Home Home > GIT Browse > linux-next
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-01-17 07:04:39 +0100
committerKernel Build Daemon <kbuild@suse.de>2019-01-17 07:04:39 +0100
commit6af4ef80c4c8cbc4c19f0e727341ba9bab9c633b (patch)
tree41d471f7fb0f459804d8cbeba5523c299699d163
parent99d4b71a1d39333e9f74d16868afbf6cce3abec1 (diff)
parentdd6077c8eed7e05c2c9c81f1ad5c239067ab7ecb (diff)
Merge branch 'SLE15' into SLE12-SP4rpm-4.12.14-95.6
-rw-r--r--blacklist.conf2
-rw-r--r--patches.drivers/drivers-tty-add-missing-of_node_put.patch35
-rw-r--r--patches.drivers/iwlwifi-fix-wrong-WGDS_WIFI_DATA_SIZE.patch83
-rw-r--r--patches.drivers/tty-Don-t-hold-ldisc-lock-in-tty_reopen-if-ldisc-pre.patch73
-rw-r--r--patches.drm/0001-drm-fb-helper-Ignore-the-value-of-fb_var_screeninfo..patch78
-rw-r--r--patches.fixes/0001-iwlwifi-fix-non_shared_ant-for-22000-devices.patch30
-rw-r--r--patches.fixes/0001-iwlwifi-mvm-don-t-send-GEO_TX_POWER_LIMIT-to-old-fir.patch46
-rw-r--r--patches.fixes/0001-libertas_tf-prevent-underflow-in-process_cmdrequest.patch34
-rw-r--r--series.conf7
9 files changed, 388 insertions, 0 deletions
diff --git a/blacklist.conf b/blacklist.conf
index b9887b74ea..1a07ca00a0 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -986,3 +986,5 @@ af27d9403f5b80685b79c88425086edccecaf711 # Warning applies to unsupported config
613a5eb5677923fdaecfa582738c7bcf80abe186 # Problem affects debugging builds only and is harmless
d50d82faa0c964e31f7a946ba8aba7c715ca7ab0 # Problem affects SLUB which is not enabled in kconfig
8363dae23463df5d27aa3f3430ad64f5c8fcee3e # Not applicable for SLE15
+6508497cbdc70b92130fbca57402af6a94e05d20 # patch misattributed
+9ff067ff4c4a08d412e51307f11f7de3fb3045e7 # cosmetic cleanup
diff --git a/patches.drivers/drivers-tty-add-missing-of_node_put.patch b/patches.drivers/drivers-tty-add-missing-of_node_put.patch
new file mode 100644
index 0000000000..e37fa8a075
--- /dev/null
+++ b/patches.drivers/drivers-tty-add-missing-of_node_put.patch
@@ -0,0 +1,35 @@
+From dac097c4546e4c5b16dd303a1e97c1d319c8ab3e Mon Sep 17 00:00:00 2001
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Wed, 21 Nov 2018 10:22:54 -0500
+Subject: [PATCH] drivers/tty: add missing of_node_put()
+Git-commit: dac097c4546e4c5b16dd303a1e97c1d319c8ab3e
+Patch-mainline: v4.20-rc6
+References: bsc#1051510
+
+of_find_node_by_path() acquires a reference to the node
+returned by it and that reference needs to be dropped by its caller.
+This place is not doing this, so fix it.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/suncore.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tty/serial/suncore.c b/drivers/tty/serial/suncore.c
+index 70a4ea4eaa6e..990376576970 100644
+--- a/drivers/tty/serial/suncore.c
++++ b/drivers/tty/serial/suncore.c
+@@ -112,6 +112,7 @@ void sunserial_console_termios(struct console *con, struct device_node *uart_dp)
+ mode = of_get_property(dp, mode_prop, NULL);
+ if (!mode)
+ mode = "9600,8,n,1,-";
++ of_node_put(dp);
+ }
+
+ cflag = CREAD | HUPCL | CLOCAL;
+--
+2.20.1
+
diff --git a/patches.drivers/iwlwifi-fix-wrong-WGDS_WIFI_DATA_SIZE.patch b/patches.drivers/iwlwifi-fix-wrong-WGDS_WIFI_DATA_SIZE.patch
new file mode 100644
index 0000000000..2b451b08cc
--- /dev/null
+++ b/patches.drivers/iwlwifi-fix-wrong-WGDS_WIFI_DATA_SIZE.patch
@@ -0,0 +1,83 @@
+From 66e839030fd698586734e017fd55c4f2a89dba0b Mon Sep 17 00:00:00 2001
+From: Matt Chen <matt.chen@intel.com>
+Date: Fri, 3 Aug 2018 14:29:20 +0800
+Subject: [PATCH] iwlwifi: fix wrong WGDS_WIFI_DATA_SIZE
+Git-commit: 66e839030fd698586734e017fd55c4f2a89dba0b
+Patch-mainline: v4.20
+References: bsc#1119086
+
+From coreboot/BIOS:
+Name ("WGDS", Package() {
+ Revision,
+ Package() {
+ DomainType, // 0x7:WiFi ==> We miss this one.
+ WgdsWiFiSarDeltaGroup1PowerMax1, // Group 1 FCC 2400 Max
+ WgdsWiFiSarDeltaGroup1PowerChainA1, // Group 1 FCC 2400 A Offset
+ WgdsWiFiSarDeltaGroup1PowerChainB1, // Group 1 FCC 2400 B Offset
+ WgdsWiFiSarDeltaGroup1PowerMax2, // Group 1 FCC 5200 Max
+ WgdsWiFiSarDeltaGroup1PowerChainA2, // Group 1 FCC 5200 A Offset
+ WgdsWiFiSarDeltaGroup1PowerChainB2, // Group 1 FCC 5200 B Offset
+ WgdsWiFiSarDeltaGroup2PowerMax1, // Group 2 EC Jap 2400 Max
+ WgdsWiFiSarDeltaGroup2PowerChainA1, // Group 2 EC Jap 2400 A Offset
+ WgdsWiFiSarDeltaGroup2PowerChainB1, // Group 2 EC Jap 2400 B Offset
+ WgdsWiFiSarDeltaGroup2PowerMax2, // Group 2 EC Jap 5200 Max
+ WgdsWiFiSarDeltaGroup2PowerChainA2, // Group 2 EC Jap 5200 A Offset
+ WgdsWiFiSarDeltaGroup2PowerChainB2, // Group 2 EC Jap 5200 B Offset
+ WgdsWiFiSarDeltaGroup3PowerMax1, // Group 3 ROW 2400 Max
+ WgdsWiFiSarDeltaGroup3PowerChainA1, // Group 3 ROW 2400 A Offset
+ WgdsWiFiSarDeltaGroup3PowerChainB1, // Group 3 ROW 2400 B Offset
+ WgdsWiFiSarDeltaGroup3PowerMax2, // Group 3 ROW 5200 Max
+ WgdsWiFiSarDeltaGroup3PowerChainA2, // Group 3 ROW 5200 A Offset
+ WgdsWiFiSarDeltaGroup3PowerChainB2, // Group 3 ROW 5200 B Offset
+ }
+})
+
+When read the ACPI data to find out the WGDS, the DATA_SIZE is never
+matched.
+From the above format, it gives 19 numbers, but our driver is hardcode
+as 18.
+Fix it to pass then can parse the data into our wgds table.
+Then we will see:
+iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init Sending GEO_TX_POWER_LIMIT
+iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[0]
+Band[0]: chain A = 68 chain B = 69 max_tx_power = 54
+iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[0]
+Band[1]: chain A = 48 chain B = 49 max_tx_power = 70
+iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[1]
+Band[0]: chain A = 51 chain B = 67 max_tx_power = 50
+iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[1]
+Band[1]: chain A = 69 chain B = 70 max_tx_power = 68
+iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[2]
+Band[0]: chain A = 49 chain B = 50 max_tx_power = 48
+iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[2]
+Band[1]: chain A = 52 chain B = 53 max_tx_power = 51
+
+Cc: stable@vger.kernel.org # 4.12+
+Fixes: a6bff3cb19b7 ("iwlwifi: mvm: add GEO_TX_POWER_LIMIT cmd for geographic tx power table")
+Signed-off-by: Matt Chen <matt.chen@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -590,7 +590,7 @@ static int iwl_mvm_config_ltr(struct iwl
+ #define ACPI_WRDS_WIFI_DATA_SIZE (IWL_MVM_SAR_TABLE_SIZE + 2)
+ #define ACPI_EWRD_WIFI_DATA_SIZE ((IWL_MVM_SAR_PROFILE_NUM - 1) * \
+ IWL_MVM_SAR_TABLE_SIZE + 3)
+-#define ACPI_WGDS_WIFI_DATA_SIZE 18
++#define ACPI_WGDS_WIFI_DATA_SIZE 19
+ #define ACPI_WGDS_NUM_BANDS 2
+ #define ACPI_WGDS_TABLE_SIZE 3
+
+@@ -968,7 +968,7 @@ static int iwl_mvm_sar_geo_init(struct i
+ IWL_DEBUG_RADIO(mvm, "Sending GEO_TX_POWER_LIMIT\n");
+
+ BUILD_BUG_ON(IWL_NUM_GEO_PROFILES * ACPI_WGDS_NUM_BANDS *
+- ACPI_WGDS_TABLE_SIZE != ACPI_WGDS_WIFI_DATA_SIZE);
++ ACPI_WGDS_TABLE_SIZE + 1 != ACPI_WGDS_WIFI_DATA_SIZE);
+
+ for (i = 0; i < IWL_NUM_GEO_PROFILES; i++) {
+ struct iwl_per_chain_offset *chain =
diff --git a/patches.drivers/tty-Don-t-hold-ldisc-lock-in-tty_reopen-if-ldisc-pre.patch b/patches.drivers/tty-Don-t-hold-ldisc-lock-in-tty_reopen-if-ldisc-pre.patch
new file mode 100644
index 0000000000..118b0a13e2
--- /dev/null
+++ b/patches.drivers/tty-Don-t-hold-ldisc-lock-in-tty_reopen-if-ldisc-pre.patch
@@ -0,0 +1,73 @@
+From d3736d82e8169768218ee0ef68718875918091a0 Mon Sep 17 00:00:00 2001
+From: Dmitry Safonov <dima@arista.com>
+Date: Wed, 9 Jan 2019 01:17:40 +0000
+Subject: [PATCH] tty: Don't hold ldisc lock in tty_reopen() if ldisc present
+Git-commit: d3736d82e8169768218ee0ef68718875918091a0
+Patch-mainline: v5.0-rc2
+References: bsc#1051510
+
+Try to get reference for ldisc during tty_reopen().
+If ldisc present, we don't need to do tty_ldisc_reinit() and lock the
+write side for line discipline semaphore.
+Effectively, it optimizes fast-path for tty_reopen(), but more
+importantly it won't interrupt ongoing IO on the tty as no ldisc change
+is needed.
+Fixes user-visible issue when tty_reopen() interrupted login process for
+user with a long password, observed and reported by Lukas.
+
+Fixes: c96cf923a98d ("tty: Don't block on IO when ldisc change is pending")
+Fixes: 83d817f41070 ("tty: Hold tty_ldisc_lock() during tty_reopen()")
+Cc: Jiri Slaby <jslaby@suse.com>
+Reported-by: Lukas F. Hartmann <lukas@mntmn.com>
+Tested-by: Lukas F. Hartmann <lukas@mntmn.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/tty_io.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index bfe9ad85b362..23c6fd238422 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1256,7 +1256,8 @@ static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *
+ static int tty_reopen(struct tty_struct *tty)
+ {
+ struct tty_driver *driver = tty->driver;
+- int retval;
++ struct tty_ldisc *ld;
++ int retval = 0;
+
+ if (driver->type == TTY_DRIVER_TYPE_PTY &&
+ driver->subtype == PTY_TYPE_MASTER)
+@@ -1268,13 +1269,18 @@ static int tty_reopen(struct tty_struct *tty)
+ if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
+ return -EBUSY;
+
+- retval = tty_ldisc_lock(tty, 5 * HZ);
+- if (retval)
+- return retval;
++ ld = tty_ldisc_ref_wait(tty);
++ if (ld) {
++ tty_ldisc_deref(ld);
++ } else {
++ retval = tty_ldisc_lock(tty, 5 * HZ);
++ if (retval)
++ return retval;
+
+- if (!tty->ldisc)
+- retval = tty_ldisc_reinit(tty, tty->termios.c_line);
+- tty_ldisc_unlock(tty);
++ if (!tty->ldisc)
++ retval = tty_ldisc_reinit(tty, tty->termios.c_line);
++ tty_ldisc_unlock(tty);
++ }
+
+ if (retval == 0)
+ tty->count++;
+--
+2.20.1
+
diff --git a/patches.drm/0001-drm-fb-helper-Ignore-the-value-of-fb_var_screeninfo..patch b/patches.drm/0001-drm-fb-helper-Ignore-the-value-of-fb_var_screeninfo..patch
new file mode 100644
index 0000000000..0840dd8cbf
--- /dev/null
+++ b/patches.drm/0001-drm-fb-helper-Ignore-the-value-of-fb_var_screeninfo..patch
@@ -0,0 +1,78 @@
+From 66a8d5bfb518f9f12d47e1d2dce1732279f9451e Mon Sep 17 00:00:00 2001
+From: Ivan Mironov <mironov.ivan@gmail.com>
+Date: Tue, 8 Jan 2019 12:23:53 +0500
+Subject: drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock
+Git-commit: 66a8d5bfb518f9f12d47e1d2dce1732279f9451e
+Patch-mainline: v5.0-rc2
+References: bsc#1113722
+
+Strict requirement of pixclock to be zero breaks support of SDL 1.2
+which contains hardcoded table of supported video modes with non-zero
+pixclock values[1].
+
+To better understand which pixclock values are considered valid and how
+driver should handle these values, I briefly examined few existing fbdev
+drivers and documentation in Documentation/fb/. And it looks like there
+are no strict rules on that and actual behaviour varies:
+
+ * some drivers treat (pixclock == 0) as "use defaults" (uvesafb.c);
+ * some treat (pixclock == 0) as invalid value which leads to
+ -EINVAL (clps711x-fb.c);
+ * some pass converted pixclock value to hardware (uvesafb.c);
+ * some are trying to find nearest value from predefined table
+ (vga16fb.c, video_gx.c).
+
+Given this, I believe that it should be safe to just ignore this value if
+changing is not supported. It seems that any portable fbdev application
+which was not written only for one specific device working under one
+specific kernel version should not rely on any particular behaviour of
+pixclock anyway.
+
+However, while enabling SDL1 applications to work out of the box when
+there is no /etc/fb.modes with valid settings, this change affects the
+video mode choosing logic in SDL. Depending on current screen
+resolution, contents of /etc/fb.modes and resolution requested by
+application, this may lead to user-visible difference (not always):
+image will be displayed in a right way, but it will be aligned to the
+left instead of center. There is no "right behaviour" here as well, as
+emulated fbdev, opposing to old fbdev drivers, simply ignores any
+requsts of video mode changes with resolutions smaller than current.
+
+The easiest way to reproduce this problem is to install sdl-sopwith[2],
+remove /etc/fb.modes file if it exists, and then try to run sopwith
+from console without X. At least in Fedora 29, sopwith may be simply
+installed from standard repositories.
+
+[1] SDL 1.2.15 source code, src/video/fbcon/SDL_fbvideo.c, vesa_timings
+[2] http://sdl-sopwith.sourceforge.net/
+
+Signed-off-by: Ivan Mironov <mironov.ivan@gmail.com>
+Cc: stable@vger.kernel.org
+Fixes: 79e539453b34e ("DRM: i915: add mode setting support")
+Fixes: 771fe6b912fca ("drm/radeon: introduce kernel modesetting for radeon hardware")
+Fixes: 785b93ef8c309 ("drm/kms: move driver specific fb common code to helper functions (v2)")
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190108072353.28078-3-mironov.ivan@gmail.com
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/drm_fb_helper.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1526,9 +1526,14 @@ int drm_fb_helper_check_var(struct fb_va
+ struct drm_fb_helper *fb_helper = info->par;
+ struct drm_framebuffer *fb = fb_helper->fb;
+
+- if (var->pixclock != 0 || in_dbg_master())
++ if (in_dbg_master())
+ return -EINVAL;
+
++ if (var->pixclock != 0) {
++ DRM_DEBUG("fbdev emulation doesn't support changing the pixel clock, value of pixclock is ignored\n");
++ var->pixclock = 0;
++ }
++
+ /*
+ * Changes struct fb_var_screeninfo are currently not pushed back
+ * to KMS, hence fail if different settings are requested.
diff --git a/patches.fixes/0001-iwlwifi-fix-non_shared_ant-for-22000-devices.patch b/patches.fixes/0001-iwlwifi-fix-non_shared_ant-for-22000-devices.patch
new file mode 100644
index 0000000000..7d067f8c75
--- /dev/null
+++ b/patches.fixes/0001-iwlwifi-fix-non_shared_ant-for-22000-devices.patch
@@ -0,0 +1,30 @@
+From a40287727d9b737e183959fd31a4e0c55f312853 Mon Sep 17 00:00:00 2001
+From: Erel Geron <erelx.geron@intel.com>
+Date: Mon, 28 May 2018 17:15:56 +0300
+Subject: [PATCH] iwlwifi: fix non_shared_ant for 22000 devices
+Git-commit: a40287727d9b737e183959fd31a4e0c55f312853
+Patch-mainline: v4.20
+References: bsc#1119086
+
+The non-shared antenna was wrong for 22000 device series.
+Fix it to ANT_B for correct antenna preference by coex in MVM driver.
+
+Fixes: e34d975e40ff ("iwlwifi: Add a000 HW family support")
+Signed-off-by: Erel Geron <erelx.geron@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/net/wireless/intel/iwlwifi/cfg/a000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/a000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/a000.c
+@@ -118,7 +118,7 @@ static const struct iwl_ht_params iwl_a0
+ .base_params = &iwl_a000_base_params, \
+ .led_mode = IWL_LED_RF_STATE, \
+ .nvm_hw_section_num = NVM_HW_SECTION_NUM_FAMILY_A000, \
+- .non_shared_ant = ANT_A, \
++ .non_shared_ant = ANT_B, \
+ .dccm_offset = IWL_A000_DCCM_OFFSET, \
+ .dccm_len = IWL_A000_DCCM_LEN, \
+ .dccm2_offset = IWL_A000_DCCM2_OFFSET, \
diff --git a/patches.fixes/0001-iwlwifi-mvm-don-t-send-GEO_TX_POWER_LIMIT-to-old-fir.patch b/patches.fixes/0001-iwlwifi-mvm-don-t-send-GEO_TX_POWER_LIMIT-to-old-fir.patch
new file mode 100644
index 0000000000..c8449cc247
--- /dev/null
+++ b/patches.fixes/0001-iwlwifi-mvm-don-t-send-GEO_TX_POWER_LIMIT-to-old-fir.patch
@@ -0,0 +1,46 @@
+From eca1e56ceedd9cc185eb18baf307d3ff2e4af376 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Fri, 14 Dec 2018 18:30:22 +0200
+Subject: [PATCH] iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT to old firmwares
+Git-commit: eca1e56ceedd9cc185eb18baf307d3ff2e4af376
+Patch-mainline: v4.20
+References: bsc#1119086
+
+Old firmware versions don't support this command. Sending it
+to any firmware before -41.ucode will crash the firmware.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=201975
+
+Fixes: 66e839030fd6 ("iwlwifi: fix wrong WGDS_WIFI_DATA_SIZE")
+CC: <stable@vger.kernel.org> #4.19+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 2ba890445c35..1689bead1b4f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -881,6 +881,15 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
+ int ret, i, j;
+ u16 cmd_wide_id = WIDE_ID(PHY_OPS_GROUP, GEO_TX_POWER_LIMIT);
+
++ /*
++ * This command is not supported on earlier firmware versions.
++ * Unfortunately, we don't have a TLV API flag to rely on, so
++ * rely on the major version which is in the first byte of
++ * ucode_ver.
++ */
++ if (IWL_UCODE_SERIAL(mvm->fw->ucode_ver) < 41)
++ return 0;
++
+ ret = iwl_mvm_sar_get_wgds_table(mvm);
+ if (ret < 0) {
+ IWL_DEBUG_RADIO(mvm,
+--
+2.16.4
+
diff --git a/patches.fixes/0001-libertas_tf-prevent-underflow-in-process_cmdrequest.patch b/patches.fixes/0001-libertas_tf-prevent-underflow-in-process_cmdrequest.patch
new file mode 100644
index 0000000000..1ea84de7f0
--- /dev/null
+++ b/patches.fixes/0001-libertas_tf-prevent-underflow-in-process_cmdrequest.patch
@@ -0,0 +1,34 @@
+From 3348ef6a6a126706d6a73ed40c18d8033df72783 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 14 Aug 2018 12:07:48 +0300
+Subject: [PATCH] libertas_tf: prevent underflow in process_cmdrequest()
+Git-commit: 3348ef6a6a126706d6a73ed40c18d8033df72783
+Patch-mainline: v4.20
+References: bsc#1119086
+
+If recvlength is less than MESSAGE_HEADER_LEN (4) we would end up
+corrupting memory.
+
+Fixes: c305a19a0d0a ("libertas_tf: usb specific functions")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/net/wireless/marvell/libertas_tf/if_usb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+@@ -603,9 +603,10 @@ static inline void process_cmdrequest(in
+ struct if_usb_card *cardp,
+ struct lbtf_private *priv)
+ {
+- if (recvlength > LBS_CMD_BUFFER_SIZE) {
++ if (recvlength < MESSAGE_HEADER_LEN ||
++ recvlength > LBS_CMD_BUFFER_SIZE) {
+ lbtf_deb_usbd(&cardp->udev->dev,
+- "The receive buffer is too large\n");
++ "The receive buffer is invalid %d\n", recvlength);
+ kfree_skb(skb);
+ return;
+ }
diff --git a/series.conf b/series.conf
index 83f9e078e6..944cd30dcf 100644
--- a/series.conf
+++ b/series.conf
@@ -19099,8 +19099,10 @@
patches.fixes/iwlwifi-don-t-WARN-on-trying-to-dump-dead-firmware.patch
patches.drivers/iwlwifi-mvm-fix-BAR-seq-ctrl-reporting.patch
patches.drivers/iwlwifi-mvm-send-BCAST-management-frames-to-the-righ.patch
+ patches.fixes/0001-libertas_tf-prevent-underflow-in-process_cmdrequest.patch
patches.drivers/brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch
patches.drivers/iwlwifi-dbg-don-t-crash-if-the-firmware-crashes-in-t.patch
+ patches.fixes/0001-iwlwifi-fix-non_shared_ant-for-22000-devices.patch
patches.drivers/iwlwifi-pcie-gen2-build-A-MSDU-only-for-GSO.patch
patches.drivers/0001-iwlwifi-fix-LED-command-capability-bit.patch
patches.drivers/iwlwifi-mvm-Allow-TKIP-for-AP-mode.patch
@@ -19569,6 +19571,7 @@
patches.suse/net-mlx5e-Fix-selftest-for-small-MTUs.patch
patches.suse/tg3-Add-PHY-reset-for-5717-5719-5720-in-change-ring-.patch
patches.drivers/brcmutil-really-fix-decoding-channel-info-for-160-MH.patch
+ patches.drivers/iwlwifi-fix-wrong-WGDS_WIFI_DATA_SIZE.patch
patches.drivers/iwlwifi-mvm-support-sta_statistics-even-on-older-fir.patch
patches.drivers/iwlwifi-mvm-fix-regulatory-domain-update-when-the-fi.patch
patches.drivers/iwlwifi-mvm-don-t-use-SAR-Geo-if-basic-SAR-is-not-us.patch
@@ -19692,6 +19695,7 @@
patches.arch/x86-speculation-add-seccomp-spectre-v2-user-space-protection-mode.patch
patches.arch/x86-speculation-provide-ibpb-always-command-line-options.patch
patches.fixes/0001-xen-x86-add-diagnostic-printout-to-xen_mc_flush-in-c.patch
+ patches.drivers/drivers-tty-add-missing-of_node_put.patch
patches.drivers/Input-matrix_keypad-check-for-errors-from-of_get_nam.patch
patches.drivers/Input-elan_i2c-add-ELAN0620-to-the-ACPI-table.patch
patches.drivers/Input-cros_ec_keyb-fix-button-switch-capability-repo.patch
@@ -19766,6 +19770,7 @@
patches.arch/ibmvnic-Fix-non-atomic-memory-allocation-in-IRQ-cont.patch
patches.drivers/USB-hso-Fix-OOB-memory-access-in-hso_probe-hso_get_c.patch
patches.fixes/0001-xen-netfront-tolerate-frags-with-no-data.patch
+ patches.fixes/0001-iwlwifi-mvm-don-t-send-GEO_TX_POWER_LIMIT-to-old-fir.patch
patches.drivers/mmc-omap_hsmmc-fix-DMA-API-warning.patch
patches.drivers/mmc-core-Reset-HPI-enabled-state-during-re-init-and-.patch
patches.drivers/mmc-core-Allow-BKOPS-and-CACHE-ctrl-even-if-no-HPI-s.patch
@@ -19908,6 +19913,8 @@
patches.drivers/ALSA-cs46xx-Potential-NULL-dereference-in-probe.patch
patches.drivers/ALSA-hda-realtek-Add-unplug-function-into-unplug-sta.patch
patches.drivers/ALSA-hda-realtek-Disable-headset-Mic-VREF-for-headse.patch
+ patches.drm/0001-drm-fb-helper-Ignore-the-value-of-fb_var_screeninfo..patch
+ patches.drivers/tty-Don-t-hold-ldisc-lock-in-tty_reopen-if-ldisc-pre.patch
# dhowells/linux-fs keys-uefi
patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch