Home Home > GIT Browse > openSUSE-15.0
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohannes Thumshirn <jthumshirn@suse.de>2018-10-09 11:05:13 +0200
committerJohannes Thumshirn <jthumshirn@suse.de>2018-10-09 11:06:15 +0200
commit80b4b44075f6da57f3655c48c1b23eb5e31e705a (patch)
tree82718d72058de2ea9ca679ee2b5fb27f0740b1f1
parentba960d82bfe4413c5563c0fa1233fbb9287e47ce (diff)
parentb6e2ad9d08e99fe39eee5f9b0398ad201d50d312 (diff)
Merge remote-tracking branch 'origin/SLE15' into SLE12-SP4
Conflicts: patches.apparmor/apparmor-fix-logging-of-the-existence-test-for-signa.patch patches.apparmor/apparmor-Fix-failure-to-audit-context-info-in-build_.patch patches.apparmor/apparmor-Fully-initialize-aa_perms-struct-when-answe.patch patches.apparmor/apparmor-fix-mediation-of-prlimit.patch patches.apparmor/apparmor-fix-memory-leak-when-deduping-profile-load.patch patches.apparmor/apparmor-fix-ptrace-read-check.patch series.conf
-rw-r--r--blacklist.conf3
-rw-r--r--patches.arch/kvm-nvmx-do-not-expose-mpx-vmx-controls-when-guest-mpx-disabled96
-rw-r--r--patches.arch/kvm-x86-do-not-use-kvm_x86_ops-mpx_supported-directly40
-rw-r--r--patches.arch/x86-decoder-add-new-test-instruction-pattern22
-rw-r--r--patches.arch/x86-vdso-fix-asm-constraints-on-vdso-syscall-fallbacks108
-rw-r--r--patches.arch/x86-vdso-fix-vdso-syscall-fallback-asm-constraint-regression58
-rw-r--r--patches.drivers/IB-qedr-Remove-GID-add-del-dummy-routines.patch89
-rw-r--r--patches.drivers/ath10k-protect-ath10k_htt_rx_ring_free-with-rx_ring..patch51
-rw-r--r--patches.drivers/clk-clk-fixed-factor-Clear-OF_POPULATED-flag-in-case.patch50
-rw-r--r--patches.drivers/clk-rockchip-Add-pclk_rkpwm_pmu-to-PMU-critical-cloc.patch46
-rw-r--r--patches.drivers/clk-tegra-bpmp-Don-t-crash-when-a-clock-fails-to-reg.patch50
-rw-r--r--patches.drivers/gpiolib-Free-the-last-requested-descriptor.patch41
-rw-r--r--patches.drivers/hwmon-nct6775-Set-weight-source-to-zero-correctly.patch36
-rw-r--r--patches.drivers/iommu-amd-clear-memory-encryption-mask-from-physical-address54
-rw-r--r--patches.drivers/rtc-bq4802-add-error-handling-for-devm_ioremap.patch39
-rw-r--r--patches.drivers/thermal-of-thermal-disable-passive-polling-when-ther.patch47
-rw-r--r--patches.drivers/tsl2550-fix-lux1_input-error-in-low-light.patch43
-rw-r--r--patches.drivers/usb-cdc_acm-Do-not-leak-URB-buffers.patch56
-rw-r--r--patches.drivers/virtio-pci-legacy-Validate-queue-pfn.patch74
-rw-r--r--patches.fixes/PM-core-Clear-the-direct_complete-flag-on-errors.patch58
-rw-r--r--patches.fixes/cifs-integer-overflow-in-in-SMB2_ioctl.patch41
-rw-r--r--patches.fixes/crypto-caam-jr-fix-ablkcipher_edesc-pointer-arithmet.patch63
-rw-r--r--patches.fixes/crypto-cavium-nitrox-fix-for-command-corruption-in-q.patch190
-rw-r--r--patches.fixes/fuse-Don-t-access-pipe-buffers-without-pipe_lock.patch44
-rw-r--r--patches.fixes/irq-core-Fix-boot-crash-when-the-irqaffinity-boot-pa.patch58
-rw-r--r--patches.fixes/mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch38
-rw-r--r--patches.fixes/udp-Unbreak-modules-that-rely-on-external-__skb_recv.patch43
-rw-r--r--patches.suse/PCI-dwc-Fix-scheduling-while-atomic-issues.patch86
-rw-r--r--patches.suse/ipv4-fix-use-after-free-in-ip_cmsg_recv_dstaddr.patch40
-rw-r--r--series.conf29
30 files changed, 1598 insertions, 95 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 3728bdb007..0ac946bbc6 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -507,3 +507,6 @@ d0a8d9378d16eb3c69bd8e6d23779fbdbee3a8c7 # Breaks build
9aee5f8a7e30330d0a8f4c626dc924ca5590aba5 # Doesn't fix a bug, breaks kABI
45b575c00d8e72d69d75dd8c112f044b7b01b069 # Doesn't fix a bug, breaks kABI
78ce241099bb363b19dbd0245442e66c8de8f567 # Not relevant
+cc51e5428ea54f575d49cfcede1d4cb3a72b4ec4 # Warning fix only, breaks kABI
+c685af1108d7c303f0b901413405d68eaeac4477 # serial/mvebu-uart: not buildable
+e0bf2d4982fe7d9ddaf550dd023803ea286f47fc # serial/mvebu-uart: not applicable
diff --git a/patches.arch/kvm-nvmx-do-not-expose-mpx-vmx-controls-when-guest-mpx-disabled b/patches.arch/kvm-nvmx-do-not-expose-mpx-vmx-controls-when-guest-mpx-disabled
new file mode 100644
index 0000000000..2fec794cda
--- /dev/null
+++ b/patches.arch/kvm-nvmx-do-not-expose-mpx-vmx-controls-when-guest-mpx-disabled
@@ -0,0 +1,96 @@
+From: Liran Alon <liran.alon@oracle.com>
+Date: Fri, 14 Sep 2018 03:25:52 +0300
+Subject: KVM: nVMX: Do not expose MPX VMX controls when guest MPX disabled
+Git-commit: 5f76f6f5ff96587af5acd5930f7d9fea81e0d1a8
+Patch-mainline: v4.19-rc7
+References: bsc#1106240
+
+Before this commit, KVM exposes MPX VMX controls to L1 guest only based
+on if KVM and host processor supports MPX virtualization.
+However, these controls should be exposed to guest only in case guest
+vCPU supports MPX.
+
+Without this change, a L1 guest running with kernel which don't have
+commit 691bd4340bef ("kvm: vmx: allow host to access guest
+MSR_IA32_BNDCFGS") asserts in QEMU on the following:
+ qemu-kvm: error: failed to set MSR 0xd90 to 0x0
+ qemu-kvm: .../qemu-2.10.0/target/i386/kvm.c:1801 kvm_put_msrs:
+ Assertion 'ret == cpu->kvm_msr_buf->nmsrs failed'
+This is because L1 KVM kvm_init_msr_list() will see that
+vmx_mpx_supported() (As it only checks MPX VMX controls support) and
+therefore KVM_GET_MSR_INDEX_LIST IOCTL will include MSR_IA32_BNDCFGS.
+However, later when L1 will attempt to set this MSR via KVM_SET_MSRS
+IOCTL, it will fail because !guest_cpuid_has_mpx(vcpu).
+
+Therefore, fix the issue by exposing MPX VMX controls to L1 guest only
+when vCPU supports MPX.
+
+Fixes: 36be0b9deb23 ("KVM: x86: Add nested virtualization support for MPX")
+
+Reported-by: Eyal Moscovici <eyal.moscovici@oracle.com>
+Reviewed-by: Nikita Leshchenko <nikita.leshchenko@oracle.com>
+Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+Signed-off-by: Liran Alon <liran.alon@oracle.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/vmx.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2775,9 +2775,6 @@ static void nested_vmx_setup_ctls_msrs(s
+ VM_EXIT_LOAD_IA32_EFER | VM_EXIT_SAVE_IA32_EFER |
+ VM_EXIT_SAVE_VMX_PREEMPTION_TIMER | VM_EXIT_ACK_INTR_ON_EXIT;
+
+- if (kvm_mpx_supported())
+- vmx->nested.nested_vmx_exit_ctls_high |= VM_EXIT_CLEAR_BNDCFGS;
+-
+ /* We support free control of debug control saving. */
+ vmx->nested.nested_vmx_exit_ctls_low &= ~VM_EXIT_SAVE_DEBUG_CONTROLS;
+
+@@ -2794,8 +2791,6 @@ static void nested_vmx_setup_ctls_msrs(s
+ VM_ENTRY_LOAD_IA32_PAT;
+ vmx->nested.nested_vmx_entry_ctls_high |=
+ (VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR | VM_ENTRY_LOAD_IA32_EFER);
+- if (kvm_mpx_supported())
+- vmx->nested.nested_vmx_entry_ctls_high |= VM_ENTRY_LOAD_BNDCFGS;
+
+ /* We support free control of debug control loading. */
+ vmx->nested.nested_vmx_entry_ctls_low &= ~VM_ENTRY_LOAD_DEBUG_CONTROLS;
+@@ -9921,6 +9916,23 @@ static void nested_vmx_cr_fixed1_bits_up
+ #undef cr4_fixed1_update
+ }
+
++static void nested_vmx_entry_exit_ctls_update(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (kvm_mpx_supported()) {
++ bool mpx_enabled = guest_cpuid_has(vcpu, X86_FEATURE_MPX);
++
++ if (mpx_enabled) {
++ vmx->nested.nested_vmx_entry_ctls_high |= VM_ENTRY_LOAD_BNDCFGS;
++ vmx->nested.nested_vmx_exit_ctls_high |= VM_EXIT_CLEAR_BNDCFGS;
++ } else {
++ vmx->nested.nested_vmx_entry_ctls_high &= ~VM_ENTRY_LOAD_BNDCFGS;
++ vmx->nested.nested_vmx_exit_ctls_high &= ~VM_EXIT_CLEAR_BNDCFGS;
++ }
++ }
++}
++
+ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
+@@ -9937,8 +9949,10 @@ static void vmx_cpuid_update(struct kvm_
+ to_vmx(vcpu)->msr_ia32_feature_control_valid_bits &=
+ ~FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
+
+- if (nested_vmx_allowed(vcpu))
++ if (nested_vmx_allowed(vcpu)) {
+ nested_vmx_cr_fixed1_bits_update(vcpu);
++ nested_vmx_entry_exit_ctls_update(vcpu);
++ }
+ }
+
+ static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
diff --git a/patches.arch/kvm-x86-do-not-use-kvm_x86_ops-mpx_supported-directly b/patches.arch/kvm-x86-do-not-use-kvm_x86_ops-mpx_supported-directly
new file mode 100644
index 0000000000..15e148d960
--- /dev/null
+++ b/patches.arch/kvm-x86-do-not-use-kvm_x86_ops-mpx_supported-directly
@@ -0,0 +1,40 @@
+From: Liran Alon <liran.alon@oracle.com>
+Date: Fri, 14 Sep 2018 03:25:53 +0300
+Subject: KVM: x86: Do not use kvm_x86_ops->mpx_supported() directly
+Git-commit: 503234b3fdcaa578395c07e393ea3e5d13958824
+Patch-mainline: v4.19-rc7
+References: bsc#1106240
+
+Commit a87036add092 ("KVM: x86: disable MPX if host did not enable
+MPX XSAVE features") introduced kvm_mpx_supported() to return true
+iff MPX is enabled in the host.
+
+However, that commit seems to have missed replacing some calls to
+kvm_x86_ops->mpx_supported() to kvm_mpx_supported().
+
+Complete original commit by replacing remaining calls to
+kvm_mpx_supported().
+
+Fixes: a87036add092 ("KVM: x86: disable MPX if host did not enable
+MPX XSAVE features")
+
+Suggested-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Liran Alon <liran.alon@oracle.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/vmx.c | 2 +-
+ arch/x86/kvm/x86.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -4355,7 +4355,7 @@ static void kvm_init_msr_list(void)
+ */
+ switch (msrs_to_save[i]) {
+ case MSR_IA32_BNDCFGS:
+- if (!kvm_x86_ops->mpx_supported())
++ if (!kvm_mpx_supported())
+ continue;
+ break;
+ case MSR_TSC_AUX:
diff --git a/patches.arch/x86-decoder-add-new-test-instruction-pattern b/patches.arch/x86-decoder-add-new-test-instruction-pattern
index 3074686be6..72e8a649e6 100644
--- a/patches.arch/x86-decoder-add-new-test-instruction-pattern
+++ b/patches.arch/x86-decoder-add-new-test-instruction-pattern
@@ -28,6 +28,9 @@ So, it seems TEST Ib is assigned to 001.
Add the new pattern.
+[ Also refresh the same file in tools/objtool/arch/x86/lib/x86-opcode-map.txt
+ where it was corrected secretly in the merge commit e53000b1ed93 -- tiwai ]
+
Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
@@ -40,11 +43,10 @@ Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Joerg Roedel <jroedel@suse.de>
---
- arch/x86/lib/x86-opcode-map.txt | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
+ arch/x86/lib/x86-opcode-map.txt | 2 +-
+ tools/objtool/arch/x86/lib/x86-opcode-map.txt | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
-index 12e377184ee4..c4d55919fac1 100644
--- a/arch/x86/lib/x86-opcode-map.txt
+++ b/arch/x86/lib/x86-opcode-map.txt
@@ -896,7 +896,7 @@ EndTable
@@ -56,4 +58,14 @@ index 12e377184ee4..c4d55919fac1 100644
2: NOT Eb
3: NEG Eb
4: MUL AL,Eb
-
+--- a/tools/objtool/arch/x86/lib/x86-opcode-map.txt
++++ b/tools/objtool/arch/x86/lib/x86-opcode-map.txt
+@@ -896,7 +896,7 @@ EndTable
+
+ GrpTable: Grp3_1
+ 0: TEST Eb,Ib
+-1:
++1: TEST Eb,Ib
+ 2: NOT Eb
+ 3: NEG Eb
+ 4: MUL AL,Eb
diff --git a/patches.arch/x86-vdso-fix-asm-constraints-on-vdso-syscall-fallbacks b/patches.arch/x86-vdso-fix-asm-constraints-on-vdso-syscall-fallbacks
new file mode 100644
index 0000000000..ee20e3bb08
--- /dev/null
+++ b/patches.arch/x86-vdso-fix-asm-constraints-on-vdso-syscall-fallbacks
@@ -0,0 +1,108 @@
+From: Andy Lutomirski <luto@kernel.org>
+Date: Mon, 1 Oct 2018 12:52:15 -0700
+Subject: x86/vdso: Fix asm constraints on vDSO syscall fallbacks
+Git-commit: 715bd9d12f84d8f5cc8ad21d888f9bc304a8eb0b
+Patch-mainline: v4.19-rc7
+References: bsc#1110006
+
+The syscall fallbacks in the vDSO have incorrect asm constraints.
+They are not marked as writing to their outputs -- instead, they are
+marked as clobbering "memory", which is useless. In particular, gcc
+is smart enough to know that the timespec parameter hasn't escaped,
+so a memory clobber doesn't clobber it. And passing a pointer as an
+asm *input* does not tell gcc that the pointed-to value is changed.
+
+Add in the fact that the asm instructions weren't volatile, and gcc
+was free to omit them entirely unless their sole output (the return
+value) is used. Which it is (phew!), but that stops happening with
+some upcoming patches.
+
+As a trivial example, the following code:
+
+void test_fallback(struct timespec *ts)
+{
+ vdso_fallback_gettime(CLOCK_MONOTONIC, ts);
+}
+
+compiles to:
+
+00000000000000c0 <test_fallback>:
+ c0: c3 retq
+
+To add insult to injury, the RCX and R11 clobbers on 64-bit
+builds were missing.
+
+The "memory" clobber is also unnecessary -- no ordering with respect to
+other memory operations is needed, but that's going to be fixed in a
+separate not-for-stable patch.
+
+Fixes: 2aae950b21e4 ("x86_64: Add vDSO for x86-64 with gettimeofday/clock_gettime/getcpu")
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/2c0231690551989d2fafa60ed0e7b5cc8b403908.1538422295.git.luto@kernel.org
+
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/entry/vdso/vclock_gettime.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/arch/x86/entry/vdso/vclock_gettime.c b/arch/x86/entry/vdso/vclock_gettime.c
+index f19856d95c60..134e2d2e8add 100644
+--- a/arch/x86/entry/vdso/vclock_gettime.c
++++ b/arch/x86/entry/vdso/vclock_gettime.c
+@@ -43,8 +43,9 @@ extern u8 hvclock_page
+ notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
+ {
+ long ret;
+- asm("syscall" : "=a" (ret) :
+- "0" (__NR_clock_gettime), "D" (clock), "S" (ts) : "memory");
++ asm ("syscall" : "=a" (ret), "=m" (*ts) :
++ "0" (__NR_clock_gettime), "D" (clock), "S" (ts) :
++ "memory", "rcx", "r11");
+ return ret;
+ }
+
+@@ -52,8 +53,9 @@ notrace static long vdso_fallback_gtod(struct timeval *tv, struct timezone *tz)
+ {
+ long ret;
+
+- asm("syscall" : "=a" (ret) :
+- "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
++ asm ("syscall" : "=a" (ret), "=m" (*tv), "=m" (*tz) :
++ "0" (__NR_gettimeofday), "D" (tv), "S" (tz) :
++ "memory", "rcx", "r11");
+ return ret;
+ }
+
+@@ -64,12 +66,12 @@ notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
+ {
+ long ret;
+
+- asm(
++ asm (
+ "mov %%ebx, %%edx \n"
+ "mov %2, %%ebx \n"
+ "call __kernel_vsyscall \n"
+ "mov %%edx, %%ebx \n"
+- : "=a" (ret)
++ : "=a" (ret), "=m" (*ts)
+ : "0" (__NR_clock_gettime), "g" (clock), "c" (ts)
+ : "memory", "edx");
+ return ret;
+@@ -79,12 +81,12 @@ notrace static long vdso_fallback_gtod(struct timeval *tv, struct timezone *tz)
+ {
+ long ret;
+
+- asm(
++ asm (
+ "mov %%ebx, %%edx \n"
+ "mov %2, %%ebx \n"
+ "call __kernel_vsyscall \n"
+ "mov %%edx, %%ebx \n"
+- : "=a" (ret)
++ : "=a" (ret), "=m" (*tv), "=m" (*tz)
+ : "0" (__NR_gettimeofday), "g" (tv), "c" (tz)
+ : "memory", "edx");
+ return ret;
+
diff --git a/patches.arch/x86-vdso-fix-vdso-syscall-fallback-asm-constraint-regression b/patches.arch/x86-vdso-fix-vdso-syscall-fallback-asm-constraint-regression
new file mode 100644
index 0000000000..e35bc282e3
--- /dev/null
+++ b/patches.arch/x86-vdso-fix-vdso-syscall-fallback-asm-constraint-regression
@@ -0,0 +1,58 @@
+From: Andy Lutomirski <luto@kernel.org>
+Date: Wed, 3 Oct 2018 16:23:49 -0700
+Subject: x86/vdso: Fix vDSO syscall fallback asm constraint regression
+Git-commit: 02e425668f5c9deb42787d10001a3b605993ad15
+Patch-mainline: v4.19-rc7
+References: bsc#1110006
+
+When I added the missing memory outputs, I failed to update the
+index of the first argument (ebx) on 32-bit builds, which broke the
+fallbacks. Somehow I must have screwed up my testing or gotten
+lucky.
+
+Add another test to cover gettimeofday() as well.
+
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Fixes: 715bd9d12f84 ("x86/vdso: Fix asm constraints on vDSO syscall fallbacks")
+Link: http://lkml.kernel.org/r/21bd45ab04b6d838278fa5bebfa9163eceffa13c.1538608971.git.luto@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/entry/vdso/vclock_gettime.c | 8 ++--
+ tools/testing/selftests/x86/test_vdso.c | 73 +++++++++++++++++++++++++++++++++
+ 2 files changed, 77 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/entry/vdso/vclock_gettime.c
++++ b/arch/x86/entry/vdso/vclock_gettime.c
+@@ -68,11 +68,11 @@ notrace static long vdso_fallback_gettim
+
+ asm (
+ "mov %%ebx, %%edx \n"
+- "mov %2, %%ebx \n"
++ "mov %[clock], %%ebx \n"
+ "call __kernel_vsyscall \n"
+ "mov %%edx, %%ebx \n"
+ : "=a" (ret), "=m" (*ts)
+- : "0" (__NR_clock_gettime), "g" (clock), "c" (ts)
++ : "0" (__NR_clock_gettime), [clock] "g" (clock), "c" (ts)
+ : "memory", "edx");
+ return ret;
+ }
+@@ -83,11 +83,11 @@ notrace static long vdso_fallback_gtod(s
+
+ asm (
+ "mov %%ebx, %%edx \n"
+- "mov %2, %%ebx \n"
++ "mov %[tv], %%ebx \n"
+ "call __kernel_vsyscall \n"
+ "mov %%edx, %%ebx \n"
+ : "=a" (ret), "=m" (*tv), "=m" (*tz)
+- : "0" (__NR_gettimeofday), "g" (tv), "c" (tz)
++ : "0" (__NR_gettimeofday), [tv] "g" (tv), "c" (tz)
+ : "memory", "edx");
+ return ret;
+ }
diff --git a/patches.drivers/IB-qedr-Remove-GID-add-del-dummy-routines.patch b/patches.drivers/IB-qedr-Remove-GID-add-del-dummy-routines.patch
deleted file mode 100644
index ba21ace728..0000000000
--- a/patches.drivers/IB-qedr-Remove-GID-add-del-dummy-routines.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From: Parav Pandit <parav@mellanox.com>
-Date: Sun, 1 Apr 2018 13:51:28 -0500
-Subject: IB/qedr: Remove GID add/del dummy routines
-Patch-mainline: v4.17-rc1
-Git-commit: ca486a3b338ea0858104bab80d86475de3575966
-References: bsc#1086314 FATE#324886 bsc#1086313 FATE#324885 bsc#1086301 FATE#3248881
-
-qedr driver's add_gid() and del_gid() callbacks are doing simple
-checks which are already done by the ib core before invoking these
-callback routines.
-
-Therefore, code is simplified to skip implementing add_gid() and
-del_gid() callback functions.
-
-Signed-off-by: Parav Pandit <parav@mellanox.com>
-Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
-Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
----
- drivers/infiniband/hw/qedr/main.c | 3 ---
- drivers/infiniband/hw/qedr/verbs.c | 31 -------------------------------
- drivers/infiniband/hw/qedr/verbs.h | 5 -----
- 3 files changed, 39 deletions(-)
-
---- a/drivers/infiniband/hw/qedr/main.c
-+++ b/drivers/infiniband/hw/qedr/main.c
-@@ -164,9 +164,6 @@ static void qedr_roce_register_device(st
- dev->ibdev.node_type = RDMA_NODE_IB_CA;
- dev->ibdev.query_gid = qedr_query_gid;
-
-- dev->ibdev.add_gid = qedr_add_gid;
-- dev->ibdev.del_gid = qedr_del_gid;
--
- dev->ibdev.get_port_immutable = qedr_roce_port_immutable;
- }
-
---- a/drivers/infiniband/hw/qedr/verbs.c
-+++ b/drivers/infiniband/hw/qedr/verbs.c
-@@ -105,37 +105,6 @@ int qedr_query_gid(struct ib_device *ibd
- return rc;
- }
-
--int qedr_add_gid(struct ib_device *device, u8 port_num,
-- unsigned int index, const union ib_gid *gid,
-- const struct ib_gid_attr *attr, void **context)
--{
-- if (!rdma_cap_roce_gid_table(device, port_num))
-- return -EINVAL;
--
-- if (port_num > QEDR_MAX_PORT)
-- return -EINVAL;
--
-- if (!context)
-- return -EINVAL;
--
-- return 0;
--}
--
--int qedr_del_gid(struct ib_device *device, u8 port_num,
-- unsigned int index, void **context)
--{
-- if (!rdma_cap_roce_gid_table(device, port_num))
-- return -EINVAL;
--
-- if (port_num > QEDR_MAX_PORT)
-- return -EINVAL;
--
-- if (!context)
-- return -EINVAL;
--
-- return 0;
--}
--
- int qedr_query_device(struct ib_device *ibdev,
- struct ib_device_attr *attr, struct ib_udata *udata)
- {
---- a/drivers/infiniband/hw/qedr/verbs.h
-+++ b/drivers/infiniband/hw/qedr/verbs.h
-@@ -48,11 +48,6 @@ struct ib_ucontext *qedr_alloc_ucontext(
- int qedr_dealloc_ucontext(struct ib_ucontext *);
-
- int qedr_mmap(struct ib_ucontext *, struct vm_area_struct *vma);
--int qedr_del_gid(struct ib_device *device, u8 port_num,
-- unsigned int index, void **context);
--int qedr_add_gid(struct ib_device *device, u8 port_num,
-- unsigned int index, const union ib_gid *gid,
-- const struct ib_gid_attr *attr, void **context);
- struct ib_pd *qedr_alloc_pd(struct ib_device *,
- struct ib_ucontext *, struct ib_udata *);
- int qedr_dealloc_pd(struct ib_pd *pd);
diff --git a/patches.drivers/ath10k-protect-ath10k_htt_rx_ring_free-with-rx_ring..patch b/patches.drivers/ath10k-protect-ath10k_htt_rx_ring_free-with-rx_ring..patch
new file mode 100644
index 0000000000..26299d7505
--- /dev/null
+++ b/patches.drivers/ath10k-protect-ath10k_htt_rx_ring_free-with-rx_ring..patch
@@ -0,0 +1,51 @@
+From 168f75f11fe68455e0d058a818ebccfc329d8685 Mon Sep 17 00:00:00 2001
+From: Ben Greear <greearb@candelatech.com>
+Date: Mon, 18 Jun 2018 17:00:56 +0300
+Subject: [PATCH] ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock
+Git-commit: 168f75f11fe68455e0d058a818ebccfc329d8685
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+While debugging driver crashes related to a buggy firmware
+crashing under load, I noticed that ath10k_htt_rx_ring_free
+could be called without being under lock. I'm not sure if this
+is the root cause of the crash or not, but it seems prudent to
+protect it.
+
+Originally tested on 4.16+ kernel with ath10k-ct 10.4 firmware
+running on 9984 NIC.
+
+Signed-off-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/ath/ath10k/htt_rx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -215,11 +215,12 @@ int ath10k_htt_rx_ring_refill(struct ath
+ spin_lock_bh(&htt->rx_ring.lock);
+ ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level -
+ htt->rx_ring.fill_cnt));
+- spin_unlock_bh(&htt->rx_ring.lock);
+
+ if (ret)
+ ath10k_htt_rx_ring_free(htt);
+
++ spin_unlock_bh(&htt->rx_ring.lock);
++
+ return ret;
+ }
+
+@@ -231,7 +232,9 @@ void ath10k_htt_rx_free(struct ath10k_ht
+ skb_queue_purge(&htt->rx_in_ord_compl_q);
+ skb_queue_purge(&htt->tx_fetch_ind_q);
+
++ spin_lock_bh(&htt->rx_ring.lock);
+ ath10k_htt_rx_ring_free(htt);
++ spin_unlock_bh(&htt->rx_ring.lock);
+
+ dma_free_coherent(htt->ar->dev,
+ (htt->rx_ring.size *
diff --git a/patches.drivers/clk-clk-fixed-factor-Clear-OF_POPULATED-flag-in-case.patch b/patches.drivers/clk-clk-fixed-factor-Clear-OF_POPULATED-flag-in-case.patch
new file mode 100644
index 0000000000..c76b2718f7
--- /dev/null
+++ b/patches.drivers/clk-clk-fixed-factor-Clear-OF_POPULATED-flag-in-case.patch
@@ -0,0 +1,50 @@
+From f6dab4233d6b64d719109040503b567f71fbfa01 Mon Sep 17 00:00:00 2001
+From: Rajan Vaja <rajan.vaja@xilinx.com>
+Date: Tue, 17 Jul 2018 06:17:00 -0700
+Subject: [PATCH] clk: clk-fixed-factor: Clear OF_POPULATED flag in case of failure
+Git-commit: f6dab4233d6b64d719109040503b567f71fbfa01
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Fixed factor clock has two initializations at of_clk_init() time
+and during platform driver probe. Before of_clk_init() call,
+node is marked as populated and so its probe never gets called.
+
+During of_clk_init() fixed factor clock registration may fail if
+any of its parent clock is not registered. In this case, it doesn't
+get chance to retry registration from probe. Clear OF_POPULATED
+flag if fixed factor clock registration fails so that clock
+registration is attempted again from probe.
+
+Signed-off-by: Rajan Vaja <rajan.vaja@xilinx.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/clk-fixed-factor.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c
+index a5d402de5584..20724abd38bd 100644
+--- a/drivers/clk/clk-fixed-factor.c
++++ b/drivers/clk/clk-fixed-factor.c
+@@ -177,8 +177,15 @@ static struct clk *_of_fixed_factor_clk_setup(struct device_node *node)
+
+ clk = clk_register_fixed_factor(NULL, clk_name, parent_name, flags,
+ mult, div);
+- if (IS_ERR(clk))
++ if (IS_ERR(clk)) {
++ /*
++ * If parent clock is not registered, registration would fail.
++ * Clear OF_POPULATED flag so that clock registration can be
++ * attempted again from probe function.
++ */
++ of_node_clear_flag(node, OF_POPULATED);
+ return clk;
++ }
+
+ ret = of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ if (ret) {
+--
+2.18.0
+
diff --git a/patches.drivers/clk-rockchip-Add-pclk_rkpwm_pmu-to-PMU-critical-cloc.patch b/patches.drivers/clk-rockchip-Add-pclk_rkpwm_pmu-to-PMU-critical-cloc.patch
new file mode 100644
index 0000000000..fcb4a93f26
--- /dev/null
+++ b/patches.drivers/clk-rockchip-Add-pclk_rkpwm_pmu-to-PMU-critical-cloc.patch
@@ -0,0 +1,46 @@
+From 640332d1a089909df08bc9f3e42888a2019c66e2 Mon Sep 17 00:00:00 2001
+From: Levin Du <djw@t-chip.com.cn>
+Date: Sat, 4 Aug 2018 15:31:02 +0800
+Subject: [PATCH] clk: rockchip: Add pclk_rkpwm_pmu to PMU critical clocks in rk3399
+Git-commit: 640332d1a089909df08bc9f3e42888a2019c66e2
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+PWM2 is commonly used to control voltage of PWM regulator of VDD_LOG in
+RK3399. On the Firefly-RK3399 board, PWM2 outputs 40 KHz square wave
+from power on and the VDD_LOG is about 0.9V. When the kernel boots
+normally into the system, the PWM2 keeps outputing PWM signal.
+
+But the kernel hangs randomly after "Starting kernel ..." line on that
+board. When it happens, PWM2 outputs high level which causes VDD_LOG
+drops to 0.4V below the normal operating voltage.
+
+By adding "pclk_rkpwm_pmu" to the rk3399_pmucru_critical_clocks array,
+PWM clock is ensured to be prepared at startup and the PWM2 output is
+normal. After repeated tests, the early boot hang is gone.
+
+This patch works on both Firefly-RK3399 and ROC-RK3399-PC boards.
+
+Signed-off-by: Levin Du <djw@t-chip.com.cn>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/rockchip/clk-rk3399.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c
+index 2a8634a52856..5a628148f3f0 100644
+--- a/drivers/clk/rockchip/clk-rk3399.c
++++ b/drivers/clk/rockchip/clk-rk3399.c
+@@ -1523,6 +1523,7 @@ static const char *const rk3399_pmucru_critical_clocks[] __initconst = {
+ "pclk_pmu_src",
+ "fclk_cm0s_src_pmu",
+ "clk_timer_src_pmu",
++ "pclk_rkpwm_pmu",
+ };
+
+ static void __init rk3399_clk_init(struct device_node *np)
+--
+2.18.0
+
diff --git a/patches.drivers/clk-tegra-bpmp-Don-t-crash-when-a-clock-fails-to-reg.patch b/patches.drivers/clk-tegra-bpmp-Don-t-crash-when-a-clock-fails-to-reg.patch
new file mode 100644
index 0000000000..cdf261dff5
--- /dev/null
+++ b/patches.drivers/clk-tegra-bpmp-Don-t-crash-when-a-clock-fails-to-reg.patch
@@ -0,0 +1,50 @@
+From f7b3182232c82bb9769e2d5471d702bae2972d2b Mon Sep 17 00:00:00 2001
+From: Mikko Perttunen <mperttunen@nvidia.com>
+Date: Fri, 29 Jun 2018 17:38:14 +0300
+Subject: [PATCH] clk: tegra: bpmp: Don't crash when a clock fails to register
+Git-commit: f7b3182232c82bb9769e2d5471d702bae2972d2b
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+When registering clocks, we just skip any that fail to register
+(leaving a NULL hole in the clock table). However, our of_xlate
+function still tries to dereference each entry while looking for
+the clock with the requested id, causing a crash if any clocks
+failed to register. Add a check to of_xlate to skip any NULL
+clocks.
+
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/tegra/clk-bpmp.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c
+index a896692b74ec..01dada561c10 100644
+--- a/drivers/clk/tegra/clk-bpmp.c
++++ b/drivers/clk/tegra/clk-bpmp.c
+@@ -586,9 +586,15 @@ static struct clk_hw *tegra_bpmp_clk_of_xlate(struct of_phandle_args *clkspec,
+ unsigned int id = clkspec->args[0], i;
+ struct tegra_bpmp *bpmp = data;
+
+- for (i = 0; i < bpmp->num_clocks; i++)
+- if (bpmp->clocks[i]->id == id)
+- return &bpmp->clocks[i]->hw;
++ for (i = 0; i < bpmp->num_clocks; i++) {
++ struct tegra_bpmp_clk *clk = bpmp->clocks[i];
++
++ if (!clk)
++ continue;
++
++ if (clk->id == id)
++ return &clk->hw;
++ }
+
+ return NULL;
+ }
+--
+2.18.0
+
diff --git a/patches.drivers/gpiolib-Free-the-last-requested-descriptor.patch b/patches.drivers/gpiolib-Free-the-last-requested-descriptor.patch
new file mode 100644
index 0000000000..53cf2f8c20
--- /dev/null
+++ b/patches.drivers/gpiolib-Free-the-last-requested-descriptor.patch
@@ -0,0 +1,41 @@
+From 19a4fbffc94e41abaa2a623a25ce2641d69eccf0 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Date: Thu, 13 Sep 2018 15:37:04 +0200
+Subject: [PATCH] gpiolib: Free the last requested descriptor
+Git-commit: 19a4fbffc94e41abaa2a623a25ce2641d69eccf0
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+The current code only frees N-1 gpios if an error occurs during
+gpiod_set_transitory, gpiod_direction_output or gpiod_direction_input.
+Leading to gpios that cannot be used by userspace nor other drivers.
+
+Cc: Timur Tabi <timur@codeaurora.org>
+Cc: stable@vger.kernel.org
+Fixes: ab3dbcf78f60f46d ("gpioib: do not free unrequested descriptors)
+Reported-by: Jan Lorenzen <jl@newtec.dk>
+Reported-by: Jim Paris <jim@jtan.com>
+Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpiolib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index e8f8a1999393..a57300c1d649 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -571,7 +571,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
+ if (ret)
+ goto out_free_descs;
+ lh->descs[i] = desc;
+- count = i;
++ count = i + 1;
+
+ if (lflags & GPIOHANDLE_REQUEST_ACTIVE_LOW)
+ set_bit(FLAG_ACTIVE_LOW, &desc->flags);
+--
+2.18.0
+
diff --git a/patches.drivers/hwmon-nct6775-Set-weight-source-to-zero-correctly.patch b/patches.drivers/hwmon-nct6775-Set-weight-source-to-zero-correctly.patch
new file mode 100644
index 0000000000..9aa481a224
--- /dev/null
+++ b/patches.drivers/hwmon-nct6775-Set-weight-source-to-zero-correctly.patch
@@ -0,0 +1,36 @@
+From e3f3d7ab00cd459d0f7a839758a4542f4d4b8ac8 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 5 Sep 2018 10:46:27 +0300
+Subject: [PATCH] hwmon: (nct6775) Set weight source to zero correctly
+Git-commit: e3f3d7ab00cd459d0f7a839758a4542f4d4b8ac8
+Patch-mainline: v4.19-rc5
+References: bsc#1051510
+
+This is dead code because j can never be 1 at this point. We had
+intended to just test if the bit was clear.
+
+Fixes: bbd8decd4123 ("hwmon: (nct6775) Add support for weighted fan control")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwmon/nct6775.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
+index 944f5b63aecd..139781ae830b 100644
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -1558,7 +1558,7 @@ static void nct6775_update_pwm(struct device *dev)
+ reg = nct6775_read_value(data, data->REG_WEIGHT_TEMP_SEL[i]);
+ data->pwm_weight_temp_sel[i] = reg & 0x1f;
+ /* If weight is disabled, report weight source as 0 */
+- if (j == 1 && !(reg & 0x80))
++ if (!(reg & 0x80))
+ data->pwm_weight_temp_sel[i] = 0;
+
+ /* Weight temp data */
+--
+2.18.0
+
diff --git a/patches.drivers/iommu-amd-clear-memory-encryption-mask-from-physical-address b/patches.drivers/iommu-amd-clear-memory-encryption-mask-from-physical-address
new file mode 100644
index 0000000000..e831214dca
--- /dev/null
+++ b/patches.drivers/iommu-amd-clear-memory-encryption-mask-from-physical-address
@@ -0,0 +1,54 @@
+From: "Singh, Brijesh" <brijesh.singh@amd.com>
+Date: Thu, 4 Oct 2018 21:40:23 +0000
+Subject: iommu/amd: Clear memory encryption mask from physical address
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: b3e9b515b08e407ab3a026dc2e4d935c48d05f69
+Patch-mainline: v4.19-rc7
+References: bsc#1106105
+
+Boris Ostrovsky reported a memory leak with device passthrough when SME
+is active.
+
+The VFIO driver uses iommu_iova_to_phys() to get the physical address for
+an iova. This physical address is later passed into vfio_unmap_unpin() to
+unpin the memory. The vfio_unmap_unpin() uses pfn_valid() before unpinning
+the memory. The pfn_valid() check was failing because encryption mask was
+part of the physical address returned. This resulted in the memory not
+being unpinned and therefore leaked after the guest terminates.
+
+The memory encryption mask must be cleared from the physical address in
+iommu_iova_to_phys().
+
+Fixes: 2543a786aa25 ("iommu/amd: Allow the AMD IOMMU to work with memory encryption")
+Reported-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Joerg Roedel <joro@8bytes.org>
+Cc: <iommu@lists.linux-foundation.org>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: kvm@vger.kernel.org
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: <stable@vger.kernel.org> # 4.14+
+Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 73e47d93e7a0..bee0dfb7b93b 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -3069,7 +3069,7 @@ static phys_addr_t amd_iommu_iova_to_phys(struct iommu_domain *dom,
+ return 0;
+
+ offset_mask = pte_pgsize - 1;
+- __pte = *pte & PM_ADDR_MASK;
++ __pte = __sme_clr(*pte & PM_ADDR_MASK);
+
+ return (__pte & ~offset_mask) | (iova & offset_mask);
+ }
+
diff --git a/patches.drivers/rtc-bq4802-add-error-handling-for-devm_ioremap.patch b/patches.drivers/rtc-bq4802-add-error-handling-for-devm_ioremap.patch
new file mode 100644
index 0000000000..8406bfffb7
--- /dev/null
+++ b/patches.drivers/rtc-bq4802-add-error-handling-for-devm_ioremap.patch
@@ -0,0 +1,39 @@
+From 7874b919866ba91bac253fa219d3d4c82bb944df Mon Sep 17 00:00:00 2001
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+Date: Tue, 12 Jun 2018 12:40:03 +0800
+Subject: [PATCH] rtc: bq4802: add error handling for devm_ioremap
+Git-commit: 7874b919866ba91bac253fa219d3d4c82bb944df
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+When devm_ioremap fails, the lack of error-handling code may
+cause unexpected results.
+
+This patch adds error-handling code after calling devm_ioremap.
+
+Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/rtc/rtc-bq4802.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/rtc/rtc-bq4802.c b/drivers/rtc/rtc-bq4802.c
+index d768f6747961..113493b52149 100644
+--- a/drivers/rtc/rtc-bq4802.c
++++ b/drivers/rtc/rtc-bq4802.c
+@@ -162,6 +162,10 @@ static int bq4802_probe(struct platform_device *pdev)
+ } else if (p->r->flags & IORESOURCE_MEM) {
+ p->regs = devm_ioremap(&pdev->dev, p->r->start,
+ resource_size(p->r));
++ if (!p->regs){
++ err = -ENOMEM;
++ goto out;
++ }
+ p->read = bq4802_read_mem;
+ p->write = bq4802_write_mem;
+ } else {
+--
+2.18.0
+
diff --git a/patches.drivers/thermal-of-thermal-disable-passive-polling-when-ther.patch b/patches.drivers/thermal-of-thermal-disable-passive-polling-when-ther.patch
new file mode 100644
index 0000000000..77d82cb201
--- /dev/null
+++ b/patches.drivers/thermal-of-thermal-disable-passive-polling-when-ther.patch
@@ -0,0 +1,47 @@
+From 152395fd03d4ce1e535a75cdbf58105e50587611 Mon Sep 17 00:00:00 2001
+From: Anson Huang <Anson.Huang@nxp.com>
+Date: Tue, 31 Jul 2018 00:56:49 +0800
+Subject: [PATCH] thermal: of-thermal: disable passive polling when thermal zone is disabled
+Git-commit: 152395fd03d4ce1e535a75cdbf58105e50587611
+Patch-mainline: v4.19-rc2
+References: bsc#1051510
+
+When thermal zone is in passive mode, disabling its mode from
+sysfs is NOT taking effect at all, it is still polling the
+temperature of the disabled thermal zone and handling all thermal
+trips, it makes user confused. The disabling operation should
+disable the thermal zone behavior completely, for both active and
+passive mode, this patch clears the passive_delay when thermal
+zone is disabled and restores it when it is enabled.
+
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/thermal/of-thermal.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
+index 977a8307fbb1..4f2816559205 100644
+--- a/drivers/thermal/of-thermal.c
++++ b/drivers/thermal/of-thermal.c
+@@ -260,10 +260,13 @@ static int of_thermal_set_mode(struct thermal_zone_device *tz,
+
+ mutex_lock(&tz->lock);
+
+- if (mode == THERMAL_DEVICE_ENABLED)
++ if (mode == THERMAL_DEVICE_ENABLED) {
+ tz->polling_delay = data->polling_delay;
+- else
++ tz->passive_delay = data->passive_delay;
++ } else {
+ tz->polling_delay = 0;
++ tz->passive_delay = 0;
++ }
+
+ mutex_unlock(&tz->lock);
+
+--
+2.18.0
+
diff --git a/patches.drivers/tsl2550-fix-lux1_input-error-in-low-light.patch b/patches.drivers/tsl2550-fix-lux1_input-error-in-low-light.patch
new file mode 100644
index 0000000000..777fc69487
--- /dev/null
+++ b/patches.drivers/tsl2550-fix-lux1_input-error-in-low-light.patch
@@ -0,0 +1,43 @@
+From ce054546cc2c26891cefa2f284d90d93b52205de Mon Sep 17 00:00:00 2001
+From: Matt Ranostay <matt.ranostay@konsulko.com>
+Date: Fri, 8 Jun 2018 23:58:15 -0700
+Subject: [PATCH] tsl2550: fix lux1_input error in low light
+Git-commit: ce054546cc2c26891cefa2f284d90d93b52205de
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+ADC channel 0 photodiode detects both infrared + visible light,
+but ADC channel 1 just detects infrared. However, the latter is a bit
+more sensitive in that range so complete darkness or low light causes
+a error condition in which the chan0 - chan1 is negative that
+results in a -EAGAIN.
+
+This patch changes the resulting lux1_input sysfs attribute message from
+"Resource temporarily unavailable" to a user-grokable lux value of 0.
+
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Matt Ranostay <matt.ranostay@konsulko.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/misc/tsl2550.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c
+index adf46072cb37..3fce3b6a3624 100644
+--- a/drivers/misc/tsl2550.c
++++ b/drivers/misc/tsl2550.c
+@@ -177,7 +177,7 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
+ } else
+ lux = 0;
+ else
+- return -EAGAIN;
++ return 0;
+
+ /* LUX range check */
+ return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
+--
+2.18.0
+
diff --git a/patches.drivers/usb-cdc_acm-Do-not-leak-URB-buffers.patch b/patches.drivers/usb-cdc_acm-Do-not-leak-URB-buffers.patch
new file mode 100644
index 0000000000..e989abb81c
--- /dev/null
+++ b/patches.drivers/usb-cdc_acm-Do-not-leak-URB-buffers.patch
@@ -0,0 +1,56 @@
+From f2924d4b16ae138c2de6a0e73f526fb638330858 Mon Sep 17 00:00:00 2001
+From: Romain Izard <romain.izard.pro@gmail.com>
+Date: Thu, 20 Sep 2018 16:49:04 +0200
+Subject: [PATCH] usb: cdc_acm: Do not leak URB buffers
+Git-commit: f2924d4b16ae138c2de6a0e73f526fb638330858
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+When the ACM TTY port is disconnected, the URBs it uses must be killed, and
+then the buffers must be freed. Unfortunately a previous refactor removed
+the code freeing the buffers because it looked extremely similar to the
+code killing the URBs.
+
+As a result, there were many new leaks for each plug/unplug cycle of a
+CDC-ACM device, that were detected by kmemleak.
+
+Restore the missing code, and the memory leak is removed.
+
+Fixes: ba8c931ded8d ("cdc-acm: refactor killing urbs")
+Signed-off-by: Romain Izard <romain.izard.pro@gmail.com>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index f9b40a9dc4d3..bc03b0a690b4 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1514,6 +1514,7 @@ static void acm_disconnect(struct usb_interface *intf)
+ {
+ struct acm *acm = usb_get_intfdata(intf);
+ struct tty_struct *tty;
++ int i;
+
+ /* sibling interface is already cleaning up */
+ if (!acm)
+@@ -1544,6 +1545,11 @@ static void acm_disconnect(struct usb_interface *intf)
+
+ tty_unregister_device(acm_tty_driver, acm->minor);
+
++ usb_free_urb(acm->ctrlurb);
++ for (i = 0; i < ACM_NW; i++)
++ usb_free_urb(acm->wb[i].urb);
++ for (i = 0; i < acm->rx_buflimit; i++)
++ usb_free_urb(acm->read_urbs[i]);
+ acm_write_buffers_free(acm);
+ usb_free_coherent(acm->dev, acm->ctrlsize, acm->ctrl_buffer, acm->ctrl_dma);
+ acm_read_buffers_free(acm);
+--
+2.18.0
+
diff --git a/patches.drivers/virtio-pci-legacy-Validate-queue-pfn.patch b/patches.drivers/virtio-pci-legacy-Validate-queue-pfn.patch
new file mode 100644
index 0000000000..a54ef0e689
--- /dev/null
+++ b/patches.drivers/virtio-pci-legacy-Validate-queue-pfn.patch
@@ -0,0 +1,74 @@
+From 69599206ea9a3f8f2e94d46580579cbf9d08ad6c Mon Sep 17 00:00:00 2001
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Wed, 18 Jul 2018 10:18:45 +0100
+Subject: [PATCH] virtio: pci-legacy: Validate queue pfn
+Git-commit: 69599206ea9a3f8f2e94d46580579cbf9d08ad6c
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Legacy PCI over virtio uses a 32bit PFN for the queue. If the
+queue pfn is too large to fit in 32bits, which we could hit on
+arm64 systems with 52bit physical addresses (even with 64K page
+size), we simply miss out a proper link to the other side of
+the queue.
+
+Add a check to validate the PFN, rather than silently breaking
+the devices.
+
+Cc: "Michael S. Tsirkin" <mst@redhat.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Christoffer Dall <cdall@kernel.org>
+Cc: Peter Maydel <peter.maydell@linaro.org>
+Cc: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/virtio/virtio_pci_legacy.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c
+index 2780886e8ba3..de062fb201bc 100644
+--- a/drivers/virtio/virtio_pci_legacy.c
++++ b/drivers/virtio/virtio_pci_legacy.c
+@@ -122,6 +122,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+ struct virtqueue *vq;
+ u16 num;
+ int err;
++ u64 q_pfn;
+
+ /* Select the queue we're interested in */
+ iowrite16(index, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_SEL);
+@@ -141,9 +142,17 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+ if (!vq)
+ return ERR_PTR(-ENOMEM);
+
++ q_pfn = virtqueue_get_desc_addr(vq) >> VIRTIO_PCI_QUEUE_ADDR_SHIFT;
++ if (q_pfn >> 32) {
++ dev_err(&vp_dev->pci_dev->dev,
++ "platform bug: legacy virtio-mmio must not be used with RAM above 0x%llxGB\n",
++ 0x1ULL << (32 + PAGE_SHIFT - 30));
++ err = -E2BIG;
++ goto out_del_vq;
++ }
++
+ /* activate the queue */
+- iowrite32(virtqueue_get_desc_addr(vq) >> VIRTIO_PCI_QUEUE_ADDR_SHIFT,
+- vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN);
++ iowrite32(q_pfn, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN);
+
+ vq->priv = (void __force *)vp_dev->ioaddr + VIRTIO_PCI_QUEUE_NOTIFY;
+
+@@ -160,6 +169,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+
+ out_deactivate:
+ iowrite32(0, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN);
++out_del_vq:
+ vring_del_virtqueue(vq);
+ return ERR_PTR(err);
+ }
+--
+2.18.0
+
diff --git a/patches.fixes/PM-core-Clear-the-direct_complete-flag-on-errors.patch b/patches.fixes/PM-core-Clear-the-direct_complete-flag-on-errors.patch
new file mode 100644
index 0000000000..2dfd2ee7a2
--- /dev/null
+++ b/patches.fixes/PM-core-Clear-the-direct_complete-flag-on-errors.patch
@@ -0,0 +1,58 @@
+From 69e445ab8b66a9f30519842ef18be555d3ee9b51 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 4 Oct 2018 11:08:12 +0200
+Subject: [PATCH] PM / core: Clear the direct_complete flag on errors
+Git-commit: 69e445ab8b66a9f30519842ef18be555d3ee9b51
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+If __device_suspend() runs asynchronously (in which case the device
+passed to it is in dpm_suspended_list at that point) and it returns
+early on an error or pending wakeup, and the power.direct_complete
+flag has been set for the device already, the subsequent
+device_resume() will be confused by that and it will call
+pm_runtime_enable() incorrectly, as runtime PM has not been
+disabled for the device by __device_suspend().
+
+To avoid that, clear power.direct_complete if __device_suspend()
+is not going to disable runtime PM for the device before returning.
+
+Fixes: aae4518b3124 (PM / sleep: Mechanism to avoid resuming runtime-suspended devices unnecessarily)
+Reported-by: Al Cooper <alcooperx@gmail.com>
+Tested-by: Al Cooper <alcooperx@gmail.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Cc: 3.16+ <stable@vger.kernel.org> # 3.16+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/base/power/main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 3f68e2919dc5..a690fd400260 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -1713,8 +1713,10 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
+
+ dpm_wait_for_subordinate(dev, async);
+
+- if (async_error)
++ if (async_error) {
++ dev->power.direct_complete = false;
+ goto Complete;
++ }
+
+ /*
+ * If a device configured to wake up the system from sleep states
+@@ -1726,6 +1728,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
+ pm_wakeup_event(dev, 0);
+
+ if (pm_wakeup_pending()) {
++ dev->power.direct_complete = false;
+ async_error = -EBUSY;
+ goto Complete;
+ }
+--
+2.18.0
+
diff --git a/patches.fixes/cifs-integer-overflow-in-in-SMB2_ioctl.patch b/patches.fixes/cifs-integer-overflow-in-in-SMB2_ioctl.patch
new file mode 100644
index 0000000000..9259863374
--- /dev/null
+++ b/patches.fixes/cifs-integer-overflow-in-in-SMB2_ioctl.patch
@@ -0,0 +1,41 @@
+From 2d204ee9d671327915260071c19350d84344e096 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 10 Sep 2018 14:12:07 +0300
+Subject: [PATCH] cifs: integer overflow in in SMB2_ioctl()
+Patch-mainline: v4.19-rc4
+Git-commit: 2d204ee9d671327915260071c19350d84344e096
+References: bsc#1051510
+
+The "le32_to_cpu(rsp->OutputOffset) + *plen" addition can overflow and
+wrap around to a smaller value which looks like it would lead to an
+information leak.
+
+Fixes: 4a72dafa19ba ("SMB2 FSCTL and IOCTL worker function")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+CC: Stable <stable@vger.kernel.org>
+Acked-by: Paulo Alcantara <palcantara@suse.de>
+---
+ fs/cifs/smb2pdu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -1745,14 +1745,14 @@ SMB2_ioctl(const unsigned int xid, struc
+ /* We check for obvious errors in the output buffer length and offset */
+ if (*plen == 0)
+ goto ioctl_exit; /* server returned no data */
+- else if (*plen > 0xFF00) {
++ else if (*plen > get_rfc1002_length(rsp) || *plen > 0xFF00) {
+ cifs_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen);
+ *plen = 0;
+ rc = -EIO;
+ goto ioctl_exit;
+ }
+
+- if (get_rfc1002_length(rsp) < le32_to_cpu(rsp->OutputOffset) + *plen) {
++ if (get_rfc1002_length(rsp) - *plen < le32_to_cpu(rsp->OutputOffset)) {
+ cifs_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen,
+ le32_to_cpu(rsp->OutputOffset));
+ *plen = 0;
diff --git a/patches.fixes/crypto-caam-jr-fix-ablkcipher_edesc-pointer-arithmet.patch b/patches.fixes/crypto-caam-jr-fix-ablkcipher_edesc-pointer-arithmet.patch
new file mode 100644
index 0000000000..03346272f6
--- /dev/null
+++ b/patches.fixes/crypto-caam-jr-fix-ablkcipher_edesc-pointer-arithmet.patch
@@ -0,0 +1,63 @@
+From 13cc6f48c7434ce46ba6dbc90003a136a263d75a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Horia=20Geant=C4=83?= <horia.geanta@nxp.com>
+Date: Fri, 14 Sep 2018 18:34:28 +0300
+Subject: [PATCH] crypto: caam/jr - fix ablkcipher_edesc pointer arithmetic
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 13cc6f48c7434ce46ba6dbc90003a136a263d75a
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+In some cases the zero-length hw_desc array at the end of
+ablkcipher_edesc struct requires for 4B of tail padding.
+
+Due to tail padding and the way pointers to S/G table and IV
+are computed:
+ edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) +
+ desc_bytes;
+ iv = (u8 *)edesc->hw_desc + desc_bytes + sec4_sg_bytes;
+first 4 bytes of IV are overwritten by S/G table.
+
+Update computation of pointer to S/G table to rely on offset of hw_desc
+member and not on sizeof() operator.
+
+Cc: <stable@vger.kernel.org> # 4.13+
+Fixes: 115957bb3e59 ("crypto: caam - fix IV DMA mapping and updating")
+Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/caam/caamalg.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index d67667970f7e..ec40f991e6c6 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -1553,8 +1553,8 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request
+ edesc->src_nents = src_nents;
+ edesc->dst_nents = dst_nents;
+ edesc->sec4_sg_bytes = sec4_sg_bytes;
+- edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) +
+- desc_bytes;
++ edesc->sec4_sg = (struct sec4_sg_entry *)((u8 *)edesc->hw_desc +
++ desc_bytes);
+ edesc->iv_dir = DMA_TO_DEVICE;
+
+ /* Make sure IV is located in a DMAable area */
+@@ -1757,8 +1757,8 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc(
+ edesc->src_nents = src_nents;
+ edesc->dst_nents = dst_nents;
+ edesc->sec4_sg_bytes = sec4_sg_bytes;
+- edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) +
+- desc_bytes;
++ edesc->sec4_sg = (struct sec4_sg_entry *)((u8 *)edesc->hw_desc +
++ desc_bytes);
+ edesc->iv_dir = DMA_FROM_DEVICE;
+
+ /* Make sure IV is located in a DMAable area */
+--
+2.18.0
+
diff --git a/patches.fixes/crypto-cavium-nitrox-fix-for-command-corruption-in-q.patch b/patches.fixes/crypto-cavium-nitrox-fix-for-command-corruption-in-q.patch
new file mode 100644
index 0000000000..c6724b3641
--- /dev/null
+++ b/patches.fixes/crypto-cavium-nitrox-fix-for-command-corruption-in-q.patch
@@ -0,0 +1,190 @@
+From 3d7c82060d1fe65bde4023aac41a0b1bd7718e07 Mon Sep 17 00:00:00 2001
+From: Srikanth Jampala <Jampala.Srikanth@cavium.com>
+Date: Wed, 22 Aug 2018 12:40:52 +0530
+Subject: [PATCH] crypto: cavium/nitrox - fix for command corruption in queue full case with backlog submissions.
+Git-commit: 3d7c82060d1fe65bde4023aac41a0b1bd7718e07
+Patch-mainline: v4.19-rc2
+References: bsc#1051510
+
+Earlier used to post the current command without checking queue full
+ after backlog submissions. So, post the current command only after
+ confirming the space in queue after backlog submissions.
+
+ Maintain host write index instead of reading device registers
+ to get the next free slot to post the command.
+
+ Return -ENOSPC in queue full case.
+
+Signed-off-by: Srikanth Jampala <Jampala.Srikanth@cavium.com>
+Reviewed-by: Gadam Sreerama <sgadam@cavium.com>
+Tested-by: Jha, Chandan <Chandan.Jha@cavium.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/cavium/nitrox/nitrox_dev.h | 3 +-
+ drivers/crypto/cavium/nitrox/nitrox_lib.c | 1 +
+ drivers/crypto/cavium/nitrox/nitrox_reqmgr.c | 57 +++++++++++---------
+ 3 files changed, 35 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/crypto/cavium/nitrox/nitrox_dev.h b/drivers/crypto/cavium/nitrox/nitrox_dev.h
+index 9a476bb6d4c7..af596455b420 100644
+--- a/drivers/crypto/cavium/nitrox/nitrox_dev.h
++++ b/drivers/crypto/cavium/nitrox/nitrox_dev.h
+@@ -35,6 +35,7 @@ struct nitrox_cmdq {
+ /* requests in backlog queues */
+ atomic_t backlog_count;
+
++ int write_idx;
+ /* command size 32B/64B */
+ u8 instr_size;
+ u8 qno;
+@@ -87,7 +88,7 @@ struct nitrox_bh {
+ struct bh_data *slc;
+ };
+
+-/* NITROX-5 driver state */
++/* NITROX-V driver state */
+ #define NITROX_UCODE_LOADED 0
+ #define NITROX_READY 1
+
+diff --git a/drivers/crypto/cavium/nitrox/nitrox_lib.c b/drivers/crypto/cavium/nitrox/nitrox_lib.c
+index ebe267379ac9..4d31df07777f 100644
+--- a/drivers/crypto/cavium/nitrox/nitrox_lib.c
++++ b/drivers/crypto/cavium/nitrox/nitrox_lib.c
+@@ -36,6 +36,7 @@ static int cmdq_common_init(struct nitrox_cmdq *cmdq)
+ cmdq->head = PTR_ALIGN(cmdq->head_unaligned, PKT_IN_ALIGN);
+ cmdq->dma = PTR_ALIGN(cmdq->dma_unaligned, PKT_IN_ALIGN);
+ cmdq->qsize = (qsize + PKT_IN_ALIGN);
++ cmdq->write_idx = 0;
+
+ spin_lock_init(&cmdq->response_lock);
+ spin_lock_init(&cmdq->cmdq_lock);
+diff --git a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+index deaefd532aaa..4a362fc22f62 100644
+--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
++++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+@@ -42,6 +42,16 @@
+ * Invalid flag options in AES-CCM IV.
+ */
+
++static inline int incr_index(int index, int count, int max)
++{
++ if ((index + count) >= max)
++ index = index + count - max;
++ else
++ index += count;
++
++ return index;
++}
++
+ /**
+ * dma_free_sglist - unmap and free the sg lists.
+ * @ndev: N5 device
+@@ -426,30 +436,29 @@ static void post_se_instr(struct nitrox_softreq *sr,
+ struct nitrox_cmdq *cmdq)
+ {
+ struct nitrox_device *ndev = sr->ndev;
+- union nps_pkt_in_instr_baoff_dbell pkt_in_baoff_dbell;
+- u64 offset;
++ int idx;
+ u8 *ent;
+
+ spin_lock_bh(&cmdq->cmdq_lock);
+
+- /* get the next write offset */
+- offset = NPS_PKT_IN_INSTR_BAOFF_DBELLX(cmdq->qno);
+- pkt_in_baoff_dbell.value = nitrox_read_csr(ndev, offset);
++ idx = cmdq->write_idx;
+ /* copy the instruction */
+- ent = cmdq->head + pkt_in_baoff_dbell.s.aoff;
++ ent = cmdq->head + (idx * cmdq->instr_size);
+ memcpy(ent, &sr->instr, cmdq->instr_size);
+- /* flush the command queue updates */
+- dma_wmb();
+
+- sr->tstamp = jiffies;
+ atomic_set(&sr->status, REQ_POSTED);
+ response_list_add(sr, cmdq);
++ sr->tstamp = jiffies;
++ /* flush the command queue updates */
++ dma_wmb();
+
+ /* Ring doorbell with count 1 */
+ writeq(1, cmdq->dbell_csr_addr);
+ /* orders the doorbell rings */
+ mmiowb();
+
++ cmdq->write_idx = incr_index(idx, 1, ndev->qlen);
++
+ spin_unlock_bh(&cmdq->cmdq_lock);
+ }
+
+@@ -459,6 +468,9 @@ static int post_backlog_cmds(struct nitrox_cmdq *cmdq)
+ struct nitrox_softreq *sr, *tmp;
+ int ret = 0;
+
++ if (!atomic_read(&cmdq->backlog_count))
++ return 0;
++
+ spin_lock_bh(&cmdq->backlog_lock);
+
+ list_for_each_entry_safe(sr, tmp, &cmdq->backlog_head, backlog) {
+@@ -466,7 +478,7 @@ static int post_backlog_cmds(struct nitrox_cmdq *cmdq)
+
+ /* submit until space available */
+ if (unlikely(cmdq_full(cmdq, ndev->qlen))) {
+- ret = -EBUSY;
++ ret = -ENOSPC;
+ break;
+ }
+ /* delete from backlog list */
+@@ -491,23 +503,20 @@ static int nitrox_enqueue_request(struct nitrox_softreq *sr)
+ {
+ struct nitrox_cmdq *cmdq = sr->cmdq;
+ struct nitrox_device *ndev = sr->ndev;
+- int ret = -EBUSY;
++
++ /* try to post backlog requests */
++ post_backlog_cmds(cmdq);
+
+ if (unlikely(cmdq_full(cmdq, ndev->qlen))) {
+ if (!(sr->flags & CRYPTO_TFM_REQ_MAY_BACKLOG))
+- return -EAGAIN;
+-
++ return -ENOSPC;
++ /* add to backlog list */
+ backlog_list_add(sr, cmdq);
+- } else {
+- ret = post_backlog_cmds(cmdq);
+- if (ret) {
+- backlog_list_add(sr, cmdq);
+- return ret;
+- }
+- post_se_instr(sr, cmdq);
+- ret = -EINPROGRESS;
++ return -EBUSY;
+ }
+- return ret;
++ post_se_instr(sr, cmdq);
++
++ return -EINPROGRESS;
+ }
+
+ /**
+@@ -624,11 +633,9 @@ int nitrox_process_se_request(struct nitrox_device *ndev,
+ */
+ sr->instr.fdata[0] = *((u64 *)&req->gph);
+ sr->instr.fdata[1] = 0;
+- /* flush the soft_req changes before posting the cmd */
+- wmb();
+
+ ret = nitrox_enqueue_request(sr);
+- if (ret == -EAGAIN)
++ if (ret == -ENOSPC)
+ goto send_fail;
+
+ return ret;
+--
+2.18.0
+
diff --git a/patches.fixes/fuse-Don-t-access-pipe-buffers-without-pipe_lock.patch b/patches.fixes/fuse-Don-t-access-pipe-buffers-without-pipe_lock.patch
new file mode 100644
index 0000000000..8ab55701e8
--- /dev/null
+++ b/patches.fixes/fuse-Don-t-access-pipe-buffers-without-pipe_lock.patch
@@ -0,0 +1,44 @@
+From a2477b0e67c52f4364a47c3ad70902bc2a61bd4c Mon Sep 17 00:00:00 2001
+From: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Date: Tue, 17 Jul 2018 19:00:33 +0300
+Subject: [PATCH] fuse: Don't access pipe->buffers without pipe_lock()
+Git-commit: a2477b0e67c52f4364a47c3ad70902bc2a61bd4c
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+fuse_dev_splice_write() reads pipe->buffers to determine the size of
+'bufs' array before taking the pipe_lock(). This is not safe as
+another thread might change the 'pipe->buffers' between the allocation
+and taking the pipe_lock(). So we end up with too small 'bufs' array.
+
+Move the bufs allocations inside pipe_lock()/pipe_unlock() to fix this.
+
+Fixes: dd3bb14f44a6 ("fuse: support splice() writing to fuse device")
+Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: <stable@vger.kernel.org> # v2.6.35
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ fs/fuse/dev.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -1946,11 +1946,14 @@ static ssize_t fuse_dev_splice_write(str
+ if (!fud)
+ return -EPERM;
+
++ pipe_lock(pipe);
++
+ bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
+- if (!bufs)
++ if (!bufs) {
++ pipe_unlock(pipe);
+ return -ENOMEM;
++ }
+
+- pipe_lock(pipe);
+ nbuf = 0;
+ rem = 0;
+ for (idx = 0; idx < pipe->nrbufs && rem < len; idx++)
diff --git a/patches.fixes/irq-core-Fix-boot-crash-when-the-irqaffinity-boot-pa.patch b/patches.fixes/irq-core-Fix-boot-crash-when-the-irqaffinity-boot-pa.patch
new file mode 100644
index 0000000000..e1ce107089
--- /dev/null
+++ b/patches.fixes/irq-core-Fix-boot-crash-when-the-irqaffinity-boot-pa.patch
@@ -0,0 +1,58 @@
+From 10d94ff4d558b96bfc4f55bb0051ae4d938246fe Mon Sep 17 00:00:00 2001
+From: Rakib Mullick <rakib.mullick@gmail.com>
+Date: Wed, 1 Nov 2017 10:14:51 +0600
+Subject: [PATCH] irq/core: Fix boot crash when the irqaffinity= boot parameter is passed on CPUMASK_OFFSTACK=y kernels(v1)
+Git-commit: 10d94ff4d558b96bfc4f55bb0051ae4d938246fe
+Patch-mainline: v4.15-rc1
+References: bsc#1051510
+
+When the irqaffinity= kernel parameter is passed in a CPUMASK_OFFSTACK=y
+kernel, it fails to boot, because zalloc_cpumask_var() cannot be used before
+initializing the slab allocator to allocate a cpumask.
+
+So, use alloc_bootmem_cpumask_var() instead.
+
+Also do some cleanups while at it: in init_irq_default_affinity() remove
+an #ifdef via using cpumask_available().
+
+Signed-off-by: Rakib Mullick <rakib.mullick@gmail.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20171026045800.27087-1-rakib.mullick@gmail.com
+Link: http://lkml.kernel.org/r/20171101041451.12581-1-rakib.mullick@gmail.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ kernel/irq/irqdesc.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index 982a3576fb01..f2edcf85780d 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -27,7 +27,7 @@ static struct lock_class_key irq_desc_lock_class;
+ #if defined(CONFIG_SMP)
+ static int __init irq_affinity_setup(char *str)
+ {
+- zalloc_cpumask_var(&irq_default_affinity, GFP_NOWAIT);
++ alloc_bootmem_cpumask_var(&irq_default_affinity);
+ cpulist_parse(str, irq_default_affinity);
+ /*
+ * Set at least the boot cpu. We don't want to end up with
+@@ -40,10 +40,8 @@ __setup("irqaffinity=", irq_affinity_setup);
+
+ static void __init init_irq_default_affinity(void)
+ {
+-#ifdef CONFIG_CPUMASK_OFFSTACK
+- if (!irq_default_affinity)
++ if (!cpumask_available(irq_default_affinity))
+ zalloc_cpumask_var(&irq_default_affinity, GFP_NOWAIT);
+-#endif
+ if (cpumask_empty(irq_default_affinity))
+ cpumask_setall(irq_default_affinity);
+ }
+--
+2.18.0
+
diff --git a/patches.fixes/mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch b/patches.fixes/mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch
new file mode 100644
index 0000000000..e99c5e4ea4
--- /dev/null
+++ b/patches.fixes/mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch
@@ -0,0 +1,38 @@
+From 211710ca74adf790b46ab3867fcce8047b573cd1 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 29 Sep 2018 16:01:58 +0200
+Subject: [PATCH] mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode keys
+Git-commit: 211710ca74adf790b46ab3867fcce8047b573cd1
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+key->sta is only valid after ieee80211_key_link, which is called later
+in this function. Because of that, the IEEE80211_KEY_FLAG_RX_MGMT is
+never set when management frame protection is enabled.
+
+Fixes: e548c49e6dc6b ("mac80211: add key flag for management keys")
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/cfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index d25da0e66da1..5d22eda8a6b1 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -427,7 +427,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+ case NL80211_IFTYPE_AP:
+ case NL80211_IFTYPE_AP_VLAN:
+ /* Keys without a station are used for TX only */
+- if (key->sta && test_sta_flag(key->sta, WLAN_STA_MFP))
++ if (sta && test_sta_flag(sta, WLAN_STA_MFP))
+ key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
+ break;
+ case NL80211_IFTYPE_ADHOC:
+--
+2.18.0
+
diff --git a/patches.fixes/udp-Unbreak-modules-that-rely-on-external-__skb_recv.patch b/patches.fixes/udp-Unbreak-modules-that-rely-on-external-__skb_recv.patch
new file mode 100644
index 0000000000..e832014a4c
--- /dev/null
+++ b/patches.fixes/udp-Unbreak-modules-that-rely-on-external-__skb_recv.patch
@@ -0,0 +1,43 @@
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Thu, 4 Oct 2018 13:37:32 +0200
+Subject: udp: Unbreak modules that rely on external __skb_recv_udp() availability
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
+Git-commit: 7e823644b60555f70f241274b8d0120dd919269a
+References: bsc#1109151
+
+Commit 2276f58ac589 ("udp: use a separate rx queue for packet reception")
+turned static inline __skb_recv_udp() from being a trivial helper around
+__skb_recv_datagram() into a UDP specific implementaion, making it
+EXPORT_SYMBOL_GPL() at the same time.
+
+There are external modules that got broken by __skb_recv_udp() not being
+visible to them. Let's unbreak them by making __skb_recv_udp EXPORT_SYMBOL().
+
+Rationale (one of those) why this is actually "technically correct" thing
+to do: __skb_recv_udp() used to be an inline wrapper around
+__skb_recv_datagram(), which itself (still, and correctly so, I believe)
+is EXPORT_SYMBOL().
+
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Eric Dumazet <edumazet@google.com>
+Fixes: 2276f58ac589 ("udp: use a separate rx queue for packet reception")
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Kubecek <mkubecek@suse.cz>
+
+---
+ net/ipv4/udp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1512,7 +1512,7 @@ struct sk_buff *__skb_recv_udp(struct sock *sk, unsigned int flags,
+ *err = error;
+ return NULL;
+ }
+-EXPORT_SYMBOL_GPL(__skb_recv_udp);
++EXPORT_SYMBOL(__skb_recv_udp);
+
+ /*
+ * This should be easy, if there is something there we
diff --git a/patches.suse/PCI-dwc-Fix-scheduling-while-atomic-issues.patch b/patches.suse/PCI-dwc-Fix-scheduling-while-atomic-issues.patch
new file mode 100644
index 0000000000..d11fefc50f
--- /dev/null
+++ b/patches.suse/PCI-dwc-Fix-scheduling-while-atomic-issues.patch
@@ -0,0 +1,86 @@
+From: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
+Date: Thu, 20 Sep 2018 16:32:52 -0500
+Subject: PCI: dwc: Fix scheduling while atomic issues
+Git-commit: 9024143e700f89d74b8cdaf316a3499d74fc56fe
+Patch-mainline: v4.19-rc6
+References: git-fixes
+
+When programming the inbound/outbound ATUs, we call usleep_range() after
+each checking PCIE_ATU_ENABLE bit. Unfortunately, the ATU programming
+can be executed in atomic context:
+
+inbound ATU programming could be called through
+pci_epc_write_header()
+ =>dw_pcie_ep_write_header()
+ =>dw_pcie_prog_inbound_atu()
+
+outbound ATU programming could be called through
+pci_bus_read_config_dword()
+ =>dw_pcie_rd_conf()
+ =>dw_pcie_prog_outbound_atu()
+
+Fix this issue by calling mdelay() instead.
+
+Fixes: f8aed6ec624f ("PCI: dwc: designware: Add EP mode support")
+Fixes: d8bbeb39fbf3 ("PCI: designware: Wait for iATU enable")
+Signed-off-by: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
+[lorenzo.pieralisi@arm.com: commit log update]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pci/dwc/pcie-designware.c | 8 ++++----
+ drivers/pci/dwc/pcie-designware.h | 3 +--
+ 2 files changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/pci/dwc/pcie-designware.c
++++ b/drivers/pci/dwc/pcie-designware.c
+@@ -137,7 +137,7 @@ void dw_pcie_prog_outbound_atu_unroll(st
+ if (val & PCIE_ATU_ENABLE)
+ return;
+
+- usleep_range(LINK_WAIT_IATU_MIN, LINK_WAIT_IATU_MAX);
++ mdelay(LINK_WAIT_IATU);
+ }
+ dev_err(pci->dev, "outbound iATU is not being enabled\n");
+ }
+@@ -180,7 +180,7 @@ void dw_pcie_prog_outbound_atu(struct dw
+ if (val == PCIE_ATU_ENABLE)
+ return;
+
+- usleep_range(LINK_WAIT_IATU_MIN, LINK_WAIT_IATU_MAX);
++ mdelay(LINK_WAIT_IATU);
+ }
+ dev_err(pci->dev, "outbound iATU is not being enabled\n");
+ }
+@@ -237,7 +237,7 @@ int dw_pcie_prog_inbound_atu_unroll(stru
+ if (val & PCIE_ATU_ENABLE)
+ return 0;
+
+- usleep_range(LINK_WAIT_IATU_MIN, LINK_WAIT_IATU_MAX);
++ mdelay(LINK_WAIT_IATU);
+ }
+ dev_err(pci->dev, "inbound iATU is not being enabled\n");
+
+@@ -283,7 +283,7 @@ int dw_pcie_prog_inbound_atu(struct dw_p
+ if (val & PCIE_ATU_ENABLE)
+ return 0;
+
+- usleep_range(LINK_WAIT_IATU_MIN, LINK_WAIT_IATU_MAX);
++ mdelay(LINK_WAIT_IATU);
+ }
+ dev_err(pci->dev, "inbound iATU is not being enabled\n");
+
+--- a/drivers/pci/dwc/pcie-designware.h
++++ b/drivers/pci/dwc/pcie-designware.h
+@@ -28,8 +28,7 @@
+
+ /* Parameters for the waiting for iATU enabled routine */
+ #define LINK_WAIT_MAX_IATU_RETRIES 5
+-#define LINK_WAIT_IATU_MIN 9000
+-#define LINK_WAIT_IATU_MAX 10000
++#define LINK_WAIT_IATU 9
+
+ /* Synopsys-specific PCIe configuration registers */
+ #define PCIE_PORT_LINK_CONTROL 0x710
diff --git a/patches.suse/ipv4-fix-use-after-free-in-ip_cmsg_recv_dstaddr.patch b/patches.suse/ipv4-fix-use-after-free-in-ip_cmsg_recv_dstaddr.patch
new file mode 100644
index 0000000000..d50cba2bbc
--- /dev/null
+++ b/patches.suse/ipv4-fix-use-after-free-in-ip_cmsg_recv_dstaddr.patch
@@ -0,0 +1,40 @@
+From: Eric Dumazet <edumazet@google.com>
+Date: Sun, 30 Sep 2018 11:33:39 -0700
+Subject: ipv4: fix use-after-free in ip_cmsg_recv_dstaddr()
+Git-commit: 64199fc0a46ba211362472f7f942f900af9492fd
+Patch-mainline: v4.19-rc7
+References: git-fixes
+
+Caching ip_hdr(skb) before a call to pskb_may_pull() is buggy,
+do not do it.
+
+Fixes: 2efd4fca703a ("ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv4/ip_sockglue.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -146,7 +146,6 @@ static void ip_cmsg_recv_security(struct
+ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
+ {
+ struct sockaddr_in sin;
+- const struct iphdr *iph = ip_hdr(skb);
+ __be16 *ports;
+ int end;
+
+@@ -161,7 +160,7 @@ static void ip_cmsg_recv_dstaddr(struct
+ ports = (__be16 *)skb_transport_header(skb);
+
+ sin.sin_family = AF_INET;
+- sin.sin_addr.s_addr = iph->daddr;
++ sin.sin_addr.s_addr = ip_hdr(skb)->daddr;
+ sin.sin_port = ports[1];
+ memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
+
diff --git a/series.conf b/series.conf
index 304aa0662c..49a551d658 100644
--- a/series.conf
+++ b/series.conf
@@ -7873,6 +7873,7 @@
patches.suse/irqchip-gic-v3-its-Limit-scope-of-VPE-mapping-to-be-.patch
patches.suse/irqchip-gic-v3-its-Only-send-VINVALL-to-a-single-ITS.patch
patches.suse/irqchip-gic-v3-its-Update-effective-affinity-on-VPE-.patch
+ patches.fixes/irq-core-Fix-boot-crash-when-the-irqaffinity-boot-pa.patch
patches.suse/irqchip-gic-v3-its-Setup-VLPI-properties-at-map-time.patch
patches.suse/irqchip-gic-Deal-with-broken-firmware-exposing-only-.patch
patches.fixes/irqdomain-Update-the-comments-of-fwnode-field-of-irq.patch
@@ -14796,7 +14797,6 @@
patches.drivers/IB-core-Refer-to-RoCE-port-property-instead-of-GID-t.patch
patches.drivers/qedr-Fix-spelling-mistake-hanlde-handle.patch
patches.drivers/iw_cxgb4-print-mapped-ports-correctly.patch
- patches.drivers/IB-qedr-Remove-GID-add-del-dummy-routines.patch
patches.drivers/RDMA-ucma-Don-t-allow-setting-RDMA_OPTION_IB_PATH-wi.patch
patches.drivers/RDMA-qedr-Zero-stack-memory-before-copying-to-user-s.patch
patches.drivers/RDMA-qedr-Fix-wmb-usage-in-qedr.patch
@@ -17357,6 +17357,7 @@
patches.drivers/Bluetooth-hidp-Fix-handling-of-strncpy-for-hid-name-.patch
patches.drivers/Bluetooth-hidp-buffer-overflow-in-hidp_process_repor
patches.drivers/Bluetooth-h5-Fix-missing-dependency-on-BT_HCIUART_SE.patch
+ patches.drivers/ath10k-protect-ath10k_htt_rx_ring_free-with-rx_ring..patch
patches.drivers/wlcore-Set-rx_status-boottime_ns-field-on-rx.patch
patches.drivers/iwlwifi-pcie-don-t-access-periphery-registers-when-n
patches.fixes/selftests-bpf-fix-a-typo-in-map-in-map-test.patch
@@ -17433,9 +17434,12 @@
patches.drivers/gpiolib-Mark-gpio_suffixes-array-with-__maybe_unused.patch
patches.drivers/gpio-pxa-Fix-potential-NULL-dereference.patch
patches.drivers/gpio-ml-ioh-Fix-buffer-underwrite-on-probe-error-pat.patch
+ patches.drivers/clk-tegra-bpmp-Don-t-crash-when-a-clock-fails-to-reg.patch
patches.drivers/clk-meson-gxbb-remove-HHI_GEN_CLK_CTNL-duplicate-def
patches.drivers/clk-rockchip-fix-clk_i2sout-parent-selection-bits-on
+ patches.drivers/clk-rockchip-Add-pclk_rkpwm_pmu-to-PMU-critical-cloc.patch
patches.drivers/clk-core-Potentially-free-connection-id
+ patches.drivers/clk-clk-fixed-factor-Clear-OF_POPULATED-flag-in-case.patch
patches.drivers/clk-imx6ul-fix-missing-of_node_put
patches.drivers/scsi-mpt3sas-Don-t-abort-I-Os-issued-to-NVMe-drives-.patch
patches.drivers/scsi-mpt3sas-Incorrect-command-status-was-set-marked.patch
@@ -17626,6 +17630,7 @@
patches.suse/msft-hv-1721-Drivers-hv-vmbus-Fix-the-offer_in_progress-in-vmbus_.patch
patches.suse/msft-hv-1724-Tools-hv-vss-fix-loop-device-detection.patch
patches.fixes/vmci-type-promotion-bug-in-qp_host_get_user_memory.patch
+ patches.drivers/tsl2550-fix-lux1_input-error-in-low-light.patch
patches.drivers/mei-bus-type-promotion-bug-in-mei_nfc_if_version.patch
patches.drivers/mei-don-t-update-offset-in-write
patches.drivers/coresight-Handle-errors-in-finding-input-output-port.patch
@@ -17656,6 +17661,7 @@
patches.drivers/HID-hid-ntrig-add-error-handling-for-sysfs_create_gr.patch
patches.suse/livepatch-validate-module-old-func-name-length.patch
patches.suse/livepatch-remove-reliable-stacktrace-check-in-klp_try_switch_task.patch
+ patches.drivers/rtc-bq4802-add-error-handling-for-devm_ioremap.patch
patches.fixes/ceph-fix-incorrect-use-of-strncpy.patch
patches.fixes/ceph-return-errors-from-posix_acl_equiv_mode-correctly.patch
patches.fixes/0001-libceph-store-ceph_auth_handshake-pointer-in-ceph_connection.patch
@@ -17685,6 +17691,7 @@
patches.fixes/fuse-umount-should-wait-for-all-requests.patch
patches.fixes/fuse-Fix-oops-at-process_init_reply.patch
patches.fixes/fuse-fix-initial-parallel-dirops.patch
+ patches.fixes/fuse-Don-t-access-pipe-buffers-without-pipe_lock.patch
patches.fixes/fuse-Add-missed-unlock_page-to-fuse_readpages_fill.patch
patches.drivers/PM-sleep-wakeup-Fix-build-error-caused-by-missing-SR
patches.suse/0001-ACPICA-Reference-Counts-increase-max-to-0x4000-for-l.patch
@@ -17726,6 +17733,7 @@
patches.fixes/0001-NFS-Use-an-appropriate-work-queue-for-direct-write-c.patch
patches.fixes/0007-NFSv4-Fix-a-sleep-in-atomic-context-in-nfs4_callback.patch
patches.fixes/hfsplus-fix-null-dereference-in-hfsplus_lookup.patch
+ patches.drivers/virtio-pci-legacy-Validate-queue-pfn.patch
patches.drivers/drm-edid-Add-6-bpc-quirk-for-SDC-panel-in-Lenovo-B50.patch
patches.fixes/userns-move-user-access-out-of-the-mutex.patch
patches.fixes/sys-don-t-hold-uts_sem-while-accessing-userspace-mem.patch
@@ -17770,9 +17778,11 @@
patches.drivers/i40e-fix-condition-of-WARN_ONCE-for-stat-strings.patch
patches.fixes/qlge-Fix-netdev-features-configuration.patch
patches.drivers/vhost-correctly-check-the-iova-range-when-waking-vir.patch
+ patches.drivers/thermal-of-thermal-disable-passive-polling-when-ther.patch
patches.drivers/crypto-caam-jr-fix-descriptor-DMA-unmapping.patch
patches.drivers/crypto-caam-qi-fix-error-path-in-xts-setkey.patch
patches.drivers/crypto-vmx-Fix-sleep-in-atomic-bugs.patch
+ patches.fixes/crypto-cavium-nitrox-fix-for-command-corruption-in-q.patch
patches.drivers/cdrom-Fix-info-leak-OOB-read-in-cdrom_ioctl_drive_st
patches.fixes/nvme-pci-add-a-memory-barrier-to-nvme_dbbuf_update_a.patch
patches.drivers/PM-clk-signedness-bug-in-of_pm_clk_add_clks
@@ -17859,6 +17869,7 @@
patches.drivers/USB-net2280-Fix-erroneous-synchronization-change.patch
patches.drivers/usb-gadget-udc-renesas_usb3-fix-maxpacket-size-of-ep.patch
patches.drivers/Revert-cdc-acm-implement-put_char-and-flush_chars.patch
+ patches.fixes/cifs-integer-overflow-in-in-SMB2_ioctl.patch
patches.fixes/sched-fair-Fix-vruntime_normalized-for-remote-non-migration-wakeup.patch
patches.fixes/ext4-dax-add-ext4_bmap-to-ext4_dax_aops.patch
patches.fixes/ext4-dax-set-ext4_dax_aops-for-dax-files.patch
@@ -17867,6 +17878,7 @@
patches.drivers/bnxt_en-Fix-VF-mac-address-regression.patch
patches.drivers/qmi_wwan-set-DTR-for-modems-in-forced-USB2-mode.patch
patches.drivers/platform-x86-alienware-wmi-Correct-a-memory-leak.patch
+ patches.drivers/hwmon-nct6775-Set-weight-source-to-zero-correctly.patch
patches.drivers/ALSA-bebob-use-address-returned-by-kmalloc-instead-o.patch
patches.drivers/ALSA-fireface-fix-memory-leak-in-ff400_switch_fetchi.patch
patches.drivers/ALSA-emu10k1-fix-possible-info-leak-to-userspace-on-.patch
@@ -17915,6 +17927,7 @@
patches.drivers/iommu-amd-return-devid-as-alias-for-acpi-hid-devices
patches.drivers/cxgb4-fix-abort_req_rss6-struct.patch
patches.drivers/RDMA-bnxt_re-Fix-system-crash-during-RDMA-resource-i.patch
+ patches.suse/PCI-dwc-Fix-scheduling-while-atomic-issues.patch
patches.drivers/pinctrl-cannonlake-Fix-HOSTSW_OWN-register-offset-of.patch
patches.arch/powerpc-Avoid-code-patching-freed-init-sections.patch
patches.arch/powerpc-pkeys-Fix-reading-of-ibm-processor-storage-k.patch
@@ -17942,8 +17955,22 @@
patches.drivers/smsc95xx-Check-for-Wake-on-LAN-modes.patch
patches.drivers/qlcnic-fix-Tx-descriptor-corruption-on-82xx-devices.patch
patches.drivers/declance-Fix-continuation-with-the-adapter-identific.patch
+ patches.suse/ipv4-fix-use-after-free-in-ip_cmsg_recv_dstaddr.patch
patches.arch/ARM-8799-1-mm-fix-pci_ioremap_io-offset-check.patch
+ patches.fixes/crypto-caam-jr-fix-ablkcipher_edesc-pointer-arithmet.patch
+ patches.arch/kvm-nvmx-do-not-expose-mpx-vmx-controls-when-guest-mpx-disabled
+ patches.arch/kvm-x86-do-not-use-kvm_x86_ops-mpx_supported-directly
+ patches.drivers/iommu-amd-clear-memory-encryption-mask-from-physical-address
+ patches.arch/x86-vdso-fix-asm-constraints-on-vdso-syscall-fallbacks
+ patches.arch/x86-vdso-fix-vdso-syscall-fallback-asm-constraint-regression
+ patches.fixes/PM-core-Clear-the-direct_complete-flag-on-errors.patch
+ patches.drivers/gpiolib-Free-the-last-requested-descriptor.patch
+ patches.fixes/mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch
patches.drivers/scsi-qedi-initialize-the-stats-mutex-lock
+ patches.drivers/usb-cdc_acm-Do-not-leak-URB-buffers.patch
+
+ # davem/net
+ patches.fixes/udp-Unbreak-modules-that-rely-on-external-__skb_recv.patch
# jejb/scsi for-next
patches.drivers/scsi-qla2xxx-Fix-process-response-queue-for-ISP26XX-.patch