inline_ref_type(leaf, iref);
++ type = btrfs_get_extent_inline_ref_type(leaf, iref, needed);
++ if (type == BTRFS_REF_TYPE_INVALID) {
++ err = -EINVAL;
++ goto out;
++ }
++
+ if (want < type)
+ break;
+ if (want > type) {
+@@ -1910,7 +1927,12 @@ void update_inline_extent_backref(struct btrfs_fs_info *fs_info,
+ if (extent_op)
+ __run_delayed_extent_op(extent_op, leaf, ei);
+
+- type = btrfs_extent_inline_ref_type(leaf, iref);
++ /*
++ * If type is invalid, we should have bailed out after
++ * lookup_inline_extent_backref().
++ */
++ type = btrfs_get_extent_inline_ref_type(leaf, iref, BTRFS_REF_TYPE_ANY);
++ ASSERT(type != BTRFS_REF_TYPE_INVALID);
+
+ if (type == BTRFS_EXTENT_DATA_REF_KEY) {
+ dref = (struct btrfs_extent_data_ref *)(&iref->offset);
+@@ -3195,6 +3217,7 @@ static noinline int check_committed_ref(struct btrfs_root *root,
+ struct btrfs_extent_item *ei;
+ struct btrfs_key key;
+ u32 item_size;
++ int type;
+ int ret;
+
+ key.objectid = bytenr;
+@@ -3236,8 +3259,9 @@ static noinline int check_committed_ref(struct btrfs_root *root,
+ goto out;
+
+ iref = (struct btrfs_extent_inline_ref *)(ei + 1);
+- if (btrfs_extent_inline_ref_type(leaf, iref) !=
+- BTRFS_EXTENT_DATA_REF_KEY)
++
++ type = btrfs_get_extent_inline_ref_type(leaf, iref, BTRFS_REF_TYPE_DATA);
++ if (type != BTRFS_EXTENT_DATA_REF_KEY)
+ goto out;
+
+ ref = (struct btrfs_extent_data_ref *)(&iref->offset);
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 1a532bb72eab..96f816aa9ed3 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -799,9 +799,17 @@ struct backref_node *build_backref_tree(struct reloc_control *rc,
+ if (ptr < end) {
+ /* update key for inline back ref */
+ struct btrfs_extent_inline_ref *iref;
++ int type;
+ iref = (struct btrfs_extent_inline_ref *)ptr;
+- key.type = btrfs_extent_inline_ref_type(eb, iref);
++ type = btrfs_get_extent_inline_ref_type(eb, iref,
++ BTRFS_REF_TYPE_BLOCK);
++ if (type == BTRFS_REF_TYPE_INVALID) {
++ err = -EINVAL;
++ goto out;
++ }
++ key.type = type;
+ key.offset = btrfs_extent_inline_ref_offset(eb, iref);
++
+ WARN_ON(key.type != BTRFS_TREE_BLOCK_REF_KEY &&
+ key.type != BTRFS_SHARED_BLOCK_REF_KEY);
+ }
+@@ -3753,7 +3761,8 @@ int add_data_references(struct reloc_control *rc,
+
+ while (ptr < end) {
+ iref = (struct btrfs_extent_inline_ref *)ptr;
+- key.type = btrfs_extent_inline_ref_type(eb, iref);
++ key.type = btrfs_get_extent_inline_ref_type(eb, iref,
++ BTRFS_REF_TYPE_DATA);
+ if (key.type == BTRFS_SHARED_DATA_REF_KEY) {
+ key.offset = btrfs_extent_inline_ref_offset(eb, iref);
+ ret = __add_tree_block(rc, key.offset, blocksize,
+
diff --git a/patches.suse/btrfs-remove-bug-in-add_data_reference.patch b/patches.suse/btrfs-remove-bug-in-add_data_reference.patch
new file mode 100644
index 0000000000..21948a230e
--- /dev/null
+++ b/patches.suse/btrfs-remove-bug-in-add_data_reference.patch
@@ -0,0 +1,35 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:22 -0600
+Subject: Btrfs: remove BUG() in add_data_reference
+Git-commit: b14c55a191263889c379aeee85223bb72501824d
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+Now that we have a helper to report invalid value of extent inline ref
+type, we need to quit gracefully instead of throwing out a kernel panic.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/relocation.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 96f816aa9ed3..1c086d0667be 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -3772,7 +3772,10 @@ int add_data_references(struct reloc_control *rc,
+ ret = find_data_references(rc, extent_key,
+ eb, dref, blocks);
+ } else {
+- BUG();
++ ret = -EINVAL;
++ btrfs_err(rc->extent_root->fs_info,
++ "extent %llu slot %d has an invalid inline ref type",
++ eb->start, path->slots[0]);
+ }
+ if (ret) {
+ err = ret;
+
diff --git a/patches.suse/btrfs-remove-bug-in-btrfs_extent_inline_ref_size.patch b/patches.suse/btrfs-remove-bug-in-btrfs_extent_inline_ref_size.patch
new file mode 100644
index 0000000000..5e664614b4
--- /dev/null
+++ b/patches.suse/btrfs-remove-bug-in-btrfs_extent_inline_ref_size.patch
@@ -0,0 +1,32 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:20 -0600
+Subject: Btrfs: remove BUG() in btrfs_extent_inline_ref_size
+Git-commit: 4335958de2a43c6790c7f6aa0682aa7189983fa4
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+Now that btrfs_get_extent_inline_ref_type() can report if type is a
+valid one and all callers can gracefully deal with that, we don't need
+to crash here.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/ctree.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 542db9d0dbcd..b7cfc74c1757 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -1804,7 +1804,6 @@ static inline u32 btrfs_extent_inline_ref_size(int type)
+ if (type == BTRFS_EXTENT_DATA_REF_KEY)
+ return sizeof(struct btrfs_extent_data_ref) +
+ offsetof(struct btrfs_extent_inline_ref, offset);
+- BUG();
+ return 0;
+ }
+
+
diff --git a/patches.suse/btrfs-remove-bug-in-print_extent_item.patch b/patches.suse/btrfs-remove-bug-in-print_extent_item.patch
new file mode 100644
index 0000000000..25e39229ee
--- /dev/null
+++ b/patches.suse/btrfs-remove-bug-in-print_extent_item.patch
@@ -0,0 +1,36 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:21 -0600
+Subject: Btrfs: remove BUG() in print_extent_item
+Git-commit: 07638ea5987e51715b35eb5a9a9e908f18ffabf7
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+btrfs_print_leaf() is used in btrfs_get_extent_inline_ref_type, so
+here we really want to print the invalid value of ref type instead of
+causing a kernel panic.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/print-tree.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
+index 6e7a8c40dcd9..c1acbdcb476c 100644
+--- a/fs/btrfs/print-tree.c
++++ b/fs/btrfs/print-tree.c
+@@ -121,7 +121,10 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
+ offset, btrfs_shared_data_ref_count(eb, sref));
+ break;
+ default:
+- BUG();
++ btrfs_err(eb->fs_info,
++ "extent %llu has invalid ref type %d",
++ eb->start, type);
++ return;
+ }
+ ptr += btrfs_extent_inline_ref_size(type);
+ }
+
diff --git a/patches.suse/btrfs-remove-bug_on-in-_add_tree_block.patch b/patches.suse/btrfs-remove-bug_on-in-_add_tree_block.patch
new file mode 100644
index 0000000000..0e045736ec
--- /dev/null
+++ b/patches.suse/btrfs-remove-bug_on-in-_add_tree_block.patch
@@ -0,0 +1,54 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:23 -0600
+Subject: Btrfs: remove BUG_ON in __add_tree_block
+Git-commit: cdccee993f2f3466f69a358daec19de744a02f92
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+The BUG_ON() can be triggered when the caller is processing an invalid
+extent inline ref, e.g.
+
+a shared data ref is offered instead of an extent data ref, such that
+it tries to find a non-existent tree block and then btrfs_search_slot
+returns 1 for no such item.
+
+This replaces the BUG_ON() with a WARN() followed by calling
+btrfs_print_leaf() to show more details about what's going on and
+returning -EINVAL to upper callers.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/relocation.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -32,6 +32,7 @@
+ #include "free-space-cache.h"
+ #include "inode-map.h"
+ #include "qgroup.h"
++#include "print-tree.h"
+
+ /*
+ * backref_node, mapping_node and tree_block start with this
+@@ -3485,7 +3486,16 @@ again:
+ goto again;
+ }
+ }
+- BUG_ON(ret);
++ if (ret) {
++ ASSERT(ret == 1);
++ btrfs_print_leaf(fs_info, path->nodes[0]);
++ btrfs_err(fs_info,
++ "tree block extent item (%llu) is not found in extent tree",
++ bytenr);
++ WARN_ON(1);
++ ret = -EINVAL;
++ goto out;
++ }
+
+ ret = add_tree_block(rc, &key, path, blocks);
+ out:
diff --git a/patches.suse/can-peak_usb-force-the-string-buffer-NULL-terminated.patch b/patches.suse/can-peak_usb-force-the-string-buffer-NULL-terminated.patch
new file mode 100644
index 0000000000..64cef6eca3
--- /dev/null
+++ b/patches.suse/can-peak_usb-force-the-string-buffer-NULL-terminated.patch
@@ -0,0 +1,40 @@
+From e787f19373b8a5fa24087800ed78314fd17b984a Mon Sep 17 00:00:00 2001
+From: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
+Date: Wed, 31 Jul 2019 15:25:59 +0800
+Subject: [PATCH] can: peak_usb: force the string buffer NULL-terminated
+Git-commit: e787f19373b8a5fa24087800ed78314fd17b984a
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+strncpy() does not ensure NULL-termination when the input string size
+equals to the destination buffer size IFNAMSIZ. The output string is
+passed to dev_info() which relies on the NULL-termination.
+
+Use strlcpy() instead.
+
+This issue is identified by a Coccinelle script.
+
+Signed-off-by: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index 22b9c8e6d040..65dce642b86b 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -855,7 +855,7 @@ static void peak_usb_disconnect(struct usb_interface *intf)
+
+ dev_prev_siblings = dev->prev_siblings;
+ dev->state &= ~PCAN_USB_STATE_CONNECTED;
+- strncpy(name, netdev->name, IFNAMSIZ);
++ strlcpy(name, netdev->name, IFNAMSIZ);
+
+ unregister_netdev(netdev);
+
+--
+2.16.4
+
diff --git a/patches.suse/can-sja1000-force-the-string-buffer-NULL-terminated.patch b/patches.suse/can-sja1000-force-the-string-buffer-NULL-terminated.patch
new file mode 100644
index 0000000000..d184163943
--- /dev/null
+++ b/patches.suse/can-sja1000-force-the-string-buffer-NULL-terminated.patch
@@ -0,0 +1,40 @@
+From cd28aa2e056cd1ea79fc5f24eed0ce868c6cab5c Mon Sep 17 00:00:00 2001
+From: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
+Date: Wed, 31 Jul 2019 15:31:14 +0800
+Subject: [PATCH] can: sja1000: force the string buffer NULL-terminated
+Git-commit: cd28aa2e056cd1ea79fc5f24eed0ce868c6cab5c
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+strncpy() does not ensure NULL-termination when the input string size
+equals to the destination buffer size IFNAMSIZ. The output string
+'name' is passed to dev_info which relies on NULL-termination.
+
+Use strlcpy() instead.
+
+This issue is identified by a Coccinelle script.
+
+Signed-off-by: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/can/sja1000/peak_pcmcia.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/sja1000/peak_pcmcia.c b/drivers/net/can/sja1000/peak_pcmcia.c
+index 185c7f7d38a4..5e0d5e8101c8 100644
+--- a/drivers/net/can/sja1000/peak_pcmcia.c
++++ b/drivers/net/can/sja1000/peak_pcmcia.c
+@@ -479,7 +479,7 @@ static void pcan_free_channels(struct pcan_pccard *card)
+ if (!netdev)
+ continue;
+
+- strncpy(name, netdev->name, IFNAMSIZ);
++ strlcpy(name, netdev->name, IFNAMSIZ);
+
+ unregister_sja1000dev(netdev);
+
+--
+2.16.4
+
diff --git a/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-_ceph_build_xattrs_blob.patch b/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-_ceph_build_xattrs_blob.patch
index 9bed7dc193..6398b525b4 100644
--- a/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-_ceph_build_xattrs_blob.patch
+++ b/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-_ceph_build_xattrs_blob.patch
@@ -47,17 +47,15 @@ Signed-off-by: Luis Henriques <lhenriques@suse.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
- fs/ceph/caps.c | 5 ++++-
- fs/ceph/snap.c | 4 +++-
- fs/ceph/super.h | 2 +-
- fs/ceph/xattr.c | 11 ++++++++---
+ fs/ceph/caps.c | 5 ++++-
+ fs/ceph/snap.c | 4 +++-
+ fs/ceph/super.h | 2 +-
+ fs/ceph/xattr.c | 11 ++++++++---
4 files changed, 16 insertions(+), 6 deletions(-)
-diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
-index d98dcd976c80..ce0f5658720a 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
-@@ -1275,6 +1275,7 @@ static int __send_cap(struct ceph_mds_cl
+@@ -1290,6 +1290,7 @@ static int __send_cap(struct ceph_mds_cl
{
struct ceph_inode_info *ci = cap->ci;
struct inode *inode = &ci->vfs_inode;
@@ -65,7 +63,7 @@ index d98dcd976c80..ce0f5658720a 100644
struct cap_msg_args arg;
int held, revoking;
int wake = 0;
-@@ -1339,7 +1340,7 @@ static int __send_cap(struct ceph_mds_cl
+@@ -1354,7 +1355,7 @@ static int __send_cap(struct ceph_mds_cl
ci->i_requested_max_size = arg.max_size;
if (flushing & CEPH_CAP_XATTR_EXCL) {
@@ -74,7 +72,7 @@ index d98dcd976c80..ce0f5658720a 100644
arg.xattr_version = ci->i_xattrs.version;
arg.xattr_buf = ci->i_xattrs.blob;
} else {
-@@ -1376,6 +1377,8 @@ static int __send_cap(struct ceph_mds_cl
+@@ -1389,6 +1390,8 @@ static int __send_cap(struct ceph_mds_cl
spin_unlock(&ci->i_ceph_lock);
@@ -83,8 +81,6 @@ index d98dcd976c80..ce0f5658720a 100644
ret = send_cap_msg(&arg);
if (ret < 0) {
dout("error sending cap msg, must requeue %p\n", inode);
-diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
-index 4c6494eb02b5..ccfcc66aaf44 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -459,6 +459,7 @@ void ceph_queue_cap_snap(struct ceph_ino
@@ -112,11 +108,9 @@ index 4c6494eb02b5..ccfcc66aaf44 100644
kfree(capsnap);
ceph_put_snap_context(old_snapc);
}
-diff --git a/fs/ceph/super.h b/fs/ceph/super.h
-index d2352fd95dbc..6b9f1ee7de85 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
-@@ -899,7 +899,7 @@ extern int ceph_getattr(const struct pat
+@@ -895,7 +895,7 @@ extern int ceph_getattr(const struct pat
int __ceph_setxattr(struct inode *, const char *, const void *, size_t, int);
ssize_t __ceph_getxattr(struct inode *, const char *, void *, size_t);
extern ssize_t ceph_listxattr(struct dentry *, char *, size_t);
@@ -125,11 +119,9 @@ index d2352fd95dbc..6b9f1ee7de85 100644
extern void __ceph_destroy_xattrs(struct ceph_inode_info *ci);
extern const struct xattr_handler *ceph_xattr_handlers[];
-diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
-index c083557b3657..939eab7aa219 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
-@@ -738,12 +738,15 @@ static int __get_required_blob_size(stru
+@@ -754,12 +754,15 @@ static int __get_required_blob_size(stru
/*
* If there are dirty xattrs, reencode xattrs into the prealloc_blob
@@ -147,7 +139,7 @@ index c083557b3657..939eab7aa219 100644
void *dest;
dout("__build_xattrs_blob %p\n", &ci->vfs_inode);
-@@ -774,12 +777,14 @@ void __ceph_build_xattrs_blob(struct cep
+@@ -790,12 +793,14 @@ void __ceph_build_xattrs_blob(struct cep
dest - ci->i_xattrs.prealloc_blob->vec.iov_base;
if (ci->i_xattrs.blob)
@@ -163,4 +155,3 @@ index c083557b3657..939eab7aa219 100644
}
static inline int __get_request_mask(struct inode *in) {
-
diff --git a/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fill_inode.patch b/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fill_inode.patch
index 9798ed0d0e..6c69fc429a 100644
--- a/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fill_inode.patch
+++ b/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fill_inode.patch
@@ -46,11 +46,9 @@ Signed-off-by: Luis Henriques <lhenriques@suse.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
- fs/ceph/inode.c | 7 ++++---
+ fs/ceph/inode.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
-diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
-index 791f84a13bb8..18500edefc56 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -744,6 +744,7 @@ static int fill_inode(struct inode *inod
@@ -61,7 +59,7 @@ index 791f84a13bb8..18500edefc56 100644
struct ceph_string *pool_ns = NULL;
struct ceph_cap *new_cap = NULL;
int err = 0;
-@@ -881,7 +882,7 @@ static int fill_inode(struct inode *inod
+@@ -874,7 +875,7 @@ static int fill_inode(struct inode *inod
if ((ci->i_xattrs.version == 0 || !(issued & CEPH_CAP_XATTR_EXCL)) &&
le64_to_cpu(info->xattr_version) > ci->i_xattrs.version) {
if (ci->i_xattrs.blob)
@@ -70,7 +68,7 @@ index 791f84a13bb8..18500edefc56 100644
ci->i_xattrs.blob = xattr_blob;
if (xattr_blob)
memcpy(ci->i_xattrs.blob->vec.iov_base,
-@@ -1020,8 +1021,8 @@ static int fill_inode(struct inode *inod
+@@ -1019,8 +1020,8 @@ static int fill_inode(struct inode *inod
out:
if (new_cap)
ceph_put_cap(mdsc, new_cap);
@@ -81,4 +79,3 @@ index 791f84a13bb8..18500edefc56 100644
ceph_put_string(pool_ns);
return err;
}
-
diff --git a/patches.suse/ceph-fix-ceph-dir-rctime-vxattr-value.patch b/patches.suse/ceph-fix-ceph-dir-rctime-vxattr-value.patch
index cd66f850e6..b54da58a5e 100644
--- a/patches.suse/ceph-fix-ceph-dir-rctime-vxattr-value.patch
+++ b/patches.suse/ceph-fix-ceph-dir-rctime-vxattr-value.patch
@@ -15,11 +15,9 @@ Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Acked-by: Luis Henriques <lhenriques@suse.com>
---
- fs/ceph/xattr.c | 2 +-
+ fs/ceph/xattr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
-index 57350e4b7da0..d2fb9f10720c 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -223,7 +223,7 @@ static size_t ceph_vxattrcb_dir_rbytes(s
@@ -31,4 +29,3 @@ index 57350e4b7da0..d2fb9f10720c 100644
(long)ci->i_rctime.tv_nsec);
}
-
diff --git a/patches.suse/cifs-Fix-use-after-free-in-SMB2_read.patch b/patches.suse/cifs-Fix-use-after-free-in-SMB2_read.patch
index 17c5d49528..24b3b641df 100644
--- a/patches.suse/cifs-Fix-use-after-free-in-SMB2_read.patch
+++ b/patches.suse/cifs-Fix-use-after-free-in-SMB2_read.patch
@@ -3,7 +3,7 @@ Date: Sat, 6 Apr 2019 15:47:39 +0800
Subject: [PATCH] cifs: Fix use-after-free in SMB2_read
Git-commit: 088aaf17aa79300cab14dbee2569c58cfafd7d6e
Patch-mainline: v5.1-rc6
-References: bsc#1144333
+References: bsc#1144333, CVE-2019-15920, bsc#1149626
There is a KASAN use-after-free:
BUG: KASAN: use-after-free in SMB2_read+0x1136/0x1190
diff --git a/patches.suse/cifs-Fix-use-after-free-in-SMB2_write.patch b/patches.suse/cifs-Fix-use-after-free-in-SMB2_write.patch
index f484ff2a94..48c747ebc5 100644
--- a/patches.suse/cifs-Fix-use-after-free-in-SMB2_write.patch
+++ b/patches.suse/cifs-Fix-use-after-free-in-SMB2_write.patch
@@ -3,7 +3,7 @@ Date: Sat, 6 Apr 2019 15:47:38 +0800
Subject: [PATCH] cifs: Fix use-after-free in SMB2_write
Git-commit: 6a3eb3360667170988f8a6477f6686242061488a
Patch-mainline: v5.1-rc6
-References: bsc#1144333
+References: bsc#1144333, CVE-2019-15919, bsc#1149552
There is a KASAN use-after-free:
BUG: KASAN: use-after-free in SMB2_write+0x1342/0x1580
diff --git a/patches.suse/drm-amdgpu-psp-move-psp-version-specific-function-po.patch b/patches.suse/drm-amdgpu-psp-move-psp-version-specific-function-po.patch
index 4c2916382b..69488d740e 100644
--- a/patches.suse/drm-amdgpu-psp-move-psp-version-specific-function-po.patch
+++ b/patches.suse/drm-amdgpu-psp-move-psp-version-specific-function-po.patch
@@ -1,13 +1,14 @@
From 9d6fea5744d6798353f37ac42a8a653a2607ca69 Mon Sep 17 00:00:00 2001
From: Alex Deucher <alexander.deucher@amd.com>
Date: Wed, 8 May 2019 21:45:06 -0500
-Subject: [PATCH] drm/amdgpu/psp: move psp version specific function pointers to early_init
-Mime-version: 1.0
-Content-type: text/plain; charset=UTF-8
-Content-transfer-encoding: 8bit
+Subject: drm/amdgpu/psp: move psp version specific function pointers to
+ early_init
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
Git-commit: 9d6fea5744d6798353f37ac42a8a653a2607ca69
Patch-mainline: v5.2-rc1
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
In case we need to use them for GPU reset prior initializing the
asic. Fixes a crash if the driver attempts to reset the GPU at driver
@@ -16,15 +17,14 @@ load time.
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
-@@ -37,18 +37,10 @@ static void psp_set_funcs(struct amdgpu_
+@@ -36,18 +36,10 @@ static void psp_set_funcs(struct amdgpu_
static int psp_early_init(void *handle)
{
struct amdgpu_device *adev = (struct amdgpu_device *)handle;
diff --git a/patches.suse/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch b/patches.suse/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch
index e1b0330ccd..59d4199528 100644
--- a/patches.suse/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch
+++ b/patches.suse/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch
@@ -1,10 +1,10 @@
From be132e1375c1fffe48801296279079f8a59a9ed3 Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Thu, 27 Jun 2019 16:42:00 +0200
-Subject: [PATCH] drm/etnaviv: add missing failure path to destroy suballoc
+Subject: drm/etnaviv: add missing failure path to destroy suballoc
Git-commit: be132e1375c1fffe48801296279079f8a59a9ed3
Patch-mainline: v5.2
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
When something goes wrong in the GPU init after the cmdbuf suballocator
has been constructed, we fail to destroy it properly. This causes havok
@@ -13,17 +13,14 @@ later when the GPU is unbound due to a module unload or similar.
Fixes: e66774dd6f6a (drm/etnaviv: add cmdbuf suballocator)
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Tested-by: Russell King <rmk+kernel@armlinux.org.uk>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 7 +++++--
+ drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
-diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
-index 72d01e873160..5418a1a87b2c 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
-@@ -760,7 +760,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+@@ -705,7 +705,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu
if (IS_ERR(gpu->cmdbuf_suballoc)) {
dev_err(gpu->dev, "Failed to create cmdbuf suballocator\n");
ret = PTR_ERR(gpu->cmdbuf_suballoc);
@@ -32,7 +29,7 @@ index 72d01e873160..5418a1a87b2c 100644
}
/* Create buffer: */
-@@ -768,7 +768,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+@@ -713,7 +713,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu
PAGE_SIZE);
if (ret) {
dev_err(gpu->dev, "could not create command buffer\n");
@@ -41,7 +38,7 @@ index 72d01e873160..5418a1a87b2c 100644
}
if (gpu->mmu->version == ETNAVIV_IOMMU_V1 &&
-@@ -800,6 +800,9 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+@@ -746,6 +746,9 @@ int etnaviv_gpu_init(struct etnaviv_gpu
free_buffer:
etnaviv_cmdbuf_free(&gpu->buffer);
gpu->buffer.suballoc = NULL;
@@ -51,6 +48,3 @@ index 72d01e873160..5418a1a87b2c 100644
destroy_iommu:
etnaviv_iommu_destroy(gpu->mmu);
gpu->mmu = NULL;
---
-2.16.4
-
diff --git a/patches.suse/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch b/patches.suse/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch
index b9fe49c71e..fe17b0dbf0 100644
--- a/patches.suse/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch
+++ b/patches.suse/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch
@@ -1,11 +1,11 @@
From 73a0ff0b30af79bf0303d557eb82f1d1945bb6ee Mon Sep 17 00:00:00 2001
From: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
Date: Fri, 12 Jul 2019 11:19:38 +0300
-Subject: [PATCH] drm/i915: Fix wrong escape clock divisor init for GLK
+Subject: drm/i915: Fix wrong escape clock divisor init for GLK
Git-commit: 73a0ff0b30af79bf0303d557eb82f1d1945bb6ee
Patch-mainline: v5.3-rc4
+References: bsc#1051510 bsc#1142635
No-fix: ce52ad5dd52cfaf3398058384e0ff94134bbd89c
-References: bsc#1051510
According to Bspec clock divisor registers in GeminiLake
should be initialized by shifting 1(<<) to amount of correspondent
@@ -14,8 +14,8 @@ divisor. While i915 was writing all this time that value as is.
Surprisingly that it by accident worked, until we met some issues
with Microtech Etab.
-V2: Added Fixes tag and cc
-V3: Added stable to cc as well.
+v2: Added Fixes tag and cc
+v3: Added stable to cc as well.
Signed-off-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
Reviewed-by: Vandita Kulkarni <vandita.kulkarni@intel.com>
@@ -32,18 +32,15 @@ Cc: stable@vger.kernel.org
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190712081938.14185-1-stanislav.lisovskiy@intel.com
(cherry picked from commit ce52ad5dd52cfaf3398058384e0ff94134bbd89c)
-
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/i915/display/vlv_dsi_pll.c | 4 ++--
+ drivers/gpu/drm/i915/vlv_dsi_pll.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/drivers/gpu/drm/i915/display/vlv_dsi_pll.c b/drivers/gpu/drm/i915/display/vlv_dsi_pll.c
-index 99cc3e2e9c2c..f016a776a39e 100644
--- a/drivers/gpu/drm/i915/vlv_dsi_pll.c
+++ b/drivers/gpu/drm/i915/vlv_dsi_pll.c
-@@ -396,8 +396,8 @@ static void glk_dsi_program_esc_clock(struct drm_device *dev,
+@@ -422,8 +422,8 @@ static void glk_dsi_program_esc_clock(st
else
txesc2_div = 10;
@@ -54,6 +51,3 @@ index 99cc3e2e9c2c..f016a776a39e 100644
}
/* Program BXT Mipi clocks and dividers */
---
-2.16.4
-
diff --git a/patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch b/patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch
index 0e45493703..09eb704be2 100644
--- a/patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch
+++ b/patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch
@@ -1,11 +1,11 @@
From 06c12ae3b401238477e65e8c4e04e065699a6115 Mon Sep 17 00:00:00 2001
From: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Date: Tue, 9 Jul 2019 15:33:39 +0300
-Subject: [PATCH] drm/i915/perf: ensure we keep a reference on the driver
+Subject: drm/i915/perf: ensure we keep a reference on the driver
Git-commit: 06c12ae3b401238477e65e8c4e04e065699a6115
Patch-mainline: v5.3-rc3
+References: bsc#1051510 bsc#1142635
No-fix: a5af1df716c123a09341351008fc497bea137b77
-References: bsc#1051510
The i915 perf stream has its own file descriptor and is tied to
reference of the driver. We haven't taken care of keep the driver
@@ -18,19 +18,15 @@ Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20190709123351.5645-2-lionel.g.landwerlin@intel.com
(cherry picked from commit a5af1df716c123a09341351008fc497bea137b77)
-
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/i915/i915_perf.c | 8 ++++++++
+ drivers/gpu/drm/i915/i915_perf.c | 8 ++++++++
1 file changed, 8 insertions(+)
-diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
-index 1ae06a1b6749..629511ea9a18 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
-@@ -2515,6 +2515,9 @@ static int i915_perf_release(struct inode *inode, struct file *file)
+@@ -2523,6 +2523,9 @@ static int i915_perf_release(struct inod
i915_perf_destroy_locked(stream);
mutex_unlock(&dev_priv->perf.lock);
@@ -40,7 +36,7 @@ index 1ae06a1b6749..629511ea9a18 100644
return 0;
}
-@@ -2650,6 +2653,11 @@ i915_perf_open_ioctl_locked(struct drm_i915_private *dev_priv,
+@@ -2658,6 +2661,11 @@ i915_perf_open_ioctl_locked(struct drm_i
if (!(param->flags & I915_PERF_FLAG_DISABLED))
i915_perf_enable_locked(stream);
@@ -52,6 +48,3 @@ index 1ae06a1b6749..629511ea9a18 100644
return stream_fd;
err_open:
---
-2.16.4
-
diff --git a/patches.suse/drm-imx-notify-drm-core-before-sending-event-during-.patch b/patches.suse/drm-imx-notify-drm-core-before-sending-event-during-.patch
index 1c2e9dd01d..5c424acc8c 100644
--- a/patches.suse/drm-imx-notify-drm-core-before-sending-event-during-.patch
+++ b/patches.suse/drm-imx-notify-drm-core-before-sending-event-during-.patch
@@ -1,10 +1,10 @@
From 78c68e8f5cd24bd32ba4ca1cdfb0c30cf0642685 Mon Sep 17 00:00:00 2001
From: Robert Beckett <bob.beckett@collabora.com>
Date: Tue, 25 Jun 2019 18:59:13 +0100
-Subject: [PATCH] drm/imx: notify drm core before sending event during crtc disable
+Subject: drm/imx: notify drm core before sending event during crtc disable
Git-commit: 78c68e8f5cd24bd32ba4ca1cdfb0c30cf0642685
Patch-mainline: v5.2
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
Notify drm core before sending pending events during crtc disable.
This fixes the first event after disable having an old stale timestamp
@@ -28,8 +28,7 @@ Fixes: a474478642d5 ("drm/imx: fix crtc vblank state regression")
Signed-off-by: Robert Beckett <bob.beckett@collabora.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/imx/ipuv3-crtc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
@@ -56,5 +55,5 @@ index 9cc1d678674f..e04d6efff1b5 100644
static void imx_drm_crtc_reset(struct drm_crtc *crtc)
--
-2.16.4
+2.22.0
diff --git a/patches.suse/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch b/patches.suse/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch
index 2ac3f6b068..40f9da3b6a 100644
--- a/patches.suse/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch
+++ b/patches.suse/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch
@@ -1,10 +1,10 @@
From 5aeab2bfc9ffa72d3ca73416635cb3785dfc076f Mon Sep 17 00:00:00 2001
From: Robert Beckett <bob.beckett@collabora.com>
Date: Tue, 25 Jun 2019 18:59:15 +0100
-Subject: [PATCH] drm/imx: only send event on crtc disable if kept disabled
+Subject: drm/imx: only send event on crtc disable if kept disabled
Git-commit: 5aeab2bfc9ffa72d3ca73416635cb3785dfc076f
Patch-mainline: v5.2
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
The event will be sent as part of the vblank enable during the modeset
if the crtc is not being kept disabled.
@@ -14,8 +14,7 @@ Fixes: 5f2f911578fb ("drm/imx: atomic phase 3 step 1: Use atomic configuration")
Signed-off-by: Robert Beckett <bob.beckett@collabora.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
@@ -34,5 +33,5 @@ index e04d6efff1b5..c436a28d50e4 100644
crtc->state->event = NULL;
}
--
-2.16.4
+2.22.0
diff --git a/patches.suse/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch b/patches.suse/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch
index fb671f18d2..48fda0cf3d 100644
--- a/patches.suse/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch
+++ b/patches.suse/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch
@@ -1,27 +1,24 @@
From cf49b24ffa62766f8f04cd1c4cf17b75d29b240a Mon Sep 17 00:00:00 2001
From: Hsin-Yi Wang <hsinyi@chromium.org>
Date: Wed, 29 May 2019 18:25:54 +0800
-Subject: [PATCH] drm/mediatek: call drm_atomic_helper_shutdown() when unbinding driver
+Subject: drm/mediatek: call drm_atomic_helper_shutdown() when unbinding driver
Git-commit: cf49b24ffa62766f8f04cd1c4cf17b75d29b240a
Patch-mainline: v5.2-rc5
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
shutdown all CRTC when unbinding drm driver.
Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
1 file changed, 1 insertion(+)
-diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
-index e7362bdafa82..8718d123ccaa 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
-@@ -311,6 +311,7 @@ static int mtk_drm_kms_init(struct drm_device *drm)
+@@ -265,6 +265,7 @@ err_config_cleanup:
static void mtk_drm_kms_deinit(struct drm_device *drm)
{
drm_kms_helper_poll_fini(drm);
@@ -29,6 +26,3 @@ index e7362bdafa82..8718d123ccaa 100644
component_unbind_all(drm->dev, drm);
drm_mode_config_cleanup(drm);
---
-2.16.4
-
diff --git a/patches.suse/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch b/patches.suse/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch
index ff5c60736c..d38353f2b9 100644
--- a/patches.suse/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch
+++ b/patches.suse/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch
@@ -1,10 +1,10 @@
From 2458d9d6d94be982b917e93c61a89b4426f32e31 Mon Sep 17 00:00:00 2001
From: Hsin-Yi Wang <hsinyi@chromium.org>
Date: Thu, 30 May 2019 17:18:47 +0800
-Subject: [PATCH] drm/mediatek: call mtk_dsi_stop() after mtk_drm_crtc_atomic_disable()
+Subject: drm/mediatek: call mtk_dsi_stop() after mtk_drm_crtc_atomic_disable()
Git-commit: 2458d9d6d94be982b917e93c61a89b4426f32e31
Patch-mainline: v5.2-rc5
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
mtk_dsi_stop() should be called after mtk_drm_crtc_atomic_disable(), which
needs ovl irq for drm_crtc_wait_one_vblank(), since after mtk_dsi_stop() is
@@ -32,8 +32,7 @@ mtk_dsi_stop() called in mtk_dsi_poweroff() when refcount is 0.
Fixes: 0707632b5bac ("drm/mediatek: update DSI sub driver flow for sending commands to panel")
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/mediatek/mtk_dsi.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
@@ -67,5 +66,5 @@ index 1ae3be99e0ff..179f2b080342 100644
dsi->enabled = false;
--
-2.16.4
+2.22.0
diff --git a/patches.suse/drm-mediatek-clear-num_pipes-when-unbind-driver.patch b/patches.suse/drm-mediatek-clear-num_pipes-when-unbind-driver.patch
index 408997ee98..a9ff6630dc 100644
--- a/patches.suse/drm-mediatek-clear-num_pipes-when-unbind-driver.patch
+++ b/patches.suse/drm-mediatek-clear-num_pipes-when-unbind-driver.patch
@@ -1,10 +1,10 @@
From a4cd1d2b016d5d043ab2c4b9c4ec50a5805f5396 Mon Sep 17 00:00:00 2001
From: Hsin-Yi Wang <hsinyi@chromium.org>
Date: Wed, 29 May 2019 18:25:55 +0800
-Subject: [PATCH] drm/mediatek: clear num_pipes when unbind driver
+Subject: drm/mediatek: clear num_pipes when unbind driver
Git-commit: a4cd1d2b016d5d043ab2c4b9c4ec50a5805f5396
Patch-mainline: v5.2-rc5
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
num_pipes is used for mutex created in mtk_drm_crtc_create(). If we
don't clear num_pipes count, when rebinding driver, the count will
@@ -14,17 +14,14 @@ be accumulated. From mtk_disp_mutex_get(), there can only be at most
Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
1 file changed, 1 insertion(+)
-diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
-index 8718d123ccaa..bbfe3a464aea 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
-@@ -400,6 +400,7 @@ static void mtk_drm_unbind(struct device *dev)
+@@ -351,6 +351,7 @@ static void mtk_drm_unbind(struct device
drm_dev_unregister(private->drm);
mtk_drm_kms_deinit(private->drm);
drm_dev_put(private->drm);
@@ -32,6 +29,3 @@ index 8718d123ccaa..bbfe3a464aea 100644
private->drm = NULL;
}
---
-2.16.4
-
diff --git a/patches.suse/drm-mediatek-fix-unbind-functions.patch b/patches.suse/drm-mediatek-fix-unbind-functions.patch
index 29f453ab42..bff0f3d083 100644
--- a/patches.suse/drm-mediatek-fix-unbind-functions.patch
+++ b/patches.suse/drm-mediatek-fix-unbind-functions.patch
@@ -1,10 +1,10 @@
From 8fd7a37b191f93737f6280a9b5de65f98acc12c9 Mon Sep 17 00:00:00 2001
From: Hsin-Yi Wang <hsinyi@chromium.org>
Date: Wed, 29 May 2019 18:25:52 +0800
-Subject: [PATCH] drm/mediatek: fix unbind functions
+Subject: drm/mediatek: fix unbind functions
Git-commit: 8fd7a37b191f93737f6280a9b5de65f98acc12c9
Patch-mainline: v5.2-rc5
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
detatch panel in mtk_dsi_destroy_conn_enc(), since .bind will try to
attach it again.
@@ -12,8 +12,7 @@ attach it again.
Fixes: 2e54c14e310f ("drm/mediatek: Add DSI sub driver")
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/mediatek/mtk_dsi.c | 2 ++
1 file changed, 2 insertions(+)
@@ -32,5 +31,5 @@ index b00eb2d2e086..1ae3be99e0ff 100644
static void mtk_dsi_ddp_start(struct mtk_ddp_comp *comp)
--
-2.16.4
+2.22.0
diff --git a/patches.suse/drm-mediatek-mtk_drm_drv.c-Add-of_node_put-before-go.patch b/patches.suse/drm-mediatek-mtk_drm_drv.c-Add-of_node_put-before-go.patch
index a3db7b22f1..786a7549b0 100644
--- a/patches.suse/drm-mediatek-mtk_drm_drv.c-Add-of_node_put-before-go.patch
+++ b/patches.suse/drm-mediatek-mtk_drm_drv.c-Add-of_node_put-before-go.patch
@@ -1,10 +1,10 @@
From 165d42c012be69900f0e2f8545626cb9e7d4a832 Mon Sep 17 00:00:00 2001
From: Nishka Dasgupta <nishkadg.linux@gmail.com>
Date: Sat, 6 Jul 2019 19:00:21 +0530
-Subject: [PATCH] drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
+Subject: drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
Git-commit: 165d42c012be69900f0e2f8545626cb9e7d4a832
Patch-mainline: v5.3-rc6
-References: bsc#1111666
+References: bsc#1111666 bsc#1142635
Each iteration of for_each_child_of_node puts the previous
node, but in the case of a goto from the middle of the loop, there is
@@ -16,8 +16,7 @@ Fixes: 119f5173628a (drm/mediatek: Add DRM Driver for Mediatek SoC MT8173)
Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/mediatek/mtk_drm_drv.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
@@ -44,5 +43,5 @@ index c021d4c8324f..7f5408cb2377 100644
private->ddp_comp[comp_id] = comp;
}
--
-2.16.4
+2.22.0
diff --git a/patches.suse/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch b/patches.suse/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch
index 05fc9c54aa..98f5c2410c 100644
--- a/patches.suse/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch
+++ b/patches.suse/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch
@@ -1,10 +1,10 @@
From f0fd848342802bc0f74620d387eead53e8905804 Mon Sep 17 00:00:00 2001
From: Hsin-Yi Wang <hsinyi@chromium.org>
Date: Wed, 29 May 2019 18:25:53 +0800
-Subject: [PATCH] drm/mediatek: unbind components in mtk_drm_unbind()
+Subject: drm/mediatek: unbind components in mtk_drm_unbind()
Git-commit: f0fd848342802bc0f74620d387eead53e8905804
Patch-mainline: v5.2-rc5
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
Unbinding components (i.e. mtk_dsi and mtk_disp_ovl/rdma/color) will
trigger master(mtk_drm)'s .unbind(), and currently mtk_drm's unbind
@@ -20,17 +20,14 @@ called here.
Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 6 +-----
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
-diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
-index 57ce4708ef1b..e7362bdafa82 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
-@@ -397,6 +397,7 @@ static void mtk_drm_unbind(struct device *dev)
+@@ -348,6 +348,7 @@ static void mtk_drm_unbind(struct device
struct mtk_drm_private *private = dev_get_drvdata(dev);
drm_dev_unregister(private->drm);
@@ -38,7 +35,7 @@ index 57ce4708ef1b..e7362bdafa82 100644
drm_dev_put(private->drm);
private->drm = NULL;
}
-@@ -568,13 +569,8 @@ static int mtk_drm_probe(struct platform_device *pdev)
+@@ -497,13 +498,8 @@ err_node:
static int mtk_drm_remove(struct platform_device *pdev)
{
struct mtk_drm_private *private = platform_get_drvdata(pdev);
@@ -52,6 +49,3 @@ index 57ce4708ef1b..e7362bdafa82 100644
component_master_del(&pdev->dev, &mtk_drm_ops);
pm_runtime_disable(&pdev->dev);
of_node_put(private->mutex_node);
---
-2.16.4
-
diff --git a/patches.suse/drm-mediatek-use-correct-device-to-import-PRIME-buff.patch b/patches.suse/drm-mediatek-use-correct-device-to-import-PRIME-buff.patch
index 3ff6bbb579..66a335b904 100644
--- a/patches.suse/drm-mediatek-use-correct-device-to-import-PRIME-buff.patch
+++ b/patches.suse/drm-mediatek-use-correct-device-to-import-PRIME-buff.patch
@@ -1,10 +1,10 @@
From 4c6f3196e6ea111c456c6086dc3f57d4706b0b2d Mon Sep 17 00:00:00 2001
From: Alexandre Courbot <acourbot@chromium.org>
Date: Mon, 29 Jul 2019 14:33:34 +0900
-Subject: [PATCH] drm/mediatek: use correct device to import PRIME buffers
+Subject: drm/mediatek: use correct device to import PRIME buffers
Git-commit: 4c6f3196e6ea111c456c6086dc3f57d4706b0b2d
Patch-mainline: v5.3-rc6
-References: bsc#1111666
+References: bsc#1111666 bsc#1142635
PRIME buffers should be imported using the DMA device. To this end, use
a custom import function that mimics drm_gem_prime_import_dev(), but
@@ -13,8 +13,7 @@ passes the correct device.
Fixes: 119f5173628aa ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Alexandre Courbot <acourbot@chromium.org>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/mediatek/mtk_drm_drv.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
@@ -52,5 +51,5 @@ index 95fdbd0fbcac..8b18a00a58c7 100644
.gem_prime_import_sg_table = mtk_gem_prime_import_sg_table,
.gem_prime_mmap = mtk_drm_gem_mmap_buf,
--
-2.16.4
+2.22.0
diff --git a/patches.suse/drm-msm-mdp5-Fix-mdp5_cfg_init-error-return.patch b/patches.suse/drm-msm-mdp5-Fix-mdp5_cfg_init-error-return.patch
index 37ca0495b1..4670b0d4ff 100644
--- a/patches.suse/drm-msm-mdp5-Fix-mdp5_cfg_init-error-return.patch
+++ b/patches.suse/drm-msm-mdp5-Fix-mdp5_cfg_init-error-return.patch
@@ -1,10 +1,10 @@
From fc19cbb785d7bbd1a1af26229b5240a3ab332744 Mon Sep 17 00:00:00 2001
From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
Date: Tue, 21 May 2019 08:00:30 -0700
-Subject: [PATCH] drm/msm/mdp5: Fix mdp5_cfg_init error return
+Subject: drm/msm/mdp5: Fix mdp5_cfg_init error return
Git-commit: fc19cbb785d7bbd1a1af26229b5240a3ab332744
Patch-mainline: v5.3-rc1
-References: bsc#1111666
+References: bsc#1111666 bsc#1142635
If mdp5_cfg_init fails because of an unknown major version, a null pointer
dereference occurs. This is because the caller of init expects error
@@ -15,17 +15,14 @@ Fixes: 2e362e1772b8 (drm/msm/mdp5: introduce mdp5_cfg module)
Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
-index ea8f7d7daf7f..52e23780fce1 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
-@@ -721,7 +721,7 @@ struct mdp5_cfg_handler *mdp5_cfg_init(struct mdp5_kms *mdp5_kms,
+@@ -633,7 +633,7 @@ fail:
if (cfg_handler)
mdp5_cfg_destroy(cfg_handler);
@@ -34,6 +31,3 @@ index ea8f7d7daf7f..52e23780fce1 100644
}
static struct mdp5_cfg_platform *mdp5_get_config(struct platform_device *dev)
---
-2.16.4
-
diff --git a/patches.suse/drm-nouveau-Don-t-retry-infinitely-when-receiving-no.patch b/patches.suse/drm-nouveau-Don-t-retry-infinitely-when-receiving-no.patch
new file mode 100644
index 0000000000..931b32d0b4
--- /dev/null
+++ b/patches.suse/drm-nouveau-Don-t-retry-infinitely-when-receiving-no.patch
@@ -0,0 +1,107 @@
+From c358ebf59634f06d8ed176da651ec150df3c8686 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Thu, 25 Jul 2019 15:40:01 -0400
+Subject: drm/nouveau: Don't retry infinitely when receiving no data on i2c
+ over AUX
+Git-commit: c358ebf59634f06d8ed176da651ec150df3c8686
+Patch-mainline: v5.3-rc6
+References: bsc#1142635
+
+While I had thought I had fixed this issue in:
+
+commit 342406e4fbba ("drm/nouveau/i2c: Disable i2c bus access after
+->fini()")
+
+It turns out that while I did fix the error messages I was seeing on my
+P50 when trying to access i2c busses with the GPU in runtime suspend, I
+accidentally had missed one important detail that was mentioned on the
+bug report this commit was supposed to fix: that the CPU would only lock
+up when trying to access i2c busses _on connected devices_ _while the
+GPU is not in runtime suspend_. Whoops. That definitely explains why I
+was not able to get my machine to hang with i2c bus interactions until
+now, as plugging my P50 into it's dock with an HDMI monitor connected
+allowed me to finally reproduce this locally.
+
+Now that I have managed to reproduce this issue properly, it looks like
+the problem is much simpler then it looks. It turns out that some
+connected devices, such as MST laptop docks, will actually ACK i2c reads
+even if no data was actually read:
+
+[ 275.063043] nouveau 0000:01:00.0: i2c: aux 000a: 1: 0000004c 1
+[ 275.063447] nouveau 0000:01:00.0: i2c: aux 000a: 00 01101000 10040000
+[ 275.063759] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000001
+[ 275.064024] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000000
+[ 275.064285] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000000
+[ 275.064594] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000000
+
+Because we don't handle the situation of i2c ack without any data, we
+end up entering an infinite loop in nvkm_i2c_aux_i2c_xfer() since the
+value of cnt always remains at 0. This finally properly explains how
+this could result in a CPU hang like the ones observed in the
+aforementioned commit.
+
+So, fix this by retrying transactions if no data is written or received,
+and give up and fail the transaction if we continue to not write or
+receive any data after 32 retries.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c | 24 +++++++++++++------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
+index b4e7404fe660..a11637b0f6cc 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
+@@ -40,8 +40,7 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ u8 *ptr = msg->buf;
+
+ while (remaining) {
+- u8 cnt = (remaining > 16) ? 16 : remaining;
+- u8 cmd;
++ u8 cnt, retries, cmd;
+
+ if (msg->flags & I2C_M_RD)
+ cmd = 1;
+@@ -51,10 +50,19 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ if (mcnt || remaining > 16)
+ cmd |= 4; /* MOT */
+
+- ret = aux->func->xfer(aux, true, cmd, msg->addr, ptr, &cnt);
+- if (ret < 0) {
+- nvkm_i2c_aux_release(aux);
+- return ret;
++ for (retries = 0, cnt = 0;
++ retries < 32 && !cnt;
++ retries++) {
++ cnt = min_t(u8, remaining, 16);
++ ret = aux->func->xfer(aux, true, cmd,
++ msg->addr, ptr, &cnt);
++ if (ret < 0)
++ goto out;
++ }
++ if (!cnt) {
++ AUX_TRACE(aux, "no data after 32 retries");
++ ret = -EIO;
++ goto out;
+ }
+
+ ptr += cnt;
+@@ -64,8 +72,10 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ msg++;
+ }
+
++ ret = num;
++out:
+ nvkm_i2c_aux_release(aux);
+- return num;
++ return ret;
+ }
+
+ static u32
+--
+2.22.0
+
diff --git a/patches.suse/drm-rockchip-Suspend-DP-late.patch b/patches.suse/drm-rockchip-Suspend-DP-late.patch
index 1d86d66a3b..11e56910b9 100644
--- a/patches.suse/drm-rockchip-Suspend-DP-late.patch
+++ b/patches.suse/drm-rockchip-Suspend-DP-late.patch
@@ -1,10 +1,10 @@
From f7ccbed656f78212593ca965d9a8f34bf24e0aab Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Fri, 2 Aug 2019 11:46:16 -0700
-Subject: [PATCH] drm/rockchip: Suspend DP late
+Subject: drm/rockchip: Suspend DP late
Git-commit: f7ccbed656f78212593ca965d9a8f34bf24e0aab
Patch-mainline: v5.3-rc4
-References: bsc#1051510
+References: bsc#1051510 bsc#1142635
In commit fe64ba5c6323 ("drm/rockchip: Resume DP early") we moved
resume to be early but left suspend at its normal time. This seems
@@ -22,17 +22,14 @@ Fixes: fe64ba5c6323 ("drm/rockchip: Resume DP early")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190802184616.44822-1-dianders@chromium.org
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 2 +-
+ drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
-index 95e5c517a15f..9aae3d8e99ef 100644
--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
-@@ -432,7 +432,7 @@ static int rockchip_dp_resume(struct device *dev)
+@@ -428,7 +428,7 @@ static int rockchip_dp_remove(struct pla
static const struct dev_pm_ops rockchip_dp_pm_ops = {
#ifdef CONFIG_PM_SLEEP
@@ -41,6 +38,3 @@ index 95e5c517a15f..9aae3d8e99ef 100644
.resume_early = rockchip_dp_resume,
#endif
};
---
-2.16.4
-
diff --git a/patches.suse/drm-udl-introduce-a-macro-to-convert-dev-to-udl.patch b/patches.suse/drm-udl-introduce-a-macro-to-convert-dev-to-udl.patch
index 8048420148..8b0896bdc1 100644
--- a/patches.suse/drm-udl-introduce-a-macro-to-convert-dev-to-udl.patch
+++ b/patches.suse/drm-udl-introduce-a-macro-to-convert-dev-to-udl.patch
@@ -1,30 +1,27 @@
From fd96e0dba19c53c2d66f2a398716bb74df8ca85e Mon Sep 17 00:00:00 2001
From: Dave Airlie <airlied@redhat.com>
Date: Fri, 5 Apr 2019 13:17:14 +1000
-Subject: [PATCH] drm/udl: introduce a macro to convert dev to udl.
+Subject: drm/udl: introduce a macro to convert dev to udl.
Git-commit: fd96e0dba19c53c2d66f2a398716bb74df8ca85e
Patch-mainline: v5.2-rc1
-References: bsc#1111666
+References: bsc#1111666 bsc#1113722
This just makes it easier to later embed drm into udl.
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190405031715.5959-3-airlied@gmail.com
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/udl/udl_drv.h | 2 ++
- drivers/gpu/drm/udl/udl_fb.c | 10 +++++-----
- drivers/gpu/drm/udl/udl_gem.c | 2 +-
- drivers/gpu/drm/udl/udl_main.c | 12 ++++++------
+ drivers/gpu/drm/udl/udl_drv.h | 2 ++
+ drivers/gpu/drm/udl/udl_fb.c | 10 +++++-----
+ drivers/gpu/drm/udl/udl_gem.c | 2 +-
+ drivers/gpu/drm/udl/udl_main.c | 12 ++++++------
4 files changed, 14 insertions(+), 12 deletions(-)
-diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
-index 4ae67d882eae..b3e08e876d62 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
-@@ -71,6 +71,8 @@ struct udl_device {
+@@ -68,6 +68,8 @@ struct udl_device {
atomic_t cpu_kcycles_used; /* transpired during pixel processing */
};
@@ -33,11 +30,9 @@ index 4ae67d882eae..b3e08e876d62 100644
struct udl_gem_object {
struct drm_gem_object base;
struct page **pages;
-diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
-index f8ff5a6f559e..16593d4f02b4 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
-@@ -82,7 +82,7 @@ int udl_handle_damage(struct udl_framebuffer *fb, int x, int y,
+@@ -82,7 +82,7 @@ int udl_handle_damage(struct udl_framebu
int width, int height)
{
struct drm_device *dev = fb->base.dev;
@@ -46,7 +41,7 @@ index f8ff5a6f559e..16593d4f02b4 100644
int i, ret;
char *cmd;
cycles_t start_cycles, end_cycles;
-@@ -210,7 +210,7 @@ static int udl_fb_open(struct fb_info *info, int user)
+@@ -210,7 +210,7 @@ static int udl_fb_open(struct fb_info *i
{
struct udl_fbdev *ufbdev = info->par;
struct drm_device *dev = ufbdev->ufb.base.dev;
@@ -55,7 +50,7 @@ index f8ff5a6f559e..16593d4f02b4 100644
/* If the USB device is gone, we don't accept new opens */
if (drm_dev_is_unplugged(udl->ddev))
-@@ -437,7 +437,7 @@ static void udl_fbdev_destroy(struct drm_device *dev,
+@@ -442,7 +442,7 @@ static void udl_fbdev_destroy(struct drm
int udl_fbdev_init(struct drm_device *dev)
{
@@ -64,7 +59,7 @@ index f8ff5a6f559e..16593d4f02b4 100644
int bpp_sel = fb_bpp;
struct udl_fbdev *ufbdev;
int ret;
-@@ -476,7 +476,7 @@ int udl_fbdev_init(struct drm_device *dev)
+@@ -481,7 +481,7 @@ free:
void udl_fbdev_cleanup(struct drm_device *dev)
{
@@ -73,7 +68,7 @@ index f8ff5a6f559e..16593d4f02b4 100644
if (!udl->fbdev)
return;
-@@ -487,7 +487,7 @@ void udl_fbdev_cleanup(struct drm_device *dev)
+@@ -492,7 +492,7 @@ void udl_fbdev_cleanup(struct drm_device
void udl_fbdev_unplug(struct drm_device *dev)
{
@@ -82,8 +77,6 @@ index f8ff5a6f559e..16593d4f02b4 100644
struct udl_fbdev *ufbdev;
if (!udl->fbdev)
return;
-diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
-index bb7b58407039..3b3e17652bb2 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -203,7 +203,7 @@ int udl_gem_mmap(struct drm_file *file, struct drm_device *dev,
@@ -95,8 +88,6 @@ index bb7b58407039..3b3e17652bb2 100644
int ret = 0;
mutex_lock(&udl->gem_lock);
-diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
-index 1f8ef34ade24..862c099d7c4c 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -30,7 +30,7 @@
@@ -108,7 +99,7 @@ index 1f8ef34ade24..862c099d7c4c 100644
char *desc;
char *buf;
char *desc_end;
-@@ -166,7 +166,7 @@ void udl_urb_completion(struct urb *urb)
+@@ -164,7 +164,7 @@ void udl_urb_completion(struct urb *urb)
static void udl_free_urb_list(struct drm_device *dev)
{
@@ -117,7 +108,7 @@ index 1f8ef34ade24..862c099d7c4c 100644
int count = udl->urbs.count;
struct list_head *node;
struct urb_node *unode;
-@@ -199,7 +199,7 @@ static void udl_free_urb_list(struct drm_device *dev)
+@@ -198,7 +198,7 @@ static void udl_free_urb_list(struct drm
static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size)
{
@@ -126,7 +117,7 @@ index 1f8ef34ade24..862c099d7c4c 100644
struct urb *urb;
struct urb_node *unode;
char *buf;
-@@ -263,7 +263,7 @@ static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size)
+@@ -262,7 +262,7 @@ retry:
struct urb *udl_get_urb(struct drm_device *dev)
{
@@ -135,7 +126,7 @@ index 1f8ef34ade24..862c099d7c4c 100644
int ret = 0;
struct list_head *entry;
struct urb_node *unode;
-@@ -296,7 +296,7 @@ struct urb *udl_get_urb(struct drm_device *dev)
+@@ -296,7 +296,7 @@ error:
int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
{
@@ -144,7 +135,7 @@ index 1f8ef34ade24..862c099d7c4c 100644
int ret;
BUG_ON(len > udl->urbs.size);
-@@ -371,7 +371,7 @@ int udl_drop_usb(struct drm_device *dev)
+@@ -372,7 +372,7 @@ int udl_drop_usb(struct drm_device *dev)
void udl_driver_unload(struct drm_device *dev)
{
@@ -153,6 +144,3 @@ index 1f8ef34ade24..862c099d7c4c 100644
drm_kms_helper_poll_fini(dev);
---
-2.16.4
-
diff --git a/patches.suse/drm-udl-move-to-embedding-drm-device-inside-udl-devi.patch b/patches.suse/drm-udl-move-to-embedding-drm-device-inside-udl-devi.patch
index 0f44d4a83a..f0da7d6e7a 100644
--- a/patches.suse/drm-udl-move-to-embedding-drm-device-inside-udl-devi.patch
+++ b/patches.suse/drm-udl-move-to-embedding-drm-device-inside-udl-devi.patch
@@ -1,10 +1,10 @@
From 6ecac85eadb9d4065b9038fa3d3c66d49038e14b Mon Sep 17 00:00:00 2001
From: Dave Airlie <airlied@redhat.com>
Date: Fri, 5 Apr 2019 13:17:15 +1000
-Subject: [PATCH] drm/udl: move to embedding drm device inside udl device.
+Subject: drm/udl: move to embedding drm device inside udl device.
Git-commit: 6ecac85eadb9d4065b9038fa3d3c66d49038e14b
Patch-mainline: v5.2-rc1
-References: bsc#1111666
+References: bsc#1111666 bsc#1113722
This should help with some of the lifetime issues, and move us away
from load/unload.
@@ -12,20 +12,17 @@ from load/unload.
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190405031715.5959-4-airlied@gmail.com
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/udl/udl_drv.c | 56 +++++++++++++++++++++++++++++++++---------
- drivers/gpu/drm/udl/udl_drv.h | 9 +++----
- drivers/gpu/drm/udl/udl_fb.c | 2 +-
- drivers/gpu/drm/udl/udl_main.c | 23 +++--------------
+ drivers/gpu/drm/udl/udl_drv.c | 56 ++++++++++++++++++++++++++++++++---------
+ drivers/gpu/drm/udl/udl_drv.h | 9 ++----
+ drivers/gpu/drm/udl/udl_fb.c | 2 -
+ drivers/gpu/drm/udl/udl_main.c | 23 ++--------------
4 files changed, 53 insertions(+), 37 deletions(-)
-diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
-index b7d01b3664cb..312bf324841a 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
-@@ -48,10 +48,16 @@ static const struct file_operations udl_driver_fops = {
+@@ -48,10 +48,16 @@ static const struct file_operations udl_
.llseek = noop_llseek,
};
@@ -44,7 +41,7 @@ index b7d01b3664cb..312bf324841a 100644
.release = udl_driver_release,
/* gem hooks */
-@@ -75,28 +81,56 @@ static struct drm_driver driver = {
+@@ -77,28 +83,56 @@ static struct drm_driver driver = {
.patchlevel = DRIVER_PATCHLEVEL,
};
@@ -110,11 +107,9 @@ index b7d01b3664cb..312bf324841a 100644
return r;
}
-diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
-index b3e08e876d62..35c1f33fbc1a 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
-@@ -50,8 +50,8 @@ struct urb_list {
+@@ -49,8 +49,8 @@ struct urb_list {
struct udl_fbdev;
struct udl_device {
@@ -124,7 +119,7 @@ index b3e08e876d62..35c1f33fbc1a 100644
struct usb_device *udev;
struct drm_crtc *crtc;
-@@ -71,7 +71,7 @@ struct udl_device {
+@@ -68,7 +68,7 @@ struct udl_device {
atomic_t cpu_kcycles_used; /* transpired during pixel processing */
};
@@ -133,7 +128,7 @@ index b3e08e876d62..35c1f33fbc1a 100644
struct udl_gem_object {
struct drm_gem_object base;
-@@ -104,9 +104,8 @@ struct urb *udl_get_urb(struct drm_device *dev);
+@@ -101,9 +101,8 @@ struct urb *udl_get_urb(struct drm_devic
int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len);
void udl_urb_completion(struct urb *urb);
@@ -145,11 +140,9 @@ index b3e08e876d62..35c1f33fbc1a 100644
int udl_fbdev_init(struct drm_device *dev);
void udl_fbdev_cleanup(struct drm_device *dev);
-diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
-index 16593d4f02b4..b9b67a546d4c 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
-@@ -213,7 +213,7 @@ static int udl_fb_open(struct fb_info *info, int user)
+@@ -213,7 +213,7 @@ static int udl_fb_open(struct fb_info *i
struct udl_device *udl = to_udl(dev);
/* If the USB device is gone, we don't accept new opens */
@@ -158,11 +151,9 @@ index 16593d4f02b4..b9b67a546d4c 100644
return -ENODEV;
ufbdev->fb_count++;
-diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
-index 862c099d7c4c..6743eaef4594 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
-@@ -311,20 +311,12 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
+@@ -311,20 +311,12 @@ int udl_submit_urb(struct drm_device *de
return ret;
}
@@ -185,7 +176,7 @@ index 862c099d7c4c..6743eaef4594 100644
mutex_init(&udl->gem_lock);
-@@ -358,7 +350,6 @@ int udl_driver_load(struct drm_device *dev, unsigned long flags)
+@@ -359,7 +351,6 @@ err_fb:
err:
if (udl->urbs.count)
udl_free_urb_list(dev);
@@ -193,7 +184,7 @@ index 862c099d7c4c..6743eaef4594 100644
DRM_ERROR("%d\n", ret);
return ret;
}
-@@ -369,7 +360,7 @@ int udl_drop_usb(struct drm_device *dev)
+@@ -370,7 +361,7 @@ int udl_drop_usb(struct drm_device *dev)
return 0;
}
@@ -202,7 +193,7 @@ index 862c099d7c4c..6743eaef4594 100644
{
struct udl_device *udl = to_udl(dev);
-@@ -379,12 +370,4 @@ void udl_driver_unload(struct drm_device *dev)
+@@ -380,12 +371,4 @@ void udl_driver_unload(struct drm_device
udl_free_urb_list(dev);
udl_fbdev_cleanup(dev);
@@ -215,6 +206,3 @@ index 862c099d7c4c..6743eaef4594 100644
- drm_dev_fini(dev);
- kfree(dev);
}
---
-2.16.4
-
diff --git a/patches.suse/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch b/patches.suse/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch
index a85481df2f..35754c6465 100644
--- a/patches.suse/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch
+++ b/patches.suse/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch
@@ -1,10 +1,10 @@
From cc0ba0d8624f210995924bb57a8b181ce8976606 Mon Sep 17 00:00:00 2001
From: Thomas Hellstrom <thellstrom@vmware.com>
Date: Wed, 29 May 2019 08:15:19 +0200
-Subject: [PATCH] drm/vmwgfx: Use the backdoor port if the HB port is not available
+Subject: drm/vmwgfx: Use the backdoor port if the HB port is not available
Git-commit: cc0ba0d8624f210995924bb57a8b181ce8976606
Patch-mainline: v5.2-rc6
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
The HB port may not be available for various reasons. Either it has been
disabled by a config option or by the hypervisor for other reasons.
@@ -15,17 +15,14 @@ Cc: stable@vger.kernel.org
Fixes: 89da76fde68d ("drm/vmwgfx: Add VMWare host messaging capability")
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Deepak Rawat <drawat@vmware.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 146 +++++++++++++++++++++++++++++-------
+ drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 146 ++++++++++++++++++++++++++++--------
1 file changed, 117 insertions(+), 29 deletions(-)
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
-index 8b9270f31409..e4e09d47c5c0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
-@@ -136,6 +136,114 @@ static int vmw_close_channel(struct rpc_channel *channel)
+@@ -135,6 +135,114 @@ static int vmw_close_channel(struct rpc_
return 0;
}
@@ -140,7 +137,7 @@ index 8b9270f31409..e4e09d47c5c0 100644
/**
-@@ -148,11 +256,10 @@ static int vmw_close_channel(struct rpc_channel *channel)
+@@ -147,11 +255,10 @@ static int vmw_close_channel(struct rpc_
*/
static int vmw_send_msg(struct rpc_channel *channel, const char *msg)
{
@@ -153,7 +150,7 @@ index 8b9270f31409..e4e09d47c5c0 100644
while (retries < RETRIES) {
retries++;
-@@ -166,23 +273,14 @@ static int vmw_send_msg(struct rpc_channel *channel, const char *msg)
+@@ -165,23 +272,14 @@ static int vmw_send_msg(struct rpc_chann
VMW_HYPERVISOR_MAGIC,
eax, ebx, ecx, edx, si, di);
@@ -181,7 +178,7 @@ index 8b9270f31409..e4e09d47c5c0 100644
if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) != 0) {
return 0;
-@@ -211,7 +309,7 @@ STACK_FRAME_NON_STANDARD(vmw_send_msg);
+@@ -210,7 +308,7 @@ STACK_FRAME_NON_STANDARD(vmw_send_msg);
static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
size_t *msg_len)
{
@@ -190,7 +187,7 @@ index 8b9270f31409..e4e09d47c5c0 100644
char *reply;
size_t reply_len;
int retries = 0;
-@@ -233,8 +331,7 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+@@ -232,8 +330,7 @@ static int vmw_recv_msg(struct rpc_chann
VMW_HYPERVISOR_MAGIC,
eax, ebx, ecx, edx, si, di);
@@ -200,7 +197,7 @@ index 8b9270f31409..e4e09d47c5c0 100644
DRM_ERROR("Failed to get reply size for host message.\n");
return -EINVAL;
}
-@@ -252,17 +349,8 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+@@ -251,17 +348,8 @@ static int vmw_recv_msg(struct rpc_chann
/* Receive buffer */
@@ -220,6 +217,3 @@ index 8b9270f31409..e4e09d47c5c0 100644
if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) == 0) {
kfree(reply);
---
-2.16.4
-
diff --git a/patches.suse/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch b/patches.suse/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch
index e73740852c..67b5e597a7 100644
--- a/patches.suse/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch
+++ b/patches.suse/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch
@@ -1,22 +1,22 @@
From 39916897cd815a0ee07ba1f6820cf88a63e459fc Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Mon, 3 Jun 2019 16:44:15 -0400
-Subject: [PATCH] drm/vmwgfx: fix a warning due to missing dma_parms
+Subject: drm/vmwgfx: fix a warning due to missing dma_parms
Git-commit: 39916897cd815a0ee07ba1f6820cf88a63e459fc
Patch-mainline: v5.2-rc6
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
Booting up with DMA_API_DEBUG_SG=y generates a warning due to the driver
forgot to set dma_parms appropriately. Set it just after vmw_dma_masks()
in vmw_driver_load().
-Dma-api: vmwgfx 0000:00:0f.0: mapping sg segment longer than device
+DMA-API: vmwgfx 0000:00:0f.0: mapping sg segment longer than device
claims to support [len=2097152] [max=65536]
-Warning: CPU: 2 PID: 261 at kernel/dma/debug.c:1232
+WARNING: CPU: 2 PID: 261 at kernel/dma/debug.c:1232
debug_dma_map_sg+0x360/0x480
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop
Reference Platform, BIOS 6.00 04/13/2018
-Rip: 0010:debug_dma_map_sg+0x360/0x480
+RIP: 0010:debug_dma_map_sg+0x360/0x480
Call Trace:
vmw_ttm_map_dma+0x3b1/0x5b0 [vmwgfx]
vmw_bo_map_dma+0x25/0x30 [vmwgfx]
@@ -57,11 +57,9 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 3 +++
1 file changed, 3 insertions(+)
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-index 4ff11a0077e1..9506190a0300 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-@@ -747,6 +747,9 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+@@ -758,6 +758,9 @@ static int vmw_driver_load(struct drm_de
if (unlikely(ret != 0))
goto out_err0;
@@ -71,6 +69,3 @@ index 4ff11a0077e1..9506190a0300 100644
if (dev_priv->capabilities & SVGA_CAP_GMR2) {
DRM_INFO("Max GMR ids is %u\n",
(unsigned)dev_priv->max_gmr_ids);
---
-2.16.4
-
diff --git a/patches.suse/ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch b/patches.suse/ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch
new file mode 100644
index 0000000000..2ecf741c35
--- /dev/null
+++ b/patches.suse/ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch
@@ -0,0 +1,49 @@
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Fri, 30 Aug 2019 16:30:01 -0400
+Subject: ftrace: Check for empty hash and comment the race with registering
+ probes
+Git-commit: 372e0d01da71c84dcecf7028598a33813b0d5256
+Patch-mainline: v5.3-rc7
+References: bsc#1149418
+
+The race between adding a function probe and reading the probes that exist
+is very subtle. It needs a comment. Also, the issue can also happen if the
+probe has has the EMPTY_HASH as its func_hash.
+
+Cc: stable@vger.kernel.org
+Fixes: 7b60f3d876156 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+---
+ kernel/trace/ftrace.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 80beed2cf0da..6200a6fe10e3 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3096,7 +3096,11 @@ t_probe_next(struct seq_file *m, loff_t *pos)
+
+ hash = iter->probe->ops.func_hash->filter_hash;
+
+- if (!hash)
++ /*
++ * A probe being registered may temporarily have an empty hash
++ * and it's at the end of the func_probes list.
++ */
++ if (!hash || hash == EMPTY_HASH)
+ return NULL;
+
+ size = 1 << hash->size_bits;
+@@ -4324,6 +4328,10 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
+
+ mutex_unlock(&ftrace_lock);
+
++ /*
++ * Note, there's a small window here that the func_hash->filter_hash
++ * may be NULL or empty. Need to be carefule when reading the loop.
++ */
+ mutex_lock(&probe->ops.func_hash->regex_lock);
+
+ orig_hash = &probe->ops.func_hash->filter_hash;
+
diff --git a/patches.suse/ftrace-check-for-successful-allocation-of-hash.patch b/patches.suse/ftrace-check-for-successful-allocation-of-hash.patch
new file mode 100644
index 0000000000..35572e2cfe
--- /dev/null
+++ b/patches.suse/ftrace-check-for-successful-allocation-of-hash.patch
@@ -0,0 +1,40 @@
+From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
+Date: Thu, 4 Jul 2019 20:04:42 +0530
+Subject: ftrace: Check for successful allocation of hash
+Git-commit: 5b0022dd32b7c2e15edf1827ba80aa1407edf9ff
+Patch-mainline: v5.3-rc7
+References: bsc#1149424
+
+In register_ftrace_function_probe(), we are not checking the return
+value of alloc_and_copy_ftrace_hash(). The subsequent call to
+ftrace_match_records() may end up dereferencing the same. Add a check to
+ensure this doesn't happen.
+
+Link: http://lkml.kernel.org/r/26e92574f25ad23e7cafa3cf5f7a819de1832cbe.1562249521.git.naveen.n.rao@linux.vnet.ibm.com
+
+Cc: stable@vger.kernel.org
+Fixes: 1ec3a81a0cf42 ("ftrace: Have each function probe use its own ftrace_ops")
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+---
+ kernel/trace/ftrace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 6200a6fe10e3..f9821a3374e9 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -4338,6 +4338,11 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
+ old_hash = *orig_hash;
+ hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash);
+
++ if (!hash) {
++ ret = -ENOMEM;
++ goto out;
++ }
++
+ ret = ftrace_match_records(hash, glob, strlen(glob));
+
+ /* Nothing found? */
+
diff --git a/patches.suse/ftrace-fix-null-pointer-dereference-in-t_probe_next.patch b/patches.suse/ftrace-fix-null-pointer-dereference-in-t_probe_next.patch
new file mode 100644
index 0000000000..4505f4355b
--- /dev/null
+++ b/patches.suse/ftrace-fix-null-pointer-dereference-in-t_probe_next.patch
@@ -0,0 +1,77 @@
+From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
+Date: Thu, 4 Jul 2019 20:04:41 +0530
+Subject: ftrace: Fix NULL pointer dereference in t_probe_next()
+Git-commit: 7bd46644ea0f6021dc396a39a8bfd3a58f6f1f9f
+Patch-mainline: v5.3-rc7
+References: bsc#1149413
+
+LTP testsuite on powerpc results in the below crash:
+
+ Unable to handle kernel paging request for data at address 0x00000000
+ Faulting instruction address: 0xc00000000029d800
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ LE SMP NR_CPUS=2048 NUMA PowerNV
+ ...
+ CPU: 68 PID: 96584 Comm: cat Kdump: loaded Tainted: G W
+ NIP: c00000000029d800 LR: c00000000029dac4 CTR: c0000000001e6ad0
+ REGS: c0002017fae8ba10 TRAP: 0300 Tainted: G W
+ MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 28022422 XER: 20040000
+ CFAR: c00000000029d90c DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 0
+ ...
+ NIP [c00000000029d800] t_probe_next+0x60/0x180
+ LR [c00000000029dac4] t_mod_start+0x1a4/0x1f0
+ Call Trace:
+ [c0002017fae8bc90] [c000000000cdbc40] _cond_resched+0x10/0xb0 (unreliable)
+ [c0002017fae8bce0] [c0000000002a15b0] t_start+0xf0/0x1c0
+ [c0002017fae8bd30] [c0000000004ec2b4] seq_read+0x184/0x640
+ [c0002017fae8bdd0] [c0000000004a57bc] sys_read+0x10c/0x300
+ [c0002017fae8be30] [c00000000000b388] system_call+0x5c/0x70
+
+The test (ftrace_set_ftrace_filter.sh) is part of ftrace stress tests
+and the crash happens when the test does 'cat
+$TRACING_PATH/set_ftrace_filter'.
+
+The address points to the second line below, in t_probe_next(), where
+filter_hash is dereferenced:
+ hash = iter->probe->ops.func_hash->filter_hash;
+ size = 1 << hash->size_bits;
+
+This happens due to a race with register_ftrace_function_probe(). A new
+ftrace_func_probe is created and added into the func_probes list in
+trace_array under ftrace_lock. However, before initializing the filter,
+we drop ftrace_lock, and re-acquire it after acquiring regex_lock. If
+another process is trying to read set_ftrace_filter, it will be able to
+acquire ftrace_lock during this window and it will end up seeing a NULL
+filter_hash.
+
+Fix this by just checking for a NULL filter_hash in t_probe_next(). If
+the filter_hash is NULL, then this probe is just being added and we can
+simply return from here.
+
+Link: http://lkml.kernel.org/r/05e021f757625cbbb006fad41380323dbe4e3b43.1562249521.git.naveen.n.rao@linux.vnet.ibm.com
+
+Cc: stable@vger.kernel.org
+Fixes: 7b60f3d876156 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array")
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+---
+ kernel/trace/ftrace.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index eca34503f178..80beed2cf0da 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3095,6 +3095,10 @@ t_probe_next(struct seq_file *m, loff_t *pos)
+ hnd = &iter->probe_entry->hlist;
+
+ hash = iter->probe->ops.func_hash->filter_hash;
++
++ if (!hash)
++ return NULL;
++
+ size = 1 << hash->size_bits;
+
+ retry:
+
diff --git a/patches.suse/genetlink-Fix-a-memory-leak-on-error-path.patch b/patches.suse/genetlink-Fix-a-memory-leak-on-error-path.patch
index 0df45b8fe5..d414720ca1 100644
--- a/patches.suse/genetlink-Fix-a-memory-leak-on-error-path.patch
+++ b/patches.suse/genetlink-Fix-a-memory-leak-on-error-path.patch
@@ -3,7 +3,7 @@ Date: Thu, 21 Mar 2019 15:02:50 +0800
Subject: genetlink: Fix a memory leak on error path
Git-commit: ceabee6c59943bdd5e1da1a6a20dc7ee5f8113a2
Patch-mainline: v5.1-rc3
-References: networking-stable-19_03_28
+References: networking-stable-19_03_28, CVE-2019-15921, bsc#1149602
In genl_register_family(), when idr_alloc() fails,
we forget to free the memory we possibly allocate for
diff --git a/patches.suse/gpio-mxs-Get-rid-of-external-API-call.patch b/patches.suse/gpio-mxs-Get-rid-of-external-API-call.patch
new file mode 100644
index 0000000000..6117414f43
--- /dev/null
+++ b/patches.suse/gpio-mxs-Get-rid-of-external-API-call.patch
@@ -0,0 +1,52 @@
+From 833eacc7b5913da9896bacd30db7d490aa777868 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Wed, 29 Aug 2018 17:02:16 +0200
+Subject: [PATCH] gpio: mxs: Get rid of external API call
+Git-commit: 833eacc7b5913da9896bacd30db7d490aa777868
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The MXS driver was calling back into the GPIO API from
+its irqchip. This is not very elegant, as we are a driver,
+let's just shortcut back into the gpio_chip .get() function
+instead.
+
+This is a tricky case since the .get() callback is not in
+this file, instead assigned by bgpio_init(). Calling the
+function direcly in the gpio_chip is however the lesser
+evil.
+
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+Cc: Janusz Uzycki <j.uzycki@elproma.com.pl>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpio-mxs.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/gpio/gpio-mxs.c b/drivers/gpio/gpio-mxs.c
+index df30490da820..ea874fd033a5 100644
+--- a/drivers/gpio/gpio-mxs.c
++++ b/drivers/gpio/gpio-mxs.c
+@@ -18,8 +18,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+ #include <linux/gpio/driver.h>
+-/* FIXME: for gpio_get_value(), replace this by direct register read */
+-#include <linux/gpio.h>
+ #include <linux/module.h>
+
+ #define MXS_SET 0x4
+@@ -86,7 +84,7 @@ static int mxs_gpio_set_irq_type(struct irq_data *d, unsigned int type)
+ port->both_edges &= ~pin_mask;
+ switch (type) {
+ case IRQ_TYPE_EDGE_BOTH:
+- val = gpio_get_value(port->gc.base + d->hwirq);
++ val = port->gc.get(&port->gc, d->hwirq);
+ if (val)
+ edge = GPIO_INT_FALL_EDGE;
+ else
+--
+2.16.4
+
diff --git a/patches.suse/gpio-pxa-handle-corner-case-of-unprobed-device.patch b/patches.suse/gpio-pxa-handle-corner-case-of-unprobed-device.patch
new file mode 100644
index 0000000000..4fcbbd9d2b
--- /dev/null
+++ b/patches.suse/gpio-pxa-handle-corner-case-of-unprobed-device.patch
@@ -0,0 +1,55 @@
+From 9ce3ebe973bf4073426f35f282c6b955ed802765 Mon Sep 17 00:00:00 2001
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+Date: Sat, 25 Aug 2018 10:44:17 +0200
+Subject: [PATCH] gpio: pxa: handle corner case of unprobed device
+Git-commit: 9ce3ebe973bf4073426f35f282c6b955ed802765
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+In the corner case where the gpio driver probe fails, for whatever
+reason, the suspend and resume handlers will still be called as they
+have to be registered as syscore operations. This applies as well when
+no probe was called while the driver has been built in the kernel.
+
+Nicolas tracked this in :
+https://bugzilla.kernel.org/show_bug.cgi?id=200905
+
+Therefore, add a failsafe in these function, and test if a proper probe
+succeeded and the driver is functional.
+
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Reported-by: Nicolas Chauvet <kwizart@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpio-pxa.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
+index c18712dabf93..bfe4c5c9f41c 100644
+--- a/drivers/gpio/gpio-pxa.c
++++ b/drivers/gpio/gpio-pxa.c
+@@ -776,6 +776,9 @@ static int pxa_gpio_suspend(void)
+ struct pxa_gpio_bank *c;
+ int gpio;
+
++ if (!pchip)
++ return 0;
++
+ for_each_gpio_bank(gpio, c, pchip) {
+ c->saved_gplr = readl_relaxed(c->regbase + GPLR_OFFSET);
+ c->saved_gpdr = readl_relaxed(c->regbase + GPDR_OFFSET);
+@@ -794,6 +797,9 @@ static void pxa_gpio_resume(void)
+ struct pxa_gpio_bank *c;
+ int gpio;
+
++ if (!pchip)
++ return;
++
+ for_each_gpio_bank(gpio, c, pchip) {
+ /* restore level with set/clear */
+ writel_relaxed(c->saved_gplr, c->regbase + GPSR_OFFSET);
+--
+2.16.4
+
diff --git a/patches.suse/gpu-ipu-v3-ipu-ic-Fix-saturation-bit-offset-in-TPMEM.patch b/patches.suse/gpu-ipu-v3-ipu-ic-Fix-saturation-bit-offset-in-TPMEM.patch
index ed98088b98..b7f545ed52 100644
--- a/patches.suse/gpu-ipu-v3-ipu-ic-Fix-saturation-bit-offset-in-TPMEM.patch
+++ b/patches.suse/gpu-ipu-v3-ipu-ic-Fix-saturation-bit-offset-in-TPMEM.patch
@@ -1,10 +1,10 @@
From 3d1f62c686acdedf5ed9642b763f3808d6a47d1e Mon Sep 17 00:00:00 2001
From: Steve Longerbeam <slongerbeam@gmail.com>
Date: Tue, 21 May 2019 18:03:13 -0700
-Subject: [PATCH] gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
+Subject: gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
Git-commit: 3d1f62c686acdedf5ed9642b763f3808d6a47d1e
Patch-mainline: v5.3-rc1
-References: bsc#1111666
+References: bsc#1111666 bsc#1142635
The saturation bit was being set at bit 9 in the second 32-bit word
of the TPMEM CSC. This isn't correct, the saturation bit is bit 42,
@@ -16,8 +16,7 @@ Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/ipu-v3/ipu-ic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
@@ -36,5 +35,5 @@ index 89c3961f0fce..3428b0e72bc5 100644
param = ((a[1] & 0x1f) << 27) | ((c[0][1] & 0x1ff) << 18) |
--
-2.16.4
+2.22.0
diff --git a/patches.suse/i2c-qup-fixed-releasing-dma-without-flush-operation-.patch b/patches.suse/i2c-qup-fixed-releasing-dma-without-flush-operation-.patch
new file mode 100644
index 0000000000..ad7d4bd306
--- /dev/null
+++ b/patches.suse/i2c-qup-fixed-releasing-dma-without-flush-operation-.patch
@@ -0,0 +1,53 @@
+From 7239872fb3400b21a8f5547257f9f86455867bd6 Mon Sep 17 00:00:00 2001
+From: Abhishek Sahu <absahu@codeaurora.org>
+Date: Mon, 12 Mar 2018 18:44:51 +0530
+Subject: [PATCH] i2c: qup: fixed releasing dma without flush operation completion
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 7239872fb3400b21a8f5547257f9f86455867bd6
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+The QUP BSLP BAM generates the following error sometimes if the
+current I2C DMA transfer fails and the flush operation has been
+scheduled
+
+ “bam-dma-engine 7884000.dma: Cannot free busy channel”
+
+If any I2C error comes during BAM DMA transfer, then the QUP I2C
+interrupt will be generated and the flush operation will be
+carried out to make I2C consume all scheduled DMA transfer.
+Currently, the same completion structure is being used for BAM
+transfer which has already completed without reinit. It will make
+flush operation wait_for_completion_timeout completed immediately
+and will proceed for freeing the DMA resources where the
+descriptors are still in process.
+
+Signed-off-by: Abhishek Sahu <absahu@codeaurora.org>
+Acked-by: Sricharan R <sricharan@codeaurora.org>
+Reviewed-by: Austin Christ <austinwc@codeaurora.org>
+Reviewed-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/i2c/busses/i2c-qup.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c
+index ac5edfac2d5c..75e9819a161c 100644
+--- a/drivers/i2c/busses/i2c-qup.c
++++ b/drivers/i2c/busses/i2c-qup.c
+@@ -835,6 +835,8 @@ static int qup_i2c_bam_do_xfer(struct qup_i2c_dev *qup, struct i2c_msg *msg,
+ }
+
+ if (ret || qup->bus_err || qup->qup_err) {
++ reinit_completion(&qup->xfer);
++
+ if (qup_i2c_change_state(qup, QUP_RUN_STATE)) {
+ dev_err(qup->dev, "change to run state timed out");
+ goto desc_err;
+--
+2.16.4
+
diff --git a/patches.suse/isdn-hfcsusb-Fix-mISDN-driver-crash-caused-by-transf.patch b/patches.suse/isdn-hfcsusb-Fix-mISDN-driver-crash-caused-by-transf.patch
new file mode 100644
index 0000000000..5f111841c6
--- /dev/null
+++ b/patches.suse/isdn-hfcsusb-Fix-mISDN-driver-crash-caused-by-transf.patch
@@ -0,0 +1,87 @@
+From d8a1de3d5bb881507602bc02e004904828f88711 Mon Sep 17 00:00:00 2001
+From: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com>
+Date: Wed, 31 Jul 2019 15:17:23 +0200
+Subject: [PATCH] isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack
+Git-commit: d8a1de3d5bb881507602bc02e004904828f88711
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+Since linux 4.9 it is not possible to use buffers on the stack for DMA transfers.
+
+During usb probe the driver crashes with "transfer buffer is on stack" message.
+
+This fix k-allocates a buffer to be used on "read_reg_atomic", which is a macro
+that calls "usb_control_msg" under the hood.
+
+Kernel 4.19 backtrace:
+
+usb_hcd_submit_urb+0x3e5/0x900
+? sched_clock+0x9/0x10
+? log_store+0x203/0x270
+? get_random_u32+0x6f/0x90
+? cache_alloc_refill+0x784/0x8a0
+usb_submit_urb+0x3b4/0x550
+usb_start_wait_urb+0x4e/0xd0
+usb_control_msg+0xb8/0x120
+hfcsusb_probe+0x6bc/0xb40 [hfcsusb]
+usb_probe_interface+0xc2/0x260
+really_probe+0x176/0x280
+driver_probe_device+0x49/0x130
+__driver_attach+0xa9/0xb0
+? driver_probe_device+0x130/0x130
+bus_for_each_dev+0x5a/0x90
+driver_attach+0x14/0x20
+? driver_probe_device+0x130/0x130
+bus_add_driver+0x157/0x1e0
+driver_register+0x51/0xe0
+usb_register_driver+0x5d/0x120
+? 0xf81ed000
+hfcsusb_drv_init+0x17/0x1000 [hfcsusb]
+do_one_initcall+0x44/0x190
+? free_unref_page_commit+0x6a/0xd0
+do_init_module+0x46/0x1c0
+load_module+0x1dc1/0x2400
+sys_init_module+0xed/0x120
+do_fast_syscall_32+0x7a/0x200
+entry_SYSENTER_32+0x6b/0xbe
+
+Signed-off-by: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/isdn/hardware/mISDN/hfcsusb.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
+index 8fb7c5dea07f..008a74a1ed44 100644
+--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
+@@ -1693,13 +1693,23 @@ hfcsusb_stop_endpoint(struct hfcsusb *hw, int channel)
+ static int
+ setup_hfcsusb(struct hfcsusb *hw)
+ {
++ void *dmabuf = kmalloc(sizeof(u_char), GFP_KERNEL);
+ u_char b;
++ int ret;
+
+ if (debug & DBG_HFC_CALL_TRACE)
+ printk(KERN_DEBUG "%s: %s\n", hw->name, __func__);
+
++ if (!dmabuf)
++ return -ENOMEM;
++
++ ret = read_reg_atomic(hw, HFCUSB_CHIP_ID, dmabuf);
++
++ memcpy(&b, dmabuf, sizeof(u_char));
++ kfree(dmabuf);
++
+ /* check the chip id */
+- if (read_reg_atomic(hw, HFCUSB_CHIP_ID, &b) != 1) {
++ if (ret != 1) {
+ printk(KERN_DEBUG "%s: %s: cannot read chip id\n",
+ hw->name, __func__);
+ return 1;
+--
+2.16.4
+
diff --git a/patches.suse/isdn-mISDN-hfcsusb-Fix-possible-null-pointer-derefer.patch b/patches.suse/isdn-mISDN-hfcsusb-Fix-possible-null-pointer-derefer.patch
new file mode 100644
index 0000000000..f526c0246a
--- /dev/null
+++ b/patches.suse/isdn-mISDN-hfcsusb-Fix-possible-null-pointer-derefer.patch
@@ -0,0 +1,50 @@
+From a0d57a552b836206ad7705a1060e6e1ce5a38203 Mon Sep 17 00:00:00 2001
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Fri, 26 Jul 2019 16:27:36 +0800
+Subject: [PATCH] isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain()
+Git-commit: a0d57a552b836206ad7705a1060e6e1ce5a38203
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+In start_isoc_chain(), usb_alloc_urb() on line 1392 may fail
+and return NULL. At this time, fifo->iso[i].urb is assigned to NULL.
+
+Then, fifo->iso[i].urb is used at some places, such as:
+LINE 1405: fill_isoc_urb(fifo->iso[i].urb, ...)
+ urb->number_of_packets = num_packets;
+ urb->transfer_flags = URB_ISO_ASAP;
+ urb->actual_length = 0;
+ urb->interval = interval;
+LINE 1416: fifo->iso[i].urb->...
+LINE 1419: fifo->iso[i].urb->...
+
+Thus, possible null-pointer dereferences may occur.
+
+To fix these bugs, "continue" is added to avoid using fifo->iso[i].urb
+when it is NULL.
+
+These bugs are found by a static analysis tool STCheck written by us.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/isdn/hardware/mISDN/hfcsusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
+index 0e224232f746..8fb7c5dea07f 100644
+--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
+@@ -1394,6 +1394,7 @@ start_isoc_chain(struct usb_fifo *fifo, int num_packets_per_urb,
+ printk(KERN_DEBUG
+ "%s: %s: alloc urb for fifo %i failed",
+ hw->name, __func__, fifo->fifonum);
++ continue;
+ }
+ fifo->iso[i].owner_fifo = (struct usb_fifo *) fifo;
+ fifo->iso[i].indx = i;
+--
+2.16.4
+
diff --git a/patches.suse/kconfig-mn-conf-handle-backspace-H-key.patch b/patches.suse/kconfig-mn-conf-handle-backspace-H-key.patch
new file mode 100644
index 0000000000..b6e26f50ca
--- /dev/null
+++ b/patches.suse/kconfig-mn-conf-handle-backspace-H-key.patch
@@ -0,0 +1,67 @@
+From 9c38f1f044080392603c497ecca4d7d09876ff99 Mon Sep 17 00:00:00 2001
+From: Changbin Du <changbin.du@gmail.com>
+Date: Mon, 25 Mar 2019 15:16:47 +0000
+Subject: [PATCH] kconfig/[mn]conf: handle backspace (^H) key
+Git-commit: 9c38f1f044080392603c497ecca4d7d09876ff99
+Patch-mainline: v5.1-rc3
+References: bsc#1051510
+
+Backspace is not working on some terminal emulators which do not send the
+key code defined by terminfo. Terminals either send '^H' (8) or '^?' (127).
+But currently only '^?' is handled. Let's also handle '^H' for those
+terminals.
+
+Signed-off-by: Changbin Du <changbin.du@gmail.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/kconfig/lxdialog/inputbox.c | 3 ++-
+ scripts/kconfig/nconf.c | 2 +-
+ scripts/kconfig/nconf.gui.c | 3 ++-
+ 3 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/scripts/kconfig/lxdialog/inputbox.c b/scripts/kconfig/lxdialog/inputbox.c
+index 611945611bf8..1dcfb288ee63 100644
+--- a/scripts/kconfig/lxdialog/inputbox.c
++++ b/scripts/kconfig/lxdialog/inputbox.c
+@@ -113,7 +113,8 @@ int dialog_inputbox(const char *title, const char *prompt, int height, int width
+ case KEY_DOWN:
+ break;
+ case KEY_BACKSPACE:
+- case 127:
++ case 8: /* ^H */
++ case 127: /* ^? */
+ if (pos) {
+ wattrset(dialog, dlg.inputbox.atr);
+ if (input_x == 0) {
+diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c
+index a4670f4e825a..ac92c0ded6c5 100644
+--- a/scripts/kconfig/nconf.c
++++ b/scripts/kconfig/nconf.c
+@@ -1048,7 +1048,7 @@ static int do_match(int key, struct match_state *state, int *ans)
+ state->match_direction = FIND_NEXT_MATCH_UP;
+ *ans = get_mext_match(state->pattern,
+ state->match_direction);
+- } else if (key == KEY_BACKSPACE || key == 127) {
++ } else if (key == KEY_BACKSPACE || key == 8 || key == 127) {
+ state->pattern[strlen(state->pattern)-1] = '\0';
+ adj_match_dir(&state->match_direction);
+ } else
+diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
+index 7be620a1fcdb..77f525a8617c 100644
+--- a/scripts/kconfig/nconf.gui.c
++++ b/scripts/kconfig/nconf.gui.c
+@@ -439,7 +439,8 @@ int dialog_inputbox(WINDOW *main_window,
+ case KEY_F(F_EXIT):
+ case KEY_F(F_BACK):
+ break;
+- case 127:
++ case 8: /* ^H */
++ case 127: /* ^? */
+ case KEY_BACKSPACE:
+ if (cursor_position > 0) {
+ memmove(&result[cursor_position-1],
+--
+2.16.4
+
diff --git a/patches.suse/kvm-x86-move-msr_ia32_arch_capabilities-to-array-emulated_msrs b/patches.suse/kvm-x86-move-msr_ia32_arch_capabilities-to-array-emulated_msrs
new file mode 100644
index 0000000000..3a7dba426d
--- /dev/null
+++ b/patches.suse/kvm-x86-move-msr_ia32_arch_capabilities-to-array-emulated_msrs
@@ -0,0 +1,37 @@
+From: Xiaoyao Li <xiaoyao.li@linux.intel.com>
+Date: Fri, 8 Mar 2019 15:57:20 +0800
+Subject: kvm/x86: Move MSR_IA32_ARCH_CAPABILITIES to array emulated_msrs
+Git-commit: 2bdb76c015df7125783d8394d6339d181cb5bc30
+Patch-mainline: v5.1-rc3
+References: bsc#1134881 bsc#1134882
+
+Since MSR_IA32_ARCH_CAPABILITIES is emualted unconditionally even if
+host doesn't suppot it. We should move it to array emulated_msrs from
+arry msrs_to_save, to report to userspace that guest support this msr.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@linux.intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/x86.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1010,7 +1010,7 @@ static u32 msrs_to_save[] = {
+ #endif
+ MSR_IA32_TSC, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA,
+ MSR_IA32_FEATURE_CONTROL, MSR_IA32_BNDCFGS, MSR_TSC_AUX,
+- MSR_IA32_SPEC_CTRL, MSR_IA32_ARCH_CAPABILITIES
++ MSR_IA32_SPEC_CTRL,
+ };
+
+ static unsigned num_msrs_to_save;
+@@ -1033,6 +1033,7 @@ static u32 emulated_msrs[] = {
+
+ MSR_IA32_TSC_ADJUST,
+ MSR_IA32_TSCDEADLINE,
++ MSR_IA32_ARCH_CAPABILITIES,
+ MSR_IA32_MISC_ENABLE,
+ MSR_IA32_MCG_STATUS,
+ MSR_IA32_MCG_CTL,
diff --git a/patches.suse/libata-add-SG-safety-checks-in-SFF-pio-transfers.patch b/patches.suse/libata-add-SG-safety-checks-in-SFF-pio-transfers.patch
new file mode 100644
index 0000000000..70b4b99611
--- /dev/null
+++ b/patches.suse/libata-add-SG-safety-checks-in-SFF-pio-transfers.patch
@@ -0,0 +1,48 @@
+From 752ead44491e8c91e14d7079625c5916b30921c5 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Wed, 7 Aug 2019 12:23:57 -0600
+Subject: [PATCH] libata: add SG safety checks in SFF pio transfers
+Git-commit: 752ead44491e8c91e14d7079625c5916b30921c5
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+Abort processing of a command if we run out of mapped data in the
+SG list. This should never happen, but a previous bug caused it to
+be possible. Play it safe and attempt to abort nicely if we don't
+have more SG segments left.
+
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/ata/libata-sff.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index 10aa27882142..4f115adb4ee8 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -658,6 +658,10 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
+ unsigned int offset;
+ unsigned char *buf;
+
++ if (!qc->cursg) {
++ qc->curbytes = qc->nbytes;
++ return;
++ }
+ if (qc->curbytes == qc->nbytes - qc->sect_size)
+ ap->hsm_task_state = HSM_ST_LAST;
+
+@@ -683,6 +687,8 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
+
+ if (qc->cursg_ofs == qc->cursg->length) {
+ qc->cursg = sg_next(qc->cursg);
++ if (!qc->cursg)
++ ap->hsm_task_state = HSM_ST_LAST;
+ qc->cursg_ofs = 0;
+ }
+ }
+--
+2.16.4
+
diff --git a/patches.suse/libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch b/patches.suse/libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch
new file mode 100644
index 0000000000..a537027556
--- /dev/null
+++ b/patches.suse/libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch
@@ -0,0 +1,84 @@
+From 2d7271501720038381d45fb3dcbe4831228fc8cc Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Wed, 7 Aug 2019 12:20:52 -0600
+Subject: [PATCH] libata: have ata_scsi_rw_xlat() fail invalid passthrough requests
+Git-commit: 2d7271501720038381d45fb3dcbe4831228fc8cc
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+For passthrough requests, libata-scsi takes what the user passes in
+as gospel. This can be problematic if the user fills in the CDB
+incorrectly. One example of that is in request sizes. For read/write
+commands, the CDB contains fields describing the transfer length of
+the request. These should match with the SG_IO header fields, but
+libata-scsi currently does no validation of that.
+
+Check that the number of blocks in the CDB for passthrough requests
+matches what was mapped into the request. If the CDB asks for more
+data then the validated SG_IO header fields, error it.
+
+Reported-by: Krishna Ram Prakash R <krp@gtux.in>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/ata/libata-scsi.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 391ac0503dc0..76d0f9de767b 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -1786,6 +1786,21 @@ static unsigned int ata_scsi_verify_xlat(struct ata_queued_cmd *qc)
+ return 1;
+ }
+
++static bool ata_check_nblocks(struct scsi_cmnd *scmd, u32 n_blocks)
++{
++ struct request *rq = scmd->request;
++ u32 req_blocks;
++
++ if (!blk_rq_is_passthrough(rq))
++ return true;
++
++ req_blocks = blk_rq_bytes(rq) / scmd->device->sector_size;
++ if (n_blocks > req_blocks)
++ return false;
++
++ return true;
++}
++
+ /**
+ * ata_scsi_rw_xlat - Translate SCSI r/w command into an ATA one
+ * @qc: Storage for translated ATA taskfile
+@@ -1830,6 +1845,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
+ scsi_10_lba_len(cdb, &block, &n_block);
+ if (cdb[1] & (1 << 3))
+ tf_flags |= ATA_TFLAG_FUA;
++ if (!ata_check_nblocks(scmd, n_block))
++ goto invalid_fld;
+ break;
+ case READ_6:
+ case WRITE_6:
+@@ -1844,6 +1861,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
+ */
+ if (!n_block)
+ n_block = 256;
++ if (!ata_check_nblocks(scmd, n_block))
++ goto invalid_fld;
+ break;
+ case READ_16:
+ case WRITE_16:
+@@ -1854,6 +1873,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
+ scsi_16_lba_len(cdb, &block, &n_block);
+ if (cdb[1] & (1 << 3))
+ tf_flags |= ATA_TFLAG_FUA;
++ if (!ata_check_nblocks(scmd, n_block))
++ goto invalid_fld;
+ break;
+ default:
+ DPRINTK("no-byte command\n");
+--
+2.16.4
+
diff --git a/patches.suse/mac80211-fix-possible-sta-leak.patch b/patches.suse/mac80211-fix-possible-sta-leak.patch
new file mode 100644
index 0000000000..2316cbeaf0
--- /dev/null
+++ b/patches.suse/mac80211-fix-possible-sta-leak.patch
@@ -0,0 +1,51 @@
+From 5fd2f91ad483baffdbe798f8a08f1b41442d1e24 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 1 Aug 2019 09:30:33 +0200
+Subject: [PATCH] mac80211: fix possible sta leak
+Git-commit: 5fd2f91ad483baffdbe798f8a08f1b41442d1e24
+Patch-mainline: v5.3-rc7
+References: bsc#1051510
+
+If TDLS station addition is rejected, the sta memory is leaked.
+Avoid this by moving the check before the allocation.
+
+Cc: stable@vger.kernel.org
+Fixes: 7ed5285396c2 ("mac80211: don't initiate TDLS connection if station is not associated to AP")
+Link: https://lore.kernel.org/r/20190801073033.7892-1-johannes@sipsolutions.net
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/cfg.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 4d458067d80d..111c400199ec 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1546,6 +1546,11 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
+ if (is_multicast_ether_addr(mac))
+ return -EINVAL;
+
++ if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER) &&
++ sdata->vif.type == NL80211_IFTYPE_STATION &&
++ !sdata->u.mgd.associated)
++ return -EINVAL;
++
+ sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
+ if (!sta)
+ return -ENOMEM;
+@@ -1553,10 +1558,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
+ if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
+ sta->sta.tdls = true;
+
+- if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION &&
+- !sdata->u.mgd.associated)
+- return -EINVAL;
+-
+ err = sta_apply_parameters(local, sta, params);
+ if (err) {
+ sta_info_free(local, sta);
+--
+2.16.4
+
diff --git a/patches.suse/mmc-sdhci-of-at91-add-quirk-for-broken-HS200.patch b/patches.suse/mmc-sdhci-of-at91-add-quirk-for-broken-HS200.patch
new file mode 100644
index 0000000000..af4a39d92c
--- /dev/null
+++ b/patches.suse/mmc-sdhci-of-at91-add-quirk-for-broken-HS200.patch
@@ -0,0 +1,41 @@
+From 7871aa60ae0086fe4626abdf5ed13eeddf306c61 Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Thu, 8 Aug 2019 08:35:40 +0000
+Subject: [PATCH] mmc: sdhci-of-at91: add quirk for broken HS200
+Git-commit: 7871aa60ae0086fe4626abdf5ed13eeddf306c61
+Patch-mainline: v5.3-rc7
+References: bsc#1051510
+
+HS200 is not implemented in the driver, but the controller claims it
+through caps. Remove it via a quirk, to make sure the mmc core do not try
+to enable HS200, as it causes the eMMC initialization to fail.
+
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Fixes: bb5f8ea4d514 ("mmc: sdhci-of-at91: introduce driver for the Atmel SDMMC")
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/host/sdhci-of-at91.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
+index d4e7e8b7be77..e7d1920729fb 100644
+--- a/drivers/mmc/host/sdhci-of-at91.c
++++ b/drivers/mmc/host/sdhci-of-at91.c
+@@ -357,6 +357,9 @@ static int sdhci_at91_probe(struct platform_device *pdev)
+ pm_runtime_set_autosuspend_delay(&pdev->dev, 50);
+ pm_runtime_use_autosuspend(&pdev->dev);
+
++ /* HS200 is broken at this moment */
++ host->quirks2 = SDHCI_QUIRK2_BROKEN_HS200;
++
+ ret = sdhci_add_host(host);
+ if (ret)
+ goto pm_runtime_disable;
+--
+2.16.4
+
diff --git a/patches.suse/mpls-fix-warning-with-multi-label-encap.patch b/patches.suse/mpls-fix-warning-with-multi-label-encap.patch
new file mode 100644
index 0000000000..9b472caa5c
--- /dev/null
+++ b/patches.suse/mpls-fix-warning-with-multi-label-encap.patch
@@ -0,0 +1,45 @@
+From 2f3f7d1fa0d1039b24a55d127ed190f196fc3e79 Mon Sep 17 00:00:00 2001
+From: George Wilkie <gwilkie@vyatta.att-mail.com>
+Date: Fri, 7 Jun 2019 11:49:41 +0100
+Subject: [PATCH] mpls: fix warning with multi-label encap
+Git-commit: 2f3f7d1fa0d1039b24a55d127ed190f196fc3e79
+Patch-mainline: v5.2-rc6
+References: bsc#1051510
+
+If you configure a route with multiple labels, e.g.
+ ip route add 10.10.3.0/24 encap mpls 16/100 via 10.10.2.2 dev ens4
+A warning is logged:
+ kernel: [ 130.561819] netlink: 'ip': attribute type 1 has an invalid
+ length.
+
+This happens because mpls_iptunnel_policy has set the type of
+MPLS_IPTUNNEL_DST to fixed size NLA_U32.
+Change it to a minimum size.
+nla_get_labels() does the remaining validation.
+
+Fixes: e3e4712ec096 ("mpls: ip tunnel support")
+Signed-off-by: George Wilkie <gwilkie@vyatta.att-mail.com>
+Reviewed-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mpls/mpls_iptunnel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
+index 500596130760..d25e91d7bdc1 100644
+--- a/net/mpls/mpls_iptunnel.c
++++ b/net/mpls/mpls_iptunnel.c
+@@ -23,7 +23,7 @@
+ #include "internal.h"
+
+ static const struct nla_policy mpls_iptunnel_policy[MPLS_IPTUNNEL_MAX + 1] = {
+- [MPLS_IPTUNNEL_DST] = { .type = NLA_U32 },
++ [MPLS_IPTUNNEL_DST] = { .len = sizeof(u32) },
+ [MPLS_IPTUNNEL_TTL] = { .type = NLA_U8 },
+ };
+
+--
+2.16.4
+
diff --git a/patches.suse/powerpc-fadump-when-fadump-is-supported-register-the.patch b/patches.suse/powerpc-fadump-when-fadump-is-supported-register-the.patch
new file mode 100644
index 0000000000..36df0b9c09
--- /dev/null
+++ b/patches.suse/powerpc-fadump-when-fadump-is-supported-register-the.patch
@@ -0,0 +1,68 @@
+From d34ad20a798191a6217cf245b85a26b07c0edd01 Mon Sep 17 00:00:00 2001
+From: Michal Suchanek <msuchanek@suse.de>
+Date: Tue, 20 Aug 2019 13:29:45 +0200
+Subject: [PATCH v2] powerpc/fadump: when fadump is supported register the
+ fadump sysfs files.
+To: linuxppc-dev@lists.ozlabs.org
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>, Paul Mackerras <paulus@samba.org>, Michael Ellerman <mpe@ellerman.id.au>, Michal Suchanek <msuchanek@suse.de>, Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>, Hari Bathini <hbathini@linux.vnet.ibm.com>, Christophe Leroy <christophe.leroy@c-s.fr>, Yangtao Li <tiny.windzz@gmail.com>, Thomas Gleixner <tglx@linutronix.de>, linux-kernel@vger.kernel.org
+
+References: bsc#1146352
+Patch-mainline: submitted https://patchwork.ozlabs.org/patch/1154687/
+
+Currently it is not possible to distinguish the case when fadump is
+supported by firmware and disabled in kernel and completely unsupported
+using the kernel sysfs interface. User can investigate the devicetree
+but it is more reasonable to provide sysfs files in case we get some
+fadumpv2 in the future.
+
+With this patch sysfs files are available whenever fadump is supported
+by firmware.
+
+Signed-off-by: Michal Suchanek <msuchanek@suse.de>
+---
+v2: move the sysfs initialization earlier to avoid condition nesting
+---
+ arch/powerpc/kernel/fadump.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
+index 4eab97292cc2..13741380b2f7 100644
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -1671,16 +1671,20 @@ static void fadump_init_files(void)
+ */
+ int __init setup_fadump(void)
+ {
+- if (!fw_dump.fadump_enabled)
+- return 0;
+-
+- if (!fw_dump.fadump_supported) {
++ if (!fw_dump.fadump_supported && fw_dump.fadump_enabled) {
+ printk(KERN_ERR "Firmware-assisted dump is not supported on"
+ " this hardware\n");
+- return 0;
+ }
+
++ if (!fw_dump.fadump_supported)
++ return 0;
++
++ fadump_init_files();
+ fadump_show_config();
++
++ if (!fw_dump.fadump_enabled)
++ return 1;
++
+ /*
+ * If dump data is available then see if it is valid and prepare for
+ * saving it to the disk.
+@@ -1696,7 +1700,6 @@ int __init setup_fadump(void)
+ /* Initialize the kernel dump memory structure for FAD registration. */
+ else if (fw_dump.reserve_dump_area_size)
+ init_fadump_mem_struct(&fdm, fw_dump.reserve_dump_area_start);
+- fadump_init_files();
+
+ return 1;
+ }
+--
+2.22.0
+
diff --git a/patches.suse/powerpc-xive-Fix-dump-of-XIVE-interrupt-under-pserie.patch b/patches.suse/powerpc-xive-Fix-dump-of-XIVE-interrupt-under-pserie.patch
new file mode 100644
index 0000000000..391d8a5049
--- /dev/null
+++ b/patches.suse/powerpc-xive-Fix-dump-of-XIVE-interrupt-under-pserie.patch
@@ -0,0 +1,215 @@
+From b4868ff55d082bc66b0c287a41e4888f6d3e5f87 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
+Date: Wed, 14 Aug 2019 17:47:53 +0200
+Subject: [PATCH] powerpc/xive: Fix dump of XIVE interrupt under pseries
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+References: bsc#1142019
+Patch-mainline: queued
+Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Git-commit: b4868ff55d082bc66b0c287a41e4888f6d3e5f87
+
+The xmon 'dxi' command calls OPAL to query the XIVE configuration of a
+interrupt. This can only be done on baremetal (PowerNV) and it will
+crash a pseries machine.
+
+Introduce a new XIVE get_irq_config() operation which implements a
+different query depending on the platform, PowerNV or pseries, and
+modify xmon to use a top level wrapper.
+
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190814154754.23682-3-clg@kaod.org
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/include/asm/xive.h | 2 +
+ arch/powerpc/sysdev/xive/common.c | 7 ++++
+ arch/powerpc/sysdev/xive/native.c | 15 +++++++
+ arch/powerpc/sysdev/xive/spapr.c | 51 ++++++++++++++++++++++++
+ arch/powerpc/sysdev/xive/xive-internal.h | 2 +
+ arch/powerpc/xmon/xmon.c | 12 +++---
+ 6 files changed, 83 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/xive.h b/arch/powerpc/include/asm/xive.h
+index efb0e597b272..967d6ab3c977 100644
+--- a/arch/powerpc/include/asm/xive.h
++++ b/arch/powerpc/include/asm/xive.h
+@@ -99,6 +99,8 @@ extern void xive_flush_interrupt(void);
+
+ /* xmon hook */
+ extern void xmon_xive_do_dump(int cpu);
++extern int xmon_xive_get_irq_config(u32 irq, u32 *target, u8 *prio,
++ u32 *sw_irq);
+
+ /* APIs used by KVM */
+ extern u32 xive_native_default_eq_shift(void);
+diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
+index 6b973b7cdd8a..f75a660365e5 100644
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -257,6 +257,13 @@ notrace void xmon_xive_do_dump(int cpu)
+ }
+ #endif
+ }
++
++int xmon_xive_get_irq_config(u32 irq, u32 *target, u8 *prio,
++ u32 *sw_irq)
++{
++ return xive_ops->get_irq_config(irq, target, prio, sw_irq);
++}
++
+ #endif /* CONFIG_XMON */
+
+ static unsigned int xive_get_irq(void)
+diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
+index 2f26b74f6cfa..4b61e44f0171 100644
+--- a/arch/powerpc/sysdev/xive/native.c
++++ b/arch/powerpc/sysdev/xive/native.c
+@@ -111,6 +111,20 @@ int xive_native_configure_irq(u32 hw_irq, u32 target, u8 prio, u32 sw_irq)
+ }
+ EXPORT_SYMBOL_GPL(xive_native_configure_irq);
+
++static int xive_native_get_irq_config(u32 hw_irq, u32 *target, u8 *prio,
++ u32 *sw_irq)
++{
++ s64 rc;
++ __be64 vp;
++ __be32 lirq;
++
++ rc = opal_xive_get_irq_config(hw_irq, &vp, prio, &lirq);
++
++ *target = be64_to_cpu(vp);
++ *sw_irq = be32_to_cpu(lirq);
++
++ return rc == 0 ? 0 : -ENXIO;
++}
+
+ /* This can be called multiple time to change a queue configuration */
+ int xive_native_configure_queue(u32 vp_id, struct xive_q *q, u8 prio,
+@@ -442,6 +456,7 @@ EXPORT_SYMBOL_GPL(xive_native_sync_queue);
+ static const struct xive_ops xive_native_ops = {
+ .populate_irq_data = xive_native_populate_irq_data,
+ .configure_irq = xive_native_configure_irq,
++ .get_irq_config = xive_native_get_irq_config,
+ .setup_queue = xive_native_setup_queue,
+ .cleanup_queue = xive_native_cleanup_queue,
+ .match = xive_native_match,
+diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
+index 52198131c75e..33c10749edec 100644
+--- a/arch/powerpc/sysdev/xive/spapr.c
++++ b/arch/powerpc/sysdev/xive/spapr.c
+@@ -215,6 +215,38 @@ static long plpar_int_set_source_config(unsigned long flags,
+ return 0;
+ }
+
++static long plpar_int_get_source_config(unsigned long flags,
++ unsigned long lisn,
++ unsigned long *target,
++ unsigned long *prio,
++ unsigned long *sw_irq)
++{
++ unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
++ long rc;
++
++ pr_devel("H_INT_GET_SOURCE_CONFIG flags=%lx lisn=%lx\n", flags, lisn);
++
++ do {
++ rc = plpar_hcall(H_INT_GET_SOURCE_CONFIG, retbuf, flags, lisn,
++ target, prio, sw_irq);
++ } while (plpar_busy_delay(rc));
++
++ if (rc) {
++ pr_err("H_INT_GET_SOURCE_CONFIG lisn=%ld failed %ld\n",
++ lisn, rc);
++ return rc;
++ }
++
++ *target = retbuf[0];
++ *prio = retbuf[1];
++ *sw_irq = retbuf[2];
++
++ pr_devel("H_INT_GET_SOURCE_CONFIG target=%lx prio=%lx sw_irq=%lx\n",
++ retbuf[0], retbuf[1], retbuf[2]);
++
++ return 0;
++}
++
+ static long plpar_int_get_queue_info(unsigned long flags,
+ unsigned long target,
+ unsigned long priority,
+@@ -398,6 +430,24 @@ static int xive_spapr_configure_irq(u32 hw_irq, u32 target, u8 prio, u32 sw_irq)
+ return rc == 0 ? 0 : -ENXIO;
+ }
+
++static int xive_spapr_get_irq_config(u32 hw_irq, u32 *target, u8 *prio,
++ u32 *sw_irq)
++{
++ long rc;
++ unsigned long h_target;
++ unsigned long h_prio;
++ unsigned long h_sw_irq;
++
++ rc = plpar_int_get_source_config(0, hw_irq, &h_target, &h_prio,
++ &h_sw_irq);
++
++ *target = h_target;
++ *prio = h_prio;
++ *sw_irq = h_sw_irq;
++
++ return rc == 0 ? 0 : -ENXIO;
++}
++
+ /* This can be called multiple time to change a queue configuration */
+ static int xive_spapr_configure_queue(u32 target, struct xive_q *q, u8 prio,
+ __be32 *qpage, u32 order)
+@@ -590,6 +640,7 @@ static void xive_spapr_sync_source(u32 hw_irq)
+ static const struct xive_ops xive_spapr_ops = {
+ .populate_irq_data = xive_spapr_populate_irq_data,
+ .configure_irq = xive_spapr_configure_irq,
++ .get_irq_config = xive_spapr_get_irq_config,
+ .setup_queue = xive_spapr_setup_queue,
+ .cleanup_queue = xive_spapr_cleanup_queue,
+ .match = xive_spapr_match,
+diff --git a/arch/powerpc/sysdev/xive/xive-internal.h b/arch/powerpc/sysdev/xive/xive-internal.h
+index 211725dbf364..59cd366e7933 100644
+--- a/arch/powerpc/sysdev/xive/xive-internal.h
++++ b/arch/powerpc/sysdev/xive/xive-internal.h
+@@ -33,6 +33,8 @@ struct xive_cpu {
+ struct xive_ops {
+ int (*populate_irq_data)(u32 hw_irq, struct xive_irq_data *data);
+ int (*configure_irq)(u32 hw_irq, u32 target, u8 prio, u32 sw_irq);
++ int (*get_irq_config)(u32 hw_irq, u32 *target, u8 *prio,
++ u32 *sw_irq);
+ int (*setup_queue)(unsigned int cpu, struct xive_cpu *xc, u8 prio);
+ void (*cleanup_queue)(unsigned int cpu, struct xive_cpu *xc, u8 prio);
+ void (*setup_cpu)(unsigned int cpu, struct xive_cpu *xc);
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 25d4adccf750..4ea53e05053f 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -2574,14 +2574,14 @@ static void dump_all_xives(void)
+
+ static void dump_one_xive_irq(u32 num)
+ {
+- s64 rc;
+- __be64 vp;
++ int rc;
++ u32 target;
+ u8 prio;
+- __be32 lirq;
++ u32 lirq;
+
+- rc = opal_xive_get_irq_config(num, &vp, &prio, &lirq);
+- xmon_printf("IRQ 0x%x config: vp=0x%llx prio=%d lirq=0x%x (rc=%lld)\n",
+- num, be64_to_cpu(vp), prio, be32_to_cpu(lirq), rc);
++ rc = xmon_xive_get_irq_config(num, &target, &prio, &lirq);
++ xmon_printf("IRQ 0x%08x : target=0x%x prio=%d lirq=0x%x (rc=%d)\n",
++ num, target, prio, lirq, rc);
+ }
+
+ static void dump_xives(void)
+--
+2.22.0
+
diff --git a/patches.suse/powerpc-xmon-Add-a-dump-of-all-XIVE-interrupts.patch b/patches.suse/powerpc-xmon-Add-a-dump-of-all-XIVE-interrupts.patch
new file mode 100644
index 0000000000..de520390d9
--- /dev/null
+++ b/patches.suse/powerpc-xmon-Add-a-dump-of-all-XIVE-interrupts.patch
@@ -0,0 +1,66 @@
+From 39f14e79b15a40709ef177bc4c07f193b6d3bce3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
+Date: Wed, 14 Aug 2019 17:47:54 +0200
+Subject: [PATCH] powerpc/xmon: Add a dump of all XIVE interrupts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+References: bsc#1142019
+Patch-mainline: queued
+Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Git-commit: 39f14e79b15a40709ef177bc4c07f193b6d3bce3
+
+Modify the xmon 'dxi' command to query all interrupts if no IRQ number
+is specified.
+
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190814154754.23682-4-clg@kaod.org
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/xmon/xmon.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 4ea53e05053f..dc9832e06256 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -2584,6 +2584,25 @@ static void dump_one_xive_irq(u32 num)
+ num, target, prio, lirq, rc);
+ }
+
++static void dump_all_xive_irq(void)
++{
++ unsigned int i;
++ struct irq_desc *desc;
++
++ for_each_irq_desc(i, desc) {
++ struct irq_data *d = irq_desc_get_irq_data(desc);
++ unsigned int hwirq;
++
++ if (!d)
++ continue;
++
++ hwirq = (unsigned int)irqd_to_hwirq(d);
++ /* IPIs are special (HW number 0) */
++ if (hwirq)
++ dump_one_xive_irq(hwirq);
++ }
++}
++
+ static void dump_xives(void)
+ {
+ unsigned long num;
+@@ -2601,6 +2620,8 @@ static void dump_xives(void)
+ } else if (c == 'i') {
+ if (scanhex(&num))
+ dump_one_xive_irq(num);
++ else
++ dump_all_xive_irq();
+ return;
+ }
+
+--
+2.22.0
+
diff --git a/patches.suse/powerpc-xmon-Check-for-HV-mode-when-dumping-XIVE-inf.patch b/patches.suse/powerpc-xmon-Check-for-HV-mode-when-dumping-XIVE-inf.patch
new file mode 100644
index 0000000000..bcea95d6fe
--- /dev/null
+++ b/patches.suse/powerpc-xmon-Check-for-HV-mode-when-dumping-XIVE-inf.patch
@@ -0,0 +1,59 @@
+From c3e0dbd7f780a58c4695f1cd8fc8afde80376737 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
+Date: Wed, 14 Aug 2019 17:47:52 +0200
+Subject: [PATCH] powerpc/xmon: Check for HV mode when dumping XIVE info from
+ OPAL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+References: bsc#1142019
+Patch-mainline: queued
+Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Git-commit: c3e0dbd7f780a58c4695f1cd8fc8afde80376737
+
+Currently, the xmon 'dx' command calls OPAL to dump the XIVE state in
+the OPAL logs and also outputs some of the fields of the internal XIVE
+structures in Linux. The OPAL calls can only be done on baremetal
+(PowerNV) and they crash a pseries machine. Fix by checking the
+hypervisor feature of the CPU.
+
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190814154754.23682-2-clg@kaod.org
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/xmon/xmon.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 14e56c25879f..25d4adccf750 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -2534,13 +2534,16 @@ static void dump_pacas(void)
+ static void dump_one_xive(int cpu)
+ {
+ unsigned int hwid = get_hard_smp_processor_id(cpu);
+-
+- opal_xive_dump(XIVE_DUMP_TM_HYP, hwid);
+- opal_xive_dump(XIVE_DUMP_TM_POOL, hwid);
+- opal_xive_dump(XIVE_DUMP_TM_OS, hwid);
+- opal_xive_dump(XIVE_DUMP_TM_USER, hwid);
+- opal_xive_dump(XIVE_DUMP_VP, hwid);
+- opal_xive_dump(XIVE_DUMP_EMU_STATE, hwid);
++ bool hv = cpu_has_feature(CPU_FTR_HVMODE);
++
++ if (hv) {
++ opal_xive_dump(XIVE_DUMP_TM_HYP, hwid);
++ opal_xive_dump(XIVE_DUMP_TM_POOL, hwid);
++ opal_xive_dump(XIVE_DUMP_TM_OS, hwid);
++ opal_xive_dump(XIVE_DUMP_TM_USER, hwid);
++ opal_xive_dump(XIVE_DUMP_VP, hwid);
++ opal_xive_dump(XIVE_DUMP_EMU_STATE, hwid);
++ }
+
+ if (setjmp(bus_error_jmp) != 0) {
+ catch_memory_errors = 0;
+--
+2.22.0
+
diff --git a/patches.suse/rsi-add-fix-for-crash-during-assertions.patch b/patches.suse/rsi-add-fix-for-crash-during-assertions.patch
new file mode 100644
index 0000000000..677a81e06e
--- /dev/null
+++ b/patches.suse/rsi-add-fix-for-crash-during-assertions.patch
@@ -0,0 +1,38 @@
+From abd39c6ded9db53aa44c2540092bdd5fb6590fa8 Mon Sep 17 00:00:00 2001
+From: Sanjay Konduri <sanjay.konduri@redpinesignals.com>
+Date: Tue, 15 May 2018 14:34:30 +0530
+Subject: [PATCH] rsi: add fix for crash during assertions
+Git-commit: abd39c6ded9db53aa44c2540092bdd5fb6590fa8
+Patch-mainline: v4.18-rc1
+References: CVE-2018-21008,bsc#1149591
+
+Observed crash in some scenarios when assertion has occurred,
+this is because hw structure is freed and is tried to get
+accessed in some functions where null check is already
+present. So, avoided the crash by making the hw to NULL after
+freeing.
+
+Signed-off-by: Sanjay Konduri <sanjay.konduri@redpinesignals.com>
+Signed-off-by: Sushant Kumar Mishra <sushant.mishra@redpinesignals.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+index 3faa0449a5ef..bfa7569c85bb 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+@@ -245,6 +245,7 @@ void rsi_mac80211_detach(struct rsi_hw *adapter)
+ ieee80211_stop_queues(hw);
+ ieee80211_unregister_hw(hw);
+ ieee80211_free_hw(hw);
++ adapter->hw = NULL;
+ }
+
+ for (band = 0; band < NUM_NL80211_BANDS; band++) {
+--
+2.16.4
+
diff --git a/patches.suse/rtc-pcf8523-don-t-return-invalid-date-when-battery-i.patch b/patches.suse/rtc-pcf8523-don-t-return-invalid-date-when-battery-i.patch
new file mode 100644
index 0000000000..415085b17f
--- /dev/null
+++ b/patches.suse/rtc-pcf8523-don-t-return-invalid-date-when-battery-i.patch
@@ -0,0 +1,87 @@
+From ecb4a353d3afd45b9bb30c85d03ee113a0589079 Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Wed, 5 Dec 2018 17:00:09 +0200
+Subject: [PATCH] rtc: pcf8523: don't return invalid date when battery is low
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: ecb4a353d3afd45b9bb30c85d03ee113a0589079
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+The RTC_VL_READ ioctl reports the low battery condition. Still,
+pcf8523_rtc_read_time() happily returns invalid dates in this case.
+Check the battery health on pcf8523_rtc_read_time() to avoid that.
+
+Reported-by: Erik Čuk <erik.cuk@domel.com>
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/rtc/rtc-pcf8523.c | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pcf8523.c b/drivers/rtc/rtc-pcf8523.c
+index 453615f8ac9a..3fcd2cbafc84 100644
+--- a/drivers/rtc/rtc-pcf8523.c
++++ b/drivers/rtc/rtc-pcf8523.c
+@@ -85,6 +85,18 @@ static int pcf8523_write(struct i2c_client *client, u8 reg, u8 value)
+ return 0;
+ }
+
++static int pcf8523_voltage_low(struct i2c_client *client)
++{
++ u8 value;
++ int err;
++
++ err = pcf8523_read(client, REG_CONTROL3, &value);
++ if (err < 0)
++ return err;
++
++ return !!(value & REG_CONTROL3_BLF);
++}
++
+ static int pcf8523_select_capacitance(struct i2c_client *client, bool high)
+ {
+ u8 value;
+@@ -167,6 +179,14 @@ static int pcf8523_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ struct i2c_msg msgs[2];
+ int err;
+
++ err = pcf8523_voltage_low(client);
++ if (err < 0) {
++ return err;
++ } else if (err > 0) {
++ dev_err(dev, "low voltage detected, time is unreliable\n");
++ return -EINVAL;
++ }
++
+ msgs[0].addr = client->addr;
+ msgs[0].flags = 0;
+ msgs[0].len = 1;
+@@ -251,17 +271,13 @@ static int pcf8523_rtc_ioctl(struct device *dev, unsigned int cmd,
+ unsigned long arg)
+ {
+ struct i2c_client *client = to_i2c_client(dev);
+- u8 value;
+- int ret = 0, err;
++ int ret;
+
+ switch (cmd) {
+ case RTC_VL_READ:
+- err = pcf8523_read(client, REG_CONTROL3, &value);
+- if (err < 0)
+- return err;
+-
+- if (value & REG_CONTROL3_BLF)
+- ret = 1;
++ ret = pcf8523_voltage_low(client);
++ if (ret < 0)
++ return ret;
+
+ if (copy_to_user((void __user *)arg, &ret, sizeof(int)))
+ return -EFAULT;
+--
+2.16.4
+
diff --git a/patches.suse/samples-bpf-fix-to-change-the-buffer-size-for-read.patch b/patches.suse/samples-bpf-fix-to-change-the-buffer-size-for-read.patch
new file mode 100644
index 0000000000..5ef61a07f9
--- /dev/null
+++ b/patches.suse/samples-bpf-fix-to-change-the-buffer-size-for-read.patch
@@ -0,0 +1,45 @@
+From f7c2d64bac1be2ff32f8e4f500c6e5429c1003e0 Mon Sep 17 00:00:00 2001
+From: Chang-Hsien Tsai <luke.tw@gmail.com>
+Date: Sun, 19 May 2019 09:05:44 +0000
+Subject: [PATCH] samples, bpf: fix to change the buffer size for read()
+Git-commit: f7c2d64bac1be2ff32f8e4f500c6e5429c1003e0
+Patch-mainline: v5.2-rc6
+References: bsc#1051510
+
+If the trace for read is larger than 4096, the return
+value sz will be 4096. This results in off-by-one error
+on buf:
+
+ static char buf[4096];
+ ssize_t sz;
+
+ sz = read(trace_fd, buf, sizeof(buf));
+ if (sz > 0) {
+ buf[sz] = 0;
+ puts(buf);
+ }
+
+Signed-off-by: Chang-Hsien Tsai <luke.tw@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ samples/bpf/bpf_load.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/samples/bpf/bpf_load.c b/samples/bpf/bpf_load.c
+index eae7b635343d..6e87cc831e84 100644
+--- a/samples/bpf/bpf_load.c
++++ b/samples/bpf/bpf_load.c
+@@ -678,7 +678,7 @@ void read_trace_pipe(void)
+ static char buf[4096];
+ ssize_t sz;
+
+- sz = read(trace_fd, buf, sizeof(buf));
++ sz = read(trace_fd, buf, sizeof(buf) - 1);
+ if (sz > 0) {
+ buf[sz] = 0;
+ puts(buf);
+--
+2.16.4
+
diff --git a/patches.suse/samples-mei-use-dev-mei0-instead-of-dev-mei.patch b/patches.suse/samples-mei-use-dev-mei0-instead-of-dev-mei.patch
new file mode 100644
index 0000000000..0d27474fa0
--- /dev/null
+++ b/patches.suse/samples-mei-use-dev-mei0-instead-of-dev-mei.patch
@@ -0,0 +1,36 @@
+From c4a46acf1db3ce547d290c29e55b3476c78dd76c Mon Sep 17 00:00:00 2001
+From: Tomas Winkler <tomas.winkler@intel.com>
+Date: Thu, 24 Jan 2019 14:45:03 +0200
+Subject: [PATCH] samples: mei: use /dev/mei0 instead of /dev/mei
+Git-commit: c4a46acf1db3ce547d290c29e55b3476c78dd76c
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+The device was moved from misc device to character devices
+to support multiple mei devices.
+
+Cc: <stable@vger.kernel.org> #v4.9+
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ samples/mei/mei-amt-version.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/samples/mei/mei-amt-version.c b/samples/mei/mei-amt-version.c
+index 33e67bd1dc34..32234481ad7d 100644
+--- a/samples/mei/mei-amt-version.c
++++ b/samples/mei/mei-amt-version.c
+@@ -117,7 +117,7 @@ static bool mei_init(struct mei *me, const uuid_le *guid,
+
+ me->verbose = verbose;
+
+- me->fd = open("/dev/mei", O_RDWR);
++ me->fd = open("/dev/mei0", O_RDWR);
+ if (me->fd == -1) {
+ mei_err(me, "Cannot establish a handle to the Intel MEI driver\n");
+ goto err;
+--
+2.16.4
+
diff --git a/patches.suse/scripts-checkstack.pl-Fix-arm64-wrong-or-unknown-arc.patch b/patches.suse/scripts-checkstack.pl-Fix-arm64-wrong-or-unknown-arc.patch
new file mode 100644
index 0000000000..f645c0d10f
--- /dev/null
+++ b/patches.suse/scripts-checkstack.pl-Fix-arm64-wrong-or-unknown-arc.patch
@@ -0,0 +1,39 @@
+From 4f45d62a52297b10ded963412a158685647ecdec Mon Sep 17 00:00:00 2001
+From: "George G. Davis" <george_davis@mentor.com>
+Date: Mon, 3 Jun 2019 10:30:39 -0400
+Subject: [PATCH] scripts/checkstack.pl: Fix arm64 wrong or unknown architecture
+Git-commit: 4f45d62a52297b10ded963412a158685647ecdec
+Patch-mainline: v5.2-rc4
+References: bsc#1051510
+
+The following error occurs for the `make ARCH=arm64 checkstack` case:
+
+aarch64-linux-gnu-objdump -d vmlinux $(find . -name '*.ko') | \
+perl ./scripts/checkstack.pl arm64
+wrong or unknown architecture "arm64"
+
+As suggested by Masahiro Yamada, fix the above error using regular
+expressions in the same way it was fixed for the `ARCH=x86` case via
+commit fda9f9903be6 ("scripts/checkstack.pl: automatically handle
+32-bit and 64-bit mode for ARCH=x86").
+
+Suggested-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: George G. Davis <george_davis@mentor.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/checkstack.pl | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/checkstack.pl
++++ b/scripts/checkstack.pl
+@@ -44,7 +44,7 @@ my (@stack, $re, $dre, $x, $xs, $funcre)
+ $x = "[0-9a-f]"; # hex character
+ $xs = "[0-9a-f ]"; # hex character or space
+ $funcre = qr/^$x* <(.*)>:$/;
+- if ($arch eq 'aarch64') {
++ if ($arch =~ '^(aarch|arm)64$') {
+ #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp, #-80]!
+ $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o;
+ } elsif ($arch eq 'arm') {
diff --git a/patches.suse/scripts-decode_stacktrace-only-strip-base-path-when-.patch b/patches.suse/scripts-decode_stacktrace-only-strip-base-path-when-.patch
new file mode 100644
index 0000000000..cde403ac46
--- /dev/null
+++ b/patches.suse/scripts-decode_stacktrace-only-strip-base-path-when-.patch
@@ -0,0 +1,49 @@
+From 67a28de47faa83585dd644bd4c31e5a1d9346c50 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Fri, 28 Dec 2018 00:31:25 -0800
+Subject: [PATCH] scripts/decode_stacktrace: only strip base path when a prefix of the path
+Git-commit: 67a28de47faa83585dd644bd4c31e5a1d9346c50
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+Running something like:
+
+ decodecode vmlinux .
+
+leads to interested results where not only the leading "." gets stripped
+from the displayed paths, but also anywhere in the string, displaying
+something like:
+
+ kvm_vcpu_check_block (arch/arm64/kvm/virt/kvm/kvm_mainc:2141)
+
+which doesn't help further processing.
+
+Fix it by only stripping the base path if it is a prefix of the path.
+
+Link: http://lkml.kernel.org/r/20181210174659.31054-3-marc.zyngier@arm.com
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/decode_stacktrace.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
+index 64220e36ce3b..98a7d63a723e 100755
+--- a/scripts/decode_stacktrace.sh
++++ b/scripts/decode_stacktrace.sh
+@@ -78,7 +78,7 @@ parse_symbol() {
+ fi
+
+ # Strip out the base of the path
+- code=${code//$basepath/""}
++ code=${code//^$basepath/""}
+
+ # In the case of inlines, move everything to same line
+ code=${code//$'\n'/' '}
+--
+2.16.4
+
diff --git a/patches.suse/scripts-decode_stacktrace.sh-prefix-addr2line-with-C.patch b/patches.suse/scripts-decode_stacktrace.sh-prefix-addr2line-with-C.patch
new file mode 100644
index 0000000000..fe32b820e1
--- /dev/null
+++ b/patches.suse/scripts-decode_stacktrace.sh-prefix-addr2line-with-C.patch
@@ -0,0 +1,50 @@
+From c04e32e911653442fc834be6e92e072aeebe01a1 Mon Sep 17 00:00:00 2001
+From: Manuel Traut <manut@linutronix.de>
+Date: Thu, 13 Jun 2019 15:55:52 -0700
+Subject: [PATCH] scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE
+Git-commit: c04e32e911653442fc834be6e92e072aeebe01a1
+Patch-mainline: v5.2-rc5
+References: bsc#1051510
+
+At least for ARM64 kernels compiled with the crosstoolchain from
+Debian/stretch or with the toolchain from kernel.org the line number is
+not decoded correctly by 'decode_stacktrace.sh':
+
+ $ echo "[ 136.513051] f1+0x0/0xc [kcrash]" | \
+ CROSS_COMPILE=/opt/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux- \
+ ./scripts/decode_stacktrace.sh /scratch/linux-arm64/vmlinux \
+ /scratch/linux-arm64 \
+ /nfs/debian/lib/modules/4.20.0-devel
+ [ 136.513051] f1 (/linux/drivers/staging/kcrash/kcrash.c:68) kcrash
+
+If addr2line from the toolchain is used the decoded line number is correct:
+
+ [ 136.513051] f1 (/linux/drivers/staging/kcrash/kcrash.c:57) kcrash
+
+Link: http://lkml.kernel.org/r/20190527083425.3763-1-manut@linutronix.de
+Signed-off-by: Manuel Traut <manut@linutronix.de>
+Acked-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/decode_stacktrace.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
+index bcdd45df3f51..a7a36209a193 100755
+--- a/scripts/decode_stacktrace.sh
++++ b/scripts/decode_stacktrace.sh
+@@ -73,7 +73,7 @@ parse_symbol() {
+ if [[ "${cache[$module,$address]+isset}" == "isset" ]]; then
+ local code=${cache[$module,$address]}
+ else
+- local code=$(addr2line -i -e "$objfile" "$address")
++ local code=$(${CROSS_COMPILE}addr2line -i -e "$objfile" "$address")
+ cache[$module,$address]=$code
+ fi
+
+--
+2.16.4
+
diff --git a/patches.suse/scripts-gdb-fix-lx-version-string-output.patch b/patches.suse/scripts-gdb-fix-lx-version-string-output.patch
new file mode 100644
index 0000000000..a754371831
--- /dev/null
+++ b/patches.suse/scripts-gdb-fix-lx-version-string-output.patch
@@ -0,0 +1,58 @@
+From b058809bfc8faeb7b7cae047666e23375a060059 Mon Sep 17 00:00:00 2001
+From: Du Changbin <changbin.du@gmail.com>
+Date: Thu, 3 Jan 2019 15:28:27 -0800
+Subject: [PATCH] scripts/gdb: fix lx-version string output
+Git-commit: b058809bfc8faeb7b7cae047666e23375a060059
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+A bug is present in GDB which causes early string termination when
+parsing variables. This has been reported [0], but we should ensure
+that we can support at least basic printing of the core kernel strings.
+
+For current gdb version (has been tested with 7.3 and 8.1), 'lx-version'
+only prints one character.
+
+ (gdb) lx-version
+ L(gdb)
+
+This can be fixed by casting 'linux_banner' as (char *).
+
+ (gdb) lx-version
+ Linux version 4.19.0-rc1+ (changbin@acer) (gcc version 7.3.0 (Ubuntu 7.3.0-16ubuntu3)) #21 SMP Sat Sep 1 21:43:30 CST 2018
+
+[0] https://sourceware.org/bugzilla/show_bug.cgi?id=20077
+
+[kbingham@kernel.org: add detail to commit message]
+Link: http://lkml.kernel.org/r/20181111162035.8356-1-kieran.bingham@ideasonboard.com
+Fixes: 2d061d999424 ("scripts/gdb: add version command")
+Signed-off-by: Du Changbin <changbin.du@gmail.com>
+Signed-off-by: Kieran Bingham <kbingham@kernel.org>
+Acked-by: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Jason Wessel <jason.wessel@windriver.com>
+Cc: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/gdb/linux/proc.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/gdb/linux/proc.py b/scripts/gdb/linux/proc.py
+index 086d27223c0c..0aebd7565b03 100644
+--- a/scripts/gdb/linux/proc.py
++++ b/scripts/gdb/linux/proc.py
+@@ -41,7 +41,7 @@ class LxVersion(gdb.Command):
+
+ def invoke(self, arg, from_tty):
+ # linux_banner should contain a newline
+- gdb.write(gdb.parse_and_eval("linux_banner").string())
++ gdb.write(gdb.parse_and_eval("(char *)linux_banner").string())
+
+ LxVersion()
+
+--
+2.16.4
+
diff --git a/patches.suse/supported-flag-wildcards b/patches.suse/supported-flag-wildcards
index 8006b16d91..778a20de64 100644
--- a/patches.suse/supported-flag-wildcards
+++ b/patches.suse/supported-flag-wildcards
@@ -3,6 +3,7 @@ From: Michal Marek <mmarek@suse.cz>
Date: Mon, 19 Sep 2011 16:31:49 +0200
Subject: [PATCH] modpost: Allow wildcards in the Module.supported file
Patch-mainline: Never, SLES feature
+References: none
Signed-off-by: Michal Marek <mmarek@suse.cz>
diff --git a/patches.suse/test_firmware-fix-a-memory-leak-bug.patch b/patches.suse/test_firmware-fix-a-memory-leak-bug.patch
new file mode 100644
index 0000000000..93cb35eb34
--- /dev/null
+++ b/patches.suse/test_firmware-fix-a-memory-leak-bug.patch
@@ -0,0 +1,48 @@
+From d4fddac5a51c378c5d3e68658816c37132611e1f Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wenwen@cs.uga.edu>
+Date: Sun, 14 Jul 2019 01:11:35 -0500
+Subject: [PATCH] test_firmware: fix a memory leak bug
+Git-commit: d4fddac5a51c378c5d3e68658816c37132611e1f
+Patch-mainline: v5.3-rc2
+References: bsc#1051510
+
+In test_firmware_init(), the buffer pointed to by the global pointer
+'test_fw_config' is allocated through kzalloc(). Then, the buffer is
+initialized in __test_firmware_config_init(). In the case that the
+initialization fails, the following execution in test_firmware_init() needs
+to be terminated with an error code returned to indicate this failure.
+However, the allocated buffer is not freed on this execution path, leading
+to a memory leak bug.
+
+To fix the above issue, free the allocated buffer before returning from
+test_firmware_init().
+
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Link: https://lore.kernel.org/r/1563084696-6865-1-git-send-email-wang6495@umn.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ lib/test_firmware.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/lib/test_firmware.c b/lib/test_firmware.c
+index 83ea6c4e623c..6ca97a63b3d6 100644
+--- a/lib/test_firmware.c
++++ b/lib/test_firmware.c
+@@ -886,8 +886,11 @@ static int __init test_firmware_init(void)
+ return -ENOMEM;
+
+ rc = __test_firmware_config_init();
+- if (rc)
++ if (rc) {
++ kfree(test_fw_config);
++ pr_err("could not init firmware test config: %d\n", rc);
+ return rc;
++ }
+
+ rc = misc_register(&test_fw_misc_device);
+ if (rc) {
+--
+2.16.4
+
diff --git a/patches.suse/usb-host-xhci-rcar-Fix-typo-in-compatible-string-mat.patch b/patches.suse/usb-host-xhci-rcar-Fix-typo-in-compatible-string-mat.patch
new file mode 100644
index 0000000000..d3964c43d5
--- /dev/null
+++ b/patches.suse/usb-host-xhci-rcar-Fix-typo-in-compatible-string-mat.patch
@@ -0,0 +1,40 @@
+From 636bd02a7ba9025ff851d0cfb92768c8fa865859 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 27 Aug 2019 14:51:12 +0200
+Subject: [PATCH] usb: host: xhci: rcar: Fix typo in compatible string matching
+Git-commit: 636bd02a7ba9025ff851d0cfb92768c8fa865859
+Patch-mainline: v5.3-rc7
+References: bsc#1051510
+
+It's spelled "renesas", not "renensas".
+
+Due to this typo, RZ/G1M and RZ/G1N were not covered by the check.
+
+Fixes: 2dc240a3308b ("usb: host: xhci: rcar: retire use of xhci_plat_type_is()")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/20190827125112.12192-1-geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/host/xhci-rcar.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
+index 8616c52849c6..2b0ccd150209 100644
+--- a/drivers/usb/host/xhci-rcar.c
++++ b/drivers/usb/host/xhci-rcar.c
+@@ -104,7 +104,7 @@ static int xhci_rcar_is_gen2(struct device *dev)
+ return of_device_is_compatible(node, "renesas,xhci-r8a7790") ||
+ of_device_is_compatible(node, "renesas,xhci-r8a7791") ||
+ of_device_is_compatible(node, "renesas,xhci-r8a7793") ||
+- of_device_is_compatible(node, "renensas,rcar-gen2-xhci");
++ of_device_is_compatible(node, "renesas,rcar-gen2-xhci");
+ }
+
+ static int xhci_rcar_is_gen3(struct device *dev)
+--
+2.16.4
+
diff --git a/series.conf b/series.conf
index 2efd29769c..1c717183de 100644
--- a/series.conf
+++ b/series.conf
@@ -10305,6 +10305,13 @@
patches.suse/0001-Btrfs-fix-assertion-failure-during-fsync-in-no-holes.patch
patches.suse/btrfs-incremental-send-fix-emission-of-invalid-clone-operations.patch
patches.suse/btrfs-preserve-i_mode-if-_btrfs_set_acl-fails.patch
+ patches.suse/btrfs-add-a-helper-to-retrive-extent-inline-ref-type.patch
+ patches.suse/btrfs-convert-to-use-btrfs_get_extent_inline_ref_type.patch
+ patches.suse/btrfs-remove-bug-in-btrfs_extent_inline_ref_size.patch
+ patches.suse/btrfs-remove-bug-in-print_extent_item.patch
+ patches.suse/btrfs-remove-bug-in-add_data_reference.patch
+ patches.suse/btrfs-remove-bug_on-in-_add_tree_block.patch
+ patches.suse/btrfs-add-one-more-sanity-check-for-shared-ref-type.patch
patches.suse/sunrpc-Const-ify-instances-of-struct-svc_xprt_ops.patch
patches.suse/svcrdma-Clean-up-svc_rdma_build_read_chunk.patch
patches.suse/svcrdma-Populate-tail-iovec-when-receiving.patch
@@ -29122,6 +29129,7 @@
patches.suse/i2c-mv64xxx-Apply-errata-delay-only-in-standard-mode
patches.suse/0004-i2c-xlp9xx-Check-for-Bus-state-before-every-transfer.patch
patches.suse/0005-i2c-xlp9xx-Handle-NACK-on-DATA-properly.patch
+ patches.suse/i2c-qup-fixed-releasing-dma-without-flush-operation-.patch
patches.suse/0315-i2c-imx-use-clk-notifier-for-rate-changes.patch
patches.suse/0316-i2c-imx-avoid-taking-clk_prepare-mutex-in-PM-callbac.patch
patches.suse/0022-i2c-add-support-for-Socionext-SynQuacer-I2C-controll.patch
@@ -33289,6 +33297,7 @@
patches.suse/wil6210-rate-limit-wil_rx_refill-error.patch
patches.suse/mwifiex-correct-histogram-data-with-appropriate-inde
patches.suse/brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch
+ patches.suse/rsi-add-fix-for-crash-during-assertions.patch
patches.suse/brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch
patches.suse/rtlwifi-support-accurate-nullfunc-frame-tx-ack-repor.patch
patches.suse/rtlwifi-remove-CONNECTION_MONITOR-flag.patch
@@ -40742,6 +40751,8 @@
patches.suse/pinctrl-qcom-spmi-mpp-Fix-drive-strength-setting.patch
patches.suse/pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch
patches.suse/pinctrl-qcom-spmi-mpp-Fix-err-handling-of-pmic_mpp_s.patch
+ patches.suse/gpio-pxa-handle-corner-case-of-unprobed-device.patch
+ patches.suse/gpio-mxs-Get-rid-of-external-API-call.patch
patches.suse/gpio-davinci-remove-unused-member-of-davinci_gpio_controller.patch
patches.suse/leds-pwm-silently-error-out-on-EPROBE_DEFER.patch
patches.suse/ipmi-fix-return-value-of-ipmi_set_my_LUN.patch
@@ -44720,6 +44731,7 @@
patches.suse/0005-mmc-sdhci-of-esdhc-fix-spelling-mistake-upsupported-.patch
patches.suse/0006-mmc-sdhci-of-esdhc-Fix-timeout-checks.patch
patches.suse/mmc-sdhci-xenon-Fix-timeout-checks.patch
+ patches.suse/scripts-decode_stacktrace-only-strip-base-path-when-.patch
patches.suse/0001-mm-print-more-information-about-mapping-in-__dump_pa.patch
patches.suse/0002-mm-lower-the-printk-loglevel-for-__dump_page-message.patch
patches.suse/0003-mm-memory_hotplug-drop-pointless-block-alignment-che.patch
@@ -44837,6 +44849,7 @@
patches.suse/pinctrl-freescale-break-dependency-on-soc_imx8mq-for-i-mx8mq.patch
patches.suse/rtc-m41t80-Correct-alarm-month-range-with-RTC-reads.patch
patches.suse/0001-dt-bindings-rtc-sun6i-rtc-Fix-register-range-in-exam.patch
+ patches.suse/rtc-pcf8523-don-t-return-invalid-date-when-battery-i.patch
patches.suse/dmaengine-dw-dmac-implement-dma-protection-control-s.patch
patches.suse/dmaengine-xilinx_dma-Remove-__aligned-attribute-on-z.patch
patches.suse/revert-iommu-io-pgtable-arm-check-for-v7s-incapable-systems
@@ -44928,6 +44941,7 @@
patches.suse/ALSA-hda-realtek-Enable-the-headset-mic-auto-detecti.patch
patches.suse/ALSA-hda-tegra-clear-pending-irq-handlers.patch
patches.suse/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch
+ patches.suse/scripts-gdb-fix-lx-version-string-output.patch
patches.suse/mm-speed-up-mremap-by-20x-on-large-regions.patch
patches.suse/ARM-8808-1-kexec-offline-panic_smp_self_stop-CPU.patch
patches.suse/arm64-add-basic-kconfig-symbols-for-i-mx8.patch
@@ -45369,6 +45383,7 @@
patches.suse/serial-fix-race-between-flush_to_ldisc-and-tty_open.patch
patches.suse/iio-chemical-atlas-ph-sensor-correct-IIO_TEMP-values.patch
patches.suse/debugfs-fix-debugfs_rename-parameter-checking.patch
+ patches.suse/samples-mei-use-dev-mei0-instead-of-dev-mei.patch
patches.suse/0001-fpga-stratix10-soc-fix-wrong-of_node_put-in-init-fun.patch
patches.suse/ucc_geth-Reset-BQL-queue-when-stopping-device.patch
patches.suse/virtio_net-Don-t-enable-NAPI-when-interface-is-down.patch
@@ -46809,6 +46824,7 @@
patches.suse/nvmet-fix-building-bvec-from-sg-list.patch
patches.suse/kbuild-strip-whitespace-in-cmd_record_mcount-findstr.patch
patches.suse/kbuild-modversions-Fix-relative-CRC-byte-order-inter.patch
+ patches.suse/kconfig-mn-conf-handle-backspace-H-key.patch
patches.suse/ALSA-rawmidi-Fix-potential-Spectre-v1-vulnerability.patch
patches.suse/ALSA-seq-oss-Fix-Spectre-v1-vulnerability.patch
patches.suse/ALSA-hda-realtek-Enable-headset-MIC-of-Acer-Aspire-Z.patch
@@ -46876,6 +46892,7 @@
patches.suse/KVM-Reject-device-ioctls-from-processes-other-than-t.patch
patches.suse/kvm-svm-workaround-errata-1096-insn_len-maybe-zero-on-smap-violation
patches.suse/kvm-x86-emulate-msr_ia32_arch_capabilities-on-amd-hosts.patch
+ patches.suse/kvm-x86-move-msr_ia32_arch_capabilities-to-array-emulated_msrs
patches.suse/msft-hv-1857-x86-kvm-hyper-v-avoid-spurious-pending-stimer-on-vCP.patch
patches.suse/KVM-arm-arm64-vgic-its-Take-the-srcu-lock-when-writi.patch
patches.suse/KVM-arm-arm64-vgic-its-Take-the-srcu-lock-when-parsi.patch
@@ -48410,6 +48427,7 @@
patches.suse/net-mvpp2-Use-strscpy-to-handle-stat-strings.patch
patches.suse/pktgen-do-not-sleep-with-the-thread-lock-held.patch
patches.suse/x86-insn-eval-Fix-use-after-free-access-to-LDT-entry.patch
+ patches.suse/scripts-checkstack.pl-Fix-arm64-wrong-or-unknown-arc.patch
patches.suse/hwmon-core-add-thermal-sensors-only-if-dev-of_node-i.patch
patches.suse/hwmon-pmbus-core-Treat-parameters-as-paged-if-on-mul.patch
patches.suse/drm-i915-icl-Add-WaDisableBankHangMode.patch
@@ -48449,6 +48467,7 @@
patches.suse/Revert-ALSA-hda-realtek-Improve-the-headset-mic-for-.patch
patches.suse/iommu-arm-smmu-avoid-constant-zero-in-tlbi-writes
patches.suse/mm-list_lru-c-fix-memory-leak-in-_memcg_init_list_lru_node.patch
+ patches.suse/scripts-decode_stacktrace.sh-prefix-addr2line-with-C.patch
patches.suse/mm-mlock-c-mlockall-error-for-flag-mcl_onfault.patch
patches.suse/fs-ocfs2-fix-race-in-ocfs2_dentry_attach_lock.patch
patches.suse/mm-mlock-c-change-count_mm_mlocked_page_nr-return-type.patch
@@ -48495,8 +48514,10 @@
patches.suse/0001-mwifiex-Abort-at-too-short-BSS-descriptor-element.patch
patches.suse/iwlwifi-Fix-double-free-problems-in-iwl_req_fw_callb.patch
patches.suse/0001-mwifiex-Fix-heap-overflow-in-mwifiex_uap_parse_tail_.patch
+ patches.suse/samples-bpf-fix-to-change-the-buffer-size-for-read.patch
patches.suse/bpf-sockmap-fix-use-after-free-from-sleep-in-psock-b.patch
patches.suse/ipv6-flowlabel-fl6_sock_lookup-must-use-atomic_inc_n.patch
+ patches.suse/mpls-fix-warning-with-multi-label-encap.patch
patches.suse/can-flexcan-fix-timeout-when-set-small-bitrate.patch
patches.suse/can-mcp251x-add-support-for-mcp25625.patch
patches.suse/can-m_can-implement-errata-Needless-activation-of-MR.patch
@@ -48648,6 +48669,7 @@
patches.suse/x86-umwait-Add-sysfs-interface-to-control-umwait-C0..patch
patches.suse/x86-umwait-Add-sysfs-interface-to-control-umwait-max.patch
patches.suse/Documentation-ABI-Document-umwait-control-sysfs-inte.patch
+ patches.suse/0001-x86-ptrace-Fix-possible-spectre-v1-in-ptrace_get_deb.patch
patches.suse/x86-topology-Add-CPUID.1F-multi-die-package-support.patch
patches.suse/x86-topology-Create-topology_max_die_per_package.patch
patches.suse/cpu-topology-Export-die_id.patch
@@ -49265,6 +49287,7 @@
patches.suse/usb-pci-quirks-Correct-AMD-PLL-quirk-detection.patch
patches.suse/usb-wusbcore-fix-unbalanced-get-put-cluster_id.patch
patches.suse/hpet-Fix-division-by-zero-in-hpet_time_div.patch
+ patches.suse/test_firmware-fix-a-memory-leak-bug.patch
patches.suse/tracing-fix-header-include-guards-in-trace-event-headers.patch
patches.suse/hci_uart-check-for-missing-tty-operations.patch
patches.suse/0012-gpiolib-fix-incorrect-IRQ-requesting-of-an-active-lo.patch
@@ -49297,11 +49320,13 @@
patches.suse/coredump-split-pipe-command-whitespace-before-expand.patch
patches.suse/mm-migrate-c-initialize-pud_entry-in-migrate_vma.patch
patches.suse/powerpc-nvdimm-Pick-nearby-online-node-if-the-device.patch
+ patches.suse/HID-Add-044f-b320-ThrustMaster-Inc.-2-in-1-DT.patch
patches.suse/0013-HID-wacom-fix-bit-shift-for-Cintiq-Companion-2.patch
patches.suse/HID-holtek-test-for-sanity-of-intfdata.patch
patches.suse/HID-Add-quirk-for-HP-X1200-PIXART-OEM-mouse.patch
patches.suse/hid-input-fix-a4tech-horizontal-wheel-custom-usage.patch
patches.suse/HID-hiddev-avoid-opening-a-disconnected-device.patch
+ patches.suse/HID-hiddev-do-cleanup-in-failure-of-opening-a-device.patch
patches.suse/HID-sony-Fix-race-condition-between-rumble-and-devic.patch
patches.suse/bonding-Force-slave-speed-check-after-link-state-rec.patch
patches.suse/net-mvpp2-Don-t-check-for-3-consecutive-Idle-frames-.patch
@@ -49318,15 +49343,19 @@
patches.suse/bpf-sockmap-synchronize_rcu-before-free-ing-map.patch
patches.suse/bpf-sockmap-only-create-entry-if-ulp-is-not-already-.patch
patches.suse/net-mlx5-Fix-modify_cq_in-alignment.patch
+ patches.suse/isdn-mISDN-hfcsusb-Fix-possible-null-pointer-derefer.patch
patches.suse/net-phylink-Fix-flow-control-for-fixed-link.patch
patches.suse/compat_ioctl-pppoe-fix-PPPOEIOCSFWD-handling.patch
patches.suse/mlxsw-spectrum-Fix-error-path-in-mlxsw_sp_module_ini.patch
patches.suse/nl-mac-80211-fix-interface-combinations-on-crypto-co.patch
patches.suse/mac80211-don-t-WARN-on-short-WMM-parameters-from-AP.patch
patches.suse/mac80211_hwsim-Fix-possible-null-pointer-dereference.patch
+ patches.suse/isdn-hfcsusb-Fix-mISDN-driver-crash-caused-by-transf.patch
patches.suse/net-usb-pegasus-fix-improper-read-if-get_registers-f.patch
patches.suse/net-mlx5e-always-initialize-frag-last_in_page.patch
patches.suse/net-fix-bpf_xdp_adjust_head-regression-for-generic-X.patch
+ patches.suse/can-sja1000-force-the-string-buffer-NULL-terminated.patch
+ patches.suse/can-peak_usb-force-the-string-buffer-NULL-terminated.patch
patches.suse/0005-can-peak_usb-pcan_usb_fd-Fix-info-leaks-to-USB-devic.patch
patches.suse/0006-can-peak_usb-pcan_usb_pro-Fix-info-leaks-to-USB-devi.patch
patches.suse/mwifiex-fix-802.11n-WPA-detection.patch
@@ -49353,6 +49382,8 @@
patches.suse/ALSA-firewire-fix-a-memory-leak-bug.patch
patches.suse/mmc-cavium-Set-the-correct-dma-max-segment-size-for-.patch
patches.suse/mmc-cavium-Add-the-missing-dma-unmap-when-the-dma-ha.patch
+ patches.suse/libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch
+ patches.suse/libata-add-SG-safety-checks-in-SFF-pio-transfers.patch
patches.suse/loop-set-PF_MEMALLOC_NOIO-for-the-worker-thread.patch
patches.suse/bcache-Revert-bcache-use-sysfs_match_string-instead-.patch
patches.suse/drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch
@@ -49427,11 +49458,14 @@
patches.suse/dm-btree-fix-order-of-block-initialization-in-btree_.patch
patches.suse/dm-space-map-metadata-fix-missing-store-of-apply_bop.patch
patches.suse/dm-table-fix-invalid-memory-accesses-with-too-high-s.patch
+ patches.suse/drm-nouveau-Don-t-retry-infinitely-when-receiving-no.patch
patches.suse/xfs-fix-missing-ILOCK-unlock-when-xfs_setattr_nonsiz.patch
patches.suse/scsi-ufs-fix-null-pointer-dereference-in-ufshcd_config_vreg_hpm
patches.suse/gpiolib-never-report-open-drain-source-lines-as-inpu.patch
patches.suse/gpio-Fix-build-error-of-function-redefinition.patch
patches.suse/mm-page_owner-handle-thp-splits-correctly.patch
+ patches.suse/mac80211-fix-possible-sta-leak.patch
+ patches.suse/batman-adv-fix-uninit-value-in-batadv_netlink_get_if.patch
patches.suse/ALSA-hda-Fixes-inverted-Conexant-GPIO-mic-mute-led.patch
patches.suse/ALSA-usb-audio-Add-implicit-fb-quirk-for-Behringer-U.patch
patches.suse/ALSA-hda-ca0132-Add-new-SBZ-quirk.patch
@@ -49439,9 +49473,18 @@
patches.suse/ALSA-line6-Fix-memory-leak-at-line6_init_pcm-error-p.patch
patches.suse/ALSA-usb-audio-Check-mixer-unit-bitmap-yet-more-stri.patch
patches.suse/ALSA-seq-Fix-potential-concurrent-access-to-the-dele.patch
+ patches.suse/mmc-sdhci-of-at91-add-quirk-for-broken-HS200.patch
patches.suse/kvm-x86-don-t-update-rip-or-do-single-step-on-faulting-emulation
+ patches.suse/ftrace-fix-null-pointer-dereference-in-t_probe_next.patch
+ patches.suse/ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch
+ patches.suse/ftrace-check-for-successful-allocation-of-hash.patch
patches.suse/mac80211-Don-t-memset-RXCB-prior-to-PAE-intercept.patch
patches.suse/mac80211-Correctly-set-noencrypt-for-PAE-frames.patch
+ patches.suse/batman-adv-Only-read-OGM-tvlv_len-after-buffer-len-c.patch
+ patches.suse/batman-adv-Only-read-OGM2-tvlv_len-after-buffer-len-.patch
+ patches.suse/usb-host-xhci-rcar-Fix-typo-in-compatible-string-mat.patch
+ patches.suse/USB-cdc-wdm-fix-race-between-write-and-disconnect-du.patch
+ patches.suse/VMCI-Release-resource-if-the-work-is-already-queued.patch
# jejb/scsi for-next
patches.suse/scsi-cxlflash-Mark-expected-switch-fall-throughs.patch
@@ -49489,6 +49532,9 @@
patches.suse/scsi-lpfc-Update-lpfc-version-to-12.4.0.0.patch
# powerpc/linux next
+ patches.suse/powerpc-xmon-Check-for-HV-mode-when-dumping-XIVE-inf.patch
+ patches.suse/powerpc-xive-Fix-dump-of-XIVE-interrupt-under-pserie.patch
+ patches.suse/powerpc-xmon-Add-a-dump-of-all-XIVE-interrupts.patch
patches.suse/powerpc-rtas-use-device-model-APIs-and-serialization.patch
patches.suse/powerpc-64s-support-nospectre_v2-cmdline-option.patch
@@ -49547,6 +49593,7 @@
patches.suse/0001-x86-speculation-Prepare-entry-code-for-Spectre-v1-sw.patch
patches.suse/0002-x86-speculation-Enable-Spectre-v1-swapgs-mitigations.patch
patches.suse/x86-speculation-swapgs-exclude-ATOMs-from-speculating-through-SWAPGS.patch
+ patches.suse/powerpc-fadump-when-fadump-is-supported-register-the.patch
########################################################
# end of sorted patches