Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2019-05-17 06:39:08 +0200
committerJiri Slaby <jslaby@suse.cz>2019-05-17 06:39:08 +0200
commit4baa04bc2a08e48ca10f7838f4d1a2a8f359c0fb (patch)
tree2d5ebf96b639bf55cba25dbe007e3a94469184a1
parenta3b49050a2c62f2915620eca83b1b5f0ef1840dd (diff)
parent073196d10993d0156c3e040fe324a0e3c0745523 (diff)
Merge branch 'master' into stable
-rw-r--r--patches.kernel.org/5.1.3-001-platform-x86-sony-laptop-Fix-unintentional-fall.patch58
-rw-r--r--patches.kernel.org/5.1.3-002-platform-x86-thinkpad_acpi-Disable-Bluetooth-fo.patch125
-rw-r--r--patches.kernel.org/5.1.3-003-platform-x86-dell-laptop-fix-rfkill-functionali.patch62
-rw-r--r--patches.kernel.org/5.1.3-004-hwmon-pwm-fan-Disable-PWM-if-fetching-cooling-d.patch39
-rw-r--r--patches.kernel.org/5.1.3-005-hwmon-occ-Fix-extended-status-bits.patch52
-rw-r--r--patches.kernel.org/5.1.3-006-selftests-seccomp-Handle-namespace-failures-gra.patch194
-rw-r--r--patches.kernel.org/5.1.3-007-i2c-core-ratelimit-transfer-when-suspended-erro.patch64
-rw-r--r--patches.kernel.org/5.1.3-008-kernfs-fix-barrier-usage-in-__kernfs_new_node.patch43
-rw-r--r--patches.kernel.org/5.1.3-009-virt-vbox-Sanity-check-parameter-types-for-hgcm.patch79
-rw-r--r--patches.kernel.org/5.1.3-010-USB-serial-fix-unthrottle-races.patch137
-rw-r--r--patches.kernel.org/5.1.3-011-mwl8k-Fix-rate_idx-underflow.patch87
-rw-r--r--patches.kernel.org/5.1.3-012-rtlwifi-rtl8723ae-Fix-missing-break-in-switch-s.patch42
-rw-r--r--patches.kernel.org/5.1.3-013-Don-t-jump-to-compute_result-state-from-check_r.patch120
-rw-r--r--patches.kernel.org/5.1.3-014-bonding-fix-arp_validate-toggling-in-active-bac.patch84
-rw-r--r--patches.kernel.org/5.1.3-015-bridge-Fix-error-path-for-kobject_init_and_add.patch70
-rw-r--r--patches.kernel.org/5.1.3-016-dpaa_eth-fix-SG-frame-cleanup.patch38
-rw-r--r--patches.kernel.org/5.1.3-017-fib_rules-return-0-directly-if-an-exactly-same-.patch55
-rw-r--r--patches.kernel.org/5.1.3-018-ipv4-Fix-raw-socket-lookup-for-local-traffic.patch52
-rw-r--r--patches.kernel.org/5.1.3-019-net-dsa-Fix-error-cleanup-path-in-dsa_init_modu.patch89
-rw-r--r--patches.kernel.org/5.1.3-020-net-ethernet-stmmac-dwmac-sun8i-enable-support-.patch41
-rw-r--r--patches.kernel.org/5.1.3-021-net-macb-Change-interrupt-and-napi-enable-order.patch58
-rw-r--r--patches.kernel.org/5.1.3-022-net-seeq-fix-crash-caused-by-not-set-dev.parent.patch36
-rw-r--r--patches.kernel.org/5.1.3-023-net-ucc_geth-fix-Oops-when-changing-number-of-b.patch88
-rw-r--r--patches.kernel.org/5.1.3-024-packet-Fix-error-path-in-packet_init.patch93
-rw-r--r--patches.kernel.org/5.1.3-025-selinux-do-not-report-error-on-connect-AF_UNSPE.patch61
-rw-r--r--patches.kernel.org/5.1.3-026-tipc-fix-hanging-clients-using-poll-with-EPOLLO.patch60
-rw-r--r--patches.kernel.org/5.1.3-027-vlan-disable-SIOCSHWTSTAMP-in-container.patch45
-rw-r--r--patches.kernel.org/5.1.3-028-vrf-sit-mtu-should-not-be-updated-when-vrf-netd.patch41
-rw-r--r--patches.kernel.org/5.1.3-029-tuntap-fix-dividing-by-zero-in-ebpf-queue-selec.patch50
-rw-r--r--patches.kernel.org/5.1.3-030-tuntap-synchronize-through-tfiles-array-instead.patch77
-rw-r--r--patches.kernel.org/5.1.3-031-net-phy-fix-phy_validate_pause.patch55
-rw-r--r--patches.kernel.org/5.1.3-032-flow_dissector-disable-preemption-around-BPF-ca.patch75
-rw-r--r--patches.kernel.org/5.1.3-033-isdn-bas_gigaset-use-usb_fill_int_urb-properly.patch126
-rw-r--r--patches.kernel.org/5.1.3-034-drivers-virt-fsl_hypervisor.c-dereferencing-err.patch110
-rw-r--r--patches.kernel.org/5.1.3-035-drivers-virt-fsl_hypervisor.c-prevent-integer-o.patch52
-rw-r--r--patches.kernel.org/5.1.3-036-powerpc-book3s-64-check-for-NULL-pointer-in-pgd.patch63
-rw-r--r--patches.kernel.org/5.1.3-037-powerpc-powernv-idle-Restore-IAMR-after-idle.patch84
-rw-r--r--patches.kernel.org/5.1.3-038-powerpc-booke64-set-RI-in-default-MSR.patch39
-rw-r--r--patches.kernel.org/5.1.3-039-virtio_ring-Fix-potential-mem-leak-in-virtqueue.patch38
-rw-r--r--patches.kernel.org/5.1.3-040-PCI-hv-Fix-a-memory-leak-in-hv_eject_device_wor.patch56
-rw-r--r--patches.kernel.org/5.1.3-041-PCI-hv-Add-hv_pci_remove_slots-when-we-unload-t.patch83
-rw-r--r--patches.kernel.org/5.1.3-042-PCI-hv-Add-pci_destroy_slot-in-pci_devices_pres.patch97
-rw-r--r--patches.kernel.org/5.1.3-043-f2fs-Fix-use-of-number-of-devices.patch199
-rw-r--r--patches.kernel.org/5.1.3-044-Linux-5.1.3.patch28
-rw-r--r--series.conf44
45 files changed, 3289 insertions, 0 deletions
diff --git a/patches.kernel.org/5.1.3-001-platform-x86-sony-laptop-Fix-unintentional-fall.patch b/patches.kernel.org/5.1.3-001-platform-x86-sony-laptop-Fix-unintentional-fall.patch
new file mode 100644
index 0000000000..e9dd9e5985
--- /dev/null
+++ b/patches.kernel.org/5.1.3-001-platform-x86-sony-laptop-Fix-unintentional-fall.patch
@@ -0,0 +1,58 @@
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 24 Apr 2019 13:09:34 -0500
+Subject: [PATCH] platform/x86: sony-laptop: Fix unintentional fall-through
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 1cbd7a64959d33e7a2a1fa2bf36a62b350a9fcbd
+
+commit 1cbd7a64959d33e7a2a1fa2bf36a62b350a9fcbd upstream.
+
+It seems that the default case should return AE_CTRL_TERMINATE, instead
+of falling through to case ACPI_RESOURCE_TYPE_END_TAG and returning AE_OK;
+otherwise the line of code at the end of the function is unreachable and
+makes no sense:
+
+return AE_CTRL_TERMINATE;
+
+This fix is based on the following thread of discussion:
+
+https://lore.kernel.org/patchwork/patch/959782/
+
+Fixes: 33a04454527e ("sony-laptop: Add SNY6001 device handling (sonypi reimplementation)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/platform/x86/sony-laptop.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index 4bfbfa3f78e6..2058445fc456 100644
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -4424,14 +4424,16 @@ sony_pic_read_possible_resource(struct acpi_resource *resource, void *context)
+ }
+ return AE_OK;
+ }
++
++ case ACPI_RESOURCE_TYPE_END_TAG:
++ return AE_OK;
++
+ default:
+ dprintk("Resource %d isn't an IRQ nor an IO port\n",
+ resource->type);
++ return AE_CTRL_TERMINATE;
+
+- case ACPI_RESOURCE_TYPE_END_TAG:
+- return AE_OK;
+ }
+- return AE_CTRL_TERMINATE;
+ }
+
+ static int sony_pic_possible_resources(struct acpi_device *device)
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-002-platform-x86-thinkpad_acpi-Disable-Bluetooth-fo.patch b/patches.kernel.org/5.1.3-002-platform-x86-thinkpad_acpi-Disable-Bluetooth-fo.patch
new file mode 100644
index 0000000000..f05a8e83e7
--- /dev/null
+++ b/patches.kernel.org/5.1.3-002-platform-x86-thinkpad_acpi-Disable-Bluetooth-fo.patch
@@ -0,0 +1,125 @@
+From: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Date: Thu, 7 Mar 2019 17:37:16 +0800
+Subject: [PATCH] platform/x86: thinkpad_acpi: Disable Bluetooth for some
+ machines
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: f7db839fccf087664e5587966220821289b6a9cb
+
+commit f7db839fccf087664e5587966220821289b6a9cb upstream.
+
+Some AMD based ThinkPads have a firmware bug that calling
+"GBDC" will cause Bluetooth on Intel wireless cards blocked.
+
+Probe these models by DMI match and disable Bluetooth subdriver
+if specified Intel wireless card exist.
+
+Cc: stable <stable@vger.kernel.org> # 4.14+
+Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 72 +++++++++++++++++++++++++++-
+ 1 file changed, 70 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 726341f2b638..89ce14b35adc 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -79,7 +79,7 @@
+ #include <linux/jiffies.h>
+ #include <linux/workqueue.h>
+ #include <linux/acpi.h>
+-#include <linux/pci_ids.h>
++#include <linux/pci.h>
+ #include <linux/power_supply.h>
+ #include <sound/core.h>
+ #include <sound/control.h>
+@@ -4501,6 +4501,74 @@ static void bluetooth_exit(void)
+ bluetooth_shutdown();
+ }
+
++static const struct dmi_system_id bt_fwbug_list[] __initconst = {
++ {
++ .ident = "ThinkPad E485",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20KU"),
++ },
++ },
++ {
++ .ident = "ThinkPad E585",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20KV"),
++ },
++ },
++ {
++ .ident = "ThinkPad A285 - 20MW",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20MW"),
++ },
++ },
++ {
++ .ident = "ThinkPad A285 - 20MX",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20MX"),
++ },
++ },
++ {
++ .ident = "ThinkPad A485 - 20MU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20MU"),
++ },
++ },
++ {
++ .ident = "ThinkPad A485 - 20MV",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20MV"),
++ },
++ },
++ {}
++};
++
++static const struct pci_device_id fwbug_cards_ids[] __initconst = {
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x24F3) },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x24FD) },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2526) },
++ {}
++};
++
++
++static int __init have_bt_fwbug(void)
++{
++ /*
++ * Some AMD based ThinkPads have a firmware bug that calling
++ * "GBDC" will cause bluetooth on Intel wireless cards blocked
++ */
++ if (dmi_check_system(bt_fwbug_list) && pci_dev_present(fwbug_cards_ids)) {
++ vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_RFKILL,
++ FW_BUG "disable bluetooth subdriver for Intel cards\n");
++ return 1;
++ } else
++ return 0;
++}
++
+ static int __init bluetooth_init(struct ibm_init_struct *iibm)
+ {
+ int res;
+@@ -4513,7 +4581,7 @@ static int __init bluetooth_init(struct ibm_init_struct *iibm)
+
+ /* bluetooth not supported on 570, 600e/x, 770e, 770x, A21e, A2xm/p,
+ G4x, R30, R31, R40e, R50e, T20-22, X20-21 */
+- tp_features.bluetooth = hkey_handle &&
++ tp_features.bluetooth = !have_bt_fwbug() && hkey_handle &&
+ acpi_evalf(hkey_handle, &status, "GBDC", "qd");
+
+ vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_RFKILL,
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-003-platform-x86-dell-laptop-fix-rfkill-functionali.patch b/patches.kernel.org/5.1.3-003-platform-x86-dell-laptop-fix-rfkill-functionali.patch
new file mode 100644
index 0000000000..141848667d
--- /dev/null
+++ b/patches.kernel.org/5.1.3-003-platform-x86-dell-laptop-fix-rfkill-functionali.patch
@@ -0,0 +1,62 @@
+From: Mario Limonciello <mario.limonciello@dell.com>
+Date: Wed, 27 Mar 2019 09:25:34 -0500
+Subject: [PATCH] platform/x86: dell-laptop: fix rfkill functionality
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 6cc13c28da5beee0f706db6450e190709700b34a
+
+commit 6cc13c28da5beee0f706db6450e190709700b34a upstream.
+
+When converting the driver two arguments were transposed leading
+to rfkill not working.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201427
+Reported-by: Pepijn de Vos <pepijndevos@gmail.com>
+Fixes: 549b49 ("platform/x86: dell-smbios: Introduce dispatcher for SMM calls")
+Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
+Acked-by: Pali Rohár <pali.rohar@gmail.com>
+Cc: <stable@vger.kernel.org> # 4.14.x
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/platform/x86/dell-laptop.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index 95e6ca116e00..a561f653cf13 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -531,7 +531,7 @@ static void dell_rfkill_query(struct rfkill *rfkill, void *data)
+ return;
+ }
+
+- dell_fill_request(&buffer, 0, 0x2, 0, 0);
++ dell_fill_request(&buffer, 0x2, 0, 0, 0);
+ ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL);
+ hwswitch = buffer.output[1];
+
+@@ -562,7 +562,7 @@ static int dell_debugfs_show(struct seq_file *s, void *data)
+ return ret;
+ status = buffer.output[1];
+
+- dell_fill_request(&buffer, 0, 0x2, 0, 0);
++ dell_fill_request(&buffer, 0x2, 0, 0, 0);
+ hwswitch_ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL);
+ if (hwswitch_ret)
+ return hwswitch_ret;
+@@ -647,7 +647,7 @@ static void dell_update_rfkill(struct work_struct *ignored)
+ if (ret != 0)
+ return;
+
+- dell_fill_request(&buffer, 0, 0x2, 0, 0);
++ dell_fill_request(&buffer, 0x2, 0, 0, 0);
+ ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL);
+
+ if (ret == 0 && (status & BIT(0)))
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-004-hwmon-pwm-fan-Disable-PWM-if-fetching-cooling-d.patch b/patches.kernel.org/5.1.3-004-hwmon-pwm-fan-Disable-PWM-if-fetching-cooling-d.patch
new file mode 100644
index 0000000000..df08097fcc
--- /dev/null
+++ b/patches.kernel.org/5.1.3-004-hwmon-pwm-fan-Disable-PWM-if-fetching-cooling-d.patch
@@ -0,0 +1,39 @@
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Wed, 3 Apr 2019 14:48:33 +0200
+Subject: [PATCH] hwmon: (pwm-fan) Disable PWM if fetching cooling data fails
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 53f1647da3e8fb3e89066798f0fdc045064d353d
+
+commit 53f1647da3e8fb3e89066798f0fdc045064d353d upstream.
+
+In case pwm_fan_of_get_cooling_data() fails we should disable the PWM
+just like in the other error cases.
+
+Fixes: 2e5219c77183 ("hwmon: (pwm-fan) Read PWM FAN configuration from device tree")
+Cc: <stable@vger.kernel.org> # 4.14+
+Reported-by: Guenter Rock <linux@roeck-us.net>
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/hwmon/pwm-fan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
+index 167221c7628a..e4c5197417a8 100644
+--- a/drivers/hwmon/pwm-fan.c
++++ b/drivers/hwmon/pwm-fan.c
+@@ -271,7 +271,7 @@ static int pwm_fan_probe(struct platform_device *pdev)
+
+ ret = pwm_fan_of_get_cooling_data(&pdev->dev, ctx);
+ if (ret)
+- return ret;
++ goto err_pwm_disable;
+
+ ctx->pwm_fan_state = ctx->pwm_fan_max_state;
+ if (IS_ENABLED(CONFIG_THERMAL)) {
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-005-hwmon-occ-Fix-extended-status-bits.patch b/patches.kernel.org/5.1.3-005-hwmon-occ-Fix-extended-status-bits.patch
new file mode 100644
index 0000000000..60e8d85d0d
--- /dev/null
+++ b/patches.kernel.org/5.1.3-005-hwmon-occ-Fix-extended-status-bits.patch
@@ -0,0 +1,52 @@
+From: Lei YU <mine260309@gmail.com>
+Date: Mon, 15 Apr 2019 18:37:20 +0800
+Subject: [PATCH] hwmon: (occ) Fix extended status bits
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: b88c5049219a7f322bb1fd65fc30d17472a23563
+
+commit b88c5049219a7f322bb1fd65fc30d17472a23563 upstream.
+
+The occ's extended status is checked and shown as sysfs attributes. But
+the code was incorrectly checking the "status" bits.
+Fix it by checking the "ext_status" bits.
+
+Cc: stable@vger.kernel.org
+Fixes: df04ced684d4 ("hwmon (occ): Add sysfs attributes for additional OCC data")
+Signed-off-by: Lei YU <mine260309@gmail.com>
+Reviewed-by: Eddie James <eajames@linux.ibm.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/hwmon/occ/sysfs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hwmon/occ/sysfs.c b/drivers/hwmon/occ/sysfs.c
+index fe3d15e416e7..a71ca94c789f 100644
+--- a/drivers/hwmon/occ/sysfs.c
++++ b/drivers/hwmon/occ/sysfs.c
+@@ -42,16 +42,16 @@ static ssize_t occ_sysfs_show(struct device *dev,
+ val = !!(header->status & OCC_STAT_ACTIVE);
+ break;
+ case 2:
+- val = !!(header->status & OCC_EXT_STAT_DVFS_OT);
++ val = !!(header->ext_status & OCC_EXT_STAT_DVFS_OT);
+ break;
+ case 3:
+- val = !!(header->status & OCC_EXT_STAT_DVFS_POWER);
++ val = !!(header->ext_status & OCC_EXT_STAT_DVFS_POWER);
+ break;
+ case 4:
+- val = !!(header->status & OCC_EXT_STAT_MEM_THROTTLE);
++ val = !!(header->ext_status & OCC_EXT_STAT_MEM_THROTTLE);
+ break;
+ case 5:
+- val = !!(header->status & OCC_EXT_STAT_QUICK_DROP);
++ val = !!(header->ext_status & OCC_EXT_STAT_QUICK_DROP);
+ break;
+ case 6:
+ val = header->occ_state;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-006-selftests-seccomp-Handle-namespace-failures-gra.patch b/patches.kernel.org/5.1.3-006-selftests-seccomp-Handle-namespace-failures-gra.patch
new file mode 100644
index 0000000000..8e5194eb74
--- /dev/null
+++ b/patches.kernel.org/5.1.3-006-selftests-seccomp-Handle-namespace-failures-gra.patch
@@ -0,0 +1,194 @@
+From: Kees Cook <keescook@chromium.org>
+Date: Thu, 11 Apr 2019 16:56:31 -0700
+Subject: [PATCH] selftests/seccomp: Handle namespace failures gracefully
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 9dd3fcb0ab73cb1e00b8562ef027a38521aaff87
+
+commit 9dd3fcb0ab73cb1e00b8562ef027a38521aaff87 upstream.
+
+When running without USERNS or PIDNS the seccomp test would hang since
+it was waiting forever for the child to trigger the user notification
+since it seems the glibc() abort handler makes a call to getpid(),
+which would trap again. This changes the getpid filter to getppid, and
+makes sure ASSERTs execute to stop from spawning the listener.
+
+Reported-by: Shuah Khan <shuah@kernel.org>
+Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace")
+Cc: stable@vger.kernel.org # > 5.0
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Tycho Andersen <tycho@tycho.ws>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ tools/testing/selftests/seccomp/seccomp_bpf.c | 43 ++++++++++---------
+ 1 file changed, 23 insertions(+), 20 deletions(-)
+
+diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
+index 5019cdae5d0b..0fad0dc62338 100644
+--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
+@@ -3095,9 +3095,9 @@ TEST(user_notification_basic)
+
+ /* Check that we get -ENOSYS with no listener attached */
+ if (pid == 0) {
+- if (user_trap_syscall(__NR_getpid, 0) < 0)
++ if (user_trap_syscall(__NR_getppid, 0) < 0)
+ exit(1);
+- ret = syscall(__NR_getpid);
++ ret = syscall(__NR_getppid);
+ exit(ret >= 0 || errno != ENOSYS);
+ }
+
+@@ -3112,12 +3112,12 @@ TEST(user_notification_basic)
+ EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
+
+ /* Check that the basic notification machinery works */
+- listener = user_trap_syscall(__NR_getpid,
++ listener = user_trap_syscall(__NR_getppid,
+ SECCOMP_FILTER_FLAG_NEW_LISTENER);
+ ASSERT_GE(listener, 0);
+
+ /* Installing a second listener in the chain should EBUSY */
+- EXPECT_EQ(user_trap_syscall(__NR_getpid,
++ EXPECT_EQ(user_trap_syscall(__NR_getppid,
+ SECCOMP_FILTER_FLAG_NEW_LISTENER),
+ -1);
+ EXPECT_EQ(errno, EBUSY);
+@@ -3126,7 +3126,7 @@ TEST(user_notification_basic)
+ ASSERT_GE(pid, 0);
+
+ if (pid == 0) {
+- ret = syscall(__NR_getpid);
++ ret = syscall(__NR_getppid);
+ exit(ret != USER_NOTIF_MAGIC);
+ }
+
+@@ -3144,7 +3144,7 @@ TEST(user_notification_basic)
+ EXPECT_GT(poll(&pollfd, 1, -1), 0);
+ EXPECT_EQ(pollfd.revents, POLLOUT);
+
+- EXPECT_EQ(req.data.nr, __NR_getpid);
++ EXPECT_EQ(req.data.nr, __NR_getppid);
+
+ resp.id = req.id;
+ resp.error = 0;
+@@ -3176,7 +3176,7 @@ TEST(user_notification_kill_in_middle)
+ TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
+ }
+
+- listener = user_trap_syscall(__NR_getpid,
++ listener = user_trap_syscall(__NR_getppid,
+ SECCOMP_FILTER_FLAG_NEW_LISTENER);
+ ASSERT_GE(listener, 0);
+
+@@ -3188,7 +3188,7 @@ TEST(user_notification_kill_in_middle)
+ ASSERT_GE(pid, 0);
+
+ if (pid == 0) {
+- ret = syscall(__NR_getpid);
++ ret = syscall(__NR_getppid);
+ exit(ret != USER_NOTIF_MAGIC);
+ }
+
+@@ -3298,7 +3298,7 @@ TEST(user_notification_closed_listener)
+ TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
+ }
+
+- listener = user_trap_syscall(__NR_getpid,
++ listener = user_trap_syscall(__NR_getppid,
+ SECCOMP_FILTER_FLAG_NEW_LISTENER);
+ ASSERT_GE(listener, 0);
+
+@@ -3309,7 +3309,7 @@ TEST(user_notification_closed_listener)
+ ASSERT_GE(pid, 0);
+ if (pid == 0) {
+ close(listener);
+- ret = syscall(__NR_getpid);
++ ret = syscall(__NR_getppid);
+ exit(ret != -1 && errno != ENOSYS);
+ }
+
+@@ -3332,14 +3332,15 @@ TEST(user_notification_child_pid_ns)
+
+ ASSERT_EQ(unshare(CLONE_NEWUSER | CLONE_NEWPID), 0);
+
+- listener = user_trap_syscall(__NR_getpid, SECCOMP_FILTER_FLAG_NEW_LISTENER);
++ listener = user_trap_syscall(__NR_getppid,
++ SECCOMP_FILTER_FLAG_NEW_LISTENER);
+ ASSERT_GE(listener, 0);
+
+ pid = fork();
+ ASSERT_GE(pid, 0);
+
+ if (pid == 0)
+- exit(syscall(__NR_getpid) != USER_NOTIF_MAGIC);
++ exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
+
+ EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
+ EXPECT_EQ(req.pid, pid);
+@@ -3371,7 +3372,8 @@ TEST(user_notification_sibling_pid_ns)
+ TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
+ }
+
+- listener = user_trap_syscall(__NR_getpid, SECCOMP_FILTER_FLAG_NEW_LISTENER);
++ listener = user_trap_syscall(__NR_getppid,
++ SECCOMP_FILTER_FLAG_NEW_LISTENER);
+ ASSERT_GE(listener, 0);
+
+ pid = fork();
+@@ -3384,7 +3386,7 @@ TEST(user_notification_sibling_pid_ns)
+ ASSERT_GE(pid2, 0);
+
+ if (pid2 == 0)
+- exit(syscall(__NR_getpid) != USER_NOTIF_MAGIC);
++ exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
+
+ EXPECT_EQ(waitpid(pid2, &status, 0), pid2);
+ EXPECT_EQ(true, WIFEXITED(status));
+@@ -3393,11 +3395,11 @@ TEST(user_notification_sibling_pid_ns)
+ }
+
+ /* Create the sibling ns, and sibling in it. */
+- EXPECT_EQ(unshare(CLONE_NEWPID), 0);
+- EXPECT_EQ(errno, 0);
++ ASSERT_EQ(unshare(CLONE_NEWPID), 0);
++ ASSERT_EQ(errno, 0);
+
+ pid2 = fork();
+- EXPECT_GE(pid2, 0);
++ ASSERT_GE(pid2, 0);
+
+ if (pid2 == 0) {
+ ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
+@@ -3405,7 +3407,7 @@ TEST(user_notification_sibling_pid_ns)
+ * The pid should be 0, i.e. the task is in some namespace that
+ * we can't "see".
+ */
+- ASSERT_EQ(req.pid, 0);
++ EXPECT_EQ(req.pid, 0);
+
+ resp.id = req.id;
+ resp.error = 0;
+@@ -3435,14 +3437,15 @@ TEST(user_notification_fault_recv)
+
+ ASSERT_EQ(unshare(CLONE_NEWUSER), 0);
+
+- listener = user_trap_syscall(__NR_getpid, SECCOMP_FILTER_FLAG_NEW_LISTENER);
++ listener = user_trap_syscall(__NR_getppid,
++ SECCOMP_FILTER_FLAG_NEW_LISTENER);
+ ASSERT_GE(listener, 0);
+
+ pid = fork();
+ ASSERT_GE(pid, 0);
+
+ if (pid == 0)
+- exit(syscall(__NR_getpid) != USER_NOTIF_MAGIC);
++ exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
+
+ /* Do a bad recv() */
+ EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, NULL), -1);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-007-i2c-core-ratelimit-transfer-when-suspended-erro.patch b/patches.kernel.org/5.1.3-007-i2c-core-ratelimit-transfer-when-suspended-erro.patch
new file mode 100644
index 0000000000..927bbbebc9
--- /dev/null
+++ b/patches.kernel.org/5.1.3-007-i2c-core-ratelimit-transfer-when-suspended-erro.patch
@@ -0,0 +1,64 @@
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Thu, 25 Apr 2019 16:19:47 +0200
+Subject: [PATCH] i2c: core: ratelimit 'transfer when suspended' errors
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 4db61c2a16fce2ef85d82751de4ba43a39347cfb
+
+commit 4db61c2a16fce2ef85d82751de4ba43a39347cfb upstream.
+
+There are two problems with WARN_ON() here. One: It is not ratelimited.
+Two: We don't see which adapter was used when trying to transfer
+something when already suspended. Implement a custom ratelimit once per
+adapter and use dev_WARN there. This fixes both issues. Drawback is that
+we don't see if multiple drivers are trying to transfer with the same
+adapter while suspended. They need to be discovered one after the other
+now. This is better than a high CPU load because a really broken driver
+might try to resend endlessly.
+
+Fixes: 9ac6cb5fbb17 ("i2c: add suspended flag and accessors for i2c adapters")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Cc: stable@vger.kernel.org # v5.1+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/i2c/i2c-core-base.c | 5 ++++-
+ include/linux/i2c.h | 3 ++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 688aa3b5f3ac..2f0f88b79c4b 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -1871,8 +1871,11 @@ int __i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+
+ if (WARN_ON(!msgs || num < 1))
+ return -EINVAL;
+- if (WARN_ON(test_bit(I2C_ALF_IS_SUSPENDED, &adap->locked_flags)))
++ if (test_bit(I2C_ALF_IS_SUSPENDED, &adap->locked_flags)) {
++ if (!test_and_set_bit(I2C_ALF_SUSPEND_REPORTED, &adap->locked_flags))
++ dev_WARN(&adap->dev, "Transfer while suspended\n");
+ return -ESHUTDOWN;
++ }
+
+ if (adap->quirks && i2c_check_for_quirks(adap, msgs, num))
+ return -EOPNOTSUPP;
+diff --git a/include/linux/i2c.h b/include/linux/i2c.h
+index 383510b4f083..646dd962d6a1 100644
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -682,7 +682,8 @@ struct i2c_adapter {
+ int retries;
+ struct device dev; /* the adapter device */
+ unsigned long locked_flags; /* owned by the I2C core */
+-#define I2C_ALF_IS_SUSPENDED 0
++#define I2C_ALF_IS_SUSPENDED 0
++#define I2C_ALF_SUSPEND_REPORTED 1
+
+ int nr;
+ char name[48];
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-008-kernfs-fix-barrier-usage-in-__kernfs_new_node.patch b/patches.kernel.org/5.1.3-008-kernfs-fix-barrier-usage-in-__kernfs_new_node.patch
new file mode 100644
index 0000000000..0ba56c9b52
--- /dev/null
+++ b/patches.kernel.org/5.1.3-008-kernfs-fix-barrier-usage-in-__kernfs_new_node.patch
@@ -0,0 +1,43 @@
+From: Andrea Parri <andrea.parri@amarulasolutions.com>
+Date: Tue, 16 Apr 2019 14:17:11 +0200
+Subject: [PATCH] kernfs: fix barrier usage in __kernfs_new_node()
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 998267900cee901c5d1dfa029a6304d00acbc29f
+
+commit 998267900cee901c5d1dfa029a6304d00acbc29f upstream.
+
+smp_mb__before_atomic() can not be applied to atomic_set(). Remove the
+barrier and rely on RELEASE synchronization.
+
+Fixes: ba16b2846a8c6 ("kernfs: add an API to get kernfs node from inode number")
+Cc: stable@vger.kernel.org
+Signed-off-by: Andrea Parri <andrea.parri@amarulasolutions.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/kernfs/dir.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
+index b84d635567d3..1e7a74b8e064 100644
+--- a/fs/kernfs/dir.c
++++ b/fs/kernfs/dir.c
+@@ -650,11 +650,10 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
+ kn->id.generation = gen;
+
+ /*
+- * set ino first. This barrier is paired with atomic_inc_not_zero in
++ * set ino first. This RELEASE is paired with atomic_inc_not_zero in
+ * kernfs_find_and_get_node_by_ino
+ */
+- smp_mb__before_atomic();
+- atomic_set(&kn->count, 1);
++ atomic_set_release(&kn->count, 1);
+ atomic_set(&kn->active, KN_DEACTIVATED_BIAS);
+ RB_CLEAR_NODE(&kn->rb);
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-009-virt-vbox-Sanity-check-parameter-types-for-hgcm.patch b/patches.kernel.org/5.1.3-009-virt-vbox-Sanity-check-parameter-types-for-hgcm.patch
new file mode 100644
index 0000000000..9201c6d58e
--- /dev/null
+++ b/patches.kernel.org/5.1.3-009-virt-vbox-Sanity-check-parameter-types-for-hgcm.patch
@@ -0,0 +1,79 @@
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 4 Apr 2019 14:39:09 +0200
+Subject: [PATCH] virt: vbox: Sanity-check parameter types for hgcm-calls
+ coming from userspace
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: cf4f2ad6b87dda2dbe0573b1ebeb0273f8d4aac6
+
+commit cf4f2ad6b87dda2dbe0573b1ebeb0273f8d4aac6 upstream.
+
+Userspace can make host function calls, called hgcm-calls through the
+/dev/vboxguest device.
+
+In this case we should not accept all hgcm-function-parameter-types, some
+are only valid for in kernel calls.
+
+This commit adds proper hgcm-function-parameter-type validation to the
+ioctl for doing a hgcm-call from userspace.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/virt/vboxguest/vboxguest_core.c | 31 +++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
+index 8ca333f21292..2307b0329aec 100644
+--- a/drivers/virt/vboxguest/vboxguest_core.c
++++ b/drivers/virt/vboxguest/vboxguest_core.c
+@@ -1298,6 +1298,20 @@ static int vbg_ioctl_hgcm_disconnect(struct vbg_dev *gdev,
+ return ret;
+ }
+
++static bool vbg_param_valid(enum vmmdev_hgcm_function_parameter_type type)
++{
++ switch (type) {
++ case VMMDEV_HGCM_PARM_TYPE_32BIT:
++ case VMMDEV_HGCM_PARM_TYPE_64BIT:
++ case VMMDEV_HGCM_PARM_TYPE_LINADDR:
++ case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
++ case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
++ return true;
++ default:
++ return false;
++ }
++}
++
+ static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
+ struct vbg_session *session, bool f32bit,
+ struct vbg_ioctl_hgcm_call *call)
+@@ -1333,6 +1347,23 @@ static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
+ }
+ call->hdr.size_out = actual_size;
+
++ /* Validate parameter types */
++ if (f32bit) {
++ struct vmmdev_hgcm_function_parameter32 *parm =
++ VBG_IOCTL_HGCM_CALL_PARMS32(call);
++
++ for (i = 0; i < call->parm_count; i++)
++ if (!vbg_param_valid(parm[i].type))
++ return -EINVAL;
++ } else {
++ struct vmmdev_hgcm_function_parameter *parm =
++ VBG_IOCTL_HGCM_CALL_PARMS(call);
++
++ for (i = 0; i < call->parm_count; i++)
++ if (!vbg_param_valid(parm[i].type))
++ return -EINVAL;
++ }
++
+ /*
+ * Validate the client id.
+ */
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-010-USB-serial-fix-unthrottle-races.patch b/patches.kernel.org/5.1.3-010-USB-serial-fix-unthrottle-races.patch
new file mode 100644
index 0000000000..bebf1a3d2a
--- /dev/null
+++ b/patches.kernel.org/5.1.3-010-USB-serial-fix-unthrottle-races.patch
@@ -0,0 +1,137 @@
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 25 Apr 2019 18:05:36 +0200
+Subject: [PATCH] USB: serial: fix unthrottle races
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 3f5edd58d040bfa4b74fb89bc02f0bc6b9cd06ab
+
+commit 3f5edd58d040bfa4b74fb89bc02f0bc6b9cd06ab upstream.
+
+Fix two long-standing bugs which could potentially lead to memory
+corruption or leave the port throttled until it is reopened (on weakly
+ordered systems), respectively, when read-URB completion races with
+unthrottle().
+
+First, the URB must not be marked as free before processing is complete
+to prevent it from being submitted by unthrottle() on another CPU.
+
+ CPU 1 CPU 2
+ ================ ================
+ complete() unthrottle()
+ process_urb();
+ smp_mb__before_atomic();
+ set_bit(i, free); if (test_and_clear_bit(i, free))
+ submit_urb();
+
+Second, the URB must be marked as free before checking the throttled
+flag to prevent unthrottle() on another CPU from failing to observe that
+the URB needs to be submitted if complete() sees that the throttled flag
+is set.
+
+ CPU 1 CPU 2
+ ================ ================
+ complete() unthrottle()
+ set_bit(i, free); throttled = 0;
+ smp_mb__after_atomic(); smp_mb();
+ if (throttled) if (test_and_clear_bit(i, free))
+ return; submit_urb();
+
+Note that test_and_clear_bit() only implies barriers when the test is
+successful. To handle the case where the URB is still in use an explicit
+barrier needs to be added to unthrottle() for the second race condition.
+
+Fixes: d83b405383c9 ("USB: serial: add support for multiple read urbs")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/usb/serial/generic.c | 39 +++++++++++++++++++++++++++++-------
+ 1 file changed, 32 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
+index 2274d9625f63..0fff4968ea1b 100644
+--- a/drivers/usb/serial/generic.c
++++ b/drivers/usb/serial/generic.c
+@@ -376,6 +376,7 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb)
+ struct usb_serial_port *port = urb->context;
+ unsigned char *data = urb->transfer_buffer;
+ unsigned long flags;
++ bool stopped = false;
+ int status = urb->status;
+ int i;
+
+@@ -383,33 +384,51 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb)
+ if (urb == port->read_urbs[i])
+ break;
+ }
+- set_bit(i, &port->read_urbs_free);
+
+ dev_dbg(&port->dev, "%s - urb %d, len %d\n", __func__, i,
+ urb->actual_length);
+ switch (status) {
+ case 0:
++ usb_serial_debug_data(&port->dev, __func__, urb->actual_length,
++ data);
++ port->serial->type->process_read_urb(urb);
+ break;
+ case -ENOENT:
+ case -ECONNRESET:
+ case -ESHUTDOWN:
+ dev_dbg(&port->dev, "%s - urb stopped: %d\n",
+ __func__, status);
+- return;
++ stopped = true;
++ break;
+ case -EPIPE:
+ dev_err(&port->dev, "%s - urb stopped: %d\n",
+ __func__, status);
+- return;
++ stopped = true;
++ break;
+ default:
+ dev_dbg(&port->dev, "%s - nonzero urb status: %d\n",
+ __func__, status);
+- goto resubmit;
++ break;
+ }
+
+- usb_serial_debug_data(&port->dev, __func__, urb->actual_length, data);
+- port->serial->type->process_read_urb(urb);
++ /*
++ * Make sure URB processing is done before marking as free to avoid
++ * racing with unthrottle() on another CPU. Matches the barriers
++ * implied by the test_and_clear_bit() in
++ * usb_serial_generic_submit_read_urb().
++ */
++ smp_mb__before_atomic();
++ set_bit(i, &port->read_urbs_free);
++ /*
++ * Make sure URB is marked as free before checking the throttled flag
++ * to avoid racing with unthrottle() on another CPU. Matches the
++ * smp_mb() in unthrottle().
++ */
++ smp_mb__after_atomic();
++
++ if (stopped)
++ return;
+
+-resubmit:
+ /* Throttle the device if requested by tty */
+ spin_lock_irqsave(&port->lock, flags);
+ port->throttled = port->throttle_req;
+@@ -484,6 +503,12 @@ void usb_serial_generic_unthrottle(struct tty_struct *tty)
+ port->throttled = port->throttle_req = 0;
+ spin_unlock_irq(&port->lock);
+
++ /*
++ * Matches the smp_mb__after_atomic() in
++ * usb_serial_generic_read_bulk_callback().
++ */
++ smp_mb();
++
+ if (was_throttled)
+ usb_serial_generic_submit_read_urbs(port, GFP_KERNEL);
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-011-mwl8k-Fix-rate_idx-underflow.patch b/patches.kernel.org/5.1.3-011-mwl8k-Fix-rate_idx-underflow.patch
new file mode 100644
index 0000000000..367e530878
--- /dev/null
+++ b/patches.kernel.org/5.1.3-011-mwl8k-Fix-rate_idx-underflow.patch
@@ -0,0 +1,87 @@
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Thu, 11 Apr 2019 20:13:30 +0200
+Subject: [PATCH] mwl8k: Fix rate_idx underflow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 6b583201fa219b7b1b6aebd8966c8fd9357ef9f4
+
+commit 6b583201fa219b7b1b6aebd8966c8fd9357ef9f4 upstream.
+
+It was reported on OpenWrt bug tracking system[1], that several users
+are affected by the endless reboot of their routers if they configure
+5GHz interface with channel 44 or 48.
+
+The reboot loop is caused by the following excessive number of WARN_ON
+messages:
+
+ WARNING: CPU: 0 PID: 0 at backports-4.19.23-1/net/mac80211/rx.c:4516
+ ieee80211_rx_napi+0x1fc/0xa54 [mac80211]
+
+as the messages are being correctly emitted by the following guard:
+
+ case RX_ENC_LEGACY:
+ if (WARN_ON(status->rate_idx >= sband->n_bitrates))
+
+as the rate_idx is in this case erroneously set to 251 (0xfb). This fix
+simply converts previously used magic number to proper constant and
+guards against substraction which is leading to the currently observed
+underflow.
+
+1. https://bugs.openwrt.org/index.php?do=details&task_id=2218
+
+Fixes: 854783444bab ("mwl8k: properly set receive status rate index on 5 GHz receive")
+Cc: <stable@vger.kernel.org>
+Tested-by: Eubert Bao <bunnier@gmail.com>
+Reported-by: Eubert Bao <bunnier@gmail.com>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/wireless/marvell/mwl8k.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
+index 8e4e9b6919e0..ffc565ac2192 100644
+--- a/drivers/net/wireless/marvell/mwl8k.c
++++ b/drivers/net/wireless/marvell/mwl8k.c
+@@ -441,6 +441,9 @@ static const struct ieee80211_rate mwl8k_rates_50[] = {
+ #define MWL8K_CMD_UPDATE_STADB 0x1123
+ #define MWL8K_CMD_BASTREAM 0x1125
+
++#define MWL8K_LEGACY_5G_RATE_OFFSET \
++ (ARRAY_SIZE(mwl8k_rates_24) - ARRAY_SIZE(mwl8k_rates_50))
++
+ static const char *mwl8k_cmd_name(__le16 cmd, char *buf, int bufsize)
+ {
+ u16 command = le16_to_cpu(cmd);
+@@ -1016,8 +1019,9 @@ mwl8k_rxd_ap_process(void *_rxd, struct ieee80211_rx_status *status,
+
+ if (rxd->channel > 14) {
+ status->band = NL80211_BAND_5GHZ;
+- if (!(status->encoding == RX_ENC_HT))
+- status->rate_idx -= 5;
++ if (!(status->encoding == RX_ENC_HT) &&
++ status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
++ status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
+ } else {
+ status->band = NL80211_BAND_2GHZ;
+ }
+@@ -1124,8 +1128,9 @@ mwl8k_rxd_sta_process(void *_rxd, struct ieee80211_rx_status *status,
+
+ if (rxd->channel > 14) {
+ status->band = NL80211_BAND_5GHZ;
+- if (!(status->encoding == RX_ENC_HT))
+- status->rate_idx -= 5;
++ if (!(status->encoding == RX_ENC_HT) &&
++ status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
++ status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
+ } else {
+ status->band = NL80211_BAND_2GHZ;
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-012-rtlwifi-rtl8723ae-Fix-missing-break-in-switch-s.patch b/patches.kernel.org/5.1.3-012-rtlwifi-rtl8723ae-Fix-missing-break-in-switch-s.patch
new file mode 100644
index 0000000000..6a9a13a615
--- /dev/null
+++ b/patches.kernel.org/5.1.3-012-rtlwifi-rtl8723ae-Fix-missing-break-in-switch-s.patch
@@ -0,0 +1,42 @@
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Tue, 16 Apr 2019 10:17:22 -0500
+Subject: [PATCH] rtlwifi: rtl8723ae: Fix missing break in switch statement
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 84242b82d81c54e009a2aaa74d3d9eff70babf56
+
+commit 84242b82d81c54e009a2aaa74d3d9eff70babf56 upstream.
+
+Add missing break statement in order to prevent the code from falling
+through to case 0x1025, and erroneously setting rtlhal->oem_id to
+RT_CID_819X_ACER when rtlefuse->eeprom_svid is equal to 0x10EC and
+none of the cases in switch (rtlefuse->eeprom_smid) match.
+
+This bug was found thanks to the ongoing efforts to enable
+-Wimplicit-fallthrough.
+
+Fixes: 238ad2ddf34b ("rtlwifi: rtl8723ae: Clean up the hardware info routine")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c
+index 6bab162e1bb8..655460f61bbc 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c
+@@ -1675,6 +1675,7 @@ static void _rtl8723e_read_adapter_info(struct ieee80211_hw *hw,
+ rtlhal->oem_id = RT_CID_819X_LENOVO;
+ break;
+ }
++ break;
+ case 0x1025:
+ rtlhal->oem_id = RT_CID_819X_ACER;
+ break;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-013-Don-t-jump-to-compute_result-state-from-check_r.patch b/patches.kernel.org/5.1.3-013-Don-t-jump-to-compute_result-state-from-check_r.patch
new file mode 100644
index 0000000000..686523dc95
--- /dev/null
+++ b/patches.kernel.org/5.1.3-013-Don-t-jump-to-compute_result-state-from-check_r.patch
@@ -0,0 +1,120 @@
+From: Nigel Croxon <ncroxon@redhat.com>
+Date: Fri, 29 Mar 2019 10:46:15 -0700
+Subject: [PATCH] Don't jump to compute_result state from check_result state
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 4f4fd7c5798bbdd5a03a60f6269cf1177fbd11ef
+
+commit 4f4fd7c5798bbdd5a03a60f6269cf1177fbd11ef upstream.
+
+Changing state from check_state_check_result to
+check_state_compute_result not only is unsafe but also doesn't
+appear to serve a valid purpose. A raid6 check should only be
+pushing out extra writes if doing repair and a mis-match occurs.
+The stripe dev management will already try and do repair writes
+for failing sectors.
+
+This patch makes the raid6 check_state_check_result handling
+work more like raid5's. If somehow too many failures for a
+check, just quit the check operation for the stripe. When any
+checks pass, don't try and use check_state_compute_result for
+a purpose it isn't needed for and is unsafe for. Just mark the
+stripe as in sync for passing its parity checks and let the
+stripe dev read/write code and the bad blocks list do their
+job handling I/O errors.
+
+Repro steps from Xiao:
+
+These are the steps to reproduce this problem:
+1. redefined OPT_MEDIUM_ERR_ADDR to 12000 in scsi_debug.c
+2. insmod scsi_debug.ko dev_size_mb=11000 max_luns=1 num_tgts=1
+3. mdadm --create /dev/md127 --level=6 --raid-devices=5 /dev/sde1 /dev/sde2 /dev/sde3 /dev/sde5 /dev/sde6
+sde is the disk created by scsi_debug
+4. echo "2" >/sys/module/scsi_debug/parameters/opts
+5. raid-check
+
+It panic:
+[ 4854.730899] md: data-check of RAID array md127
+[ 4854.857455] sd 5:0:0:0: [sdr] tag#80 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
+[ 4854.859246] sd 5:0:0:0: [sdr] tag#80 Sense Key : Medium Error [current]
+[ 4854.860694] sd 5:0:0:0: [sdr] tag#80 Add. Sense: Unrecovered read error
+[ 4854.862207] sd 5:0:0:0: [sdr] tag#80 CDB: Read(10) 28 00 00 00 2d 88 00 04 00 00
+[ 4854.864196] print_req_error: critical medium error, dev sdr, sector 11656 flags 0
+[ 4854.867409] sd 5:0:0:0: [sdr] tag#100 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
+[ 4854.869469] sd 5:0:0:0: [sdr] tag#100 Sense Key : Medium Error [current]
+[ 4854.871206] sd 5:0:0:0: [sdr] tag#100 Add. Sense: Unrecovered read error
+[ 4854.872858] sd 5:0:0:0: [sdr] tag#100 CDB: Read(10) 28 00 00 00 2e e0 00 00 08 00
+[ 4854.874587] print_req_error: critical medium error, dev sdr, sector 12000 flags 4000
+[ 4854.876456] sd 5:0:0:0: [sdr] tag#101 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
+[ 4854.878552] sd 5:0:0:0: [sdr] tag#101 Sense Key : Medium Error [current]
+[ 4854.880278] sd 5:0:0:0: [sdr] tag#101 Add. Sense: Unrecovered read error
+[ 4854.881846] sd 5:0:0:0: [sdr] tag#101 CDB: Read(10) 28 00 00 00 2e e8 00 00 08 00
+[ 4854.883691] print_req_error: critical medium error, dev sdr, sector 12008 flags 4000
+[ 4854.893927] sd 5:0:0:0: [sdr] tag#166 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
+[ 4854.896002] sd 5:0:0:0: [sdr] tag#166 Sense Key : Medium Error [current]
+[ 4854.897561] sd 5:0:0:0: [sdr] tag#166 Add. Sense: Unrecovered read error
+[ 4854.899110] sd 5:0:0:0: [sdr] tag#166 CDB: Read(10) 28 00 00 00 2e e0 00 00 10 00
+[ 4854.900989] print_req_error: critical medium error, dev sdr, sector 12000 flags 0
+[ 4854.902757] md/raid:md127: read error NOT corrected!! (sector 9952 on sdr1).
+[ 4854.904375] md/raid:md127: read error NOT corrected!! (sector 9960 on sdr1).
+[ 4854.906201] ------------[ cut here ]------------
+[ 4854.907341] kernel BUG at drivers/md/raid5.c:4190!
+
+raid5.c:4190 above is this BUG_ON:
+
+ handle_parity_checks6()
+ ...
+ BUG_ON(s->uptodate < disks - 1); /* We don't need Q to recover */
+
+Cc: <stable@vger.kernel.org> # v3.16+
+OriginalAuthor: David Jeffery <djeffery@redhat.com>
+Cc: Xiao Ni <xni@redhat.com>
+Tested-by: David Jeffery <djeffery@redhat.com>
+Signed-off-by: David Jeffy <djeffery@redhat.com>
+Signed-off-by: Nigel Croxon <ncroxon@redhat.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/raid5.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index c033bfcb209e..364dd2f6fa1b 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -4223,26 +4223,15 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
+ case check_state_check_result:
+ sh->check_state = check_state_idle;
+
++ if (s->failed > 1)
++ break;
+ /* handle a successful check operation, if parity is correct
+ * we are done. Otherwise update the mismatch count and repair
+ * parity if !MD_RECOVERY_CHECK
+ */
+ if (sh->ops.zero_sum_result == 0) {
+- /* both parities are correct */
+- if (!s->failed)
+- set_bit(STRIPE_INSYNC, &sh->state);
+- else {
+- /* in contrast to the raid5 case we can validate
+- * parity, but still have a failure to write
+- * back
+- */
+- sh->check_state = check_state_compute_result;
+- /* Returning at this point means that we may go
+- * off and bring p and/or q uptodate again so
+- * we make sure to check zero_sum_result again
+- * to verify if p or q need writeback
+- */
+- }
++ /* Any parity checked was correct */
++ set_bit(STRIPE_INSYNC, &sh->state);
+ } else {
+ atomic64_add(STRIPE_SECTORS, &conf->mddev->resync_mismatches);
+ if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery)) {
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-014-bonding-fix-arp_validate-toggling-in-active-bac.patch b/patches.kernel.org/5.1.3-014-bonding-fix-arp_validate-toggling-in-active-bac.patch
new file mode 100644
index 0000000000..a4689806d7
--- /dev/null
+++ b/patches.kernel.org/5.1.3-014-bonding-fix-arp_validate-toggling-in-active-bac.patch
@@ -0,0 +1,84 @@
+From: Jarod Wilson <jarod@redhat.com>
+Date: Fri, 10 May 2019 17:57:09 -0400
+Subject: [PATCH] bonding: fix arp_validate toggling in active-backup mode
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: a9b8a2b39ce65df45687cf9ef648885c2a99fe75
+
+[ Upstream commit a9b8a2b39ce65df45687cf9ef648885c2a99fe75 ]
+
+There's currently a problem with toggling arp_validate on and off with an
+active-backup bond. At the moment, you can start up a bond, like so:
+
+modprobe bonding mode=1 arp_interval=100 arp_validate=0 arp_ip_targets=192.168.1.1
+ip link set bond0 down
+echo "ens4f0" > /sys/class/net/bond0/bonding/slaves
+echo "ens4f1" > /sys/class/net/bond0/bonding/slaves
+ip link set bond0 up
+ip addr add 192.168.1.2/24 dev bond0
+
+Pings to 192.168.1.1 work just fine. Now turn on arp_validate:
+
+echo 1 > /sys/class/net/bond0/bonding/arp_validate
+
+Pings to 192.168.1.1 continue to work just fine. Now when you go to turn
+arp_validate off again, the link falls flat on it's face:
+
+echo 0 > /sys/class/net/bond0/bonding/arp_validate
+dmesg
+...
+[133191.911987] bond0: Setting arp_validate to none (0)
+[133194.257793] bond0: bond_should_notify_peers: slave ens4f0
+[133194.258031] bond0: link status definitely down for interface ens4f0, disabling it
+[133194.259000] bond0: making interface ens4f1 the new active one
+[133197.330130] bond0: link status definitely down for interface ens4f1, disabling it
+[133197.331191] bond0: now running without any active interface!
+
+The problem lies in bond_options.c, where passing in arp_validate=0
+results in bond->recv_probe getting set to NULL. This flies directly in
+the face of commit 3fe68df97c7f, which says we need to set recv_probe =
+bond_arp_recv, even if we're not using arp_validate. Said commit fixed
+this in bond_option_arp_interval_set, but missed that we can get to that
+same state in bond_option_arp_validate_set as well.
+
+One solution would be to universally set recv_probe = bond_arp_recv here
+as well, but I don't think bond_option_arp_validate_set has any business
+touching recv_probe at all, and that should be left to the arp_interval
+code, so we can just make things much tidier here.
+
+Fixes: 3fe68df97c7f ("bonding: always set recv_probe to bond_arp_rcv in arp monitor")
+CC: Jay Vosburgh <j.vosburgh@gmail.com>
+CC: Veaceslav Falico <vfalico@gmail.com>
+CC: Andy Gospodarek <andy@greyhouse.net>
+CC: "David S. Miller" <davem@davemloft.net>
+CC: netdev@vger.kernel.org
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Jay Vosburgh <jay.vosburgh@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/bonding/bond_options.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
+index da1fc17295d9..b996967af8d9 100644
+--- a/drivers/net/bonding/bond_options.c
++++ b/drivers/net/bonding/bond_options.c
+@@ -1098,13 +1098,6 @@ static int bond_option_arp_validate_set(struct bonding *bond,
+ {
+ netdev_dbg(bond->dev, "Setting arp_validate to %s (%llu)\n",
+ newval->string, newval->value);
+-
+- if (bond->dev->flags & IFF_UP) {
+- if (!newval->value)
+- bond->recv_probe = NULL;
+- else if (bond->params.arp_interval)
+- bond->recv_probe = bond_arp_rcv;
+- }
+ bond->params.arp_validate = newval->value;
+
+ return 0;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-015-bridge-Fix-error-path-for-kobject_init_and_add.patch b/patches.kernel.org/5.1.3-015-bridge-Fix-error-path-for-kobject_init_and_add.patch
new file mode 100644
index 0000000000..a93230e25f
--- /dev/null
+++ b/patches.kernel.org/5.1.3-015-bridge-Fix-error-path-for-kobject_init_and_add.patch
@@ -0,0 +1,70 @@
+From: "Tobin C. Harding" <tobin@kernel.org>
+Date: Fri, 10 May 2019 12:52:12 +1000
+Subject: [PATCH] bridge: Fix error path for kobject_init_and_add()
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: bdfad5aec1392b93495b77b864d58d7f101dc1c1
+
+[ Upstream commit bdfad5aec1392b93495b77b864d58d7f101dc1c1 ]
+
+Currently error return from kobject_init_and_add() is not followed by a
+call to kobject_put(). This means there is a memory leak. We currently
+set p to NULL so that kfree() may be called on it as a noop, the code is
+arguably clearer if we move the kfree() up closer to where it is
+called (instead of after goto jump).
+
+Remove a goto label 'err1' and jump to call to kobject_put() in error
+return from kobject_init_and_add() fixing the memory leak. Re-name goto
+label 'put_back' to 'err1' now that we don't use err1, following current
+nomenclature (err1, err2 ...). Move call to kfree out of the error
+code at bottom of function up to closer to where memory was allocated.
+Add comment to clarify call to kfree().
+
+Signed-off-by: Tobin C. Harding <tobin@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/bridge/br_if.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
+index 41f0a696a65f..0cb0aa0313a8 100644
+--- a/net/bridge/br_if.c
++++ b/net/bridge/br_if.c
+@@ -602,13 +602,15 @@ int br_add_if(struct net_bridge *br, struct net_device *dev,
+ call_netdevice_notifiers(NETDEV_JOIN, dev);
+
+ err = dev_set_allmulti(dev, 1);
+- if (err)
+- goto put_back;
++ if (err) {
++ kfree(p); /* kobject not yet init'd, manually free */
++ goto err1;
++ }
+
+ err = kobject_init_and_add(&p->kobj, &brport_ktype, &(dev->dev.kobj),
+ SYSFS_BRIDGE_PORT_ATTR);
+ if (err)
+- goto err1;
++ goto err2;
+
+ err = br_sysfs_addif(p);
+ if (err)
+@@ -700,12 +702,9 @@ int br_add_if(struct net_bridge *br, struct net_device *dev,
+ sysfs_remove_link(br->ifobj, p->dev->name);
+ err2:
+ kobject_put(&p->kobj);
+- p = NULL; /* kobject_put frees */
+-err1:
+ dev_set_allmulti(dev, -1);
+-put_back:
++err1:
+ dev_put(dev);
+- kfree(p);
+ return err;
+ }
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-016-dpaa_eth-fix-SG-frame-cleanup.patch b/patches.kernel.org/5.1.3-016-dpaa_eth-fix-SG-frame-cleanup.patch
new file mode 100644
index 0000000000..9af77eaedd
--- /dev/null
+++ b/patches.kernel.org/5.1.3-016-dpaa_eth-fix-SG-frame-cleanup.patch
@@ -0,0 +1,38 @@
+From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Date: Fri, 3 May 2019 16:03:11 +0300
+Subject: [PATCH] dpaa_eth: fix SG frame cleanup
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 17170e6570c082717c142733d9a638bcd20551f8
+
+[ Upstream commit 17170e6570c082717c142733d9a638bcd20551f8 ]
+
+Fix issue with the entry indexing in the sg frame cleanup code being
+off-by-1. This problem showed up when doing some basic iperf tests and
+manifested in traffic coming to a halt.
+
+Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Acked-by: Madalin Bucur <madalin.bucur@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index dfebc30c4841..d3f2408dc9e8 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -1648,7 +1648,7 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+ qm_sg_entry_get_len(&sgt[0]), dma_dir);
+
+ /* remaining pages were mapped with skb_frag_dma_map() */
+- for (i = 1; i < nr_frags; i++) {
++ for (i = 1; i <= nr_frags; i++) {
+ WARN_ON(qm_sg_entry_is_ext(&sgt[i]));
+
+ dma_unmap_page(dev, qm_sg_addr(&sgt[i]),
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-017-fib_rules-return-0-directly-if-an-exactly-same-.patch b/patches.kernel.org/5.1.3-017-fib_rules-return-0-directly-if-an-exactly-same-.patch
new file mode 100644
index 0000000000..e8d00eeeb3
--- /dev/null
+++ b/patches.kernel.org/5.1.3-017-fib_rules-return-0-directly-if-an-exactly-same-.patch
@@ -0,0 +1,55 @@
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Tue, 7 May 2019 17:11:18 +0800
+Subject: [PATCH] fib_rules: return 0 directly if an exactly same rule exists
+ when NLM_F_EXCL not supplied
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: e9919a24d3022f72bcadc407e73a6ef17093a849
+
+[ Upstream commit e9919a24d3022f72bcadc407e73a6ef17093a849 ]
+
+With commit 153380ec4b9 ("fib_rules: Added NLM_F_EXCL support to
+fib_nl_newrule") we now able to check if a rule already exists. But this
+only works with iproute2. For other tools like libnl, NetworkManager,
+it still could add duplicate rules with only NLM_F_CREATE flag, like
+
+[localhost ~ ]# ip rule
+0: from all lookup local
+32766: from all lookup main
+32767: from all lookup default
+100000: from 192.168.7.5 lookup 5
+100000: from 192.168.7.5 lookup 5
+
+As it doesn't make sense to create two duplicate rules, let's just return
+0 if the rule exists.
+
+Fixes: 153380ec4b9 ("fib_rules: Added NLM_F_EXCL support to fib_nl_newrule")
+Reported-by: Thomas Haller <thaller@redhat.com>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/core/fib_rules.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
+index ffbb827723a2..c49b752ea7eb 100644
+--- a/net/core/fib_rules.c
++++ b/net/core/fib_rules.c
+@@ -756,9 +756,9 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if (err)
+ goto errout;
+
+- if ((nlh->nlmsg_flags & NLM_F_EXCL) &&
+- rule_exists(ops, frh, tb, rule)) {
+- err = -EEXIST;
++ if (rule_exists(ops, frh, tb, rule)) {
++ if (nlh->nlmsg_flags & NLM_F_EXCL)
++ err = -EEXIST;
+ goto errout_free;
+ }
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-018-ipv4-Fix-raw-socket-lookup-for-local-traffic.patch b/patches.kernel.org/5.1.3-018-ipv4-Fix-raw-socket-lookup-for-local-traffic.patch
new file mode 100644
index 0000000000..e68346debf
--- /dev/null
+++ b/patches.kernel.org/5.1.3-018-ipv4-Fix-raw-socket-lookup-for-local-traffic.patch
@@ -0,0 +1,52 @@
+From: David Ahern <dsahern@gmail.com>
+Date: Tue, 7 May 2019 20:44:59 -0700
+Subject: [PATCH] ipv4: Fix raw socket lookup for local traffic
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 19e4e768064a87b073a4b4c138b55db70e0cfb9f
+
+[ Upstream commit 19e4e768064a87b073a4b4c138b55db70e0cfb9f ]
+
+inet_iif should be used for the raw socket lookup. inet_iif considers
+rt_iif which handles the case of local traffic.
+
+As it stands, ping to a local address with the '-I <dev>' option fails
+ever since ping was changed to use SO_BINDTODEVICE instead of
+cmsg + IP_PKTINFO.
+
+IPv6 works fine.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv4/raw.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
+index c55a5432cf37..dc91c27bb788 100644
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -173,6 +173,7 @@ static int icmp_filter(const struct sock *sk, const struct sk_buff *skb)
+ static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash)
+ {
+ int sdif = inet_sdif(skb);
++ int dif = inet_iif(skb);
+ struct sock *sk;
+ struct hlist_head *head;
+ int delivered = 0;
+@@ -185,8 +186,7 @@ static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash)
+
+ net = dev_net(skb->dev);
+ sk = __raw_v4_lookup(net, __sk_head(head), iph->protocol,
+- iph->saddr, iph->daddr,
+- skb->dev->ifindex, sdif);
++ iph->saddr, iph->daddr, dif, sdif);
+
+ while (sk) {
+ delivered = 1;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-019-net-dsa-Fix-error-cleanup-path-in-dsa_init_modu.patch b/patches.kernel.org/5.1.3-019-net-dsa-Fix-error-cleanup-path-in-dsa_init_modu.patch
new file mode 100644
index 0000000000..ba0193b4d7
--- /dev/null
+++ b/patches.kernel.org/5.1.3-019-net-dsa-Fix-error-cleanup-path-in-dsa_init_modu.patch
@@ -0,0 +1,89 @@
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Mon, 6 May 2019 23:25:29 +0800
+Subject: [PATCH] net: dsa: Fix error cleanup path in dsa_init_module
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 68be930249d051fd54d3d99156b3dcadcb2a1f9b
+
+[ Upstream commit 68be930249d051fd54d3d99156b3dcadcb2a1f9b ]
+
+BUG: unable to handle kernel paging request at ffffffffa01c5430
+PGD 3270067 P4D 3270067 PUD 3271063 PMD 230bc5067 PTE 0
+Oops: 0000 [#1
+CPU: 0 PID: 6159 Comm: modprobe Not tainted 5.1.0+ #33
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
+RIP: 0010:raw_notifier_chain_register+0x16/0x40
+Code: 63 f8 66 90 e9 5d ff ff ff 90 90 90 90 90 90 90 90 90 90 90 55 48 8b 07 48 89 e5 48 85 c0 74 1c 8b 56 10 3b 50 10 7e 07 eb 12 <39> 50 10 7c 0d 48 8d 78 08 48 8b 40 08 48 85 c0 75 ee 48 89 46 08
+RSP: 0018:ffffc90001c33c08 EFLAGS: 00010282
+RAX: ffffffffa01c5420 RBX: ffffffffa01db420 RCX: 4fcef45928070a8b
+RDX: 0000000000000000 RSI: ffffffffa01db420 RDI: ffffffffa01b0068
+RBP: ffffc90001c33c08 R08: 000000003e0a33d0 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000094443661 R12: ffff88822c320700
+R13: ffff88823109be80 R14: 0000000000000000 R15: ffffc90001c33e78
+FS: 00007fab8bd08540(0000) GS:ffff888237a00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: ffffffffa01c5430 CR3: 00000002297ea000 CR4: 00000000000006f0
+Call Trace:
+ register_netdevice_notifier+0x43/0x250
+ ? 0xffffffffa01e0000
+ dsa_slave_register_notifier+0x13/0x70 [dsa_core
+ ? 0xffffffffa01e0000
+ dsa_init_module+0x2e/0x1000 [dsa_core
+ do_one_initcall+0x6c/0x3cc
+ ? do_init_module+0x22/0x1f1
+ ? rcu_read_lock_sched_held+0x97/0xb0
+ ? kmem_cache_alloc_trace+0x325/0x3b0
+ do_init_module+0x5b/0x1f1
+ load_module+0x1db1/0x2690
+ ? m_show+0x1d0/0x1d0
+ __do_sys_finit_module+0xc5/0xd0
+ __x64_sys_finit_module+0x15/0x20
+ do_syscall_64+0x6b/0x1d0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Cleanup allocated resourses if there are errors,
+otherwise it will trgger memleak.
+
+Fixes: c9eb3e0f8701 ("net: dsa: Add support for learning FDB through notification")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/dsa/dsa.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
+index 36de4f2a3366..cb080efdc7b3 100644
+--- a/net/dsa/dsa.c
++++ b/net/dsa/dsa.c
+@@ -344,15 +344,22 @@ static int __init dsa_init_module(void)
+
+ rc = dsa_slave_register_notifier();
+ if (rc)
+- return rc;
++ goto register_notifier_fail;
+
+ rc = dsa_legacy_register();
+ if (rc)
+- return rc;
++ goto legacy_register_fail;
+
+ dev_add_pack(&dsa_pack_type);
+
+ return 0;
++
++legacy_register_fail:
++ dsa_slave_unregister_notifier();
++register_notifier_fail:
++ destroy_workqueue(dsa_owq);
++
++ return rc;
+ }
+ module_init(dsa_init_module);
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-020-net-ethernet-stmmac-dwmac-sun8i-enable-support-.patch b/patches.kernel.org/5.1.3-020-net-ethernet-stmmac-dwmac-sun8i-enable-support-.patch
new file mode 100644
index 0000000000..2fd2f1e92d
--- /dev/null
+++ b/patches.kernel.org/5.1.3-020-net-ethernet-stmmac-dwmac-sun8i-enable-support-.patch
@@ -0,0 +1,41 @@
+From: Corentin Labbe <clabbe@baylibre.com>
+Date: Mon, 13 May 2019 13:06:39 +0000
+Subject: [PATCH] net: ethernet: stmmac: dwmac-sun8i: enable support of unicast
+ filtering
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: d4c26eb6e721683a0f93e346ce55bc8dc3cbb175
+
+[ Upstream commit d4c26eb6e721683a0f93e346ce55bc8dc3cbb175 ]
+
+When adding more MAC addresses to a dwmac-sun8i interface, the device goes
+directly in promiscuous mode.
+This is due to IFF_UNICAST_FLT missing flag.
+
+So since the hardware support unicast filtering, let's add IFF_UNICAST_FLT.
+
+Fixes: 9f93ac8d4085 ("net-next: stmmac: Add dwmac-sun8i")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index 195669f550f0..ba124a4da793 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -1015,6 +1015,8 @@ static struct mac_device_info *sun8i_dwmac_setup(void *ppriv)
+ mac->mac = &sun8i_dwmac_ops;
+ mac->dma = &sun8i_dwmac_dma_ops;
+
++ priv->dev->priv_flags |= IFF_UNICAST_FLT;
++
+ /* The loopback bit seems to be re-set when link change
+ * Simply mask it each time
+ * Speed 10/100/1000 are set in BIT(2)/BIT(3)
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-021-net-macb-Change-interrupt-and-napi-enable-order.patch b/patches.kernel.org/5.1.3-021-net-macb-Change-interrupt-and-napi-enable-order.patch
new file mode 100644
index 0000000000..1be5a091e8
--- /dev/null
+++ b/patches.kernel.org/5.1.3-021-net-macb-Change-interrupt-and-napi-enable-order.patch
@@ -0,0 +1,58 @@
+From: Harini Katakam <harini.katakam@xilinx.com>
+Date: Tue, 7 May 2019 19:59:10 +0530
+Subject: [PATCH] net: macb: Change interrupt and napi enable order in open
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 0504453139ef5a593c9587e1e851febee859c7d8
+
+[ Upstream commit 0504453139ef5a593c9587e1e851febee859c7d8 ]
+
+Current order in open:
+-> Enable interrupts (macb_init_hw)
+-> Enable NAPI
+-> Start PHY
+
+Sequence of RX handling:
+-> RX interrupt occurs
+-> Interrupt is cleared and interrupt bits disabled in handler
+-> NAPI is scheduled
+-> In NAPI, RX budget is processed and RX interrupts are re-enabled
+
+With the above, on QEMU or fixed link setups (where PHY state doesn't
+matter), there's a chance macb RX interrupt occurs before NAPI is
+enabled. This will result in NAPI being scheduled before it is enabled.
+Fix this macb open by changing the order.
+
+Fixes: ae1f2a56d273 ("net: macb: Added support for many RX queues")
+Signed-off-by: Harini Katakam <harini.katakam@xilinx.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 3da2795e2486..a6535e226d84 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -2461,12 +2461,12 @@ static int macb_open(struct net_device *dev)
+ goto pm_exit;
+ }
+
+- bp->macbgem_ops.mog_init_rings(bp);
+- macb_init_hw(bp);
+-
+ for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue)
+ napi_enable(&queue->napi);
+
++ bp->macbgem_ops.mog_init_rings(bp);
++ macb_init_hw(bp);
++
+ /* schedule a link state check */
+ phy_start(dev->phydev);
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-022-net-seeq-fix-crash-caused-by-not-set-dev.parent.patch b/patches.kernel.org/5.1.3-022-net-seeq-fix-crash-caused-by-not-set-dev.parent.patch
new file mode 100644
index 0000000000..188913e2a3
--- /dev/null
+++ b/patches.kernel.org/5.1.3-022-net-seeq-fix-crash-caused-by-not-set-dev.parent.patch
@@ -0,0 +1,36 @@
+From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Date: Mon, 13 May 2019 13:15:17 +0200
+Subject: [PATCH] net: seeq: fix crash caused by not set dev.parent
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 5afcd14cfc7fed1bcc8abcee2cef82732772bfc2
+
+[ Upstream commit 5afcd14cfc7fed1bcc8abcee2cef82732772bfc2 ]
+
+The old MIPS implementation of dma_cache_sync() didn't use the dev argument,
+but commit c9eb6172c328 ("dma-mapping: turn dma_cache_sync into a
+dma_map_ops method") changed that, so we now need to set dev.parent.
+
+Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/seeq/sgiseeq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c
+index 70cce63a6081..696037d5ac3d 100644
+--- a/drivers/net/ethernet/seeq/sgiseeq.c
++++ b/drivers/net/ethernet/seeq/sgiseeq.c
+@@ -735,6 +735,7 @@ static int sgiseeq_probe(struct platform_device *pdev)
+ }
+
+ platform_set_drvdata(pdev, dev);
++ SET_NETDEV_DEV(dev, &pdev->dev);
+ sp = netdev_priv(dev);
+
+ /* Make private data page aligned */
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-023-net-ucc_geth-fix-Oops-when-changing-number-of-b.patch b/patches.kernel.org/5.1.3-023-net-ucc_geth-fix-Oops-when-changing-number-of-b.patch
new file mode 100644
index 0000000000..a84d06c7ec
--- /dev/null
+++ b/patches.kernel.org/5.1.3-023-net-ucc_geth-fix-Oops-when-changing-number-of-b.patch
@@ -0,0 +1,88 @@
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Fri, 3 May 2019 13:33:23 +0000
+Subject: [PATCH] net: ucc_geth - fix Oops when changing number of buffers in
+ the ring
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: ee0df19305d9fabd9479b785918966f6e25b733b
+
+[ Upstream commit ee0df19305d9fabd9479b785918966f6e25b733b ]
+
+When changing the number of buffers in the RX ring while the interface
+is running, the following Oops is encountered due to the new number
+of buffers being taken into account immediately while their allocation
+is done when opening the device only.
+
+[ 69.882706] Unable to handle kernel paging request for data at address 0xf0000100
+[ 69.890172] Faulting instruction address: 0xc033e164
+[ 69.895122] Oops: Kernel access of bad area, sig: 11 [#1]
+[ 69.900494] BE PREEMPT CMPCPRO
+[ 69.907120] CPU: 0 PID: 0 Comm: swapper Not tainted 4.14.115-00006-g179ade8ce3-dirty #269
+[ 69.915956] task: c0684310 task.stack: c06da000
+[ 69.920470] NIP: c033e164 LR: c02e44d0 CTR: c02e41fc
+[ 69.925504] REGS: dfff1e20 TRAP: 0300 Not tainted (4.14.115-00006-g179ade8ce3-dirty)
+[ 69.934161] MSR: 00009032 <EE,ME,IR,DR,RI> CR: 22004428 XER: 20000000
+[ 69.940869] DAR: f0000100 DSISR: 20000000
+[ 69.940869] GPR00: c0352d70 dfff1ed0 c0684310 f00000a4 00000040 dfff1f68 00000000 0000001f
+[ 69.940869] GPR08: df53f410 1cc00040 00000021 c0781640 42004424 100c82b6 f00000a4 df53f5b0
+[ 69.940869] GPR16: df53f6c0 c05daf84 00000040 00000000 00000040 c0782be4 00000000 00000001
+[ 69.940869] GPR24: 00000000 df53f400 000001b0 df53f410 df53f000 0000003f df708220 1cc00044
+[ 69.978348] NIP [c033e164] skb_put+0x0/0x5c
+[ 69.982528] LR [c02e44d0] ucc_geth_poll+0x2d4/0x3f8
+[ 69.987384] Call Trace:
+[ 69.989830] [dfff1ed0] [c02e4554] ucc_geth_poll+0x358/0x3f8 (unreliable)
+[ 69.996522] [dfff1f20] [c0352d70] net_rx_action+0x248/0x30c
+[ 70.002099] [dfff1f80] [c04e93e4] __do_softirq+0xfc/0x310
+[ 70.007492] [dfff1fe0] [c0021124] irq_exit+0xd0/0xd4
+[ 70.012458] [dfff1ff0] [c000e7e0] call_do_irq+0x24/0x3c
+[ 70.017683] [c06dbe80] [c0006bac] do_IRQ+0x64/0xc4
+[ 70.022474] [c06dbea0] [c001097c] ret_from_except+0x0/0x14
+[ 70.027964] --- interrupt: 501 at rcu_idle_exit+0x84/0x90
+[ 70.027964] LR = rcu_idle_exit+0x74/0x90
+[ 70.037585] [c06dbf60] [20000000] 0x20000000 (unreliable)
+[ 70.042984] [c06dbf80] [c004bb0c] do_idle+0xb4/0x11c
+[ 70.047945] [c06dbfa0] [c004bd14] cpu_startup_entry+0x18/0x1c
+[ 70.053682] [c06dbfb0] [c05fb034] start_kernel+0x370/0x384
+[ 70.059153] [c06dbff0] [00003438] 0x3438
+[ 70.063062] Instruction dump:
+[ 70.066023] 38a00000 38800000 90010014 4bfff015 80010014 7c0803a6 3123ffff 7c691910
+[ 70.073767] 38210010 4e800020 38600000 4e800020 <80e3005c> 80c30098 3107ffff 7d083910
+[ 70.081690] ---[ end trace be7ccd9c1e1a9f12 ]---
+
+This patch forbids the modification of the number of buffers in the
+ring while the interface is running.
+
+Fixes: ac421852b3a0 ("ucc_geth: add ethtool support")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/freescale/ucc_geth_ethtool.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
+index 0beee2cc2ddd..722b6de24816 100644
+--- a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
++++ b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
+@@ -252,14 +252,12 @@ uec_set_ringparam(struct net_device *netdev,
+ return -EINVAL;
+ }
+
++ if (netif_running(netdev))
++ return -EBUSY;
++
+ ug_info->bdRingLenRx[queue] = ring->rx_pending;
+ ug_info->bdRingLenTx[queue] = ring->tx_pending;
+
+- if (netif_running(netdev)) {
+- /* FIXME: restart automatically */
+- netdev_info(netdev, "Please re-open the interface\n");
+- }
+-
+ return ret;
+ }
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-024-packet-Fix-error-path-in-packet_init.patch b/patches.kernel.org/5.1.3-024-packet-Fix-error-path-in-packet_init.patch
new file mode 100644
index 0000000000..cb238bde4e
--- /dev/null
+++ b/patches.kernel.org/5.1.3-024-packet-Fix-error-path-in-packet_init.patch
@@ -0,0 +1,93 @@
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 9 May 2019 22:52:20 +0800
+Subject: [PATCH] packet: Fix error path in packet_init
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 36096f2f4fa05f7678bc87397665491700bae757
+
+[ Upstream commit 36096f2f4fa05f7678bc87397665491700bae757 ]
+
+kernel BUG at lib/list_debug.c:47!
+invalid opcode: 0000 [#1
+CPU: 0 PID: 12914 Comm: rmmod Tainted: G W 5.1.0+ #47
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
+RIP: 0010:__list_del_entry_valid+0x53/0x90
+Code: 48 8b 32 48 39 fe 75 35 48 8b 50 08 48 39 f2 75 40 b8 01 00 00 00 5d c3 48
+89 fe 48 89 c2 48 c7 c7 18 75 fe 82 e8 cb 34 78 ff <0f> 0b 48 89 fe 48 c7 c7 50 75 fe 82 e8 ba 34 78 ff 0f 0b 48 89 f2
+RSP: 0018:ffffc90001c2fe40 EFLAGS: 00010286
+RAX: 000000000000004e RBX: ffffffffa0184000 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: ffff888237a17788 RDI: 00000000ffffffff
+RBP: ffffc90001c2fe40 R08: 0000000000000000 R09: 0000000000000000
+R10: ffffc90001c2fe10 R11: 0000000000000000 R12: 0000000000000000
+R13: ffffc90001c2fe50 R14: ffffffffa0184000 R15: 0000000000000000
+FS: 00007f3d83634540(0000) GS:ffff888237a00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000555c350ea818 CR3: 0000000231677000 CR4: 00000000000006f0
+Call Trace:
+ unregister_pernet_operations+0x34/0x120
+ unregister_pernet_subsys+0x1c/0x30
+ packet_exit+0x1c/0x369 [af_packet
+ __x64_sys_delete_module+0x156/0x260
+ ? lockdep_hardirqs_on+0x133/0x1b0
+ ? do_syscall_64+0x12/0x1f0
+ do_syscall_64+0x6e/0x1f0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+When modprobe af_packet, register_pernet_subsys
+fails and does a cleanup, ops->list is set to LIST_POISON1,
+but the module init is considered to success, then while rmmod it,
+BUG() is triggered in __list_del_entry_valid which is called from
+unregister_pernet_subsys. This patch fix error handing path in
+packet_init to avoid possilbe issue if some error occur.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/packet/af_packet.c | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 9b81813dd16a..59da6f5b717d 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4603,14 +4603,29 @@ static void __exit packet_exit(void)
+
+ static int __init packet_init(void)
+ {
+- int rc = proto_register(&packet_proto, 0);
++ int rc;
+
+- if (rc != 0)
++ rc = proto_register(&packet_proto, 0);
++ if (rc)
+ goto out;
++ rc = sock_register(&packet_family_ops);
++ if (rc)
++ goto out_proto;
++ rc = register_pernet_subsys(&packet_net_ops);
++ if (rc)
++ goto out_sock;
++ rc = register_netdevice_notifier(&packet_netdev_notifier);
++ if (rc)
++ goto out_pernet;
+
+- sock_register(&packet_family_ops);
+- register_pernet_subsys(&packet_net_ops);
+- register_netdevice_notifier(&packet_netdev_notifier);
++ return 0;
++
++out_pernet:
++ unregister_pernet_subsys(&packet_net_ops);
++out_sock:
++ sock_unregister(PF_PACKET);
++out_proto:
++ proto_unregister(&packet_proto);
+ out:
+ return rc;
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-025-selinux-do-not-report-error-on-connect-AF_UNSPE.patch b/patches.kernel.org/5.1.3-025-selinux-do-not-report-error-on-connect-AF_UNSPE.patch
new file mode 100644
index 0000000000..e4db4406a5
--- /dev/null
+++ b/patches.kernel.org/5.1.3-025-selinux-do-not-report-error-on-connect-AF_UNSPE.patch
@@ -0,0 +1,61 @@
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Wed, 8 May 2019 15:32:51 +0200
+Subject: [PATCH] selinux: do not report error on connect(AF_UNSPEC)
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: c7e0d6cca86581092cbbf2cd868b3601495554cf
+
+[ Upstream commit c7e0d6cca86581092cbbf2cd868b3601495554cf ]
+
+calling connect(AF_UNSPEC) on an already connected TCP socket is an
+established way to disconnect() such socket. After commit 68741a8adab9
+("selinux: Fix ltp test connect-syscall failure") it no longer works
+and, in the above scenario connect() fails with EAFNOSUPPORT.
+
+Fix the above falling back to the generic/old code when the address family
+is not AF_INET{4,6}, but leave the SCTP code path untouched, as it has
+specific constraints.
+
+Fixes: 68741a8adab9 ("selinux: Fix ltp test connect-syscall failure")
+Reported-by: Tom Deseyn <tdeseyn@redhat.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ security/selinux/hooks.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 1d0b37af2444..28bff30c2f15 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -4572,7 +4572,7 @@ static int selinux_socket_connect_helper(struct socket *sock,
+ struct lsm_network_audit net = {0,};
+ struct sockaddr_in *addr4 = NULL;
+ struct sockaddr_in6 *addr6 = NULL;
+- unsigned short snum;
++ unsigned short snum = 0;
+ u32 sid, perm;
+
+ /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
+@@ -4595,12 +4595,12 @@ static int selinux_socket_connect_helper(struct socket *sock,
+ break;
+ default:
+ /* Note that SCTP services expect -EINVAL, whereas
+- * others expect -EAFNOSUPPORT.
++ * others must handle this at the protocol level:
++ * connect(AF_UNSPEC) on a connected socket is
++ * a documented way disconnect the socket.
+ */
+ if (sksec->sclass == SECCLASS_SCTP_SOCKET)
+ return -EINVAL;
+- else
+- return -EAFNOSUPPORT;
+ }
+
+ err = sel_netport_sid(sk->sk_protocol, snum, &sid);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-026-tipc-fix-hanging-clients-using-poll-with-EPOLLO.patch b/patches.kernel.org/5.1.3-026-tipc-fix-hanging-clients-using-poll-with-EPOLLO.patch
new file mode 100644
index 0000000000..67aa475c33
--- /dev/null
+++ b/patches.kernel.org/5.1.3-026-tipc-fix-hanging-clients-using-poll-with-EPOLLO.patch
@@ -0,0 +1,60 @@
+From: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@gmail.com>
+Date: Thu, 9 May 2019 07:13:42 +0200
+Subject: [PATCH] tipc: fix hanging clients using poll with EPOLLOUT flag
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: ff946833b70e0c7f93de9a3f5b329b5ae2287b38
+
+[ Upstream commit ff946833b70e0c7f93de9a3f5b329b5ae2287b38 ]
+
+commit 517d7c79bdb398 ("tipc: fix hanging poll() for stream sockets")
+introduced a regression for clients using non-blocking sockets.
+After the commit, we send EPOLLOUT event to the client even in
+TIPC_CONNECTING state. This causes the subsequent send() to fail
+with ENOTCONN, as the socket is still not in TIPC_ESTABLISHED state.
+
+In this commit, we:
+- improve the fix for hanging poll() by replacing sk_data_ready()
+ with sk_state_change() to wake up all clients.
+- revert the faulty updates introduced by commit 517d7c79bdb398
+ ("tipc: fix hanging poll() for stream sockets").
+
+Fixes: 517d7c79bdb398 ("tipc: fix hanging poll() for stream sockets")
+Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@gmail.com>
+Acked-by: Jon Maloy <jon.maloy@ericsson.se>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/tipc/socket.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index b542f14ed444..2851937f6e32 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -734,11 +734,11 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
+
+ switch (sk->sk_state) {
+ case TIPC_ESTABLISHED:
+- case TIPC_CONNECTING:
+ if (!tsk->cong_link_cnt && !tsk_conn_cong(tsk))
+ revents |= EPOLLOUT;
+ /* fall through */
+ case TIPC_LISTEN:
++ case TIPC_CONNECTING:
+ if (!skb_queue_empty(&sk->sk_receive_queue))
+ revents |= EPOLLIN | EPOLLRDNORM;
+ break;
+@@ -2041,7 +2041,7 @@ static bool tipc_sk_filter_connect(struct tipc_sock *tsk, struct sk_buff *skb)
+ if (msg_data_sz(hdr))
+ return true;
+ /* Empty ACK-, - wake up sleeping connect() and drop */
+- sk->sk_data_ready(sk);
++ sk->sk_state_change(sk);
+ msg_set_dest_droppable(hdr, 1);
+ return false;
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-027-vlan-disable-SIOCSHWTSTAMP-in-container.patch b/patches.kernel.org/5.1.3-027-vlan-disable-SIOCSHWTSTAMP-in-container.patch
new file mode 100644
index 0000000000..b2dc190f7f
--- /dev/null
+++ b/patches.kernel.org/5.1.3-027-vlan-disable-SIOCSHWTSTAMP-in-container.patch
@@ -0,0 +1,45 @@
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Thu, 9 May 2019 14:55:07 +0800
+Subject: [PATCH] vlan: disable SIOCSHWTSTAMP in container
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 873017af778439f2f8e3d87f28ddb1fcaf244a76
+
+[ Upstream commit 873017af778439f2f8e3d87f28ddb1fcaf244a76 ]
+
+With NET_ADMIN enabled in container, a normal user could be mapped to
+root and is able to change the real device's rx filter via ioctl on
+vlan, which would affect the other ptp process on host. Fix it by
+disabling SIOCSHWTSTAMP in container.
+
+Fixes: a6111d3c93d0 ("vlan: Pass SIOC[SG]HWTSTAMP ioctls to real device")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/8021q/vlan_dev.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 8d77b6ee4477..eb98be23423e 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -367,10 +367,12 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ ifrr.ifr_ifru = ifr->ifr_ifru;
+
+ switch (cmd) {
++ case SIOCSHWTSTAMP:
++ if (!net_eq(dev_net(dev), &init_net))
++ break;
+ case SIOCGMIIPHY:
+ case SIOCGMIIREG:
+ case SIOCSMIIREG:
+- case SIOCSHWTSTAMP:
+ case SIOCGHWTSTAMP:
+ if (netif_device_present(real_dev) && ops->ndo_do_ioctl)
+ err = ops->ndo_do_ioctl(real_dev, &ifrr, cmd);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-028-vrf-sit-mtu-should-not-be-updated-when-vrf-netd.patch b/patches.kernel.org/5.1.3-028-vrf-sit-mtu-should-not-be-updated-when-vrf-netd.patch
new file mode 100644
index 0000000000..d28bb6a598
--- /dev/null
+++ b/patches.kernel.org/5.1.3-028-vrf-sit-mtu-should-not-be-updated-when-vrf-netd.patch
@@ -0,0 +1,41 @@
+From: Stephen Suryaputra <ssuryaextr@gmail.com>
+Date: Mon, 6 May 2019 15:00:01 -0400
+Subject: [PATCH] vrf: sit mtu should not be updated when vrf netdev is the
+ link
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: ff6ab32bd4e073976e4d8797b4d514a172cfe6cb
+
+[ Upstream commit ff6ab32bd4e073976e4d8797b4d514a172cfe6cb ]
+
+VRF netdev mtu isn't typically set and have an mtu of 65536. When the
+link of a tunnel is set, the tunnel mtu is changed from 1480 to the link
+mtu minus tunnel header. In the case of VRF netdev is the link, then the
+tunnel mtu becomes 65516. So, fix it by not setting the tunnel mtu in
+this case.
+
+Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
+Reviewed-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv6/sit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index b2109b74857d..971d60bf9640 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1084,7 +1084,7 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
+ if (!tdev && tunnel->parms.link)
+ tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link);
+
+- if (tdev) {
++ if (tdev && !netif_is_l3_master(tdev)) {
+ int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+
+ dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-029-tuntap-fix-dividing-by-zero-in-ebpf-queue-selec.patch b/patches.kernel.org/5.1.3-029-tuntap-fix-dividing-by-zero-in-ebpf-queue-selec.patch
new file mode 100644
index 0000000000..68c888a299
--- /dev/null
+++ b/patches.kernel.org/5.1.3-029-tuntap-fix-dividing-by-zero-in-ebpf-queue-selec.patch
@@ -0,0 +1,50 @@
+From: Jason Wang <jasowang@redhat.com>
+Date: Wed, 8 May 2019 23:20:17 -0400
+Subject: [PATCH] tuntap: fix dividing by zero in ebpf queue selection
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: a35d310f03a692bf4798eb309a1950a06a150620
+
+[ Upstream commit a35d310f03a692bf4798eb309a1950a06a150620 ]
+
+We need check if tun->numqueues is zero (e.g for the persist device)
+before trying to use it for modular arithmetic.
+
+Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
+Fixes: 96f84061620c6("tun: add eBPF based queue selection method")
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/tun.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index e9ca1c088d0b..dc62fc3c5a95 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -596,13 +596,18 @@ static u16 tun_automq_select_queue(struct tun_struct *tun, struct sk_buff *skb)
+ static u16 tun_ebpf_select_queue(struct tun_struct *tun, struct sk_buff *skb)
+ {
+ struct tun_prog *prog;
++ u32 numqueues;
+ u16 ret = 0;
+
++ numqueues = READ_ONCE(tun->numqueues);
++ if (!numqueues)
++ return 0;
++
+ prog = rcu_dereference(tun->steering_prog);
+ if (prog)
+ ret = bpf_prog_run_clear_cb(prog->prog, skb);
+
+- return ret % tun->numqueues;
++ return ret % numqueues;
+ }
+
+ static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-030-tuntap-synchronize-through-tfiles-array-instead.patch b/patches.kernel.org/5.1.3-030-tuntap-synchronize-through-tfiles-array-instead.patch
new file mode 100644
index 0000000000..8299910bdf
--- /dev/null
+++ b/patches.kernel.org/5.1.3-030-tuntap-synchronize-through-tfiles-array-instead.patch
@@ -0,0 +1,77 @@
+From: Jason Wang <jasowang@redhat.com>
+Date: Wed, 8 May 2019 23:20:18 -0400
+Subject: [PATCH] tuntap: synchronize through tfiles array instead of
+ tun->numqueues
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 9871a9e47a2646fe30ae7fd2e67668a8d30912f6
+
+[ Upstream commit 9871a9e47a2646fe30ae7fd2e67668a8d30912f6 ]
+
+When a queue(tfile) is detached through __tun_detach(), we move the
+last enabled tfile to the position where detached one sit but don't
+NULL out last position. We expect to synchronize the datapath through
+tun->numqueues. Unfortunately, this won't work since we're lacking
+sufficient mechanism to order or synchronize the access to
+tun->numqueues.
+
+To fix this, NULL out the last position during detaching and check
+RCU protected tfile against NULL instead of checking tun->numqueues in
+datapath.
+
+Cc: YueHaibing <yuehaibing@huawei.com>
+Cc: Cong Wang <xiyou.wangcong@gmail.com>
+Cc: weiyongjun (A) <weiyongjun1@huawei.com>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Fixes: c8d68e6be1c3b ("tuntap: multiqueue support")
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/tun.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index dc62fc3c5a95..f4c933ac6edf 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -705,6 +705,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
+ tun->tfiles[tun->numqueues - 1]);
+ ntfile = rtnl_dereference(tun->tfiles[index]);
+ ntfile->queue_index = index;
++ rcu_assign_pointer(tun->tfiles[tun->numqueues - 1],
++ NULL);
+
+ --tun->numqueues;
+ if (clean) {
+@@ -1087,7 +1089,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
+ tfile = rcu_dereference(tun->tfiles[txq]);
+
+ /* Drop packet if interface is not attached */
+- if (txq >= tun->numqueues)
++ if (!tfile)
+ goto drop;
+
+ if (!rcu_dereference(tun->steering_prog))
+@@ -1310,6 +1312,7 @@ static int tun_xdp_xmit(struct net_device *dev, int n,
+
+ rcu_read_lock();
+
++resample:
+ numqueues = READ_ONCE(tun->numqueues);
+ if (!numqueues) {
+ rcu_read_unlock();
+@@ -1318,6 +1321,8 @@ static int tun_xdp_xmit(struct net_device *dev, int n,
+
+ tfile = rcu_dereference(tun->tfiles[smp_processor_id() %
+ numqueues]);
++ if (unlikely(!tfile))
++ goto resample;
+
+ spin_lock(&tfile->tx_ring.producer_lock);
+ for (i = 0; i < n; i++) {
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-031-net-phy-fix-phy_validate_pause.patch b/patches.kernel.org/5.1.3-031-net-phy-fix-phy_validate_pause.patch
new file mode 100644
index 0000000000..112edd8002
--- /dev/null
+++ b/patches.kernel.org/5.1.3-031-net-phy-fix-phy_validate_pause.patch
@@ -0,0 +1,55 @@
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 1 May 2019 21:54:28 +0200
+Subject: [PATCH] net: phy: fix phy_validate_pause
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: b4010af981ac8cdf1f7f58eb6b131c482e5dee02
+
+[ Upstream commit b4010af981ac8cdf1f7f58eb6b131c482e5dee02 ]
+
+We have valid scenarios where ETHTOOL_LINK_MODE_Pause_BIT doesn't
+need to be supported. Therefore extend the first check to check
+for rx_pause being set.
+
+See also phy_set_asym_pause:
+rx=0 and tx=1: advertise asym pause only
+rx=0 and tx=0: stop advertising both pause modes
+
+The fixed commit isn't wrong, it's just the one that introduced the
+linkmode bitmaps.
+
+Fixes: 3c1bcc8614db ("net: ethernet: Convert phydev advertize and supported from u32 to link mode")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/phy/phy_device.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 77068c545de0..cd5966b0db57 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -2044,11 +2044,14 @@ bool phy_validate_pause(struct phy_device *phydev,
+ struct ethtool_pauseparam *pp)
+ {
+ if (!linkmode_test_bit(ETHTOOL_LINK_MODE_Pause_BIT,
+- phydev->supported) ||
+- (!linkmode_test_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
+- phydev->supported) &&
+- pp->rx_pause != pp->tx_pause))
++ phydev->supported) && pp->rx_pause)
+ return false;
++
++ if (!linkmode_test_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
++ phydev->supported) &&
++ pp->rx_pause != pp->tx_pause)
++ return false;
++
+ return true;
+ }
+ EXPORT_SYMBOL(phy_validate_pause);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-032-flow_dissector-disable-preemption-around-BPF-ca.patch b/patches.kernel.org/5.1.3-032-flow_dissector-disable-preemption-around-BPF-ca.patch
new file mode 100644
index 0000000000..82dc4455f4
--- /dev/null
+++ b/patches.kernel.org/5.1.3-032-flow_dissector-disable-preemption-around-BPF-ca.patch
@@ -0,0 +1,75 @@
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 13 May 2019 09:38:55 -0700
+Subject: [PATCH] flow_dissector: disable preemption around BPF calls
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: b1c17a9a353878602fd5bfe9103e4afe5e9a3f96
+
+[ Upstream commit b1c17a9a353878602fd5bfe9103e4afe5e9a3f96 ]
+
+Various things in eBPF really require us to disable preemption
+before running an eBPF program.
+
+syzbot reported :
+
+BUG: assuming atomic context at net/core/flow_dissector.c:737
+in_atomic(): 0, irqs_disabled(): 0, pid: 24710, name: syz-executor.3
+2 locks held by syz-executor.3/24710:
+ #0: 00000000e81a4bf1 (&tfile->napi_mutex){+.+.}, at: tun_get_user+0x168e/0x3ff0 drivers/net/tun.c:1850
+ #1: 00000000254afebd (rcu_read_lock){....}, at: __skb_flow_dissect+0x1e1/0x4bb0 net/core/flow_dissector.c:822
+CPU: 1 PID: 24710 Comm: syz-executor.3 Not tainted 5.1.0+ #6
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x172/0x1f0 lib/dump_stack.c:113
+ __cant_sleep kernel/sched/core.c:6165 [inline]
+ __cant_sleep.cold+0xa3/0xbb kernel/sched/core.c:6142
+ bpf_flow_dissect+0xfe/0x390 net/core/flow_dissector.c:737
+ __skb_flow_dissect+0x362/0x4bb0 net/core/flow_dissector.c:853
+ skb_flow_dissect_flow_keys_basic include/linux/skbuff.h:1322 [inline]
+ skb_probe_transport_header include/linux/skbuff.h:2500 [inline]
+ skb_probe_transport_header include/linux/skbuff.h:2493 [inline]
+ tun_get_user+0x2cfe/0x3ff0 drivers/net/tun.c:1940
+ tun_chr_write_iter+0xbd/0x156 drivers/net/tun.c:2037
+ call_write_iter include/linux/fs.h:1872 [inline]
+ do_iter_readv_writev+0x5fd/0x900 fs/read_write.c:693
+ do_iter_write fs/read_write.c:970 [inline]
+ do_iter_write+0x184/0x610 fs/read_write.c:951
+ vfs_writev+0x1b3/0x2f0 fs/read_write.c:1015
+ do_writev+0x15b/0x330 fs/read_write.c:1058
+ __do_sys_writev fs/read_write.c:1131 [inline]
+ __se_sys_writev fs/read_write.c:1128 [inline]
+ __x64_sys_writev+0x75/0xb0 fs/read_write.c:1128
+ do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Cc: Petar Penkov <ppenkov@google.com>
+Cc: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/core/flow_dissector.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index 94a450b2191a..139470d8d3c0 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -712,7 +712,10 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog,
+ flow_keys->thoff = flow_keys->nhoff;
+
+ bpf_compute_data_pointers((struct sk_buff *)skb);
++
++ preempt_disable();
+ result = BPF_PROG_RUN(prog, skb);
++ preempt_enable();
+
+ /* Restore state */
+ memcpy(cb, &cb_saved, sizeof(cb_saved));
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-033-isdn-bas_gigaset-use-usb_fill_int_urb-properly.patch b/patches.kernel.org/5.1.3-033-isdn-bas_gigaset-use-usb_fill_int_urb-properly.patch
new file mode 100644
index 0000000000..c48b1e7c7c
--- /dev/null
+++ b/patches.kernel.org/5.1.3-033-isdn-bas_gigaset-use-usb_fill_int_urb-properly.patch
@@ -0,0 +1,126 @@
+From: Paul Bolle <pebolle@tiscali.nl>
+Date: Wed, 1 May 2019 23:19:03 +0200
+Subject: [PATCH] isdn: bas_gigaset: use usb_fill_int_urb() properly
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 4014dfae3ccaaf3ec19c9ae0691a3f14e7132eae
+
+[ Upstream commit 4014dfae3ccaaf3ec19c9ae0691a3f14e7132eae ]
+
+The switch to make bas_gigaset use usb_fill_int_urb() - instead of
+filling that urb "by hand" - missed the subtle ordering of the previous
+code.
+
+See, before the switch urb->dev was set to a member somewhere deep in a
+complicated structure and then supplied to usb_rcvisocpipe() and
+usb_sndisocpipe(). After that switch urb->dev wasn't set to anything
+specific before being supplied to those two macros. This triggers a
+nasty oops:
+
+ BUG: unable to handle kernel NULL pointer dereference at 00000000
+ #PF error: [normal kernel read fault]
+ *pde = 00000000
+ Oops: 0000 [#1] SMP
+ CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.1.0-0.rc4.1.local0.fc28.i686 #1
+ Hardware name: IBM 2525FAG/2525FAG, BIOS 74ET64WW (2.09 ) 12/14/2006
+ EIP: gigaset_init_bchannel+0x89/0x320 [bas_gigaset]
+ Code: 75 07 83 8b 84 00 00 00 40 8d 47 74 c7 07 01 00 00 00 89 45 f0 8b 44 b7 68 85 c0 0f 84 6a 02 00 00 8b 48 28 8b 93 88 00 00 00 <8b> 09 8d 54 12 03 c1 e2 0f c1 e1 08 09 ca 8b 8b 8c 00 00 00 80 ca
+ EAX: f05ec200 EBX: ed404200 ECX: 00000000 EDX: 00000000
+ ESI: 00000000 EDI: f065a000 EBP: f30c9f40 ESP: f30c9f20
+ DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010086
+ CR0: 80050033 CR2: 00000000 CR3: 0ddc7000 CR4: 000006d0
+ Call Trace:
+ <SOFTIRQ>
+ ? gigaset_isdn_connD+0xf6/0x140 [gigaset]
+ gigaset_handle_event+0x173e/0x1b90 [gigaset]
+ tasklet_action_common.isra.16+0x4e/0xf0
+ tasklet_action+0x1e/0x20
+ __do_softirq+0xb2/0x293
+ ? __irqentry_text_end+0x3/0x3
+ call_on_stack+0x45/0x50
+ </SOFTIRQ>
+ ? irq_exit+0xb5/0xc0
+ ? do_IRQ+0x78/0xd0
+ ? acpi_idle_enter_s2idle+0x50/0x50
+ ? common_interrupt+0xd4/0xdc
+ ? acpi_idle_enter_s2idle+0x50/0x50
+ ? sched_cpu_activate+0x1b/0xf0
+ ? acpi_fan_resume.cold.7+0x9/0x18
+ ? cpuidle_enter_state+0x152/0x4c0
+ ? cpuidle_enter+0x14/0x20
+ ? call_cpuidle+0x21/0x40
+ ? do_idle+0x1c8/0x200
+ ? cpu_startup_entry+0x25/0x30
+ ? rest_init+0x88/0x8a
+ ? arch_call_rest_init+0xd/0x19
+ ? start_kernel+0x42f/0x448
+ ? i386_start_kernel+0xac/0xb0
+ ? startup_32_smp+0x164/0x168
+ Modules linked in: ppp_generic slhc capi bas_gigaset gigaset kernelcapi nf_conntrack_netbios_ns nf_conntrack_broadcast xt_CT ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_mangle iptable_raw iptable_security ebtable_filter ebtables ip6table_filter ip6_tables sunrpc ipw2200 iTCO_wdt gpio_ich snd_intel8x0 libipw iTCO_vendor_support snd_ac97_codec lib80211 ppdev ac97_bus snd_seq cfg80211 snd_seq_device pcspkr thinkpad_acpi lpc_ich snd_pcm i2c_i801 snd_timer ledtrig_audio snd soundcore rfkill parport_pc parport pcc_cpufreq acpi_cpufreq i915 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sdhci_pci sysimgblt cqhci fb_sys_fops drm sdhci mmc_core tg3 ata_generic serio_raw yenta_socket pata_acpi video
+ CR2: 0000000000000000
+ ---[ end trace 1fe07487b9200c73 ]---
+ EIP: gigaset_init_bchannel+0x89/0x320 [bas_gigaset]
+ Code: 75 07 83 8b 84 00 00 00 40 8d 47 74 c7 07 01 00 00 00 89 45 f0 8b 44 b7 68 85 c0 0f 84 6a 02 00 00 8b 48 28 8b 93 88 00 00 00 <8b> 09 8d 54 12 03 c1 e2 0f c1 e1 08 09 ca 8b 8b 8c 00 00 00 80 ca
+ EAX: f05ec200 EBX: ed404200 ECX: 00000000 EDX: 00000000
+ ESI: 00000000 EDI: f065a000 EBP: f30c9f40 ESP: cddcb3bc
+ DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010086
+ CR0: 80050033 CR2: 00000000 CR3: 0ddc7000 CR4: 000006d0
+ Kernel panic - not syncing: Fatal exception in interrupt
+ Kernel Offset: 0xcc00000 from 0xc0400000 (relocation range: 0xc0000000-0xf6ffdfff)
+ ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
+
+No-one noticed because this Oops is apparently only triggered by setting
+up an ISDN data connection on a live ISDN line on a gigaset base (ie,
+the PBX that the gigaset driver support). Very few people do that
+running present day kernels.
+
+Anyhow, a little code reorganization makes this problem go away, while
+avoiding the subtle ordering that was used in the past. So let's do
+that.
+
+Fixes: 78c696c19578 ("isdn: gigaset: use usb_fill_int_urb()")
+Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/isdn/gigaset/bas-gigaset.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
+index ecdeb89645d0..149b1aca52a2 100644
+--- a/drivers/isdn/gigaset/bas-gigaset.c
++++ b/drivers/isdn/gigaset/bas-gigaset.c
+@@ -958,6 +958,7 @@ static void write_iso_callback(struct urb *urb)
+ */
+ static int starturbs(struct bc_state *bcs)
+ {
++ struct usb_device *udev = bcs->cs->hw.bas->udev;
+ struct bas_bc_state *ubc = bcs->hw.bas;
+ struct urb *urb;
+ int j, k;
+@@ -975,8 +976,8 @@ static int starturbs(struct bc_state *bcs)
+ rc = -EFAULT;
+ goto error;
+ }
+- usb_fill_int_urb(urb, bcs->cs->hw.bas->udev,
+- usb_rcvisocpipe(urb->dev, 3 + 2 * bcs->channel),
++ usb_fill_int_urb(urb, udev,
++ usb_rcvisocpipe(udev, 3 + 2 * bcs->channel),
+ ubc->isoinbuf + k * BAS_INBUFSIZE,
+ BAS_INBUFSIZE, read_iso_callback, bcs,
+ BAS_FRAMETIME);
+@@ -1006,8 +1007,8 @@ static int starturbs(struct bc_state *bcs)
+ rc = -EFAULT;
+ goto error;
+ }
+- usb_fill_int_urb(urb, bcs->cs->hw.bas->udev,
+- usb_sndisocpipe(urb->dev, 4 + 2 * bcs->channel),
++ usb_fill_int_urb(urb, udev,
++ usb_sndisocpipe(udev, 4 + 2 * bcs->channel),
+ ubc->isooutbuf->data,
+ sizeof(ubc->isooutbuf->data),
+ write_iso_callback, &ubc->isoouturbs[k],
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-034-drivers-virt-fsl_hypervisor.c-dereferencing-err.patch b/patches.kernel.org/5.1.3-034-drivers-virt-fsl_hypervisor.c-dereferencing-err.patch
new file mode 100644
index 0000000000..926bc2ee74
--- /dev/null
+++ b/patches.kernel.org/5.1.3-034-drivers-virt-fsl_hypervisor.c-dereferencing-err.patch
@@ -0,0 +1,110 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 14 May 2019 15:47:00 -0700
+Subject: [PATCH] drivers/virt/fsl_hypervisor.c: dereferencing error pointers
+ in ioctl
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: c8ea3663f7a8e6996d44500ee818c9330ac4fd88
+
+commit c8ea3663f7a8e6996d44500ee818c9330ac4fd88 upstream.
+
+strndup_user() returns error pointers on error, and then in the error
+handling we pass the error pointers to kfree(). It will cause an Oops.
+
+Link: http://lkml.kernel.org/r/20181218082003.GD32567@kadam
+Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Timur Tabi <timur@freescale.com>
+Cc: Mihai Caraman <mihai.caraman@freescale.com>
+Cc: Kumar Gala <galak@kernel.crashing.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/virt/fsl_hypervisor.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
+index 8ba726e600e9..7b7f8e9a2801 100644
+--- a/drivers/virt/fsl_hypervisor.c
++++ b/drivers/virt/fsl_hypervisor.c
+@@ -331,8 +331,8 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set)
+ struct fsl_hv_ioctl_prop param;
+ char __user *upath, *upropname;
+ void __user *upropval;
+- char *path = NULL, *propname = NULL;
+- void *propval = NULL;
++ char *path, *propname;
++ void *propval;
+ int ret = 0;
+
+ /* Get the parameters from the user. */
+@@ -344,32 +344,30 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set)
+ upropval = (void __user *)(uintptr_t)param.propval;
+
+ path = strndup_user(upath, FH_DTPROP_MAX_PATHLEN);
+- if (IS_ERR(path)) {
+- ret = PTR_ERR(path);
+- goto out;
+- }
++ if (IS_ERR(path))
++ return PTR_ERR(path);
+
+ propname = strndup_user(upropname, FH_DTPROP_MAX_PATHLEN);
+ if (IS_ERR(propname)) {
+ ret = PTR_ERR(propname);
+- goto out;
++ goto err_free_path;
+ }
+
+ if (param.proplen > FH_DTPROP_MAX_PROPLEN) {
+ ret = -EINVAL;
+- goto out;
++ goto err_free_propname;
+ }
+
+ propval = kmalloc(param.proplen, GFP_KERNEL);
+ if (!propval) {
+ ret = -ENOMEM;
+- goto out;
++ goto err_free_propname;
+ }
+
+ if (set) {
+ if (copy_from_user(propval, upropval, param.proplen)) {
+ ret = -EFAULT;
+- goto out;
++ goto err_free_propval;
+ }
+
+ param.ret = fh_partition_set_dtprop(param.handle,
+@@ -388,7 +386,7 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set)
+ if (copy_to_user(upropval, propval, param.proplen) ||
+ put_user(param.proplen, &p->proplen)) {
+ ret = -EFAULT;
+- goto out;
++ goto err_free_propval;
+ }
+ }
+ }
+@@ -396,10 +394,12 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set)
+ if (put_user(param.ret, &p->ret))
+ ret = -EFAULT;
+
+-out:
+- kfree(path);
++err_free_propval:
+ kfree(propval);
++err_free_propname:
+ kfree(propname);
++err_free_path:
++ kfree(path);
+
+ return ret;
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-035-drivers-virt-fsl_hypervisor.c-prevent-integer-o.patch b/patches.kernel.org/5.1.3-035-drivers-virt-fsl_hypervisor.c-prevent-integer-o.patch
new file mode 100644
index 0000000000..381a88aa12
--- /dev/null
+++ b/patches.kernel.org/5.1.3-035-drivers-virt-fsl_hypervisor.c-prevent-integer-o.patch
@@ -0,0 +1,52 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 14 May 2019 15:47:03 -0700
+Subject: [PATCH] drivers/virt/fsl_hypervisor.c: prevent integer overflow in
+ ioctl
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 6a024330650e24556b8a18cc654ad00cfecf6c6c
+
+commit 6a024330650e24556b8a18cc654ad00cfecf6c6c upstream.
+
+The "param.count" value is a u64 thatcomes from the user. The code
+later in the function assumes that param.count is at least one and if
+it's not then it leads to an Oops when we dereference the ZERO_SIZE_PTR.
+
+Also the addition can have an integer overflow which would lead us to
+allocate a smaller "pages" array than required. I can't immediately
+tell what the possible run times implications are, but it's safest to
+prevent the overflow.
+
+Link: http://lkml.kernel.org/r/20181218082129.GE32567@kadam
+Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Timur Tabi <timur@freescale.com>
+Cc: Mihai Caraman <mihai.caraman@freescale.com>
+Cc: Kumar Gala <galak@kernel.crashing.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/virt/fsl_hypervisor.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
+index 7b7f8e9a2801..1bbd910d4ddb 100644
+--- a/drivers/virt/fsl_hypervisor.c
++++ b/drivers/virt/fsl_hypervisor.c
+@@ -215,6 +215,9 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
+ * hypervisor.
+ */
+ lb_offset = param.local_vaddr & (PAGE_SIZE - 1);
++ if (param.count == 0 ||
++ param.count > U64_MAX - lb_offset - PAGE_SIZE + 1)
++ return -EINVAL;
+ num_pages = (param.count + lb_offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+ /* Allocate the buffers we need */
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-036-powerpc-book3s-64-check-for-NULL-pointer-in-pgd.patch b/patches.kernel.org/5.1.3-036-powerpc-book3s-64-check-for-NULL-pointer-in-pgd.patch
new file mode 100644
index 0000000000..a991270ef5
--- /dev/null
+++ b/patches.kernel.org/5.1.3-036-powerpc-book3s-64-check-for-NULL-pointer-in-pgd.patch
@@ -0,0 +1,63 @@
+From: Rick Lindsley <ricklind@linux.vnet.ibm.com>
+Date: Sun, 5 May 2019 17:20:43 -0700
+Subject: [PATCH] powerpc/book3s/64: check for NULL pointer in pgd_alloc()
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: f39356261c265a0689d7ee568132d516e8b6cecc
+
+commit f39356261c265a0689d7ee568132d516e8b6cecc upstream.
+
+When the memset code was added to pgd_alloc(), it failed to consider
+that kmem_cache_alloc() can return NULL. It's uncommon, but not
+impossible under heavy memory contention. Example oops:
+
+ Unable to handle kernel paging request for data at address 0x00000000
+ Faulting instruction address: 0xc0000000000a4000
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ LE SMP NR_CPUS=2048 NUMA pSeries
+ CPU: 70 PID: 48471 Comm: entrypoint.sh Kdump: loaded Not tainted 4.14.0-115.6.1.el7a.ppc64le #1
+ task: c000000334a00000 task.stack: c000000331c00000
+ NIP: c0000000000a4000 LR: c00000000012f43c CTR: 0000000000000020
+ REGS: c000000331c039c0 TRAP: 0300 Not tainted (4.14.0-115.6.1.el7a.ppc64le)
+ MSR: 800000010280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE,TM[E]> CR: 44022840 XER: 20040000
+ CFAR: c000000000008874 DAR: 0000000000000000 DSISR: 42000000 SOFTE: 1
+ ...
+ NIP [c0000000000a4000] memset+0x68/0x104
+ LR [c00000000012f43c] mm_init+0x27c/0x2f0
+ Call Trace:
+ mm_init+0x260/0x2f0 (unreliable)
+ copy_mm+0x11c/0x638
+ copy_process.isra.28.part.29+0x6fc/0x1080
+ _do_fork+0xdc/0x4c0
+ ppc_clone+0x8/0xc
+ Instruction dump:
+ 409e000c b0860000 38c60002 409d000c 90860000 38c60004 78a0d183 78a506a0
+ 7c0903a6 41820034 60000000 60420000 <f8860000> f8860008 f8860010 f8860018
+
+Fixes: fc5c2f4a55a2 ("powerpc/mm/hash64: Zero PGD pages on allocation")
+Cc: stable@vger.kernel.org # v4.16+
+Signed-off-by: Rick Lindsley <ricklind@vnet.linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/powerpc/include/asm/book3s/64/pgalloc.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h
+index 138bc2ecc0c4..ba188797d940 100644
+--- a/arch/powerpc/include/asm/book3s/64/pgalloc.h
++++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h
+@@ -81,6 +81,9 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+
+ pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+ pgtable_gfp_flags(mm, GFP_KERNEL));
++ if (unlikely(!pgd))
++ return pgd;
++
+ /*
+ * Don't scan the PGD for pointers, it contains references to PUDs but
+ * those references are not full pointers and so can't be recognised by
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-037-powerpc-powernv-idle-Restore-IAMR-after-idle.patch b/patches.kernel.org/5.1.3-037-powerpc-powernv-idle-Restore-IAMR-after-idle.patch
new file mode 100644
index 0000000000..3d6c8e0fa7
--- /dev/null
+++ b/patches.kernel.org/5.1.3-037-powerpc-powernv-idle-Restore-IAMR-after-idle.patch
@@ -0,0 +1,84 @@
+From: Russell Currey <ruscur@russell.cc>
+Date: Thu, 18 Apr 2019 16:51:16 +1000
+Subject: [PATCH] powerpc/powernv/idle: Restore IAMR after idle
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: a3f3072db6cad40895c585dce65e36aab997f042
+
+commit a3f3072db6cad40895c585dce65e36aab997f042 upstream.
+
+Without restoring the IAMR after idle, execution prevention on POWER9
+with Radix MMU is overwritten and the kernel can freely execute
+userspace without faulting.
+
+This is necessary when returning from any stop state that modifies
+user state, as well as hypervisor state.
+
+To test how this fails without this patch, load the lkdtm driver and
+do the following:
+
+ $ echo EXEC_USERSPACE > /sys/kernel/debug/provoke-crash/DIRECT
+
+which won't fault, then boot the kernel with powersave=off, where it
+will fault. Applying this patch will fix this.
+
+Fixes: 3b10d0095a1e ("powerpc/mm/radix: Prevent kernel execution of user space")
+Cc: stable@vger.kernel.org # v4.10+
+Signed-off-by: Russell Currey <ruscur@russell.cc>
+Reviewed-by: Akshay Adiga <akshay.adiga@linux.vnet.ibm.com>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/powerpc/kernel/idle_book3s.S | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
+index 7f5ac2e8581b..36178000a2f2 100644
+--- a/arch/powerpc/kernel/idle_book3s.S
++++ b/arch/powerpc/kernel/idle_book3s.S
+@@ -170,6 +170,9 @@ core_idle_lock_held:
+ bne- core_idle_lock_held
+ blr
+
++/* Reuse an unused pt_regs slot for IAMR */
++#define PNV_POWERSAVE_IAMR _DAR
++
+ /*
+ * Pass requested state in r3:
+ * r3 - PNV_THREAD_NAP/SLEEP/WINKLE in POWER8
+@@ -200,6 +203,12 @@ pnv_powersave_common:
+ /* Continue saving state */
+ SAVE_GPR(2, r1)
+ SAVE_NVGPRS(r1)
++
++BEGIN_FTR_SECTION
++ mfspr r5, SPRN_IAMR
++ std r5, PNV_POWERSAVE_IAMR(r1)
++END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
++
+ mfcr r5
+ std r5,_CCR(r1)
+ std r1,PACAR1(r13)
+@@ -924,6 +933,17 @@ BEGIN_FTR_SECTION
+ END_FTR_SECTION_IFSET(CPU_FTR_HVMODE)
+ REST_NVGPRS(r1)
+ REST_GPR(2, r1)
++
++BEGIN_FTR_SECTION
++ /* IAMR was saved in pnv_powersave_common() */
++ ld r5, PNV_POWERSAVE_IAMR(r1)
++ mtspr SPRN_IAMR, r5
++ /*
++ * We don't need an isync here because the upcoming mtmsrd is
++ * execution synchronizing.
++ */
++END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
++
+ ld r4,PACAKMSR(r13)
+ ld r5,_LINK(r1)
+ ld r6,_CCR(r1)
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-038-powerpc-booke64-set-RI-in-default-MSR.patch b/patches.kernel.org/5.1.3-038-powerpc-booke64-set-RI-in-default-MSR.patch
new file mode 100644
index 0000000000..3f18598232
--- /dev/null
+++ b/patches.kernel.org/5.1.3-038-powerpc-booke64-set-RI-in-default-MSR.patch
@@ -0,0 +1,39 @@
+From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Date: Mon, 15 Apr 2019 14:52:11 +0300
+Subject: [PATCH] powerpc/booke64: set RI in default MSR
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 5266e58d6cd90ac85c187d673093ad9cb649e16d
+
+commit 5266e58d6cd90ac85c187d673093ad9cb649e16d upstream.
+
+Set RI in the default kernel's MSR so that the architected way of
+detecting unrecoverable machine check interrupts has a chance to work.
+This is inline with the MSR setup of the rest of booke powerpc
+architectures configured here.
+
+Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/powerpc/include/asm/reg_booke.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/include/asm/reg_booke.h b/arch/powerpc/include/asm/reg_booke.h
+index eb2a33d5df26..e382bd6ede84 100644
+--- a/arch/powerpc/include/asm/reg_booke.h
++++ b/arch/powerpc/include/asm/reg_booke.h
+@@ -41,7 +41,7 @@
+ #if defined(CONFIG_PPC_BOOK3E_64)
+ #define MSR_64BIT MSR_CM
+
+-#define MSR_ (MSR_ME | MSR_CE)
++#define MSR_ (MSR_ME | MSR_RI | MSR_CE)
+ #define MSR_KERNEL (MSR_ | MSR_64BIT)
+ #define MSR_USER32 (MSR_ | MSR_PR | MSR_EE)
+ #define MSR_USER64 (MSR_USER32 | MSR_64BIT)
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-039-virtio_ring-Fix-potential-mem-leak-in-virtqueue.patch b/patches.kernel.org/5.1.3-039-virtio_ring-Fix-potential-mem-leak-in-virtqueue.patch
new file mode 100644
index 0000000000..a6645bb617
--- /dev/null
+++ b/patches.kernel.org/5.1.3-039-virtio_ring-Fix-potential-mem-leak-in-virtqueue.patch
@@ -0,0 +1,38 @@
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 12 Mar 2019 15:06:53 +0800
+Subject: [PATCH] virtio_ring: Fix potential mem leak in
+ virtqueue_add_indirect_packed
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: df0bfe7501e9319546ea380d39674a4179e059c3
+
+commit df0bfe7501e9319546ea380d39674a4179e059c3 upstream.
+
+'desc' should be freed before leaving from err handing path.
+
+Fixes: 1ce9e6055fa0 ("virtio_ring: introduce packed ring support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/virtio/virtio_ring.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 5df92c308286..021010424fa5 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -1004,6 +1004,7 @@ static int virtqueue_add_indirect_packed(struct vring_virtqueue *vq,
+
+ if (unlikely(vq->vq.num_free < 1)) {
+ pr_debug("Can't add buf len 1 - avail = 0\n");
++ kfree(desc);
+ END_USE(vq);
+ return -ENOSPC;
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-040-PCI-hv-Fix-a-memory-leak-in-hv_eject_device_wor.patch b/patches.kernel.org/5.1.3-040-PCI-hv-Fix-a-memory-leak-in-hv_eject_device_wor.patch
new file mode 100644
index 0000000000..6e0575cc24
--- /dev/null
+++ b/patches.kernel.org/5.1.3-040-PCI-hv-Fix-a-memory-leak-in-hv_eject_device_wor.patch
@@ -0,0 +1,56 @@
+From: Dexuan Cui <decui@microsoft.com>
+Date: Mon, 4 Mar 2019 21:34:48 +0000
+Subject: [PATCH] PCI: hv: Fix a memory leak in hv_eject_device_work()
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 05f151a73ec2b23ffbff706e5203e729a995cdc2
+
+commit 05f151a73ec2b23ffbff706e5203e729a995cdc2 upstream.
+
+When a device is created in new_pcichild_device(), hpdev->refs is set
+to 2 (i.e. the initial value of 1 plus the get_pcichild()).
+
+When we hot remove the device from the host, in a Linux VM we first call
+hv_pci_eject_device(), which increases hpdev->refs by get_pcichild() and
+then schedules a work of hv_eject_device_work(), so hpdev->refs becomes
+3 (let's ignore the paired get/put_pcichild() in other places). But in
+hv_eject_device_work(), currently we only call put_pcichild() twice,
+meaning the 'hpdev' struct can't be freed in put_pcichild().
+
+Add one put_pcichild() to fix the memory leak.
+
+The device can also be removed when we run "rmmod pci-hyperv". On this
+path (hv_pci_remove() -> hv_pci_bus_exit() -> hv_pci_devices_present()),
+hpdev->refs is 2, and we do correctly call put_pcichild() twice in
+pci_devices_present_work().
+
+Fixes: 4daace0d8ce8 ("PCI: hv: Add paravirtual PCI front-end for Microsoft Hyper-V VMs")
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+[lorenzo.pieralisi@arm.com: commit log rework]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pci/controller/pci-hyperv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
+index 95441a35eceb..30f16b882746 100644
+--- a/drivers/pci/controller/pci-hyperv.c
++++ b/drivers/pci/controller/pci-hyperv.c
+@@ -1900,6 +1900,9 @@ static void hv_eject_device_work(struct work_struct *work)
+ sizeof(*ejct_pkt), (unsigned long)&ctxt.pkt,
+ VM_PKT_DATA_INBAND, 0);
+
++ /* For the get_pcichild() in hv_pci_eject_device() */
++ put_pcichild(hpdev);
++ /* For the two refs got in new_pcichild_device() */
+ put_pcichild(hpdev);
+ put_pcichild(hpdev);
+ put_hvpcibus(hpdev->hbus);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-041-PCI-hv-Add-hv_pci_remove_slots-when-we-unload-t.patch b/patches.kernel.org/5.1.3-041-PCI-hv-Add-hv_pci_remove_slots-when-we-unload-t.patch
new file mode 100644
index 0000000000..0aea3ff177
--- /dev/null
+++ b/patches.kernel.org/5.1.3-041-PCI-hv-Add-hv_pci_remove_slots-when-we-unload-t.patch
@@ -0,0 +1,83 @@
+From: Dexuan Cui <decui@microsoft.com>
+Date: Mon, 4 Mar 2019 21:34:48 +0000
+Subject: [PATCH] PCI: hv: Add hv_pci_remove_slots() when we unload the driver
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 15becc2b56c6eda3d9bf5ae993bafd5661c1fad1
+
+commit 15becc2b56c6eda3d9bf5ae993bafd5661c1fad1 upstream.
+
+When we unload the pci-hyperv host controller driver, the host does not
+send us a PCI_EJECT message.
+
+In this case we also need to make sure the sysfs PCI slot directory is
+removed, otherwise a command on a slot file eg:
+
+"cat /sys/bus/pci/slots/2/address"
+
+will trigger a
+
+"BUG: unable to handle kernel paging request"
+
+and, if we unload/reload the driver several times we would end up with
+stale slot entries in PCI slot directories in /sys/bus/pci/slots/
+
+root@localhost:~# ls -rtl /sys/bus/pci/slots/
+total 0
+drwxr-xr-x 2 root root 0 Feb 7 10:49 2
+drwxr-xr-x 2 root root 0 Feb 7 10:49 2-1
+drwxr-xr-x 2 root root 0 Feb 7 10:51 2-2
+
+Add the missing code to remove the PCI slot and fix the current
+behaviour.
+
+Fixes: a15f2c08c708 ("PCI: hv: support reporting serial number as slot information")
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+[lorenzo.pieralisi@arm.com: reformatted the log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Stephen Hemminger <sthemmin@microsoft.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pci/controller/pci-hyperv.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
+index 30f16b882746..b489412e3502 100644
+--- a/drivers/pci/controller/pci-hyperv.c
++++ b/drivers/pci/controller/pci-hyperv.c
+@@ -1486,6 +1486,21 @@ static void hv_pci_assign_slots(struct hv_pcibus_device *hbus)
+ }
+ }
+
++/*
++ * Remove entries in sysfs pci slot directory.
++ */
++static void hv_pci_remove_slots(struct hv_pcibus_device *hbus)
++{
++ struct hv_pci_dev *hpdev;
++
++ list_for_each_entry(hpdev, &hbus->children, list_entry) {
++ if (!hpdev->pci_slot)
++ continue;
++ pci_destroy_slot(hpdev->pci_slot);
++ hpdev->pci_slot = NULL;
++ }
++}
++
+ /**
+ * create_root_hv_pci_bus() - Expose a new root PCI bus
+ * @hbus: Root PCI bus, as understood by this driver
+@@ -2680,6 +2695,7 @@ static int hv_pci_remove(struct hv_device *hdev)
+ pci_lock_rescan_remove();
+ pci_stop_root_bus(hbus->pci_bus);
+ pci_remove_root_bus(hbus->pci_bus);
++ hv_pci_remove_slots(hbus);
+ pci_unlock_rescan_remove();
+ hbus->state = hv_pcibus_removed;
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-042-PCI-hv-Add-pci_destroy_slot-in-pci_devices_pres.patch b/patches.kernel.org/5.1.3-042-PCI-hv-Add-pci_destroy_slot-in-pci_devices_pres.patch
new file mode 100644
index 0000000000..4a32eecff1
--- /dev/null
+++ b/patches.kernel.org/5.1.3-042-PCI-hv-Add-pci_destroy_slot-in-pci_devices_pres.patch
@@ -0,0 +1,97 @@
+From: Dexuan Cui <decui@microsoft.com>
+Date: Mon, 4 Mar 2019 21:34:49 +0000
+Subject: [PATCH] PCI: hv: Add pci_destroy_slot() in
+ pci_devices_present_work(), if necessary
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 340d455699400f2c2c0f9b3f703ade3085cdb501
+
+commit 340d455699400f2c2c0f9b3f703ade3085cdb501 upstream.
+
+When we hot-remove a device, usually the host sends us a PCI_EJECT message,
+and a PCI_BUS_RELATIONS message with bus_rel->device_count == 0.
+
+When we execute the quick hot-add/hot-remove test, the host may not send
+us the PCI_EJECT message if the guest has not fully finished the
+initialization by sending the PCI_RESOURCES_ASSIGNED* message to the
+host, so it's potentially unsafe to only depend on the
+pci_destroy_slot() in hv_eject_device_work() because the code path
+
+create_root_hv_pci_bus()
+ -> hv_pci_assign_slots()
+
+is not called in this case. Note: in this case, the host still sends the
+guest a PCI_BUS_RELATIONS message with bus_rel->device_count == 0.
+
+In the quick hot-add/hot-remove test, we can have such a race before
+the code path
+
+pci_devices_present_work()
+ -> new_pcichild_device()
+
+adds the new device into the hbus->children list, we may have already
+received the PCI_EJECT message, and since the tasklet handler
+
+hv_pci_onchannelcallback()
+
+may fail to find the "hpdev" by calling
+
+get_pcichild_wslot(hbus, dev_message->wslot.slot)
+
+hv_pci_eject_device() is not called; Later, by continuing execution
+
+create_root_hv_pci_bus()
+ -> hv_pci_assign_slots()
+
+creates the slot and the PCI_BUS_RELATIONS message with
+bus_rel->device_count == 0 removes the device from hbus->children, and
+we end up being unable to remove the slot in
+
+hv_pci_remove()
+ -> hv_pci_remove_slots()
+
+Remove the slot in pci_devices_present_work() when the device
+is removed to address this race.
+
+pci_devices_present_work() and hv_eject_device_work() run in the
+singled-threaded hbus->wq, so there is not a double-remove issue for the
+slot.
+
+We cannot offload hv_pci_eject_device() from hv_pci_onchannelcallback()
+to the workqueue, because we need the hv_pci_onchannelcallback()
+synchronously call hv_pci_eject_device() to poll the channel
+ringbuffer to work around the "hangs in hv_compose_msi_msg()" issue
+fixed in commit de0aa7b2f97d ("PCI: hv: Fix 2 hang issues in
+hv_compose_msi_msg()")
+
+Fixes: a15f2c08c708 ("PCI: hv: support reporting serial number as slot information")
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+[lorenzo.pieralisi@arm.com: rewritten commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pci/controller/pci-hyperv.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
+index b489412e3502..82acd6155adf 100644
+--- a/drivers/pci/controller/pci-hyperv.c
++++ b/drivers/pci/controller/pci-hyperv.c
+@@ -1776,6 +1776,10 @@ static void pci_devices_present_work(struct work_struct *work)
+ hpdev = list_first_entry(&removed, struct hv_pci_dev,
+ list_entry);
+ list_del(&hpdev->list_entry);
++
++ if (hpdev->pci_slot)
++ pci_destroy_slot(hpdev->pci_slot);
++
+ put_pcichild(hpdev);
+ }
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-043-f2fs-Fix-use-of-number-of-devices.patch b/patches.kernel.org/5.1.3-043-f2fs-Fix-use-of-number-of-devices.patch
new file mode 100644
index 0000000000..f5d1a51cd9
--- /dev/null
+++ b/patches.kernel.org/5.1.3-043-f2fs-Fix-use-of-number-of-devices.patch
@@ -0,0 +1,199 @@
+From: Damien Le Moal <damien.lemoal@wdc.com>
+Date: Sat, 16 Mar 2019 09:13:06 +0900
+Subject: [PATCH] f2fs: Fix use of number of devices
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 0916878da355650d7e77104a7ac0fa1784eca852
+
+commit 0916878da355650d7e77104a7ac0fa1784eca852 upstream.
+
+For a single device mount using a zoned block device, the zone
+information for the device is stored in the sbi->devs single entry
+array and sbi->s_ndevs is set to 1. This differs from a single device
+mount using a regular block device which does not allocate sbi->devs
+and sets sbi->s_ndevs to 0.
+
+However, sbi->s_devs == 0 condition is used throughout the code to
+differentiate a single device mount from a multi-device mount where
+sbi->s_ndevs is always larger than 1. This results in problems with
+single zoned block device volumes as these are treated as multi-device
+mounts but do not have the start_blk and end_blk information set. One
+of the problem observed is skipping of zone discard issuing resulting in
+write commands being issued to full zones or unaligned to a zone write
+pointer.
+
+Fix this problem by simply treating the cases sbi->s_ndevs == 0 (single
+regular block device mount) and sbi->s_ndevs == 1 (single zoned block
+device mount) in the same manner. This is done by introducing the
+helper function f2fs_is_multi_device() and using this helper in place
+of direct tests of sbi->s_ndevs value, improving code readability.
+
+Fixes: 7bb3a371d199 ("f2fs: Fix zoned block device support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/f2fs/data.c | 17 +++++++++++------
+ fs/f2fs/f2fs.h | 13 ++++++++++++-
+ fs/f2fs/file.c | 2 +-
+ fs/f2fs/gc.c | 2 +-
+ fs/f2fs/segment.c | 13 +++++++------
+ 5 files changed, 32 insertions(+), 15 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 9727944139f2..d87dfa5aa112 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -220,12 +220,14 @@ struct block_device *f2fs_target_device(struct f2fs_sb_info *sbi,
+ struct block_device *bdev = sbi->sb->s_bdev;
+ int i;
+
+- for (i = 0; i < sbi->s_ndevs; i++) {
+- if (FDEV(i).start_blk <= blk_addr &&
+- FDEV(i).end_blk >= blk_addr) {
+- blk_addr -= FDEV(i).start_blk;
+- bdev = FDEV(i).bdev;
+- break;
++ if (f2fs_is_multi_device(sbi)) {
++ for (i = 0; i < sbi->s_ndevs; i++) {
++ if (FDEV(i).start_blk <= blk_addr &&
++ FDEV(i).end_blk >= blk_addr) {
++ blk_addr -= FDEV(i).start_blk;
++ bdev = FDEV(i).bdev;
++ break;
++ }
+ }
+ }
+ if (bio) {
+@@ -239,6 +241,9 @@ int f2fs_target_device_index(struct f2fs_sb_info *sbi, block_t blkaddr)
+ {
+ int i;
+
++ if (!f2fs_is_multi_device(sbi))
++ return 0;
++
+ for (i = 0; i < sbi->s_ndevs; i++)
+ if (FDEV(i).start_blk <= blkaddr && FDEV(i).end_blk >= blkaddr)
+ return i;
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 87f75ebd2fd6..7bea1bc6589f 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -1366,6 +1366,17 @@ static inline bool time_to_inject(struct f2fs_sb_info *sbi, int type)
+ }
+ #endif
+
++/*
++ * Test if the mounted volume is a multi-device volume.
++ * - For a single regular disk volume, sbi->s_ndevs is 0.
++ * - For a single zoned disk volume, sbi->s_ndevs is 1.
++ * - For a multi-device volume, sbi->s_ndevs is always 2 or more.
++ */
++static inline bool f2fs_is_multi_device(struct f2fs_sb_info *sbi)
++{
++ return sbi->s_ndevs > 1;
++}
++
+ /* For write statistics. Suppose sector size is 512 bytes,
+ * and the return value is in kbytes. s is of struct f2fs_sb_info.
+ */
+@@ -3615,7 +3626,7 @@ static inline bool f2fs_force_buffered_io(struct inode *inode,
+
+ if (f2fs_post_read_required(inode))
+ return true;
+- if (sbi->s_ndevs)
++ if (f2fs_is_multi_device(sbi))
+ return true;
+ /*
+ * for blkzoned device, fallback direct IO to buffered IO, so
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 5742ab8b57dc..30d49467578e 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2573,7 +2573,7 @@ static int f2fs_ioc_flush_device(struct file *filp, unsigned long arg)
+ sizeof(range)))
+ return -EFAULT;
+
+- if (sbi->s_ndevs <= 1 || sbi->s_ndevs - 1 <= range.dev_num ||
++ if (!f2fs_is_multi_device(sbi) || sbi->s_ndevs - 1 <= range.dev_num ||
+ __is_large_section(sbi)) {
+ f2fs_msg(sbi->sb, KERN_WARNING,
+ "Can't flush %u in %d for segs_per_sec %u != 1\n",
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 195cf0f9d9ef..ab764bd106de 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -1346,7 +1346,7 @@ void f2fs_build_gc_manager(struct f2fs_sb_info *sbi)
+ sbi->gc_pin_file_threshold = DEF_GC_FAILED_PINNED_FILES;
+
+ /* give warm/cold data area from slower device */
+- if (sbi->s_ndevs && !__is_large_section(sbi))
++ if (f2fs_is_multi_device(sbi) && !__is_large_section(sbi))
+ SIT_I(sbi)->last_victim[ALLOC_NEXT] =
+ GET_SEGNO(sbi, FDEV(0).end_blk) + 1;
+ }
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index aa7fe79b62b2..ddfa2eb7ec58 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -580,7 +580,7 @@ static int submit_flush_wait(struct f2fs_sb_info *sbi, nid_t ino)
+ int ret = 0;
+ int i;
+
+- if (!sbi->s_ndevs)
++ if (!f2fs_is_multi_device(sbi))
+ return __submit_flush_wait(sbi, sbi->sb->s_bdev);
+
+ for (i = 0; i < sbi->s_ndevs; i++) {
+@@ -648,7 +648,8 @@ int f2fs_issue_flush(struct f2fs_sb_info *sbi, nid_t ino)
+ return ret;
+ }
+
+- if (atomic_inc_return(&fcc->queued_flush) == 1 || sbi->s_ndevs > 1) {
++ if (atomic_inc_return(&fcc->queued_flush) == 1 ||
++ f2fs_is_multi_device(sbi)) {
+ ret = submit_flush_wait(sbi, ino);
+ atomic_dec(&fcc->queued_flush);
+
+@@ -754,7 +755,7 @@ int f2fs_flush_device_cache(struct f2fs_sb_info *sbi)
+ {
+ int ret = 0, i;
+
+- if (!sbi->s_ndevs)
++ if (!f2fs_is_multi_device(sbi))
+ return 0;
+
+ for (i = 1; i < sbi->s_ndevs; i++) {
+@@ -1369,7 +1370,7 @@ static int __queue_discard_cmd(struct f2fs_sb_info *sbi,
+
+ trace_f2fs_queue_discard(bdev, blkstart, blklen);
+
+- if (sbi->s_ndevs) {
++ if (f2fs_is_multi_device(sbi)) {
+ int devi = f2fs_target_device_index(sbi, blkstart);
+
+ blkstart -= FDEV(devi).start_blk;
+@@ -1732,7 +1733,7 @@ static int __f2fs_issue_discard_zone(struct f2fs_sb_info *sbi,
+ block_t lblkstart = blkstart;
+ int devi = 0;
+
+- if (sbi->s_ndevs) {
++ if (f2fs_is_multi_device(sbi)) {
+ devi = f2fs_target_device_index(sbi, blkstart);
+ blkstart -= FDEV(devi).start_blk;
+ }
+@@ -3089,7 +3090,7 @@ static void update_device_state(struct f2fs_io_info *fio)
+ struct f2fs_sb_info *sbi = fio->sbi;
+ unsigned int devidx;
+
+- if (!sbi->s_ndevs)
++ if (!f2fs_is_multi_device(sbi))
+ return;
+
+ devidx = f2fs_target_device_index(sbi, fio->new_blkaddr);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.3-044-Linux-5.1.3.patch b/patches.kernel.org/5.1.3-044-Linux-5.1.3.patch
new file mode 100644
index 0000000000..d2cef38f10
--- /dev/null
+++ b/patches.kernel.org/5.1.3-044-Linux-5.1.3.patch
@@ -0,0 +1,28 @@
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 16 May 2019 19:35:40 +0200
+Subject: [PATCH] Linux 5.1.3
+References: bnc#1012628
+Patch-mainline: 5.1.3
+Git-commit: 7cb9c5d341b95274b4f1fccfc5db122f945f6730
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 58ec07990e76..f6c763aff4f3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 1
+-SUBLEVEL = 2
++SUBLEVEL = 3
+ EXTRAVERSION =
+ NAME = Shy Crocodile
+
+--
+2.21.0
+
diff --git a/series.conf b/series.conf
index da22d8f502..c66a1ad6b3 100644
--- a/series.conf
+++ b/series.conf
@@ -86,6 +86,50 @@
patches.kernel.org/5.1.2-026-Documentation-Correct-the-possible-MDS-sysfs-va.patch
patches.kernel.org/5.1.2-027-x86-speculation-mds-Fix-documentation-typo.patch
patches.kernel.org/5.1.2-028-Linux-5.1.2.patch
+ patches.kernel.org/5.1.3-001-platform-x86-sony-laptop-Fix-unintentional-fall.patch
+ patches.kernel.org/5.1.3-002-platform-x86-thinkpad_acpi-Disable-Bluetooth-fo.patch
+ patches.kernel.org/5.1.3-003-platform-x86-dell-laptop-fix-rfkill-functionali.patch
+ patches.kernel.org/5.1.3-004-hwmon-pwm-fan-Disable-PWM-if-fetching-cooling-d.patch
+ patches.kernel.org/5.1.3-005-hwmon-occ-Fix-extended-status-bits.patch
+ patches.kernel.org/5.1.3-006-selftests-seccomp-Handle-namespace-failures-gra.patch
+ patches.kernel.org/5.1.3-007-i2c-core-ratelimit-transfer-when-suspended-erro.patch
+ patches.kernel.org/5.1.3-008-kernfs-fix-barrier-usage-in-__kernfs_new_node.patch
+ patches.kernel.org/5.1.3-009-virt-vbox-Sanity-check-parameter-types-for-hgcm.patch
+ patches.kernel.org/5.1.3-010-USB-serial-fix-unthrottle-races.patch
+ patches.kernel.org/5.1.3-011-mwl8k-Fix-rate_idx-underflow.patch
+ patches.kernel.org/5.1.3-012-rtlwifi-rtl8723ae-Fix-missing-break-in-switch-s.patch
+ patches.kernel.org/5.1.3-013-Don-t-jump-to-compute_result-state-from-check_r.patch
+ patches.kernel.org/5.1.3-014-bonding-fix-arp_validate-toggling-in-active-bac.patch
+ patches.kernel.org/5.1.3-015-bridge-Fix-error-path-for-kobject_init_and_add.patch
+ patches.kernel.org/5.1.3-016-dpaa_eth-fix-SG-frame-cleanup.patch
+ patches.kernel.org/5.1.3-017-fib_rules-return-0-directly-if-an-exactly-same-.patch
+ patches.kernel.org/5.1.3-018-ipv4-Fix-raw-socket-lookup-for-local-traffic.patch
+ patches.kernel.org/5.1.3-019-net-dsa-Fix-error-cleanup-path-in-dsa_init_modu.patch
+ patches.kernel.org/5.1.3-020-net-ethernet-stmmac-dwmac-sun8i-enable-support-.patch
+ patches.kernel.org/5.1.3-021-net-macb-Change-interrupt-and-napi-enable-order.patch
+ patches.kernel.org/5.1.3-022-net-seeq-fix-crash-caused-by-not-set-dev.parent.patch
+ patches.kernel.org/5.1.3-023-net-ucc_geth-fix-Oops-when-changing-number-of-b.patch
+ patches.kernel.org/5.1.3-024-packet-Fix-error-path-in-packet_init.patch
+ patches.kernel.org/5.1.3-025-selinux-do-not-report-error-on-connect-AF_UNSPE.patch
+ patches.kernel.org/5.1.3-026-tipc-fix-hanging-clients-using-poll-with-EPOLLO.patch
+ patches.kernel.org/5.1.3-027-vlan-disable-SIOCSHWTSTAMP-in-container.patch
+ patches.kernel.org/5.1.3-028-vrf-sit-mtu-should-not-be-updated-when-vrf-netd.patch
+ patches.kernel.org/5.1.3-029-tuntap-fix-dividing-by-zero-in-ebpf-queue-selec.patch
+ patches.kernel.org/5.1.3-030-tuntap-synchronize-through-tfiles-array-instead.patch
+ patches.kernel.org/5.1.3-031-net-phy-fix-phy_validate_pause.patch
+ patches.kernel.org/5.1.3-032-flow_dissector-disable-preemption-around-BPF-ca.patch
+ patches.kernel.org/5.1.3-033-isdn-bas_gigaset-use-usb_fill_int_urb-properly.patch
+ patches.kernel.org/5.1.3-034-drivers-virt-fsl_hypervisor.c-dereferencing-err.patch
+ patches.kernel.org/5.1.3-035-drivers-virt-fsl_hypervisor.c-prevent-integer-o.patch
+ patches.kernel.org/5.1.3-036-powerpc-book3s-64-check-for-NULL-pointer-in-pgd.patch
+ patches.kernel.org/5.1.3-037-powerpc-powernv-idle-Restore-IAMR-after-idle.patch
+ patches.kernel.org/5.1.3-038-powerpc-booke64-set-RI-in-default-MSR.patch
+ patches.kernel.org/5.1.3-039-virtio_ring-Fix-potential-mem-leak-in-virtqueue.patch
+ patches.kernel.org/5.1.3-040-PCI-hv-Fix-a-memory-leak-in-hv_eject_device_wor.patch
+ patches.kernel.org/5.1.3-041-PCI-hv-Add-hv_pci_remove_slots-when-we-unload-t.patch
+ patches.kernel.org/5.1.3-042-PCI-hv-Add-pci_destroy_slot-in-pci_devices_pres.patch
+ patches.kernel.org/5.1.3-043-f2fs-Fix-use-of-number-of-devices.patch
+ patches.kernel.org/5.1.3-044-Linux-5.1.3.patch
########################################################
# Build fixes that apply to the vanilla kernel too.