Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2018-10-30 07:05:11 +0100
committerKernel Build Daemon <kbuild@suse.de>2018-10-30 07:05:11 +0100
commitd809a9ce8eba704fbf51e88748aeaebb1e9bf5a9 (patch)
tree04a0b8213eff7f511b50471c51d17b1ed0aa07f6
parenteb7c9661954fa5b99c697b40f2b3a0a346ac1062 (diff)
parenta966b56f299a254b4ae9a32f356bb9762657eee6 (diff)
Merge branch 'SLE15' into openSUSE-15.0
-rw-r--r--blacklist.conf13
-rw-r--r--patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch39
-rw-r--r--patches.arch/powernv-pseries-consolidate-code-for-mce-early-handl.patch3
-rw-r--r--patches.arch/powerpc-fadump-re-register-firmware-assisted-dump-if.patch3
-rw-r--r--patches.arch/powerpc-mm-hugetlb-initialize-the-pagetable-cache-co.patch75
-rw-r--r--patches.arch/powerpc-pseries-Define-MCE-error-event-section.patch3
-rw-r--r--patches.arch/powerpc-pseries-Disable-CPU-hotplug-across-migration.patch3
-rw-r--r--patches.arch/powerpc-pseries-Display-machine-check-error-details.patch3
-rw-r--r--patches.arch/powerpc-pseries-Dump-the-SLB-contents-on-SLB-MCE-err.patch3
-rw-r--r--patches.arch/powerpc-pseries-Fix-OF-ERROR-Bad-of_node_put-on-cpus.patch102
-rw-r--r--patches.arch/powerpc-pseries-Fix-parent_dn-reference-leak-in-add_.patch18
-rw-r--r--patches.arch/powerpc-pseries-Flush-SLB-contents-on-SLB-MCE-errors.patch3
-rw-r--r--patches.arch/powerpc-pseries-Remove-prrn_work-workqueue.patch3
-rw-r--r--patches.arch/powerpc-pseries-Remove-unneeded-uses-of-dlpar-work-q.patch3
-rw-r--r--patches.arch/powerpc-pseries-mm-Introducing-FW_FEATURE_BLOCK_REMO.patch3
-rw-r--r--patches.arch/powerpc-pseries-mm-call-H_BLOCK_REMOVE.patch3
-rw-r--r--patches.arch/powerpc-pseries-mm-factorize-PTE-slot-computation.patch3
-rw-r--r--patches.arch/powerpc-pseries-remove-dlpar_attach_node-dependency-.patch92
-rw-r--r--patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch3
-rw-r--r--patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch5
-rw-r--r--patches.drivers/NFC-nfcmrvl_uart-fix-OF-child-node-lookup.patch50
-rw-r--r--patches.drivers/USB-serial-cypress_m8-fix-interrupt-out-transfer-len.patch38
-rw-r--r--patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID3
-rw-r--r--patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch3
-rw-r--r--patches.drivers/kernfs-update-comment-about-kernfs_path-return-value.patch43
-rw-r--r--patches.drivers/usb-chipidea-Prevent-unbalanced-IRQ-disable.patch39
-rw-r--r--patches.drivers/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch89
-rw-r--r--patches.drivers/usb-gadget-fsl_udc_core-fixup-struct_udc_setup-docum.patch45
-rw-r--r--patches.drivers/usbip-tools-fix-atoi-on-non-null-terminated-string.patch60
-rw-r--r--patches.fixes/0001-btrfs-Enhance-btrfs_trim_fs-function-to-handle-error.patch152
-rw-r--r--patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch3
-rw-r--r--patches.fixes/0001-drm-mediatek-fix-OF-sibling-node-lookup.patch59
-rw-r--r--patches.fixes/0001-drm-msm-fix-OF-child-node-lookup.patch56
-rw-r--r--patches.fixes/0001-of-add-helper-to-lookup-compatible-child-node.patch96
-rw-r--r--patches.fixes/0002-btrfs-Ensure-btrfs_trim_fs-can-trim-the-whole-filesy.patch104
-rw-r--r--patches.fixes/cdrom-fix-improper-type-cast-which-can-leat-to-infor.patch38
-rw-r--r--patches.suse/n_tty-fix-EXTPROC-vs-ICANON-interaction-with-TIOCINQ.patch2
-rw-r--r--patches.suse/rpmsg-Correct-support-for-MODULE_DEVICE_TABLE.patch52
-rw-r--r--patches.suse/tty-Hold-tty_ldisc_lock-during-tty_reopen.patch69
-rw-r--r--patches.suse/tty-Simplify-tty-count-math-in-tty_reopen.patch45
-rw-r--r--patches.suse/tty-fix-data-race-between-tty_init_dev-and-flush-of-.patch97
-rw-r--r--patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch81
-rw-r--r--patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch131
-rw-r--r--patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch38
-rw-r--r--patches.suse/tty-ldsem-Wake-up-readers-after-timed-out-down_write.patch54
-rw-r--r--series.conf42
46 files changed, 1799 insertions, 73 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 6923bbe93e..67d91d31f6 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -865,4 +865,15 @@ d3349b6b3c373ac1fbfb040b810fcee5e2adc7e0 # fixes WARN when machine runs OOM
a6795a585929d94ca3e931bc8518f8deb8bbe627 # vfs: reverted in below
f473bf92169633719acc3b43617c1dd20107770a # vfs: reverting (in stable-4.14.y)
fe782affd0f440a4e60e2cc81b8f2eccb2923113 # rpmsg: reverted in below
-13d216167d3d89d882b264857fe1d14c95da1490 # rpmsg: reverting (in stable-4.14.y) \ No newline at end of file
+13d216167d3d89d882b264857fe1d14c95da1490 # rpmsg: reverting (in stable-4.14.y)
+573e1784817ca1f13d76a0df636929e983e5de3c # Cleanup
+078d5039a13dedbd2ed14153a6d764fd75baae07 # Cleanup, kABI incompatible
+df16aaac26e92e97ab7234d3f93c953466adc4b5 # fix for clang
+ae6b289a37890909fea0e4a1666e19377fa0ed2c # fix for clang
+0e410e158e5baa1300bdf678cea4f4e0cf9d8b94 # fix for clang
+0a5f41767444cc3b4fc5573921ab914b4f78baaa # fix for clang
+87e0d4f0f37fb0c8c4aeeac46fff5e957738df79 # fix for clang
+b8fe1120b4ba342b4f156d24e952d6e686b20298 # typo fix
+747df19747bc9752cd40b9cce761e17a033aa5c2 # asoc: sta32x: need a prerequisite commit that breaks kABI
+d52e4d0c0c428bf2ba35074a7495cdb28e2efbae # usb: gadget: need a prerequisite commit that breaks kABI
+af424a410749ed7e0c2bffd3cedbc7c274d0ff6f # usb: dwc2: breaks kABI
diff --git a/patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch b/patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch
index f44e20d285..52f00e430e 100644
--- a/patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch
+++ b/patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch
@@ -18,10 +18,10 @@ Acked-by: Michal Suchanek <msuchanek@suse.de>
1 file changed, 40 insertions(+), 31 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
-index 83a551cfa575..47719274b21f 100644
+index 4d2328fb569d..b94d881eab7a 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
-@@ -434,7 +434,7 @@ static bool valid_cpu_drc_index(struct device_node *parent, u32 drc_index)
+@@ -432,7 +432,7 @@ static bool valid_cpu_drc_index(struct device_node *parent, u32 drc_index)
return found;
}
@@ -30,7 +30,7 @@ index 83a551cfa575..47719274b21f 100644
{
struct device_node *dn, *parent;
int rc, saved_rc;
-@@ -459,12 +459,14 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
+@@ -457,19 +457,22 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
return -EINVAL;
}
@@ -51,17 +51,16 @@ index 83a551cfa575..47719274b21f 100644
}
dn = dlpar_configure_connector(cpu_to_be32(drc_index), parent);
-@@ -472,7 +474,8 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
if (!dn) {
pr_warn("Failed call to configure-connector, drc index: %x\n",
drc_index);
- dlpar_release_drc(drc_index);
+ if (acquire_drc)
+ dlpar_release_drc(drc_index);
+ of_node_put(parent);
return -EINVAL;
}
-
-@@ -482,9 +485,11 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
+@@ -484,9 +487,11 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
pr_warn("Failed to attach node %s, rc: %d, drc index: %x\n",
dn->name, rc, drc_index);
@@ -76,7 +75,7 @@ index 83a551cfa575..47719274b21f 100644
return saved_rc;
}
-@@ -496,7 +501,7 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
+@@ -498,7 +503,7 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
dn->name, rc, drc_index);
rc = dlpar_detach_node(dn);
@@ -85,7 +84,7 @@ index 83a551cfa575..47719274b21f 100644
dlpar_release_drc(drc_index);
return saved_rc;
-@@ -564,7 +569,8 @@ static int dlpar_offline_cpu(struct device_node *dn)
+@@ -566,7 +571,8 @@ static int dlpar_offline_cpu(struct device_node *dn)
}
@@ -95,7 +94,7 @@ index 83a551cfa575..47719274b21f 100644
{
int rc;
-@@ -577,12 +583,14 @@ static ssize_t dlpar_cpu_remove(struct device_node *dn, u32 drc_index)
+@@ -579,12 +585,14 @@ static ssize_t dlpar_cpu_remove(struct device_node *dn, u32 drc_index)
return -EINVAL;
}
@@ -116,7 +115,7 @@ index 83a551cfa575..47719274b21f 100644
}
rc = dlpar_detach_node(dn);
-@@ -591,8 +599,9 @@ static ssize_t dlpar_cpu_remove(struct device_node *dn, u32 drc_index)
+@@ -593,8 +601,9 @@ static ssize_t dlpar_cpu_remove(struct device_node *dn, u32 drc_index)
pr_warn("Failed to detach CPU %s, rc: %d", dn->name, rc);
@@ -128,7 +127,7 @@ index 83a551cfa575..47719274b21f 100644
dlpar_online_cpu(dn);
return saved_rc;
-@@ -620,7 +629,7 @@ static struct device_node *cpu_drc_index_to_dn(u32 drc_index)
+@@ -622,7 +631,7 @@ static struct device_node *cpu_drc_index_to_dn(u32 drc_index)
return dn;
}
@@ -137,7 +136,7 @@ index 83a551cfa575..47719274b21f 100644
{
struct device_node *dn;
int rc;
-@@ -632,7 +641,7 @@ static int dlpar_cpu_remove_by_index(u32 drc_index)
+@@ -634,7 +643,7 @@ static int dlpar_cpu_remove_by_index(u32 drc_index)
return -ENODEV;
}
@@ -146,7 +145,7 @@ index 83a551cfa575..47719274b21f 100644
of_node_put(dn);
return rc;
}
-@@ -697,7 +706,7 @@ static int dlpar_cpu_remove_by_count(u32 cpus_to_remove)
+@@ -699,7 +708,7 @@ static int dlpar_cpu_remove_by_count(u32 cpus_to_remove)
}
for (i = 0; i < cpus_to_remove; i++) {
@@ -155,7 +154,7 @@ index 83a551cfa575..47719274b21f 100644
if (rc)
break;
-@@ -708,7 +717,7 @@ static int dlpar_cpu_remove_by_count(u32 cpus_to_remove)
+@@ -710,7 +719,7 @@ static int dlpar_cpu_remove_by_count(u32 cpus_to_remove)
pr_warn("CPU hot-remove failed, adding back removed CPUs\n");
for (i = 0; i < cpus_removed; i++)
@@ -164,7 +163,7 @@ index 83a551cfa575..47719274b21f 100644
rc = -EINVAL;
} else {
-@@ -778,7 +787,7 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
+@@ -780,7 +789,7 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
}
for (i = 0; i < cpus_to_add; i++) {
@@ -173,7 +172,7 @@ index 83a551cfa575..47719274b21f 100644
if (rc)
break;
-@@ -789,7 +798,7 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
+@@ -791,7 +800,7 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
pr_warn("CPU hot-add failed, removing any added CPUs\n");
for (i = 0; i < cpus_added; i++)
@@ -182,7 +181,7 @@ index 83a551cfa575..47719274b21f 100644
rc = -EINVAL;
} else {
-@@ -815,7 +824,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
+@@ -817,7 +826,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
if (hp_elog->id_type == PSERIES_HP_ELOG_ID_DRC_COUNT)
rc = dlpar_cpu_remove_by_count(count);
else if (hp_elog->id_type == PSERIES_HP_ELOG_ID_DRC_INDEX)
@@ -191,7 +190,7 @@ index 83a551cfa575..47719274b21f 100644
else
rc = -EINVAL;
break;
-@@ -823,7 +832,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
+@@ -825,7 +834,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
if (hp_elog->id_type == PSERIES_HP_ELOG_ID_DRC_COUNT)
rc = dlpar_cpu_add_by_count(count);
else if (hp_elog->id_type == PSERIES_HP_ELOG_ID_DRC_INDEX)
@@ -200,7 +199,7 @@ index 83a551cfa575..47719274b21f 100644
else
rc = -EINVAL;
break;
-@@ -848,7 +857,7 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
+@@ -850,7 +859,7 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
if (rc)
return -EINVAL;
@@ -209,7 +208,7 @@ index 83a551cfa575..47719274b21f 100644
return rc ? rc : count;
}
-@@ -869,7 +878,7 @@ static ssize_t dlpar_cpu_release(const char *buf, size_t count)
+@@ -871,7 +880,7 @@ static ssize_t dlpar_cpu_release(const char *buf, size_t count)
return -EINVAL;
}
diff --git a/patches.arch/powernv-pseries-consolidate-code-for-mce-early-handl.patch b/patches.arch/powernv-pseries-consolidate-code-for-mce-early-handl.patch
index a94d40264e..b294221def 100644
--- a/patches.arch/powernv-pseries-consolidate-code-for-mce-early-handl.patch
+++ b/patches.arch/powernv-pseries-consolidate-code-for-mce-early-handl.patch
@@ -4,8 +4,7 @@ Date: Tue, 11 Sep 2018 19:57:23 +0530
Subject: [PATCH 5/7] powernv/pseries: consolidate code for mce early handling.
References: bsc#1094244
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: db7d31ac04133fc18893725d348fabf91d6e808e
Now that other platforms also implements real mode mce handler,
diff --git a/patches.arch/powerpc-fadump-re-register-firmware-assisted-dump-if.patch b/patches.arch/powerpc-fadump-re-register-firmware-assisted-dump-if.patch
index 5c946b2014..2a99a71cb8 100644
--- a/patches.arch/powerpc-fadump-re-register-firmware-assisted-dump-if.patch
+++ b/patches.arch/powerpc-fadump-re-register-firmware-assisted-dump-if.patch
@@ -5,8 +5,7 @@ Subject: [PATCH] powerpc/fadump: re-register firmware-assisted dump if already
registered
References: bsc#1108170, bsc#1108823
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: 0823c68b054bca9dc321adea829af5cf36afb30b
Firmware-Assisted Dump (FADump) needs to be registered again after any
diff --git a/patches.arch/powerpc-mm-hugetlb-initialize-the-pagetable-cache-co.patch b/patches.arch/powerpc-mm-hugetlb-initialize-the-pagetable-cache-co.patch
new file mode 100644
index 0000000000..af103ba272
--- /dev/null
+++ b/patches.arch/powerpc-mm-hugetlb-initialize-the-pagetable-cache-co.patch
@@ -0,0 +1,75 @@
+From 6fa504835d6969144b2bd3699684dd447c789ba2 Mon Sep 17 00:00:00 2001
+From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
+Date: Fri, 30 Mar 2018 17:34:08 +0530
+Subject: [PATCH] powerpc/mm/hugetlb: initialize the pagetable cache correctly
+ for hugetlb
+
+References: bsc#1091800
+Patch-mainline: v4.17-rc1
+Git-commit: 6fa504835d6969144b2bd3699684dd447c789ba2
+
+With 64k page size, we have hugetlb pte entries at the pmd and pud level for
+book3s64. We don't need to create a separate page table cache for that. With 4k
+we need to make sure hugepd page table cache for 16M is placed at PUD level
+and 16G at the PGD level.
+
+Simplify all these by not using HUGEPD_PD_SHIFT which is confusing for book3s64.
+
+Without this patch, with 64k page size we create pagetable caches with shift
+value 10 and 7 which are not used at all.
+
+Fixes: 419df06eea5b ("powerpc: Reduce the PTE_INDEX_SIZE")
+
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/mm/hugetlbpage.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
+index f4153f21d214..99cf86096970 100644
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -122,9 +122,6 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t *hpdp,
+ #if defined(CONFIG_PPC_FSL_BOOK3E) || defined(CONFIG_PPC_8xx)
+ #define HUGEPD_PGD_SHIFT PGDIR_SHIFT
+ #define HUGEPD_PUD_SHIFT PUD_SHIFT
+-#else
+-#define HUGEPD_PGD_SHIFT PUD_SHIFT
+-#define HUGEPD_PUD_SHIFT PMD_SHIFT
+ #endif
+
+ /*
+@@ -670,15 +667,26 @@ static int __init hugetlbpage_init(void)
+
+ shift = mmu_psize_to_shift(psize);
+
+- if (add_huge_page_size(1ULL << shift) < 0)
++#ifdef CONFIG_PPC_BOOK3S_64
++ if (shift > PGDIR_SHIFT)
+ continue;
+-
++ else if (shift > PUD_SHIFT)
++ pdshift = PGDIR_SHIFT;
++ else if (shift > PMD_SHIFT)
++ pdshift = PUD_SHIFT;
++ else
++ pdshift = PMD_SHIFT;
++#else
+ if (shift < HUGEPD_PUD_SHIFT)
+ pdshift = PMD_SHIFT;
+ else if (shift < HUGEPD_PGD_SHIFT)
+ pdshift = PUD_SHIFT;
+ else
+ pdshift = PGDIR_SHIFT;
++#endif
++
++ if (add_huge_page_size(1ULL << shift) < 0)
++ continue;
+ /*
+ * if we have pdshift and shift value same, we don't
+ * use pgt cache for hugepd.
+--
+2.13.7
+
diff --git a/patches.arch/powerpc-pseries-Define-MCE-error-event-section.patch b/patches.arch/powerpc-pseries-Define-MCE-error-event-section.patch
index 006175715c..b7279356fd 100644
--- a/patches.arch/powerpc-pseries-Define-MCE-error-event-section.patch
+++ b/patches.arch/powerpc-pseries-Define-MCE-error-event-section.patch
@@ -4,8 +4,7 @@ Date: Tue, 11 Sep 2018 19:56:52 +0530
Subject: [PATCH 1/7] powerpc/pseries: Define MCE error event section.
References: bsc#1094244
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: 04fce21c9db54695389200b50b0b7a7866232ba6
On pseries, the machine check error details are part of RTAS extended
diff --git a/patches.arch/powerpc-pseries-Disable-CPU-hotplug-across-migration.patch b/patches.arch/powerpc-pseries-Disable-CPU-hotplug-across-migration.patch
index 084a642a56..7d4ae949f8 100644
--- a/patches.arch/powerpc-pseries-Disable-CPU-hotplug-across-migration.patch
+++ b/patches.arch/powerpc-pseries-Disable-CPU-hotplug-across-migration.patch
@@ -4,8 +4,7 @@ Date: Mon, 17 Sep 2018 14:14:02 -0500
Subject: [PATCH] powerpc/pseries: Disable CPU hotplug across migrations
References: bsc#1065729
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: 85a88cabad57d26d826dd94ea34d3a785824d802
When performing partition migrations all present CPUs must be online
diff --git a/patches.arch/powerpc-pseries-Display-machine-check-error-details.patch b/patches.arch/powerpc-pseries-Display-machine-check-error-details.patch
index de2b9ad5a7..3ca1ddcf23 100644
--- a/patches.arch/powerpc-pseries-Display-machine-check-error-details.patch
+++ b/patches.arch/powerpc-pseries-Display-machine-check-error-details.patch
@@ -4,8 +4,7 @@ Date: Tue, 11 Sep 2018 19:57:07 +0530
Subject: [PATCH 3/7] powerpc/pseries: Display machine check error details.
References: bsc#1094244
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: 8f0b80561f217e3f379d7819a6c6b429bebdaea6
Extract the MCE error details from RTAS extended log and display it to
diff --git a/patches.arch/powerpc-pseries-Dump-the-SLB-contents-on-SLB-MCE-err.patch b/patches.arch/powerpc-pseries-Dump-the-SLB-contents-on-SLB-MCE-err.patch
index 3ccdbab62d..53eb8d2f51 100644
--- a/patches.arch/powerpc-pseries-Dump-the-SLB-contents-on-SLB-MCE-err.patch
+++ b/patches.arch/powerpc-pseries-Dump-the-SLB-contents-on-SLB-MCE-err.patch
@@ -4,8 +4,7 @@ Date: Tue, 11 Sep 2018 19:57:15 +0530
Subject: [PATCH 4/7] powerpc/pseries: Dump the SLB contents on SLB MCE errors.
References: bsc#1094244
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: c6d15258cdf1c197cad7b11b9848e79068dd21e0
If we get a machine check exceptions due to SLB errors then dump the
diff --git a/patches.arch/powerpc-pseries-Fix-OF-ERROR-Bad-of_node_put-on-cpus.patch b/patches.arch/powerpc-pseries-Fix-OF-ERROR-Bad-of_node_put-on-cpus.patch
new file mode 100644
index 0000000000..9f4ac5ca9d
--- /dev/null
+++ b/patches.arch/powerpc-pseries-Fix-OF-ERROR-Bad-of_node_put-on-cpus.patch
@@ -0,0 +1,102 @@
+From 087ff6a5ae3052bb2835e191094b793789cb8817 Mon Sep 17 00:00:00 2001
+From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Date: Wed, 20 Sep 2017 17:02:51 -0400
+Subject: [PATCH] powerpc/pseries: Fix "OF: ERROR: Bad of_node_put() on /cpus"
+ during DLPAR
+
+References: FATE#326628, bsc#1113295
+Patch-mainline: v4.14-rc2
+Git-commit: 087ff6a5ae3052bb2835e191094b793789cb8817
+
+Commit 215ee763f8cb ("powerpc: pseries: remove dlpar_attach_node
+dependency on full path") reworked dlpar_attach_node() to no longer
+look up the parent node "/cpus", but instead to have the parent node
+passed by the caller in the function parameter list.
+
+As a result dlpar_attach_node() is no longer responsible for freeing
+the reference to the parent node. However, commit 215ee763f8cb failed
+to remove the of_node_put(parent) call in dlpar_attach_node(), or to
+take into account that the reference to the parent in the caller
+dlpar_cpu_add() needs to be held until after dlpar_attach_node()
+returns.
+
+As a result doing repeated cpu add/remove dlpar operations will
+eventually result in the following error:
+
+ OF: ERROR: Bad of_node_put() on /cpus
+ CPU: 0 PID: 10896 Comm: drmgr Not tainted 4.13.0-autotest #1
+ Call Trace:
+ dump_stack+0x15c/0x1f8 (unreliable)
+ of_node_release+0x1a4/0x1c0
+ kobject_put+0x1a8/0x310
+ kobject_del+0xbc/0xf0
+ __of_detach_node_sysfs+0x144/0x210
+ of_detach_node+0xf0/0x180
+ dlpar_detach_node+0xc4/0x120
+ dlpar_cpu_remove+0x280/0x560
+ dlpar_cpu_release+0xbc/0x1b0
+ arch_cpu_release+0x6c/0xb0
+ cpu_release_store+0xa0/0x100
+ dev_attr_store+0x68/0xa0
+ sysfs_kf_write+0xa8/0xf0
+ kernfs_fop_write+0x2cc/0x400
+ __vfs_write+0x5c/0x340
+ vfs_write+0x1a8/0x3d0
+ SyS_write+0xa8/0x1a0
+ system_call+0x58/0x6c
+
+Fix the issue by removing the of_node_put(parent) call from
+dlpar_attach_node(), and ensuring that the reference to the parent
+node is properly held and released by the caller dlpar_cpu_add().
+
+Fixes: 215ee763f8cb ("powerpc: pseries: remove dlpar_attach_node dependency on full path")
+Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Reported-by: Abdul Haleem <abdhalee@linux.vnet.ibm.com>
+[mpe: Add a comment in the code and frob the change log slightly]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/platforms/pseries/dlpar.c | 1 -
+ arch/powerpc/platforms/pseries/hotplug-cpu.c | 6 +++++-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 783f36364690..e45b5f10645a 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -266,7 +266,6 @@ int dlpar_attach_node(struct device_node *dn, struct device_node *parent)
+ return rc;
+ }
+
+- of_node_put(dn->parent);
+ return 0;
+ }
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index fc0d8f97c03a..fadb95efbb9e 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -462,15 +462,19 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
+ }
+
+ dn = dlpar_configure_connector(cpu_to_be32(drc_index), parent);
+- of_node_put(parent);
+ if (!dn) {
+ pr_warn("Failed call to configure-connector, drc index: %x\n",
+ drc_index);
+ dlpar_release_drc(drc_index);
++ of_node_put(parent);
+ return -EINVAL;
+ }
+
+ rc = dlpar_attach_node(dn, parent);
++
++ /* Regardless we are done with parent now */
++ of_node_put(parent);
++
+ if (rc) {
+ saved_rc = rc;
+ pr_warn("Failed to attach node %s, rc: %d, drc index: %x\n",
+--
+2.13.7
+
diff --git a/patches.arch/powerpc-pseries-Fix-parent_dn-reference-leak-in-add_.patch b/patches.arch/powerpc-pseries-Fix-parent_dn-reference-leak-in-add_.patch
index 1bbe857ab6..43cc459fc9 100644
--- a/patches.arch/powerpc-pseries-Fix-parent_dn-reference-leak-in-add_.patch
+++ b/patches.arch/powerpc-pseries-Fix-parent_dn-reference-leak-in-add_.patch
@@ -1,9 +1,12 @@
+From b537ca6fede69a281dc524983e5e633d79a10a08 Mon Sep 17 00:00:00 2001
From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Date: Wed, 20 Sep 2017 17:02:52 -0400
-Subject: powerpc/pseries: Fix parent_dn reference leak in add_dt_node()
+Subject: [PATCH] powerpc/pseries: Fix parent_dn reference leak in
+ add_dt_node()
+
+References: bsc#1065729
Patch-mainline: v4.14-rc2
Git-commit: b537ca6fede69a281dc524983e5e633d79a10a08
-References: bsc#1065729
A reference to the parent device node is held by add_dt_node() for the
node to be added. If the call to dlpar_configure_connector() fails
@@ -18,12 +21,14 @@ Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
- arch/powerpc/platforms/pseries/mobility.c | 4 +++-
+ arch/powerpc/platforms/pseries/mobility.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index 210ce632d63e..f7042ad492ba 100644
--- a/arch/powerpc/platforms/pseries/mobility.c
+++ b/arch/powerpc/platforms/pseries/mobility.c
-@@ -226,8 +226,10 @@ static int add_dt_node(__be32 parent_pha
+@@ -226,8 +226,10 @@ static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
return -ENOENT;
dn = dlpar_configure_connector(drc_index, parent_dn);
@@ -33,5 +38,8 @@ Acked-by: Michal Suchanek <msuchanek@suse.de>
return -ENOENT;
+ }
- rc = dlpar_attach_node(dn);
+ rc = dlpar_attach_node(dn, parent_dn);
if (rc)
+--
+2.13.7
+
diff --git a/patches.arch/powerpc-pseries-Flush-SLB-contents-on-SLB-MCE-errors.patch b/patches.arch/powerpc-pseries-Flush-SLB-contents-on-SLB-MCE-errors.patch
index 8ddb5fb9a0..1093397763 100644
--- a/patches.arch/powerpc-pseries-Flush-SLB-contents-on-SLB-MCE-errors.patch
+++ b/patches.arch/powerpc-pseries-Flush-SLB-contents-on-SLB-MCE-errors.patch
@@ -4,8 +4,7 @@ Date: Tue, 11 Sep 2018 19:57:00 +0530
Subject: [PATCH 2/7] powerpc/pseries: Flush SLB contents on SLB MCE errors.
References: bsc#1094244
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: a43c1590426c44a5c6bbaf51b70a36a5c6d86914
On pseries, as of today system crashes if we get a machine check
diff --git a/patches.arch/powerpc-pseries-Remove-prrn_work-workqueue.patch b/patches.arch/powerpc-pseries-Remove-prrn_work-workqueue.patch
index 529537cb22..81f8d3c207 100644
--- a/patches.arch/powerpc-pseries-Remove-prrn_work-workqueue.patch
+++ b/patches.arch/powerpc-pseries-Remove-prrn_work-workqueue.patch
@@ -4,8 +4,7 @@ Date: Mon, 10 Sep 2018 09:57:00 -0500
Subject: [PATCH] powerpc/pseries: Remove prrn_work workqueue
References: bsc#1102495, bsc#1109337
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: cd24e457fd8b2d087d9236700c8d2957054598bf
When a PRRN event is received we are already running in a worker
diff --git a/patches.arch/powerpc-pseries-Remove-unneeded-uses-of-dlpar-work-q.patch b/patches.arch/powerpc-pseries-Remove-unneeded-uses-of-dlpar-work-q.patch
index d141db2d7c..d808551d1c 100644
--- a/patches.arch/powerpc-pseries-Remove-unneeded-uses-of-dlpar-work-q.patch
+++ b/patches.arch/powerpc-pseries-Remove-unneeded-uses-of-dlpar-work-q.patch
@@ -4,8 +4,7 @@ Date: Mon, 10 Sep 2018 09:57:07 -0500
Subject: [PATCH] powerpc/pseries: Remove unneeded uses of dlpar work queue
References: bsc#1102495, bsc#1109337
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: fd12527a1da42dcb906b694e01794e8d438f7d10
There are three instances in which dlpar hotplug events are invoked;
diff --git a/patches.arch/powerpc-pseries-mm-Introducing-FW_FEATURE_BLOCK_REMO.patch b/patches.arch/powerpc-pseries-mm-Introducing-FW_FEATURE_BLOCK_REMO.patch
index c1ab0c648d..3f0fa36a97 100644
--- a/patches.arch/powerpc-pseries-mm-Introducing-FW_FEATURE_BLOCK_REMO.patch
+++ b/patches.arch/powerpc-pseries-mm-Introducing-FW_FEATURE_BLOCK_REMO.patch
@@ -4,8 +4,7 @@ Date: Mon, 20 Aug 2018 16:29:34 +0200
Subject: [PATCH 3/5] powerpc/pseries/mm: Introducing FW_FEATURE_BLOCK_REMOVE
References: bsc#1109158
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: 5600fbe340331e2a25d1b277f9c190f5c9948038
This feature tells if the hcall H_BLOCK_REMOVE is available.
diff --git a/patches.arch/powerpc-pseries-mm-call-H_BLOCK_REMOVE.patch b/patches.arch/powerpc-pseries-mm-call-H_BLOCK_REMOVE.patch
index 1133c8175c..9563f702f4 100644
--- a/patches.arch/powerpc-pseries-mm-call-H_BLOCK_REMOVE.patch
+++ b/patches.arch/powerpc-pseries-mm-call-H_BLOCK_REMOVE.patch
@@ -4,8 +4,7 @@ Date: Mon, 20 Aug 2018 16:29:36 +0200
Subject: [PATCH 5/5] powerpc/pseries/mm: call H_BLOCK_REMOVE
References: bsc#1109158
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: ba2dd8a26baa7e140555746d396e32952709c42d
This hypervisor's call allows to remove up to 8 ptes with only call to
diff --git a/patches.arch/powerpc-pseries-mm-factorize-PTE-slot-computation.patch b/patches.arch/powerpc-pseries-mm-factorize-PTE-slot-computation.patch
index cfb7e8414f..3de8058920 100644
--- a/patches.arch/powerpc-pseries-mm-factorize-PTE-slot-computation.patch
+++ b/patches.arch/powerpc-pseries-mm-factorize-PTE-slot-computation.patch
@@ -4,8 +4,7 @@ Date: Mon, 20 Aug 2018 16:29:35 +0200
Subject: [PATCH 4/5] powerpc/pseries/mm: factorize PTE slot computation
References: bsc#1109158
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: 0effa488dc1ad082ceed44b5d38c29fd8b3f259e
This part of code will be called also when dealing with H_BLOCK_REMOVE.
diff --git a/patches.arch/powerpc-pseries-remove-dlpar_attach_node-dependency-.patch b/patches.arch/powerpc-pseries-remove-dlpar_attach_node-dependency-.patch
new file mode 100644
index 0000000000..554672f938
--- /dev/null
+++ b/patches.arch/powerpc-pseries-remove-dlpar_attach_node-dependency-.patch
@@ -0,0 +1,92 @@
+From 215ee763f8cb9a2912d411f96f6f67a35d644c6b Mon Sep 17 00:00:00 2001
+From: Rob Herring <robh@kernel.org>
+Date: Mon, 21 Aug 2017 10:16:49 -0500
+Subject: [PATCH] powerpc: pseries: remove dlpar_attach_node dependency on full
+ path
+
+References: FATE#326628, bsc#1113295
+Patch-mainline: v4.14-rc1
+Git-commit: 215ee763f8cb9a2912d411f96f6f67a35d644c6b
+
+In preparation to stop storing the full node path in full_name, remove the
+dependency on full_name from dlpar_attach_node(). Callers of
+dlpar_attach_node() already have the parent device_node, so just pass the
+parent node into dlpar_attach_node instead of the path. This avoids doing
+a lookup of the parent node by the path.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: linuxppc-dev@lists.ozlabs.org
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/platforms/pseries/dlpar.c | 6 ++----
+ arch/powerpc/platforms/pseries/hotplug-cpu.c | 2 +-
+ arch/powerpc/platforms/pseries/mobility.c | 2 +-
+ arch/powerpc/platforms/pseries/pseries.h | 2 +-
+ 4 files changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 80b84c9c8509..783f36364690 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -254,13 +254,11 @@ struct device_node *dlpar_configure_connector(__be32 drc_index,
+ return first_dn;
+ }
+
+-int dlpar_attach_node(struct device_node *dn)
++int dlpar_attach_node(struct device_node *dn, struct device_node *parent)
+ {
+ int rc;
+
+- dn->parent = pseries_of_derive_parent(dn->full_name);
+- if (IS_ERR(dn->parent))
+- return PTR_ERR(dn->parent);
++ dn->parent = parent;
+
+ rc = of_attach_node(dn);
+ if (rc) {
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index 0a93093fbcef..b357f1ae0b0a 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -463,7 +463,7 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
+ return -EINVAL;
+ }
+
+- rc = dlpar_attach_node(dn);
++ rc = dlpar_attach_node(dn, parent);
+ if (rc) {
+ saved_rc = rc;
+ pr_warn("Failed to attach node %s, rc: %d, drc index: %x\n",
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index 2da4851eff99..210ce632d63e 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -229,7 +229,7 @@ static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
+ if (!dn)
+ return -ENOENT;
+
+- rc = dlpar_attach_node(dn);
++ rc = dlpar_attach_node(dn, parent_dn);
+ if (rc)
+ dlpar_free_cc_nodes(dn);
+
+diff --git a/arch/powerpc/platforms/pseries/pseries.h b/arch/powerpc/platforms/pseries/pseries.h
+index 1361a9db534b..4470a3194311 100644
+--- a/arch/powerpc/platforms/pseries/pseries.h
++++ b/arch/powerpc/platforms/pseries/pseries.h
+@@ -46,7 +46,7 @@ extern void dlpar_free_cc_nodes(struct device_node *);
+ extern void dlpar_free_cc_property(struct property *);
+ extern struct device_node *dlpar_configure_connector(__be32,
+ struct device_node *);
+-extern int dlpar_attach_node(struct device_node *);
++extern int dlpar_attach_node(struct device_node *, struct device_node *);
+ extern int dlpar_detach_node(struct device_node *);
+ extern int dlpar_acquire_drc(u32 drc_index);
+ extern int dlpar_release_drc(u32 drc_index);
+--
+2.13.7
+
diff --git a/patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch b/patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch
index 4d98c5c893..562f500352 100644
--- a/patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch
+++ b/patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch
@@ -5,8 +5,7 @@ Subject: [PATCH] powerpc/rtas: Fix a potential race between CPU-Offline &
Migration
References: bsc#1111870
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: dfd718a2ed1f678e66749ffe41bdeafedf3f4314
Live Partition Migrations require all the present CPUs to execute the
diff --git a/patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch b/patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch
index 61676d0cfe..6dc3669036 100644
--- a/patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch
+++ b/patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch
@@ -1,9 +1,8 @@
From: "Cho, Yu-Chen" <acho@suse.com>
Date: Tue, 2 Oct 2018 17:57:04 +0800
Subject: [PATCH] Bluetooth: btsdio: Do not bind to non-removable BCM43430
-Patch-mainline: Queued in subsystem maintainer repository
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
-Git-commit: 3c89f14043962fec1f3197e8b25a70cc0493ea3e
+Patch-mainline: v4.20-rc1
+Git-commit: 70ecdd3d8b36cd2bb960bc4e7ae047fbb94c031b
References: bsc#1103587
BCM43430 devices soldered onto the PCB (non-removable)
diff --git a/patches.drivers/NFC-nfcmrvl_uart-fix-OF-child-node-lookup.patch b/patches.drivers/NFC-nfcmrvl_uart-fix-OF-child-node-lookup.patch
new file mode 100644
index 0000000000..ad6ceeecf1
--- /dev/null
+++ b/patches.drivers/NFC-nfcmrvl_uart-fix-OF-child-node-lookup.patch
@@ -0,0 +1,50 @@
+From 5bf59773aaf36dd62117dc83d50e1bbf9ef432da Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 27 Aug 2018 10:21:52 +0200
+Subject: [PATCH] NFC: nfcmrvl_uart: fix OF child-node lookup
+Git-commit: 5bf59773aaf36dd62117dc83d50e1bbf9ef432da
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Use the new of_get_compatible_child() helper to lookup the nfc child
+node instead of using of_find_compatible_node(), which searches the
+entire tree from a given start node and thus can return an unrelated
+(i.e. non-child) node.
+
+This also addresses a potential use-after-free (e.g. after probe
+deferral) as the tree-wide helper drops a reference to its first
+argument (i.e. the parent node).
+
+Fixes: e097dc624f78 ("NFC: nfcmrvl: add UART driver")
+Fixes: d8e018c0b321 ("NFC: nfcmrvl: update device tree bindings for Marvell NFC")
+Cc: stable <stable@vger.kernel.org> # 4.2
+Cc: Vincent Cuissard <cuissard@marvell.com>
+Cc: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/nfc/nfcmrvl/uart.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nfc/nfcmrvl/uart.c b/drivers/nfc/nfcmrvl/uart.c
+index 91162f8e0366..9a22056e8d9e 100644
+--- a/drivers/nfc/nfcmrvl/uart.c
++++ b/drivers/nfc/nfcmrvl/uart.c
+@@ -73,10 +73,9 @@ static int nfcmrvl_uart_parse_dt(struct device_node *node,
+ struct device_node *matched_node;
+ int ret;
+
+- matched_node = of_find_compatible_node(node, NULL, "marvell,nfc-uart");
++ matched_node = of_get_compatible_child(node, "marvell,nfc-uart");
+ if (!matched_node) {
+- matched_node = of_find_compatible_node(node, NULL,
+- "mrvl,nfc-uart");
++ matched_node = of_get_compatible_child(node, "mrvl,nfc-uart");
+ if (!matched_node)
+ return -ENODEV;
+ }
+--
+2.19.1
+
diff --git a/patches.drivers/USB-serial-cypress_m8-fix-interrupt-out-transfer-len.patch b/patches.drivers/USB-serial-cypress_m8-fix-interrupt-out-transfer-len.patch
new file mode 100644
index 0000000000..6d4f1aae7d
--- /dev/null
+++ b/patches.drivers/USB-serial-cypress_m8-fix-interrupt-out-transfer-len.patch
@@ -0,0 +1,38 @@
+From 56445eef55cb5904096fed7a73cf87b755dfffc7 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Sun, 30 Sep 2018 18:03:11 +0200
+Subject: [PATCH] USB: serial: cypress_m8: fix interrupt-out transfer length
+Git-commit: 56445eef55cb5904096fed7a73cf87b755dfffc7
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Fix interrupt-out transfer length which was being set to the
+transfer-buffer length rather than the size of the outgoing packet.
+
+Note that no slab data was leaked as the whole transfer buffer is always
+cleared before each transfer.
+
+Fixes: 9aa8dae7b1fa ("cypress_m8: use usb_fill_int_urb where appropriate")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/cypress_m8.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
+index 31c6091be46a..5aaab8f4dd8f 100644
+--- a/drivers/usb/serial/cypress_m8.c
++++ b/drivers/usb/serial/cypress_m8.c
+@@ -769,7 +769,7 @@ static void cypress_send(struct usb_serial_port *port)
+
+ usb_fill_int_urb(port->interrupt_out_urb, port->serial->dev,
+ usb_sndintpipe(port->serial->dev, port->interrupt_out_endpointAddress),
+- port->interrupt_out_buffer, port->interrupt_out_size,
++ port->interrupt_out_buffer, actual_size,
+ cypress_write_int_callback, port, priv->write_urb_interval);
+ result = usb_submit_urb(port->interrupt_out_urb, GFP_ATOMIC);
+ if (result) {
+--
+2.19.1
+
diff --git a/patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID b/patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID
index 3cb898d43a..e5987270e9 100644
--- a/patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID
+++ b/patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID
@@ -6,8 +6,7 @@ Mime-version: 1.0
Content-type: text/plain; charset=UTF-8
Content-transfer-encoding: 8bit
Git-commit: d0e062ebb3a44b56a7e672da568334c76f763552
-Git-repo: git://anongit.freedesktop.org/drm-intel
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v4.20-rc1
References: FATE#322643
One more CFL ID added to spec.
diff --git a/patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch b/patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch
index b2143d5ef7..6f39bae9b4 100644
--- a/patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch
+++ b/patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch
@@ -3,8 +3,7 @@ From: Corey Minyard <cminyard@mvista.com>
Date: Thu, 23 Aug 2018 15:22:35 -0500
Subject: [PATCH] ipmi: Move BT capabilities detection to the detect call
Git-commit: c86ba91be75702c013bbf7379542920b6920e98f
-Git-repo: git://github.com/cminyard/linux-ipmi.git
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v4.19-rc4
References: bsc#1106779
[ backport note: dev_warn() & co are replaced with pr_warn() & co,
diff --git a/patches.drivers/kernfs-update-comment-about-kernfs_path-return-value.patch b/patches.drivers/kernfs-update-comment-about-kernfs_path-return-value.patch
new file mode 100644
index 0000000000..1e0ab8e3b5
--- /dev/null
+++ b/patches.drivers/kernfs-update-comment-about-kernfs_path-return-value.patch
@@ -0,0 +1,43 @@
+From 8f5be0ec23bb9ef3f96659c8dff1340b876600bf Mon Sep 17 00:00:00 2001
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Date: Mon, 13 Aug 2018 09:52:09 +0300
+Subject: [PATCH] kernfs: update comment about kernfs_path() return value
+Git-commit: 8f5be0ec23bb9ef3f96659c8dff1340b876600bf
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Now it returns the length of the full path or error code.
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Fixes: 3abb1d90f5d9 ("kernfs: make kernfs_path*() behave in the style of strlcpy()")
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/linux/kernfs.h | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h
+index 814643f7ee52..5b36b1287a5a 100644
+--- a/include/linux/kernfs.h
++++ b/include/linux/kernfs.h
+@@ -477,10 +477,11 @@ static inline void kernfs_init(void) { }
+ * @buf: buffer to copy @kn's name into
+ * @buflen: size of @buf
+ *
+- * Builds and returns the full path of @kn in @buf of @buflen bytes. The
+- * path is built from the end of @buf so the returned pointer usually
+- * doesn't match @buf. If @buf isn't long enough, @buf is nul terminated
+- * and %NULL is returned.
++ * If @kn is NULL result will be "(null)".
++ *
++ * Returns the length of the full path. If the full length is equal to or
++ * greater than @buflen, @buf contains the truncated path with the trailing
++ * '\0'. On error, -errno is returned.
+ */
+ static inline int kernfs_path(struct kernfs_node *kn, char *buf, size_t buflen)
+ {
+--
+2.19.1
+
diff --git a/patches.drivers/usb-chipidea-Prevent-unbalanced-IRQ-disable.patch b/patches.drivers/usb-chipidea-Prevent-unbalanced-IRQ-disable.patch
new file mode 100644
index 0000000000..ec17f95240
--- /dev/null
+++ b/patches.drivers/usb-chipidea-Prevent-unbalanced-IRQ-disable.patch
@@ -0,0 +1,39 @@
+From 8b97d73c4d72a2abf58f8e49062a7ee1e5f1334e Mon Sep 17 00:00:00 2001
+From: Loic Poulain <loic.poulain@linaro.org>
+Date: Tue, 4 Sep 2018 17:18:57 +0200
+Subject: [PATCH] usb: chipidea: Prevent unbalanced IRQ disable
+Git-commit: 8b97d73c4d72a2abf58f8e49062a7ee1e5f1334e
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The ChipIdea IRQ is disabled before scheduling the otg work and
+re-enabled on otg work completion. However if the job is already
+scheduled we have to undo the effect of disable_irq int order to
+balance the IRQ disable-depth value.
+
+Fixes: be6b0c1bd0be ("usb: chipidea: using one inline function to cover queue work operations")
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/chipidea/otg.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/chipidea/otg.h b/drivers/usb/chipidea/otg.h
+index 7e7428e48bfa..4f8b8179ec96 100644
+--- a/drivers/usb/chipidea/otg.h
++++ b/drivers/usb/chipidea/otg.h
+@@ -17,7 +17,8 @@ void ci_handle_vbus_change(struct ci_hdrc *ci);
+ static inline void ci_otg_queue_work(struct ci_hdrc *ci)
+ {
+ disable_irq_nosync(ci->irq);
+- queue_work(ci->wq, &ci->work);
++ if (queue_work(ci->wq, &ci->work) == false)
++ enable_irq(ci->irq);
+ }
+
+ #endif /* __DRIVERS_USB_CHIPIDEA_OTG_H */
+--
+2.19.1
+
diff --git a/patches.drivers/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch b/patches.drivers/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch
new file mode 100644
index 0000000000..df3d80c15f
--- /dev/null
+++ b/patches.drivers/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch
@@ -0,0 +1,89 @@
+From 4ab2b48c98f2ec9712452d520a381917f91ac3d2 Mon Sep 17 00:00:00 2001
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Thu, 30 Aug 2018 12:16:58 +0200
+Subject: [PATCH] usb: gadget: fsl_udc_core: check allocation return value and cleanup on failure
+Git-commit: 4ab2b48c98f2ec9712452d520a381917f91ac3d2
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The allocation with fsl_alloc_request() and kmalloc() were unchecked
+fixed this up with a NULL check and appropriate cleanup.
+
+Additionally udc->ep_qh_size was reset to 0 on failure of allocation.
+Similar udc->phy_mode is initially 0 (as udc_controller was
+allocated with kzalloc in fsl_udc_probe()) so reset it to 0 as well
+so that this function is side-effect free on failure. Not clear if
+this is necessary or sensible as fsl_udc_release() probably can not
+be called if fsl_udc_probe() failed - but it should not hurt.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: b504882da5 ("USB: add Freescale high-speed USB SOC device controller driver")
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/gadget/udc/fsl_udc_core.c | 30 ++++++++++++++++++++++++++----
+ 1 file changed, 26 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/udc/fsl_udc_core.c
++++ b/drivers/usb/gadget/udc/fsl_udc_core.c
+@@ -2264,8 +2264,10 @@ static int struct_udc_setup(struct fsl_u
+ udc->phy_mode = pdata->phy_mode;
+
+ udc->eps = kzalloc(sizeof(struct fsl_ep) * udc->max_ep, GFP_KERNEL);
+- if (!udc->eps)
+- return -1;
++ if (!udc->eps) {
++ ERR("kmalloc udc endpoint status failed\n");
++ goto eps_alloc_failed;
++ }
+
+ /* initialized QHs, take care of alignment */
+ size = udc->max_ep * sizeof(struct ep_queue_head);
+@@ -2279,8 +2281,7 @@ static int struct_udc_setup(struct fsl_u
+ &udc->ep_qh_dma, GFP_KERNEL);
+ if (!udc->ep_qh) {
+ ERR("malloc QHs for udc failed\n");
+- kfree(udc->eps);
+- return -1;
++ goto ep_queue_alloc_failed;
+ }
+
+ udc->ep_qh_size = size;
+@@ -2289,8 +2290,17 @@ static int struct_udc_setup(struct fsl_u
+ /* FIXME: fsl_alloc_request() ignores ep argument */
+ udc->status_req = container_of(fsl_alloc_request(NULL, GFP_KERNEL),
+ struct fsl_req, req);
++ if (!udc->status_req) {
++ ERR("kzalloc for udc status request failed\n");
++ goto udc_status_alloc_failed;
++ }
++
+ /* allocate a small amount of memory to get valid address */
+ udc->status_req->req.buf = kmalloc(8, GFP_KERNEL);
++ if (!udc->status_req->req.buf) {
++ ERR("kzalloc for udc request buffer failed\n");
++ goto udc_req_buf_alloc_failed;
++ }
+
+ udc->resume_state = USB_STATE_NOTATTACHED;
+ udc->usb_state = USB_STATE_POWERED;
+@@ -2298,6 +2308,18 @@ static int struct_udc_setup(struct fsl_u
+ udc->remote_wakeup = 0; /* default to 0 on reset */
+
+ return 0;
++
++udc_req_buf_alloc_failed:
++ kfree(udc->status_req);
++udc_status_alloc_failed:
++ kfree(udc->ep_qh);
++ udc->ep_qh_size = 0;
++ep_queue_alloc_failed:
++ kfree(udc->eps);
++eps_alloc_failed:
++ udc->phy_mode = 0;
++ return -1;
++
+ }
+
+ /*----------------------------------------------------------------
diff --git a/patches.drivers/usb-gadget-fsl_udc_core-fixup-struct_udc_setup-docum.patch b/patches.drivers/usb-gadget-fsl_udc_core-fixup-struct_udc_setup-docum.patch
new file mode 100644
index 0000000000..76d8495966
--- /dev/null
+++ b/patches.drivers/usb-gadget-fsl_udc_core-fixup-struct_udc_setup-docum.patch
@@ -0,0 +1,45 @@
+From 24b804e40f23a199e6d82de5b5571bb642490ca1 Mon Sep 17 00:00:00 2001
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Thu, 30 Aug 2018 12:16:59 +0200
+Subject: [PATCH] usb: gadget: fsl_udc_core: fixup struct_udc_setup documentation
+Git-commit: 24b804e40f23a199e6d82de5b5571bb642490ca1
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The original implementation from commit b504882da539
+("usb: add Freescale high-speed USB SOC device controller driver")
+returned NULL on failure and an allocated + initialized struct fsl_udc on
+success. The current code introduced in commit 4365831dadfe
+("usb: fsl_usb2_udc: Get max ep number from DCCPARAMS register") only
+provides partial initialization as well as returning 0 on success and -1
+on failures. The function documentation is updated accordingly.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: 4365831dadfe ("USB: fsl_usb2_udc: Get max ep number from DCCPARAMS register")
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/gadget/udc/fsl_udc_core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
+index 845dee3d93d6..20141c3096f6 100644
+--- a/drivers/usb/gadget/udc/fsl_udc_core.c
++++ b/drivers/usb/gadget/udc/fsl_udc_core.c
+@@ -2234,8 +2234,10 @@ static void fsl_udc_release(struct device *dev)
+ Internal structure setup functions
+ *******************************************************************/
+ /*------------------------------------------------------------------
+- * init resource for globle controller
+- * Return the udc handle on success or NULL on failure
++ * init resource for global controller called by fsl_udc_probe()
++ * On success the udc handle is initialized, on failure it is
++ * unchanged (reset).
++ * Return 0 on success and -1 on allocation failure
+ ------------------------------------------------------------------*/
+ static int struct_udc_setup(struct fsl_udc *udc,
+ struct platform_device *pdev)
+--
+2.19.1
+
diff --git a/patches.drivers/usbip-tools-fix-atoi-on-non-null-terminated-string.patch b/patches.drivers/usbip-tools-fix-atoi-on-non-null-terminated-string.patch
new file mode 100644
index 0000000000..49be769f0f
--- /dev/null
+++ b/patches.drivers/usbip-tools-fix-atoi-on-non-null-terminated-string.patch
@@ -0,0 +1,60 @@
+From e325808c0051b16729ffd472ff887c6cae5c6317 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 16 Oct 2018 19:03:43 +0100
+Subject: [PATCH] usbip: tools: fix atoi() on non-null terminated string
+Git-commit: e325808c0051b16729ffd472ff887c6cae5c6317
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Currently the call to atoi is being passed a single char string
+that is not null terminated, so there is a potential read overrun
+along the stack when parsing for an integer value. Fix this by
+instead using a 2 char string that is initialized to all zeros
+to ensure that a 1 char read into the string is always terminated
+with a \0.
+
+Detected by cppcheck:
+"Invalid atoi() argument nr 1. A nul-terminated string is required."
+
+Fixes: 3391ba0e2792 ("usbip: tools: Extract generic code to be shared with vudc backend")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ tools/usb/usbip/libsrc/usbip_host_common.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/usb/usbip/libsrc/usbip_host_common.c b/tools/usb/usbip/libsrc/usbip_host_common.c
+index dc93fadbee96..d79c7581b175 100644
+--- a/tools/usb/usbip/libsrc/usbip_host_common.c
++++ b/tools/usb/usbip/libsrc/usbip_host_common.c
+@@ -43,7 +43,7 @@ static int32_t read_attr_usbip_status(struct usbip_usb_device *udev)
+ int size;
+ int fd;
+ int length;
+- char status;
++ char status[2] = { 0 };
+ int value = 0;
+
+ size = snprintf(status_attr_path, sizeof(status_attr_path),
+@@ -61,14 +61,14 @@ static int32_t read_attr_usbip_status(struct usbip_usb_device *udev)
+ return -1;
+ }
+
+- length = read(fd, &status, 1);
++ length = read(fd, status, 1);
+ if (length < 0) {
+ err("error reading attribute %s", status_attr_path);
+ close(fd);
+ return -1;
+ }
+
+- value = atoi(&status);
++ value = atoi(status);
+
+ return value;
+ }
+--
+2.19.1
+
diff --git a/patches.fixes/0001-btrfs-Enhance-btrfs_trim_fs-function-to-handle-error.patch b/patches.fixes/0001-btrfs-Enhance-btrfs_trim_fs-function-to-handle-error.patch
new file mode 100644
index 0000000000..5c344d491f
--- /dev/null
+++ b/patches.fixes/0001-btrfs-Enhance-btrfs_trim_fs-function-to-handle-error.patch
@@ -0,0 +1,152 @@
+From 93bba24d4b5ad1e5cd8b43f64e66ff9d6355dd20 Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Fri, 7 Sep 2018 14:16:23 +0800
+Patch-mainline: v4.20
+Git-commit: 93bba24d4b5ad1e5cd8b43f64e66ff9d6355dd20
+References: Dependency for bsc#1113667
+Subject: [PATCH 1/2] btrfs: Enhance btrfs_trim_fs function to handle error
+ better
+
+Function btrfs_trim_fs() doesn't handle errors in a consistent way. If
+error happens when trimming existing block groups, it will skip the
+remaining blocks and continue to trim unallocated space for each device.
+
+The return value will only reflect the final error from device trimming.
+
+This patch will fix such behavior by:
+
+1) Recording the last error from block group or device trimming
+ The return value will also reflect the last error during trimming.
+ Make developer more aware of the problem.
+
+2) Continuing trimming if possible
+ If we failed to trim one block group or device, we could still try
+ the next block group or device.
+
+3) Report number of failures during block group and device trimming
+ It would be less noisy, but still gives user a brief summary of
+ what's going wrong.
+
+Such behavior can avoid confusion for cases like failure to trim the
+first block group and then only unallocated space is trimmed.
+
+Reported-by: Chris Murphy <lists@colorremedies.com>
+CC: stable@vger.kernel.org # 4.4+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ add bg_ret and dev_ret to the messages ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 49 ++++++++++++++++++++++++++++++++----------
+ 1 file changed, 38 insertions(+), 11 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 528f3308c32b..5dbb3f713125 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10833,6 +10833,15 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ return ret;
+ }
+
++/*
++ * Trim the whole filesystem by:
++ * 1) trimming the free space in each block group
++ * 2) trimming the unallocated space on each device
++ *
++ * This will also continue trimming even if a block group or device encounters
++ * an error. The return value will be the last error, or 0 if nothing bad
++ * happens.
++ */
+ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ {
+ struct btrfs_block_group_cache *cache = NULL;
+@@ -10843,6 +10852,10 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ u64 end;
+ u64 trimmed = 0;
+ u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
++ u64 bg_failed = 0;
++ u64 dev_failed = 0;
++ int bg_ret = 0;
++ int dev_ret = 0;
+ int ret = 0;
+
+ /*
+@@ -10853,7 +10866,7 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ else
+ cache = btrfs_lookup_block_group(fs_info, range->start);
+
+- while (cache) {
++ for (; cache; cache = next_block_group(fs_info, cache)) {
+ if (cache->key.objectid >= (range->start + range->len)) {
+ btrfs_put_block_group(cache);
+ break;
+@@ -10867,13 +10880,15 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ if (!block_group_cache_done(cache)) {
+ ret = cache_block_group(cache, 0);
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ ret = wait_block_group_cache_done(cache);
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ }
+ ret = btrfs_trim_block_group(cache,
+@@ -10884,28 +10899,40 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+
+ trimmed += group_trimmed;
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ }
+-
+- cache = next_block_group(fs_info, cache);
+ }
+
++ if (bg_failed)
++ btrfs_warn(fs_info,
++ "failed to trim %llu block group(s), last error %d",
++ bg_failed, bg_ret);
+ mutex_lock(&fs_info->fs_devices->device_list_mutex);
+ devices = &fs_info->fs_devices->alloc_list;
+ list_for_each_entry(device, devices, dev_alloc_list) {
+ ret = btrfs_trim_free_extents(device, range->minlen,
+ &group_trimmed);
+- if (ret)
++ if (ret) {
++ dev_failed++;
++ dev_ret = ret;
+ break;
++ }
+
+ trimmed += group_trimmed;
+ }
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+
++ if (dev_failed)
++ btrfs_warn(fs_info,
++ "failed to trim %llu device(s), last error %d",
++ dev_failed, dev_ret);
+ range->len = trimmed;
+- return ret;
++ if (bg_ret)
++ return bg_ret;
++ return dev_ret;
+ }
+
+ /*
+--
+2.19.1
+
diff --git a/patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch b/patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch
index 1d85348c12..64d4a6aff4 100644
--- a/patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch
+++ b/patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch
@@ -4,8 +4,7 @@ Date: Fri, 20 Jul 2018 12:48:02 +0200
Subject: drm/cirrus: Use drm_framebuffer_put to avoid kernel oops in clean-up
References: bsc#1101822
Git-commit: abf7b30d7f61d981bfcca65d1e8331b27021b475
-Git-repo: git://anongit.freedesktop.org/drm/drm-misc
-Patch-mainline: Queued for upstream in drm-misc-next
+Patch-mainline: v4.20-rc1
In the Cirrus driver, the regular clean-up code also performs the clean-up
of a failed initialization. If the fbdev's framebuffer was not initialized,
diff --git a/patches.fixes/0001-drm-mediatek-fix-OF-sibling-node-lookup.patch b/patches.fixes/0001-drm-mediatek-fix-OF-sibling-node-lookup.patch
new file mode 100644
index 0000000000..a31fe55c1e
--- /dev/null
+++ b/patches.fixes/0001-drm-mediatek-fix-OF-sibling-node-lookup.patch
@@ -0,0 +1,59 @@
+From ceff2f4dcd44abf35864d9a99f85ac619e89a01d Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 27 Aug 2018 10:21:46 +0200
+Subject: drm/mediatek: fix OF sibling-node lookup
+Git-commit: ceff2f4dcd44abf35864d9a99f85ac619e89a01d
+Patch-mainline: v4.19-rc2
+References: bsc#1106110
+
+Use the new of_get_compatible_child() helper to lookup the sibling
+instead of using of_find_compatible_node(), which searches the entire
+tree from a given start node and thus can return an unrelated (i.e.
+non-sibling) node.
+
+This also addresses a potential use-after-free (e.g. after probe
+deferral) as the tree-wide helper drops a reference to its first
+argument (i.e. the parent device node).
+
+While at it, also fix the related cec-node reference leak.
+
+Backporting notes:
+
+ * adapted patch to context changes in mtk_hdmi.c
+
+Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support")
+Cc: stable <stable@vger.kernel.org> # 4.8
+Cc: Junzhi Zhao <junzhi.zhao@mediatek.com>
+Cc: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: CK Hu <ck.hu@mediatek.com>
+Cc: David Airlie <airlied@linux.ie>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1447,8 +1447,7 @@ static int mtk_hdmi_dt_parse_pdata(struc
+ }
+
+ /* The CEC module handles HDMI hotplug detection */
+- cec_np = of_find_compatible_node(np->parent, NULL,
+- "mediatek,mt8173-cec");
++ cec_np = of_get_compatible_child(np->parent, "mediatek,mt8173-cec");
+ if (!cec_np) {
+ dev_err(dev, "Failed to find CEC node\n");
+ return -EINVAL;
+@@ -1458,8 +1457,10 @@ static int mtk_hdmi_dt_parse_pdata(struc
+ if (!cec_pdev) {
+ dev_err(hdmi->dev, "Waiting for CEC device %s\n",
+ cec_np->full_name);
++ of_node_put(cec_np);
+ return -EPROBE_DEFER;
+ }
++ of_node_put(cec_np);
+ hdmi->cec_dev = &cec_pdev->dev;
+
+ /*
diff --git a/patches.fixes/0001-drm-msm-fix-OF-child-node-lookup.patch b/patches.fixes/0001-drm-msm-fix-OF-child-node-lookup.patch
new file mode 100644
index 0000000000..3b0e0f217c
--- /dev/null
+++ b/patches.fixes/0001-drm-msm-fix-OF-child-node-lookup.patch
@@ -0,0 +1,56 @@
+From f9a7082327e26f54067a49cac2316d31e0cc8ba7 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 27 Aug 2018 10:21:47 +0200
+Subject: drm/msm: fix OF child-node lookup
+Git-commit: f9a7082327e26f54067a49cac2316d31e0cc8ba7
+Patch-mainline: v4.19-rc2
+References: bsc#1106110
+
+Use the new of_get_compatible_child() helper to lookup the legacy
+pwrlevels child node instead of using of_find_compatible_node(), which
+searches the entire tree from a given start node and thus can return an
+unrelated (i.e. non-child) node.
+
+This also addresses a potential use-after-free (e.g. after probe
+deferral) as the tree-wide helper drops a reference to its first
+argument (i.e. the probed device's node).
+
+While at it, also fix the related child-node reference leak.
+
+Backporting notes:
+
+ * apply changes in adreno_device.c
+
+Fixes: e2af8b6b0ca1 ("drm/msm: gpu: Use OPP tables if we can")
+Cc: stable <stable@vger.kernel.org> # 4.12
+Cc: Jordan Crouse <jcrouse@codeaurora.org>
+Cc: Rob Clark <robdclark@gmail.com>
+Cc: David Airlie <airlied@linux.ie>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/msm/adreno/adreno_device.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
+@@ -220,8 +220,7 @@ static int adreno_get_legacy_pwrlevels(s
+ struct device_node *child, *node;
+ int ret;
+
+- node = of_find_compatible_node(dev->of_node, NULL,
+- "qcom,gpu-pwrlevels");
++ node = of_get_compatible_child(dev->of_node, "qcom,gpu-pwrlevels");
+ if (!node) {
+ dev_err(dev, "Could not find the GPU powerlevels\n");
+ return -ENXIO;
+@@ -242,6 +241,8 @@ static int adreno_get_legacy_pwrlevels(s
+ dev_pm_opp_add(dev, val, 0);
+ }
+
++ of_node_put(node);
++
+ return 0;
+ }
+
diff --git a/patches.fixes/0001-of-add-helper-to-lookup-compatible-child-node.patch b/patches.fixes/0001-of-add-helper-to-lookup-compatible-child-node.patch
new file mode 100644
index 0000000000..469f7e5b5c
--- /dev/null
+++ b/patches.fixes/0001-of-add-helper-to-lookup-compatible-child-node.patch
@@ -0,0 +1,96 @@
+From 36156f9241cb0f9e37d998052873ca7501ad4b36 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 27 Aug 2018 10:21:45 +0200
+Subject: of: add helper to lookup compatible child node
+Git-commit: 36156f9241cb0f9e37d998052873ca7501ad4b36
+Patch-mainline: v4.19-rc1
+References: bsc#1106110
+
+Add of_get_compatible_child() helper that can be used to lookup
+compatible child nodes.
+
+Several drivers currently use of_find_compatible_node() to lookup child
+nodes while failing to notice that the of_find_ functions search the
+entire tree depth-first (from a given start node) and therefore can
+match unrelated nodes. The fact that these functions also drop a
+reference to the node they start searching from (e.g. the parent node)
+is typically also overlooked, something which can lead to use-after-free
+bugs.
+
+Backporting notes:
+
+ * backported for ceff3f4dcd44 and f9a7082327e2
+
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/of/base.c | 25 +++++++++++++++++++++++++
+ include/linux/of.h | 8 ++++++++
+ 2 files changed, 33 insertions(+)
+
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 466e3c8582f0..bc420d2aa5f5 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -719,6 +719,31 @@ struct device_node *of_get_next_available_child(const struct device_node *node,
+ }
+ EXPORT_SYMBOL(of_get_next_available_child);
+
++/**
++ * of_get_compatible_child - Find compatible child node
++ * @parent: parent node
++ * @compatible: compatible string
++ *
++ * Lookup child node whose compatible property contains the given compatible
++ * string.
++ *
++ * Returns a node pointer with refcount incremented, use of_node_put() on it
++ * when done; or NULL if not found.
++ */
++struct device_node *of_get_compatible_child(const struct device_node *parent,
++ const char *compatible)
++{
++ struct device_node *child;
++
++ for_each_child_of_node(parent, child) {
++ if (of_device_is_compatible(child, compatible))
++ break;
++ }
++
++ return child;
++}
++EXPORT_SYMBOL(of_get_compatible_child);
++
+ /**
+ * of_get_child_by_name - Find the child node by name for a given parent
+ * @node: parent node
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 4d25e4f952d9..b99a1a8c2952 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -290,6 +290,8 @@ extern struct device_node *of_get_next_child(const struct device_node *node,
+ extern struct device_node *of_get_next_available_child(
+ const struct device_node *node, struct device_node *prev);
+
++extern struct device_node *of_get_compatible_child(const struct device_node *parent,
++ const char *compatible);
+ extern struct device_node *of_get_child_by_name(const struct device_node *node,
+ const char *name);
+
+@@ -632,6 +634,12 @@ static inline bool of_have_populated_dt(void)
+ return false;
+ }
+
++static inline struct device_node *of_get_compatible_child(const struct device_node *parent,
++ const char *compatible)
++{
++ return NULL;
++}
++
+ static inline struct device_node *of_get_child_by_name(
+ const struct device_node *node,
+ const char *name)
+--
+2.19.1
+
diff --git a/patches.fixes/0002-btrfs-Ensure-btrfs_trim_fs-can-trim-the-whole-filesy.patch b/patches.fixes/0002-btrfs-Ensure-btrfs_trim_fs-can-trim-the-whole-filesy.patch
new file mode 100644
index 0000000000..e1dd1dd586
--- /dev/null
+++ b/patches.fixes/0002-btrfs-Ensure-btrfs_trim_fs-can-trim-the-whole-filesy.patch
@@ -0,0 +1,104 @@
+From 6ba9fc8e628becf0e3ec94083450d089b0dec5f5 Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Fri, 7 Sep 2018 14:16:24 +0800
+Patch-mainline: v4.20
+Git-commit: 6ba9fc8e628becf0e3ec94083450d089b0dec5f5
+References: bsc#1113667
+Subject: [PATCH 2/2] btrfs: Ensure btrfs_trim_fs can trim the whole filesystem
+
+[BUG]
+fstrim on some btrfs only trims the unallocated space, not trimming any
+space in existing block groups.
+
+[CAUSE]
+Before fstrim_range passed to btrfs_trim_fs(), it gets truncated to
+range [0, super->total_bytes). So later btrfs_trim_fs() will only be
+able to trim block groups in range [0, super->total_bytes).
+
+While for btrfs, any bytenr aligned to sectorsize is valid, since btrfs
+uses its logical address space, there is nothing limiting the location
+where we put block groups.
+
+For filesystem with frequent balance, it's quite easy to relocate all
+block groups and bytenr of block groups will start beyond
+super->total_bytes.
+
+In that case, btrfs will not trim existing block groups.
+
+[FIX]
+Just remove the truncation in btrfs_ioctl_fitrim(), so btrfs_trim_fs()
+can get the unmodified range, which is normally set to [0, U64_MAX].
+
+Reported-by: Chris Murphy <lists@colorremedies.com>
+Fixes: f4c697e6406d ("btrfs: return EINVAL if start > total_bytes in fitrim ioctl")
+CC: <stable@vger.kernel.org> # v4.4+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 10 +---------
+ fs/btrfs/ioctl.c | 11 +++++++----
+ 2 files changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 5dbb3f713125..da3257585e29 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10851,21 +10851,13 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ u64 start;
+ u64 end;
+ u64 trimmed = 0;
+- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
+ u64 bg_failed = 0;
+ u64 dev_failed = 0;
+ int bg_ret = 0;
+ int dev_ret = 0;
+ int ret = 0;
+
+- /*
+- * try to trim all FS space, our block group may start from non-zero.
+- */
+- if (range->len == total_bytes)
+- cache = btrfs_lookup_first_block_group(fs_info, range->start);
+- else
+- cache = btrfs_lookup_block_group(fs_info, range->start);
+-
++ cache = btrfs_lookup_first_block_group(fs_info, range->start);
+ for (; cache; cache = next_block_group(fs_info, cache)) {
+ if (cache->key.objectid >= (range->start + range->len)) {
+ btrfs_put_block_group(cache);
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 4905d13dee0a..a990a9045139 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -491,7 +491,6 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
+ struct fstrim_range range;
+ u64 minlen = ULLONG_MAX;
+ u64 num_devices = 0;
+- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
+ int ret;
+
+ if (!capable(CAP_SYS_ADMIN))
+@@ -515,11 +514,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
+ return -EOPNOTSUPP;
+ if (copy_from_user(&range, arg, sizeof(range)))
+ return -EFAULT;
+- if (range.start > total_bytes ||
+- range.len < fs_info->sb->s_blocksize)
++
++ /*
++ * NOTE: Don't truncate the range using super->total_bytes. Bytenr of
++ * block group is in the logical address space, which can be any
++ * sectorsize aligned bytenr in the range [0, U64_MAX].
++ */
++ if (range.len < fs_info->sb->s_blocksize)
+ return -EINVAL;
+
+- range.len = min(range.len, total_bytes - range.start);
+ range.minlen = max(range.minlen, minlen);
+ ret = btrfs_trim_fs(fs_info, &range);
+ if (ret < 0)
+--
+2.19.1
+
diff --git a/patches.fixes/cdrom-fix-improper-type-cast-which-can-leat-to-infor.patch b/patches.fixes/cdrom-fix-improper-type-cast-which-can-leat-to-infor.patch
new file mode 100644
index 0000000000..467a42aa35
--- /dev/null
+++ b/patches.fixes/cdrom-fix-improper-type-cast-which-can-leat-to-infor.patch
@@ -0,0 +1,38 @@
+From e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276 Mon Sep 17 00:00:00 2001
+From: Young_X <YangX92@hotmail.com>
+Date: Wed, 3 Oct 2018 12:54:29 +0000
+Subject: [PATCH] cdrom: fix improper type cast, which can leat to information leak.
+Git-commit: e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276
+Patch-mainline: v4.20-rc1
+References: CVE-2018-18710,bsc#1113751
+
+There is another cast from unsigned long to int which causes
+a bounds check to fail with specially crafted input. The value is
+then used as an index in the slot array in cdrom_slot_status().
+
+This issue is similar to CVE-2018-16658 and CVE-2018-10940.
+
+Signed-off-by: Young_X <YangX92@hotmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cdrom/cdrom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index a5d5a96479bf..10802d1fc554 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2445,7 +2445,7 @@ static int cdrom_ioctl_select_disc(struct cdrom_device_info *cdi,
+ return -ENOSYS;
+
+ if (arg != CDSL_CURRENT && arg != CDSL_NONE) {
+- if ((int)arg >= cdi->capacity)
++ if (arg >= cdi->capacity)
+ return -EINVAL;
+ }
+
+--
+2.19.1
+
diff --git a/patches.suse/n_tty-fix-EXTPROC-vs-ICANON-interaction-with-TIOCINQ.patch b/patches.suse/n_tty-fix-EXTPROC-vs-ICANON-interaction-with-TIOCINQ.patch
index 003a9307aa..ac0bc4dca9 100644
--- a/patches.suse/n_tty-fix-EXTPROC-vs-ICANON-interaction-with-TIOCINQ.patch
+++ b/patches.suse/n_tty-fix-EXTPROC-vs-ICANON-interaction-with-TIOCINQ.patch
@@ -3,7 +3,7 @@ Date: Wed, 20 Dec 2017 17:57:06 -0800
Subject: n_tty: fix EXTPROC vs ICANON interaction with TIOCINQ (aka FIONREAD)
Git-commit: 966031f340185eddd05affcf72b740549f056348
Patch-mainline: v4.15-rc6
-References: bnc#1094825 CVE-2018-18386
+References: bnc#1094825 bnc#1094825 bnc#1110711 CVE-2018-18386
We added support for EXTPROC back in 2010 in commit 26df6d13406d ("tty:
Add EXTPROC support for LINEMODE") and the intent was to allow it to
diff --git a/patches.suse/rpmsg-Correct-support-for-MODULE_DEVICE_TABLE.patch b/patches.suse/rpmsg-Correct-support-for-MODULE_DEVICE_TABLE.patch
new file mode 100644
index 0000000000..eaa580ada5
--- /dev/null
+++ b/patches.suse/rpmsg-Correct-support-for-MODULE_DEVICE_TABLE.patch
@@ -0,0 +1,52 @@
+From: "Andrew F. Davis" <afd@ti.com>
+Date: Sat, 21 Apr 2018 18:55:29 -0500
+Subject: rpmsg: Correct support for MODULE_DEVICE_TABLE()
+Git-commit: 5b7d127726de6eed4b900bc3bbb167837690818f
+Patch-mainline: v4.18-rc1
+References: git-fixes
+
+Due to missing a missing entry in file2alias.c MODULE_DEVICE_TABLE() are
+not generating the proper module aliases. Add the needed entry here.
+
+Fixes: bcabbccabffe ("rpmsg: add virtio-based remote processor messaging bus")
+Reported-by: Suman Anna <s-anna@ti.com>
+Signed-off-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ scripts/mod/devicetable-offsets.c | 3 +++
+ scripts/mod/file2alias.c | 11 +++++++++++
+ 2 files changed, 14 insertions(+)
+
+--- a/scripts/mod/devicetable-offsets.c
++++ b/scripts/mod/devicetable-offsets.c
+@@ -138,6 +138,9 @@ int main(void)
+ DEVID(hv_vmbus_device_id);
+ DEVID_FIELD(hv_vmbus_device_id, guid);
+
++ DEVID(rpmsg_device_id);
++ DEVID_FIELD(rpmsg_device_id, name);
++
+ DEVID(i2c_device_id);
+ DEVID_FIELD(i2c_device_id, name);
+
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -944,6 +944,17 @@ static int do_vmbus_entry(const char *fi
+ }
+ ADD_TO_DEVTABLE("vmbus", hv_vmbus_device_id, do_vmbus_entry);
+
++/* Looks like: rpmsg:S */
++static int do_rpmsg_entry(const char *filename, void *symval,
++ char *alias)
++{
++ DEF_FIELD_ADDR(symval, rpmsg_device_id, name);
++ sprintf(alias, RPMSG_DEVICE_MODALIAS_FMT, *name);
++
++ return 1;
++}
++ADD_TO_DEVTABLE("rpmsg", rpmsg_device_id, do_rpmsg_entry);
++
+ /* Looks like: i2c:S */
+ static int do_i2c_entry(const char *filename, void *symval,
+ char *alias)
diff --git a/patches.suse/tty-Hold-tty_ldisc_lock-during-tty_reopen.patch b/patches.suse/tty-Hold-tty_ldisc_lock-during-tty_reopen.patch
new file mode 100644
index 0000000000..56a77e0543
--- /dev/null
+++ b/patches.suse/tty-Hold-tty_ldisc_lock-during-tty_reopen.patch
@@ -0,0 +1,69 @@
+From: Dmitry Safonov <dima@arista.com>
+Date: Tue, 18 Sep 2018 00:52:54 +0100
+Subject: tty: Hold tty_ldisc_lock() during tty_reopen()
+Patch-mainline: Submitted on 2018/09/18
+References: bnc#1105428
+
+tty_ldisc_reinit() doesn't race with neither tty_ldisc_hangup()
+nor set_ldisc() nor tty_ldisc_release() as they use tty lock.
+But it races with anyone who expects line discipline to be the same
+after hoding read semaphore in tty_ldisc_ref().
+
+We've seen the following crash on v4.9.108 stable:
+
+BUG: unable to handle kernel paging request at 0000000000002260
+IP: [..] n_tty_receive_buf_common+0x5f/0x86d
+Workqueue: events_unbound flush_to_ldisc
+Call Trace:
+ [..] n_tty_receive_buf2
+ [..] tty_ldisc_receive_buf
+ [..] flush_to_ldisc
+ [..] process_one_work
+ [..] worker_thread
+ [..] kthread
+ [..] ret_from_fork
+
+tty_ldisc_reinit() should be called with ldisc_sem hold for writing,
+which will protect any reader against line discipline changes.
+
+Backport-first: b027e2298bd5 ("tty: fix data race between tty_init_dev
+and flush of buf")
+Cc: stable@vger.kernel.org
+
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Reviewed-by: Jiri Slaby <jslaby@suse.cz>
+Reported-by: syzbot+3aa9784721dfb90e984d@syzkaller.appspotmail.com
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Tested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_io.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1202,15 +1202,20 @@ static int tty_reopen(struct tty_struct
+ if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
+ return -EBUSY;
+
+- tty->count++;
++ retval = tty_ldisc_lock(tty, 5 * HZ);
++ if (retval)
++ return retval;
+
++ tty->count++;
+ if (tty->ldisc)
+- return 0;
++ goto out_unlock;
+
+ retval = tty_ldisc_reinit(tty, tty->termios.c_line);
+ if (retval)
+ tty->count--;
+
++out_unlock:
++ tty_ldisc_unlock(tty);
+ return retval;
+ }
+
diff --git a/patches.suse/tty-Simplify-tty-count-math-in-tty_reopen.patch b/patches.suse/tty-Simplify-tty-count-math-in-tty_reopen.patch
new file mode 100644
index 0000000000..10455330f1
--- /dev/null
+++ b/patches.suse/tty-Simplify-tty-count-math-in-tty_reopen.patch
@@ -0,0 +1,45 @@
+From: Dmitry Safonov <dima@arista.com>
+Date: Tue, 18 Sep 2018 00:52:55 +0100
+Subject: tty: Simplify tty->count math in tty_reopen()
+Patch-mainline: Submitted on 2018/09/18
+References: bnc#1105428
+
+As notted by Jiri, tty_ldisc_reinit() shouldn't rely on tty counter.
+Simplify math by increasing the counter after reinit success.
+
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Link: lkml.kernel.org/r/<20180829022353.23568-2-dima@arista.com>
+Suggested-by: Jiri Slaby <jslaby@suse.com>
+Reviewed-by: Jiri Slaby <jslaby@suse.cz>
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_io.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1206,16 +1206,13 @@ static int tty_reopen(struct tty_struct
+ if (retval)
+ return retval;
+
+- tty->count++;
+- if (tty->ldisc)
+- goto out_unlock;
++ if (!tty->ldisc)
++ retval = tty_ldisc_reinit(tty, tty->termios.c_line);
++ tty_ldisc_unlock(tty);
+
+- retval = tty_ldisc_reinit(tty, tty->termios.c_line);
+- if (retval)
+- tty->count--;
++ if (retval == 0)
++ tty->count++;
+
+-out_unlock:
+- tty_ldisc_unlock(tty);
+ return retval;
+ }
+
diff --git a/patches.suse/tty-fix-data-race-between-tty_init_dev-and-flush-of-.patch b/patches.suse/tty-fix-data-race-between-tty_init_dev-and-flush-of-.patch
new file mode 100644
index 0000000000..3f19a51aee
--- /dev/null
+++ b/patches.suse/tty-fix-data-race-between-tty_init_dev-and-flush-of-.patch
@@ -0,0 +1,97 @@
+From: Gaurav Kohli <gkohli@codeaurora.org>
+Date: Tue, 23 Jan 2018 13:16:34 +0530
+Subject: tty: fix data race between tty_init_dev and flush of buf
+Git-commit: b027e2298bd588d6fa36ed2eda97447fb3eac078
+Patch-mainline: v4.16-rc1
+References: bnc#1105428
+
+There can be a race, if receive_buf call comes before
+tty initialization completes in n_tty_open and tty->disc_data
+may be NULL.
+
+CPU0 CPU1
+---- ----
+ 000|n_tty_receive_buf_common() n_tty_open()
+-001|n_tty_receive_buf2() tty_ldisc_open.isra.3()
+-002|tty_ldisc_receive_buf(inline) tty_ldisc_setup()
+
+Using ldisc semaphore lock in tty_init_dev till disc_data
+initializes completely.
+
+Signed-off-by: Gaurav Kohli <gkohli@codeaurora.org>
+Reviewed-by: Alan Cox <alan@linux.intel.com>
+Cc: stable <stable@vger.kernel.org>
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_io.c | 8 +++++++-
+ drivers/tty/tty_ldisc.c | 4 ++--
+ include/linux/tty.h | 2 ++
+ 3 files changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1258,6 +1258,9 @@ struct tty_struct *tty_init_dev(struct t
+ "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
+ __func__, tty->driver->name);
+
++ retval = tty_ldisc_lock(tty, 5 * HZ);
++ if (retval)
++ goto err_release_lock;
+ tty->port->itty = tty;
+
+ /*
+@@ -1268,6 +1271,7 @@ struct tty_struct *tty_init_dev(struct t
+ retval = tty_ldisc_setup(tty, tty->link);
+ if (retval)
+ goto err_release_tty;
++ tty_ldisc_unlock(tty);
+ /* Return the tty locked so that it cannot vanish under the caller */
+ return tty;
+
+@@ -1280,9 +1284,11 @@ err_module_put:
+
+ /* call the tty release_tty routine to clean out this slot */
+ err_release_tty:
+- tty_unlock(tty);
++ tty_ldisc_unlock(tty);
+ tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
+ retval, idx);
++err_release_lock:
++ tty_unlock(tty);
+ release_tty(tty, idx);
+ return ERR_PTR(retval);
+ }
+--- a/drivers/tty/tty_ldisc.c
++++ b/drivers/tty/tty_ldisc.c
+@@ -336,7 +336,7 @@ static inline void __tty_ldisc_unlock(st
+ ldsem_up_write(&tty->ldisc_sem);
+ }
+
+-static int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout)
++int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout)
+ {
+ int ret;
+
+@@ -347,7 +347,7 @@ static int tty_ldisc_lock(struct tty_str
+ return 0;
+ }
+
+-static void tty_ldisc_unlock(struct tty_struct *tty)
++void tty_ldisc_unlock(struct tty_struct *tty)
+ {
+ clear_bit(TTY_LDISC_HALTED, &tty->flags);
+ __tty_ldisc_unlock(tty);
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -400,6 +400,8 @@ extern struct tty_struct *get_current_tt
+ /* tty_io.c */
+ extern int __init tty_init(void);
+ extern const char *tty_name(const struct tty_struct *tty);
++extern int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout);
++extern void tty_ldisc_unlock(struct tty_struct *tty);
+ #else
+ static inline void tty_kref_put(struct tty_struct *tty)
+ { }
diff --git a/patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch b/patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch
new file mode 100644
index 0000000000..535995a6d9
--- /dev/null
+++ b/patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch
@@ -0,0 +1,81 @@
+From: Dmitry Safonov <dima@arista.com>
+Date: Tue, 18 Sep 2018 00:52:57 +0100
+Subject: tty/ldsem: Add lockdep asserts for ldisc_sem
+Patch-mainline: Submitted on 2018/09/18
+References: bnc#1105428
+
+Make sure under CONFIG_LOCKDEP that each change to line discipline
+is done with held write semaphor.
+Otherwise potential reader will have a good time dereferencing
+incomplete/uninitialized ldisc.
+
+An exception here is tty_ldisc_open(), as it's called without ldisc_sem
+locked by tty_init_dev() => tty_ldisc_setup() for the tty->link.
+
+It seem valid as tty_init_dev() will call tty_driver_install_tty()
+which will find ops->install(). Install will establish tty->link in
+pty_common_install(), just after allocation of slave tty with
+alloc_tty_struct(). So, no one should have a reference to slave pty yet.
+
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_ldisc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/tty/tty_ldisc.c
++++ b/drivers/tty/tty_ldisc.c
+@@ -483,6 +483,7 @@ static int tty_ldisc_open(struct tty_str
+
+ static void tty_ldisc_close(struct tty_struct *tty, struct tty_ldisc *ld)
+ {
++ lockdep_assert_held_exclusive(&tty->ldisc_sem);
+ WARN_ON(!test_bit(TTY_LDISC_OPEN, &tty->flags));
+ clear_bit(TTY_LDISC_OPEN, &tty->flags);
+ if (ld->ops->close)
+@@ -504,6 +505,7 @@ static int tty_ldisc_failto(struct tty_s
+ struct tty_ldisc *disc = tty_ldisc_get(tty, ld);
+ int r;
+
++ lockdep_assert_held_exclusive(&tty->ldisc_sem);
+ if (IS_ERR(disc))
+ return PTR_ERR(disc);
+ tty->ldisc = disc;
+@@ -626,6 +628,7 @@ err:
+ */
+ static void tty_ldisc_kill(struct tty_struct *tty)
+ {
++ lockdep_assert_held_exclusive(&tty->ldisc_sem);
+ if (!tty->ldisc)
+ return;
+ /*
+@@ -673,6 +676,7 @@ int tty_ldisc_reinit(struct tty_struct *
+ struct tty_ldisc *ld;
+ int retval;
+
++ lockdep_assert_held_exclusive(&tty->ldisc_sem);
+ ld = tty_ldisc_get(tty, disc);
+ if (IS_ERR(ld)) {
+ BUG_ON(disc == N_TTY);
+@@ -772,6 +776,10 @@ int tty_ldisc_setup(struct tty_struct *t
+ return retval;
+
+ if (o_tty) {
++ /*
++ * Called without o_tty->ldisc_sem held, as o_tty has been
++ * just allocated and no one has a reference to it.
++ */
+ retval = tty_ldisc_open(o_tty, o_tty->ldisc);
+ if (retval) {
+ tty_ldisc_close(tty, tty->ldisc);
+@@ -836,6 +844,7 @@ int tty_ldisc_init(struct tty_struct *tt
+ */
+ void tty_ldisc_deinit(struct tty_struct *tty)
+ {
++ /* no ldisc_sem, tty is being destroyed */
+ if (tty->ldisc)
+ tty_ldisc_put(tty->ldisc);
+ tty->ldisc = NULL;
diff --git a/patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch b/patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch
new file mode 100644
index 0000000000..ed5f75c2bf
--- /dev/null
+++ b/patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch
@@ -0,0 +1,131 @@
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Tue, 18 Sep 2018 00:52:56 +0100
+Subject: tty/ldsem: Convert to regular lockdep annotations
+Patch-mainline: Submitted on 2018/09/18
+References: bnc#1105428
+
+For some reason ldsem has its own lockdep wrappers, make them go away.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_ldsem.c | 51 +++++++++++++-----------------------------------
+ 1 file changed, 14 insertions(+), 37 deletions(-)
+
+--- a/drivers/tty/tty_ldsem.c
++++ b/drivers/tty/tty_ldsem.c
+@@ -36,29 +36,6 @@
+ #include <linux/sched/task.h>
+
+
+-#ifdef CONFIG_DEBUG_LOCK_ALLOC
+-# define __acq(l, s, t, r, c, n, i) \
+- lock_acquire(&(l)->dep_map, s, t, r, c, n, i)
+-# define __rel(l, n, i) \
+- lock_release(&(l)->dep_map, n, i)
+-#define lockdep_acquire(l, s, t, i) __acq(l, s, t, 0, 1, NULL, i)
+-#define lockdep_acquire_nest(l, s, t, n, i) __acq(l, s, t, 0, 1, n, i)
+-#define lockdep_acquire_read(l, s, t, i) __acq(l, s, t, 1, 1, NULL, i)
+-#define lockdep_release(l, n, i) __rel(l, n, i)
+-#else
+-# define lockdep_acquire(l, s, t, i) do { } while (0)
+-# define lockdep_acquire_nest(l, s, t, n, i) do { } while (0)
+-# define lockdep_acquire_read(l, s, t, i) do { } while (0)
+-# define lockdep_release(l, n, i) do { } while (0)
+-#endif
+-
+-#ifdef CONFIG_LOCK_STAT
+-# define lock_stat(_lock, stat) lock_##stat(&(_lock)->dep_map, _RET_IP_)
+-#else
+-# define lock_stat(_lock, stat) do { } while (0)
+-#endif
+-
+-
+ #if BITS_PER_LONG == 64
+ # define LDSEM_ACTIVE_MASK 0xffffffffL
+ #else
+@@ -334,17 +311,17 @@ static int __ldsem_down_read_nested(stru
+ {
+ long count;
+
+- lockdep_acquire_read(sem, subclass, 0, _RET_IP_);
++ rwsem_acquire_read(&sem->dep_map, subclass, 0, _RET_IP_);
+
+ count = ldsem_atomic_update(LDSEM_READ_BIAS, sem);
+ if (count <= 0) {
+- lock_stat(sem, contended);
++ lock_contended(&sem->dep_map, _RET_IP_);
+ if (!down_read_failed(sem, count, timeout)) {
+- lockdep_release(sem, 1, _RET_IP_);
++ rwsem_release(&sem->dep_map, 1, _RET_IP_);
+ return 0;
+ }
+ }
+- lock_stat(sem, acquired);
++ lock_acquired(&sem->dep_map, _RET_IP_);
+ return 1;
+ }
+
+@@ -353,17 +330,17 @@ static int __ldsem_down_write_nested(str
+ {
+ long count;
+
+- lockdep_acquire(sem, subclass, 0, _RET_IP_);
++ rwsem_acquire(&sem->dep_map, subclass, 0, _RET_IP_);
+
+ count = ldsem_atomic_update(LDSEM_WRITE_BIAS, sem);
+ if ((count & LDSEM_ACTIVE_MASK) != LDSEM_ACTIVE_BIAS) {
+- lock_stat(sem, contended);
++ lock_contended(&sem->dep_map, _RET_IP_);
+ if (!down_write_failed(sem, count, timeout)) {
+- lockdep_release(sem, 1, _RET_IP_);
++ rwsem_release(&sem->dep_map, 1, _RET_IP_);
+ return 0;
+ }
+ }
+- lock_stat(sem, acquired);
++ lock_acquired(&sem->dep_map, _RET_IP_);
+ return 1;
+ }
+
+@@ -386,8 +363,8 @@ int ldsem_down_read_trylock(struct ld_se
+
+ while (count >= 0) {
+ if (ldsem_cmpxchg(&count, count + LDSEM_READ_BIAS, sem)) {
+- lockdep_acquire_read(sem, 0, 1, _RET_IP_);
+- lock_stat(sem, acquired);
++ rwsem_acquire_read(&sem->dep_map, 0, 1, _RET_IP_);
++ lock_acquired(&sem->dep_map, _RET_IP_);
+ return 1;
+ }
+ }
+@@ -412,8 +389,8 @@ int ldsem_down_write_trylock(struct ld_s
+
+ while ((count & LDSEM_ACTIVE_MASK) == 0) {
+ if (ldsem_cmpxchg(&count, count + LDSEM_WRITE_BIAS, sem)) {
+- lockdep_acquire(sem, 0, 1, _RET_IP_);
+- lock_stat(sem, acquired);
++ rwsem_acquire(&sem->dep_map, 0, 1, _RET_IP_);
++ lock_acquired(&sem->dep_map, _RET_IP_);
+ return 1;
+ }
+ }
+@@ -427,7 +404,7 @@ void ldsem_up_read(struct ld_semaphore *
+ {
+ long count;
+
+- lockdep_release(sem, 1, _RET_IP_);
++ rwsem_release(&sem->dep_map, 1, _RET_IP_);
+
+ count = ldsem_atomic_update(-LDSEM_READ_BIAS, sem);
+ if (count < 0 && (count & LDSEM_ACTIVE_MASK) == 0)
+@@ -441,7 +418,7 @@ void ldsem_up_write(struct ld_semaphore
+ {
+ long count;
+
+- lockdep_release(sem, 1, _RET_IP_);
++ rwsem_release(&sem->dep_map, 1, _RET_IP_);
+
+ count = ldsem_atomic_update(-LDSEM_WRITE_BIAS, sem);
+ if (count < 0)
diff --git a/patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch b/patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch
new file mode 100644
index 0000000000..1e3fa456c8
--- /dev/null
+++ b/patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch
@@ -0,0 +1,38 @@
+From: Dmitry Safonov <dima@arista.com>
+Date: Tue, 18 Sep 2018 00:52:58 +0100
+Subject: tty/ldsem: Decrement wait_readers on timeouted down_read()
+Patch-mainline: Submitted on 2018/09/18
+References: bnc#1105428
+
+It seems like when ldsem_down_read() fails with timeout, it misses
+update for sem->wait_readers. By that reason, when writer finally
+releases write end of the semaphore __ldsem_wake_readers() does adjust
+sem->count with wrong value:
+sem->wait_readers * (LDSEM_ACTIVE_BIAS - LDSEM_WAIT_BIAS)
+
+I.e, if update comes with 1 missed wait_readers decrement, sem->count
+will be 0x100000001 which means that there is active reader and it'll
+make any further writer to fail in acquiring the semaphore.
+
+It looks like, this is a dead-code, because ldsem_down_read() is never
+called with timeout different than MAX_SCHEDULE_TIMEOUT, so it might be
+worth to delete timeout parameter and error path fall-back..
+
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_ldsem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/tty/tty_ldsem.c
++++ b/drivers/tty/tty_ldsem.c
+@@ -228,6 +228,7 @@ down_read_failed(struct ld_semaphore *se
+ raw_spin_lock_irq(&sem->wait_lock);
+ if (waiter.task) {
+ ldsem_atomic_update(-LDSEM_WAIT_BIAS, sem);
++ sem->wait_readers--;
+ list_del(&waiter.list);
+ raw_spin_unlock_irq(&sem->wait_lock);
+ put_task_struct(waiter.task);
diff --git a/patches.suse/tty-ldsem-Wake-up-readers-after-timed-out-down_write.patch b/patches.suse/tty-ldsem-Wake-up-readers-after-timed-out-down_write.patch
new file mode 100644
index 0000000000..50ea5f03b2
--- /dev/null
+++ b/patches.suse/tty-ldsem-Wake-up-readers-after-timed-out-down_write.patch
@@ -0,0 +1,54 @@
+From: Dmitry Safonov <dima@arista.com>
+Date: Tue, 18 Sep 2018 00:52:53 +0100
+Subject: tty/ldsem: Wake up readers after timed out down_write()
+Patch-mainline: Submitted on 2018/09/18
+References: bnc#1105428
+
+ldsem_down_read() will sleep if there is pending writer in the queue.
+If the writer times out, readers in the queue should be woken up,
+otherwise they may miss a chance to acquire the semaphore until the last
+active reader will do ldsem_up_read().
+
+There was a couple of reports where there was one active reader and
+other readers soft locked up:
+ Showing all locks held in the system:
+ 2 locks held by khungtaskd/17:
+ #0: (rcu_read_lock){......}, at: watchdog+0x124/0x6d1
+ #1: (tasklist_lock){.+.+..}, at: debug_show_all_locks+0x72/0x2d3
+ 2 locks held by askfirst/123:
+ #0: (&tty->ldisc_sem){.+.+.+}, at: ldsem_down_read+0x46/0x58
+ #1: (&ldata->atomic_read_lock){+.+...}, at: n_tty_read+0x115/0xbe4
+
+Prevent readers wait for active readers to release ldisc semaphore.
+
+Link: lkml.kernel.org/r/<20171121132855.ajdv4k6swzhvktl6@wfg-t540p.sh.intel.com>
+Link: lkml.kernel.org/r/<20180907045041.GF1110@shao2-debian>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Reported-by: kernel test robot <rong.a.chen@intel.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_ldsem.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/tty/tty_ldsem.c
++++ b/drivers/tty/tty_ldsem.c
+@@ -307,6 +307,16 @@ down_write_failed(struct ld_semaphore *s
+ if (!locked)
+ ldsem_atomic_update(-LDSEM_WAIT_BIAS, sem);
+ list_del(&waiter.list);
++
++ /*
++ * In case of timeout, wake up every reader who gave the right of way
++ * to writer. Prevent separation readers into two groups:
++ * one that helds semaphore and another that sleeps.
++ * (in case of no contention with a writer)
++ */
++ if (!locked && list_empty(&sem->write_wait))
++ __ldsem_wake_readers(sem);
++
+ raw_spin_unlock_irq(&sem->wait_lock);
+
+ __set_current_state(TASK_RUNNING);
diff --git a/series.conf b/series.conf
index b069a0bece..162e981df8 100644
--- a/series.conf
+++ b/series.conf
@@ -6127,6 +6127,7 @@
patches.arch/powerpc-perf-imc-fix-nest-events-on-muti-socket-system.patch
patches.arch/powerpc-Fix-missing-newline-before.patch
patches.arch/powerpc-perf-fix-usage-of-nest_imc_refc.patch
+ patches.arch/powerpc-pseries-remove-dlpar_attach_node-dependency-.patch
patches.arch/powerpc-mm-Move-pgdir-setting-into-a-helper.patch
patches.arch/powerpc-mm-Optimize-detection-of-thread-local-mm-s.patch
patches.arch/powerpc-mm-Make-switch_mm_irqs_off-out-of-line.patch
@@ -6912,6 +6913,7 @@
patches.arch/powerpc-sysrq-Fix-oops-whem-ppmu-is-not-registered.patch
patches.arch/powerpc-tm-Flush-TM-only-if-CPU-has-TM-feature.patch
patches.arch/powerpc-eeh-Create-PHB-PEs-after-EEH-is-initialized.patch
+ patches.arch/powerpc-pseries-Fix-OF-ERROR-Bad-of_node_put-on-cpus.patch
patches.arch/powerpc-pseries-Fix-parent_dn-reference-leak-in-add_.patch
patches.fixes/xen-x86-mark-xen_find_pt_base-as-init.patch
patches.suse/0041-libceph-don-t-allow-bidirectional-swap-of-pg-upmap-items.patch
@@ -11314,6 +11316,7 @@
patches.drivers/cpufreq-powernv-Dont-assume-distinct-pstate-values-f.patch
patches.drivers/PM-devfreq-Propagate-error-from-devfreq_add_device
patches.drivers/PM-devfreq-Fix-potential-NULL-pointer-dereference-in
+ patches.fixes/acpi-pci-pci_link-reduce-verbosity-when-irq-is-enabled.patch
patches.drivers/ACPICA-iasl-Add-SMMUv3-device-ID-mapping-index-suppo.patch
patches.drivers/ACPICA-ACPI-6.0A-Changes-to-the-NFIT-ACPI-table.patch
patches.fixes/ACPI-NUMA-ia64-Parse-all-entries-of-SRAT-memory-affi.patch
@@ -12277,6 +12280,7 @@
patches.drivers/serial-8250_uniphier-fix-error-return-code-in-uniphi
patches.drivers/serial-imx-Only-wakeup-via-RTSDEN-bit-if-the-system-
patches.drivers/serial-core-mark-port-as-initialized-after-successfu
+ patches.suse/tty-fix-data-race-between-tty_init_dev-and-flush-of-.patch
patches.drivers/tty-serial-exar-Relocate-sleep-wake-up-handling.patch
patches.drivers/iio-adc-accel-Fix-up-module-licenses
patches.drivers/iio-health-max30102-Add-power-enable-parameter-to-ge
@@ -14148,6 +14152,7 @@
patches.drivers/ACPICA-acpi-acpica-fix-acpi-operand-cache-leak-in-ns
patches.drivers/ACPICA-Fix-memory-leak-on-unusual-memory-leak
patches.drivers/ACPICA-Events-add-a-return-on-failure-from-acpi_hw_r
+ patches.fixes/acpi-pci-pci_link-allow-the-absence-of-_prs-and-change.patch
patches.fixes/0001-ACPI-scan-Send-change-uevent-with-offine-environment.patch
patches.drivers/ACPI-video-Add-quirk-to-force-acpi-video-backlight-o
patches.fixes/0001-PCMCIA-PM-Avoid-noirq-suspend-aborts-during-suspend-.patch
@@ -14886,6 +14891,7 @@
patches.arch/selftests-powerpc-Fix-copyloops-build-since-Power4-a.patch
patches.arch/powerpc-powernv-Fix-SMT4-forcing-idle-code.patch
patches.arch/powerpc-mm-radix-Update-pte-fragment-count-from-16-t.patch
+ patches.arch/powerpc-mm-hugetlb-initialize-the-pagetable-cache-co.patch
patches.arch/powerpc-mm-radix-Parse-disable_radix-commandline-cor.patch
patches.arch/powerpc-mm-radix-Update-command-line-parsing-for-dis.patch
patches.arch/powerpc-hw_breakpoint-Only-disable-hw-breakpoint-if-.patch
@@ -15870,6 +15876,7 @@
patches.fixes/ARM-amba-Fix-wrong-indentation-in-driver_override_st.patch
patches.drivers/w1-mxc_w1-Enable-clock-before-calling-clk_get_rate-o
patches.drivers/1wire-family-module-autoload-fails-because-of-upper-
+ patches.suse/rpmsg-Correct-support-for-MODULE_DEVICE_TABLE.patch
patches.drivers/vmw_balloon-fixing-double-free-when-batching-mode-is
patches.drivers/driver-core-Don-t-ignore-class_dir_create_and_add-fa
patches.drivers/sc16is7xx-Check-for-an-error-when-the-clock-is-enabl
@@ -17098,6 +17105,7 @@
patches.fixes/ext4-fix-inline-data-updates-with-checksums-enabled.patch
patches.fixes/ext4-check-for-allocation-block-validity-with-block-.patch
patches.fixes/ext4-fix-check-to-prevent-initializing-reserved-inod.patch
+ patches.arch/0001-x86-efi-Access-EFI-MMIO-data-as-unencrypted-when-SEV.patch
patches.arch/perf-x86-amd-ibs-don-t-access-non-started-event
patches.fixes/x86-entry-64-remove-ebx-handling-from-error_entry-exit.patch
patches.arch/x86-boot-fix-if_changed-build-flip-flop-bug
@@ -17883,6 +17891,7 @@
patches.arch/x86-nmi-fix-nmi-uaccess-race-against-cr3-switching
patches.fixes/x86-mce-Fix-set_mce_nospec-to-avoid-GP-fault.patch
patches.arch/x86-vdso-fix-lsl-operand-order.patch
+ patches.fixes/0001-of-add-helper-to-lookup-compatible-child-node.patch
patches.fixes/vti6-remove-skb-ignore_df-check-from-vti6_xmit.patch
patches.drivers/net-hns-add-the-code-for-cleaning-pkt-in-chip.patch
patches.drivers/net-hns-add-netif_carrier_off-before-change-speed-an.patch
@@ -17960,6 +17969,7 @@
patches.drivers/drm-nouveau-drm-nouveau-Don-t-forget-to-cancel-hpd_w.patch
patches.drivers/drm-nouveau-TBDdevinit-don-t-fail-when-PMU-PRE_OS-is.patch
patches.drivers/drm-nouveau-disp-fix-DP-disable-race.patch
+ patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch
patches.drivers/Revert-PCI-Add-ACS-quirk-for-Intel-300-series
patches.drivers/switchtec-Fix-Spectre-v1-vulnerability.patch
patches.arch/s390-sles15-15-04-crypto-paes-fix.patch
@@ -18167,6 +18177,7 @@
patches.arch/x86-time-correct-the-attribute-on-jiffies-definition
patches.arch/x86-fpu-remove-second-definition-of-fpu-in-_fpu__restore_sig
patches.drivers/i2c-rcar-cleanup-DMA-for-all-kinds-of-failure.patch
+ patches.fixes/cdrom-fix-improper-type-cast-which-can-leat-to-infor.patch
patches.fixes/nvme_fc-add-nvme_discovery-sysfs-attribute-to-fc-tra.patch
patches.fixes/nvme-call-nvme_complete_rq-when-nvmf_check_ready-fai.patch
patches.drivers/ACPI-processor-Fix-the-return-value-of-acpi_processo.patch
@@ -18179,6 +18190,7 @@
patches.drivers/iwlwifi-pcie-gen2-check-iwl_pcie_gen2_set_tb-return-.patch
patches.drivers/mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
patches.fixes/xfrm-use-complete-IPv6-addresses-for-hash.patch
+ patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch
patches.arch/signal-properly-deliver-sigsegv-from-x86-uprobes
patches.fixes/jbd2-fix-use-after-free-in-jbd2_log_do_checkpoint.patch
patches.fixes/Documentation-l1tf-Fix-small-spelling-typo.patch
@@ -18252,8 +18264,15 @@
patches.drivers/crypto-tcrypt-fix-ghash-generic-speed-test.patch
patches.drivers/crypto-lrw-Fix-out-of-bounds-access-on-counter-overf.patch
patches.drivers/hwrng-core-document-the-quality-field.patch
-
- # powerpc/linux next
+ patches.drivers/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch
+ patches.drivers/usb-gadget-fsl_udc_core-fixup-struct_udc_setup-docum.patch
+ patches.drivers/usb-chipidea-Prevent-unbalanced-IRQ-disable.patch
+ patches.drivers/USB-serial-cypress_m8-fix-interrupt-out-transfer-len.patch
+ patches.drivers/usbip-tools-fix-atoi-on-non-null-terminated-string.patch
+ patches.drivers/kernfs-update-comment-about-kernfs_path-return-value.patch
+ patches.fixes/0001-drm-mediatek-fix-OF-sibling-node-lookup.patch
+ patches.fixes/0001-drm-msm-fix-OF-child-node-lookup.patch
+ patches.drivers/NFC-nfcmrvl_uart-fix-OF-child-node-lookup.patch
patches.arch/powerpc-pseries-mm-Introducing-FW_FEATURE_BLOCK_REMO.patch
patches.arch/powerpc-pseries-mm-factorize-PTE-slot-computation.patch
patches.arch/powerpc-pseries-mm-call-H_BLOCK_REMOVE.patch
@@ -18267,6 +18286,8 @@
patches.arch/powerpc-pseries-Disable-CPU-hotplug-across-migration.patch
patches.arch/powerpc-fadump-re-register-firmware-assisted-dump-if.patch
patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch
+ patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch
+ patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID
# dhowells/linux-fs keys-uefi
patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch
@@ -18277,6 +18298,12 @@
patches.suse/0006-modsign-Use-secondary-trust-keyring-for-module-signi.patch
# out-of-tree patches
+ patches.suse/tty-ldsem-Wake-up-readers-after-timed-out-down_write.patch
+ patches.suse/tty-Hold-tty_ldisc_lock-during-tty_reopen.patch
+ patches.suse/tty-Simplify-tty-count-math-in-tty_reopen.patch
+ patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch
+ patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch
+ patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch
patches.suse/md-display-timeout-error.patch
patches.suse/nvme-register-ns_id-attributes-as-default-sysfs-grou.patch
patches.fixes/0001-Revert-mm-vmacache-optimize-overflow-system-wide-flu.patch
@@ -18513,8 +18540,6 @@
########################################################
patches.arch/acpi_thinkpad_introduce_acpi_root_table_boot_param.patch
patches.arch/acpi_thermal_passive_blacklist.patch
- patches.fixes/acpi-pci-pci_link-reduce-verbosity-when-irq-is-enabled.patch
- patches.fixes/acpi-pci-pci_link-allow-the-absence-of-_prs-and-change.patch
########################################################
# Driver core
@@ -18582,6 +18607,8 @@
patches.fixes/btrfs-check-integrity-Fix-NULL-pointer-dereference-f.patch
patches.fixes/btrfs-scrub-Don-t-use-inode-pages-for-device-replace.patch
patches.fixes/btrfs-scrub-Don-t-use-inode-page-cache-in-scrub_hand.patch
+ patches.fixes/0001-btrfs-Enhance-btrfs_trim_fs-function-to-handle-error.patch
+ patches.fixes/0002-btrfs-Ensure-btrfs_trim_fs-can-trim-the-whole-filesy.patch
patches.suse/0001-btrfs-Refactor-check_leaf-function-for-later-expansi.patch
patches.suse/0002-btrfs-Check-if-item-pointer-overlaps-with-the-item-i.patch
@@ -18719,10 +18746,6 @@
patches.drivers/drm-hibmc-initialize-the-hibmc_bo_driver_io_mem_pfn.patch
patches.suse/Revert-drm-nouveau-drm-therm-fan-add-a-fallback-if-n
- # bsc#1101822
- patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch
-
- patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID
+disable patches.drivers/drm-Add-DRM-client-cap-for-aspect-ratio
+disable patches.drivers/drm-Handle-aspect-ratio-info-in-legacy-modeset-path
+disable patches.drivers/drm-Expose-modes-with-aspect-ratio-only-if-requested
@@ -18777,16 +18800,13 @@
########################################################
# Other driver fixes
########################################################
- patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch
patches.suse/tpm-Downgrade-error-level
patches.suse/Input-synaptics-Add-intertouch-blacklist-for-Thinkpa.patch
patches.suse/mmc-version-check-printk-downgrade
patches.drivers/dell_rbu-make-firmware-payload-memory-uncachable
patches.kabi/iio-kabi-fix-for-iio_buffer.patch
- patches.arch/0001-x86-efi-Access-EFI-MMIO-data-as-unencrypted-when-SEV.patch
patches.kabi/power_supply-removing-field-kabi-fix.patch
patches.kabi/strscpy-annotation-drop-kABI-workaround.patch
- patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch
patches.drivers/HID-quirks-fix-support-for-Apple-Magic-Keyboards.patch
########################################################