Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOlaf Hering <ohering@suse.de>2019-12-08 11:17:03 +0100
committerOlaf Hering <ohering@suse.de>2019-12-08 11:17:03 +0100
commit712844db2ba361b161bafb02d92e974d764c9b5e (patch)
tree297bd312480c6735d08f1895a447ce2719349742
parentf70e1bb518783466e0f4923ae86166a6e75c8662 (diff)
parent4c18f2b994bace213e64a2f71a58a75322d331ce (diff)
Merge remote-tracking branch 'kerncvs/SLE15-SP1' into SLE15-SP1-AZURErpm-4.12.14-8.22--sle15-sp1-updatesrpm-4.12.14-8.22
-rw-r--r--blacklist.conf6
-rw-r--r--patches.suse/0001-i2c-of-Try-to-find-an-I2C-adapter-matching-the-paren.patch64
-rw-r--r--patches.suse/0001-rt2800-remove-errornous-duplicate-condition.patch73
-rw-r--r--patches.suse/0002-drm-i915-Reacquire-priolist-cache-after-dropping-the.patch153
-rw-r--r--patches.suse/0004-drm-i915-Don-t-dereference-request-if-it-may-have-be.patch76
-rw-r--r--patches.suse/0005-drm-i915-Lock-the-engine-while-dumping-the-active-re.patch121
-rw-r--r--patches.suse/0006-drm-i915-Fix-and-improve-MCR-selection-logic.patch182
-rw-r--r--patches.suse/0007-drm-fix-module-name-in-edid_firmware-log-message.patch35
-rw-r--r--patches.suse/cgroup-writeback-don-t-switch-wbs-immediately-on-dea.patch62
-rw-r--r--patches.suse/ecryptfs_lookup_interpose-lower_dentry-d_inode-is-no.patch56
-rw-r--r--patches.suse/ecryptfs_lookup_interpose-lower_dentry-d_parent-is-n.patch64
-rw-r--r--patches.suse/edac-ghes-do-not-warn-when-incrementing-refcount-on-0.patch70
-rw-r--r--patches.suse/edac-ghes-fix-locking-and-memory-barrier-issues.patch234
-rw-r--r--patches.suse/ext4-fix-punch-hole-for-inline_data-file-systems.patch53
-rw-r--r--patches.suse/ext4-update-direct-I-O-read-lock-pattern-for-IOCB_NO.patch47
-rw-r--r--patches.suse/iomap-Fix-pipe-page-leakage-during-splicing.patch51
-rw-r--r--patches.suse/loop-fix-no-unmap-write-zeroes-request-behavior.patch83
-rw-r--r--patches.suse/media-dvb-usb-fix-use-after-free-in-dvb_usb_device_e.patch2
-rw-r--r--patches.suse/nbd-prevent-memory-leak.patch46
-rw-r--r--patches.suse/ocfs2-fix-panic-due-to-ocfs2_wq-is-null.patch84
-rw-r--r--patches.suse/ocfs2-fix-passing-zero-to-PTR_ERR-warning.patch48
-rw-r--r--patches.suse/ubifs-Correctly-initialize-c-min_log_bytes.patch55
-rw-r--r--patches.suse/ubifs-Limit-the-number-of-pages-in-shrink_liability.patch41
-rw-r--r--patches.suse/xfs-Sanity-check-flags-of-Q_XQUOTARM-call.patch40
-rw-r--r--series.conf22
25 files changed, 1767 insertions, 1 deletions
diff --git a/blacklist.conf b/blacklist.conf
index e7e83b9e60..9558d38613 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -1408,3 +1408,9 @@ bacb7e1855969bba78b32302453d2cc8ba0bc403 # we do not have 11fc7d5a0a2d
d1f0b5dce8fda09a7f5f04c1878f181d548e42f5 # requires updating firmware
1d200e9d6f635ae894993a7d0f1b9e0b6e522e3b # not really needed. No long BDI name in the kernel.
880a98c339961eaa074393e3a2117cbe9125b8bb # 32-bit fix
+ed7dc6777400937b4686e9ec1db1533ea4546864 # Duplicate of 7b1366b48c1f063c902f87a4bd6cdd0cbb86664e: drm/i915: Reacquire priolist cache after dropping the engine lock
+cfe7288c276e359eebf057699fe86c2f8af14224 # Duplicate of 982b1d002f16c2695871e005c4132060c836db56: drm/i915: Lock the engine while dumping the active request
+c4a52d669690423ee3c99d8eda1e69cd0821fcad # Not applicable: drm/nouveau: fix duplication of nv50_head_atom struct
+c70d868f272befca09081190ae477c51fcbee5dd # Comment fix
+8e88bfba77eec6231c6a72076c28bbb7634a0e8c # Comment fix
+6b2daec19094a90435abe67d16fb43b1a5527254 # 32-bit fix
diff --git a/patches.suse/0001-i2c-of-Try-to-find-an-I2C-adapter-matching-the-paren.patch b/patches.suse/0001-i2c-of-Try-to-find-an-I2C-adapter-matching-the-paren.patch
new file mode 100644
index 0000000000..0b7a89b692
--- /dev/null
+++ b/patches.suse/0001-i2c-of-Try-to-find-an-I2C-adapter-matching-the-paren.patch
@@ -0,0 +1,64 @@
+From e814e688413aabd7b0d75e2a8ed1caa472951dec Mon Sep 17 00:00:00 2001
+From: Thierry Reding <treding@nvidia.com>
+Date: Fri, 25 Jan 2019 14:11:42 +0100
+Subject: i2c: of: Try to find an I2C adapter matching the parent
+Git-commit: e814e688413aabd7b0d75e2a8ed1caa472951dec
+Patch-mainline: v5.1-rc1
+References: bsc#1129770
+
+If an I2C adapter doesn't match the provided device tree node, also try
+matching the parent's device tree node. This allows finding an adapter
+based on the device node of the parent device that was used to register
+it.
+
+This fixes a regression on Tegra124-based Chromebooks (Nyan) where the
+eDP controller registers an I2C adapter that is used to read to EDID.
+After commit 993a815dcbb2 ("dt-bindings: panel: Add missing .txt
+suffix") this stopped working because the I2C adapter could no longer
+be found. The approach in this patch fixes the regression without
+introducing the issues that the above commit solved.
+
+Fixes: 17ab7806de0c ("drm: don't link DP aux i2c adapter to the hardware device node")
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Tested-by: Tristan Bastian <tristan-c.bastian@gmx.de>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/i2c/i2c-core-of.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
+index 6cb7ad608bcd..0f01cdba9d2c 100644
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -121,6 +121,17 @@ static int of_dev_node_match(struct device *dev, void *data)
+ return dev->of_node == data;
+ }
+
++static int of_dev_or_parent_node_match(struct device *dev, void *data)
++{
++ if (dev->of_node == data)
++ return 1;
++
++ if (dev->parent)
++ return dev->parent->of_node == data;
++
++ return 0;
++}
++
+ /* must call put_device() when done with returned i2c_client device */
+ struct i2c_client *of_find_i2c_device_by_node(struct device_node *node)
+ {
+@@ -145,7 +156,8 @@ struct i2c_adapter *of_find_i2c_adapter_by_node(struct device_node *node)
+ struct device *dev;
+ struct i2c_adapter *adapter;
+
+- dev = bus_find_device(&i2c_bus_type, NULL, node, of_dev_node_match);
++ dev = bus_find_device(&i2c_bus_type, NULL, node,
++ of_dev_or_parent_node_match);
+ if (!dev)
+ return NULL;
+
+--
+2.23.0
+
diff --git a/patches.suse/0001-rt2800-remove-errornous-duplicate-condition.patch b/patches.suse/0001-rt2800-remove-errornous-duplicate-condition.patch
new file mode 100644
index 0000000000..e0988c54a2
--- /dev/null
+++ b/patches.suse/0001-rt2800-remove-errornous-duplicate-condition.patch
@@ -0,0 +1,73 @@
+From a1f7c2cabf701a17b1a05d6526bbdadc3d05e05c Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 2 Nov 2019 18:47:01 +0100
+Subject: [PATCH] rt2800: remove errornous duplicate condition
+Git-commit: a1f7c2cabf701a17b1a05d6526bbdadc3d05e05c
+Patch-mainline: v5.4
+References: git-fixes
+
+On 2019-10-28 06:07, wbob wrote:
+> Hello Roman,
+>
+> while reading around drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+> I stumbled on what I think is an edit of yours made in error in march
+> 2017:
+>
+> https://github.com/torvalds/linux/commit/41977e86#diff-dae5dc10da180f3b055809a48118e18aR5281
+>
+> RT6352 in line 5281 should not have been introduced as the "else if"
+> below line 5291 can then not take effect for a RT6352 device. Another
+> possibility is for line 5291 to be not for RT6352, but this seems
+> very unlikely. Are you able to clarify still after this substantial time?
+>
+> 5277: static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
+> ...
+> 5279: } else if (rt2x00_rt(rt2x00dev, RT5390) ||
+> 5280: rt2x00_rt(rt2x00dev, RT5392) ||
+> 5281: rt2x00_rt(rt2x00dev, RT6352)) {
+> ...
+> 5291: } else if (rt2x00_rt(rt2x00dev, RT6352)) {
+> ...
+
+Hence remove errornous line 5281 to make the driver actually
+execute the correct initialization routine for MT7620 chips.
+
+As it was requested by Stanislaw Gruszka remove setting values of
+MIMO_PS_CFG and TX_PIN_CFG. MIMO_PS_CFG is responsible for MIMO
+power-safe mode (which is disabled), hence we can drop setting it.
+TX_PIN_CFG is set correctly in other functions, and as setting this
+value breaks some devices, rather don't set it here during init, but
+only modify it later on.
+
+Fixes: 41977e86c984 ("rt2x00: add support for MT7620")
+Reported-by: wbob <wbob@jify.de>
+Reported-by: Roman Yeryomin <roman@advem.lv>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5297,8 +5297,7 @@ static int rt2800_init_registers(struct
+ 0x00000000);
+ }
+ } else if (rt2x00_rt(rt2x00dev, RT5390) ||
+- rt2x00_rt(rt2x00dev, RT5392) ||
+- rt2x00_rt(rt2x00dev, RT6352)) {
++ rt2x00_rt(rt2x00dev, RT5392)) {
+ rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
+ rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
+ rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
+@@ -5312,8 +5311,6 @@ static int rt2800_init_registers(struct
+ rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
+ rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000);
+ rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
+- rt2800_register_write(rt2x00dev, MIMO_PS_CFG, 0x00000002);
+- rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x00150F0F);
+ rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x06060606);
+ rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
+ rt2800_register_write(rt2x00dev, TX1_BB_GAIN_ATTEN, 0x0);
diff --git a/patches.suse/0002-drm-i915-Reacquire-priolist-cache-after-dropping-the.patch b/patches.suse/0002-drm-i915-Reacquire-priolist-cache-after-dropping-the.patch
new file mode 100644
index 0000000000..f0132fec5c
--- /dev/null
+++ b/patches.suse/0002-drm-i915-Reacquire-priolist-cache-after-dropping-the.patch
@@ -0,0 +1,153 @@
+From 7b1366b48c1f063c902f87a4bd6cdd0cbb86664e Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 11 Feb 2019 20:46:47 +0000
+Subject: drm/i915: Reacquire priolist cache after dropping the engine lock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 7b1366b48c1f063c902f87a4bd6cdd0cbb86664e
+Patch-mainline: v5.1-rc1
+References: bsc#1129770
+
+If we drop the engine lock, we may run execlists_dequeue which may free
+the priolist. Therefore if we ever drop the execution lock on the
+engine, we have to discard our cache and refetch the priolist to ensure
+we do not use a stale pointer.
+
+[ 506.418935] [IGT] gem_exec_whisper: starting subtest contexts-priority
+[ 593.240825] general protection fault: 0000 [#1] SMP
+[ 593.240863] CPU: 1 PID: 494 Comm: gem_exec_whispe Tainted: G U 5.0.0-rc6+ #100
+[ 593.240879] Hardware name: /NUC6CAYB, BIOS AYAPLCEL.86A.0029.2016.1124.1625 11/24/2016
+[ 593.240965] RIP: 0010:__i915_schedule+0x1fe/0x320 [i915]
+[ 593.240981] Code: 48 8b 0c 24 48 89 c3 49 8b 45 28 49 8b 75 20 4c 89 3c 24 48 89 46 08 48 89 30 48 8b 43 08 48 89 4b 08 49 89 5d 20 49 89 45 28 <48> 89 08 45 39 a7 b8 03 00 00 7d 44 45 89 a7 b8 03 00 00 49 8b 85
+[ 593.240999] RSP: 0018:ffffc90000057a60 EFLAGS: 00010046
+[ 593.241013] RAX: 6b6b6b6b6b6b6b6b RBX: ffff8882582d7870 RCX: ffff88826baba6f0
+[ 593.241026] RDX: 0000000000000000 RSI: ffff8882582d6e70 RDI: ffff888273482194
+[ 593.241049] RBP: ffffc90000057a68 R08: ffff8882582d7680 R09: ffff8882582d7840
+[ 593.241068] R10: 0000000000000000 R11: ffffea00095ebe08 R12: 0000000000000728
+[ 593.241105] R13: ffff88826baba6d0 R14: ffffc90000057a40 R15: ffff888273482158
+[ 593.241120] FS: 00007f4613fb3900(0000) GS:ffff888277a80000(0000) knlGS:0000000000000000
+[ 593.241133] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 593.241146] CR2: 00007f57d3c66a84 CR3: 000000026e2b6000 CR4: 00000000001406e0
+[ 593.241158] Call Trace:
+[ 593.241233] i915_schedule+0x1f/0x30 [i915]
+[ 593.241326] i915_request_add+0x1a9/0x290 [i915]
+[ 593.241393] i915_gem_do_execbuffer+0x45f/0x1150 [i915]
+[ 593.241411] ? init_object+0x49/0x80
+[ 593.241425] ? ___slab_alloc.constprop.91+0x4b8/0x4e0
+[ 593.241491] ? i915_gem_execbuffer2_ioctl+0x99/0x380 [i915]
+[ 593.241563] ? i915_gem_execbuffer_ioctl+0x270/0x270 [i915]
+[ 593.241629] i915_gem_execbuffer2_ioctl+0x1bb/0x380 [i915]
+[ 593.241705] ? i915_gem_execbuffer_ioctl+0x270/0x270 [i915]
+[ 593.241724] drm_ioctl_kernel+0x81/0xd0
+[ 593.241738] drm_ioctl+0x1a7/0x310
+[ 593.241803] ? i915_gem_execbuffer_ioctl+0x270/0x270 [i915]
+[ 593.241819] ? __update_load_avg_se+0x1c9/0x240
+[ 593.241834] ? pick_next_entity+0x7e/0x120
+[ 593.241851] do_vfs_ioctl+0x88/0x5d0
+[ 593.241880] ksys_ioctl+0x35/0x70
+[ 593.241894] __x64_sys_ioctl+0x11/0x20
+[ 593.241907] do_syscall_64+0x44/0xf0
+[ 593.241924] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 593.241940] RIP: 0033:0x7f4615ffe757
+[ 593.241952] Code: 00 00 90 48 8b 05 39 a7 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 09 a7 0c 00 f7 d8 64 89 01 48
+[ 593.241970] RSP: 002b:00007ffc1030ddf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+[ 593.241984] RAX: ffffffffffffffda RBX: 00007ffc10324420 RCX: 00007f4615ffe757
+[ 593.241997] RDX: 00007ffc1030e220 RSI: 0000000040406469 RDI: 0000000000000003
+[ 593.242010] RBP: 00007ffc1030e220 R08: 00007f46160c9208 R09: 00007f46160c9240
+[ 593.242022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000040406469
+[ 593.242038] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
+[ 593.242058] Modules linked in: i915 intel_gtt drm_kms_helper prime_numbers
+
+v2: Track the local engine cache and explicitly clear it when switching
+engine locks.
+
+Fixes: a02eb975be78 ("drm/i915/execlists: Cache the priolist when rescheduling")
+Testcase: igt/gem_exec_whisper/contexts-priority # rare!
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Michał Winiarski <michal.winiarski@intel.com>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190211204647.26723-1-chris@chris-wilson.co.uk
+(cherry picked from commit ed7dc6777400937b4686e9ec1db1533ea4546864)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/intel_lrc.c | 27 ++++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_lrc.c
++++ b/drivers/gpu/drm/i915/intel_lrc.c
+@@ -1148,8 +1148,14 @@ static struct i915_request *sched_to_req
+ return container_of(node, struct i915_request, sched);
+ }
+
++struct sched_cache {
++ struct i915_priolist *priolist;
++};
++
+ static struct intel_engine_cs *
+-sched_lock_engine(struct i915_sched_node *node, struct intel_engine_cs *locked)
++sched_lock_engine(struct i915_sched_node *node,
++ struct intel_engine_cs *locked,
++ struct sched_cache *cache)
+ {
+ struct intel_engine_cs *engine = sched_to_request(node)->engine;
+
+@@ -1157,6 +1163,7 @@ sched_lock_engine(struct i915_sched_node
+
+ if (engine != locked) {
+ spin_unlock(&locked->timeline.lock);
++ memset(cache, 0, sizeof(*cache));
+ spin_lock(&engine->timeline.lock);
+ }
+
+@@ -1166,11 +1173,11 @@ sched_lock_engine(struct i915_sched_node
+ static void execlists_schedule(struct i915_request *request,
+ const struct i915_sched_attr *attr)
+ {
+- struct i915_priolist *uninitialized_var(pl);
+- struct intel_engine_cs *engine, *last;
++ struct intel_engine_cs *engine;
+ struct i915_dependency *dep, *p;
+ struct i915_dependency stack;
+ const int prio = attr->priority;
++ struct sched_cache cache;
+ LIST_HEAD(dfs);
+
+ GEM_BUG_ON(prio == I915_PRIORITY_INVALID);
+@@ -1240,7 +1247,7 @@ static void execlists_schedule(struct i9
+ __list_del_entry(&stack.dfs_link);
+ }
+
+- last = NULL;
++ memset(&cache, 0, sizeof(cache));
+ engine = request->engine;
+ spin_lock_irq(&engine->timeline.lock);
+
+@@ -1250,19 +1257,17 @@ static void execlists_schedule(struct i9
+
+ INIT_LIST_HEAD(&dep->dfs_link);
+
+- engine = sched_lock_engine(node, engine);
++ engine = sched_lock_engine(node, engine, &cache);
+
+ if (prio <= node->attr.priority)
+ continue;
+
+ node->attr.priority = prio;
+ if (!list_empty(&node->link)) {
+- if (last != engine) {
+- pl = lookup_priolist(engine, prio);
+- last = engine;
+- }
+- GEM_BUG_ON(pl->priority != prio);
+- list_move_tail(&node->link, &pl->requests);
++ if (!cache.priolist)
++ cache.priolist =
++ lookup_priolist(engine, prio);
++ list_move_tail(&node->link, &cache.priolist->requests);
+ }
+
+ if (prio > engine->execlists.queue_priority &&
diff --git a/patches.suse/0004-drm-i915-Don-t-dereference-request-if-it-may-have-be.patch b/patches.suse/0004-drm-i915-Don-t-dereference-request-if-it-may-have-be.patch
new file mode 100644
index 0000000000..6d9dbfbe9c
--- /dev/null
+++ b/patches.suse/0004-drm-i915-Don-t-dereference-request-if-it-may-have-be.patch
@@ -0,0 +1,76 @@
+From eca153603f2f020e15d071918e0daf1d56c17d29 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 18 Jun 2019 17:19:51 +0100
+Subject: drm/i915: Don't dereference request if it may have been retired when
+ printing
+Git-commit: eca153603f2f020e15d071918e0daf1d56c17d29
+Patch-mainline: v5.3-rc1
+References: bsc#1142635
+
+This has caught me out on countless occasions, when we retrieve a pointer
+from the submission/execlists backend, it does not carry a reference to
+the context or ring. Those are only pinned while the request is active,
+so if we see the request is already completed, it may be in the process
+of being retired and those pointers defunct.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110938
+Fixes: 3a068721a973 ("drm/i915: Show ring->start for the ELSP context/request queue")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190618161951.28820-2-chris@chris-wilson.co.uk
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/intel_engine_cs.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_engine_cs.c
++++ b/drivers/gpu/drm/i915/intel_engine_cs.c
+@@ -1284,12 +1284,13 @@ static void hexdump(struct drm_printer *
+ }
+ }
+
+-static void intel_engine_print_registers(const struct intel_engine_cs *engine,
++static void intel_engine_print_registers(struct intel_engine_cs *engine,
+ struct drm_printer *m)
+ {
+ struct drm_i915_private *dev_priv = engine->i915;
+ const struct intel_engine_execlists * const execlists =
+ &engine->execlists;
++ unsigned long flags;
+ u64 addr;
+
+ if (engine->id == RCS && IS_GEN(dev_priv, 4, 7))
+@@ -1383,26 +1384,27 @@ static void intel_engine_print_registers
+ hws[idx * 2 + 1]);
+ }
+
+- rcu_read_lock();
++ spin_lock_irqsave(&engine->timeline.lock, flags);
+ for (idx = 0; idx < execlists_num_ports(execlists); idx++) {
+ struct i915_request *rq;
+ unsigned int count;
++ char hdr[80];
+
+ rq = port_unpack(&execlists->port[idx], &count);
+- if (rq) {
+- char hdr[80];
+-
++ if (!rq) {
++ drm_printf(m, "\t\tELSP[%d] idle\n", idx);
++ } else if (!i915_request_signaled(rq)) {
+ snprintf(hdr, sizeof(hdr),
+ "\t\tELSP[%d] count=%d, ring->start=%08x, rq: ",
+ idx, count,
+ i915_ggtt_offset(rq->ring->vma));
+ print_request(m, rq, hdr);
+ } else {
+- drm_printf(m, "\t\tELSP[%d] idle\n", idx);
++ print_request(m, rq, "\t\tELSP[%d] rq: ");
+ }
+ }
+ drm_printf(m, "\t\tHW active? 0x%x\n", execlists->active);
+- rcu_read_unlock();
++ spin_unlock_irqrestore(&engine->timeline.lock, flags);
+ } else if (INTEL_GEN(dev_priv) > 6) {
+ drm_printf(m, "\tPP_DIR_BASE: 0x%08x\n",
+ I915_READ(RING_PP_DIR_BASE(engine)));
diff --git a/patches.suse/0005-drm-i915-Lock-the-engine-while-dumping-the-active-re.patch b/patches.suse/0005-drm-i915-Lock-the-engine-while-dumping-the-active-re.patch
new file mode 100644
index 0000000000..c57894fea2
--- /dev/null
+++ b/patches.suse/0005-drm-i915-Lock-the-engine-while-dumping-the-active-re.patch
@@ -0,0 +1,121 @@
+From 982b1d002f16c2695871e005c4132060c836db56 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 15 Jul 2019 09:09:28 +0100
+Subject: drm/i915: Lock the engine while dumping the active request
+Git-commit: 982b1d002f16c2695871e005c4132060c836db56
+Patch-mainline: v5.3-rc3
+References: bsc#1142635
+
+We cannot let the request be retired and freed while we are trying to
+dump it during error capture. It is not sufficient just to grab a
+reference to the request, as during retirement we may free the ring
+which we are also dumping. So take the engine lock to prevent retiring
+and freeing of the request.
+
+Reported-by: Alex Shumsky <alexthreed@gmail.com>
+Fixes: 83c317832eb1 ("drm/i915: Dump the ringbuffer of the active request for debugging")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Alex Shumsky <alexthreed@gmail.com>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190715080946.15593-6-chris@chris-wilson.co.uk
+(cherry picked from commit cfe7288c276e359eebf057699fe86c2f8af14224)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/i915_gem.c | 4 +---
+ drivers/gpu/drm/i915/i915_gpu_error.c | 6 ++++--
+ drivers/gpu/drm/i915/intel_engine_cs.c | 6 ++----
+ 3 files changed, 7 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -3033,7 +3033,6 @@ struct i915_request *
+ i915_gem_find_active_request(struct intel_engine_cs *engine)
+ {
+ struct i915_request *request, *active = NULL;
+- unsigned long flags;
+
+ /*
+ * We are called by the error capture, reset and to dump engine
+@@ -3046,7 +3045,7 @@ i915_gem_find_active_request(struct inte
+ * At all other times, we must assume the GPU is still running, but
+ * we only care about the snapshot of this moment.
+ */
+- spin_lock_irqsave(&engine->timeline.lock, flags);
++ lockdep_assert_held(&engine->timeline.lock);
+ list_for_each_entry(request, &engine->timeline.requests, link) {
+ if (__i915_request_completed(request, request->global_seqno))
+ continue;
+@@ -3054,7 +3053,6 @@ i915_gem_find_active_request(struct inte
+ active = request;
+ break;
+ }
+- spin_unlock_irqrestore(&engine->timeline.lock, flags);
+
+ return active;
+ }
+--- a/drivers/gpu/drm/i915/i915_gpu_error.c
++++ b/drivers/gpu/drm/i915/i915_gpu_error.c
+@@ -1460,6 +1460,7 @@ static void gem_record_rings(struct i915
+ struct intel_engine_cs *engine = i915->engine[i];
+ struct drm_i915_error_engine *ee = &error->engine[i];
+ struct i915_request *request;
++ unsigned long flags;
+
+ ee->engine_id = -1;
+
+@@ -1472,10 +1473,11 @@ static void gem_record_rings(struct i915
+ error_record_engine_waiters(engine, ee);
+ error_record_engine_execlists(engine, ee);
+
++ spin_lock_irqsave(&engine->timeline.lock, flags);
+ request = i915_gem_find_active_request(engine);
+ if (request) {
+ struct i915_gem_context *ctx = request->gem_context;
+- struct intel_ring *ring;
++ struct intel_ring *ring = request->ring;
+
+ ee->vm = ctx->ppgtt ? &ctx->ppgtt->vm : &ggtt->vm;
+
+@@ -1505,7 +1507,6 @@ static void gem_record_rings(struct i915
+ ee->rq_post = request->postfix;
+ ee->rq_tail = request->tail;
+
+- ring = request->ring;
+ ee->cpu_ring_head = ring->head;
+ ee->cpu_ring_tail = ring->tail;
+ ee->ringbuffer =
+@@ -1513,6 +1514,7 @@ static void gem_record_rings(struct i915
+
+ engine_record_requests(engine, request, ee);
+ }
++ spin_unlock_irqrestore(&engine->timeline.lock, flags);
+
+ ee->hws_page =
+ i915_error_object_create(i915,
+--- a/drivers/gpu/drm/i915/intel_engine_cs.c
++++ b/drivers/gpu/drm/i915/intel_engine_cs.c
+@@ -1481,10 +1481,9 @@ void intel_engine_dump(struct intel_engi
+ i915_reset_engine_count(error, engine),
+ i915_reset_count(error));
+
+- rcu_read_lock();
+-
+ drm_printf(m, "\tRequests:\n");
+
++ spin_lock_irqsave(&engine->timeline.lock, flags);
+ rq = list_first_entry(&engine->timeline.requests,
+ struct i915_request, link);
+ if (&rq->link != &engine->timeline.requests)
+@@ -1512,8 +1511,7 @@ void intel_engine_dump(struct intel_engi
+
+ print_request_ring(m, rq);
+ }
+-
+- rcu_read_unlock();
++ spin_unlock_irqrestore(&engine->timeline.lock, flags);
+
+ if (intel_runtime_pm_get_if_in_use(engine->i915)) {
+ intel_engine_print_registers(engine, m);
diff --git a/patches.suse/0006-drm-i915-Fix-and-improve-MCR-selection-logic.patch b/patches.suse/0006-drm-i915-Fix-and-improve-MCR-selection-logic.patch
new file mode 100644
index 0000000000..e8dd79ac13
--- /dev/null
+++ b/patches.suse/0006-drm-i915-Fix-and-improve-MCR-selection-logic.patch
@@ -0,0 +1,182 @@
+From 6c2b0103ad92b4238c26b0b8f224f4581d98b2fe Mon Sep 17 00:00:00 2001
+From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Date: Wed, 17 Jul 2019 19:06:21 +0100
+Subject: drm/i915: Fix and improve MCR selection logic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 6c2b0103ad92b4238c26b0b8f224f4581d98b2fe
+Patch-mainline: v5.4-rc1
+References: bsc#1112178
+
+A couple issues were present in this code:
+
+1.
+fls() usage was incorrect causing off by one in subslice mask lookup,
+which in other words means subslice mask of all zeroes is always used
+(subslice mask of a slice which is not present, or even out of bounds
+array access), rendering the checks in wa_init_mcr either futile or
+random.
+
+2.
+Condition in WARN_ON was not correct. It is doing a bitwise and operation
+between a positive (present subslices) and negative mask (disabled L3
+banks).
+
+This means that with corrected fls() usage the assert would always
+incorrectly fail.
+
+We could fix this by inverting the fuse bits in the check, but instead do
+one better and improve the code so it not only asserts, but finds the
+first common index between the two masks and only warns if no such index
+can be found.
+
+v2:
+ * Simplify check for logic and redability.
+ * Improve commentary explaining what is really happening ie. what the
+ assert is really trying to check and why.
+
+v3:
+ * Find first common index instead of just asserting.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Fixes: fe864b76c2ab ("drm/i915: Implement WaProgramMgsrForL3BankSpecificMmioReads")
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> # v1
+Cc: Michał Winiarski <michal.winiarski@intel.com>
+Cc: Stuart Summers <stuart.summers@intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190717180624.20354-4-tvrtko.ursulin@linux.intel.com
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/i915_request.h | 6 ++
+ drivers/gpu/drm/i915/intel_workarounds.c | 89 +++++++++++++++++--------------
+ 2 files changed, 55 insertions(+), 40 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_request.h
++++ b/drivers/gpu/drm/i915/i915_request.h
+@@ -272,6 +272,12 @@ long i915_request_wait(struct i915_reque
+ #define I915_WAIT_ALL BIT(2) /* used by i915_gem_object_wait() */
+ #define I915_WAIT_FOR_IDLE_BOOST BIT(3)
+
++static inline bool i915_request_signaled(const struct i915_request *rq)
++{
++ /* The request may live longer than its HWSP, so check flags first! */
++ return test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &rq->fence.flags);
++}
++
+ static inline u32 intel_engine_get_seqno(struct intel_engine_cs *engine);
+
+ /**
+--- a/drivers/gpu/drm/i915/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/intel_workarounds.c
+@@ -764,7 +764,10 @@ static void wa_init_mcr(struct drm_i915_
+ {
+ const struct sseu_dev_info *sseu = &RUNTIME_INFO(dev_priv)->sseu;
+ struct i915_wa_list *wal = &dev_priv->gt_wa_list;
+- u32 mcr_slice_subslice_mask;
++ unsigned int slice, subslice;
++ u32 l3_en, mcr, mcr_mask;
++
++ GEM_BUG_ON(INTEL_GEN(dev_priv) < 10);
+
+ /*
+ * WaProgramMgsrForL3BankSpecificMmioReads: cnl,icl
+@@ -772,41 +775,7 @@ static void wa_init_mcr(struct drm_i915_
+ * the case, we might need to program MCR select to a valid L3Bank
+ * by default, to make sure we correctly read certain registers
+ * later on (in the range 0xB100 - 0xB3FF).
+- * This might be incompatible with
+- * WaProgramMgsrForCorrectSliceSpecificMmioReads.
+- * Fortunately, this should not happen in production hardware, so
+- * we only assert that this is the case (instead of implementing
+- * something more complex that requires checking the range of every
+- * MMIO read).
+- */
+- if (INTEL_GEN(dev_priv) >= 10 &&
+- is_power_of_2(sseu->slice_mask)) {
+- /*
+- * read FUSE3 for enabled L3 Bank IDs, if L3 Bank matches
+- * enabled subslice, no need to redirect MCR packet
+- */
+- u32 slice = fls(sseu->slice_mask);
+- u32 fuse3 = I915_READ(GEN10_MIRROR_FUSE3);
+- u8 ss_mask = sseu->subslice_mask[slice];
+-
+- u8 enabled_mask = (ss_mask | ss_mask >>
+- GEN10_L3BANK_PAIR_COUNT) & GEN10_L3BANK_MASK;
+- u8 disabled_mask = fuse3 & GEN10_L3BANK_MASK;
+-
+- /*
+- * Production silicon should have matched L3Bank and
+- * subslice enabled
+- */
+- WARN_ON((enabled_mask & disabled_mask) != enabled_mask);
+- }
+-
+- if (INTEL_GEN(dev_priv) >= 11)
+- mcr_slice_subslice_mask = GEN11_MCR_SLICE_MASK |
+- GEN11_MCR_SUBSLICE_MASK;
+- else
+- mcr_slice_subslice_mask = GEN8_MCR_SLICE_MASK |
+- GEN8_MCR_SUBSLICE_MASK;
+- /*
++ *
+ * WaProgramMgsrForCorrectSliceSpecificMmioReads:cnl,icl
+ * Before any MMIO read into slice/subslice specific registers, MCR
+ * packet control register needs to be programmed to point to any
+@@ -816,11 +785,51 @@ static void wa_init_mcr(struct drm_i915_
+ * are consistent across s/ss in almost all cases. In the rare
+ * occasions, such as INSTDONE, where this value is dependent
+ * on s/ss combo, the read should be done with read_subslice_reg.
++ *
++ * Since GEN8_MCR_SELECTOR contains dual-purpose bits which select both
++ * to which subslice, or to which L3 bank, the respective mmio reads
++ * will go, we have to find a common index which works for both
++ * accesses.
++ *
++ * Case where we cannot find a common index fortunately should not
++ * happen in production hardware, so we only emit a warning instead of
++ * implementing something more complex that requires checking the range
++ * of every MMIO read.
+ */
+- wa_write_masked_or(wal,
+- GEN8_MCR_SELECTOR,
+- mcr_slice_subslice_mask,
+- intel_calculate_mcr_s_ss_select(dev_priv));
++
++ if (INTEL_GEN(dev_priv) >= 10 && is_power_of_2(sseu->slice_mask)) {
++ u32 l3_fuse =
++ raw_reg_read(dev_priv->regs, GEN10_MIRROR_FUSE3) &
++ GEN10_L3BANK_MASK;
++
++ DRM_DEBUG_DRIVER("L3 fuse = %x\n", l3_fuse);
++ l3_en = ~(l3_fuse << GEN10_L3BANK_PAIR_COUNT | l3_fuse);
++ } else {
++ l3_en = ~0;
++ }
++
++ slice = fls(sseu->slice_mask) - 1;
++ GEM_BUG_ON(slice >= ARRAY_SIZE(sseu->subslice_mask));
++ subslice = fls(l3_en & sseu->subslice_mask[slice]);
++ if (!subslice) {
++ DRM_WARN("No common index found between subslice mask %x and L3 bank mask %x!\n",
++ sseu->subslice_mask[slice], l3_en);
++ subslice = fls(l3_en);
++ WARN_ON(!subslice);
++ }
++ subslice--;
++
++ if (INTEL_GEN(dev_priv) >= 11) {
++ mcr = GEN11_MCR_SLICE(slice) | GEN11_MCR_SUBSLICE(subslice);
++ mcr_mask = GEN11_MCR_SLICE_MASK | GEN11_MCR_SUBSLICE_MASK;
++ } else {
++ mcr = GEN8_MCR_SLICE(slice) | GEN8_MCR_SUBSLICE(subslice);
++ mcr_mask = GEN8_MCR_SLICE_MASK | GEN8_MCR_SUBSLICE_MASK;
++ }
++
++ DRM_DEBUG_DRIVER("MCR slice/subslice = %x\n", mcr);
++
++ wa_write_masked_or(wal, GEN8_MCR_SELECTOR, mcr_mask, mcr);
+ }
+
+ static void cnl_gt_workarounds_init(struct drm_i915_private *i915)
diff --git a/patches.suse/0007-drm-fix-module-name-in-edid_firmware-log-message.patch b/patches.suse/0007-drm-fix-module-name-in-edid_firmware-log-message.patch
new file mode 100644
index 0000000000..ecf9ecf5aa
--- /dev/null
+++ b/patches.suse/0007-drm-fix-module-name-in-edid_firmware-log-message.patch
@@ -0,0 +1,35 @@
+From ade925995b172f1d7410d1c665b2f47c5e99bef0 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Wed, 21 Aug 2019 12:43:12 +0300
+Subject: drm: fix module name in edid_firmware log message
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: ade925995b172f1d7410d1c665b2f47c5e99bef0
+Patch-mainline: v5.4-rc1
+References: bsc#1113956
+
+The module is drm_kms_helper, not drm_kms_firmware.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204549
+Reported-by: Göran Uddeborg <goeran@uddeborg.se>
+Fixes: ac6c35a4d8c7 ("drm: add backwards compatibility support for drm_kms_helper.edid_firmware")
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190821094312.5514-1-jani.nikula@intel.com
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/drm_kms_helper_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_kms_helper_common.c
++++ b/drivers/gpu/drm/drm_kms_helper_common.c
+@@ -39,7 +39,7 @@ MODULE_LICENSE("GPL and additional right
+ /* Backward compatibility for drm_kms_helper.edid_firmware */
+ static int edid_firmware_set(const char *val, const struct kernel_param *kp)
+ {
+- DRM_NOTE("drm_kms_firmware.edid_firmware is deprecated, please use drm.edid_firmware intead.\n");
++ DRM_NOTE("drm_kms_helper.edid_firmware is deprecated, please use drm.edid_firmware instead.\n");
+
+ return __drm_set_edid_firmware_path(val);
+ }
diff --git a/patches.suse/cgroup-writeback-don-t-switch-wbs-immediately-on-dea.patch b/patches.suse/cgroup-writeback-don-t-switch-wbs-immediately-on-dea.patch
new file mode 100644
index 0000000000..4547f5a005
--- /dev/null
+++ b/patches.suse/cgroup-writeback-don-t-switch-wbs-immediately-on-dea.patch
@@ -0,0 +1,62 @@
+From 65de03e251382306a4575b1779c57c87889eee49 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Fri, 8 Nov 2019 12:18:29 -0800
+Subject: [PATCH] cgroup,writeback: don't switch wbs immediately on dead wbs if
+ the memcg is dead
+Git-commit: 65de03e251382306a4575b1779c57c87889eee49
+Patch-mainline: v5.4-rc7
+References: bsc#1158645
+
+cgroup writeback tries to refresh the associated wb immediately if the
+current wb is dead. This is to avoid keeping issuing IOs on the stale
+wb after memcg - blkcg association has changed (ie. when blkcg got
+disabled / enabled higher up in the hierarchy).
+
+Unfortunately, the logic gets triggered spuriously on inodes which are
+associated with dead cgroups. When the logic is triggered on dead
+cgroups, the attempt fails only after doing quite a bit of work
+allocating and initializing a new wb.
+
+While c3aab9a0bd91 ("mm/filemap.c: don't initiate writeback if mapping
+has no dirty pages") alleviated the issue significantly as it now only
+triggers when the inode has dirty pages. However, the condition can
+still be triggered before the inode is switched to a different cgroup
+and the logic simply doesn't make sense.
+
+Skip the immediate switching if the associated memcg is dying.
+
+This is a simplified version of the following two patches:
+
+ * https://lore.kernel.org/linux-mm/20190513183053.GA73423@dennisz-mbp/
+ * http://lkml.kernel.org/r/156355839560.2063.5265687291430814589.stgit@buzz
+
+Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Fixes: e8a7abf5a5bd ("writeback: disassociate inodes from dying bdi_writebacks")
+Acked-by: Dennis Zhou <dennis@kernel.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/fs-writeback.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -552,10 +552,13 @@ void wbc_attach_and_unlock_inode(struct
+ spin_unlock(&inode->i_lock);
+
+ /*
+- * A dying wb indicates that the memcg-blkcg mapping has changed
+- * and a new wb is already serving the memcg. Switch immediately.
++ * A dying wb indicates that either the blkcg associated with the
++ * memcg changed or the associated memcg is dying. In the first
++ * case, a replacement wb should already be available and we should
++ * refresh the wb immediately. In the second case, trying to
++ * refresh will keep failing.
+ */
+- if (unlikely(wb_dying(wbc->wb)))
++ if (unlikely(wb_dying(wbc->wb) && !css_is_dying(wbc->wb->memcg_css)))
+ inode_switch_wbs(inode, wbc->wb_id);
+ }
+
diff --git a/patches.suse/ecryptfs_lookup_interpose-lower_dentry-d_inode-is-no.patch b/patches.suse/ecryptfs_lookup_interpose-lower_dentry-d_inode-is-no.patch
new file mode 100644
index 0000000000..980687dd99
--- /dev/null
+++ b/patches.suse/ecryptfs_lookup_interpose-lower_dentry-d_inode-is-no.patch
@@ -0,0 +1,56 @@
+From e72b9dd6a5f17d0fb51f16f8685f3004361e83d0 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Sun, 3 Nov 2019 13:45:04 -0500
+Subject: [PATCH] ecryptfs_lookup_interpose(): lower_dentry->d_inode is not
+ stable
+Git-commit: e72b9dd6a5f17d0fb51f16f8685f3004361e83d0
+Patch-mainline: v5.4-rc8
+References: bsc#1158646
+
+lower_dentry can't go from positive to negative (we have it pinned),
+but it *can* go from negative to positive. So fetching ->d_inode
+into a local variable, doing a blocking allocation, checking that
+now ->d_inode is non-NULL and feeding the value we'd fetched
+earlier to a function that won't accept NULL is not a good idea.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/ecryptfs/inode.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index a905d5f4f3b0..3c2298721359 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -319,7 +319,7 @@ static int ecryptfs_i_size_read(struct dentry *dentry, struct inode *inode)
+ static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,
+ struct dentry *lower_dentry)
+ {
+- struct inode *inode, *lower_inode = d_inode(lower_dentry);
++ struct inode *inode, *lower_inode;
+ struct ecryptfs_dentry_info *dentry_info;
+ struct vfsmount *lower_mnt;
+ int rc = 0;
+@@ -339,7 +339,15 @@ static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,
+ dentry_info->lower_path.mnt = lower_mnt;
+ dentry_info->lower_path.dentry = lower_dentry;
+
+- if (d_really_is_negative(lower_dentry)) {
++ /*
++ * negative dentry can go positive under us here - its parent is not
++ * locked. That's OK and that could happen just as we return from
++ * ecryptfs_lookup() anyway. Just need to be careful and fetch
++ * ->d_inode only once - it's not stable here.
++ */
++ lower_inode = READ_ONCE(lower_dentry->d_inode);
++
++ if (!lower_inode) {
+ /* We want to add because we couldn't find in lower */
+ d_add(dentry, NULL);
+ return NULL;
+--
+2.16.4
+
diff --git a/patches.suse/ecryptfs_lookup_interpose-lower_dentry-d_parent-is-n.patch b/patches.suse/ecryptfs_lookup_interpose-lower_dentry-d_parent-is-n.patch
new file mode 100644
index 0000000000..b204dd99fe
--- /dev/null
+++ b/patches.suse/ecryptfs_lookup_interpose-lower_dentry-d_parent-is-n.patch
@@ -0,0 +1,64 @@
+From 762c69685ff7ad5ad7fee0656671e20a0c9c864d Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Sun, 3 Nov 2019 13:55:43 -0500
+Subject: [PATCH] ecryptfs_lookup_interpose(): lower_dentry->d_parent is not
+ stable either
+Git-commit: 762c69685ff7ad5ad7fee0656671e20a0c9c864d
+Patch-mainline: v5.4-rc8
+References: bsc#1158647
+
+We need to get the underlying dentry of parent; sure, absent the races
+it is the parent of underlying dentry, but there's nothing to prevent
+losing a timeslice to preemtion in the middle of evaluation of
+lower_dentry->d_parent->d_inode, having another process move lower_dentry
+around and have its (ex)parent not pinned anymore and freed on memory
+pressure. Then we regain CPU and try to fetch ->d_inode from memory
+that is freed by that point.
+
+dentry->d_parent *is* stable here - it's an argument of ->lookup() and
+we are guaranteed that it won't be moved anywhere until we feed it
+to d_add/d_splice_alias. So we safely go that way to get to its
+underlying dentry.
+
+Cc: stable@vger.kernel.org # since 2009 or so
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/ecryptfs/inode.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index 3c2298721359..e23752d9a79f 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -319,9 +319,9 @@ static int ecryptfs_i_size_read(struct dentry *dentry, struct inode *inode)
+ static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,
+ struct dentry *lower_dentry)
+ {
++ struct path *path = ecryptfs_dentry_to_lower_path(dentry->d_parent);
+ struct inode *inode, *lower_inode;
+ struct ecryptfs_dentry_info *dentry_info;
+- struct vfsmount *lower_mnt;
+ int rc = 0;
+
+ dentry_info = kmem_cache_alloc(ecryptfs_dentry_info_cache, GFP_KERNEL);
+@@ -330,13 +330,12 @@ static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,
+ return ERR_PTR(-ENOMEM);
+ }
+
+- lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
+ fsstack_copy_attr_atime(d_inode(dentry->d_parent),
+- d_inode(lower_dentry->d_parent));
++ d_inode(path->dentry));
+ BUG_ON(!d_count(lower_dentry));
+
+ ecryptfs_set_dentry_private(dentry, dentry_info);
+- dentry_info->lower_path.mnt = lower_mnt;
++ dentry_info->lower_path.mnt = mntget(path->mnt);
+ dentry_info->lower_path.dentry = lower_dentry;
+
+ /*
+--
+2.16.4
+
diff --git a/patches.suse/edac-ghes-do-not-warn-when-incrementing-refcount-on-0.patch b/patches.suse/edac-ghes-do-not-warn-when-incrementing-refcount-on-0.patch
new file mode 100644
index 0000000000..dcea9f37b4
--- /dev/null
+++ b/patches.suse/edac-ghes-do-not-warn-when-incrementing-refcount-on-0.patch
@@ -0,0 +1,70 @@
+From: Robert Richter <rrichter@marvell.com>
+Date: Thu, 21 Nov 2019 21:36:57 +0000
+Subject: EDAC/ghes: Do not warn when incrementing refcount on 0
+Git-commit: 16214bd9e43a31683a7073664b000029bba00354
+Patch-mainline: v5.5-rc1
+References: bsc#1114279
+
+The following warning from the refcount framework is seen during ghes
+initialization:
+
+ EDAC MC0: Giving out device to module ghes_edac.c controller ghes_edac: DEV ghes (INTERRUPT)
+ ------------[ cut here ]------------
+ refcount_t: increment on 0; use-after-free.
+ WARNING: CPU: 36 PID: 1 at lib/refcount.c:156 refcount_inc_checked
+ [...]
+ Call trace:
+ refcount_inc_checked
+ ghes_edac_register
+ ghes_probe
+ ...
+
+It warns if the refcount is incremented from zero. This warning is
+reasonable as a kernel object is typically created with a refcount of
+one and freed once the refcount is zero. Afterwards the object would be
+"used-after-free".
+
+For GHES, the refcount is initialized with zero, and that is why this
+message is seen when initializing the first instance. However, whenever
+the refcount is zero, the device will be allocated and registered. Since
+the ghes_reg_mutex protects the refcount and serializes allocation and
+freeing of ghes devices, a use-after-free cannot happen here.
+
+Instead of using refcount_inc() for the first instance, use
+refcount_set(). This can be used here because the refcount is zero at
+this point and can not change due to its protection by the mutex.
+
+Fixes: 23f61b9fc5cc ("EDAC/ghes: Fix locking and memory barrier issues")
+Reported-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Robert Richter <rrichter@marvell.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Tested-by: John Garry <john.garry@huawei.com>
+Cc: <huangming23@huawei.com>
+Cc: James Morse <james.morse@arm.com>
+Cc: <linuxarm@huawei.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: <tanxiaofei@huawei.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: <wanghuiqiang@huawei.com>
+Link: https://lkml.kernel.org/r/20191121213628.21244-1-rrichter@marvell.com
+---
+ drivers/edac/ghes_edac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c
+index 47f4e7f90ef0..b99080d8a10c 100644
+--- a/drivers/edac/ghes_edac.c
++++ b/drivers/edac/ghes_edac.c
+@@ -556,8 +556,8 @@ int ghes_edac_register(struct ghes *ghes, struct device *dev)
+ ghes_pvt = pvt;
+ spin_unlock_irqrestore(&ghes_lock, flags);
+
+- /* only increment on success */
+- refcount_inc(&ghes_refcount);
++ /* only set on success */
++ refcount_set(&ghes_refcount, 1);
+
+ unlock:
+ mutex_unlock(&ghes_reg_mutex);
+
diff --git a/patches.suse/edac-ghes-fix-locking-and-memory-barrier-issues.patch b/patches.suse/edac-ghes-fix-locking-and-memory-barrier-issues.patch
new file mode 100644
index 0000000000..f378723201
--- /dev/null
+++ b/patches.suse/edac-ghes-fix-locking-and-memory-barrier-issues.patch
@@ -0,0 +1,234 @@
+From: Robert Richter <rrichter@marvell.com>
+Date: Tue, 5 Nov 2019 20:07:51 +0000
+Subject: EDAC/ghes: Fix locking and memory barrier issues
+Git-commit: 23f61b9fc5cc10d87f66e50518707eec2a0fbda1
+Patch-mainline: v5.5-rc1
+References: bsc#1114279
+
+The ghes registration and refcount is broken in several ways:
+
+ * ghes_edac_register() returns with success for a 2nd instance
+ even if a first instance's registration is still running. This is
+ not correct as the first instance may fail later. A subsequent
+ registration may not finish before the first. Parallel registrations
+ must be avoided.
+
+ * The refcount was increased even if a registration failed. This
+ leads to stale counters preventing the device from being released.
+
+ * The ghes refcount may not be decremented properly on unregistration.
+ Always decrement the refcount once ghes_edac_unregister() is called to
+ keep the refcount sane.
+
+ * The ghes_pvt pointer is handed to the irq handler before registration
+ finished.
+
+ * The mci structure could be freed while the irq handler is running.
+
+Fix this by adding a mutex to ghes_edac_register(). This mutex
+serializes instances to register and unregister. The refcount is only
+increased if the registration succeeded. This makes sure the refcount is
+in a consistent state after registering or unregistering a device.
+
+Note: A spinlock cannot be used here as the code section may sleep.
+
+The ghes_pvt is protected by ghes_lock now. This ensures the pointer is
+not updated before registration was finished or while the irq handler is
+running. It is unset before unregistering the device including necessary
+(implicit) memory barriers making the changes visible to other CPUs.
+Thus, the device can not be used anymore by an interrupt.
+
+Also, rename ghes_init to ghes_refcount for better readability and
+switch to refcount API.
+
+A refcount is needed because there can be multiple GHES structures being
+defined (see ACPI 6.3 specification, 18.3.2.7 Generic Hardware Error
+Source, "Some platforms may describe multiple Generic Hardware Error
+Source structures with different notification types, ...").
+
+Another approach to use the mci's device refcount (get_device()) and
+have a release function does not work here. A release function will be
+called only for device_release() with the last put_device() call. The
+device must be deleted *before* that with device_del(). This is only
+possible by maintaining an own refcount.
+
+ [ bp: touchups. ]
+
+Fixes: 0fe5f281f749 ("EDAC, ghes: Model a single, logical memory controller")
+Fixes: 1e72e673b9d1 ("EDAC/ghes: Fix Use after free in ghes_edac remove path")
+Co-developed-by: James Morse <james.morse@arm.com>
+Signed-off-by: James Morse <james.morse@arm.com>
+Co-developed-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Robert Richter <rrichter@marvell.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Tony Luck <tony.luck@intel.com>
+Link: https://lkml.kernel.org/r/20191105200732.3053-1-rrichter@marvell.com
+---
+ drivers/edac/ghes_edac.c | 83 ++++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 64 insertions(+), 19 deletions(-)
+
+--- a/drivers/edac/ghes_edac.c
++++ b/drivers/edac/ghes_edac.c
+@@ -30,9 +30,18 @@ struct ghes_edac_pvt {
+ char msg[80];
+ };
+
+-static atomic_t ghes_init = ATOMIC_INIT(0);
++static refcount_t ghes_refcount = REFCOUNT_INIT(0);
++
++/*
++ * Access to ghes_pvt must be protected by ghes_lock. The spinlock
++ * also provides the necessary (implicit) memory barrier for the SMP
++ * case to make the pointer visible on another CPU.
++ */
+ static struct ghes_edac_pvt *ghes_pvt;
+
++/* GHES registration mutex */
++static DEFINE_MUTEX(ghes_reg_mutex);
++
+ /*
+ * Sync with other, potentially concurrent callers of
+ * ghes_edac_report_mem_error(). We don't know what the
+@@ -190,14 +199,11 @@ void ghes_edac_report_mem_error(struct g
+ enum hw_event_mc_err_type type;
+ struct edac_raw_error_desc *e;
+ struct mem_ctl_info *mci;
+- struct ghes_edac_pvt *pvt = ghes_pvt;
++ struct ghes_edac_pvt *pvt;
+ unsigned long flags;
+ char *p;
+ u8 grain_bits;
+
+- if (!pvt)
+- return;
+-
+ /*
+ * We can do the locking below because GHES defers error processing
+ * from NMI to IRQ context. Whenever that changes, we'd at least
+@@ -208,6 +214,10 @@ void ghes_edac_report_mem_error(struct g
+
+ spin_lock_irqsave(&ghes_lock, flags);
+
++ pvt = ghes_pvt;
++ if (!pvt)
++ goto unlock;
++
+ mci = pvt->mci;
+ e = &mci->error_desc;
+
+@@ -426,6 +436,8 @@ void ghes_edac_report_mem_error(struct g
+ grain_bits, e->syndrome, pvt->detail_location);
+
+ edac_raw_mc_handle_error(type, mci, e);
++
++unlock:
+ spin_unlock_irqrestore(&ghes_lock, flags);
+ }
+
+@@ -440,10 +452,12 @@ static struct acpi_platform_list plat_li
+ int ghes_edac_register(struct ghes *ghes, struct device *dev)
+ {
+ bool fake = false;
+- int rc, num_dimm = 0;
++ int rc = 0, num_dimm = 0;
+ struct mem_ctl_info *mci;
++ struct ghes_edac_pvt *pvt;
+ struct edac_mc_layer layers[1];
+ struct ghes_edac_dimm_fill dimm_fill;
++ unsigned long flags;
+ int idx;
+
+ /* Check if safe to enable on this system */
+@@ -451,11 +465,14 @@ int ghes_edac_register(struct ghes *ghes
+ if (!force_load && idx < 0)
+ return -ENODEV;
+
++ /* finish another registration/unregistration instance first */
++ mutex_lock(&ghes_reg_mutex);
++
+ /*
+ * We have only one logical memory controller to which all DIMMs belong.
+ */
+- if (atomic_inc_return(&ghes_init) > 1)
+- return 0;
++ if (refcount_inc_not_zero(&ghes_refcount))
++ goto unlock;
+
+ /* Get the number of DIMMs */
+ dmi_walk(ghes_edac_count_dimms, &num_dimm);
+@@ -473,12 +490,13 @@ int ghes_edac_register(struct ghes *ghes
+ mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, sizeof(struct ghes_edac_pvt));
+ if (!mci) {
+ pr_info("Can't allocate memory for EDAC data\n");
+- return -ENOMEM;
++ rc = -ENOMEM;
++ goto unlock;
+ }
+
+- ghes_pvt = mci->pvt_info;
+- ghes_pvt->ghes = ghes;
+- ghes_pvt->mci = mci;
++ pvt = mci->pvt_info;
++ pvt->ghes = ghes;
++ pvt->mci = mci;
+
+ mci->pdev = dev;
+ mci->mtype_cap = MEM_FLAG_EMPTY;
+@@ -521,20 +539,47 @@ int ghes_edac_register(struct ghes *ghes
+ if (rc < 0) {
+ pr_info("Can't register at EDAC core\n");
+ edac_mc_free(mci);
+- return -ENODEV;
++ rc = -ENODEV;
++ goto unlock;
+ }
+- return 0;
++
++ spin_lock_irqsave(&ghes_lock, flags);
++ ghes_pvt = pvt;
++ spin_unlock_irqrestore(&ghes_lock, flags);
++
++ /* only increment on success */
++ refcount_inc(&ghes_refcount);
++
++unlock:
++ mutex_unlock(&ghes_reg_mutex);
++
++ return rc;
+ }
+
+ void ghes_edac_unregister(struct ghes *ghes)
+ {
+ struct mem_ctl_info *mci;
++ unsigned long flags;
+
+- if (atomic_dec_return(&ghes_init))
+- return;
++ mutex_lock(&ghes_reg_mutex);
++ if (!refcount_dec_and_test(&ghes_refcount))
++ goto unlock;
+
+- mci = ghes_pvt->mci;
++ /*
++ * Wait for the irq handler being finished.
++ */
++ spin_lock_irqsave(&ghes_lock, flags);
++ mci = ghes_pvt ? ghes_pvt->mci : NULL;
+ ghes_pvt = NULL;
+- edac_mc_del_mc(mci->pdev);
+- edac_mc_free(mci);
++ spin_unlock_irqrestore(&ghes_lock, flags);
++
++ if (!mci)
++ goto unlock;
++
++ mci = edac_mc_del_mc(mci->pdev);
++ if (mci)
++ edac_mc_free(mci);
++
++unlock:
++ mutex_unlock(&ghes_reg_mutex);
+ }
diff --git a/patches.suse/ext4-fix-punch-hole-for-inline_data-file-systems.patch b/patches.suse/ext4-fix-punch-hole-for-inline_data-file-systems.patch
new file mode 100644
index 0000000000..99c0080535
--- /dev/null
+++ b/patches.suse/ext4-fix-punch-hole-for-inline_data-file-systems.patch
@@ -0,0 +1,53 @@
+From c1e8220bd316d8ae8e524df39534b8a412a45d5e Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Fri, 23 Aug 2019 22:38:00 -0400
+Subject: [PATCH] ext4: fix punch hole for inline_data file systems
+Git-commit: c1e8220bd316d8ae8e524df39534b8a412a45d5e
+Patch-mainline: v5.4-rc1
+References: bsc#1158640
+
+If a program attempts to punch a hole on an inline data file, we need
+to convert it to a normal file first.
+
+This was detected using ext4/032 using the adv configuration. Simple
+Reproducer:
+
+mke2fs -Fq -t ext4 -O inline_data /dev/vdc
+mount /vdc
+echo "" > /vdc/testfile
+xfs_io -c 'truncate 33554432' /vdc/testfile
+xfs_io -c 'fpunch 0 1048576' /vdc/testfile
+umount /vdc
+e2fsck -fy /dev/vdc
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/ext4/inode.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 2b1c58da8d1e..e567f0229d4e 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4236,6 +4236,15 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
+
+ trace_ext4_punch_hole(inode, offset, length, 0);
+
++ ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
++ if (ext4_has_inline_data(inode)) {
++ down_write(&EXT4_I(inode)->i_mmap_sem);
++ ret = ext4_convert_inline_data(inode);
++ up_write(&EXT4_I(inode)->i_mmap_sem);
++ if (ret)
++ return ret;
++ }
++
+ /*
+ * Write out all dirty pages to avoid race conditions
+ * Then release them.
+--
+2.16.4
+
diff --git a/patches.suse/ext4-update-direct-I-O-read-lock-pattern-for-IOCB_NO.patch b/patches.suse/ext4-update-direct-I-O-read-lock-pattern-for-IOCB_NO.patch
new file mode 100644
index 0000000000..7069db8761
--- /dev/null
+++ b/patches.suse/ext4-update-direct-I-O-read-lock-pattern-for-IOCB_NO.patch
@@ -0,0 +1,47 @@
+From 548feebec7e93e58b647dba70b3303dcb569c914 Mon Sep 17 00:00:00 2001
+From: Matthew Bobrowski <mbobrowski@mbobrowski.org>
+Date: Tue, 5 Nov 2019 22:59:22 +1100
+Subject: [PATCH] ext4: update direct I/O read lock pattern for IOCB_NOWAIT
+Git-commit: 548feebec7e93e58b647dba70b3303dcb569c914
+Patch-mainline: v5.5-rc1
+References: bsc#1158639
+
+This patch updates the lock pattern in ext4_direct_IO_read() to not
+block on inode lock in cases of IOCB_NOWAIT direct I/O reads. The
+locking condition implemented here is similar to that of 942491c9e6d6
+("xfs: fix AIM7 regression").
+
+Fixes: 16c54688592c ("ext4: Allow parallel DIO reads")
+Signed-off-by: Matthew Bobrowski <mbobrowski@mbobrowski.org>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Link: https://lore.kernel.org/r/c5d5e759f91747359fbd2c6f9a36240cf75ad79f.1572949325.git.mbobrowski@mbobrowski.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/ext4/inode.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index e4b0722717b3..f33fa86fff67 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -3881,7 +3881,13 @@ static ssize_t ext4_direct_IO_read(struct kiocb *iocb, struct iov_iter *iter)
+ * writes & truncates and since we take care of writing back page cache,
+ * we are protected against page writeback as well.
+ */
+- inode_lock_shared(inode);
++ if (iocb->ki_flags & IOCB_NOWAIT) {
++ if (!inode_trylock_shared(inode))
++ return -EAGAIN;
++ } else {
++ inode_lock_shared(inode);
++ }
++
+ ret = filemap_write_and_wait_range(mapping, iocb->ki_pos,
+ iocb->ki_pos + count - 1);
+ if (ret)
+--
+2.16.4
+
diff --git a/patches.suse/iomap-Fix-pipe-page-leakage-during-splicing.patch b/patches.suse/iomap-Fix-pipe-page-leakage-during-splicing.patch
new file mode 100644
index 0000000000..f1c41d16a7
--- /dev/null
+++ b/patches.suse/iomap-Fix-pipe-page-leakage-during-splicing.patch
@@ -0,0 +1,51 @@
+From 419e9c38aa075ed0cd3c13d47e15954b686bcdb6 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Thu, 21 Nov 2019 16:14:38 -0800
+Subject: [PATCH] iomap: Fix pipe page leakage during splicing
+Git-commit: 419e9c38aa075ed0cd3c13d47e15954b686bcdb6
+Patch-mainline: v5.5-rc1
+References: bsc#1158651
+
+When splicing using iomap_dio_rw() to a pipe, we may leak pipe pages
+because bio_iov_iter_get_pages() records that the pipe will have full
+extent worth of data however if file size is not block size aligned
+iomap_dio_rw() returns less than what bio_iov_iter_get_pages() set up
+and splice code gets confused leaking a pipe page with the file tail.
+
+Handle the situation similarly to the old direct IO implementation and
+revert iter to actually returned read amount which makes iter consistent
+with value returned from iomap_dio_rw() and thus the splice code is
+happy.
+
+Fixes: ff6a9292e6f6 ("iomap: implement direct I/O")
+Cc: stable@vger.kernel.org
+Reported-by: syzbot+991400e8eba7e00a26e1@syzkaller.appspotmail.com
+Signed-off-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/iomap.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/fs/iomap.c
++++ b/fs/iomap.c
+@@ -1046,8 +1046,15 @@ iomap_dio_rw(struct kiocb *iocb, struct
+ }
+ pos += ret;
+
+- if (iov_iter_rw(iter) == READ && pos >= dio->i_size)
++ if (iov_iter_rw(iter) == READ && pos >= dio->i_size) {
++ /*
++ * We only report that we've read data up to i_size.
++ * Revert iter to a state corresponding to that as
++ * some callers (such as splice code) rely on it.
++ */
++ iov_iter_revert(iter, pos - dio->i_size);
+ break;
++ }
+ } while ((count = iov_iter_count(iter)) > 0);
+ blk_finish_plug(&plug);
+
diff --git a/patches.suse/loop-fix-no-unmap-write-zeroes-request-behavior.patch b/patches.suse/loop-fix-no-unmap-write-zeroes-request-behavior.patch
new file mode 100644
index 0000000000..c8d6f2c314
--- /dev/null
+++ b/patches.suse/loop-fix-no-unmap-write-zeroes-request-behavior.patch
@@ -0,0 +1,83 @@
+From efcfec579f6139528c9e6925eca2bc4a36da65c6 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Wed, 30 Oct 2019 20:29:48 -0700
+Subject: [PATCH] loop: fix no-unmap write-zeroes request behavior
+Git-commit: efcfec579f6139528c9e6925eca2bc4a36da65c6
+Patch-mainline: v5.5-rc1
+References: bsc#1158637
+
+Currently, if the loop device receives a WRITE_ZEROES request, it asks
+the underlying filesystem to punch out the range. This behavior is
+correct if unmapping is allowed. However, a NOUNMAP request means that
+the caller doesn't want us to free the storage backing the range, so
+punching out the range is incorrect behavior.
+
+To satisfy a NOUNMAP | WRITE_ZEROES request, loop should ask the
+underlying filesystem to FALLOC_FL_ZERO_RANGE, which is (according to
+the fallocate documentation) required to ensure that the entire range is
+backed by real storage, which suffices for our purposes.
+
+Fixes: 19372e2769179dd ("loop: implement REQ_OP_WRITE_ZEROES")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ drivers/block/loop.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index f6f77eaa7217..ef6e251857c8 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -417,18 +417,20 @@ static int lo_read_transfer(struct loop_device *lo, struct request *rq,
+ return ret;
+ }
+
+-static int lo_discard(struct loop_device *lo, struct request *rq, loff_t pos)
++static int lo_fallocate(struct loop_device *lo, struct request *rq, loff_t pos,
++ int mode)
+ {
+ /*
+- * We use punch hole to reclaim the free space used by the
+- * image a.k.a. discard. However we do not support discard if
+- * encryption is enabled, because it may give an attacker
+- * useful information.
++ * We use fallocate to manipulate the space mappings used by the image
++ * a.k.a. discard/zerorange. However we do not support this if
++ * encryption is enabled, because it may give an attacker useful
++ * information.
+ */
+ struct file *file = lo->lo_backing_file;
+- int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE;
+ int ret;
+
++ mode |= FALLOC_FL_KEEP_SIZE;
++
+ if ((!file->f_op->fallocate) || lo->lo_encrypt_key_size) {
+ ret = -EOPNOTSUPP;
+ goto out;
+@@ -596,9 +598,17 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq)
+ switch (req_op(rq)) {
+ case REQ_OP_FLUSH:
+ return lo_req_flush(lo, rq);
+- case REQ_OP_DISCARD:
+ case REQ_OP_WRITE_ZEROES:
+- return lo_discard(lo, rq, pos);
++ /*
++ * If the caller doesn't want deallocation, call zeroout to
++ * write zeroes the range. Otherwise, punch them out.
++ */
++ return lo_fallocate(lo, rq, pos,
++ (rq->cmd_flags & REQ_NOUNMAP) ?
++ FALLOC_FL_ZERO_RANGE :
++ FALLOC_FL_PUNCH_HOLE);
++ case REQ_OP_DISCARD:
++ return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE);
+ case REQ_OP_WRITE:
+ if (lo->transfer)
+ return lo_write_transfer(lo, rq, pos);
+--
+2.16.4
+
diff --git a/patches.suse/media-dvb-usb-fix-use-after-free-in-dvb_usb_device_e.patch b/patches.suse/media-dvb-usb-fix-use-after-free-in-dvb_usb_device_e.patch
index 6d514e8729..cda512950f 100644
--- a/patches.suse/media-dvb-usb-fix-use-after-free-in-dvb_usb_device_e.patch
+++ b/patches.suse/media-dvb-usb-fix-use-after-free-in-dvb_usb_device_e.patch
@@ -4,7 +4,7 @@ Date: Tue, 30 Apr 2019 09:07:36 -0400
Subject: [PATCH] media: dvb: usb: fix use after free in dvb_usb_device_exit
Git-commit: 6cf97230cd5f36b7665099083272595c55d72be7
Patch-mainline: v5.3-rc1
-References: bsc#1051510
+References: bsc#1146544 CVE-2019-15213
dvb_usb_device_exit() frees and uses the device name in that order.
Fix by storing the name in a buffer before freeing it.
diff --git a/patches.suse/nbd-prevent-memory-leak.patch b/patches.suse/nbd-prevent-memory-leak.patch
new file mode 100644
index 0000000000..65130e6f8e
--- /dev/null
+++ b/patches.suse/nbd-prevent-memory-leak.patch
@@ -0,0 +1,46 @@
+From 03bf73c315edca28f47451913177e14cd040a216 Mon Sep 17 00:00:00 2001
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Mon, 23 Sep 2019 15:09:58 -0500
+Subject: [PATCH] nbd: prevent memory leak
+Git-commit: 03bf73c315edca28f47451913177e14cd040a216
+Patch-mainline: v5.5-rc1
+References: bsc#1158638
+
+In nbd_add_socket when krealloc succeeds, if nsock's allocation fail the
+reallocted memory is leak. The correct behaviour should be assigning the
+reallocted memory to config->socks right after success.
+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ drivers/block/nbd.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index ac07e8c94c79..f471142d264d 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1004,14 +1004,15 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
+ sockfd_put(sock);
+ return -ENOMEM;
+ }
++
++ config->socks = socks;
++
+ nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL);
+ if (!nsock) {
+ sockfd_put(sock);
+ return -ENOMEM;
+ }
+
+- config->socks = socks;
+-
+ nsock->fallback_index = -1;
+ nsock->dead = false;
+ mutex_init(&nsock->tx_lock);
+--
+2.16.4
+
diff --git a/patches.suse/ocfs2-fix-panic-due-to-ocfs2_wq-is-null.patch b/patches.suse/ocfs2-fix-panic-due-to-ocfs2_wq-is-null.patch
new file mode 100644
index 0000000000..645dfeae8c
--- /dev/null
+++ b/patches.suse/ocfs2-fix-panic-due-to-ocfs2_wq-is-null.patch
@@ -0,0 +1,84 @@
+From b918c43021baaa3648de09e19a4a3dd555a45f40 Mon Sep 17 00:00:00 2001
+From: Yi Li <yilikernel@gmail.com>
+Date: Fri, 18 Oct 2019 20:20:08 -0700
+Subject: [PATCH] ocfs2: fix panic due to ocfs2_wq is null
+Git-commit: b918c43021baaa3648de09e19a4a3dd555a45f40
+Patch-mainline: v5.4-rc4
+References: bsc#1158644
+
+mount.ocfs2 failed when reading ocfs2 filesystem superblock encounters
+an error. ocfs2_initialize_super() returns before allocating ocfs2_wq.
+ocfs2_dismount_volume() triggers the following panic.
+
+ Oct 15 16:09:27 cnwarekv-205120 kernel: On-disk corruption discovered.Please run fsck.ocfs2 once the filesystem is unmounted.
+ Oct 15 16:09:27 cnwarekv-205120 kernel: (mount.ocfs2,22804,44): ocfs2_read_locked_inode:537 ERROR: status = -30
+ Oct 15 16:09:27 cnwarekv-205120 kernel: (mount.ocfs2,22804,44): ocfs2_init_global_system_inodes:458 ERROR: status = -30
+ Oct 15 16:09:27 cnwarekv-205120 kernel: (mount.ocfs2,22804,44): ocfs2_init_global_system_inodes:491 ERROR: status = -30
+ Oct 15 16:09:27 cnwarekv-205120 kernel: (mount.ocfs2,22804,44): ocfs2_initialize_super:2313 ERROR: status = -30
+ Oct 15 16:09:27 cnwarekv-205120 kernel: (mount.ocfs2,22804,44): ocfs2_fill_super:1033 ERROR: status = -30
+ ------------[ cut here ]------------
+ Oops: 0002 [#1] SMP NOPTI
+ CPU: 1 PID: 11753 Comm: mount.ocfs2 Tainted: G E
+ 4.14.148-200.ckv.x86_64 #1
+ Hardware name: Sugon H320-G30/35N16-US, BIOS 0SSDX017 12/21/2018
+ task: ffff967af0520000 task.stack: ffffa5f05484000
+ RIP: 0010:mutex_lock+0x19/0x20
+ Call Trace:
+ flush_workqueue+0x81/0x460
+ ocfs2_shutdown_local_alloc+0x47/0x440 [ocfs2]
+ ocfs2_dismount_volume+0x84/0x400 [ocfs2]
+ ocfs2_fill_super+0xa4/0x1270 [ocfs2]
+ ? ocfs2_initialize_super.isa.211+0xf20/0xf20 [ocfs2]
+ mount_bdev+0x17f/0x1c0
+ mount_fs+0x3a/0x160
+
+Link: http://lkml.kernel.org/r/1571139611-24107-1-git-send-email-yili@winhong.com
+Signed-off-by: Yi Li <yilikernel@gmail.com>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/ocfs2/journal.c | 3 ++-
+ fs/ocfs2/localalloc.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
+index 930e3d388579..699a560efbb0 100644
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -217,7 +217,8 @@ void ocfs2_recovery_exit(struct ocfs2_super *osb)
+ /* At this point, we know that no more recovery threads can be
+ * launched, so wait for any recovery completion work to
+ * complete. */
+- flush_workqueue(osb->ocfs2_wq);
++ if (osb->ocfs2_wq)
++ flush_workqueue(osb->ocfs2_wq);
+
+ /*
+ * Now that recovery is shut down, and the osb is about to be
+diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
+index 158e5af767fd..720e9f94957e 100644
+--- a/fs/ocfs2/localalloc.c
++++ b/fs/ocfs2/localalloc.c
+@@ -377,7 +377,8 @@ void ocfs2_shutdown_local_alloc(struct ocfs2_super *osb)
+ struct ocfs2_dinode *alloc = NULL;
+
+ cancel_delayed_work(&osb->la_enable_wq);
+- flush_workqueue(osb->ocfs2_wq);
++ if (osb->ocfs2_wq)
++ flush_workqueue(osb->ocfs2_wq);
+
+ if (osb->local_alloc_state == OCFS2_LA_UNUSED)
+ goto out;
+--
+2.16.4
+
diff --git a/patches.suse/ocfs2-fix-passing-zero-to-PTR_ERR-warning.patch b/patches.suse/ocfs2-fix-passing-zero-to-PTR_ERR-warning.patch
new file mode 100644
index 0000000000..a698e21d02
--- /dev/null
+++ b/patches.suse/ocfs2-fix-passing-zero-to-PTR_ERR-warning.patch
@@ -0,0 +1,48 @@
+From 188c523e1c271d537f3c9f55b6b65bf4476de32f Mon Sep 17 00:00:00 2001
+From: Ding Xiang <dingxiang@cmss.chinamobile.com>
+Date: Sat, 30 Nov 2019 17:49:12 -0800
+Subject: [PATCH] ocfs2: fix passing zero to 'PTR_ERR' warning
+Git-commit: 188c523e1c271d537f3c9f55b6b65bf4476de32f
+Patch-mainline: v5.5-rc1
+References: bsc#1158649
+
+Fix a static code checker warning:
+fs/ocfs2/acl.c:331
+ ocfs2_acl_chmod() warn: passing zero to 'PTR_ERR'
+
+Link: http://lkml.kernel.org/r/1dee278b-6c96-eec2-ce76-fe6e07c6e20f@linux.alibaba.com
+Fixes: 5ee0fbd50fd ("ocfs2: revert using ocfs2_acl_chmod to avoid inode cluster lock hang")
+Signed-off-by: Ding Xiang <dingxiang@cmss.chinamobile.com>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/ocfs2/acl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
+index 3e7da392aa6f..bb981ec76456 100644
+--- a/fs/ocfs2/acl.c
++++ b/fs/ocfs2/acl.c
+@@ -327,8 +327,8 @@ int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh)
+ down_read(&OCFS2_I(inode)->ip_xattr_sem);
+ acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh);
+ up_read(&OCFS2_I(inode)->ip_xattr_sem);
+- if (IS_ERR(acl) || !acl)
+- return PTR_ERR(acl);
++ if (IS_ERR_OR_NULL(acl))
++ return PTR_ERR_OR_ZERO(acl);
+ ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode);
+ if (ret)
+ return ret;
+--
+2.16.4
+
diff --git a/patches.suse/ubifs-Correctly-initialize-c-min_log_bytes.patch b/patches.suse/ubifs-Correctly-initialize-c-min_log_bytes.patch
new file mode 100644
index 0000000000..9e7d912b8a
--- /dev/null
+++ b/patches.suse/ubifs-Correctly-initialize-c-min_log_bytes.patch
@@ -0,0 +1,55 @@
+From 377e208f44784174f3002d9892d553715a3ab71b Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Tue, 13 Aug 2019 23:55:48 +0200
+Subject: [PATCH] ubifs: Correctly initialize c->min_log_bytes
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 377e208f44784174f3002d9892d553715a3ab71b
+Patch-mainline: v5.3-rc6
+References: bsc#1158641
+
+Currently on a freshly mounted UBIFS, c->min_log_bytes is 0.
+This can lead to a log overrun and make commits fail.
+
+Recent kernels will report the following assert:
+UBIFS assert failed: c->lhead_lnum != c->ltail_lnum, in fs/ubifs/log.c:412
+
+c->min_log_bytes can have two states, 0 and c->leb_size.
+It controls how much bytes of the log area are reserved for non-bud
+nodes such as commit nodes.
+
+After a commit it has to be set to c->leb_size such that we have always
+enough space for a commit. While a commit runs it can be 0 to make the
+remaining bytes of the log available to writers.
+
+Having it set to 0 right after mount is wrong since no space for commits
+is reserved.
+
+Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system")
+Reported-and-tested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/ubifs/super.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index 2c0803b0ac3a..8c1d571334bc 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -609,6 +609,10 @@ static int init_constants_early(struct ubifs_info *c)
+ c->max_bu_buf_len = UBIFS_MAX_BULK_READ * UBIFS_MAX_DATA_NODE_SZ;
+ if (c->max_bu_buf_len > c->leb_size)
+ c->max_bu_buf_len = c->leb_size;
++
++ /* Log is ready, preserve one LEB for commits. */
++ c->min_log_bytes = c->leb_size;
++
+ return 0;
+ }
+
+--
+2.16.4
+
diff --git a/patches.suse/ubifs-Limit-the-number-of-pages-in-shrink_liability.patch b/patches.suse/ubifs-Limit-the-number-of-pages-in-shrink_liability.patch
new file mode 100644
index 0000000000..996bc6d2a6
--- /dev/null
+++ b/patches.suse/ubifs-Limit-the-number-of-pages-in-shrink_liability.patch
@@ -0,0 +1,41 @@
+From 0af83abbd4a6e36a4b209d8c57c26143e40eeec1 Mon Sep 17 00:00:00 2001
+From: Liu Song <liu.song11@zte.com.cn>
+Date: Tue, 6 Aug 2019 22:21:40 +0800
+Subject: [PATCH] ubifs: Limit the number of pages in shrink_liability
+Git-commit: 0af83abbd4a6e36a4b209d8c57c26143e40eeec1
+Patch-mainline: v5.3-rc6
+References: bsc#1158643
+
+If the number of dirty pages to be written back is large,
+then writeback_inodes_sb will block waiting for a long time,
+causing hung task detection alarm. Therefore, we should limit
+the maximum number of pages written back this time, which let
+the budget be completed faster. The remaining dirty pages
+tend to rely on the writeback mechanism to complete the
+synchronization.
+
+Fixes: b6e51316daed ("writeback: separate starting of sync vs opportunistic writeback")
+Signed-off-by: Liu Song <liu.song11@zte.com.cn>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/ubifs/budget.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c
+index 80d7301ab76d..c0b84e960b20 100644
+--- a/fs/ubifs/budget.c
++++ b/fs/ubifs/budget.c
+@@ -51,7 +51,7 @@
+ static void shrink_liability(struct ubifs_info *c, int nr_to_write)
+ {
+ down_read(&c->vfs_sb->s_umount);
+- writeback_inodes_sb(c->vfs_sb, WB_REASON_FS_FREE_SPACE);
++ writeback_inodes_sb_nr(c->vfs_sb, nr_to_write, WB_REASON_FS_FREE_SPACE);
+ up_read(&c->vfs_sb->s_umount);
+ }
+
+--
+2.16.4
+
diff --git a/patches.suse/xfs-Sanity-check-flags-of-Q_XQUOTARM-call.patch b/patches.suse/xfs-Sanity-check-flags-of-Q_XQUOTARM-call.patch
new file mode 100644
index 0000000000..1cb5475870
--- /dev/null
+++ b/patches.suse/xfs-Sanity-check-flags-of-Q_XQUOTARM-call.patch
@@ -0,0 +1,40 @@
+From 3dd4d40b420846dd35869ccc8f8627feef2cff32 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 23 Oct 2019 17:00:45 -0700
+Subject: [PATCH] xfs: Sanity check flags of Q_XQUOTARM call
+Git-commit: 3dd4d40b420846dd35869ccc8f8627feef2cff32
+Patch-mainline: v5.5-rc1
+References: bsc#1158652
+
+Flags passed to Q_XQUOTARM were not sanity checked for invalid values.
+Fix that.
+
+Fixes: 9da93f9b7cdf ("xfs: fix Q_XQUOTARM ioctl")
+Reported-by: Yang Xu <xuyang2018.jy@cn.fujitsu.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/xfs/xfs_quotaops.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/xfs/xfs_quotaops.c b/fs/xfs/xfs_quotaops.c
+index cd6c7210a373..c7de17deeae6 100644
+--- a/fs/xfs/xfs_quotaops.c
++++ b/fs/xfs/xfs_quotaops.c
+@@ -201,6 +201,9 @@ xfs_fs_rm_xquota(
+ if (XFS_IS_QUOTA_ON(mp))
+ return -EINVAL;
+
++ if (uflags & ~(FS_USER_QUOTA | FS_GROUP_QUOTA | FS_PROJ_QUOTA))
++ return -EINVAL;
++
+ if (uflags & FS_USER_QUOTA)
+ flags |= XFS_DQ_USER;
+ if (uflags & FS_GROUP_QUOTA)
+--
+2.16.4
+
diff --git a/series.conf b/series.conf
index 617b632e1c..a1aa1d1b6c 100644
--- a/series.conf
+++ b/series.conf
@@ -46500,6 +46500,7 @@
patches.suse/ipmi-kcs_bmc-handle-devm_kasprintf-failure-case.patch
patches.suse/cpcap-charger-generate-events-for-userspace.patch
patches.suse/0025-i2c-synquacer-remove-unused-is_suspended-flag.patch
+ patches.suse/0001-i2c-of-Try-to-find-an-I2C-adapter-matching-the-paren.patch
patches.suse/i2c-tegra-fix-maximum-transfer-size.patch
patches.suse/iscsi_ibft-Fix-missing-break-in-switch-statement.patch
patches.suse/thermal-mediatek-fix-register-index-error.patch
@@ -46965,6 +46966,7 @@
patches.suse/drm-etnaviv-fix-some-off-by-one-bugs.patch
patches.suse/0001-drm-etnaviv-NULL-vs-IS_ERR-buf-in-etnaviv_core_dump.patch
patches.suse/0002-drm-etnaviv-potential-NULL-dereference.patch
+ patches.suse/0002-drm-i915-Reacquire-priolist-cache-after-dropping-the.patch
patches.suse/drm-i915-Fix-atomic-state-leak-when-resetting-HDMI-l.patch
patches.suse/drm-i915-Relax-mmap-VMA-check.patch
patches.suse/0002-drm-amd-powerplay-correct-power-reading-on-fiji.patch
@@ -49624,6 +49626,7 @@
patches.suse/drm-crc-debugfs-Also-sprinkle-irqrestore-over-early-.patch
patches.suse/drm-virtio-Add-memory-barriers-for-capset-cache.patch
patches.suse/drm-rockchip-Properly-adjust-to-a-true-clock-in-adju.patch
+ patches.suse/0004-drm-i915-Don-t-dereference-request-if-it-may-have-be.patch
patches.suse/drm-edid-parse-CEA-blocks-embedded-in-DisplayID.patch
patches.suse/drm-amd-display-Always-allocate-initial-connector-st.patch
patches.suse/drm-amd-display-fix-compilation-error.patch
@@ -49890,6 +49893,7 @@
patches.suse/0001-xen-swiotlb-fix-condition-for-calling-xen_destroy_co.patch
patches.suse/drm-i915-perf-fix-ICL-perf-register-offsets.patch
patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch
+ patches.suse/0005-drm-i915-Lock-the-engine-while-dumping-the-active-re.patch
patches.suse/drm-i915-Fix-GEN8_MCR_SELECTOR-programming.patch
patches.suse/drm-i915-Fix-the-TBT-AUX-power-well-enabling.patch
patches.suse/drm-i915-gvt-fix-incorrect-cache-entry-for-guest-pag.patch
@@ -50101,6 +50105,8 @@
patches.suse/gpio-Fix-build-error-of-function-redefinition.patch
patches.suse/mm-page_owner-handle-thp-splits-correctly.patch
patches.suse/x86-cpu-amd-clear-rdrand-cpuid-bit-on-amd-family-15h-16h.patch
+ patches.suse/ubifs-Correctly-initialize-c-min_log_bytes.patch
+ patches.suse/ubifs-Limit-the-number-of-pages-in-shrink_liability.patch
patches.suse/tcp-make-sure-EPOLLOUT-wont-be-missed.patch
patches.suse/net-smc-make-sure-EPOLLOUT-is-raised.patch
patches.suse/mac80211-fix-possible-sta-leak.patch
@@ -50391,6 +50397,7 @@
patches.suse/ipmi_si-Only-schedule-continuously-in-the-thread-in-.patch
patches.suse/pinctrl-tegra-Fix-write-barrier-placement-in-pmx_wri.patch
patches.suse/0001-drm-i915-Fix-various-tracepoints-for-gen2.patch
+ patches.suse/0006-drm-i915-Fix-and-improve-MCR-selection-logic.patch
patches.suse/drm-bridge-tc358767-Increase-AUX-transfer-length-lim.patch
patches.suse/drm-panel-simple-fix-AUO-g185han01-horizontal-blanki.patch
patches.suse/drm-panel-make-drm_panel.h-self-contained.patch
@@ -50405,6 +50412,7 @@
patches.suse/drm-rcar-du-lvds-Fix-bridge_to_rcar_lvds.patch
patches.suse/drm-nouveau-volt-Fix-for-some-cards-having-0-maximum.patch
patches.suse/0001-drm-imx-Drop-unused-imx-ipuv3-crtc.o-build.patch
+ patches.suse/0007-drm-fix-module-name-in-edid_firmware-log-message.patch
patches.suse/drm-amd-display-fix-issue-where-252-255-values-are-c.patch
patches.suse/drm-amd-display-reprogram-VM-config-when-system-resu.patch
patches.suse/drm-amd-powerplay-smu7-enforce-minimal-VBITimeout-v2.patch
@@ -50596,6 +50604,7 @@
patches.suse/mtd-spi-nor-Fix-Cadence-QSPI-RCU-Schedule-Stall.patch
patches.suse/ext4-set-error-return-correctly-when-ext4_htree_stor.patch
patches.suse/ext4-fix-warning-inside-ext4_convert_unwritten_exten.patch
+ patches.suse/ext4-fix-punch-hole-for-inline_data-file-systems.patch
patches.suse/quota-fix-wrong-condition-in-is_quota_modification.patch
patches.suse/power-supply-Init-device-wakeup-after-device_add.patch
patches.suse/power-reset-gpio-restart-Fix-typo-when-gpio-reset-is.patch
@@ -50809,6 +50818,7 @@
patches.suse/ceph-just-skip-unrecognized-info-in-ceph_reply_info_extra.patch
patches.suse/filldir-remove-WARN_ON_ONCE-for-bad-directory-entries.patch
patches.suse/0001-md-raid0-fix-warning-message-for-parameter-default_l.patch
+ patches.suse/ocfs2-fix-panic-due-to-ocfs2_wq-is-null.patch
patches.suse/net-dsa-b53-Do-not-clear-existing-mirrored-port-mask.patch
patches.suse/net_sched-fix-backward-compatibility-for-TCA_ACT_KIN.patch
patches.suse/NFC-pn533-fix-use-after-free-and-memleaks.patch
@@ -50936,6 +50946,7 @@
patches.suse/ceph-add-missing-check-in-d_revalidate-snapdir-handling.patch
patches.suse/ceph-don-t-try-to-handle-hashed-dentries-in-non-o_creat-atomic_open.patch
patches.suse/pwm-bcm-iproc-Prevent-unloading-the-driver-module-wh.patch
+ patches.suse/cgroup-writeback-don-t-switch-wbs-immediately-on-dea.patch
patches.suse/dccp-do-not-leak-jiffies-on-the-wire.patch
patches.suse/can-gs_usb-gs_can_open-prevent-memory-leak.patch
patches.suse/can-mcba_usb-fix-use-after-free-on-disconnect.patch
@@ -50996,6 +51007,8 @@
patches.suse/Input-synaptics-rmi4-disable-the-relative-position-I.patch
patches.suse/Input-synaptics-rmi4-do-not-consume-more-data-than-w.patch
patches.suse/Input-synaptics-rmi4-clear-IRQ-enables-for-F54.patch
+ patches.suse/ecryptfs_lookup_interpose-lower_dentry-d_inode-is-no.patch
+ patches.suse/ecryptfs_lookup_interpose-lower_dentry-d_parent-is-n.patch
patches.suse/drm-i915-gvt-fix-dropping-obj-reference-twice.patch
patches.suse/ALSA-usb-audio-Fix-missing-error-check-at-mixer-reso.patch
patches.suse/ALSA-hda-Add-Cometlake-S-PCI-ID.patch
@@ -51025,6 +51038,8 @@
patches.suse/0001-virtio_ring-fix-return-code-on-DMA-mapping-fails.patch
patches.suse/virtio_console-allocate-inbufs-in-add_port-only-if-i.patch
patches.suse/tpm-add-check-after-commands-attribs-tab-allocation.patch
+ patches.suse/loop-fix-no-unmap-write-zeroes-request-behavior.patch
+ patches.suse/nbd-prevent-memory-leak.patch
patches.suse/mtd-spear_smi-Fix-Write-Burst-mode.patch
patches.suse/mtd-spi-nor-fix-silent-truncation-in-spi_nor_read.patch
patches.suse/s390-mm-properly-clear-page_noexec-bit-when-it-is-not-supported
@@ -51032,6 +51047,8 @@
patches.suse/kvm-svm-guard-against-deactivate-when-performing-wbinvd-df_flush.patch
patches.suse/kvm-x86-introduce-vcpu-arch-xsaves_enabled
patches.suse/kvm-vmx-fix-conditions-for-guest-ia32_xss-support
+ patches.suse/edac-ghes-fix-locking-and-memory-barrier-issues.patch
+ patches.suse/edac-ghes-do-not-warn-when-incrementing-refcount-on-0.patch
patches.suse/livepatch-keep-replaced-patches-until-post_patch-callback-is-called.patch
patches.suse/livepatch-basic-api-to-track-system-state-changes.patch
patches.suse/livepatch-allow-to-distinguish-different-version-of-system-state-changes.patch
@@ -51061,6 +51078,7 @@
patches.suse/0001-Bluetooth-Fix-invalid-free-in-bcsp_close.patch
patches.suse/tun-fix-data-race-in-gro_normal_list.patch
patches.suse/ath10k-Correct-error-handling-of-dma_map_single.patch
+ patches.suse/0001-rt2800-remove-errornous-duplicate-condition.patch
patches.suse/rtlwifi-rtl8192de-Fix-missing-code-to-retrieve-RX-bu.patch
patches.suse/rtlwifi-rtl8192de-Fix-missing-enable-interrupt-flag.patch
patches.suse/mac80211-consider-QoS-Null-frames-for-STA_NULLFUNC_A.patch
@@ -51161,6 +51179,8 @@
patches.suse/drm-msm-fix-memleak-on-release.patch
patches.suse/drm-radeon-fix-bad-DMA-from-INTERRUPT_CNTL2.patch
patches.suse/drm-amdgpu-fix-bad-DMA-from-INTERRUPT_CNTL2.patch
+ patches.suse/iomap-Fix-pipe-page-leakage-during-splicing.patch
+ patches.suse/ext4-update-direct-I-O-read-lock-pattern-for-IOCB_NO.patch
patches.suse/CIFS-Fix-SMB2-oplock-break-processing.patch
patches.suse/cifs-move-cifsFileInfo_put-logic-into-a-work-queue.patch
patches.suse/powerpc-papr_scm-Fix-an-off-by-one-check-in-papr_scm.patch
@@ -51180,6 +51200,7 @@
patches.suse/gpio-mpc8xxx-Don-t-overwrite-default-irq_set_type-ca.patch
patches.suse/libnvdimm-export-the-target_node-attribute-for-regions-and-namespaces.patch
patches.suse/tipc-fix-wrong-timeout-input-for-tipc_wait_for_cond.patch
+ patches.suse/ocfs2-fix-passing-zero-to-PTR_ERR-warning.patch
patches.suse/scsi-lpfc-Fix-pt2pt-discovery-on-SLI3-HBAs.patch
patches.suse/scsi-lpfc-Fix-premature-re-enabling-of-interrupts-in.patch
patches.suse/scsi-lpfc-Fix-miss-of-register-read-failure-check.patch
@@ -51263,6 +51284,7 @@
patches.suse/scsi-lpfc-revise-nvme-max-queues-to-be-hdwq-count.patch
patches.suse/scsi-lpfc-Update-lpfc-version-to-12.6.0.2.patch
patches.suse/scsi-lpfc-use-hdwq-assigned-cpu-for-allocation.patch
+ patches.suse/xfs-Sanity-check-flags-of-Q_XQUOTARM-call.patch
patches.suse/PCI-pciehp-Do-not-disable-interrupt-twice-on-suspend.patch
patches.suse/ACPI-hotplug-PCI-Allocate-resources-directly-under-t.patch
patches.suse/PCI-PTM-Remove-spurious-d-from-granularity-message.patch