Home Home > GIT Browse > openSUSE-42.3
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-01-16 07:16:58 +0100
committerKernel Build Daemon <kbuild@suse.de>2019-01-16 07:16:58 +0100
commit2beaffaecc647e443f57b8aa872f02d53f46dde0 (patch)
treec6685b4b7c516d78ef0ed8129e4d08d297f347dc
parent23b4d2e8aeca5628b78700f5a464dafef2d5d968 (diff)
parentc019e4f3abcdbd46a1fc57955e93ca692a4eaab2 (diff)
Merge branch 'SLE12-SP3' into openSUSE-42.3
-rw-r--r--patches.drivers/0019-x86-mm-introduce-vmem_altmap-to-augment-vmemmap_populate.patch52
-rw-r--r--patches.drivers/0085-Replace-asm-uaccess.h-with-linux-uaccess.h-globally.patch34
-rw-r--r--patches.drivers/genwqe-ensure-zero-initialization.patch17
-rw-r--r--patches.drivers/mm-dax-pmem-introduce-get_put-dev_pagemap-for-dax-gup.patch54
-rw-r--r--patches.drivers/net-next-treewide-use-is_vlan_dev-helper-function.patch32
-rw-r--r--patches.fixes/0003-memremap-add-scheduling-point-to-devm_memremap_pages.patch8
-rw-r--r--patches.fixes/vfs-Avoid-softlockups-in-drop_pagecache_sb.patch53
-rw-r--r--patches.kernel.org/4.4.169-001-lib-interval_tree_test.c-make-test-options-mo.patch148
-rw-r--r--patches.kernel.org/4.4.169-002-lib-interval_tree_test.c-allow-full-tree-sear.patch70
-rw-r--r--patches.kernel.org/4.4.169-003-lib-rbtree_test.c-make-input-module-parameter.patch158
-rw-r--r--patches.kernel.org/4.4.169-004-lib-rbtree-test-lower-default-params.patch61
-rw-r--r--patches.kernel.org/4.4.169-005-lib-interval_tree_test.c-allow-users-to-limit.patch69
-rw-r--r--patches.kernel.org/4.4.169-006-timer-debug-Change-proc-timer_list-from-0444-.patch39
-rw-r--r--patches.kernel.org/4.4.169-007-powerpc-boot-Fix-random-libfdt-related-build-.patch61
-rw-r--r--patches.kernel.org/4.4.169-008-pinctrl-sunxi-a83t-Fix-IRQ-offset-typo-for-PH.patch42
-rw-r--r--patches.kernel.org/4.4.169-009-aio-fix-spectre-gadget-in-lookup_ioctx.patch47
-rw-r--r--patches.kernel.org/4.4.169-010-MMC-OMAP-fix-broken-MMC-on-OMAP15XX-OMAP5910-.patch133
-rw-r--r--patches.kernel.org/4.4.169-011-tracing-Fix-memory-leak-in-set_trigger_filter.patch50
-rw-r--r--patches.kernel.org/4.4.169-012-tracing-Fix-memory-leak-of-instance-function-.patch46
-rw-r--r--patches.kernel.org/4.4.169-013-powerpc-msi-Fix-NULL-pointer-access-in-teardo.patch59
-rw-r--r--patches.kernel.org/4.4.169-014-Revert-drm-rockchip-Allow-driver-to-be-shutdo.patch (renamed from patches.fixes/0001-Revert-drm-rockchip-Allow-driver-to-be-shutdown-on-r.patch)19
-rw-r--r--patches.kernel.org/4.4.169-015-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_con.patch (renamed from patches.fixes/0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch)19
-rw-r--r--patches.kernel.org/4.4.169-016-mac80211-don-t-WARN-on-bad-WMM-parameters-fro.patch (renamed from patches.drivers/mac80211-don-t-WARN-on-bad-WMM-parameters-from-buggy)20
-rw-r--r--patches.kernel.org/4.4.169-017-mac80211-Fix-condition-validating-WMM-IE.patch (renamed from patches.drivers/mac80211-Fix-condition-validating-WMM-IE)20
-rw-r--r--patches.kernel.org/4.4.169-018-mac80211_hwsim-fix-module-init-error-paths-fo.patch62
-rw-r--r--patches.kernel.org/4.4.169-019-scsi-libiscsi-Fix-NULL-pointer-dereference-in.patch42
-rw-r--r--patches.kernel.org/4.4.169-020-scsi-vmw_pscsi-Rearrange-code-to-avoid-multip.patch58
-rw-r--r--patches.kernel.org/4.4.169-021-x86-earlyprintk-efi-Fix-infinite-loop-on-some.patch66
-rw-r--r--patches.kernel.org/4.4.169-022-drm-msm-Grab-a-vblank-reference-when-waiting-.patch42
-rw-r--r--patches.kernel.org/4.4.169-023-ARC-io.h-Implement-reads-x-writes-x.patch146
-rw-r--r--patches.kernel.org/4.4.169-024-bonding-fix-802.3ad-state-sent-to-partner-whe.patch64
-rw-r--r--patches.kernel.org/4.4.169-025-SUNRPC-Fix-a-potential-race-in-xprt_connect.patch (renamed from patches.fixes/SUNRPC-Fix-a-potential-race-in-xprt_connect.patch)17
-rw-r--r--patches.kernel.org/4.4.169-026-sbus-char-add-of_node_put.patch34
-rw-r--r--patches.kernel.org/4.4.169-027-drivers-sbus-char-add-of_node_put.patch37
-rw-r--r--patches.kernel.org/4.4.169-028-drivers-tty-add-missing-of_node_put.patch36
-rw-r--r--patches.kernel.org/4.4.169-029-ide-pmac-add-of_node_put.patch34
-rw-r--r--patches.kernel.org/4.4.169-030-clk-mmp-Off-by-one-in-mmp_clk_add.patch40
-rw-r--r--patches.kernel.org/4.4.169-031-Input-omap-keypad-fix-keyboard-debounce-confi.patch70
-rw-r--r--patches.kernel.org/4.4.169-032-libata-whitelist-all-SAMSUNG-MZ7KM-solid-stat.patch37
-rw-r--r--patches.kernel.org/4.4.169-033-mv88e6060-disable-hardware-level-MAC-learning.patch55
-rw-r--r--patches.kernel.org/4.4.169-034-ARM-8814-1-mm-improve-fix-ARM-v7_dma_inv_rang.patch77
-rw-r--r--patches.kernel.org/4.4.169-035-cifs-In-Kconfig-CONFIG_CIFS_POSIX-needs-depen.patch38
-rw-r--r--patches.kernel.org/4.4.169-036-i2c-axxia-properly-handle-master-timeout.patch176
-rw-r--r--patches.kernel.org/4.4.169-037-i2c-scmi-Fix-probe-error-on-devices-with-an-e.patch75
-rw-r--r--patches.kernel.org/4.4.169-038-rtc-snvs-add-a-missing-write-sync.patch36
-rw-r--r--patches.kernel.org/4.4.169-039-rtc-snvs-Add-timeouts-to-avoid-kernel-lockups.patch199
-rw-r--r--patches.kernel.org/4.4.169-040-ALSA-isa-wavefront-prevent-some-out-of-bound-.patch57
-rw-r--r--patches.kernel.org/4.4.169-041-Linux-4.4.169.patch27
-rw-r--r--patches.kernel.org/4.4.170-001-USB-hso-Fix-OOB-memory-access-in-hso_probe-hs.patch (renamed from patches.drivers/USB-hso-Fix-OOB-memory-access-in-hso_probe-hso_get_c.patch)20
-rw-r--r--patches.kernel.org/4.4.170-002-xhci-Don-t-prevent-USB2-bus-suspend-in-state-.patch45
-rw-r--r--patches.kernel.org/4.4.170-003-USB-serial-option-add-GosunCn-ZTE-WeLink-ME36.patch75
-rw-r--r--patches.kernel.org/4.4.170-004-USB-serial-option-add-HP-lt4132.patch88
-rw-r--r--patches.kernel.org/4.4.170-005-USB-serial-option-add-Simcom-SIM7500-SIM7600-.patch54
-rw-r--r--patches.kernel.org/4.4.170-006-USB-serial-option-add-Fibocom-NL668-series.patch71
-rw-r--r--patches.kernel.org/4.4.170-007-USB-serial-option-add-Telit-LN940-series.patch71
-rw-r--r--patches.kernel.org/4.4.170-008-mmc-core-Reset-HPI-enabled-state-during-re-in.patch44
-rw-r--r--patches.kernel.org/4.4.170-009-mmc-omap_hsmmc-fix-DMA-API-warning.patch71
-rw-r--r--patches.kernel.org/4.4.170-010-gpio-max7301-fix-driver-for-use-with-CONFIG_V.patch59
-rw-r--r--patches.kernel.org/4.4.170-011-Drivers-hv-vmbus-Return-EINVAL-for-the-sys-fi.patch125
-rw-r--r--patches.kernel.org/4.4.170-012-x86-mtrr-Don-t-copy-uninitialized-gentry-fiel.patch47
-rw-r--r--patches.kernel.org/4.4.170-013-drm-ioctl-Fix-Spectre-v1-vulnerabilities.patch80
-rw-r--r--patches.kernel.org/4.4.170-014-ip6mr-Fix-potential-Spectre-v1-vulnerability.patch65
-rw-r--r--patches.kernel.org/4.4.170-015-ipv4-Fix-potential-Spectre-v1-vulnerability.patch56
-rw-r--r--patches.kernel.org/4.4.170-016-ax25-fix-a-use-after-free-in-ax25_fillin_cb.patch81
-rw-r--r--patches.kernel.org/4.4.170-017-ibmveth-fix-DMA-unmap-error-in-ibmveth_xmit_s.patch66
-rw-r--r--patches.kernel.org/4.4.170-018-ieee802154-lowpan_header_create-check-must-ch.patch39
-rw-r--r--patches.kernel.org/4.4.170-019-ipv6-explicitly-initialize-udp6_addr-in-udp_s.patch54
-rw-r--r--patches.kernel.org/4.4.170-020-isdn-fix-kernel-infoleak-in-capi_unlocked_ioc.patch86
-rw-r--r--patches.kernel.org/4.4.170-021-netrom-fix-locking-in-nr_find_socket.patch107
-rw-r--r--patches.kernel.org/4.4.170-022-packet-validate-address-length.patch46
-rw-r--r--patches.kernel.org/4.4.170-023-packet-validate-address-length-if-non-zero.patch47
-rw-r--r--patches.kernel.org/4.4.170-024-sctp-initialize-sin6_flowinfo-for-ipv6-addrs-.patch68
-rw-r--r--patches.kernel.org/4.4.170-025-vhost-make-sure-used-idx-is-seen-before-log-i.patch40
-rw-r--r--patches.kernel.org/4.4.170-026-VSOCK-Send-reset-control-packet-when-socket-i.patch135
-rw-r--r--patches.kernel.org/4.4.170-027-xen-netfront-tolerate-frags-with-no-data.patch41
-rw-r--r--patches.kernel.org/4.4.170-028-gro_cell-add-napi_disable-in-gro_cells_destro.patch83
-rw-r--r--patches.kernel.org/4.4.170-029-sock-Make-sock-sk_stamp-thread-safe.patch192
-rw-r--r--patches.kernel.org/4.4.170-030-ALSA-rme9652-Fix-potential-Spectre-v1-vulnera.patch76
-rw-r--r--patches.kernel.org/4.4.170-031-ALSA-emu10k1-Fix-potential-Spectre-v1-vulnera.patch67
-rw-r--r--patches.kernel.org/4.4.170-032-ALSA-pcm-Fix-potential-Spectre-v1-vulnerabili.patch56
-rw-r--r--patches.kernel.org/4.4.170-033-ALSA-emux-Fix-potential-Spectre-v1-vulnerabil.patch74
-rw-r--r--patches.kernel.org/4.4.170-034-ALSA-hda-add-mute-LED-support-for-HP-EliteBoo.patch41
-rw-r--r--patches.kernel.org/4.4.170-035-ALSA-hda-tegra-clear-pending-irq-handlers.patch48
-rw-r--r--patches.kernel.org/4.4.170-036-USB-serial-pl2303-add-ids-for-Hewlett-Packard.patch69
-rw-r--r--patches.kernel.org/4.4.170-037-USB-serial-option-add-Fibocom-NL678-series.patch72
-rw-r--r--patches.kernel.org/4.4.170-038-usb-r8a66597-Fix-a-possible-concurrency-use-a.patch73
-rw-r--r--patches.kernel.org/4.4.170-039-Input-elan_i2c-add-ACPI-ID-for-touchpad-in-AS.patch37
-rw-r--r--patches.kernel.org/4.4.170-040-KVM-x86-Use-jmp-to-invoke-kvm_spurious_fault-.patch141
-rw-r--r--patches.kernel.org/4.4.170-041-perf-pmu-Suppress-potential-format-truncation.patch81
-rw-r--r--patches.kernel.org/4.4.170-042-ext4-fix-possible-use-after-free-in-ext4_quot.patch42
-rw-r--r--patches.kernel.org/4.4.170-043-ext4-missing-unlock-put_page-in-ext4_try_to_w.patch43
-rw-r--r--patches.kernel.org/4.4.170-044-ext4-fix-EXT4_IOC_GROUP_ADD-ioctl.patch45
-rw-r--r--patches.kernel.org/4.4.170-045-ext4-force-inode-writes-when-nfsd-calls-commi.patch93
-rw-r--r--patches.kernel.org/4.4.170-046-spi-bcm2835-Fix-race-on-DMA-termination.patch67
-rw-r--r--patches.kernel.org/4.4.170-047-spi-bcm2835-Fix-book-keeping-of-DMA-terminati.patch50
-rw-r--r--patches.kernel.org/4.4.170-048-spi-bcm2835-Avoid-finishing-transfer-prematur.patch66
-rw-r--r--patches.kernel.org/4.4.170-049-cdc-acm-fix-abnormal-DATA-RX-issue-for-Mediat.patch87
-rw-r--r--patches.kernel.org/4.4.170-050-media-vivid-free-bitmap_cap-when-updating-std.patch38
-rw-r--r--patches.kernel.org/4.4.170-051-MIPS-Ensure-pmd_present-returns-false-after-p.patch50
-rw-r--r--patches.kernel.org/4.4.170-052-MIPS-Align-kernel-load-address-to-64KB.patch62
-rw-r--r--patches.kernel.org/4.4.170-053-CIFS-Fix-error-mapping-for-SMB2_LOCK-command-.patch58
-rw-r--r--patches.kernel.org/4.4.170-054-x86-kvm-vmx-do-not-use-vm-exit-instruction-le.patch (renamed from patches.fixes/x86-kvm-vmx-do-not-use-vm-exit-instruction-length-fo.patch)61
-rw-r--r--patches.kernel.org/4.4.170-055-spi-bcm2835-Unbreak-the-build-of-esoteric-con.patch47
-rw-r--r--patches.kernel.org/4.4.170-056-powerpc-Fix-COFF-zImage-booting-on-old-powerm.patch59
-rw-r--r--patches.kernel.org/4.4.170-057-ARM-imx-update-the-cpu-power-up-timing-settin.patch43
-rw-r--r--patches.kernel.org/4.4.170-058-Input-restore-EV_ABS-ABS_RESERVED.patch46
-rw-r--r--patches.kernel.org/4.4.170-059-checkstack.pl-fix-for-aarch64.patch49
-rw-r--r--patches.kernel.org/4.4.170-060-xfrm-Fix-bucket-count-reported-to-userspace.patch37
-rw-r--r--patches.kernel.org/4.4.170-061-scsi-bnx2fc-Fix-NULL-dereference-in-error-han.patch37
-rw-r--r--patches.kernel.org/4.4.170-062-Input-omap-keypad-fix-idle-configuration-to-n.patch86
-rw-r--r--patches.kernel.org/4.4.170-063-scsi-zfcp-fix-posting-too-many-status-read-bu.patch98
-rw-r--r--patches.kernel.org/4.4.170-064-fork-record-start_time-late.patch83
-rw-r--r--patches.kernel.org/4.4.170-065-hwpoison-memory_hotplug-allow-hwpoisoned-page.patch (renamed from patches.fixes/0001-hwpoison-memory_hotplug-allow-hwpoisoned-pages-to-be.patch)114
-rw-r--r--patches.kernel.org/4.4.170-067-mm-devm_memremap_pages-kill-mapping-System-RA.patch65
-rw-r--r--patches.kernel.org/4.4.170-068-sunrpc-fix-cache_head-leak-due-to-queued-requ.patch74
-rw-r--r--patches.kernel.org/4.4.170-069-sunrpc-use-SVC_NET-in-svcauth_gss_-functions.patch (renamed from patches.fixes/sunrpc-use-SVC_NET-in-svcauth_gss_-functions.patch)28
-rw-r--r--patches.kernel.org/4.4.170-070-crypto-x86-chacha20-avoid-sleeping-with-preem.patch43
-rw-r--r--patches.kernel.org/4.4.170-071-ALSA-cs46xx-Potential-NULL-dereference-in-pro.patch39
-rw-r--r--patches.kernel.org/4.4.170-072-ALSA-usb-audio-Avoid-access-before-bLength-ch.patch54
-rw-r--r--patches.kernel.org/4.4.170-073-ALSA-usb-audio-Fix-an-out-of-bound-read-in-cr.patch51
-rw-r--r--patches.kernel.org/4.4.170-074-dlm-fixed-memory-leaks-after-failed-ls_remove.patch46
-rw-r--r--patches.kernel.org/4.4.170-075-dlm-possible-memory-leak-on-error-path-in-cre.patch35
-rw-r--r--patches.kernel.org/4.4.170-076-dlm-lost-put_lkb-on-error-path-in-receive_con.patch44
-rw-r--r--patches.kernel.org/4.4.170-077-dlm-memory-leaks-on-error-path-in-dlm_user_re.patch61
-rw-r--r--patches.kernel.org/4.4.170-078-gfs2-Fix-loop-in-gfs2_rbm_find.patch42
-rw-r--r--patches.kernel.org/4.4.170-079-b43-Fix-error-in-cordic-routine.patch48
-rw-r--r--patches.kernel.org/4.4.170-080-9p-net-put-a-lower-bound-on-msize.patch86
-rw-r--r--patches.kernel.org/4.4.170-081-iommu-vt-d-Handle-domain-agaw-being-less-than.patch (renamed from patches.drivers/iommu-vt-d-handle-domain-agaw-being-less-than-iommu-agaw)18
-rw-r--r--patches.kernel.org/4.4.170-082-ceph-don-t-update-importing-cap-s-mseq-when-h.patch (renamed from patches.fixes/ceph-don-t-update-importing-cap-s-mseq-when-handing-cap-export.patch)18
-rw-r--r--patches.kernel.org/4.4.170-083-genwqe-Fix-size-check.patch70
-rw-r--r--patches.kernel.org/4.4.170-084-intel_th-msu-Fix-an-off-by-one-in-attribute-s.patch57
-rw-r--r--patches.kernel.org/4.4.170-085-power-supply-olpc_battery-correct-the-tempera.patch56
-rw-r--r--patches.kernel.org/4.4.170-086-Linux-4.4.170.patch27
-rw-r--r--patches.suse/0046-perf-tools-omit-unnecessary-cast-in-perf_pmu__parse_scale11
-rw-r--r--patches.suse/0047-perf-pmu-factor-out-scale-conversion-code15
-rw-r--r--patches.suse/mm-compaction-introduce-kcompactd.patch56
-rw-r--r--series.conf140
137 files changed, 8055 insertions, 317 deletions
diff --git a/patches.drivers/0019-x86-mm-introduce-vmem_altmap-to-augment-vmemmap_populate.patch b/patches.drivers/0019-x86-mm-introduce-vmem_altmap-to-augment-vmemmap_populate.patch
index dadc54e379..47241e7cec 100644
--- a/patches.drivers/0019-x86-mm-introduce-vmem_altmap-to-augment-vmemmap_populate.patch
+++ b/patches.drivers/0019-x86-mm-introduce-vmem_altmap-to-augment-vmemmap_populate.patch
@@ -46,7 +46,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
#include <linux/nmi.h>
#include <linux/gfp.h>
#include <linux/kcore.h>
-@@ -722,6 +723,12 @@ static void __meminit free_pagetable(str
+@@ -724,6 +725,12 @@ static void __meminit free_pagetable(str
{
unsigned long magic;
unsigned int nr_pages = 1 << order;
@@ -59,7 +59,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
/* bootmem page has reserved flag */
if (PageReserved(page)) {
-@@ -1026,13 +1033,19 @@ int __ref arch_remove_memory(u64 start,
+@@ -1028,13 +1035,19 @@ int __ref arch_remove_memory(u64 start,
{
unsigned long start_pfn = start >> PAGE_SHIFT;
unsigned long nr_pages = size >> PAGE_SHIFT;
@@ -81,7 +81,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
return ret;
}
-@@ -1244,7 +1257,7 @@ static void __meminitdata *p_start, *p_e
+@@ -1246,7 +1259,7 @@ static void __meminitdata *p_start, *p_e
static int __meminitdata node_start;
static int __meminit vmemmap_populate_hugepages(unsigned long start,
@@ -90,7 +90,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
{
unsigned long addr;
unsigned long next;
-@@ -1267,7 +1280,7 @@ static int __meminit vmemmap_populate_hu
+@@ -1269,7 +1282,7 @@ static int __meminit vmemmap_populate_hu
if (pmd_none(*pmd)) {
void *p;
@@ -99,7 +99,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
if (p) {
pte_t entry;
-@@ -1288,7 +1301,8 @@ static int __meminit vmemmap_populate_hu
+@@ -1290,7 +1303,8 @@ static int __meminit vmemmap_populate_hu
addr_end = addr + PMD_SIZE;
p_end = p + PMD_SIZE;
continue;
@@ -109,7 +109,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
} else if (pmd_large(*pmd)) {
vmemmap_verify((pte_t *)pmd, node, addr, next);
continue;
-@@ -1301,11 +1315,16 @@ static int __meminit vmemmap_populate_hu
+@@ -1304,11 +1318,16 @@ static int __meminit vmemmap_populate_hu
int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node)
{
@@ -140,7 +140,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
pmem->pfn_flags |= PFN_MAP;
} else
pmem->virt_addr = (void __pmem *) devm_memremap(dev,
-@@ -386,7 +387,8 @@ static int nvdimm_namespace_attach_pfn(s
+@@ -387,7 +388,8 @@ static int nvdimm_namespace_attach_pfn(s
/* establish pfn range for lookup, and switch to direct map */
pmem = dev_get_drvdata(dev);
devm_memunmap(dev, (void __force *) pmem->virt_addr);
@@ -229,7 +229,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
#endif /* _LINUX_MEMREMAP_H_ */
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
-@@ -2250,7 +2250,14 @@ pud_t *vmemmap_pud_populate(pgd_t *pgd,
+@@ -2236,7 +2236,14 @@ pud_t *vmemmap_pud_populate(pgd_t *pgd,
pmd_t *vmemmap_pmd_populate(pud_t *pud, unsigned long addr, int node);
pte_t *vmemmap_pte_populate(pmd_t *pmd, unsigned long addr, int node);
void *vmemmap_alloc_block(unsigned long size, int node);
@@ -297,9 +297,9 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
struct page_map *page_map;
int error, nid;
-@@ -224,14 +240,27 @@ void *devm_memremap_pages(struct device
- if (is_ram == REGION_INTERSECTS)
- return __va(res->start);
+@@ -221,14 +237,27 @@ void *devm_memremap_pages(struct device
+ return ERR_PTR(-ENXIO);
+ }
+ if (altmap && !IS_ENABLED(CONFIG_SPARSEMEM_VMEMMAP)) {
+ dev_err(dev, "%s: altmap requires CONFIG_SPARSEMEM_VMEMMAP=y\n",
@@ -326,7 +326,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
mutex_lock(&pgmap_lock);
error = 0;
for (key = res->start; key <= res->end; key += SECTION_SIZE) {
-@@ -283,4 +312,43 @@ void *devm_memremap_pages(struct device
+@@ -276,4 +305,43 @@ void *devm_memremap_pages(struct device
return ERR_PTR(error);
}
EXPORT_SYMBOL(devm_memremap_pages);
@@ -380,7 +380,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
#include <linux/memory_hotplug.h>
#include <linux/highmem.h>
#include <linux/vmalloc.h>
-@@ -321,13 +322,27 @@ int __ref __add_pages(int nid, unsigned
+@@ -506,6 +507,7 @@ int __ref __add_pages(int nid, struct zo
unsigned long i;
int err = 0;
int start_sec, end_sec;
@@ -388,7 +388,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
clear_zone_contiguous(zone);
- /* during initialize mem_map, align hot-added range to section */
+@@ -513,6 +515,19 @@ int __ref __add_pages(int nid, struct zo
start_sec = pfn_to_section_nr(phys_start_pfn);
end_sec = pfn_to_section_nr(phys_start_pfn + nr_pages - 1);
@@ -408,7 +408,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
for (i = start_sec; i <= end_sec; i++) {
err = __add_section(nid, zone, section_nr_to_pfn(i));
-@@ -548,7 +563,8 @@ static void __remove_zone(struct zone *z
+@@ -736,7 +751,8 @@ static void __remove_zone(struct zone *z
pgdat_resize_unlock(zone->zone_pgdat, &flags);
}
@@ -418,7 +418,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
{
unsigned long start_pfn;
int scn_nr;
-@@ -565,7 +581,7 @@ static int __remove_section(struct zone
+@@ -753,7 +769,7 @@ static int __remove_section(struct zone
start_pfn = section_nr_to_pfn(scn_nr);
__remove_zone(zone, start_pfn);
@@ -427,7 +427,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
return 0;
}
-@@ -584,9 +600,32 @@ int __remove_pages(struct zone *zone, un
+@@ -772,9 +788,32 @@ int __remove_pages(struct zone *zone, un
unsigned long nr_pages)
{
unsigned long i;
@@ -463,7 +463,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
clear_zone_contiguous(zone);
-@@ -596,23 +635,11 @@ int __remove_pages(struct zone *zone, un
+@@ -784,23 +823,11 @@ int __remove_pages(struct zone *zone, un
BUG_ON(phys_start_pfn & ~PAGE_SECTION_MASK);
BUG_ON(nr_pages % PAGES_PER_SECTION);
@@ -499,7 +499,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
#include <linux/stop_machine.h>
#include <linux/sort.h>
#include <linux/pfn.h>
-@@ -4914,8 +4915,9 @@ void __ref build_all_zonelists(pg_data_t
+@@ -4912,8 +4913,9 @@ static inline unsigned long wait_table_b
void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
unsigned long start_pfn, enum memmap_context context)
{
@@ -510,7 +510,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
unsigned long pfn;
struct zone *z;
unsigned long nr_initialised = 0;
-@@ -4926,6 +4928,13 @@ void __meminit memmap_init_zone(unsigned
+@@ -4921,6 +4923,13 @@ void __meminit memmap_init_zone(unsigned
if (highest_memmap_pfn < end_pfn - 1)
highest_memmap_pfn = end_pfn - 1;
@@ -534,7 +534,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
#include <linux/highmem.h>
#include <linux/slab.h>
#include <linux/spinlock.h>
-@@ -74,7 +75,7 @@ void * __meminit vmemmap_alloc_block(uns
+@@ -70,7 +71,7 @@ void * __meminit vmemmap_alloc_block(uns
}
/* need to make sure size is all the same during early stage */
@@ -543,7 +543,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
{
void *ptr;
-@@ -91,6 +92,77 @@ void * __meminit vmemmap_alloc_block_buf
+@@ -87,6 +88,77 @@ void * __meminit vmemmap_alloc_block_buf
return ptr;
}
@@ -621,7 +621,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
void __meminit vmemmap_verify(pte_t *pte, int node,
unsigned long start, unsigned long end)
{
-@@ -107,7 +179,7 @@ pte_t * __meminit vmemmap_pte_populate(p
+@@ -103,7 +175,7 @@ pte_t * __meminit vmemmap_pte_populate(p
pte_t *pte = pte_offset_kernel(pmd, addr);
if (pte_none(*pte)) {
pte_t entry;
@@ -632,7 +632,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
entry = pfn_pte(__pa(p) >> PAGE_SHIFT, PAGE_KERNEL);
--- a/mm/sparse.c
+++ b/mm/sparse.c
-@@ -747,7 +747,7 @@ static void clear_hwpoisoned_pages(struc
+@@ -748,7 +748,7 @@ static void clear_hwpoisoned_pages(struc
if (!memmap)
return;
@@ -641,7 +641,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
if (PageHWPoison(&memmap[i])) {
atomic_long_sub(1, &num_poisoned_pages);
ClearPageHWPoison(&memmap[i]);
-@@ -787,7 +787,8 @@ static void free_section_usemap(struct p
+@@ -788,7 +788,8 @@ static void free_section_usemap(struct p
free_map_bootmem(memmap);
}
@@ -651,7 +651,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
{
struct page *memmap = NULL;
unsigned long *usemap = NULL, flags;
-@@ -803,7 +804,8 @@ void sparse_remove_one_section(struct zo
+@@ -804,7 +805,8 @@ void sparse_remove_one_section(struct zo
}
pgdat_resize_unlock(pgdat, &flags);
diff --git a/patches.drivers/0085-Replace-asm-uaccess.h-with-linux-uaccess.h-globally.patch b/patches.drivers/0085-Replace-asm-uaccess.h-with-linux-uaccess.h-globally.patch
index 632f2fb801..3260451327 100644
--- a/patches.drivers/0085-Replace-asm-uaccess.h-with-linux-uaccess.h-globally.patch
+++ b/patches.drivers/0085-Replace-asm-uaccess.h-with-linux-uaccess.h-globally.patch
@@ -889,12 +889,6 @@ Signed-off-by: Coly Li <colyli@suse.de>
fs/dcache.c | 2 +-
fs/dcookies.c | 2 +-
fs/dlm/dlm_internal.h | 2 +-
- fs/dmapi/dmapi_config.c | 2 +-
- fs/dmapi/dmapi_event.c | 2 +-
- fs/dmapi/dmapi_register.c | 2 +-
- fs/dmapi/dmapi_right.c | 2 +-
- fs/dmapi/dmapi_session.c | 2 +-
- fs/dmapi/dmapi_sysent.c | 2 +-
fs/efs/efs.h | 2 +-
fs/eventpoll.c | 2 +-
fs/exec.c | 2 +-
@@ -1134,7 +1128,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
sound/oss/swarm_cs4297a.c | 2 +-
sound/sound_firmware.c | 2 +-
virt/kvm/kvm_main.c | 2 +-
- 1115 files changed, 1115 insertions(+), 1115 deletions(-)
+ 1109 files changed, 1109 insertions(+), 1109 deletions(-)
--- a/arch/alpha/boot/misc.c
+++ b/arch/alpha/boot/misc.c
@@ -1336,7 +1330,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
* Error-checking SWP macros implemented using ldrex{b}/strex{b}
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
-@@ -32,7 +32,7 @@
+@@ -33,7 +33,7 @@
#define CREATE_TRACE_POINTS
#include "trace.h"
@@ -1424,7 +1418,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
#include <mach/time.h>
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
-@@ -21,7 +21,7 @@
+@@ -19,7 +19,7 @@
#include <asm/sysreg.h>
#include <asm/system_misc.h>
#include <asm/traps.h>
@@ -3393,7 +3387,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
#define MODULE_VERS "1.0"
--- a/arch/powerpc/kernel/rtasd.c
+++ b/arch/powerpc/kernel/rtasd.c
-@@ -23,7 +23,7 @@
+@@ -22,7 +22,7 @@
#include <linux/workqueue.h>
#include <linux/slab.h>
@@ -3613,7 +3607,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
int len, __wsum sum, int *err_ptr)
--- a/arch/powerpc/lib/code-patching.c
+++ b/arch/powerpc/lib/code-patching.c
-@@ -15,7 +15,7 @@
+@@ -13,7 +13,7 @@
#include <linux/mm.h>
#include <asm/page.h>
#include <asm/code-patching.h>
@@ -6131,7 +6125,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
-@@ -41,7 +41,7 @@
+@@ -40,7 +40,7 @@
#include <linux/thermal.h>
#include <linux/acpi.h>
#include <linux/workqueue.h>
@@ -9739,7 +9733,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
#include <scsi/scsi_tcq.h>
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
-@@ -38,7 +38,7 @@
+@@ -32,7 +32,7 @@
#include <linux/slab.h>
#include <linux/completion.h>
#include <linux/blkdev.h>
@@ -9750,7 +9744,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
-@@ -42,7 +42,7 @@
+@@ -41,7 +41,7 @@
#include <linux/delay.h> /* ssleep prototype */
#include <linux/kthread.h>
#include <linux/semaphore.h>
@@ -10443,8 +10437,8 @@ Signed-off-by: Coly Li <colyli@suse.de>
static struct proc_dir_entry *proc_afs;
--- a/fs/aio.c
+++ b/fs/aio.c
-@@ -42,7 +42,7 @@
- #include <linux/mount.h>
+@@ -43,7 +43,7 @@
+ #include <linux/nospec.h>
#include <asm/kmap_types.h>
-#include <asm/uaccess.h>
@@ -11773,7 +11767,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
-@@ -50,7 +50,7 @@
+@@ -47,7 +47,7 @@
#include <linux/ctype.h>
#include <linux/uio.h>
@@ -11971,7 +11965,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
--- a/mm/memory.c
+++ b/mm/memory.c
-@@ -67,7 +67,7 @@
+@@ -68,7 +68,7 @@
#include <asm/io.h>
#include <asm/mmu_context.h>
#include <asm/pgalloc.h>
@@ -12444,7 +12438,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
#include <net/protocol.h>
--- a/net/core/utils.c
+++ b/net/core/utils.c
-@@ -35,7 +35,7 @@
+@@ -31,7 +31,7 @@
#include <net/net_ratelimit.h>
#include <asm/byteorder.h>
@@ -13280,7 +13274,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
static int do_mod_firmware_load(const char *fn, char **fp)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
-@@ -53,7 +53,7 @@
+@@ -54,7 +54,7 @@
#include <asm/processor.h>
#include <asm/io.h>
#include <asm/ioctl.h>
diff --git a/patches.drivers/genwqe-ensure-zero-initialization.patch b/patches.drivers/genwqe-ensure-zero-initialization.patch
index 679bcbfbe5..350da36811 100644
--- a/patches.drivers/genwqe-ensure-zero-initialization.patch
+++ b/patches.drivers/genwqe-ensure-zero-initialization.patch
@@ -18,15 +18,13 @@ Signed-off-by: Frank Haverkamp <haver@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
- drivers/misc/genwqe/card_ddcb.c | 2 --
- drivers/misc/genwqe/card_utils.c | 4 ++--
+ drivers/misc/genwqe/card_ddcb.c | 2 --
+ drivers/misc/genwqe/card_utils.c | 4 ++--
2 files changed, 2 insertions(+), 4 deletions(-)
-diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
-index 353ee0c..ddfeefe 100644
--- a/drivers/misc/genwqe/card_ddcb.c
+++ b/drivers/misc/genwqe/card_ddcb.c
-@@ -1048,8 +1048,6 @@ static int setup_ddcb_queue(struct genwqe_dev *cd, struct ddcb_queue *queue)
+@@ -1048,8 +1048,6 @@ static int setup_ddcb_queue(struct genwq
"[%s] **err: could not allocate DDCB **\n", __func__);
return -ENOMEM;
}
@@ -35,12 +33,10 @@ index 353ee0c..ddfeefe 100644
queue->ddcb_req = kzalloc(sizeof(struct ddcb_requ *) *
queue->ddcb_max, GFP_KERNEL);
if (!queue->ddcb_req) {
-diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
-index 222367c..8a679ec 100644
--- a/drivers/misc/genwqe/card_utils.c
+++ b/drivers/misc/genwqe/card_utils.c
-@@ -220,8 +220,8 @@ void *__genwqe_alloc_consistent(struct genwqe_dev *cd, size_t size,
- if (get_order(size) > MAX_ORDER)
+@@ -220,8 +220,8 @@ void *__genwqe_alloc_consistent(struct g
+ if (get_order(size) >= MAX_ORDER)
return NULL;
- return dma_alloc_coherent(&cd->pci_dev->dev, size, dma_handle,
@@ -50,6 +46,3 @@ index 222367c..8a679ec 100644
}
void __genwqe_free_consistent(struct genwqe_dev *cd, size_t size,
---
-2.10.2
-
diff --git a/patches.drivers/mm-dax-pmem-introduce-get_put-dev_pagemap-for-dax-gup.patch b/patches.drivers/mm-dax-pmem-introduce-get_put-dev_pagemap-for-dax-gup.patch
index 3be6e02df6..e3405e30f8 100644
--- a/patches.drivers/mm-dax-pmem-introduce-get_put-dev_pagemap-for-dax-gup.patch
+++ b/patches.drivers/mm-dax-pmem-introduce-get_put-dev_pagemap-for-dax-gup.patch
@@ -35,19 +35,17 @@ Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: Jeff Mahoney <jeffm@suse.com>
---
- drivers/nvdimm/pmem.c | 6 ++++--
- include/linux/list.h | 11 ++++++++++
- include/linux/memremap.h | 49 ++++++++++++++++++++++++++++++++++++++++++--
- include/linux/mm_types.h | 5 +++++
- kernel/memremap.c | 53 ++++++++++++++++++++++++++++++++++++++++++++----
- lib/list_debug.c | 9 ++++++++
+ drivers/nvdimm/pmem.c | 6 +++--
+ include/linux/list.h | 11 +++++++++
+ include/linux/memremap.h | 49 +++++++++++++++++++++++++++++++++++++++++--
+ include/linux/mm_types.h | 5 ++++
+ kernel/memremap.c | 53 +++++++++++++++++++++++++++++++++++++++++++----
+ lib/list_debug.c | 9 +++++++
6 files changed, 125 insertions(+), 8 deletions(-)
-diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
-index 328173d..7edf316 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
-@@ -184,7 +184,7 @@ static struct pmem_device *pmem_alloc(struct device *dev,
+@@ -184,7 +184,7 @@ static struct pmem_device *pmem_alloc(st
pmem->pfn_flags = PFN_DEV;
if (pmem_should_map_pages(dev)) {
pmem->virt_addr = (void __pmem *) devm_memremap_pages(dev, res,
@@ -56,7 +54,7 @@ index 328173d..7edf316 100644
pmem->pfn_flags |= PFN_MAP;
} else
pmem->virt_addr = (void __pmem *) devm_memremap(dev,
-@@ -365,6 +365,7 @@ static int nvdimm_namespace_attach_pfn(struct nd_namespace_common *ndns)
+@@ -365,6 +365,7 @@ static int nvdimm_namespace_attach_pfn(s
struct vmem_altmap *altmap;
struct nd_pfn_sb *pfn_sb;
struct pmem_device *pmem;
@@ -64,7 +62,7 @@ index 328173d..7edf316 100644
phys_addr_t offset;
int rc;
struct vmem_altmap __altmap = {
-@@ -406,9 +407,10 @@ static int nvdimm_namespace_attach_pfn(struct nd_namespace_common *ndns)
+@@ -406,9 +407,10 @@ static int nvdimm_namespace_attach_pfn(s
/* establish pfn range for lookup, and switch to direct map */
pmem = dev_get_drvdata(dev);
@@ -76,11 +74,9 @@ index 328173d..7edf316 100644
pmem->pfn_flags |= PFN_MAP;
if (IS_ERR(pmem->virt_addr)) {
rc = PTR_ERR(pmem->virt_addr);
-diff --git a/include/linux/list.h b/include/linux/list.h
-index 5356f4d..30cf420 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
-@@ -113,6 +113,17 @@ extern void __list_del_entry(struct list_head *entry);
+@@ -113,6 +113,17 @@ extern void __list_del_entry(struct list
extern void list_del(struct list_head *entry);
#endif
@@ -98,8 +94,6 @@ index 5356f4d..30cf420 100644
/**
* list_replace - replace old entry by new one
* @old : the element to be replaced
-diff --git a/include/linux/memremap.h b/include/linux/memremap.h
-index aa3e82a..bcaa634 100644
--- a/include/linux/memremap.h
+++ b/include/linux/memremap.h
@@ -1,6 +1,8 @@
@@ -111,7 +105,7 @@ index aa3e82a..bcaa634 100644
struct resource;
struct device;
-@@ -36,21 +38,25 @@ static inline struct vmem_altmap *to_vmem_altmap(unsigned long memmap_start)
+@@ -36,21 +38,25 @@ static inline struct vmem_altmap *to_vme
/**
* struct dev_pagemap - metadata for ZONE_DEVICE mappings
* @altmap: pre-allocated/reserved memory for vmemmap allocations
@@ -139,7 +133,7 @@ index aa3e82a..bcaa634 100644
{
/*
* Fail attempts to call devm_memremap_pages() without
-@@ -66,4 +72,43 @@ static inline struct dev_pagemap *find_dev_pagemap(resource_size_t phys)
+@@ -66,4 +72,43 @@ static inline struct dev_pagemap *find_d
return NULL;
}
#endif
@@ -183,11 +177,9 @@ index aa3e82a..bcaa634 100644
+ percpu_ref_put(pgmap->ref);
+}
#endif /* _LINUX_MEMREMAP_H_ */
-diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
-index 2dd9c31..d3ebb9d 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
-@@ -116,6 +116,11 @@ struct page {
+@@ -124,6 +124,11 @@ struct page {
* Can be used as a generic list
* by the page owner.
*/
@@ -199,11 +191,9 @@ index 2dd9c31..d3ebb9d 100644
struct { /* slub per cpu partial pages */
struct page *next; /* Next partial slab */
#ifdef CONFIG_64BIT
-diff --git a/kernel/memremap.c b/kernel/memremap.c
-index 562f647..3eb8944 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
-@@ -179,6 +179,29 @@ static void pgmap_radix_release(struct resource *res)
+@@ -181,6 +181,29 @@ static void pgmap_radix_release(struct r
mutex_unlock(&pgmap_lock);
}
@@ -233,7 +223,7 @@ index 562f647..3eb8944 100644
static void devm_memremap_pages_release(struct device *dev, void *data)
{
struct page_map *page_map = data;
-@@ -186,6 +209,11 @@ static void devm_memremap_pages_release(struct device *dev, void *data)
+@@ -188,6 +211,11 @@ static void devm_memremap_pages_release(
resource_size_t align_start, align_size;
struct dev_pagemap *pgmap = &page_map->pgmap;
@@ -245,7 +235,7 @@ index 562f647..3eb8944 100644
pgmap_radix_release(res);
/* pages are dead and unused, undo the arch mapping */
-@@ -211,20 +239,26 @@ struct dev_pagemap *find_dev_pagemap(resource_size_t phys)
+@@ -215,20 +243,26 @@ struct dev_pagemap *find_dev_pagemap(res
* devm_memremap_pages - remap and provide memmap backing for the given resource
* @dev: hosting device for @res
* @res: "host memory" address range
@@ -275,8 +265,8 @@ index 562f647..3eb8944 100644
+ unsigned long pfn;
int error, nid;
- if (is_ram == REGION_MIXED) {
-@@ -242,6 +276,9 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
+ if (is_ram != REGION_DISJOINT) {
+@@ -243,6 +277,9 @@ void *devm_memremap_pages(struct device
return ERR_PTR(-ENXIO);
}
@@ -286,7 +276,7 @@ index 562f647..3eb8944 100644
page_map = devres_alloc_node(devm_memremap_pages_release,
sizeof(*page_map), GFP_KERNEL, dev_to_node(dev));
if (!page_map)
-@@ -255,6 +292,7 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
+@@ -256,6 +293,7 @@ void *devm_memremap_pages(struct device
memcpy(&page_map->altmap, altmap, sizeof(*altmap));
pgmap->altmap = &page_map->altmap;
}
@@ -294,7 +284,7 @@ index 562f647..3eb8944 100644
pgmap->res = &page_map->res;
mutex_lock(&pgmap_lock);
-@@ -292,6 +330,13 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
+@@ -295,6 +333,13 @@ void *devm_memremap_pages(struct device
if (error)
goto err_add_memory;
@@ -308,8 +298,6 @@ index 562f647..3eb8944 100644
devres_add(dev, page_map);
return __va(res->start);
-diff --git a/lib/list_debug.c b/lib/list_debug.c
-index 3859bf6..3345a08 100644
--- a/lib/list_debug.c
+++ b/lib/list_debug.c
@@ -12,6 +12,13 @@
@@ -335,5 +323,3 @@ index 3859bf6..3345a08 100644
WARN(next->prev != prev,
"list_add corruption. next->prev should be "
"prev (%p), but was %p. (next=%p).\n",
-
-
diff --git a/patches.drivers/net-next-treewide-use-is_vlan_dev-helper-function.patch b/patches.drivers/net-next-treewide-use-is_vlan_dev-helper-function.patch
index 0426975277..4516da66e6 100644
--- a/patches.drivers/net-next-treewide-use-is_vlan_dev-helper-function.patch
+++ b/patches.drivers/net-next-treewide-use-is_vlan_dev-helper-function.patch
@@ -35,7 +35,7 @@ Acked-by: David Chang <dchang@suse.com>
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
-@@ -2417,14 +2417,12 @@ static int iboe_tos_to_sl(struct net_dev
+@@ -2480,14 +2480,12 @@ static int iboe_tos_to_sl(struct net_dev
struct net_device *dev;
prio = rt_tos2priority(tos);
@@ -87,7 +87,7 @@ Acked-by: David Chang <dchang@suse.com>
e->vlan = VLAN_NONE;
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
-@@ -2223,7 +2223,7 @@ static void check_neigh_update(struct ne
+@@ -1805,7 +1805,7 @@ static void check_neigh_update(struct ne
const struct device *parent;
const struct net_device *netdev = neigh->dev;
@@ -96,7 +96,7 @@ Acked-by: David Chang <dchang@suse.com>
netdev = vlan_dev_real_dev(netdev);
parent = netdev->dev.parent;
if (parent && parent->driver == &cxgb4_driver.driver)
-@@ -2643,7 +2643,7 @@ static int cxgb4_inet6addr_handler(struc
+@@ -2111,7 +2111,7 @@ static int cxgb4_inet6addr_handler(struc
#if IS_ENABLED(CONFIG_BONDING)
struct adapter *adap;
#endif
@@ -176,7 +176,7 @@ Acked-by: David Chang <dchang@suse.com>
}
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
-@@ -1495,7 +1495,7 @@ static int netvsc_netdev_event(struct no
+@@ -1604,7 +1604,7 @@ static int netvsc_netdev_event(struct no
return NOTIFY_DONE;
/* Avoid Vlan dev with same MAC registering as VF */
@@ -187,7 +187,7 @@ Acked-by: David Chang <dchang@suse.com>
/* Avoid Bonding master dev with same MAC registering as VF */
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
-@@ -2290,7 +2290,7 @@ static int _bnx2fc_create(struct net_dev
+@@ -2295,7 +2295,7 @@ static int _bnx2fc_create(struct net_dev
}
/* obtain physical netdev */
@@ -196,8 +196,8 @@ Acked-by: David Chang <dchang@suse.com>
phys_dev = vlan_dev_real_dev(netdev);
/* verify if the physical device is a netxtreme2 device */
-@@ -2328,7 +2328,7 @@ static int _bnx2fc_create(struct net_dev
- goto ifput_err;
+@@ -2333,7 +2333,7 @@ static int _bnx2fc_create(struct net_dev
+ goto netdev_err;
}
- if (netdev->priv_flags & IFF_802_1Q_VLAN) {
@@ -205,7 +205,7 @@ Acked-by: David Chang <dchang@suse.com>
vlan_id = vlan_dev_vlan_id(netdev);
interface->vlan_enabled = 1;
}
-@@ -2546,7 +2546,7 @@ static bool bnx2fc_match(struct net_devi
+@@ -2551,7 +2551,7 @@ static bool bnx2fc_match(struct net_devi
struct net_device *phys_dev = netdev;
mutex_lock(&bnx2fc_dev_lock);
@@ -216,7 +216,7 @@ Acked-by: David Chang <dchang@suse.com>
if (bnx2fc_hba_lookup(phys_dev)) {
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
-@@ -220,7 +220,7 @@ struct cxgbi_device *cxgbi_device_find_b
+@@ -223,7 +223,7 @@ struct cxgbi_device *cxgbi_device_find_b
struct cxgbi_device *cdev, *tmp;
int i;
@@ -225,7 +225,7 @@ Acked-by: David Chang <dchang@suse.com>
vdev = ndev;
ndev = vlan_dev_real_dev(ndev);
log_debug(1 << CXGBI_DBG_DEV,
-@@ -253,7 +253,7 @@ struct cxgbi_device *cxgbi_device_find_b
+@@ -256,7 +256,7 @@ struct cxgbi_device *cxgbi_device_find_b
struct cxgbi_device *cdev;
int i;
@@ -234,7 +234,7 @@ Acked-by: David Chang <dchang@suse.com>
vdev = ndev;
ndev = vlan_dev_real_dev(ndev);
pr_info("vlan dev %s -> %s.\n", vdev->name, ndev->name);
-@@ -287,7 +287,7 @@ static struct cxgbi_device *cxgbi_device
+@@ -290,7 +290,7 @@ static struct cxgbi_device *cxgbi_device
struct cxgbi_device *cdev, *tmp;
int i;
@@ -255,7 +255,7 @@ Acked-by: David Chang <dchang@suse.com>
fcoe->realdev = real_dev;
rcu_read_lock();
for_each_dev_addr(real_dev, ha) {
-@@ -746,7 +745,7 @@ static int fcoe_netdev_config(struct fc_
+@@ -752,7 +751,7 @@ static int fcoe_netdev_config(struct fc_
ctlr = fcoe_to_ctlr(fcoe);
/* Figure out the VLAN ID, if any */
@@ -264,7 +264,7 @@ Acked-by: David Chang <dchang@suse.com>
lport->vlan = vlan_dev_vlan_id(netdev);
else
lport->vlan = 0;
-@@ -975,13 +974,13 @@ static inline int fcoe_em_config(struct
+@@ -981,13 +980,13 @@ static inline int fcoe_em_config(struct
* Reuse existing offload em instance in case
* it is already allocated on real eth device
*/
@@ -280,7 +280,7 @@ Acked-by: David Chang <dchang@suse.com>
old_real_dev = vlan_dev_real_dev(oldfcoe->netdev);
else
old_real_dev = oldfcoe->netdev;
-@@ -1579,7 +1578,7 @@ static int fcoe_xmit(struct fc_lport *lp
+@@ -1585,7 +1584,7 @@ static int fcoe_xmit(struct fc_lport *lp
skb->protocol = htons(ETH_P_FCOE);
skb->priority = fcoe->priority;
@@ -289,7 +289,7 @@ Acked-by: David Chang <dchang@suse.com>
fcoe->realdev->features & NETIF_F_HW_VLAN_CTAG_TX) {
/* must set skb->dev before calling vlan_put_tag */
skb->dev = fcoe->realdev;
-@@ -1809,7 +1808,7 @@ fcoe_hostlist_lookup_realdev_port(struct
+@@ -1815,7 +1814,7 @@ fcoe_hostlist_lookup_realdev_port(struct
struct net_device *real_dev;
list_for_each_entry(fcoe, &fcoe_hostlist, list) {
@@ -300,7 +300,7 @@ Acked-by: David Chang <dchang@suse.com>
real_dev = fcoe->netdev;
--- a/include/rdma/ib_addr.h
+++ b/include/rdma/ib_addr.h
-@@ -160,8 +160,7 @@ static inline int rdma_addr_gid_offset(s
+@@ -162,8 +162,7 @@ static inline int rdma_addr_gid_offset(s
static inline u16 rdma_vlan_dev_vlan_id(const struct net_device *dev)
{
diff --git a/patches.fixes/0003-memremap-add-scheduling-point-to-devm_memremap_pages.patch b/patches.fixes/0003-memremap-add-scheduling-point-to-devm_memremap_pages.patch
index 02b15ab04a..2dec33b881 100644
--- a/patches.fixes/0003-memremap-add-scheduling-point-to-devm_memremap_pages.patch
+++ b/patches.fixes/0003-memremap-add-scheduling-point-to-devm_memremap_pages.patch
@@ -45,16 +45,16 @@ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
-@@ -275,7 +275,7 @@ void *devm_memremap_pages(struct device
+@@ -290,7 +290,7 @@ void *devm_memremap_pages(struct device
struct dev_pagemap *pgmap;
struct page_map *page_map;
unsigned long pfn;
- int error, nid;
+ int error, nid, i = 0;
- if (is_ram == REGION_MIXED) {
- WARN_ONCE(1, "%s attempted on mixed region %pr\n",
-@@ -358,6 +358,8 @@ void *devm_memremap_pages(struct device
+ if (is_ram != REGION_DISJOINT) {
+ WARN_ONCE(1, "%s attempted on %s region %pr\n", __func__,
+@@ -376,6 +376,8 @@ void *devm_memremap_pages(struct device
/* ZONE_DEVICE pages must never appear on a slab lru */
list_force_poison(&page->lru);
page->pgmap = pgmap;
diff --git a/patches.fixes/vfs-Avoid-softlockups-in-drop_pagecache_sb.patch b/patches.fixes/vfs-Avoid-softlockups-in-drop_pagecache_sb.patch
new file mode 100644
index 0000000000..2d5366d23d
--- /dev/null
+++ b/patches.fixes/vfs-Avoid-softlockups-in-drop_pagecache_sb.patch
@@ -0,0 +1,53 @@
+From 9a6b7c0ff64945366c05338873e2456b990948e9 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Thu, 6 Dec 2018 17:06:08 +0100
+Subject: [PATCH] vfs: Avoid softlockups in drop_pagecache_sb()
+Patch-mainline: Submitted, Jan 14 2019
+References: bsc#1118505
+
+When superblock has lots of inodes without any pagecache (like is the
+case for /proc), drop_pagecache_sb() will iterate through all of them
+without dropping sb->s_inode_list_lock which can lead to softlockups
+(one of our customers hit this).
+
+Fix the problem by going to the slow path and doing cond_resched() in
+case the process needs rescheduling.
+
+Acked-by: Michal Hocko <mhocko@suse.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/drop_caches.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/drop_caches.c b/fs/drop_caches.c
+index 82377017130f..d31b6c72b476 100644
+--- a/fs/drop_caches.c
++++ b/fs/drop_caches.c
+@@ -21,8 +21,13 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
+ spin_lock(&sb->s_inode_list_lock);
+ list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
+ spin_lock(&inode->i_lock);
++ /*
++ * We must skip inodes in unusual state. We may also skip
++ * inodes without pages but we deliberately won't in case
++ * we need to reschedule to avoid softlockups.
++ */
+ if ((inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) ||
+- (inode->i_mapping->nrpages == 0)) {
++ (inode->i_mapping->nrpages == 0 && !need_resched())) {
+ spin_unlock(&inode->i_lock);
+ continue;
+ }
+@@ -30,6 +35,7 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
+ spin_unlock(&inode->i_lock);
+ spin_unlock(&sb->s_inode_list_lock);
+
++ cond_resched();
+ invalidate_mapping_pages(inode->i_mapping, 0, -1);
+ iput(toput_inode);
+ toput_inode = inode;
+--
+2.16.4
+
diff --git a/patches.kernel.org/4.4.169-001-lib-interval_tree_test.c-make-test-options-mo.patch b/patches.kernel.org/4.4.169-001-lib-interval_tree_test.c-make-test-options-mo.patch
new file mode 100644
index 0000000000..d4d80c2629
--- /dev/null
+++ b/patches.kernel.org/4.4.169-001-lib-interval_tree_test.c-make-test-options-mo.patch
@@ -0,0 +1,148 @@
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Mon, 10 Jul 2017 15:51:46 -0700
+Subject: [PATCH] lib/interval_tree_test.c: make test options module parameters
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: a54dae0338b7f01eb0f9c7571fb9b74f791d1c6b
+
+[ Upstream commit a54dae0338b7f01eb0f9c7571fb9b74f791d1c6b ]
+
+Allows for more flexible debugging.
+
+Link: http://lkml.kernel.org/r/20170518174936.20265-3-dave@stgolabs.net
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ lib/interval_tree_test.c | 57 ++++++++++++++++++++++++++++------------
+ 1 file changed, 40 insertions(+), 17 deletions(-)
+
+diff --git a/lib/interval_tree_test.c b/lib/interval_tree_test.c
+index 245900b98c8e..1093f0496d5e 100644
+--- a/lib/interval_tree_test.c
++++ b/lib/interval_tree_test.c
+@@ -1,16 +1,25 @@
+ #include <linux/module.h>
++#include <linux/moduleparam.h>
+ #include <linux/interval_tree.h>
+ #include <linux/random.h>
++#include <linux/slab.h>
+ #include <asm/timex.h>
+
+-#define NODES 100
+-#define PERF_LOOPS 100000
+-#define SEARCHES 100
+-#define SEARCH_LOOPS 10000
++#define __param(type, name, init, msg) \
++ static type name = init; \
++ module_param(name, type, 0444); \
++ MODULE_PARM_DESC(name, msg);
++
++__param(int, nnodes, 100, "Number of nodes in the interval tree");
++__param(int, perf_loops, 100000, "Number of iterations modifying the tree");
++
++__param(int, nsearches, 100, "Number of searches to the interval tree");
++__param(int, search_loops, 10000, "Number of iterations searching the tree");
++
+
+ static struct rb_root root = RB_ROOT;
+-static struct interval_tree_node nodes[NODES];
+-static u32 queries[SEARCHES];
++static struct interval_tree_node *nodes = NULL;
++static u32 *queries = NULL;
+
+ static struct rnd_state rnd;
+
+@@ -29,7 +38,8 @@ search(unsigned long query, struct rb_root *root)
+ static void init(void)
+ {
+ int i;
+- for (i = 0; i < NODES; i++) {
++
++ for (i = 0; i < nnodes; i++) {
+ u32 a = prandom_u32_state(&rnd);
+ u32 b = prandom_u32_state(&rnd);
+ if (a <= b) {
+@@ -40,7 +50,7 @@ static void init(void)
+ nodes[i].last = a;
+ }
+ }
+- for (i = 0; i < SEARCHES; i++)
++ for (i = 0; i < nsearches; i++)
+ queries[i] = prandom_u32_state(&rnd);
+ }
+
+@@ -50,6 +60,16 @@ static int interval_tree_test_init(void)
+ unsigned long results;
+ cycles_t time1, time2, time;
+
++ nodes = kmalloc(nnodes * sizeof(struct interval_tree_node), GFP_KERNEL);
++ if (!nodes)
++ return -ENOMEM;
++
++ queries = kmalloc(nsearches * sizeof(int), GFP_KERNEL);
++ if (!queries) {
++ kfree(nodes);
++ return -ENOMEM;
++ }
++
+ printk(KERN_ALERT "interval tree insert/remove");
+
+ prandom_seed_state(&rnd, 3141592653589793238ULL);
+@@ -57,39 +77,42 @@ static int interval_tree_test_init(void)
+
+ time1 = get_cycles();
+
+- for (i = 0; i < PERF_LOOPS; i++) {
+- for (j = 0; j < NODES; j++)
++ for (i = 0; i < perf_loops; i++) {
++ for (j = 0; j < nnodes; j++)
+ interval_tree_insert(nodes + j, &root);
+- for (j = 0; j < NODES; j++)
++ for (j = 0; j < nnodes; j++)
+ interval_tree_remove(nodes + j, &root);
+ }
+
+ time2 = get_cycles();
+ time = time2 - time1;
+
+- time = div_u64(time, PERF_LOOPS);
++ time = div_u64(time, perf_loops);
+ printk(" -> %llu cycles\n", (unsigned long long)time);
+
+ printk(KERN_ALERT "interval tree search");
+
+- for (j = 0; j < NODES; j++)
++ for (j = 0; j < nnodes; j++)
+ interval_tree_insert(nodes + j, &root);
+
+ time1 = get_cycles();
+
+ results = 0;
+- for (i = 0; i < SEARCH_LOOPS; i++)
+- for (j = 0; j < SEARCHES; j++)
++ for (i = 0; i < search_loops; i++)
++ for (j = 0; j < nsearches; j++)
+ results += search(queries[j], &root);
+
+ time2 = get_cycles();
+ time = time2 - time1;
+
+- time = div_u64(time, SEARCH_LOOPS);
+- results = div_u64(results, SEARCH_LOOPS);
++ time = div_u64(time, search_loops);
++ results = div_u64(results, search_loops);
+ printk(" -> %llu cycles (%lu results)\n",
+ (unsigned long long)time, results);
+
++ kfree(queries);
++ kfree(nodes);
++
+ return -EAGAIN; /* Fail will directly unload the module */
+ }
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-002-lib-interval_tree_test.c-allow-full-tree-sear.patch b/patches.kernel.org/4.4.169-002-lib-interval_tree_test.c-allow-full-tree-sear.patch
new file mode 100644
index 0000000000..40fd19957b
--- /dev/null
+++ b/patches.kernel.org/4.4.169-002-lib-interval_tree_test.c-allow-full-tree-sear.patch
@@ -0,0 +1,70 @@
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Mon, 10 Jul 2017 15:51:52 -0700
+Subject: [PATCH] lib/interval_tree_test.c: allow full tree search
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: c46ecce431ebe6b1a9551d1f530eb432dae5c39b
+
+[ Upstream commit c46ecce431ebe6b1a9551d1f530eb432dae5c39b ]
+
+... such that a user can specify visiting all the nodes in the tree
+(intersects with the world). This is a nice opposite from the very
+basic default query which is a single point.
+
+Link: http://lkml.kernel.org/r/20170518174936.20265-5-dave@stgolabs.net
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ lib/interval_tree_test.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/lib/interval_tree_test.c b/lib/interval_tree_test.c
+index 1093f0496d5e..409383463879 100644
+--- a/lib/interval_tree_test.c
++++ b/lib/interval_tree_test.c
+@@ -15,6 +15,7 @@ __param(int, perf_loops, 100000, "Number of iterations modifying the tree");
+
+ __param(int, nsearches, 100, "Number of searches to the interval tree");
+ __param(int, search_loops, 10000, "Number of iterations searching the tree");
++__param(bool, search_all, false, "Searches will iterate all nodes in the tree");
+
+
+ static struct rb_root root = RB_ROOT;
+@@ -24,13 +25,13 @@ static u32 *queries = NULL;
+ static struct rnd_state rnd;
+
+ static inline unsigned long
+-search(unsigned long query, struct rb_root *root)
++search(struct rb_root *root, unsigned long start, unsigned long last)
+ {
+ struct interval_tree_node *node;
+ unsigned long results = 0;
+
+- for (node = interval_tree_iter_first(root, query, query); node;
+- node = interval_tree_iter_next(node, query, query))
++ for (node = interval_tree_iter_first(root, start, last); node;
++ node = interval_tree_iter_next(node, start, last))
+ results++;
+ return results;
+ }
+@@ -99,8 +100,12 @@ static int interval_tree_test_init(void)
+
+ results = 0;
+ for (i = 0; i < search_loops; i++)
+- for (j = 0; j < nsearches; j++)
+- results += search(queries[j], &root);
++ for (j = 0; j < nsearches; j++) {
++ unsigned long start = search_all ? 0 : queries[j];
++ unsigned long last = search_all ? max_endpoint : queries[j];
++
++ results += search(&root, start, last);
++ }
+
+ time2 = get_cycles();
+ time = time2 - time1;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-003-lib-rbtree_test.c-make-input-module-parameter.patch b/patches.kernel.org/4.4.169-003-lib-rbtree_test.c-make-input-module-parameter.patch
new file mode 100644
index 0000000000..d4cf285780
--- /dev/null
+++ b/patches.kernel.org/4.4.169-003-lib-rbtree_test.c-make-input-module-parameter.patch
@@ -0,0 +1,158 @@
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Fri, 8 Sep 2017 16:14:46 -0700
+Subject: [PATCH] lib/rbtree_test.c: make input module parameters
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 223f8911eace60c787f8767c25148b80ece9732a
+
+[ Upstream commit 223f8911eace60c787f8767c25148b80ece9732a ]
+
+Allows for more flexible debugging.
+
+Link: http://lkml.kernel.org/r/20170719014603.19029-5-dave@stgolabs.net
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ lib/rbtree_test.c | 55 +++++++++++++++++++++++++++++------------------
+ 1 file changed, 34 insertions(+), 21 deletions(-)
+
+diff --git a/lib/rbtree_test.c b/lib/rbtree_test.c
+index 8b3c9dc88262..e83331aa1b7f 100644
+--- a/lib/rbtree_test.c
++++ b/lib/rbtree_test.c
+@@ -1,11 +1,18 @@
+ #include <linux/module.h>
++#include <linux/moduleparam.h>
+ #include <linux/rbtree_augmented.h>
+ #include <linux/random.h>
++#include <linux/slab.h>
+ #include <asm/timex.h>
+
+-#define NODES 100
+-#define PERF_LOOPS 100000
+-#define CHECK_LOOPS 100
++#define __param(type, name, init, msg) \
++ static type name = init; \
++ module_param(name, type, 0444); \
++ MODULE_PARM_DESC(name, msg);
++
++__param(int, nnodes, 100, "Number of nodes in the rb-tree");
++__param(int, perf_loops, 100000, "Number of iterations modifying the rb-tree");
++__param(int, check_loops, 100, "Number of iterations modifying and verifying the rb-tree");
+
+ struct test_node {
+ u32 key;
+@@ -17,7 +24,7 @@ struct test_node {
+ };
+
+ static struct rb_root root = RB_ROOT;
+-static struct test_node nodes[NODES];
++static struct test_node *nodes = NULL;
+
+ static struct rnd_state rnd;
+
+@@ -95,7 +102,7 @@ static void erase_augmented(struct test_node *node, struct rb_root *root)
+ static void init(void)
+ {
+ int i;
+- for (i = 0; i < NODES; i++) {
++ for (i = 0; i < nnodes; i++) {
+ nodes[i].key = prandom_u32_state(&rnd);
+ nodes[i].val = prandom_u32_state(&rnd);
+ }
+@@ -177,6 +184,10 @@ static int __init rbtree_test_init(void)
+ int i, j;
+ cycles_t time1, time2, time;
+
++ nodes = kmalloc(nnodes * sizeof(*nodes), GFP_KERNEL);
++ if (!nodes)
++ return -ENOMEM;
++
+ printk(KERN_ALERT "rbtree testing");
+
+ prandom_seed_state(&rnd, 3141592653589793238ULL);
+@@ -184,27 +195,27 @@ static int __init rbtree_test_init(void)
+
+ time1 = get_cycles();
+
+- for (i = 0; i < PERF_LOOPS; i++) {
+- for (j = 0; j < NODES; j++)
++ for (i = 0; i < perf_loops; i++) {
++ for (j = 0; j < nnodes; j++)
+ insert(nodes + j, &root);
+- for (j = 0; j < NODES; j++)
++ for (j = 0; j < nnodes; j++)
+ erase(nodes + j, &root);
+ }
+
+ time2 = get_cycles();
+ time = time2 - time1;
+
+- time = div_u64(time, PERF_LOOPS);
++ time = div_u64(time, perf_loops);
+ printk(" -> %llu cycles\n", (unsigned long long)time);
+
+- for (i = 0; i < CHECK_LOOPS; i++) {
++ for (i = 0; i < check_loops; i++) {
+ init();
+- for (j = 0; j < NODES; j++) {
++ for (j = 0; j < nnodes; j++) {
+ check(j);
+ insert(nodes + j, &root);
+ }
+- for (j = 0; j < NODES; j++) {
+- check(NODES - j);
++ for (j = 0; j < nnodes; j++) {
++ check(nnodes - j);
+ erase(nodes + j, &root);
+ }
+ check(0);
+@@ -216,32 +227,34 @@ static int __init rbtree_test_init(void)
+
+ time1 = get_cycles();
+
+- for (i = 0; i < PERF_LOOPS; i++) {
+- for (j = 0; j < NODES; j++)
++ for (i = 0; i < perf_loops; i++) {
++ for (j = 0; j < nnodes; j++)
+ insert_augmented(nodes + j, &root);
+- for (j = 0; j < NODES; j++)
++ for (j = 0; j < nnodes; j++)
+ erase_augmented(nodes + j, &root);
+ }
+
+ time2 = get_cycles();
+ time = time2 - time1;
+
+- time = div_u64(time, PERF_LOOPS);
++ time = div_u64(time, perf_loops);
+ printk(" -> %llu cycles\n", (unsigned long long)time);
+
+- for (i = 0; i < CHECK_LOOPS; i++) {
++ for (i = 0; i < check_loops; i++) {
+ init();
+- for (j = 0; j < NODES; j++) {
++ for (j = 0; j < nnodes; j++) {
+ check_augmented(j);
+ insert_augmented(nodes + j, &root);
+ }
+- for (j = 0; j < NODES; j++) {
+- check_augmented(NODES - j);
++ for (j = 0; j < nnodes; j++) {
++ check_augmented(nnodes - j);
+ erase_augmented(nodes + j, &root);
+ }
+ check_augmented(0);
+ }
+
++ kfree(nodes);
++
+ return -EAGAIN; /* Fail will directly unload the module */
+ }
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-004-lib-rbtree-test-lower-default-params.patch b/patches.kernel.org/4.4.169-004-lib-rbtree-test-lower-default-params.patch
new file mode 100644
index 0000000000..d5b2bef244
--- /dev/null
+++ b/patches.kernel.org/4.4.169-004-lib-rbtree-test-lower-default-params.patch
@@ -0,0 +1,61 @@
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Fri, 17 Nov 2017 15:28:27 -0800
+Subject: [PATCH] lib/rbtree-test: lower default params
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 0b548e33e6cb2bff240fdaf1783783be15c29080
+
+[ Upstream commit 0b548e33e6cb2bff240fdaf1783783be15c29080 ]
+
+Fengguang reported soft lockups while running the rbtree and interval
+tree test modules. The logic for these tests all occur in init phase,
+and we currently are pounding with the default values for number of
+nodes and number of iterations of each test. Reduce the latter by two
+orders of magnitude. This does not influence the value of the tests in
+that one thousand times by default is enough to get the picture.
+
+Link: http://lkml.kernel.org/r/20171109161715.xai2dtwqw2frhkcm@linux-n805
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ lib/interval_tree_test.c | 4 ++--
+ lib/rbtree_test.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/interval_tree_test.c b/lib/interval_tree_test.c
+index 409383463879..bababcf7ffdd 100644
+--- a/lib/interval_tree_test.c
++++ b/lib/interval_tree_test.c
+@@ -11,10 +11,10 @@
+ MODULE_PARM_DESC(name, msg);
+
+ __param(int, nnodes, 100, "Number of nodes in the interval tree");
+-__param(int, perf_loops, 100000, "Number of iterations modifying the tree");
++__param(int, perf_loops, 1000, "Number of iterations modifying the tree");
+
+ __param(int, nsearches, 100, "Number of searches to the interval tree");
+-__param(int, search_loops, 10000, "Number of iterations searching the tree");
++__param(int, search_loops, 1000, "Number of iterations searching the tree");
+ __param(bool, search_all, false, "Searches will iterate all nodes in the tree");
+
+
+diff --git a/lib/rbtree_test.c b/lib/rbtree_test.c
+index e83331aa1b7f..afedd3770562 100644
+--- a/lib/rbtree_test.c
++++ b/lib/rbtree_test.c
+@@ -11,7 +11,7 @@
+ MODULE_PARM_DESC(name, msg);
+
+ __param(int, nnodes, 100, "Number of nodes in the rb-tree");
+-__param(int, perf_loops, 100000, "Number of iterations modifying the rb-tree");
++__param(int, perf_loops, 1000, "Number of iterations modifying the rb-tree");
+ __param(int, check_loops, 100, "Number of iterations modifying and verifying the rb-tree");
+
+ struct test_node {
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-005-lib-interval_tree_test.c-allow-users-to-limit.patch b/patches.kernel.org/4.4.169-005-lib-interval_tree_test.c-allow-users-to-limit.patch
new file mode 100644
index 0000000000..bb6ed1dcb7
--- /dev/null
+++ b/patches.kernel.org/4.4.169-005-lib-interval_tree_test.c-allow-users-to-limit.patch
@@ -0,0 +1,69 @@
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Mon, 10 Jul 2017 15:51:49 -0700
+Subject: [PATCH] lib/interval_tree_test.c: allow users to limit scope of
+ endpoint
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: a8ec14d4f6aa8e245efacc992c8ee6ea0464ce2a
+
+[ Upstream commit a8ec14d4f6aa8e245efacc992c8ee6ea0464ce2a ]
+
+Add a 'max_endpoint' parameter such that users may easily limit the size
+of the intervals that are randomly generated.
+
+Link: http://lkml.kernel.org/r/20170518174936.20265-4-dave@stgolabs.net
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ lib/interval_tree_test.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/lib/interval_tree_test.c b/lib/interval_tree_test.c
+index bababcf7ffdd..222c8010bda0 100644
+--- a/lib/interval_tree_test.c
++++ b/lib/interval_tree_test.c
+@@ -17,6 +17,7 @@ __param(int, nsearches, 100, "Number of searches to the interval tree");
+ __param(int, search_loops, 1000, "Number of iterations searching the tree");
+ __param(bool, search_all, false, "Searches will iterate all nodes in the tree");
+
++__param(uint, max_endpoint, ~0, "Largest value for the interval's endpoint");
+
+ static struct rb_root root = RB_ROOT;
+ static struct interval_tree_node *nodes = NULL;
+@@ -41,18 +42,20 @@ static void init(void)
+ int i;
+
+ for (i = 0; i < nnodes; i++) {
+- u32 a = prandom_u32_state(&rnd);
+- u32 b = prandom_u32_state(&rnd);
+- if (a <= b) {
+- nodes[i].start = a;
+- nodes[i].last = b;
+- } else {
+- nodes[i].start = b;
+- nodes[i].last = a;
+- }
++ u32 b = (prandom_u32_state(&rnd) >> 4) % max_endpoint;
++ u32 a = (prandom_u32_state(&rnd) >> 4) % b;
++
++ nodes[i].start = a;
++ nodes[i].last = b;
+ }
++
++ /*
++ * Limit the search scope to what the user defined.
++ * Otherwise we are merely measuring empty walks,
++ * which is pointless.
++ */
+ for (i = 0; i < nsearches; i++)
+- queries[i] = prandom_u32_state(&rnd);
++ queries[i] = (prandom_u32_state(&rnd) >> 4) % max_endpoint;
+ }
+
+ static int interval_tree_test_init(void)
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-006-timer-debug-Change-proc-timer_list-from-0444-.patch b/patches.kernel.org/4.4.169-006-timer-debug-Change-proc-timer_list-from-0444-.patch
new file mode 100644
index 0000000000..23bd42e01d
--- /dev/null
+++ b/patches.kernel.org/4.4.169-006-timer-debug-Change-proc-timer_list-from-0444-.patch
@@ -0,0 +1,39 @@
+From: Ingo Molnar <mingo@kernel.org>
+Date: Mon, 13 Nov 2017 07:15:41 +0100
+Subject: [PATCH] timer/debug: Change /proc/timer_list from 0444 to 0400
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 8e7df2b5b7f245c9bd11064712db5cb69044a362
+
+[ Upstream commit 8e7df2b5b7f245c9bd11064712db5cb69044a362 ]
+
+While it uses %pK, there's still few reasons to read this file
+as non-root.
+
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/time/timer_list.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
+index ef4f16e81283..1407ed20ea93 100644
+--- a/kernel/time/timer_list.c
++++ b/kernel/time/timer_list.c
+@@ -399,7 +399,7 @@ static int __init init_timer_list_procfs(void)
+ {
+ struct proc_dir_entry *pe;
+
+- pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
++ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
+ if (!pe)
+ return -ENOMEM;
+ return 0;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-007-powerpc-boot-Fix-random-libfdt-related-build-.patch b/patches.kernel.org/4.4.169-007-powerpc-boot-Fix-random-libfdt-related-build-.patch
new file mode 100644
index 0000000000..44457c8e18
--- /dev/null
+++ b/patches.kernel.org/4.4.169-007-powerpc-boot-Fix-random-libfdt-related-build-.patch
@@ -0,0 +1,61 @@
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sat, 15 Dec 2018 07:30:39 -0800
+Subject: [PATCH] powerpc/boot: Fix random libfdt related build errors
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 64c3f648c25d108f346fdc96c15180c6b7d250e9
+
+[ Upstream commit 64c3f648c25d108f346fdc96c15180c6b7d250e9 ]
+
+Once in a while I see build errors similar to the following
+when building images from a clean tree.
+
+ Building powerpc:virtex-ml507:44x/virtex5_defconfig ... failed
+ ------------
+ Error log:
+ arch/powerpc/boot/treeboot-akebono.c:37:20: fatal error:
+ libfdt.h: No such file or directory
+
+ Building powerpc:bamboo:smpdev:44x/bamboo_defconfig ... failed
+ ------------
+ Error log:
+ arch/powerpc/boot/treeboot-akebono.c:37:20: fatal error:
+ libfdt.h: No such file or directory
+
+ arch/powerpc/boot/treeboot-currituck.c:35:20: fatal error:
+ libfdt.h: No such file or directory
+
+Rebuilds will succeed.
+
+Turns out that several source files in arch/powerpc/boot/ include
+libfdt.h, but Makefile dependencies are incomplete. Let's fix that.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[groeck: Backport to v4.4.y]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/powerpc/boot/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
+index 99e4487248ff..57003d1bd243 100644
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -70,7 +70,8 @@ $(addprefix $(obj)/,$(zlib) cuboot-c2k.o gunzip_util.o main.o): \
+ libfdt := fdt.c fdt_ro.c fdt_wip.c fdt_sw.c fdt_rw.c fdt_strerror.c
+ libfdtheader := fdt.h libfdt.h libfdt_internal.h
+
+-$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o): \
++$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o \
++ treeboot-akebono.o treeboot-currituck.o treeboot-iss4xx.o): \
+ $(addprefix $(obj)/,$(libfdtheader))
+
+ src-wlib-y := string.S crt0.S crtsavres.S stdio.c main.c \
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-008-pinctrl-sunxi-a83t-Fix-IRQ-offset-typo-for-PH.patch b/patches.kernel.org/4.4.169-008-pinctrl-sunxi-a83t-Fix-IRQ-offset-typo-for-PH.patch
new file mode 100644
index 0000000000..c9ed658a8e
--- /dev/null
+++ b/patches.kernel.org/4.4.169-008-pinctrl-sunxi-a83t-Fix-IRQ-offset-typo-for-PH.patch
@@ -0,0 +1,42 @@
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Tue, 4 Dec 2018 17:04:57 +0800
+Subject: [PATCH] pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 478b6767ad26ab86d9ecc341027dd09a87b1f997
+
+commit 478b6767ad26ab86d9ecc341027dd09a87b1f997 upstream.
+
+Pin PH11 is used on various A83T board to detect a change in the OTG
+port's ID pin, as in when an OTG host cable is plugged in.
+
+The incorrect offset meant the gpiochip/irqchip was activating the wrong
+pin for interrupts.
+
+Fixes: 4730f33f0d82 ("pinctrl: sunxi: add allwinner A83T PIO controller support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+index a7c81e988656..383977ea3a3c 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+@@ -568,7 +568,7 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = {
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(H, 11),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+- SUNXI_FUNCTION_IRQ_BANK(0x6, 2, 1)), /* PH_EINT11 */
++ SUNXI_FUNCTION_IRQ_BANK(0x6, 2, 11)), /* PH_EINT11 */
+ };
+
+ static const struct sunxi_pinctrl_desc sun8i_a83t_pinctrl_data = {
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-009-aio-fix-spectre-gadget-in-lookup_ioctx.patch b/patches.kernel.org/4.4.169-009-aio-fix-spectre-gadget-in-lookup_ioctx.patch
new file mode 100644
index 0000000000..99b3dbc913
--- /dev/null
+++ b/patches.kernel.org/4.4.169-009-aio-fix-spectre-gadget-in-lookup_ioctx.patch
@@ -0,0 +1,47 @@
+From: Jeff Moyer <jmoyer@redhat.com>
+Date: Tue, 11 Dec 2018 12:37:49 -0500
+Subject: [PATCH] aio: fix spectre gadget in lookup_ioctx
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: a538e3ff9dabcdf6c3f477a373c629213d1c3066
+
+commit a538e3ff9dabcdf6c3f477a373c629213d1c3066 upstream.
+
+Matthew pointed out that the ioctx_table is susceptible to spectre v1,
+because the index can be controlled by an attacker. The below patch
+should mitigate the attack for all of the aio system calls.
+
+Cc: stable@vger.kernel.org
+Reported-by: Matthew Wilcox <willy@infradead.org>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/aio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/aio.c b/fs/aio.c
+index c283eb03cb38..7187d03aa0bc 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -40,6 +40,7 @@
+ #include <linux/ramfs.h>
+ #include <linux/percpu-refcount.h>
+ #include <linux/mount.h>
++#include <linux/nospec.h>
+
+ #include <asm/kmap_types.h>
+ #include <asm/uaccess.h>
+@@ -1063,6 +1064,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
+ if (!table || id >= table->nr)
+ goto out;
+
++ id = array_index_nospec(id, table->nr);
+ ctx = rcu_dereference(table->table[id]);
+ if (ctx && ctx->user_id == ctx_id) {
+ if (percpu_ref_tryget_live(&ctx->users))
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-010-MMC-OMAP-fix-broken-MMC-on-OMAP15XX-OMAP5910-.patch b/patches.kernel.org/4.4.169-010-MMC-OMAP-fix-broken-MMC-on-OMAP15XX-OMAP5910-.patch
new file mode 100644
index 0000000000..d254c38220
--- /dev/null
+++ b/patches.kernel.org/4.4.169-010-MMC-OMAP-fix-broken-MMC-on-OMAP15XX-OMAP5910-.patch
@@ -0,0 +1,133 @@
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+Date: Tue, 20 Nov 2018 01:14:00 +0200
+Subject: [PATCH] MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: e8cde625bfe8a714a856e1366bcbb259d7346095
+
+commit e8cde625bfe8a714a856e1366bcbb259d7346095 upstream.
+
+Since v2.6.22 or so there has been reports [1] about OMAP MMC being
+broken on OMAP15XX based hardware (OMAP5910 and OMAP310). The breakage
+seems to have been caused by commit 46a6730e3ff9 ("mmc-omap: Fix
+omap to use MMC_POWER_ON") that changed clock enabling to be done
+on MMC_POWER_ON. This can happen multiple times in a row, and on 15XX
+the hardware doesn't seem to like it and the MMC just stops responding.
+Fix by memorizing the power mode and do the init only when necessary.
+
+Before the patch (on Palm TE):
+
+ mmc0: new SD card at address b368
+ mmcblk0: mmc0:b368 SDC 977 MiB
+ mmci-omap mmci-omap.0: command timeout (CMD18)
+ mmci-omap mmci-omap.0: command timeout (CMD13)
+ mmci-omap mmci-omap.0: command timeout (CMD13)
+ mmci-omap mmci-omap.0: command timeout (CMD12) [x 6]
+ mmci-omap mmci-omap.0: command timeout (CMD13) [x 6]
+ mmcblk0: error -110 requesting status
+ mmci-omap mmci-omap.0: command timeout (CMD8)
+ mmci-omap mmci-omap.0: command timeout (CMD18)
+ mmci-omap mmci-omap.0: command timeout (CMD13)
+ mmci-omap mmci-omap.0: command timeout (CMD13)
+ mmci-omap mmci-omap.0: command timeout (CMD12) [x 6]
+ mmci-omap mmci-omap.0: command timeout (CMD13) [x 6]
+ mmcblk0: error -110 requesting status
+ mmcblk0: recovery failed!
+ print_req_error: I/O error, dev mmcblk0, sector 0
+ Buffer I/O error on dev mmcblk0, logical block 0, async page read
+ mmcblk0: unable to read partition table
+
+After the patch:
+
+ mmc0: new SD card at address b368
+ mmcblk0: mmc0:b368 SDC 977 MiB
+ mmcblk0: p1
+
+The patch is based on a fix and analysis done by Ladislav Michl.
+
+Tested on OMAP15XX/OMAP310 (Palm TE), OMAP1710 (Nokia 770)
+and OMAP2420 (Nokia N810).
+
+[1] https://marc.info/?t=123175197000003&r=1&w=2
+
+Fixes: 46a6730e3ff9 ("mmc-omap: Fix omap to use MMC_POWER_ON")
+Reported-by: Ladislav Michl <ladis@linux-mips.org>
+Reported-by: Andrzej Zaborowski <balrogg@gmail.com>
+Tested-by: Ladislav Michl <ladis@linux-mips.org>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/mmc/host/omap.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
+index b9958a123594..5bcf4f45f8b4 100644
+--- a/drivers/mmc/host/omap.c
++++ b/drivers/mmc/host/omap.c
+@@ -105,6 +105,7 @@ struct mmc_omap_slot {
+ unsigned int vdd;
+ u16 saved_con;
+ u16 bus_mode;
++ u16 power_mode;
+ unsigned int fclk_freq;
+
+ struct tasklet_struct cover_tasklet;
+@@ -1156,7 +1157,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ struct mmc_omap_slot *slot = mmc_priv(mmc);
+ struct mmc_omap_host *host = slot->host;
+ int i, dsor;
+- int clk_enabled;
++ int clk_enabled, init_stream;
+
+ mmc_omap_select_slot(slot, 0);
+
+@@ -1166,6 +1167,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ slot->vdd = ios->vdd;
+
+ clk_enabled = 0;
++ init_stream = 0;
+ switch (ios->power_mode) {
+ case MMC_POWER_OFF:
+ mmc_omap_set_power(slot, 0, ios->vdd);
+@@ -1173,13 +1175,17 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ case MMC_POWER_UP:
+ /* Cannot touch dsor yet, just power up MMC */
+ mmc_omap_set_power(slot, 1, ios->vdd);
++ slot->power_mode = ios->power_mode;
+ goto exit;
+ case MMC_POWER_ON:
+ mmc_omap_fclk_enable(host, 1);
+ clk_enabled = 1;
+ dsor |= 1 << 11;
++ if (slot->power_mode != MMC_POWER_ON)
++ init_stream = 1;
+ break;
+ }
++ slot->power_mode = ios->power_mode;
+
+ if (slot->bus_mode != ios->bus_mode) {
+ if (slot->pdata->set_bus_mode != NULL)
+@@ -1195,7 +1201,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ for (i = 0; i < 2; i++)
+ OMAP_MMC_WRITE(host, CON, dsor);
+ slot->saved_con = dsor;
+- if (ios->power_mode == MMC_POWER_ON) {
++ if (init_stream) {
+ /* worst case at 400kHz, 80 cycles makes 200 microsecs */
+ int usecs = 250;
+
+@@ -1233,6 +1239,7 @@ static int mmc_omap_new_slot(struct mmc_omap_host *host, int id)
+ slot->host = host;
+ slot->mmc = mmc;
+ slot->id = id;
++ slot->power_mode = MMC_POWER_UNDEFINED;
+ slot->pdata = &host->pdata->slots[id];
+
+ host->slots[id] = slot;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-011-tracing-Fix-memory-leak-in-set_trigger_filter.patch b/patches.kernel.org/4.4.169-011-tracing-Fix-memory-leak-in-set_trigger_filter.patch
new file mode 100644
index 0000000000..d00d951504
--- /dev/null
+++ b/patches.kernel.org/4.4.169-011-tracing-Fix-memory-leak-in-set_trigger_filter.patch
@@ -0,0 +1,50 @@
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Sun, 9 Dec 2018 21:17:30 -0500
+Subject: [PATCH] tracing: Fix memory leak in set_trigger_filter()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 3cec638b3d793b7cacdec5b8072364b41caeb0e1
+
+commit 3cec638b3d793b7cacdec5b8072364b41caeb0e1 upstream.
+
+When create_event_filter() fails in set_trigger_filter(), the filter may
+still be allocated and needs to be freed. The caller expects the
+data->filter to be updated with the new filter, even if the new filter
+failed (we could add an error message by setting set_str parameter of
+create_event_filter(), but that's another update).
+
+But because the error would just exit, filter was left hanging and
+nothing could free it.
+
+Found by kmemleak detector.
+
+Cc: stable@vger.kernel.org
+Fixes: bac5fb97a173a ("tracing: Add and use generic set_trigger_filter() implementation")
+Reviewed-by: Tom Zanussi <tom.zanussi@linux.intel.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/trace/trace_events_trigger.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index b8a894adab2c..8be66a2b0cac 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -727,8 +727,10 @@ static int set_trigger_filter(char *filter_str,
+
+ /* The filter is for the 'trigger' event, not the triggered event */
+ ret = create_event_filter(file->event_call, filter_str, false, &filter);
+- if (ret)
+- goto out;
++ /*
++ * If create_event_filter() fails, filter still needs to be freed.
++ * Which the calling code will do with data->filter.
++ */
+ assign:
+ tmp = rcu_access_pointer(data->filter);
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-012-tracing-Fix-memory-leak-of-instance-function-.patch b/patches.kernel.org/4.4.169-012-tracing-Fix-memory-leak-of-instance-function-.patch
new file mode 100644
index 0000000000..0c60810bb5
--- /dev/null
+++ b/patches.kernel.org/4.4.169-012-tracing-Fix-memory-leak-of-instance-function-.patch
@@ -0,0 +1,46 @@
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Mon, 10 Dec 2018 23:58:01 -0500
+Subject: [PATCH] tracing: Fix memory leak of instance function hash filters
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 2840f84f74035e5a535959d5f17269c69fa6edc5
+
+commit 2840f84f74035e5a535959d5f17269c69fa6edc5 upstream.
+
+The following commands will cause a memory leak:
+
+ # cd /sys/kernel/tracing
+ # mkdir instances/foo
+ # echo schedule > instance/foo/set_ftrace_filter
+ # rmdir instances/foo
+
+The reason is that the hashes that hold the filters to set_ftrace_filter and
+set_ftrace_notrace are not freed if they contain any data on the instance
+and the instance is removed.
+
+Found by kmemleak detector.
+
+Cc: stable@vger.kernel.org
+Fixes: 591dffdade9f ("ftrace: Allow for function tracing instance to filter functions")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/trace/ftrace.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index ac758a53fcea..d90b42b39908 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -4767,6 +4767,7 @@ void ftrace_destroy_filter_files(struct ftrace_ops *ops)
+ if (ops->flags & FTRACE_OPS_FL_ENABLED)
+ ftrace_shutdown(ops, 0);
+ ops->flags |= FTRACE_OPS_FL_DELETED;
++ ftrace_free_filter(ops);
+ mutex_unlock(&ftrace_lock);
+ }
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-013-powerpc-msi-Fix-NULL-pointer-access-in-teardo.patch b/patches.kernel.org/4.4.169-013-powerpc-msi-Fix-NULL-pointer-access-in-teardo.patch
new file mode 100644
index 0000000000..b564d3f77a
--- /dev/null
+++ b/patches.kernel.org/4.4.169-013-powerpc-msi-Fix-NULL-pointer-access-in-teardo.patch
@@ -0,0 +1,59 @@
+From: Radu Rendec <radu.rendec@gmail.com>
+Date: Tue, 27 Nov 2018 22:20:48 -0500
+Subject: [PATCH] powerpc/msi: Fix NULL pointer access in teardown code
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 78e7b15e17ac175e7eed9e21c6f92d03d3b0a6fa
+
+commit 78e7b15e17ac175e7eed9e21c6f92d03d3b0a6fa upstream.
+
+The arch_teardown_msi_irqs() function assumes that controller ops
+pointers were already checked in arch_setup_msi_irqs(), but this
+assumption is wrong: arch_teardown_msi_irqs() can be called even when
+arch_setup_msi_irqs() returns an error (-ENOSYS).
+
+This can happen in the following scenario:
+ - msi_capability_init() calls pci_msi_setup_msi_irqs()
+ - pci_msi_setup_msi_irqs() returns -ENOSYS
+ - msi_capability_init() notices the error and calls free_msi_irqs()
+ - free_msi_irqs() calls pci_msi_teardown_msi_irqs()
+
+This is easier to see when CONFIG_PCI_MSI_IRQ_DOMAIN is not set and
+pci_msi_setup_msi_irqs() and pci_msi_teardown_msi_irqs() are just
+aliases to arch_setup_msi_irqs() and arch_teardown_msi_irqs().
+
+The call to free_msi_irqs() upon pci_msi_setup_msi_irqs() failure
+seems legit, as it does additional cleanup; e.g.
+list_del(&entry->list) and kfree(entry) inside free_msi_irqs() do
+happen (MSI descriptors are allocated before pci_msi_setup_msi_irqs()
+is called and need to be cleaned up if that fails).
+
+Fixes: 6b2fd7efeb88 ("PCI/MSI/PPC: Remove arch_msi_check_device()")
+Cc: stable@vger.kernel.org # v3.18+
+Signed-off-by: Radu Rendec <radu.rendec@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/powerpc/kernel/msi.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/msi.c b/arch/powerpc/kernel/msi.c
+index dab616a33b8d..f2197654be07 100644
+--- a/arch/powerpc/kernel/msi.c
++++ b/arch/powerpc/kernel/msi.c
+@@ -34,5 +34,10 @@ void arch_teardown_msi_irqs(struct pci_dev *dev)
+ {
+ struct pci_controller *phb = pci_bus_to_host(dev->bus);
+
+- phb->controller_ops.teardown_msi_irqs(dev);
++ /*
++ * We can be called even when arch_setup_msi_irqs() returns -ENOSYS,
++ * so check the pointer again.
++ */
++ if (phb->controller_ops.teardown_msi_irqs)
++ phb->controller_ops.teardown_msi_irqs(dev);
+ }
+--
+2.20.1
+
diff --git a/patches.fixes/0001-Revert-drm-rockchip-Allow-driver-to-be-shutdown-on-r.patch b/patches.kernel.org/4.4.169-014-Revert-drm-rockchip-Allow-driver-to-be-shutdo.patch
index 1942091540..efac3d4b2f 100644
--- a/patches.fixes/0001-Revert-drm-rockchip-Allow-driver-to-be-shutdown-on-r.patch
+++ b/patches.kernel.org/4.4.169-014-Revert-drm-rockchip-Allow-driver-to-be-shutdo.patch
@@ -1,10 +1,12 @@
-From 63238173b2faf3d6b85a416f1c69af6c7be2413f Mon Sep 17 00:00:00 2001
From: Brian Norris <briannorris@chromium.org>
Date: Wed, 5 Dec 2018 10:16:57 -0800
-Subject: Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"
+Subject: [PATCH] Revert "drm/rockchip: Allow driver to be shutdown on
+ reboot/kexec"
+Patch-mainline: 4.4.169
+References: bnc#1012382 bsc#1106929
Git-commit: 63238173b2faf3d6b85a416f1c69af6c7be2413f
-Patch-mainline: v4.20-rc7
-References: bsc#1106929
+
+commit 63238173b2faf3d6b85a416f1c69af6c7be2413f upstream.
This reverts commit 7f3ef5dedb146e3d5063b6845781ad1bb59b92b5.
@@ -60,16 +62,17 @@ Cc: stable@vger.kernel.org
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20181205181657.177703-1-briannorris@chromium.org
-Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
-index 941f35233b1f..5864cb452c5c 100644
+index d1f3be78c649..f22e1e1ee64a 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
-@@ -448,11 +448,6 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev)
+@@ -547,11 +547,6 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev)
return 0;
}
@@ -81,7 +84,7 @@ index 941f35233b1f..5864cb452c5c 100644
static const struct of_device_id rockchip_drm_dt_ids[] = {
{ .compatible = "rockchip,display-subsystem", },
{ /* sentinel */ },
-@@ -462,7 +457,6 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids);
+@@ -561,7 +556,6 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids);
static struct platform_driver rockchip_drm_platform_driver = {
.probe = rockchip_drm_platform_probe,
.remove = rockchip_drm_platform_remove,
diff --git a/patches.fixes/0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch b/patches.kernel.org/4.4.169-015-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_con.patch
index 1f326fd8e4..a46c326baf 100644
--- a/patches.fixes/0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch
+++ b/patches.kernel.org/4.4.169-015-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_con.patch
@@ -1,10 +1,11 @@
-From e8ad4f9a609fb14bbd3d32602145e569e489a418 Mon Sep 17 00:00:00 2001
From: Yunlei He <heyunlei@huawei.com>
Date: Thu, 1 Jun 2017 16:43:51 +0800
Subject: [PATCH] f2fs: fix a panic caused by NULL flush_cmd_control
+Patch-mainline: 4.4.169
+References: CVE-2017-18241 bnc#1012382 bsc#1086400
Git-commit: d4fdf8ba0e5808ba9ad6b44337783bd9935e0982
-Patch-mainline: v4.13-rc1
-References: bsc#1086400, CVE-2017-18241
+
+commit d4fdf8ba0e5808ba9ad6b44337783bd9935e0982 upstream.
Mount fs with option noflush_merge, boot failed for illegal address
fcc in function f2fs_issue_flush:
@@ -17,16 +18,18 @@ fcc in function f2fs_issue_flush:
Signed-off-by: Yunlei He <heyunlei@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-Acked-by: Nikolay Borisov <nborisov@suse.com>
+[bwh: Backported to 4.9: adjust context]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/f2fs/segment.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
-index 0b00bbadc864..f85d5b3765fc 100644
+index 2bba0c4ef4b7..39ec9da08bb5 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
-@@ -396,6 +396,9 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
+@@ -398,6 +398,9 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
init_waitqueue_head(&fcc->flush_wait_queue);
init_llist_head(&fcc->issue_list);
SM_I(sbi)->cmd_control_info = fcc;
@@ -36,7 +39,7 @@ index 0b00bbadc864..f85d5b3765fc 100644
fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi,
"f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
if (IS_ERR(fcc->f2fs_issue_flush)) {
-@@ -2314,7 +2317,7 @@ int build_segment_manager(struct f2fs_sb_info *sbi)
+@@ -2316,7 +2319,7 @@ int build_segment_manager(struct f2fs_sb_info *sbi)
INIT_LIST_HEAD(&sm_info->sit_entry_set);
@@ -46,5 +49,5 @@ index 0b00bbadc864..f85d5b3765fc 100644
if (err)
return err;
--
-2.7.4
+2.20.1
diff --git a/patches.drivers/mac80211-don-t-WARN-on-bad-WMM-parameters-from-buggy b/patches.kernel.org/4.4.169-016-mac80211-don-t-WARN-on-bad-WMM-parameters-fro.patch
index fc160d475a..3bfba31f84 100644
--- a/patches.drivers/mac80211-don-t-WARN-on-bad-WMM-parameters-from-buggy
+++ b/patches.kernel.org/4.4.169-016-mac80211-don-t-WARN-on-bad-WMM-parameters-fro.patch
@@ -1,10 +1,11 @@
-From c470bdc1aaf36669e04ba65faf1092b2d1c6cabe Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Mon, 26 Mar 2018 16:21:04 +0300
Subject: [PATCH] mac80211: don't WARN on bad WMM parameters from buggy APs
+Patch-mainline: 4.4.169
+References: bnc#1012382 bsc#1031717
Git-commit: c470bdc1aaf36669e04ba65faf1092b2d1c6cabe
-Patch-mainline: v4.17-rc1
-References: bsc#1031717
+
+[ Upstream commit c470bdc1aaf36669e04ba65faf1092b2d1c6cabe ]
Apparently, some APs are buggy enough to send a zeroed
WMM IE. Don't WARN on this since this is not caused by a bug
@@ -21,15 +22,17 @@ https://bugzilla.kernel.org/show_bug.cgi?id=199161
Fixes: f409079bb678 ("mac80211: sanity check CW_min/CW_max towards driver")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
- net/mac80211/mlme.c | 3 ++-
+ net/mac80211/mlme.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index a5e11280f405..51f31e77c19b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
-@@ -1829,7 +1829,8 @@ static bool ieee80211_sta_wmm_params(str
+@@ -1886,7 +1886,8 @@ static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
params[ac].acm = acm;
params[ac].uapsd = uapsd;
@@ -39,3 +42,6 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
sdata_info(sdata,
"AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
params[ac].cw_min, params[ac].cw_max, aci);
+--
+2.20.1
+
diff --git a/patches.drivers/mac80211-Fix-condition-validating-WMM-IE b/patches.kernel.org/4.4.169-017-mac80211-Fix-condition-validating-WMM-IE.patch
index 719c49f0f7..12c2994d96 100644
--- a/patches.drivers/mac80211-Fix-condition-validating-WMM-IE
+++ b/patches.kernel.org/4.4.169-017-mac80211-Fix-condition-validating-WMM-IE.patch
@@ -1,10 +1,11 @@
-From 911a26484c33e10de6237228ca1d7293548e9f49 Mon Sep 17 00:00:00 2001
From: Ilan Peer <ilan.peer@intel.com>
Date: Tue, 3 Apr 2018 11:35:22 +0300
Subject: [PATCH] mac80211: Fix condition validating WMM IE
+Patch-mainline: 4.4.169
+References: bnc#1012382 bsc#1099732 bsc#1099810
Git-commit: 911a26484c33e10de6237228ca1d7293548e9f49
-Patch-mainline: v4.17-rc5
-References: bsc#1099810,bsc#1099732
+
+[ Upstream commit 911a26484c33e10de6237228ca1d7293548e9f49 ]
Commit c470bdc1aaf3 ("mac80211: don't WARN on bad WMM parameters from
buggy APs") handled cases where an AP reports a zeroed WMM
@@ -16,15 +17,17 @@ Fixes: c470bdc1aaf3 ("mac80211: don't WARN on bad WMM parameters from buggy APs"
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
- net/mac80211/mlme.c | 2 +-
+ net/mac80211/mlme.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 51f31e77c19b..ed4fef32b394 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
-@@ -1829,7 +1829,7 @@ static bool ieee80211_sta_wmm_params(str
+@@ -1886,7 +1886,7 @@ static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
params[ac].acm = acm;
params[ac].uapsd = uapsd;
@@ -33,3 +36,6 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
params[ac].cw_min > params[ac].cw_max) {
sdata_info(sdata,
"AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-018-mac80211_hwsim-fix-module-init-error-paths-fo.patch b/patches.kernel.org/4.4.169-018-mac80211_hwsim-fix-module-init-error-paths-fo.patch
new file mode 100644
index 0000000000..df7f13a275
--- /dev/null
+++ b/patches.kernel.org/4.4.169-018-mac80211_hwsim-fix-module-init-error-paths-fo.patch
@@ -0,0 +1,62 @@
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Fri, 5 Oct 2018 23:22:06 +0300
+Subject: [PATCH] mac80211_hwsim: fix module init error paths for netlink
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 05cc09de4c017663a217630682041066f2f9a5cd
+
+[ Upstream commit 05cc09de4c017663a217630682041066f2f9a5cd ]
+
+There is no unregister netlink notifier and family on error paths
+in init_mac80211_hwsim(). Also there is an error path where
+hwsim_class is not destroyed.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Fixes: 62759361eb49 ("mac80211-hwsim: Provide multicast event for HWSIM_CMD_NEW_RADIO")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/wireless/mac80211_hwsim.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index ab480ea6d95a..0d1abcfec003 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3195,16 +3195,16 @@ static int __init init_mac80211_hwsim(void)
+ if (err)
+ return err;
+
++ err = hwsim_init_netlink();
++ if (err)
++ goto out_unregister_driver;
++
+ hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
+ if (IS_ERR(hwsim_class)) {
+ err = PTR_ERR(hwsim_class);
+- goto out_unregister_driver;
++ goto out_exit_netlink;
+ }
+
+- err = hwsim_init_netlink();
+- if (err < 0)
+- goto out_unregister_driver;
+-
+ for (i = 0; i < radios; i++) {
+ struct hwsim_new_radio_params param = { 0 };
+
+@@ -3310,6 +3310,8 @@ static int __init init_mac80211_hwsim(void)
+ free_netdev(hwsim_mon);
+ out_free_radios:
+ mac80211_hwsim_free();
++out_exit_netlink:
++ hwsim_exit_netlink();
+ out_unregister_driver:
+ platform_driver_unregister(&mac80211_hwsim_driver);
+ return err;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-019-scsi-libiscsi-Fix-NULL-pointer-dereference-in.patch b/patches.kernel.org/4.4.169-019-scsi-libiscsi-Fix-NULL-pointer-dereference-in.patch
new file mode 100644
index 0000000000..e3225d3891
--- /dev/null
+++ b/patches.kernel.org/4.4.169-019-scsi-libiscsi-Fix-NULL-pointer-dereference-in.patch
@@ -0,0 +1,42 @@
+From: Fred Herard <fred.herard@oracle.com>
+Date: Tue, 20 Nov 2018 20:22:45 -0500
+Subject: [PATCH] scsi: libiscsi: Fix NULL pointer dereference in
+ iscsi_eh_session_reset
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 5db6dd14b31397e8cccaaddab2ff44ebec1acf25
+
+[ Upstream commit 5db6dd14b31397e8cccaaddab2ff44ebec1acf25 ]
+
+This commit addresses NULL pointer dereference in iscsi_eh_session_reset.
+Reference should not be made to session->leadconn when session->state is
+set to ISCSI_STATE_TERMINATE.
+
+Signed-off-by: Fred Herard <fred.herard@oracle.com>
+Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/scsi/libiscsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index a74f8fbefd33..009a2ef829d6 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -2416,8 +2416,8 @@ int iscsi_eh_session_reset(struct scsi_cmnd *sc)
+ failed:
+ ISCSI_DBG_EH(session,
+ "failing session reset: Could not log back into "
+- "%s, %s [age %d]\n", session->targetname,
+- conn->persistent_address, session->age);
++ "%s [age %d]\n", session->targetname,
++ session->age);
+ spin_unlock_bh(&session->frwd_lock);
+ mutex_unlock(&session->eh_mutex);
+ return FAILED;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-020-scsi-vmw_pscsi-Rearrange-code-to-avoid-multip.patch b/patches.kernel.org/4.4.169-020-scsi-vmw_pscsi-Rearrange-code-to-avoid-multip.patch
new file mode 100644
index 0000000000..20f219c055
--- /dev/null
+++ b/patches.kernel.org/4.4.169-020-scsi-vmw_pscsi-Rearrange-code-to-avoid-multip.patch
@@ -0,0 +1,58 @@
+From: Cathy Avery <cavery@redhat.com>
+Date: Tue, 27 Nov 2018 14:28:53 -0500
+Subject: [PATCH] scsi: vmw_pscsi: Rearrange code to avoid multiple calls to
+ free_irq during unload
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 02f425f811cefcc4d325d7a72272651e622dc97e
+
+[ Upstream commit 02f425f811cefcc4d325d7a72272651e622dc97e ]
+
+Currently pvscsi_remove calls free_irq more than once as
+pvscsi_release_resources and __pvscsi_shutdown both call
+pvscsi_shutdown_intr. This results in a 'Trying to free already-free IRQ'
+warning and stack trace. To solve the problem pvscsi_shutdown_intr has been
+moved out of pvscsi_release_resources.
+
+Signed-off-by: Cathy Avery <cavery@redhat.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/scsi/vmw_pvscsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
+index 0de2f9069e23..23081ed8f1e3 100644
+--- a/drivers/scsi/vmw_pvscsi.c
++++ b/drivers/scsi/vmw_pvscsi.c
+@@ -1199,8 +1199,6 @@ static void pvscsi_shutdown_intr(struct pvscsi_adapter *adapter)
+
+ static void pvscsi_release_resources(struct pvscsi_adapter *adapter)
+ {
+- pvscsi_shutdown_intr(adapter);
+-
+ if (adapter->workqueue)
+ destroy_workqueue(adapter->workqueue);
+
+@@ -1529,6 +1527,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ out_reset_adapter:
+ ll_adapter_reset(adapter);
+ out_release_resources:
++ pvscsi_shutdown_intr(adapter);
+ pvscsi_release_resources(adapter);
+ scsi_host_put(host);
+ out_disable_device:
+@@ -1537,6 +1536,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ return error;
+
+ out_release_resources_and_disable:
++ pvscsi_shutdown_intr(adapter);
+ pvscsi_release_resources(adapter);
+ goto out_disable_device;
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-021-x86-earlyprintk-efi-Fix-infinite-loop-on-some.patch b/patches.kernel.org/4.4.169-021-x86-earlyprintk-efi-Fix-infinite-loop-on-some.patch
new file mode 100644
index 0000000000..7d5ae6c60a
--- /dev/null
+++ b/patches.kernel.org/4.4.169-021-x86-earlyprintk-efi-Fix-infinite-loop-on-some.patch
@@ -0,0 +1,66 @@
+From: YiFei Zhu <zhuyifei1999@gmail.com>
+Date: Thu, 29 Nov 2018 18:12:30 +0100
+Subject: [PATCH] x86/earlyprintk/efi: Fix infinite loop on some screen widths
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 79c2206d369b87b19ac29cb47601059b6bf5c291
+
+[ Upstream commit 79c2206d369b87b19ac29cb47601059b6bf5c291 ]
+
+An affected screen resolution is 1366 x 768, which width is not
+divisible by 8, the default font width. On such screens, when longer
+lines are earlyprintk'ed, overflow-to-next-line can never trigger,
+due to the left-most x-coordinate of the next character always less
+than the screen width. Earlyprintk will infinite loop in trying to
+print the rest of the string but unable to, due to the line being
+full.
+
+This patch makes the trigger consider the right-most x-coordinate,
+instead of left-most, as the value to compare against the screen
+width threshold.
+
+Signed-off-by: YiFei Zhu <zhuyifei1999@gmail.com>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Arend van Spriel <arend.vanspriel@broadcom.com>
+Cc: Bhupesh Sharma <bhsharma@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Eric Snowberg <eric.snowberg@oracle.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Joe Perches <joe@perches.com>
+Cc: Jon Hunter <jonathanh@nvidia.com>
+Cc: Julien Thierry <julien.thierry@arm.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Matt Fleming <matt@codeblueprint.co.uk>
+Cc: Nathan Chancellor <natechancellor@gmail.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
+Cc: Sedat Dilek <sedat.dilek@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-efi@vger.kernel.org
+Link: http://lkml.kernel.org/r/20181129171230.18699-12-ard.biesheuvel@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/x86/platform/efi/early_printk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/platform/efi/early_printk.c b/arch/x86/platform/efi/early_printk.c
+index 524142117296..82324fc25d5e 100644
+--- a/arch/x86/platform/efi/early_printk.c
++++ b/arch/x86/platform/efi/early_printk.c
+@@ -179,7 +179,7 @@ early_efi_write(struct console *con, const char *str, unsigned int num)
+ num--;
+ }
+
+- if (efi_x >= si->lfb_width) {
++ if (efi_x + font->width > si->lfb_width) {
+ efi_x = 0;
+ efi_y += font->height;
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-022-drm-msm-Grab-a-vblank-reference-when-waiting-.patch b/patches.kernel.org/4.4.169-022-drm-msm-Grab-a-vblank-reference-when-waiting-.patch
new file mode 100644
index 0000000000..0335e1d76c
--- /dev/null
+++ b/patches.kernel.org/4.4.169-022-drm-msm-Grab-a-vblank-reference-when-waiting-.patch
@@ -0,0 +1,42 @@
+From: Sean Paul <seanpaul@chromium.org>
+Date: Wed, 3 Oct 2018 16:22:31 -0400
+Subject: [PATCH] drm/msm: Grab a vblank reference when waiting for commit_done
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 3b712e43e3876b42b38321ecf790a1f5fe59c834
+
+[ Upstream commit 3b712e43e3876b42b38321ecf790a1f5fe59c834 ]
+
+Similar to the atomic helpers, we should enable vblank while we're
+waiting for the commit to finish. DPU needs this, MDP5 seems to work
+fine without it.
+
+Reviewed-by: Abhinav Kumar <abhinavk@codeaurora.org>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/gpu/drm/msm/msm_atomic.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
+index 7eb253bc24df..221eaea651d4 100644
+--- a/drivers/gpu/drm/msm/msm_atomic.c
++++ b/drivers/gpu/drm/msm/msm_atomic.c
+@@ -107,7 +107,12 @@ static void msm_atomic_wait_for_commit_done(struct drm_device *dev,
+ if (old_state->legacy_cursor_update)
+ continue;
+
++ if (drm_crtc_vblank_get(crtc))
++ continue;
++
+ kms->funcs->wait_for_crtc_commit_done(kms, crtc);
++
++ drm_crtc_vblank_put(crtc);
+ }
+ }
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-023-ARC-io.h-Implement-reads-x-writes-x.patch b/patches.kernel.org/4.4.169-023-ARC-io.h-Implement-reads-x-writes-x.patch
new file mode 100644
index 0000000000..38b4daf256
--- /dev/null
+++ b/patches.kernel.org/4.4.169-023-ARC-io.h-Implement-reads-x-writes-x.patch
@@ -0,0 +1,146 @@
+From: Jose Abreu <joabreu@synopsys.com>
+Date: Fri, 30 Nov 2018 09:47:31 +0000
+Subject: [PATCH] ARC: io.h: Implement reads{x}()/writes{x}()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 10d443431dc2bb733cf7add99b453e3fb9047a2e
+
+[ Upstream commit 10d443431dc2bb733cf7add99b453e3fb9047a2e ]
+
+Some ARC CPU's do not support unaligned loads/stores. Currently, generic
+implementation of reads{b/w/l}()/writes{b/w/l}() is being used with ARC.
+This can lead to misfunction of some drivers as generic functions do a
+plain dereference of a pointer that can be unaligned.
+
+Let's use {get/put}_unaligned() helpers instead of plain dereference of
+pointer in order to fix. The helpers allow to get and store data from an
+unaligned address whilst preserving the CPU internal alignment.
+According to [1], the use of these helpers are costly in terms of
+performance so we added an initial check for a buffer already aligned so
+that the usage of the helpers can be avoided, when possible.
+
+[1] Documentation/unaligned-memory-access.txt
+
+Cc: Alexey Brodkin <abrodkin@synopsys.com>
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David Laight <David.Laight@ACULAB.COM>
+Tested-by: Vitor Soares <soares@synopsys.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/arc/include/asm/io.h | 72 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 72 insertions(+)
+
+diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h
+index cb69299a492e..f120d823e8c2 100644
+--- a/arch/arc/include/asm/io.h
++++ b/arch/arc/include/asm/io.h
+@@ -12,6 +12,7 @@
+ #include <linux/types.h>
+ #include <asm/byteorder.h>
+ #include <asm/page.h>
++#include <asm/unaligned.h>
+
+ #ifdef CONFIG_ISA_ARCV2
+ #include <asm/barrier.h>
+@@ -85,6 +86,42 @@ static inline u32 __raw_readl(const volatile void __iomem *addr)
+ return w;
+ }
+
++/*
++ * {read,write}s{b,w,l}() repeatedly access the same IO address in
++ * native endianness in 8-, 16-, 32-bit chunks {into,from} memory,
++ * @count times
++ */
++#define __raw_readsx(t,f) \
++static inline void __raw_reads##f(const volatile void __iomem *addr, \
++ void *ptr, unsigned int count) \
++{ \
++ bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0; \
++ u##t *buf = ptr; \
++ \
++ if (!count) \
++ return; \
++ \
++ /* Some ARC CPU's don't support unaligned accesses */ \
++ if (is_aligned) { \
++ do { \
++ u##t x = __raw_read##f(addr); \
++ *buf++ = x; \
++ } while (--count); \
++ } else { \
++ do { \
++ u##t x = __raw_read##f(addr); \
++ put_unaligned(x, buf++); \
++ } while (--count); \
++ } \
++}
++
++#define __raw_readsb __raw_readsb
++__raw_readsx(8, b)
++#define __raw_readsw __raw_readsw
++__raw_readsx(16, w)
++#define __raw_readsl __raw_readsl
++__raw_readsx(32, l)
++
+ #define __raw_writeb __raw_writeb
+ static inline void __raw_writeb(u8 b, volatile void __iomem *addr)
+ {
+@@ -117,6 +154,35 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
+
+ }
+
++#define __raw_writesx(t,f) \
++static inline void __raw_writes##f(volatile void __iomem *addr, \
++ const void *ptr, unsigned int count) \
++{ \
++ bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0; \
++ const u##t *buf = ptr; \
++ \
++ if (!count) \
++ return; \
++ \
++ /* Some ARC CPU's don't support unaligned accesses */ \
++ if (is_aligned) { \
++ do { \
++ __raw_write##f(*buf++, addr); \
++ } while (--count); \
++ } else { \
++ do { \
++ __raw_write##f(get_unaligned(buf++), addr); \
++ } while (--count); \
++ } \
++}
++
++#define __raw_writesb __raw_writesb
++__raw_writesx(8, b)
++#define __raw_writesw __raw_writesw
++__raw_writesx(16, w)
++#define __raw_writesl __raw_writesl
++__raw_writesx(32, l)
++
+ /*
+ * MMIO can also get buffered/optimized in micro-arch, so barriers needed
+ * Based on ARM model for the typical use case
+@@ -132,10 +198,16 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
+ #define readb(c) ({ u8 __v = readb_relaxed(c); __iormb(); __v; })
+ #define readw(c) ({ u16 __v = readw_relaxed(c); __iormb(); __v; })
+ #define readl(c) ({ u32 __v = readl_relaxed(c); __iormb(); __v; })
++#define readsb(p,d,l) ({ __raw_readsb(p,d,l); __iormb(); })
++#define readsw(p,d,l) ({ __raw_readsw(p,d,l); __iormb(); })
++#define readsl(p,d,l) ({ __raw_readsl(p,d,l); __iormb(); })
+
+ #define writeb(v,c) ({ __iowmb(); writeb_relaxed(v,c); })
+ #define writew(v,c) ({ __iowmb(); writew_relaxed(v,c); })
+ #define writel(v,c) ({ __iowmb(); writel_relaxed(v,c); })
++#define writesb(p,d,l) ({ __iowmb(); __raw_writesb(p,d,l); })
++#define writesw(p,d,l) ({ __iowmb(); __raw_writesw(p,d,l); })
++#define writesl(p,d,l) ({ __iowmb(); __raw_writesl(p,d,l); })
+
+ /*
+ * Relaxed API for drivers which can handle barrier ordering themselves
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-024-bonding-fix-802.3ad-state-sent-to-partner-whe.patch b/patches.kernel.org/4.4.169-024-bonding-fix-802.3ad-state-sent-to-partner-whe.patch
new file mode 100644
index 0000000000..7bdd916bed
--- /dev/null
+++ b/patches.kernel.org/4.4.169-024-bonding-fix-802.3ad-state-sent-to-partner-whe.patch
@@ -0,0 +1,64 @@
+From: Toni Peltonen <peltzi@peltzi.fi>
+Date: Tue, 27 Nov 2018 16:56:57 +0200
+Subject: [PATCH] bonding: fix 802.3ad state sent to partner when unbinding
+ slave
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 3b5b3a3331d141e8f2a7aaae3a94dfa1e61ecbe4
+
+[ Upstream commit 3b5b3a3331d141e8f2a7aaae3a94dfa1e61ecbe4 ]
+
+Previously when unbinding a slave the 802.3ad implementation only told
+partner that the port is not suitable for aggregation by setting the port
+aggregation state from aggregatable to individual. This is not enough. If the
+physical layer still stays up and we only unbinded this port from the bond there
+is nothing in the aggregation status alone to prevent the partner from sending
+traffic towards us. To ensure that the partner doesn't consider this
+port at all anymore we should also disable collecting and distributing to
+signal that this actor is going away. Also clear AD_STATE_SYNCHRONIZATION to
+ensure partner exits collecting + distributing state.
+
+I have tested this behaviour againts Arista EOS switches with mlx5 cards
+(physical link stays up even when interface is down) and simulated
+the same situation virtually Linux <-> Linux with two network namespaces
+running two veth device pairs. In both cases setting aggregation to
+individual doesn't alone prevent traffic from being to sent towards this
+port given that the link stays up in partners end. Partner still keeps
+it's end in collecting + distributing state and continues until timeout is
+reached. In most cases this means we are losing the traffic partner sends
+towards our port while we wait for timeout. This is most visible with slow
+periodic time (LACP rate slow).
+
+Other open source implementations like Open VSwitch and libreswitch, and
+vendor implementations like Arista EOS, seem to disable collecting +
+distributing to when doing similar port disabling/detaching/removing change.
+With this patch kernel implementation would behave the same way and ensure
+partner doesn't consider our actor viable anymore.
+
+Signed-off-by: Toni Peltonen <peltzi@peltzi.fi>
+Signed-off-by: Jay Vosburgh <jay.vosburgh@canonical.com>
+Acked-by: Jonathan Toppins <jtoppins@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/bonding/bond_3ad.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index 940e2ebbdea8..399c627b15cc 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -2011,6 +2011,9 @@ void bond_3ad_unbind_slave(struct slave *slave)
+ aggregator->aggregator_identifier);
+
+ /* Tell the partner that this port is not suitable for aggregation */
++ port->actor_oper_port_state &= ~AD_STATE_SYNCHRONIZATION;
++ port->actor_oper_port_state &= ~AD_STATE_COLLECTING;
++ port->actor_oper_port_state &= ~AD_STATE_DISTRIBUTING;
+ port->actor_oper_port_state &= ~AD_STATE_AGGREGATION;
+ __update_lacpdu_from_port(port);
+ ad_lacpdu_send(port);
+--
+2.20.1
+
diff --git a/patches.fixes/SUNRPC-Fix-a-potential-race-in-xprt_connect.patch b/patches.kernel.org/4.4.169-025-SUNRPC-Fix-a-potential-race-in-xprt_connect.patch
index a7d796ec7a..34a8c8e104 100644
--- a/patches.fixes/SUNRPC-Fix-a-potential-race-in-xprt_connect.patch
+++ b/patches.kernel.org/4.4.169-025-SUNRPC-Fix-a-potential-race-in-xprt_connect.patch
@@ -1,9 +1,11 @@
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Sat, 1 Dec 2018 23:18:00 -0500
Subject: [PATCH] SUNRPC: Fix a potential race in xprt_connect()
+Patch-mainline: 4.4.169
+References: bnc#1012382 git-fixes
Git-commit: 0a9a4304f3614e25d9de9b63502ca633c01c0d70
-Patch-mainline: v4.20
-References: git-fixes
+
+[ Upstream commit 0a9a4304f3614e25d9de9b63502ca633c01c0d70 ]
If an asynchronous connection attempt completes while another task is
in xprt_connect(), then the call to rpc_sleep_on() could end up
@@ -14,12 +16,14 @@ can be no asynchronous connection attempts still in progress.
Fixes: 0b9e79431377d ("SUNRPC: Move the test for XPRT_CONNECTING into...")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
-Acked-by: NeilBrown <neilb@suse.com>
-
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
- net/sunrpc/xprt.c | 11 +++++++++--
+ net/sunrpc/xprt.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index 2e98f4a243e5..112c191b8336 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -758,8 +758,15 @@ void xprt_connect(struct rpc_task *task)
@@ -40,3 +44,6 @@ Acked-by: NeilBrown <neilb@suse.com>
}
xprt_release_write(xprt, task);
}
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-026-sbus-char-add-of_node_put.patch b/patches.kernel.org/4.4.169-026-sbus-char-add-of_node_put.patch
new file mode 100644
index 0000000000..7112dde3af
--- /dev/null
+++ b/patches.kernel.org/4.4.169-026-sbus-char-add-of_node_put.patch
@@ -0,0 +1,34 @@
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Tue, 20 Nov 2018 08:30:40 -0500
+Subject: [PATCH] sbus: char: add of_node_put()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 87d81a23e24f24ebe014891e8bdf3ff8785031e8
+
+[ Upstream commit 87d81a23e24f24ebe014891e8bdf3ff8785031e8 ]
+
+use of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/sbus/char/display7seg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/sbus/char/display7seg.c b/drivers/sbus/char/display7seg.c
+index 33fbe8249fd5..044cffbc45e8 100644
+--- a/drivers/sbus/char/display7seg.c
++++ b/drivers/sbus/char/display7seg.c
+@@ -221,6 +221,7 @@ static int d7s_probe(struct platform_device *op)
+ dev_set_drvdata(&op->dev, p);
+ d7s_device = p;
+ err = 0;
++ of_node_put(opts);
+
+ out:
+ return err;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-027-drivers-sbus-char-add-of_node_put.patch b/patches.kernel.org/4.4.169-027-drivers-sbus-char-add-of_node_put.patch
new file mode 100644
index 0000000000..25ac26b229
--- /dev/null
+++ b/patches.kernel.org/4.4.169-027-drivers-sbus-char-add-of_node_put.patch
@@ -0,0 +1,37 @@
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Tue, 20 Nov 2018 08:38:26 -0500
+Subject: [PATCH] drivers/sbus/char: add of_node_put()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 6bd520ab7cf69486ea81fd3cdfd2d5a390ad1100
+
+[ Upstream commit 6bd520ab7cf69486ea81fd3cdfd2d5a390ad1100 ]
+
+use of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/sbus/char/envctrl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
+index 5609b602c54d..baa9b322520b 100644
+--- a/drivers/sbus/char/envctrl.c
++++ b/drivers/sbus/char/envctrl.c
+@@ -910,8 +910,10 @@ static void envctrl_init_i2c_child(struct device_node *dp,
+ for (len = 0; len < PCF8584_MAX_CHANNELS; ++len) {
+ pchild->mon_type[len] = ENVCTRL_NOMON;
+ }
++ of_node_put(root_node);
+ return;
+ }
++ of_node_put(root_node);
+ }
+
+ /* Get the monitor channels. */
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-028-drivers-tty-add-missing-of_node_put.patch b/patches.kernel.org/4.4.169-028-drivers-tty-add-missing-of_node_put.patch
new file mode 100644
index 0000000000..b52ebce89c
--- /dev/null
+++ b/patches.kernel.org/4.4.169-028-drivers-tty-add-missing-of_node_put.patch
@@ -0,0 +1,36 @@
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Wed, 21 Nov 2018 10:22:54 -0500
+Subject: [PATCH] drivers/tty: add missing of_node_put()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: dac097c4546e4c5b16dd303a1e97c1d319c8ab3e
+
+[ Upstream commit dac097c4546e4c5b16dd303a1e97c1d319c8ab3e ]
+
+of_find_node_by_path() acquires a reference to the node
+returned by it and that reference needs to be dropped by its caller.
+This place is not doing this, so fix it.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/serial/suncore.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tty/serial/suncore.c b/drivers/tty/serial/suncore.c
+index 127472bd6a7c..209f314745ab 100644
+--- a/drivers/tty/serial/suncore.c
++++ b/drivers/tty/serial/suncore.c
+@@ -111,6 +111,7 @@ void sunserial_console_termios(struct console *con, struct device_node *uart_dp)
+ mode = of_get_property(dp, mode_prop, NULL);
+ if (!mode)
+ mode = "9600,8,n,1,-";
++ of_node_put(dp);
+ }
+
+ cflag = CREAD | HUPCL | CLOCAL;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-029-ide-pmac-add-of_node_put.patch b/patches.kernel.org/4.4.169-029-ide-pmac-add-of_node_put.patch
new file mode 100644
index 0000000000..fa67ae716a
--- /dev/null
+++ b/patches.kernel.org/4.4.169-029-ide-pmac-add-of_node_put.patch
@@ -0,0 +1,34 @@
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Tue, 20 Nov 2018 08:02:49 -0500
+Subject: [PATCH] ide: pmac: add of_node_put()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: a51921c0db3fd26c4ed83dc0ec5d32988fa02aa5
+
+[ Upstream commit a51921c0db3fd26c4ed83dc0ec5d32988fa02aa5 ]
+
+use of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/ide/pmac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c
+index 96a345248224..0add5bb3cee8 100644
+--- a/drivers/ide/pmac.c
++++ b/drivers/ide/pmac.c
+@@ -920,6 +920,7 @@ static u8 pmac_ide_cable_detect(ide_hwif_t *hwif)
+ struct device_node *root = of_find_node_by_path("/");
+ const char *model = of_get_property(root, "model", NULL);
+
++ of_node_put(root);
+ /* Get cable type from device-tree. */
+ if (cable && !strncmp(cable, "80-", 3)) {
+ /* Some drives fail to detect 80c cable in PowerBook */
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-030-clk-mmp-Off-by-one-in-mmp_clk_add.patch b/patches.kernel.org/4.4.169-030-clk-mmp-Off-by-one-in-mmp_clk_add.patch
new file mode 100644
index 0000000000..9284018fd9
--- /dev/null
+++ b/patches.kernel.org/4.4.169-030-clk-mmp-Off-by-one-in-mmp_clk_add.patch
@@ -0,0 +1,40 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 3 Dec 2018 17:51:43 +0300
+Subject: [PATCH] clk: mmp: Off by one in mmp_clk_add()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 2e85c57493e391b93445c1e0d530b36b95becc64
+
+[ Upstream commit 2e85c57493e391b93445c1e0d530b36b95becc64 ]
+
+The > comparison should be >= or we write one element beyond the end of
+the unit->clk_table[] array.
+
+(The unit->clk_table[] array is allocated in the mmp_clk_init() function
+and it has unit->nr_clks elements).
+
+Fixes: 4661fda10f8b ("clk: mmp: add basic support functions for DT support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/clk/mmp/clk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mmp/clk.c b/drivers/clk/mmp/clk.c
+index 61893fe73251..18b6c9b55b95 100644
+--- a/drivers/clk/mmp/clk.c
++++ b/drivers/clk/mmp/clk.c
+@@ -182,7 +182,7 @@ void mmp_clk_add(struct mmp_clk_unit *unit, unsigned int id,
+ pr_err("CLK %d has invalid pointer %p\n", id, clk);
+ return;
+ }
+- if (id > unit->nr_clks) {
++ if (id >= unit->nr_clks) {
+ pr_err("CLK %d is invalid\n", id);
+ return;
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-031-Input-omap-keypad-fix-keyboard-debounce-confi.patch b/patches.kernel.org/4.4.169-031-Input-omap-keypad-fix-keyboard-debounce-confi.patch
new file mode 100644
index 0000000000..526b19e24a
--- /dev/null
+++ b/patches.kernel.org/4.4.169-031-Input-omap-keypad-fix-keyboard-debounce-confi.patch
@@ -0,0 +1,70 @@
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 3 Dec 2018 11:24:30 -0800
+Subject: [PATCH] Input: omap-keypad - fix keyboard debounce configuration
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 6c3516fed7b61a3527459ccfa67fab130d910610
+
+[ Upstream commit 6c3516fed7b61a3527459ccfa67fab130d910610 ]
+
+I noticed that the Android v3.0.8 kernel on droid4 is using different
+keypad values from the mainline kernel and does not have issues with
+keys occasionally being stuck until pressed again. Turns out there was
+an earlier patch posted to fix this as "Input: omap-keypad: errata i689:
+Correct debounce time", but it was never reposted to fix use macros
+for timing calculations.
+
+This updated version is using macros, and also fixes the use of the
+input clock rate to use 32768KiHz instead of 32000KiHz. And we want to
+use the known good Android kernel values of 3 and 6 instead of 2 and 6
+in the earlier patch.
+
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/input/keyboard/omap4-keypad.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index 6639b2b8528a..f78c464899db 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -60,8 +60,18 @@
+
+ /* OMAP4 values */
+ #define OMAP4_VAL_IRQDISABLE 0x0
+-#define OMAP4_VAL_DEBOUNCINGTIME 0x7
+-#define OMAP4_VAL_PVT 0x7
++
++/*
++ * Errata i689: If a key is released for a time shorter than debounce time,
++ * the keyboard will idle and never detect the key release. The workaround
++ * is to use at least a 12ms debounce time. See omap5432 TRM chapter
++ * "26.4.6.2 Keyboard Controller Timer" for more information.
++ */
++#define OMAP4_KEYPAD_PTV_DIV_128 0x6
++#define OMAP4_KEYPAD_DEBOUNCINGTIME_MS(dbms, ptv) \
++ ((((dbms) * 1000) / ((1 << ((ptv) + 1)) * (1000000 / 32768))) - 1)
++#define OMAP4_VAL_DEBOUNCINGTIME_16MS \
++ OMAP4_KEYPAD_DEBOUNCINGTIME_MS(16, OMAP4_KEYPAD_PTV_DIV_128)
+
+ enum {
+ KBD_REVISION_OMAP4 = 0,
+@@ -181,9 +191,9 @@ static int omap4_keypad_open(struct input_dev *input)
+
+ kbd_writel(keypad_data, OMAP4_KBD_CTRL,
+ OMAP4_DEF_CTRL_NOSOFTMODE |
+- (OMAP4_VAL_PVT << OMAP4_DEF_CTRL_PTV_SHIFT));
++ (OMAP4_KEYPAD_PTV_DIV_128 << OMAP4_DEF_CTRL_PTV_SHIFT));
+ kbd_writel(keypad_data, OMAP4_KBD_DEBOUNCINGTIME,
+- OMAP4_VAL_DEBOUNCINGTIME);
++ OMAP4_VAL_DEBOUNCINGTIME_16MS);
+ /* clear pending interrupts */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+ kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-032-libata-whitelist-all-SAMSUNG-MZ7KM-solid-stat.patch b/patches.kernel.org/4.4.169-032-libata-whitelist-all-SAMSUNG-MZ7KM-solid-stat.patch
new file mode 100644
index 0000000000..b1ec401811
--- /dev/null
+++ b/patches.kernel.org/4.4.169-032-libata-whitelist-all-SAMSUNG-MZ7KM-solid-stat.patch
@@ -0,0 +1,37 @@
+From: Juha-Matti Tilli <juha-matti.tilli@iki.fi>
+Date: Sun, 2 Dec 2018 12:47:08 +0200
+Subject: [PATCH] libata: whitelist all SAMSUNG MZ7KM* solid-state disks
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: fd6f32f78645db32b6b95a42e45da2ddd6de0e67
+
+[ Upstream commit fd6f32f78645db32b6b95a42e45da2ddd6de0e67 ]
+
+These devices support read zero after trim (RZAT), as they advertise to
+the OS. However, the OS doesn't believe the SSDs unless they are
+explicitly whitelisted.
+
+Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Juha-Matti Tilli <juha-matti.tilli@iki.fi>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/ata/libata-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index ba514fa733de..d543172b20b3 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4297,6 +4297,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "SSD*INTEL*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Samsung*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "SAMSUNG*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "SAMSUNG*MZ7KM*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "ST[1248][0248]0[FH]*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+
+ /*
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-033-mv88e6060-disable-hardware-level-MAC-learning.patch b/patches.kernel.org/4.4.169-033-mv88e6060-disable-hardware-level-MAC-learning.patch
new file mode 100644
index 0000000000..6340709552
--- /dev/null
+++ b/patches.kernel.org/4.4.169-033-mv88e6060-disable-hardware-level-MAC-learning.patch
@@ -0,0 +1,55 @@
+From: Anderson Luiz Alves <alacn1@gmail.com>
+Date: Fri, 30 Nov 2018 21:58:36 -0200
+Subject: [PATCH] mv88e6060: disable hardware level MAC learning
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: a74515604a7b171f2702bdcbd1e231225fb456d0
+
+[ Upstream commit a74515604a7b171f2702bdcbd1e231225fb456d0 ]
+
+Disable hardware level MAC learning because it breaks station roaming.
+When enabled it drops all frames that arrive from a MAC address
+that is on a different port at learning table.
+
+Signed-off-by: Anderson Luiz Alves <alacn1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/dsa/mv88e6060.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6060.c b/drivers/net/dsa/mv88e6060.c
+index 0527f485c3dc..973fcd442aea 100644
+--- a/drivers/net/dsa/mv88e6060.c
++++ b/drivers/net/dsa/mv88e6060.c
+@@ -98,8 +98,7 @@ static int mv88e6060_switch_reset(struct dsa_switch *ds)
+ /* Reset the switch. */
+ REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+ GLOBAL_ATU_CONTROL_SWRESET |
+- GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
++ GLOBAL_ATU_CONTROL_LEARNDIS);
+
+ /* Wait up to one second for reset to complete. */
+ timeout = jiffies + 1 * HZ;
+@@ -124,13 +123,10 @@ static int mv88e6060_setup_global(struct dsa_switch *ds)
+ */
+ REG_WRITE(REG_GLOBAL, GLOBAL_CONTROL, GLOBAL_CONTROL_MAX_FRAME_1536);
+
+- /* Enable automatic address learning, set the address
+- * database size to 1024 entries, and set the default aging
+- * time to 5 minutes.
++ /* Disable automatic address learning.
+ */
+ REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+- GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
++ GLOBAL_ATU_CONTROL_LEARNDIS);
+
+ return 0;
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-034-ARM-8814-1-mm-improve-fix-ARM-v7_dma_inv_rang.patch b/patches.kernel.org/4.4.169-034-ARM-8814-1-mm-improve-fix-ARM-v7_dma_inv_rang.patch
new file mode 100644
index 0000000000..4b2df5d223
--- /dev/null
+++ b/patches.kernel.org/4.4.169-034-ARM-8814-1-mm-improve-fix-ARM-v7_dma_inv_rang.patch
@@ -0,0 +1,77 @@
+From: Chris Cole <chris@sageembedded.com>
+Date: Fri, 23 Nov 2018 12:20:45 +0100
+Subject: [PATCH] ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned
+ address handling
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: a1208f6a822ac29933e772ef1f637c5d67838da9
+
+[ Upstream commit a1208f6a822ac29933e772ef1f637c5d67838da9 ]
+
+This patch addresses possible memory corruption when
+v7_dma_inv_range(start_address, end_address) address parameters are not
+aligned to whole cache lines. This function issues "invalidate" cache
+management operations to all cache lines from start_address (inclusive)
+to end_address (exclusive). When start_address and/or end_address are
+not aligned, the start and/or end cache lines are first issued "clean &
+invalidate" operation. The assumption is this is done to ensure that any
+dirty data addresses outside the address range (but part of the first or
+last cache lines) are cleaned/flushed so that data is not lost, which
+could happen if just an invalidate is issued.
+
+The problem is that these first/last partial cache lines are issued
+"clean & invalidate" and then "invalidate". This second "invalidate" is
+not required and worse can cause "lost" writes to addresses outside the
+address range but part of the cache line. If another component writes to
+its part of the cache line between the "clean & invalidate" and
+"invalidate" operations, the write can get lost. This fix is to remove
+the extra "invalidate" operation when unaligned addressed are used.
+
+A kernel module is available that has a stress test to reproduce the
+issue and a unit test of the updated v7_dma_inv_range(). It can be
+downloaded from
+http://ftp.sageembedded.com/outgoing/linux/cache-test-20181107.tgz.
+
+v7_dma_inv_range() is call by dmac_[un]map_area(addr, len, direction)
+when the direction is DMA_FROM_DEVICE. One can (I believe) successfully
+argue that DMA from a device to main memory should use buffers aligned
+to cache line size, because the "clean & invalidate" might overwrite
+data that the device just wrote using DMA. But if a driver does use
+unaligned buffers, at least this fix will prevent memory corruption
+outside the buffer.
+
+Signed-off-by: Chris Cole <chris@sageembedded.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/arm/mm/cache-v7.S | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
+index a134d8a13d00..11d699af30ed 100644
+--- a/arch/arm/mm/cache-v7.S
++++ b/arch/arm/mm/cache-v7.S
+@@ -359,14 +359,16 @@ v7_dma_inv_range:
+ ALT_UP(W(nop))
+ #endif
+ mcrne p15, 0, r0, c7, c14, 1 @ clean & invalidate D / U line
++ addne r0, r0, r2
+
+ tst r1, r3
+ bic r1, r1, r3
+ mcrne p15, 0, r1, c7, c14, 1 @ clean & invalidate D / U line
+-1:
+- mcr p15, 0, r0, c7, c6, 1 @ invalidate D / U line
+- add r0, r0, r2
+ cmp r0, r1
++1:
++ mcrlo p15, 0, r0, c7, c6, 1 @ invalidate D / U line
++ addlo r0, r0, r2
++ cmplo r0, r1
+ blo 1b
+ dsb st
+ ret lr
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-035-cifs-In-Kconfig-CONFIG_CIFS_POSIX-needs-depen.patch b/patches.kernel.org/4.4.169-035-cifs-In-Kconfig-CONFIG_CIFS_POSIX-needs-depen.patch
new file mode 100644
index 0000000000..f7523465d1
--- /dev/null
+++ b/patches.kernel.org/4.4.169-035-cifs-In-Kconfig-CONFIG_CIFS_POSIX-needs-depen.patch
@@ -0,0 +1,38 @@
+From: Steve French <stfrench@microsoft.com>
+Date: Sat, 3 Nov 2018 15:02:44 -0500
+Subject: [PATCH] cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy
+ (insecure cifs)
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 6e785302dad32228819d8066e5376acd15d0e6ba
+
+[ Upstream commit 6e785302dad32228819d8066e5376acd15d0e6ba ]
+
+Missing a dependency. Shouldn't show cifs posix extensions
+in Kconfig if CONFIG_CIFS_ALLOW_INSECURE_DIALECTS (ie SMB1
+protocol) is disabled.
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/cifs/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
+index e7b478b49985..8bef27b8f85d 100644
+--- a/fs/cifs/Kconfig
++++ b/fs/cifs/Kconfig
+@@ -111,7 +111,7 @@ config CIFS_XATTR
+
+ config CIFS_POSIX
+ bool "CIFS POSIX Extensions"
+- depends on CIFS_XATTR
++ depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY && CIFS_XATTR
+ help
+ Enabling this option will cause the cifs client to attempt to
+ negotiate a newer dialect with servers, such as Samba 3.0.5
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-036-i2c-axxia-properly-handle-master-timeout.patch b/patches.kernel.org/4.4.169-036-i2c-axxia-properly-handle-master-timeout.patch
new file mode 100644
index 0000000000..761038d83e
--- /dev/null
+++ b/patches.kernel.org/4.4.169-036-i2c-axxia-properly-handle-master-timeout.patch
@@ -0,0 +1,176 @@
+From: "Adamski, Krzysztof (Nokia - PL/Wroclaw)" <krzysztof.adamski@nokia.com>
+Date: Fri, 16 Nov 2018 13:24:41 +0000
+Subject: [PATCH] i2c: axxia: properly handle master timeout
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 6c7f25cae54b840302e4f1b371dbf318fbf09ab2
+
+[ Upstream commit 6c7f25cae54b840302e4f1b371dbf318fbf09ab2 ]
+
+According to Intel (R) Axxia TM Lionfish Communication Processor
+Peripheral Subsystem Hardware Reference Manual, the AXXIA I2C module
+have a programmable Master Wait Timer, which among others, checks the
+time between commands send in manual mode. When a timeout (25ms) passes,
+TSS bit is set in Master Interrupt Status register and a Stop command is
+issued by the hardware.
+
+The axxia_i2c_xfer(), does not properly handle this situation, however.
+For each message a separate axxia_i2c_xfer_msg() is called and this
+function incorrectly assumes that any interrupt might happen only when
+waiting for completion. This is mostly correct but there is one
+exception - a master timeout can trigger if enough time has passed
+between individual transfers. It will, by definition, happen between
+transfers when the interrupts are disabled by the code. If that happens,
+the hardware issues Stop command.
+
+The interrupt indicating timeout will not be triggered as soon as we
+enable them since the Master Interrupt Status is cleared when master
+mode is entered again (which happens before enabling irqs) meaning this
+error is lost and the transfer is continued even though the Stop was
+issued on the bus. The subsequent operations completes without error but
+a bogus value (0xFF in case of read) is read as the client device is
+confused because aborted transfer. No error is returned from
+master_xfer() making caller believe that a valid value was read.
+
+To fix the problem, the TSS bit (indicating timeout) in Master Interrupt
+Status register is checked before each transfer. If it is set, there was
+a timeout before this transfer and (as described above) the hardware
+already issued Stop command so the transaction should be aborted thus
+-ETIMEOUT is returned from the master_xfer() callback. In order to be
+sure no timeout was issued we can't just read the status just before
+starting new transaction as there will always be a small window of time
+(few CPU cycles at best) where this might still happen. For this reason
+we have to temporally disable the timer before checking for TSS bit.
+Disabling it will, however, clear the TSS bit so in order to preserve
+that information, we have to read it in ISR so we have to ensure that
+the TSS interrupt is not masked between transfers of one transaction.
+There is no need to call bus recovery or controller reinitialization if
+that happens so it's skipped.
+
+Signed-off-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/i2c/busses/i2c-axxia.c | 40 ++++++++++++++++++++++++----------
+ 1 file changed, 29 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-axxia.c b/drivers/i2c/busses/i2c-axxia.c
+index c335cc7852f9..9c9fd2e87a4b 100644
+--- a/drivers/i2c/busses/i2c-axxia.c
++++ b/drivers/i2c/busses/i2c-axxia.c
+@@ -74,8 +74,7 @@
+ MST_STATUS_ND)
+ #define MST_STATUS_ERR (MST_STATUS_NAK | \
+ MST_STATUS_AL | \
+- MST_STATUS_IP | \
+- MST_STATUS_TSS)
++ MST_STATUS_IP)
+ #define MST_TX_BYTES_XFRD 0x50
+ #define MST_RX_BYTES_XFRD 0x54
+ #define SCL_HIGH_PERIOD 0x80
+@@ -241,7 +240,7 @@ static int axxia_i2c_empty_rx_fifo(struct axxia_i2c_dev *idev)
+ */
+ if (c <= 0 || c > I2C_SMBUS_BLOCK_MAX) {
+ idev->msg_err = -EPROTO;
+- i2c_int_disable(idev, ~0);
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
+ complete(&idev->msg_complete);
+ break;
+ }
+@@ -299,14 +298,19 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev)
+
+ if (status & MST_STATUS_SCC) {
+ /* Stop completed */
+- i2c_int_disable(idev, ~0);
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
+ complete(&idev->msg_complete);
+ } else if (status & MST_STATUS_SNS) {
+ /* Transfer done */
+- i2c_int_disable(idev, ~0);
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
+ if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len)
+ axxia_i2c_empty_rx_fifo(idev);
+ complete(&idev->msg_complete);
++ } else if (status & MST_STATUS_TSS) {
++ /* Transfer timeout */
++ idev->msg_err = -ETIMEDOUT;
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
++ complete(&idev->msg_complete);
+ } else if (unlikely(status & MST_STATUS_ERR)) {
+ /* Transfer error */
+ i2c_int_disable(idev, ~0);
+@@ -339,10 +343,10 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+ u32 rx_xfer, tx_xfer;
+ u32 addr_1, addr_2;
+ unsigned long time_left;
++ unsigned int wt_value;
+
+ idev->msg = msg;
+ idev->msg_xfrd = 0;
+- idev->msg_err = 0;
+ reinit_completion(&idev->msg_complete);
+
+ if (i2c_m_ten(msg)) {
+@@ -382,9 +386,18 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+ else if (axxia_i2c_fill_tx_fifo(idev) != 0)
+ int_mask |= MST_STATUS_TFL;
+
++ wt_value = WT_VALUE(readl(idev->base + WAIT_TIMER_CONTROL));
++ /* Disable wait timer temporarly */
++ writel(wt_value, idev->base + WAIT_TIMER_CONTROL);
++ /* Check if timeout error happened */
++ if (idev->msg_err)
++ goto out;
++
+ /* Start manual mode */
+ writel(CMD_MANUAL, idev->base + MST_COMMAND);
+
++ writel(WT_EN | wt_value, idev->base + WAIT_TIMER_CONTROL);
++
+ i2c_int_enable(idev, int_mask);
+
+ time_left = wait_for_completion_timeout(&idev->msg_complete,
+@@ -395,13 +408,15 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+ if (readl(idev->base + MST_COMMAND) & CMD_BUSY)
+ dev_warn(idev->dev, "busy after xfer\n");
+
+- if (time_left == 0)
++ if (time_left == 0) {
+ idev->msg_err = -ETIMEDOUT;
+-
+- if (idev->msg_err == -ETIMEDOUT)
+ i2c_recover_bus(&idev->adapter);
++ axxia_i2c_init(idev);
++ }
+
+- if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO)
++out:
++ if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO &&
++ idev->msg_err != -ETIMEDOUT)
+ axxia_i2c_init(idev);
+
+ return idev->msg_err;
+@@ -409,7 +424,7 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+
+ static int axxia_i2c_stop(struct axxia_i2c_dev *idev)
+ {
+- u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC;
++ u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC | MST_STATUS_TSS;
+ unsigned long time_left;
+
+ reinit_completion(&idev->msg_complete);
+@@ -436,6 +451,9 @@ axxia_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
+ int i;
+ int ret = 0;
+
++ idev->msg_err = 0;
++ i2c_int_enable(idev, MST_STATUS_TSS);
++
+ for (i = 0; ret == 0 && i < num; ++i)
+ ret = axxia_i2c_xfer_msg(idev, &msgs[i]);
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-037-i2c-scmi-Fix-probe-error-on-devices-with-an-e.patch b/patches.kernel.org/4.4.169-037-i2c-scmi-Fix-probe-error-on-devices-with-an-e.patch
new file mode 100644
index 0000000000..a9f81f0940
--- /dev/null
+++ b/patches.kernel.org/4.4.169-037-i2c-scmi-Fix-probe-error-on-devices-with-an-e.patch
@@ -0,0 +1,75 @@
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 21 Nov 2018 10:19:55 +0100
+Subject: [PATCH] i2c: scmi: Fix probe error on devices with an empty SMB0001
+ ACPI device node
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 0544ee4b1ad574aec3b6379af5f5cdee42840971
+
+[ Upstream commit 0544ee4b1ad574aec3b6379af5f5cdee42840971 ]
+
+Some AMD based HP laptops have a SMB0001 ACPI device node which does not
+define any methods.
+
+This leads to the following error in dmesg:
+
+[ 5.222731] cmi: probe of SMB0001:00 failed with error -5
+
+This commit makes acpi_smbus_cmi_add() return -ENODEV instead in this case
+silencing the error. In case of a failure of the i2c_add_adapter() call
+this commit now propagates the error from that call instead of -EIO.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/i2c/busses/i2c-scmi.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c
+index efefcfa24a4c..d2178f701b41 100644
+--- a/drivers/i2c/busses/i2c-scmi.c
++++ b/drivers/i2c/busses/i2c-scmi.c
+@@ -364,6 +364,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ {
+ struct acpi_smbus_cmi *smbus_cmi;
+ const struct acpi_device_id *id;
++ int ret;
+
+ smbus_cmi = kzalloc(sizeof(struct acpi_smbus_cmi), GFP_KERNEL);
+ if (!smbus_cmi)
+@@ -385,8 +386,10 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ acpi_walk_namespace(ACPI_TYPE_METHOD, smbus_cmi->handle, 1,
+ acpi_smbus_cmi_query_methods, NULL, smbus_cmi, NULL);
+
+- if (smbus_cmi->cap_info == 0)
++ if (smbus_cmi->cap_info == 0) {
++ ret = -ENODEV;
+ goto err;
++ }
+
+ snprintf(smbus_cmi->adapter.name, sizeof(smbus_cmi->adapter.name),
+ "SMBus CMI adapter %s",
+@@ -397,7 +400,8 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ smbus_cmi->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
+ smbus_cmi->adapter.dev.parent = &device->dev;
+
+- if (i2c_add_adapter(&smbus_cmi->adapter)) {
++ ret = i2c_add_adapter(&smbus_cmi->adapter);
++ if (ret) {
+ dev_err(&device->dev, "Couldn't register adapter!\n");
+ goto err;
+ }
+@@ -407,7 +411,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ err:
+ kfree(smbus_cmi);
+ device->driver_data = NULL;
+- return -EIO;
++ return ret;
+ }
+
+ static int acpi_smbus_cmi_remove(struct acpi_device *device)
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-038-rtc-snvs-add-a-missing-write-sync.patch b/patches.kernel.org/4.4.169-038-rtc-snvs-add-a-missing-write-sync.patch
new file mode 100644
index 0000000000..58021e83ee
--- /dev/null
+++ b/patches.kernel.org/4.4.169-038-rtc-snvs-add-a-missing-write-sync.patch
@@ -0,0 +1,36 @@
+From: Guy Shapiro <guy.shapiro@mobi-wize.com>
+Date: Sun, 29 Jan 2017 11:57:19 +0200
+Subject: [PATCH] rtc: snvs: add a missing write sync
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 7bb633b1a9812a6b9f3e49d0cf17f60a633914e5
+
+[ Upstream commit 7bb633b1a9812a6b9f3e49d0cf17f60a633914e5 ]
+
+The clear of the LPTA_EN flag should be synced before writing to the
+alarm register. Omitting this synchronization creates a race when
+trying to change existing alarm.
+
+Signed-off-by: Guy Shapiro <guy.shapiro@mobi-wize.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/rtc/rtc-snvs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c
+index a161fbf6f172..af131682dbc9 100644
+--- a/drivers/rtc/rtc-snvs.c
++++ b/drivers/rtc/rtc-snvs.c
+@@ -187,6 +187,7 @@ static int snvs_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ rtc_tm_to_time(alrm_tm, &time);
+
+ regmap_update_bits(data->regmap, data->offset + SNVS_LPCR, SNVS_LPCR_LPTA_EN, 0);
++ rtc_write_sync_lp(data);
+ regmap_write(data->regmap, data->offset + SNVS_LPTAR, time);
+
+ /* Clear alarm interrupt status bit */
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-039-rtc-snvs-Add-timeouts-to-avoid-kernel-lockups.patch b/patches.kernel.org/4.4.169-039-rtc-snvs-Add-timeouts-to-avoid-kernel-lockups.patch
new file mode 100644
index 0000000000..da68c4d213
--- /dev/null
+++ b/patches.kernel.org/4.4.169-039-rtc-snvs-Add-timeouts-to-avoid-kernel-lockups.patch
@@ -0,0 +1,199 @@
+From: Trent Piepho <tpiepho@impinj.com>
+Date: Wed, 16 May 2018 16:45:51 -0700
+Subject: [PATCH] rtc: snvs: Add timeouts to avoid kernel lockups
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: cd7f3a249dbed2858e6c2f30e5be7f1f7a709ee2
+
+[ Upstream commit cd7f3a249dbed2858e6c2f30e5be7f1f7a709ee2 ]
+
+In order to read correctly from asynchronously updated RTC registers,
+it's necessary to read repeatedly until their values do not change from
+read to read. It's also necessary to wait for three RTC clock ticks for
+certain operations. There are no timeouts in this code and these
+operations could possibly loop forever.
+
+To avoid kernel hangs, put in timeouts.
+
+The iMX7d can be configured to stop the SRTC on a tamper event, which
+will lockup the kernel inside this driver as described above.
+
+These hangs can happen when running under qemu, which doesn't emulate
+the SNVS RTC, though currently the driver will refuse to load on qemu
+due to a timeout in the driver probe method.
+
+It could also happen if the SRTC block where somehow placed into reset
+or the slow speed clock that drives the SRTC counter (but not the CPU)
+were to stop.
+
+The symptoms on a two core iMX7d are a work queue hang on
+rtc_timer_do_work(), which eventually blocks a systemd fsnotify
+operation that triggers a work queue flush, causing systemd to hang and
+thus causing all services that should be started by systemd, like a
+console getty, to fail to start or stop.
+
+Also optimize the wait code to wait less. It only needs to wait for the
+clock to advance three ticks, not to see it change three times.
+
+Cc: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Fabio Estevam <fabio.estevam@nxp.com>
+Cc: Shawn Guo <shawn.guo@linaro.org>
+Cc: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+Signed-off-by: Trent Piepho <tpiepho@impinj.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/rtc/rtc-snvs.c | 105 +++++++++++++++++++++++++++--------------
+ 1 file changed, 70 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c
+index af131682dbc9..63ad5b543f14 100644
+--- a/drivers/rtc/rtc-snvs.c
++++ b/drivers/rtc/rtc-snvs.c
+@@ -47,49 +47,83 @@ struct snvs_rtc_data {
+ struct clk *clk;
+ };
+
++/* Read 64 bit timer register, which could be in inconsistent state */
++static u64 rtc_read_lpsrt(struct snvs_rtc_data *data)
++{
++ u32 msb, lsb;
++
++ regmap_read(data->regmap, data->offset + SNVS_LPSRTCMR, &msb);
++ regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &lsb);
++ return (u64)msb << 32 | lsb;
++}
++
++/* Read the secure real time counter, taking care to deal with the cases of the
++ * counter updating while being read.
++ */
+ static u32 rtc_read_lp_counter(struct snvs_rtc_data *data)
+ {
+ u64 read1, read2;
+- u32 val;
++ unsigned int timeout = 100;
+
++ /* As expected, the registers might update between the read of the LSB
++ * reg and the MSB reg. It's also possible that one register might be
++ * in partially modified state as well.
++ */
++ read1 = rtc_read_lpsrt(data);
+ do {
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCMR, &val);
+- read1 = val;
+- read1 <<= 32;
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &val);
+- read1 |= val;
+-
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCMR, &val);
+- read2 = val;
+- read2 <<= 32;
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &val);
+- read2 |= val;
+- } while (read1 != read2);
++ read2 = read1;
++ read1 = rtc_read_lpsrt(data);
++ } while (read1 != read2 && --timeout);
++ if (!timeout)
++ dev_err(&data->rtc->dev, "Timeout trying to get valid LPSRT Counter read\n");
+
+ /* Convert 47-bit counter to 32-bit raw second count */
+ return (u32) (read1 >> CNTR_TO_SECS_SH);
+ }
+
+-static void rtc_write_sync_lp(struct snvs_rtc_data *data)
++/* Just read the lsb from the counter, dealing with inconsistent state */
++static int rtc_read_lp_counter_lsb(struct snvs_rtc_data *data, u32 *lsb)
+ {
+- u32 count1, count2, count3;
+- int i;
+-
+- /* Wait for 3 CKIL cycles */
+- for (i = 0; i < 3; i++) {
+- do {
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1);
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count2);
+- } while (count1 != count2);
+-
+- /* Now wait until counter value changes */
+- do {
+- do {
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count2);
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count3);
+- } while (count2 != count3);
+- } while (count3 == count1);
++ u32 count1, count2;
++ unsigned int timeout = 100;
++
++ regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1);
++ do {
++ count2 = count1;
++ regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1);
++ } while (count1 != count2 && --timeout);
++ if (!timeout) {
++ dev_err(&data->rtc->dev, "Timeout trying to get valid LPSRT Counter read\n");
++ return -ETIMEDOUT;
+ }
++
++ *lsb = count1;
++ return 0;
++}
++
++static int rtc_write_sync_lp(struct snvs_rtc_data *data)
++{
++ u32 count1, count2;
++ u32 elapsed;
++ unsigned int timeout = 1000;
++ int ret;
++
++ ret = rtc_read_lp_counter_lsb(data, &count1);
++ if (ret)
++ return ret;
++
++ /* Wait for 3 CKIL cycles, about 61.0-91.5 µs */
++ do {
++ ret = rtc_read_lp_counter_lsb(data, &count2);
++ if (ret)
++ return ret;
++ elapsed = count2 - count1; /* wrap around _is_ handled! */
++ } while (elapsed < 3 && --timeout);
++ if (!timeout) {
++ dev_err(&data->rtc->dev, "Timeout waiting for LPSRT Counter to change\n");
++ return -ETIMEDOUT;
++ }
++ return 0;
+ }
+
+ static int snvs_rtc_enable(struct snvs_rtc_data *data, bool enable)
+@@ -173,9 +207,7 @@ static int snvs_rtc_alarm_irq_enable(struct device *dev, unsigned int enable)
+ (SNVS_LPCR_LPTA_EN | SNVS_LPCR_LPWUI_EN),
+ enable ? (SNVS_LPCR_LPTA_EN | SNVS_LPCR_LPWUI_EN) : 0);
+
+- rtc_write_sync_lp(data);
+-
+- return 0;
++ return rtc_write_sync_lp(data);
+ }
+
+ static int snvs_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+@@ -183,11 +215,14 @@ static int snvs_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ struct snvs_rtc_data *data = dev_get_drvdata(dev);
+ struct rtc_time *alrm_tm = &alrm->time;
+ unsigned long time;
++ int ret;
+
+ rtc_tm_to_time(alrm_tm, &time);
+
+ regmap_update_bits(data->regmap, data->offset + SNVS_LPCR, SNVS_LPCR_LPTA_EN, 0);
+- rtc_write_sync_lp(data);
++ ret = rtc_write_sync_lp(data);
++ if (ret)
++ return ret;
+ regmap_write(data->regmap, data->offset + SNVS_LPTAR, time);
+
+ /* Clear alarm interrupt status bit */
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-040-ALSA-isa-wavefront-prevent-some-out-of-bound-.patch b/patches.kernel.org/4.4.169-040-ALSA-isa-wavefront-prevent-some-out-of-bound-.patch
new file mode 100644
index 0000000000..b8215c7c7f
--- /dev/null
+++ b/patches.kernel.org/4.4.169-040-ALSA-isa-wavefront-prevent-some-out-of-bound-.patch
@@ -0,0 +1,57 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 4 May 2016 09:27:37 +0300
+Subject: [PATCH] ALSA: isa/wavefront: prevent some out of bound writes
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 84d7a4470dbac0dd9389050100b54a1625d04264
+
+[ Upstream commit 84d7a4470dbac0dd9389050100b54a1625d04264 ]
+
+"header->number" can be up to USHRT_MAX and it comes from the ioctl so
+it needs to be capped.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ sound/isa/wavefront/wavefront_synth.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c
+index 69f76ff5693d..718d5e3b7806 100644
+--- a/sound/isa/wavefront/wavefront_synth.c
++++ b/sound/isa/wavefront/wavefront_synth.c
+@@ -785,6 +785,9 @@ wavefront_send_patch (snd_wavefront_t *dev, wavefront_patch_info *header)
+ DPRINT (WF_DEBUG_LOAD_PATCH, "downloading patch %d\n",
+ header->number);
+
++ if (header->number >= ARRAY_SIZE(dev->patch_status))
++ return -EINVAL;
++
+ dev->patch_status[header->number] |= WF_SLOT_FILLED;
+
+ bptr = buf;
+@@ -809,6 +812,9 @@ wavefront_send_program (snd_wavefront_t *dev, wavefront_patch_info *header)
+ DPRINT (WF_DEBUG_LOAD_PATCH, "downloading program %d\n",
+ header->number);
+
++ if (header->number >= ARRAY_SIZE(dev->prog_status))
++ return -EINVAL;
++
+ dev->prog_status[header->number] = WF_SLOT_USED;
+
+ /* XXX need to zero existing SLOT_USED bit for program_status[i]
+@@ -898,6 +904,9 @@ wavefront_send_sample (snd_wavefront_t *dev,
+ header->number = x;
+ }
+
++ if (header->number >= WF_MAX_SAMPLE)
++ return -EINVAL;
++
+ if (header->size) {
+
+ /* XXX it's a debatable point whether or not RDONLY semantics
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-041-Linux-4.4.169.patch b/patches.kernel.org/4.4.169-041-Linux-4.4.169.patch
new file mode 100644
index 0000000000..4ec2ea7650
--- /dev/null
+++ b/patches.kernel.org/4.4.169-041-Linux-4.4.169.patch
@@ -0,0 +1,27 @@
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 21 Dec 2018 14:09:54 +0100
+Subject: [PATCH] Linux 4.4.169
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: ba0da581b466dcd333eeb326919a698116926258
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 082f82471b51..0d41b0626c0c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 168
++SUBLEVEL = 169
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+
+--
+2.20.1
+
diff --git a/patches.drivers/USB-hso-Fix-OOB-memory-access-in-hso_probe-hso_get_c.patch b/patches.kernel.org/4.4.170-001-USB-hso-Fix-OOB-memory-access-in-hso_probe-hs.patch
index b37f019f89..df3a869902 100644
--- a/patches.drivers/USB-hso-Fix-OOB-memory-access-in-hso_probe-hso_get_c.patch
+++ b/patches.kernel.org/4.4.170-001-USB-hso-Fix-OOB-memory-access-in-hso_probe-hs.patch
@@ -1,10 +1,12 @@
-From 5146f95df782b0ac61abde36567e718692725c89 Mon Sep 17 00:00:00 2001
From: Hui Peng <benquike@gmail.com>
Date: Wed, 12 Dec 2018 12:42:24 +0100
-Subject: [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
+Subject: [PATCH] USB: hso: Fix OOB memory access in
+ hso_probe/hso_get_config_data
+Patch-mainline: 4.4.170
+References: CVE-2018-19985 bnc#1012382 bsc#1120743
Git-commit: 5146f95df782b0ac61abde36567e718692725c89
-Patch-mainline: v4.20
-References: CVE-2018-19985,bsc#1120743
+
+commit 5146f95df782b0ac61abde36567e718692725c89 upstream.
The function hso_probe reads if_num from the USB device (as an u8) and uses
it without a length check to index an array, resulting in an OOB memory read
@@ -22,17 +24,17 @@ Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/net/usb/hso.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
-index 184c24baca15..d6916f787fce 100644
+index 111d907e0c11..79cede19e0c4 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
-@@ -2807,6 +2807,12 @@ static int hso_get_config_data(struct usb_interface *interface)
+@@ -2825,6 +2825,12 @@ static int hso_get_config_data(struct usb_interface *interface)
return -EIO;
}
@@ -45,7 +47,7 @@ index 184c24baca15..d6916f787fce 100644
switch (config_data[if_num]) {
case 0x0:
result = 0;
-@@ -2877,10 +2883,18 @@ static int hso_probe(struct usb_interface *interface,
+@@ -2895,10 +2901,18 @@ static int hso_probe(struct usb_interface *interface,
/* Get the interface/port specification from either driver_info or from
* the device itself */
diff --git a/patches.kernel.org/4.4.170-002-xhci-Don-t-prevent-USB2-bus-suspend-in-state-.patch b/patches.kernel.org/4.4.170-002-xhci-Don-t-prevent-USB2-bus-suspend-in-state-.patch
new file mode 100644
index 0000000000..79bc545794
--- /dev/null
+++ b/patches.kernel.org/4.4.170-002-xhci-Don-t-prevent-USB2-bus-suspend-in-state-.patch
@@ -0,0 +1,45 @@
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 14 Dec 2018 10:54:43 +0200
+Subject: [PATCH] xhci: Don't prevent USB2 bus suspend in state check intended
+ for USB3 only
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 45f750c16cae3625014c14c77bd9005eda975d35
+
+commit 45f750c16cae3625014c14c77bd9005eda975d35 upstream.
+
+The code to prevent a bus suspend if a USB3 port was still in link training
+also reacted to USB2 port polling state.
+This caused bus suspend to busyloop in some cases.
+USB2 polling state is different from USB3, and should not prevent bus
+suspend.
+
+Limit the USB3 link training state check to USB3 root hub ports only.
+The origial commit went to stable so this need to be applied there as well
+
+Fixes: 2f31a67f01a8 ("usb: xhci: Prevent bus suspend if a port connect change or polling state is detected")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/usb/host/xhci-hub.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 5d21cd8359d4..421825b44202 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1329,7 +1329,8 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ portsc_buf[port_index] = 0;
+
+ /* Bail out if a USB3 port has a new device in link training */
+- if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) {
++ if ((hcd->speed >= HCD_USB3) &&
++ (t1 & PORT_PLS_MASK) == XDEV_POLLING) {
+ bus_state->bus_suspended = 0;
+ spin_unlock_irqrestore(&xhci->lock, flags);
+ xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-003-USB-serial-option-add-GosunCn-ZTE-WeLink-ME36.patch b/patches.kernel.org/4.4.170-003-USB-serial-option-add-GosunCn-ZTE-WeLink-ME36.patch
new file mode 100644
index 0000000000..8e475f64b2
--- /dev/null
+++ b/patches.kernel.org/4.4.170-003-USB-serial-option-add-GosunCn-ZTE-WeLink-ME36.patch
@@ -0,0 +1,75 @@
+From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
+Date: Tue, 11 Dec 2018 18:28:28 +0100
+Subject: [PATCH] USB: serial: option: add GosunCn ZTE WeLink ME3630
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 70a7444c550a75584ffcfae95267058817eff6a7
+
+commit 70a7444c550a75584ffcfae95267058817eff6a7 upstream.
+
+Added USB serial option driver support for GosunCn ZTE WeLink ME3630
+series cellular modules for USB modes ECM/NCM and MBIM.
+
+usb-devices output MBIM mode:
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=19d2 ProdID=0602 Rev=03.18
+S: Manufacturer=Android
+S: Product=Android
+S: SerialNumber=
+C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+
+usb-devices output ECM/NCM mode:
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=19d2 ProdID=1476 Rev=03.18
+S: Manufacturer=Android
+S: Product=Android
+S: SerialNumber=
+C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+I: If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+
+Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 2b81939fecd7..b2aa7c70560f 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1327,6 +1327,7 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0602, 0xff) }, /* GosunCn ZTE WeLink ME3630 (MBIM mode) */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
+@@ -1530,6 +1531,7 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(2) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */
+ .driver_info = RSVD(2) },
++ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-004-USB-serial-option-add-HP-lt4132.patch b/patches.kernel.org/4.4.170-004-USB-serial-option-add-HP-lt4132.patch
new file mode 100644
index 0000000000..8161be467a
--- /dev/null
+++ b/patches.kernel.org/4.4.170-004-USB-serial-option-add-HP-lt4132.patch
@@ -0,0 +1,88 @@
+From: Tore Anderson <tore@fud.no>
+Date: Sat, 8 Dec 2018 19:05:12 +0100
+Subject: [PATCH] USB: serial: option: add HP lt4132
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: d57ec3c83b5153217a70b561d4fb6ed96f2f7a25
+
+commit d57ec3c83b5153217a70b561d4fb6ed96f2f7a25 upstream.
+
+The HP lt4132 is a rebranded Huawei ME906s-158 LTE modem.
+
+The interface with protocol 0x16 is "CDC ECM & NCM" according to the *.inf
+files included with the Windows driver. Attaching the option driver to it
+doesn't result in a /dev/ttyUSB* device being created, so I've excluded it.
+Note that it is also excluded for corresponding Huawei-branded devices, cf.
+commit d544db293a44 ("USB: support new huawei devices in option.c").
+
+T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=ff MxPS=64 #Cfgs= 3
+P: Vendor=03f0 ProdID=a31d Rev=01.02
+S: Manufacturer=HP Inc.
+S: Product=HP lt4132 LTE/HSPA+ 4G Module
+S: SerialNumber=0123456789ABCDEF
+C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=2mA
+I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=10 Driver=option
+I: If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=13 Driver=option
+I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=12 Driver=option
+I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=06 Prot=16 Driver=(none)
+I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option
+I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=1b Driver=option
+
+T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=ff MxPS=64 #Cfgs= 3
+P: Vendor=03f0 ProdID=a31d Rev=01.02
+S: Manufacturer=HP Inc.
+S: Product=HP lt4132 LTE/HSPA+ 4G Module
+S: SerialNumber=0123456789ABCDEF
+C: #Ifs= 7 Cfg#= 2 Atr=a0 MxPwr=2mA
+I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=06 Prot=00 Driver=cdc_ether
+I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=10 Driver=option
+I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=13 Driver=option
+I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=12 Driver=option
+I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option
+I: If#=0x6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=1b Driver=option
+
+T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=ff MxPS=64 #Cfgs= 3
+P: Vendor=03f0 ProdID=a31d Rev=01.02
+S: Manufacturer=HP Inc.
+S: Product=HP lt4132 LTE/HSPA+ 4G Module
+S: SerialNumber=0123456789ABCDEF
+C: #Ifs= 3 Cfg#= 3 Atr=a0 MxPwr=2mA
+I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option
+
+Signed-off-by: Tore Anderson <tore@fud.no>
+Cc: stable@vger.kernel.org
+[ johan: drop id defines ]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/usb/serial/option.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index b2aa7c70560f..4cd445efe249 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1943,7 +1943,12 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x10) }, /* HP lt4132 (Huawei ME906s-158) */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x12) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-005-USB-serial-option-add-Simcom-SIM7500-SIM7600-.patch b/patches.kernel.org/4.4.170-005-USB-serial-option-add-Simcom-SIM7500-SIM7600-.patch
new file mode 100644
index 0000000000..99eea54c91
--- /dev/null
+++ b/patches.kernel.org/4.4.170-005-USB-serial-option-add-Simcom-SIM7500-SIM7600-.patch
@@ -0,0 +1,54 @@
+From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
+Date: Wed, 12 Dec 2018 08:39:39 +0100
+Subject: [PATCH] USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: cc6730df08a291e51e145bc65e24ffb5e2f17ab6
+
+commit cc6730df08a291e51e145bc65e24ffb5e2f17ab6 upstream.
+
+Added USB serial option driver support for Simcom SIM7500/SIM7600 series
+cellular modules exposing MBIM interface (VID 0x1e0e,PID 0x9003)
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 14 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1e0e ProdID=9003 Rev=03.18
+S: Manufacturer=SimTech, Incorporated
+S: Product=SimTech, Incorporated
+S: SerialNumber=0123456789ABCDEF
+C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 5 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#= 6 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+
+Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 4cd445efe249..f7c13e5f7cae 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1759,6 +1759,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
+ .driver_info = RSVD(5) | RSVD(6) },
++ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-006-USB-serial-option-add-Fibocom-NL668-series.patch b/patches.kernel.org/4.4.170-006-USB-serial-option-add-Fibocom-NL668-series.patch
new file mode 100644
index 0000000000..6a4307d1e5
--- /dev/null
+++ b/patches.kernel.org/4.4.170-006-USB-serial-option-add-Fibocom-NL668-series.patch
@@ -0,0 +1,71 @@
+From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
+Date: Wed, 12 Dec 2018 21:47:36 +0100
+Subject: [PATCH] USB: serial: option: add Fibocom NL668 series
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 30360224441ce89a98ed627861e735beb4010775
+
+commit 30360224441ce89a98ed627861e735beb4010775 upstream.
+
+Added USB serial option driver support for Fibocom NL668 series cellular
+modules. Reserved USB endpoints 4, 5 and 6 for network + ADB interfaces.
+
+usb-devices output (QMI mode)
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1508 ProdID=1001 Rev=03.18
+S: Manufacturer=Nodecom NL668 Modem
+S: Product=Nodecom NL668-CN Modem
+S: SerialNumber=
+C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+
+usb-devices output (ECM mode)
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 17 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1508 ProdID=1001 Rev=03.18
+S: Manufacturer=Nodecom NL668 Modem
+S: Product=Nodecom NL668-CN Modem
+S: SerialNumber=
+C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+
+Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index f7c13e5f7cae..412d9442a760 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1950,6 +1950,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
++ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */
++ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-007-USB-serial-option-add-Telit-LN940-series.patch b/patches.kernel.org/4.4.170-007-USB-serial-option-add-Telit-LN940-series.patch
new file mode 100644
index 0000000000..d414d62b27
--- /dev/null
+++ b/patches.kernel.org/4.4.170-007-USB-serial-option-add-Telit-LN940-series.patch
@@ -0,0 +1,71 @@
+From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
+Date: Thu, 13 Dec 2018 17:32:08 +0100
+Subject: [PATCH] USB: serial: option: add Telit LN940 series
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 28a86092b1753b802ef7e3de8a4c4a69a9c1bb03
+
+commit 28a86092b1753b802ef7e3de8a4c4a69a9c1bb03 upstream.
+
+Added USB serial option driver support for Telit LN940 series cellular
+modules. Covering both QMI and MBIM modes.
+
+usb-devices output (0x1900):
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=1900 Rev=03.10
+S: Manufacturer=Telit
+S: Product=Telit LN940 Mobile Broadband
+S: SerialNumber=0123456789ABCDEF
+C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+
+usb-devices output (0x1901):
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 20 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=1901 Rev=03.10
+S: Manufacturer=Telit
+S: Product=Telit LN940 Mobile Broadband
+S: SerialNumber=0123456789ABCDEF
+C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+
+Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 412d9442a760..1e3445dd84b2 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1163,6 +1163,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
++ { USB_DEVICE(TELIT_VENDOR_ID, 0x1900), /* Telit LN940 (QMI) */
++ .driver_info = NCTRL(0) | RSVD(1) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */
++ .driver_info = NCTRL(0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) },
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-008-mmc-core-Reset-HPI-enabled-state-during-re-in.patch b/patches.kernel.org/4.4.170-008-mmc-core-Reset-HPI-enabled-state-during-re-in.patch
new file mode 100644
index 0000000000..8f86d9b884
--- /dev/null
+++ b/patches.kernel.org/4.4.170-008-mmc-core-Reset-HPI-enabled-state-during-re-in.patch
@@ -0,0 +1,44 @@
+From: Ulf Hansson <ulf.hansson@linaro.org>
+Date: Mon, 10 Dec 2018 17:52:36 +0100
+Subject: [PATCH] mmc: core: Reset HPI enabled state during re-init and in case
+ of errors
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: a0741ba40a009f97c019ae7541dc61c1fdf41efb
+
+commit a0741ba40a009f97c019ae7541dc61c1fdf41efb upstream.
+
+During a re-initialization of the eMMC card, we may fail to re-enable HPI.
+In these cases, that isn't properly reflected in the card->ext_csd.hpi_en
+bit, as it keeps being set. This may cause following attempts to use HPI,
+even if's not enabled. Let's fix this!
+
+Fixes: eb0d8f135b67 ("mmc: core: support HPI send command")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/mmc/core/mmc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index 79a0c26e1419..a31789be0840 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1608,9 +1608,11 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
+ if (err) {
+ pr_warn("%s: Enabling HPI failed\n",
+ mmc_hostname(card->host));
++ card->ext_csd.hpi_en = 0;
+ err = 0;
+- } else
++ } else {
+ card->ext_csd.hpi_en = 1;
++ }
+ }
+
+ /*
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-009-mmc-omap_hsmmc-fix-DMA-API-warning.patch b/patches.kernel.org/4.4.170-009-mmc-omap_hsmmc-fix-DMA-API-warning.patch
new file mode 100644
index 0000000000..114e1faed7
--- /dev/null
+++ b/patches.kernel.org/4.4.170-009-mmc-omap_hsmmc-fix-DMA-API-warning.patch
@@ -0,0 +1,71 @@
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Tue, 11 Dec 2018 14:41:31 +0000
+Subject: [PATCH] mmc: omap_hsmmc: fix DMA API warning
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 0b479790684192ab7024ce6a621f93f6d0a64d92
+
+commit 0b479790684192ab7024ce6a621f93f6d0a64d92 upstream.
+
+While booting with rootfs on MMC, the following warning is encountered
+on OMAP4430:
+
+omap-dma-engine 4a056000.dma-controller: DMA-API: mapping sg segment longer than device claims to support [len=69632] [max=65536]
+
+This is because the DMA engine has a default maximum segment size of 64K
+but HSMMC sets:
+
+ mmc->max_blk_size = 512; /* Block Length at max can be 1024 */
+ mmc->max_blk_count = 0xFFFF; /* No. of Blocks is 16 bits */
+ mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count;
+ mmc->max_seg_size = mmc->max_req_size;
+
+which ends up telling the block layer that we support a maximum segment
+size of 65535*512, which exceeds the advertised DMA engine capabilities.
+
+Fix this by clamping the maximum segment size to the lower of the
+maximum request size and of the DMA engine device used for either DMA
+channel.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/mmc/host/omap_hsmmc.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 6b814d7d6560..af937d3e8c3e 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -2117,7 +2117,6 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ mmc->max_blk_size = 512; /* Block Length at max can be 1024 */
+ mmc->max_blk_count = 0xFFFF; /* No. of Blocks is 16 bits */
+ mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count;
+- mmc->max_seg_size = mmc->max_req_size;
+
+ mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
+ MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE;
+@@ -2174,6 +2173,17 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ goto err_irq;
+ }
+
++ /*
++ * Limit the maximum segment size to the lower of the request size
++ * and the DMA engine device segment size limits. In reality, with
++ * 32-bit transfers, the DMA engine can do longer segments than this
++ * but there is no way to represent that in the DMA model - if we
++ * increase this figure here, we get warnings from the DMA API debug.
++ */
++ mmc->max_seg_size = min3(mmc->max_req_size,
++ dma_get_max_seg_size(host->rx_chan->device->dev),
++ dma_get_max_seg_size(host->tx_chan->device->dev));
++
+ /* Request IRQ for MMC operations */
+ ret = devm_request_irq(&pdev->dev, host->irq, omap_hsmmc_irq, 0,
+ mmc_hostname(mmc), host);
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-010-gpio-max7301-fix-driver-for-use-with-CONFIG_V.patch b/patches.kernel.org/4.4.170-010-gpio-max7301-fix-driver-for-use-with-CONFIG_V.patch
new file mode 100644
index 0000000000..2313f64653
--- /dev/null
+++ b/patches.kernel.org/4.4.170-010-gpio-max7301-fix-driver-for-use-with-CONFIG_V.patch
@@ -0,0 +1,59 @@
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Fri, 7 Dec 2018 13:07:55 +0000
+Subject: [PATCH] gpio: max7301: fix driver for use with CONFIG_VMAP_STACK
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: abf221d2f51b8ce7b9959a8953f880a8b0a1400d
+
+commit abf221d2f51b8ce7b9959a8953f880a8b0a1400d upstream.
+
+spi_read() and spi_write() require DMA-safe memory. When
+CONFIG_VMAP_STACK is selected, those functions cannot be used
+with buffers on stack.
+
+This patch replaces calls to spi_read() and spi_write() by
+spi_write_then_read() which doesn't require DMA-safe buffers.
+
+Fixes: 0c36ec314735 ("gpio: gpio driver for max7301 SPI GPIO expander")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/gpio/gpio-max7301.c | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpio/gpio-max7301.c b/drivers/gpio/gpio-max7301.c
+index 05813fbf3daf..647dfbbc4e1c 100644
+--- a/drivers/gpio/gpio-max7301.c
++++ b/drivers/gpio/gpio-max7301.c
+@@ -25,7 +25,7 @@ static int max7301_spi_write(struct device *dev, unsigned int reg,
+ struct spi_device *spi = to_spi_device(dev);
+ u16 word = ((reg & 0x7F) << 8) | (val & 0xFF);
+
+- return spi_write(spi, (const u8 *)&word, sizeof(word));
++ return spi_write_then_read(spi, &word, sizeof(word), NULL, 0);
+ }
+
+ /* A read from the MAX7301 means two transfers; here, one message each */
+@@ -37,14 +37,8 @@ static int max7301_spi_read(struct device *dev, unsigned int reg)
+ struct spi_device *spi = to_spi_device(dev);
+
+ word = 0x8000 | (reg << 8);
+- ret = spi_write(spi, (const u8 *)&word, sizeof(word));
+- if (ret)
+- return ret;
+- /*
+- * This relies on the fact, that a transfer with NULL tx_buf shifts out
+- * zero bytes (=NOOP for MAX7301)
+- */
+- ret = spi_read(spi, (u8 *)&word, sizeof(word));
++ ret = spi_write_then_read(spi, &word, sizeof(word), &word,
++ sizeof(word));
+ if (ret)
+ return ret;
+ return word & 0xff;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-011-Drivers-hv-vmbus-Return-EINVAL-for-the-sys-fi.patch b/patches.kernel.org/4.4.170-011-Drivers-hv-vmbus-Return-EINVAL-for-the-sys-fi.patch
new file mode 100644
index 0000000000..b11d1bf9e3
--- /dev/null
+++ b/patches.kernel.org/4.4.170-011-Drivers-hv-vmbus-Return-EINVAL-for-the-sys-fi.patch
@@ -0,0 +1,125 @@
+From: Dexuan Cui <decui@microsoft.com>
+Date: Thu, 13 Dec 2018 16:35:43 +0000
+Subject: [PATCH] Drivers: hv: vmbus: Return -EINVAL for the sys files for
+ unopened channels
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: fc96df16a1ce80cbb3c316ab7d4dc8cd5c2852ce
+
+commit fc96df16a1ce80cbb3c316ab7d4dc8cd5c2852ce upstream.
+
+Before 98f4c651762c, we returned zeros for unopened channels.
+With 98f4c651762c, we started to return random on-stack values.
+
+We'd better return -EINVAL instead.
+
+Fixes: 98f4c651762c ("hv: move ringbuffer bus attributes to dev_groups")
+Cc: stable@vger.kernel.org
+Cc: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/hv/vmbus_drv.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 802dcb409030..b877cce0409b 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -316,6 +316,8 @@ static ssize_t out_intr_mask_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ return sprintf(buf, "%d\n", outbound.current_interrupt_mask);
+ }
+@@ -329,6 +331,8 @@ static ssize_t out_read_index_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ return sprintf(buf, "%d\n", outbound.current_read_index);
+ }
+@@ -343,6 +347,8 @@ static ssize_t out_write_index_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ return sprintf(buf, "%d\n", outbound.current_write_index);
+ }
+@@ -357,6 +363,8 @@ static ssize_t out_read_bytes_avail_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ return sprintf(buf, "%d\n", outbound.bytes_avail_toread);
+ }
+@@ -371,6 +379,8 @@ static ssize_t out_write_bytes_avail_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ return sprintf(buf, "%d\n", outbound.bytes_avail_towrite);
+ }
+@@ -384,6 +394,8 @@ static ssize_t in_intr_mask_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ return sprintf(buf, "%d\n", inbound.current_interrupt_mask);
+ }
+@@ -397,6 +409,8 @@ static ssize_t in_read_index_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ return sprintf(buf, "%d\n", inbound.current_read_index);
+ }
+@@ -410,6 +424,8 @@ static ssize_t in_write_index_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ return sprintf(buf, "%d\n", inbound.current_write_index);
+ }
+@@ -424,6 +440,8 @@ static ssize_t in_read_bytes_avail_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ return sprintf(buf, "%d\n", inbound.bytes_avail_toread);
+ }
+@@ -438,6 +456,8 @@ static ssize_t in_write_bytes_avail_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ return sprintf(buf, "%d\n", inbound.bytes_avail_towrite);
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-012-x86-mtrr-Don-t-copy-uninitialized-gentry-fiel.patch b/patches.kernel.org/4.4.170-012-x86-mtrr-Don-t-copy-uninitialized-gentry-fiel.patch
new file mode 100644
index 0000000000..361dc8c88b
--- /dev/null
+++ b/patches.kernel.org/4.4.170-012-x86-mtrr-Don-t-copy-uninitialized-gentry-fiel.patch
@@ -0,0 +1,47 @@
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 18 Dec 2018 17:29:56 +0000
+Subject: [PATCH] x86/mtrr: Don't copy uninitialized gentry fields back to
+ userspace
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 32043fa065b51e0b1433e48d118821c71b5cd65d
+
+commit 32043fa065b51e0b1433e48d118821c71b5cd65d upstream.
+
+Currently the copy_to_user of data in the gentry struct is copying
+uninitiaized data in field _pad from the stack to userspace.
+
+Fix this by explicitly memset'ing gentry to zero, this also will zero any
+compiler added padding fields that may be in struct (currently there are
+none).
+
+Detected by CoverityScan, CID#200783 ("Uninitialized scalar variable")
+
+Fixes: b263b31e8ad6 ("x86, mtrr: Use explicit sizing and padding for the 64-bit ioctls")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
+Cc: security@kernel.org
+Link: https://lkml.kernel.org/r/20181218172956.1440-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/x86/kernel/cpu/mtrr/if.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/mtrr/if.c b/arch/x86/kernel/cpu/mtrr/if.c
+index d76f13d6d8d6..ec894bf5eeb0 100644
+--- a/arch/x86/kernel/cpu/mtrr/if.c
++++ b/arch/x86/kernel/cpu/mtrr/if.c
+@@ -173,6 +173,8 @@ mtrr_ioctl(struct file *file, unsigned int cmd, unsigned long __arg)
+ struct mtrr_gentry gentry;
+ void __user *arg = (void __user *) __arg;
+
++ memset(&gentry, 0, sizeof(gentry));
++
+ switch (cmd) {
+ case MTRRIOC_ADD_ENTRY:
+ case MTRRIOC_SET_ENTRY:
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-013-drm-ioctl-Fix-Spectre-v1-vulnerabilities.patch b/patches.kernel.org/4.4.170-013-drm-ioctl-Fix-Spectre-v1-vulnerabilities.patch
new file mode 100644
index 0000000000..42ad4ba542
--- /dev/null
+++ b/patches.kernel.org/4.4.170-013-drm-ioctl-Fix-Spectre-v1-vulnerabilities.patch
@@ -0,0 +1,80 @@
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 19 Dec 2018 18:00:15 -0600
+Subject: [PATCH] drm/ioctl: Fix Spectre v1 vulnerabilities
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 505b5240329b922f21f91d5b5d1e535c805eca6d
+
+commit 505b5240329b922f21f91d5b5d1e535c805eca6d upstream.
+
+nr is indirectly controlled by user-space, hence leading to a
+potential exploitation of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+drivers/gpu/drm/drm_ioctl.c:805 drm_ioctl() warn: potential spectre issue 'dev->driver->ioctls' [r]
+drivers/gpu/drm/drm_ioctl.c:810 drm_ioctl() warn: potential spectre issue 'drm_ioctls' [r] (local cap)
+drivers/gpu/drm/drm_ioctl.c:892 drm_ioctl_flags() warn: potential spectre issue 'drm_ioctls' [r] (local cap)
+
+Fix this by sanitizing nr before using it to index dev->driver->ioctls
+and drm_ioctls.
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181220000015.GA18973@embeddedor
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/gpu/drm/drm_ioctl.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
+index 8ce2a0c59116..a7030ada81fd 100644
+--- a/drivers/gpu/drm/drm_ioctl.c
++++ b/drivers/gpu/drm/drm_ioctl.c
+@@ -36,6 +36,7 @@
+
+ #include <linux/pci.h>
+ #include <linux/export.h>
++#include <linux/nospec.h>
+
+ static int drm_version(struct drm_device *dev, void *data,
+ struct drm_file *file_priv);
+@@ -702,13 +703,17 @@ long drm_ioctl(struct file *filp,
+
+ if (is_driver_ioctl) {
+ /* driver ioctl */
+- if (nr - DRM_COMMAND_BASE >= dev->driver->num_ioctls)
++ unsigned int index = nr - DRM_COMMAND_BASE;
++
++ if (index >= dev->driver->num_ioctls)
+ goto err_i1;
+- ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
++ index = array_index_nospec(index, dev->driver->num_ioctls);
++ ioctl = &dev->driver->ioctls[index];
+ } else {
+ /* core ioctl */
+ if (nr >= DRM_CORE_IOCTL_COUNT)
+ goto err_i1;
++ nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
+ ioctl = &drm_ioctls[nr];
+ }
+
+@@ -810,6 +815,7 @@ bool drm_ioctl_flags(unsigned int nr, unsigned int *flags)
+
+ if (nr >= DRM_CORE_IOCTL_COUNT)
+ return false;
++ nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
+
+ *flags = drm_ioctls[nr].flags;
+ return true;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-014-ip6mr-Fix-potential-Spectre-v1-vulnerability.patch b/patches.kernel.org/4.4.170-014-ip6mr-Fix-potential-Spectre-v1-vulnerability.patch
new file mode 100644
index 0000000000..c186e2b772
--- /dev/null
+++ b/patches.kernel.org/4.4.170-014-ip6mr-Fix-potential-Spectre-v1-vulnerability.patch
@@ -0,0 +1,65 @@
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Tue, 11 Dec 2018 14:10:08 -0600
+Subject: [PATCH] ip6mr: Fix potential Spectre v1 vulnerability
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 69d2c86766da2ded2b70281f1bf242cb0d58a778
+
+[ Upstream commit 69d2c86766da2ded2b70281f1bf242cb0d58a778 ]
+
+vr.mifi is indirectly controlled by user-space, hence leading to
+a potential exploitation of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+net/ipv6/ip6mr.c:1845 ip6mr_ioctl() warn: potential spectre issue 'mrt->vif_table' [r] (local cap)
+net/ipv6/ip6mr.c:1919 ip6mr_compat_ioctl() warn: potential spectre issue 'mrt->vif_table' [r] (local cap)
+
+Fix this by sanitizing vr.mifi before using it to index mrt->vif_table'
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv6/ip6mr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 9b92960f024d..74b3e9718e84 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -72,6 +72,8 @@ struct mr6_table {
+ #endif
+ };
+
++#include <linux/nospec.h>
++
+ struct ip6mr_rule {
+ struct fib_rule common;
+ };
+@@ -1871,6 +1873,7 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void __user *arg)
+ return -EFAULT;
+ if (vr.mifi >= mrt->maxvif)
+ return -EINVAL;
++ vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif);
+ read_lock(&mrt_lock);
+ vif = &mrt->vif6_table[vr.mifi];
+ if (MIF_EXISTS(mrt, vr.mifi)) {
+@@ -1945,6 +1948,7 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
+ return -EFAULT;
+ if (vr.mifi >= mrt->maxvif)
+ return -EINVAL;
++ vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif);
+ read_lock(&mrt_lock);
+ vif = &mrt->vif6_table[vr.mifi];
+ if (MIF_EXISTS(mrt, vr.mifi)) {
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-015-ipv4-Fix-potential-Spectre-v1-vulnerability.patch b/patches.kernel.org/4.4.170-015-ipv4-Fix-potential-Spectre-v1-vulnerability.patch
new file mode 100644
index 0000000000..d9dbe88579
--- /dev/null
+++ b/patches.kernel.org/4.4.170-015-ipv4-Fix-potential-Spectre-v1-vulnerability.patch
@@ -0,0 +1,56 @@
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Mon, 10 Dec 2018 12:41:24 -0600
+Subject: [PATCH] ipv4: Fix potential Spectre v1 vulnerability
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 5648451e30a0d13d11796574919a359025d52cce
+
+[ Upstream commit 5648451e30a0d13d11796574919a359025d52cce ]
+
+vr.vifi is indirectly controlled by user-space, hence leading to
+a potential exploitation of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+net/ipv4/ipmr.c:1616 ipmr_ioctl() warn: potential spectre issue 'mrt->vif_table' [r] (local cap)
+net/ipv4/ipmr.c:1690 ipmr_compat_ioctl() warn: potential spectre issue 'mrt->vif_table' [r] (local cap)
+
+Fix this by sanitizing vr.vifi before using it to index mrt->vif_table'
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv4/ipmr.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 8e77786549c6..1cb865fcc91b 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -66,6 +66,7 @@
+ #include <net/netlink.h>
+ #include <net/fib_rules.h>
+ #include <linux/netconf.h>
++#include <linux/nospec.h>
+
+ #if defined(CONFIG_IP_PIMSM_V1) || defined(CONFIG_IP_PIMSM_V2)
+ #define CONFIG_IP_PIMSM 1
+@@ -1574,6 +1575,7 @@ int ipmr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
+ return -EFAULT;
+ if (vr.vifi >= mrt->maxvif)
+ return -EINVAL;
++ vr.vifi = array_index_nospec(vr.vifi, mrt->maxvif);
+ read_lock(&mrt_lock);
+ vif = &mrt->vif_table[vr.vifi];
+ if (VIF_EXISTS(mrt, vr.vifi)) {
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-016-ax25-fix-a-use-after-free-in-ax25_fillin_cb.patch b/patches.kernel.org/4.4.170-016-ax25-fix-a-use-after-free-in-ax25_fillin_cb.patch
new file mode 100644
index 0000000000..e3a3880ffa
--- /dev/null
+++ b/patches.kernel.org/4.4.170-016-ax25-fix-a-use-after-free-in-ax25_fillin_cb.patch
@@ -0,0 +1,81 @@
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Sat, 29 Dec 2018 13:56:36 -0800
+Subject: [PATCH] ax25: fix a use-after-free in ax25_fillin_cb()
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: c433570458e49bccea5c551df628d058b3526289
+
+[ Upstream commit c433570458e49bccea5c551df628d058b3526289 ]
+
+There are multiple issues here:
+
+1. After freeing dev->ax25_ptr, we need to set it to NULL otherwise
+ we may use a dangling pointer.
+
+2. There is a race between ax25_setsockopt() and device notifier as
+ reported by syzbot. Close it by holding RTNL lock.
+
+3. We need to test if dev->ax25_ptr is NULL before using it.
+
+Reported-and-tested-by: syzbot+ae6bb869cbed29b29040@syzkaller.appspotmail.com
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ax25/af_ax25.c | 11 +++++++++--
+ net/ax25/ax25_dev.c | 2 ++
+ 2 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index 2fdebabbfacd..2772f6a13fcb 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -654,15 +654,22 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
+ break;
+ }
+
+- dev = dev_get_by_name(&init_net, devname);
++ rtnl_lock();
++ dev = __dev_get_by_name(&init_net, devname);
+ if (!dev) {
++ rtnl_unlock();
+ res = -ENODEV;
+ break;
+ }
+
+ ax25->ax25_dev = ax25_dev_ax25dev(dev);
++ if (!ax25->ax25_dev) {
++ rtnl_unlock();
++ res = -ENODEV;
++ break;
++ }
+ ax25_fillin_cb(ax25, ax25->ax25_dev);
+- dev_put(dev);
++ rtnl_unlock();
+ break;
+
+ default:
+diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
+index 3d106767b272..5faca5db6385 100644
+--- a/net/ax25/ax25_dev.c
++++ b/net/ax25/ax25_dev.c
+@@ -116,6 +116,7 @@ void ax25_dev_device_down(struct net_device *dev)
+ if ((s = ax25_dev_list) == ax25_dev) {
+ ax25_dev_list = s->next;
+ spin_unlock_bh(&ax25_dev_lock);
++ dev->ax25_ptr = NULL;
+ dev_put(dev);
+ kfree(ax25_dev);
+ return;
+@@ -125,6 +126,7 @@ void ax25_dev_device_down(struct net_device *dev)
+ if (s->next == ax25_dev) {
+ s->next = ax25_dev->next;
+ spin_unlock_bh(&ax25_dev_lock);
++ dev->ax25_ptr = NULL;
+ dev_put(dev);
+ kfree(ax25_dev);
+ return;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-017-ibmveth-fix-DMA-unmap-error-in-ibmveth_xmit_s.patch b/patches.kernel.org/4.4.170-017-ibmveth-fix-DMA-unmap-error-in-ibmveth_xmit_s.patch
new file mode 100644
index 0000000000..74ed595dfb
--- /dev/null
+++ b/patches.kernel.org/4.4.170-017-ibmveth-fix-DMA-unmap-error-in-ibmveth_xmit_s.patch
@@ -0,0 +1,66 @@
+From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Date: Mon, 31 Dec 2018 15:43:01 -0600
+Subject: [PATCH] ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 756af9c642329d54f048bac2a62f829b391f6944
+
+[ Upstream commit 756af9c642329d54f048bac2a62f829b391f6944 ]
+
+Commit 33a48ab105a7 ("ibmveth: Fix DMA unmap error") fixed an issue in the
+normal code path of ibmveth_xmit_start() that was originally introduced by
+Commit 6e8ab30ec677 ("ibmveth: Add scatter-gather support"). This original
+fix missed the error path where dma_unmap_page is wrongly called on the
+header portion in descs[0] which was mapped with dma_map_single. As a
+result a failure to DMA map any of the frags results in a dmesg warning
+when CONFIG_DMA_API_DEBUG is enabled.
+
+------------[ cut here ]------------
+DMA-API: ibmveth 30000002: device driver frees DMA memory with wrong function
+ [device address=0x000000000a430000] [size=172 bytes] [mapped as page] [unmapped as single]
+WARNING: CPU: 1 PID: 8426 at kernel/dma/debug.c:1085 check_unmap+0x4fc/0xe10
+...
+<snip>
+...
+DMA-API: Mapped at:
+ibmveth_start_xmit+0x30c/0xb60
+dev_hard_start_xmit+0x100/0x450
+sch_direct_xmit+0x224/0x490
+__qdisc_run+0x20c/0x980
+__dev_queue_xmit+0x1bc/0xf20
+
+This fixes the API misuse by unampping descs[0] with dma_unmap_single.
+
+Fixes: 6e8ab30ec677 ("ibmveth: Add scatter-gather support")
+Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/ibm/ibmveth.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
+index 2f9b12cf9ee5..61a9ab4fe047 100644
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -1163,11 +1163,15 @@ static netdev_tx_t ibmveth_start_xmit(struct sk_buff *skb,
+
+ map_failed_frags:
+ last = i+1;
+- for (i = 0; i < last; i++)
++ for (i = 1; i < last; i++)
+ dma_unmap_page(&adapter->vdev->dev, descs[i].fields.address,
+ descs[i].fields.flags_len & IBMVETH_BUF_LEN_MASK,
+ DMA_TO_DEVICE);
+
++ dma_unmap_single(&adapter->vdev->dev,
++ descs[0].fields.address,
++ descs[0].fields.flags_len & IBMVETH_BUF_LEN_MASK,
++ DMA_TO_DEVICE);
+ map_failed:
+ if (!firmware_has_feature(FW_FEATURE_CMO))
+ netdev_err(netdev, "tx: unable to map xmit buffer\n");
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-018-ieee802154-lowpan_header_create-check-must-ch.patch b/patches.kernel.org/4.4.170-018-ieee802154-lowpan_header_create-check-must-ch.patch
new file mode 100644
index 0000000000..de8b5cafe9
--- /dev/null
+++ b/patches.kernel.org/4.4.170-018-ieee802154-lowpan_header_create-check-must-ch.patch
@@ -0,0 +1,39 @@
+From: Willem de Bruijn <willemb@google.com>
+Date: Sun, 23 Dec 2018 12:52:18 -0500
+Subject: [PATCH] ieee802154: lowpan_header_create check must check daddr
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 40c3ff6d5e0809505a067dd423c110c5658c478c
+
+[ Upstream commit 40c3ff6d5e0809505a067dd423c110c5658c478c ]
+
+Packet sockets may call dev_header_parse with NULL daddr. Make
+lowpan_header_ops.create fail.
+
+Fixes: 87a93e4eceb4 ("ieee802154: change needed headroom/tailroom")
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Alexander Aring <aring@mojatatu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ieee802154/6lowpan/tx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/ieee802154/6lowpan/tx.c b/net/ieee802154/6lowpan/tx.c
+index a10db45b2e1e..df32134da924 100644
+--- a/net/ieee802154/6lowpan/tx.c
++++ b/net/ieee802154/6lowpan/tx.c
+@@ -55,6 +55,9 @@ int lowpan_header_create(struct sk_buff *skb, struct net_device *ldev,
+ const u8 *daddr = _daddr;
+ struct lowpan_addr_info *info;
+
++ if (!daddr)
++ return -EINVAL;
++
+ /* TODO:
+ * if this package isn't ipv6 one, where should it be routed?
+ */
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-019-ipv6-explicitly-initialize-udp6_addr-in-udp_s.patch b/patches.kernel.org/4.4.170-019-ipv6-explicitly-initialize-udp6_addr-in-udp_s.patch
new file mode 100644
index 0000000000..c37ef75c19
--- /dev/null
+++ b/patches.kernel.org/4.4.170-019-ipv6-explicitly-initialize-udp6_addr-in-udp_s.patch
@@ -0,0 +1,54 @@
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Tue, 18 Dec 2018 21:17:44 -0800
+Subject: [PATCH] ipv6: explicitly initialize udp6_addr in udp_sock_create6()
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: fb24274546310872eeeaf3d1d53799d8414aa0f2
+
+[ Upstream commit fb24274546310872eeeaf3d1d53799d8414aa0f2 ]
+
+syzbot reported the use of uninitialized udp6_addr::sin6_scope_id.
+We can just set ::sin6_scope_id to zero, as tunnels are unlikely
+to use an IPv6 address that needs a scope id and there is no
+interface to bind in this context.
+
+For net-next, it looks different as we have cfg->bind_ifindex there
+so we can probably call ipv6_iface_scope_id().
+
+Same for ::sin6_flowinfo, tunnels don't use it.
+
+Fixes: 8024e02879dd ("udp: Add udp_sock_create for UDP tunnels to open listener socket")
+Reported-by: syzbot+c56449ed3652e6720f30@syzkaller.appspotmail.com
+Cc: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv6/ip6_udp_tunnel.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
+index 14dacf1df529..30b03d8e321a 100644
+--- a/net/ipv6/ip6_udp_tunnel.c
++++ b/net/ipv6/ip6_udp_tunnel.c
+@@ -15,7 +15,7 @@
+ int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
+ struct socket **sockp)
+ {
+- struct sockaddr_in6 udp6_addr;
++ struct sockaddr_in6 udp6_addr = {};
+ int err;
+ struct socket *sock = NULL;
+
+@@ -42,6 +42,7 @@ int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
+ goto error;
+
+ if (cfg->peer_udp_port) {
++ memset(&udp6_addr, 0, sizeof(udp6_addr));
+ udp6_addr.sin6_family = AF_INET6;
+ memcpy(&udp6_addr.sin6_addr, &cfg->peer_ip6,
+ sizeof(udp6_addr.sin6_addr));
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-020-isdn-fix-kernel-infoleak-in-capi_unlocked_ioc.patch b/patches.kernel.org/4.4.170-020-isdn-fix-kernel-infoleak-in-capi_unlocked_ioc.patch
new file mode 100644
index 0000000000..2ee7adec52
--- /dev/null
+++ b/patches.kernel.org/4.4.170-020-isdn-fix-kernel-infoleak-in-capi_unlocked_ioc.patch
@@ -0,0 +1,86 @@
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 2 Jan 2019 09:20:27 -0800
+Subject: [PATCH] isdn: fix kernel-infoleak in capi_unlocked_ioctl
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: d63967e475ae10f286dbd35e189cb241e0b1f284
+
+[ Upstream commit d63967e475ae10f286dbd35e189cb241e0b1f284 ]
+
+Since capi_ioctl() copies 64 bytes after calling
+capi20_get_manufacturer() we need to ensure to not leak
+information to user.
+
+BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
+CPU: 0 PID: 11245 Comm: syz-executor633 Not tainted 4.20.0-rc7+ #2
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x173/0x1d0 lib/dump_stack.c:113
+ kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613
+ kmsan_internal_check_memory+0x9d4/0xb00 mm/kmsan/kmsan.c:704
+ kmsan_copy_to_user+0xab/0xc0 mm/kmsan/kmsan_hooks.c:601
+ _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
+ capi_ioctl include/linux/uaccess.h:177 [inline]
+ capi_unlocked_ioctl+0x1a0b/0x1bf0 drivers/isdn/capi/capi.c:939
+ do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46
+ ksys_ioctl fs/ioctl.c:713 [inline]
+ __do_sys_ioctl fs/ioctl.c:720 [inline]
+ __se_sys_ioctl+0x1da/0x270 fs/ioctl.c:718
+ __x64_sys_ioctl+0x4a/0x70 fs/ioctl.c:718
+ do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
+ entry_SYSCALL_64_after_hwframe+0x63/0xe7
+RIP: 0033:0x440019
+Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
+RSP: 002b:00007ffdd4659fb8 EFLAGS: 00000213 ORIG_RAX: 0000000000000010
+RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440019
+RDX: 0000000020000080 RSI: 00000000c0044306 RDI: 0000000000000003
+RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8
+R10: 0000000000000000 R11: 0000000000000213 R12: 00000000004018a0
+R13: 0000000000401930 R14: 0000000000000000 R15: 0000000000000000
+
+Local variable description: ----data.i@capi_unlocked_ioctl
+Variable was created at:
+ capi_ioctl drivers/isdn/capi/capi.c:747 [inline]
+ capi_unlocked_ioctl+0x82/0x1bf0 drivers/isdn/capi/capi.c:939
+ do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46
+
+Bytes 12-63 of 64 are uninitialized
+Memory access of size 64 starts at ffff88807ac5fce8
+Data copied to user address 0000000020000080
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Cc: Karsten Keil <isdn@linux-pingi.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/isdn/capi/kcapi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
+index dd7e38ac29bd..d15347de415a 100644
+--- a/drivers/isdn/capi/kcapi.c
++++ b/drivers/isdn/capi/kcapi.c
+@@ -851,7 +851,7 @@ u16 capi20_get_manufacturer(u32 contr, u8 *buf)
+ u16 ret;
+
+ if (contr == 0) {
+- strlcpy(buf, capi_manufakturer, CAPI_MANUFACTURER_LEN);
++ strncpy(buf, capi_manufakturer, CAPI_MANUFACTURER_LEN);
+ return CAPI_NOERROR;
+ }
+
+@@ -859,7 +859,7 @@ u16 capi20_get_manufacturer(u32 contr, u8 *buf)
+
+ ctr = get_capi_ctr_by_nr(contr);
+ if (ctr && ctr->state == CAPI_CTR_RUNNING) {
+- strlcpy(buf, ctr->manu, CAPI_MANUFACTURER_LEN);
++ strncpy(buf, ctr->manu, CAPI_MANUFACTURER_LEN);
+ ret = CAPI_NOERROR;
+ } else
+ ret = CAPI_REGNOTINSTALLED;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-021-netrom-fix-locking-in-nr_find_socket.patch b/patches.kernel.org/4.4.170-021-netrom-fix-locking-in-nr_find_socket.patch
new file mode 100644
index 0000000000..40b485675e
--- /dev/null
+++ b/patches.kernel.org/4.4.170-021-netrom-fix-locking-in-nr_find_socket.patch
@@ -0,0 +1,107 @@
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Sat, 29 Dec 2018 13:56:38 -0800
+Subject: [PATCH] netrom: fix locking in nr_find_socket()
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 7314f5480f3e37e570104dc5e0f28823ef849e72
+
+[ Upstream commit 7314f5480f3e37e570104dc5e0f28823ef849e72 ]
+
+nr_find_socket(), nr_find_peer() and nr_find_listener() lock the
+sock after finding it in the global list. However, the call path
+requires BH disabled for the sock lock consistently.
+
+Actually the locking is unnecessary at this point, we can just hold
+the sock refcnt to make sure it is not gone after we unlock the global
+list, and lock it later only when needed.
+
+Reported-and-tested-by: syzbot+f621cda8b7e598908efa@syzkaller.appspotmail.com
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/netrom/af_netrom.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
+index ed212ffc1d9d..046ae1caecea 100644
+--- a/net/netrom/af_netrom.c
++++ b/net/netrom/af_netrom.c
+@@ -153,7 +153,7 @@ static struct sock *nr_find_listener(ax25_address *addr)
+ sk_for_each(s, &nr_list)
+ if (!ax25cmp(&nr_sk(s)->source_addr, addr) &&
+ s->sk_state == TCP_LISTEN) {
+- bh_lock_sock(s);
++ sock_hold(s);
+ goto found;
+ }
+ s = NULL;
+@@ -174,7 +174,7 @@ static struct sock *nr_find_socket(unsigned char index, unsigned char id)
+ struct nr_sock *nr = nr_sk(s);
+
+ if (nr->my_index == index && nr->my_id == id) {
+- bh_lock_sock(s);
++ sock_hold(s);
+ goto found;
+ }
+ }
+@@ -198,7 +198,7 @@ static struct sock *nr_find_peer(unsigned char index, unsigned char id,
+
+ if (nr->your_index == index && nr->your_id == id &&
+ !ax25cmp(&nr->dest_addr, dest)) {
+- bh_lock_sock(s);
++ sock_hold(s);
+ goto found;
+ }
+ }
+@@ -224,7 +224,7 @@ static unsigned short nr_find_next_circuit(void)
+ if (i != 0 && j != 0) {
+ if ((sk=nr_find_socket(i, j)) == NULL)
+ break;
+- bh_unlock_sock(sk);
++ sock_put(sk);
+ }
+
+ id++;
+@@ -918,6 +918,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
+ }
+
+ if (sk != NULL) {
++ bh_lock_sock(sk);
+ skb_reset_transport_header(skb);
+
+ if (frametype == NR_CONNACK && skb->len == 22)
+@@ -927,6 +928,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
+
+ ret = nr_process_rx_frame(sk, skb);
+ bh_unlock_sock(sk);
++ sock_put(sk);
+ return ret;
+ }
+
+@@ -958,10 +960,12 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
+ (make = nr_make_new(sk)) == NULL) {
+ nr_transmit_refusal(skb, 0);
+ if (sk)
+- bh_unlock_sock(sk);
++ sock_put(sk);
+ return 0;
+ }
+
++ bh_lock_sock(sk);
++
+ window = skb->data[20];
+
+ skb->sk = make;
+@@ -1014,6 +1018,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
+ sk->sk_data_ready(sk);
+
+ bh_unlock_sock(sk);
++ sock_put(sk);
+
+ nr_insert_socket(make);
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-022-packet-validate-address-length.patch b/patches.kernel.org/4.4.170-022-packet-validate-address-length.patch
new file mode 100644
index 0000000000..76af422f1f
--- /dev/null
+++ b/patches.kernel.org/4.4.170-022-packet-validate-address-length.patch
@@ -0,0 +1,46 @@
+From: Willem de Bruijn <willemb@google.com>
+Date: Fri, 21 Dec 2018 12:06:59 -0500
+Subject: [PATCH] packet: validate address length
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 99137b7888f4058087895d035d81c6b2d31015c5
+
+[ Upstream commit 99137b7888f4058087895d035d81c6b2d31015c5 ]
+
+Packet sockets with SOCK_DGRAM may pass an address for use in
+dev_hard_header. Ensure that it is of sufficient length.
+
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/packet/af_packet.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 07668f152a3a..050dcb71e54e 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2513,6 +2513,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ proto = saddr->sll_protocol;
+ addr = saddr->sll_addr;
+ dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
++ if (addr && dev && saddr->sll_halen < dev->addr_len)
++ goto out;
+ }
+
+ err = -ENXIO;
+@@ -2680,6 +2682,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ proto = saddr->sll_protocol;
+ addr = saddr->sll_addr;
+ dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
++ if (addr && dev && saddr->sll_halen < dev->addr_len)
++ goto out;
+ }
+
+ err = -ENXIO;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-023-packet-validate-address-length-if-non-zero.patch b/patches.kernel.org/4.4.170-023-packet-validate-address-length-if-non-zero.patch
new file mode 100644
index 0000000000..fc5d30c172
--- /dev/null
+++ b/patches.kernel.org/4.4.170-023-packet-validate-address-length-if-non-zero.patch
@@ -0,0 +1,47 @@
+From: Willem de Bruijn <willemb@google.com>
+Date: Sat, 22 Dec 2018 16:53:45 -0500
+Subject: [PATCH] packet: validate address length if non-zero
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 6b8d95f1795c42161dc0984b6863e95d6acf24ed
+
+[ Upstream commit 6b8d95f1795c42161dc0984b6863e95d6acf24ed ]
+
+Validate packet socket address length if a length is given. Zero
+length is equivalent to not setting an address.
+
+Fixes: 99137b7888f4 ("packet: validate address length")
+Reported-by: Ido Schimmel <idosch@idosch.org>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/packet/af_packet.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 050dcb71e54e..0f50977ed53b 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2511,7 +2511,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ sll_addr)))
+ goto out;
+ proto = saddr->sll_protocol;
+- addr = saddr->sll_addr;
++ addr = saddr->sll_halen ? saddr->sll_addr : NULL;
+ dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
+ if (addr && dev && saddr->sll_halen < dev->addr_len)
+ goto out;
+@@ -2680,7 +2680,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
+ goto out;
+ proto = saddr->sll_protocol;
+- addr = saddr->sll_addr;
++ addr = saddr->sll_halen ? saddr->sll_addr : NULL;
+ dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
+ if (addr && dev && saddr->sll_halen < dev->addr_len)
+ goto out;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-024-sctp-initialize-sin6_flowinfo-for-ipv6-addrs-.patch b/patches.kernel.org/4.4.170-024-sctp-initialize-sin6_flowinfo-for-ipv6-addrs-.patch
new file mode 100644
index 0000000000..eaa9821176
--- /dev/null
+++ b/patches.kernel.org/4.4.170-024-sctp-initialize-sin6_flowinfo-for-ipv6-addrs-.patch
@@ -0,0 +1,68 @@
+From: Xin Long <lucien.xin@gmail.com>
+Date: Mon, 10 Dec 2018 18:00:52 +0800
+Subject: [PATCH] sctp: initialize sin6_flowinfo for ipv6 addrs in
+ sctp_inet6addr_event
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 4a2eb0c37b4759416996fbb4c45b932500cf06d3
+
+[ Upstream commit 4a2eb0c37b4759416996fbb4c45b932500cf06d3 ]
+
+syzbot reported a kernel-infoleak, which is caused by an uninitialized
+field(sin6_flowinfo) of addr->a.v6 in sctp_inet6addr_event().
+The call trace is as below:
+
+ BUG: KMSAN: kernel-infoleak in _copy_to_user+0x19a/0x230 lib/usercopy.c:33
+ CPU: 1 PID: 8164 Comm: syz-executor2 Not tainted 4.20.0-rc3+ #95
+ Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+ Google 01/01/2011
+ Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x32d/0x480 lib/dump_stack.c:113
+ kmsan_report+0x12c/0x290 mm/kmsan/kmsan.c:683
+ kmsan_internal_check_memory+0x32a/0xa50 mm/kmsan/kmsan.c:743
+ kmsan_copy_to_user+0x78/0xd0 mm/kmsan/kmsan_hooks.c:634
+ _copy_to_user+0x19a/0x230 lib/usercopy.c:33
+ copy_to_user include/linux/uaccess.h:183 [inline]
+ sctp_getsockopt_local_addrs net/sctp/socket.c:5998 [inline]
+ sctp_getsockopt+0x15248/0x186f0 net/sctp/socket.c:7477
+ sock_common_getsockopt+0x13f/0x180 net/core/sock.c:2937
+ __sys_getsockopt+0x489/0x550 net/socket.c:1939
+ __do_sys_getsockopt net/socket.c:1950 [inline]
+ __se_sys_getsockopt+0xe1/0x100 net/socket.c:1947
+ __x64_sys_getsockopt+0x62/0x80 net/socket.c:1947
+ do_syscall_64+0xcf/0x110 arch/x86/entry/common.c:291
+ entry_SYSCALL_64_after_hwframe+0x63/0xe7
+
+sin6_flowinfo is not really used by SCTP, so it will be fixed by simply
+setting it to 0.
+
+The issue exists since very beginning.
+Thanks Alexander for the reproducer provided.
+
+Reported-by: syzbot+ad5d327e6936a2e284be@syzkaller.appspotmail.com
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Acked-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/sctp/ipv6.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 5ca8309ea7b1..7dffc97a953c 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -101,6 +101,7 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
+ if (addr) {
+ addr->a.v6.sin6_family = AF_INET6;
+ addr->a.v6.sin6_port = 0;
++ addr->a.v6.sin6_flowinfo = 0;
+ addr->a.v6.sin6_addr = ifa->addr;
+ addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
+ addr->valid = 1;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-025-vhost-make-sure-used-idx-is-seen-before-log-i.patch b/patches.kernel.org/4.4.170-025-vhost-make-sure-used-idx-is-seen-before-log-i.patch
new file mode 100644
index 0000000000..38de96249d
--- /dev/null
+++ b/patches.kernel.org/4.4.170-025-vhost-make-sure-used-idx-is-seen-before-log-i.patch
@@ -0,0 +1,40 @@
+From: Jason Wang <jasowang@redhat.com>
+Date: Thu, 13 Dec 2018 10:53:37 +0800
+Subject: [PATCH] vhost: make sure used idx is seen before log in
+ vhost_add_used_n()
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 841df922417eb82c835e93d4b93eb6a68c99d599
+
+[ Upstream commit 841df922417eb82c835e93d4b93eb6a68c99d599 ]
+
+We miss a write barrier that guarantees used idx is updated and seen
+before log. This will let userspace sync and copy used ring before
+used idx is update. Fix this by adding a barrier before log_write().
+
+Fixes: 8dd014adfea6f ("vhost-net: mergeable buffers support")
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/vhost/vhost.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index c54d388310f0..2ed0a356d1d3 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -1550,6 +1550,8 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads,
+ return -EFAULT;
+ }
+ if (unlikely(vq->log_used)) {
++ /* Make sure used idx is seen before log. */
++ smp_wmb();
+ /* Log used index update. */
+ log_write(vq->log_base,
+ vq->log_addr + offsetof(struct vring_used, idx),
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-026-VSOCK-Send-reset-control-packet-when-socket-i.patch b/patches.kernel.org/4.4.170-026-VSOCK-Send-reset-control-packet-when-socket-i.patch
new file mode 100644
index 0000000000..04408e1786
--- /dev/null
+++ b/patches.kernel.org/4.4.170-026-VSOCK-Send-reset-control-packet-when-socket-i.patch
@@ -0,0 +1,135 @@
+From: Jorgen Hansen <jhansen@vmware.com>
+Date: Tue, 18 Dec 2018 00:34:06 -0800
+Subject: [PATCH] VSOCK: Send reset control packet when socket is partially
+ bound
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: a915b982d8f5e4295f64b8dd37ce753874867e88
+
+[ Upstream commit a915b982d8f5e4295f64b8dd37ce753874867e88 ]
+
+If a server side socket is bound to an address, but not in the listening
+state yet, incoming connection requests should receive a reset control
+packet in response. However, the function used to send the reset
+silently drops the reset packet if the sending socket isn't bound
+to a remote address (as is the case for a bound socket not yet in
+the listening state). This change fixes this by using the src
+of the incoming packet as destination for the reset packet in
+this case.
+
+Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
+Reviewed-by: Adit Ranadive <aditr@vmware.com>
+Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
+Signed-off-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/vmw_vsock/vmci_transport.c | 67 +++++++++++++++++++++++++---------
+ 1 file changed, 50 insertions(+), 17 deletions(-)
+
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index 589c8b9908a5..d24773552b64 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -272,6 +272,31 @@ vmci_transport_send_control_pkt_bh(struct sockaddr_vm *src,
+ false);
+ }
+
++static int
++vmci_transport_alloc_send_control_pkt(struct sockaddr_vm *src,
++ struct sockaddr_vm *dst,
++ enum vmci_transport_packet_type type,
++ u64 size,
++ u64 mode,
++ struct vmci_transport_waiting_info *wait,
++ u16 proto,
++ struct vmci_handle handle)
++{
++ struct vmci_transport_packet *pkt;
++ int err;
++
++ pkt = kmalloc(sizeof(*pkt), GFP_KERNEL);
++ if (!pkt)
++ return -ENOMEM;
++
++ err = __vmci_transport_send_control_pkt(pkt, src, dst, type, size,
++ mode, wait, proto, handle,
++ true);
++ kfree(pkt);
++
++ return err;
++}
++
+ static int
+ vmci_transport_send_control_pkt(struct sock *sk,
+ enum vmci_transport_packet_type type,
+@@ -281,9 +306,7 @@ vmci_transport_send_control_pkt(struct sock *sk,
+ u16 proto,
+ struct vmci_handle handle)
+ {
+- struct vmci_transport_packet *pkt;
+ struct vsock_sock *vsk;
+- int err;
+
+ vsk = vsock_sk(sk);
+
+@@ -293,17 +316,10 @@ vmci_transport_send_control_pkt(struct sock *sk,
+ if (!vsock_addr_bound(&vsk->remote_addr))
+ return -EINVAL;
+
+- pkt = kmalloc(sizeof(*pkt), GFP_KERNEL);
+- if (!pkt)
+- return -ENOMEM;
+-
+- err = __vmci_transport_send_control_pkt(pkt, &vsk->local_addr,
+- &vsk->remote_addr, type, size,
+- mode, wait, proto, handle,
+- true);
+- kfree(pkt);
+-
+- return err;
++ return vmci_transport_alloc_send_control_pkt(&vsk->local_addr,
++ &vsk->remote_addr,
++ type, size, mode,
++ wait, proto, handle);
+ }
+
+ static int vmci_transport_send_reset_bh(struct sockaddr_vm *dst,
+@@ -321,12 +337,29 @@ static int vmci_transport_send_reset_bh(struct sockaddr_vm *dst,
+ static int vmci_transport_send_reset(struct sock *sk,
+ struct vmci_transport_packet *pkt)
+ {
++ struct sockaddr_vm *dst_ptr;
++ struct sockaddr_vm dst;
++ struct vsock_sock *vsk;
++
+ if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST)
+ return 0;
+- return vmci_transport_send_control_pkt(sk,
+- VMCI_TRANSPORT_PACKET_TYPE_RST,
+- 0, 0, NULL, VSOCK_PROTO_INVALID,
+- VMCI_INVALID_HANDLE);
++
++ vsk = vsock_sk(sk);
++
++ if (!vsock_addr_bound(&vsk->local_addr))
++ return -EINVAL;
++
++ if (vsock_addr_bound(&vsk->remote_addr)) {
++ dst_ptr = &vsk->remote_addr;
++ } else {
++ vsock_addr_init(&dst, pkt->dg.src.context,
++ pkt->src_port);
++ dst_ptr = &dst;
++ }
++ return vmci_transport_alloc_send_control_pkt(&vsk->local_addr, dst_ptr,
++ VMCI_TRANSPORT_PACKET_TYPE_RST,
++ 0, 0, NULL, VSOCK_PROTO_INVALID,
++ VMCI_INVALID_HANDLE);
+ }
+
+ static int vmci_transport_send_negotiate(struct sock *sk, size_t size)
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-027-xen-netfront-tolerate-frags-with-no-data.patch b/patches.kernel.org/4.4.170-027-xen-netfront-tolerate-frags-with-no-data.patch
new file mode 100644
index 0000000000..e90747ca8f
--- /dev/null
+++ b/patches.kernel.org/4.4.170-027-xen-netfront-tolerate-frags-with-no-data.patch
@@ -0,0 +1,41 @@
+From: Juergen Gross <jgross@suse.com>
+Date: Tue, 18 Dec 2018 16:06:19 +0100
+Subject: [PATCH] xen/netfront: tolerate frags with no data
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: d81c5054a5d1d4999c7cdead7636b6cd4af83d36
+
+[ Upstream commit d81c5054a5d1d4999c7cdead7636b6cd4af83d36 ]
+
+At least old Xen net backends seem to send frags with no real data
+sometimes. In case such a fragment happens to occur with the frag limit
+already reached the frontend will BUG currently even if this situation
+is easily recoverable.
+
+Modify the BUG_ON() condition accordingly.
+
+Tested-by: Dietmar Hahn <dietmar.hahn@ts.fujitsu.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/xen-netfront.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 0a4bd73caae5..6f55ab4f7959 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -889,7 +889,7 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
+ if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) {
+ unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
+
+- BUG_ON(pull_to <= skb_headlen(skb));
++ BUG_ON(pull_to < skb_headlen(skb));
+ __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
+ }
+ if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-028-gro_cell-add-napi_disable-in-gro_cells_destro.patch b/patches.kernel.org/4.4.170-028-gro_cell-add-napi_disable-in-gro_cells_destro.patch
new file mode 100644
index 0000000000..1d01b29b85
--- /dev/null
+++ b/patches.kernel.org/4.4.170-028-gro_cell-add-napi_disable-in-gro_cells_destro.patch
@@ -0,0 +1,83 @@
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Wed, 19 Dec 2018 23:23:00 +0100
+Subject: [PATCH] gro_cell: add napi_disable in gro_cells_destroy
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 8e1da73acded4751a93d4166458a7e640f37d26c
+
+[ Upstream commit 8e1da73acded4751a93d4166458a7e640f37d26c ]
+
+Add napi_disable routine in gro_cells_destroy since starting from
+commit c42858eaf492 ("gro_cells: remove spinlock protecting receive
+queues") gro_cell_poll and gro_cells_destroy can run concurrently on
+napi_skbs list producing a kernel Oops if the tunnel interface is
+removed while gro_cell_poll is running. The following Oops has been
+triggered removing a vxlan device while the interface is receiving
+traffic
+
+[ 5628.948853] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
+[ 5628.949981] PGD 0 P4D 0
+[ 5628.950308] Oops: 0002 [#1] SMP PTI
+[ 5628.950748] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.20.0-rc6+ #41
+[ 5628.952940] RIP: 0010:gro_cell_poll+0x49/0x80
+[ 5628.955615] RSP: 0018:ffffc9000004fdd8 EFLAGS: 00010202
+[ 5628.956250] RAX: 0000000000000000 RBX: ffffe8ffffc08150 RCX: 0000000000000000
+[ 5628.957102] RDX: 0000000000000000 RSI: ffff88802356bf00 RDI: ffffe8ffffc08150
+[ 5628.957940] RBP: 0000000000000026 R08: 0000000000000000 R09: 0000000000000000
+[ 5628.958803] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000040
+[ 5628.959661] R13: ffffe8ffffc08100 R14: 0000000000000000 R15: 0000000000000040
+[ 5628.960682] FS: 0000000000000000(0000) GS:ffff88803ea00000(0000) knlGS:0000000000000000
+[ 5628.961616] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 5628.962359] CR2: 0000000000000008 CR3: 000000000221c000 CR4: 00000000000006b0
+[ 5628.963188] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 5628.964034] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 5628.964871] Call Trace:
+[ 5628.965179] net_rx_action+0xf0/0x380
+[ 5628.965637] __do_softirq+0xc7/0x431
+[ 5628.966510] run_ksoftirqd+0x24/0x30
+[ 5628.966957] smpboot_thread_fn+0xc5/0x160
+[ 5628.967436] kthread+0x113/0x130
+[ 5628.968283] ret_from_fork+0x3a/0x50
+[ 5628.968721] Modules linked in:
+[ 5628.969099] CR2: 0000000000000008
+[ 5628.969510] ---[ end trace 9d9dedc7181661fe ]---
+[ 5628.970073] RIP: 0010:gro_cell_poll+0x49/0x80
+[ 5628.972965] RSP: 0018:ffffc9000004fdd8 EFLAGS: 00010202
+[ 5628.973611] RAX: 0000000000000000 RBX: ffffe8ffffc08150 RCX: 0000000000000000
+[ 5628.974504] RDX: 0000000000000000 RSI: ffff88802356bf00 RDI: ffffe8ffffc08150
+[ 5628.975462] RBP: 0000000000000026 R08: 0000000000000000 R09: 0000000000000000
+[ 5628.976413] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000040
+[ 5628.977375] R13: ffffe8ffffc08100 R14: 0000000000000000 R15: 0000000000000040
+[ 5628.978296] FS: 0000000000000000(0000) GS:ffff88803ea00000(0000) knlGS:0000000000000000
+[ 5628.979327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 5628.980044] CR2: 0000000000000008 CR3: 000000000221c000 CR4: 00000000000006b0
+[ 5628.980929] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 5628.981736] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 5628.982409] Kernel panic - not syncing: Fatal exception in interrupt
+[ 5628.983307] Kernel Offset: disabled
+
+Fixes: c42858eaf492 ("gro_cells: remove spinlock protecting receive queues")
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/net/gro_cells.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h
+index cf6c74550baa..86316f90ea1e 100644
+--- a/include/net/gro_cells.h
++++ b/include/net/gro_cells.h
+@@ -84,6 +84,7 @@ static inline void gro_cells_destroy(struct gro_cells *gcells)
+ for_each_possible_cpu(i) {
+ struct gro_cell *cell = per_cpu_ptr(gcells->cells, i);
+
++ napi_disable(&cell->napi);
+ netif_napi_del(&cell->napi);
+ __skb_queue_purge(&cell->napi_skbs);
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-029-sock-Make-sock-sk_stamp-thread-safe.patch b/patches.kernel.org/4.4.170-029-sock-Make-sock-sk_stamp-thread-safe.patch
new file mode 100644
index 0000000000..1e4497d9ae
--- /dev/null
+++ b/patches.kernel.org/4.4.170-029-sock-Make-sock-sk_stamp-thread-safe.patch
@@ -0,0 +1,192 @@
+From: Deepa Dinamani <deepa.kernel@gmail.com>
+Date: Thu, 27 Dec 2018 18:55:09 -0800
+Subject: [PATCH] sock: Make sock->sk_stamp thread-safe
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 3a0ed3e9619738067214871e9cb826fa23b2ddb9
+
+[ Upstream commit 3a0ed3e9619738067214871e9cb826fa23b2ddb9 ]
+
+Al Viro mentioned (Message-ID
+<20170626041334.GZ10672@ZenIV.linux.org.uk>)
+that there is probably a race condition
+lurking in accesses of sk_stamp on 32-bit machines.
+
+sock->sk_stamp is of type ktime_t which is always an s64.
+On a 32 bit architecture, we might run into situations of
+unsafe access as the access to the field becomes non atomic.
+
+Use seqlocks for synchronization.
+This allows us to avoid using spinlocks for readers as
+readers do not need mutual exclusion.
+
+Another approach to solve this is to require sk_lock for all
+modifications of the timestamps. The current approach allows
+for timestamps to have their own lock: sk_stamp_lock.
+This allows for the patch to not compete with already
+existing critical sections, and side effects are limited
+to the paths in the patch.
+
+The addition of the new field maintains the data locality
+optimizations from
+commit 9115e8cd2a0c ("net: reorganize struct sock for better data
+locality")
+
+Note that all the instances of the sk_stamp accesses
+are either through the ioctl or the syscall recvmsg.
+
+Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/net/sock.h | 36 ++++++++++++++++++++++++++++++++++--
+ net/compat.c | 15 +++++++++------
+ net/core/sock.c | 3 +++
+ net/sunrpc/svcsock.c | 2 +-
+ 4 files changed, 47 insertions(+), 9 deletions(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 577075713ad5..7420299c31f5 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -299,6 +299,7 @@ struct cg_proto;
+ * @sk_filter: socket filtering instructions
+ * @sk_timer: sock cleanup timer
+ * @sk_stamp: time stamp of last packet received
++ * @sk_stamp_seq: lock for accessing sk_stamp on 32 bit architectures only
+ * @sk_tsflags: SO_TIMESTAMPING socket options
+ * @sk_tskey: counter to disambiguate concurrent tstamp requests
+ * @sk_socket: Identd and reporting IO signals
+@@ -434,6 +435,9 @@ struct sock {
+ long sk_sndtimeo;
+ struct timer_list sk_timer;
+ ktime_t sk_stamp;
++#if BITS_PER_LONG==32
++ seqlock_t sk_stamp_seq;
++#endif
+ u16 sk_tsflags;
+ u32 sk_tskey;
+ struct socket *sk_socket;
+@@ -2146,6 +2150,34 @@ static inline void sk_drops_add(struct sock *sk, const struct sk_buff *skb)
+ atomic_add(segs, &sk->sk_drops);
+ }
+
++static inline ktime_t sock_read_timestamp(struct sock *sk)
++{
++#if BITS_PER_LONG==32
++ unsigned int seq;
++ ktime_t kt;
++
++ do {
++ seq = read_seqbegin(&sk->sk_stamp_seq);
++ kt = sk->sk_stamp;
++ } while (read_seqretry(&sk->sk_stamp_seq, seq));
++
++ return kt;
++#else
++ return sk->sk_stamp;
++#endif
++}
++
++static inline void sock_write_timestamp(struct sock *sk, ktime_t kt)
++{
++#if BITS_PER_LONG==32
++ write_seqlock(&sk->sk_stamp_seq);
++ sk->sk_stamp = kt;
++ write_sequnlock(&sk->sk_stamp_seq);
++#else
++ sk->sk_stamp = kt;
++#endif
++}
++
+ void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
+ struct sk_buff *skb);
+ void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
+@@ -2170,7 +2202,7 @@ sock_recv_timestamp(struct msghdr *msg, struct sock *sk, struct sk_buff *skb)
+ (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE)))
+ __sock_recv_timestamp(msg, sk, skb);
+ else
+- sk->sk_stamp = kt;
++ sock_write_timestamp(sk, kt);
+
+ if (sock_flag(sk, SOCK_WIFI_STATUS) && skb->wifi_acked_valid)
+ __sock_recv_wifi_status(msg, sk, skb);
+@@ -2190,7 +2222,7 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
+ if (sk->sk_flags & FLAGS_TS_OR_DROPS || sk->sk_tsflags & TSFLAGS_ANY)
+ __sock_recv_ts_and_drops(msg, sk, skb);
+ else
+- sk->sk_stamp = skb->tstamp;
++ sock_write_timestamp(sk, skb->tstamp);
+ }
+
+ void __sock_tx_timestamp(const struct sock *sk, __u8 *tx_flags);
+diff --git a/net/compat.c b/net/compat.c
+index 17e97b106458..d67684010455 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -443,12 +443,14 @@ int compat_sock_get_timestamp(struct sock *sk, struct timeval __user *userstamp)
+ err = -ENOENT;
+ if (!sock_flag(sk, SOCK_TIMESTAMP))
+ sock_enable_timestamp(sk, SOCK_TIMESTAMP);
+- tv = ktime_to_timeval(sk->sk_stamp);
++ tv = ktime_to_timeval(sock_read_timestamp(sk));
++
+ if (tv.tv_sec == -1)
+ return err;
+ if (tv.tv_sec == 0) {
+- sk->sk_stamp = ktime_get_real();
+- tv = ktime_to_timeval(sk->sk_stamp);
++ ktime_t kt = ktime_get_real();
++ sock_write_timestamp(sk, kt);
++ tv = ktime_to_timeval(kt);
+ }
+ err = 0;
+ if (put_user(tv.tv_sec, &ctv->tv_sec) ||
+@@ -471,12 +473,13 @@ int compat_sock_get_timestampns(struct sock *sk, struct timespec __user *usersta
+ err = -ENOENT;
+ if (!sock_flag(sk, SOCK_TIMESTAMP))
+ sock_enable_timestamp(sk, SOCK_TIMESTAMP);
+- ts = ktime_to_timespec(sk->sk_stamp);
++ ts = ktime_to_timespec(sock_read_timestamp(sk));
+ if (ts.tv_sec == -1)
+ return err;
+ if (ts.tv_sec == 0) {
+- sk->sk_stamp = ktime_get_real();
+- ts = ktime_to_timespec(sk->sk_stamp);
++ ktime_t kt = ktime_get_real();
++ sock_write_timestamp(sk, kt);
++ ts = ktime_to_timespec(kt);
+ }
+ err = 0;
+ if (put_user(ts.tv_sec, &ctv->tv_sec) ||
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 4238835a0e4e..9fb1c073d0c4 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2423,6 +2423,9 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+ sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
+
+ sk->sk_stamp = ktime_set(-1L, 0);
++#if BITS_PER_LONG==32
++ seqlock_init(&sk->sk_stamp_seq);
++#endif
+
+ #ifdef CONFIG_NET_RX_BUSY_POLL
+ sk->sk_napi_id = 0;
+diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
+index 1413cdcc131c..9701fcca002c 100644
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -614,7 +614,7 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
+ /* Don't enable netstamp, sunrpc doesn't
+ need that much accuracy */
+ }
+- svsk->sk_sk->sk_stamp = skb->tstamp;
++ sock_write_timestamp(svsk->sk_sk, skb->tstamp);
+ set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags); /* there may be more data... */
+
+ len = skb->len - sizeof(struct udphdr);
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-030-ALSA-rme9652-Fix-potential-Spectre-v1-vulnera.patch b/patches.kernel.org/4.4.170-030-ALSA-rme9652-Fix-potential-Spectre-v1-vulnera.patch
new file mode 100644
index 0000000000..a28abcca22
--- /dev/null
+++ b/patches.kernel.org/4.4.170-030-ALSA-rme9652-Fix-potential-Spectre-v1-vulnera.patch
@@ -0,0 +1,76 @@
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Tue, 18 Dec 2018 11:18:34 -0600
+Subject: [PATCH] ALSA: rme9652: Fix potential Spectre v1 vulnerability
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 0b84304ef5da92add8dc75a1b07879c5374cdb05
+
+commit 0b84304ef5da92add8dc75a1b07879c5374cdb05 upstream.
+
+info->channel is indirectly controlled by user-space, hence leading to
+a potential exploitation of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+sound/pci/rme9652/hdsp.c:4100 snd_hdsp_channel_info() warn: potential spectre issue 'hdsp->channel_map' [r] (local cap)
+
+Fix this by sanitizing info->channel before using it to index hdsp->channel_map
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+Also, notice that I refactored the code a bit in order to get rid of the
+following checkpatch warning:
+
+ERROR: do not use assignment in if condition
+FILE: sound/pci/rme9652/hdsp.c:4103:
+ if ((mapped_channel = hdsp->channel_map[info->channel]) < 0)
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ sound/pci/rme9652/hdsp.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
+index 7c8941b8b2de..dd6c9e6a1d53 100644
+--- a/sound/pci/rme9652/hdsp.c
++++ b/sound/pci/rme9652/hdsp.c
+@@ -30,6 +30,7 @@
+ #include <linux/math64.h>
+ #include <linux/vmalloc.h>
+ #include <linux/io.h>
++#include <linux/nospec.h>
+
+ #include <sound/core.h>
+ #include <sound/control.h>
+@@ -4065,15 +4066,16 @@ static int snd_hdsp_channel_info(struct snd_pcm_substream *substream,
+ struct snd_pcm_channel_info *info)
+ {
+ struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+- int mapped_channel;
++ unsigned int channel = info->channel;
+
+- if (snd_BUG_ON(info->channel >= hdsp->max_channels))
++ if (snd_BUG_ON(channel >= hdsp->max_channels))
+ return -EINVAL;
++ channel = array_index_nospec(channel, hdsp->max_channels);
+
+- if ((mapped_channel = hdsp->channel_map[info->channel]) < 0)
++ if (hdsp->channel_map[channel] < 0)
+ return -EINVAL;
+
+- info->offset = mapped_channel * HDSP_CHANNEL_BUFFER_BYTES;
++ info->offset = hdsp->channel_map[channel] * HDSP_CHANNEL_BUFFER_BYTES;
+ info->first = 0;
+ info->step = 32;
+ return 0;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-031-ALSA-emu10k1-Fix-potential-Spectre-v1-vulnera.patch b/patches.kernel.org/4.4.170-031-ALSA-emu10k1-Fix-potential-Spectre-v1-vulnera.patch
new file mode 100644
index 0000000000..315998c849
--- /dev/null
+++ b/patches.kernel.org/4.4.170-031-ALSA-emu10k1-Fix-potential-Spectre-v1-vulnera.patch
@@ -0,0 +1,67 @@
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Tue, 18 Dec 2018 11:52:16 -0600
+Subject: [PATCH] ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 5ae4f61f012a097df93de2285070ec8e34716d29
+
+commit 5ae4f61f012a097df93de2285070ec8e34716d29 upstream.
+
+ipcm->substream is indirectly controlled by user-space, hence leading to
+a potential exploitation of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+sound/pci/emu10k1/emufx.c:1031 snd_emu10k1_ipcm_poke() warn: potential spectre issue 'emu->fx8010.pcm' [r] (local cap)
+sound/pci/emu10k1/emufx.c:1075 snd_emu10k1_ipcm_peek() warn: potential spectre issue 'emu->fx8010.pcm' [r] (local cap)
+
+Fix this by sanitizing ipcm->substream before using it to index emu->fx8010.pcm
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ sound/pci/emu10k1/emufx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
+index 50b216fc369f..5d422d65e62b 100644
+--- a/sound/pci/emu10k1/emufx.c
++++ b/sound/pci/emu10k1/emufx.c
+@@ -36,6 +36,7 @@
+ #include <linux/init.h>
+ #include <linux/mutex.h>
+ #include <linux/moduleparam.h>
++#include <linux/nospec.h>
+
+ #include <sound/core.h>
+ #include <sound/tlv.h>
+@@ -1000,6 +1001,8 @@ static int snd_emu10k1_ipcm_poke(struct snd_emu10k1 *emu,
+
+ if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT)
+ return -EINVAL;
++ ipcm->substream = array_index_nospec(ipcm->substream,
++ EMU10K1_FX8010_PCM_COUNT);
+ if (ipcm->channels > 32)
+ return -EINVAL;
+ pcm = &emu->fx8010.pcm[ipcm->substream];
+@@ -1046,6 +1049,8 @@ static int snd_emu10k1_ipcm_peek(struct snd_emu10k1 *emu,
+
+ if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT)
+ return -EINVAL;
++ ipcm->substream = array_index_nospec(ipcm->substream,
++ EMU10K1_FX8010_PCM_COUNT);
+ pcm = &emu->fx8010.pcm[ipcm->substream];
+ mutex_lock(&emu->fx8010.lock);
+ spin_lock_irq(&emu->reg_lock);
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-032-ALSA-pcm-Fix-potential-Spectre-v1-vulnerabili.patch b/patches.kernel.org/4.4.170-032-ALSA-pcm-Fix-potential-Spectre-v1-vulnerabili.patch
new file mode 100644
index 0000000000..7bfb372de5
--- /dev/null
+++ b/patches.kernel.org/4.4.170-032-ALSA-pcm-Fix-potential-Spectre-v1-vulnerabili.patch
@@ -0,0 +1,56 @@
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 12 Dec 2018 15:36:28 -0600
+Subject: [PATCH] ALSA: pcm: Fix potential Spectre v1 vulnerability
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 94ffb030b6d31ec840bb811be455dd2e26a4f43e
+
+commit 94ffb030b6d31ec840bb811be455dd2e26a4f43e upstream.
+
+stream is indirectly controlled by user-space, hence leading to
+a potential exploitation of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+sound/core/pcm.c:140 snd_pcm_control_ioctl() warn: potential spectre issue 'pcm->streams' [r] (local cap)
+
+Fix this by sanitizing stream before using it to index pcm->streams
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ sound/core/pcm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/core/pcm.c b/sound/core/pcm.c
+index 6bda8f6c5f84..cdff5f976480 100644
+--- a/sound/core/pcm.c
++++ b/sound/core/pcm.c
+@@ -25,6 +25,7 @@
+ #include <linux/time.h>
+ #include <linux/mutex.h>
+ #include <linux/device.h>
++#include <linux/nospec.h>
+ #include <sound/core.h>
+ #include <sound/minors.h>
+ #include <sound/pcm.h>
+@@ -125,6 +126,7 @@ static int snd_pcm_control_ioctl(struct snd_card *card,
+ return -EFAULT;
+ if (stream < 0 || stream > 1)
+ return -EINVAL;
++ stream = array_index_nospec(stream, 2);
+ if (get_user(subdevice, &info->subdevice))
+ return -EFAULT;
+ mutex_lock(&register_mutex);
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-033-ALSA-emux-Fix-potential-Spectre-v1-vulnerabil.patch b/patches.kernel.org/4.4.170-033-ALSA-emux-Fix-potential-Spectre-v1-vulnerabil.patch
new file mode 100644
index 0000000000..ec3bde23a3
--- /dev/null
+++ b/patches.kernel.org/4.4.170-033-ALSA-emux-Fix-potential-Spectre-v1-vulnerabil.patch
@@ -0,0 +1,74 @@
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 12 Dec 2018 11:20:49 -0600
+Subject: [PATCH] ALSA: emux: Fix potential Spectre v1 vulnerabilities
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 4aea96f4237cea0c51a8bc87c0db31f0f932f1f0
+
+commit 4aea96f4237cea0c51a8bc87c0db31f0f932f1f0 upstream.
+
+info.mode and info.port are indirectly controlled by user-space,
+hence leading to a potential exploitation of the Spectre variant 1
+vulnerability.
+
+These issues were detected with the help of Smatch:
+
+sound/synth/emux/emux_hwdep.c:72 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[i]->ctrls' [w] (local cap)
+sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs' [w] (local cap)
+sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[info.port]->ctrls' [w] (local cap)
+
+Fix this by sanitizing both info.mode and info.port before using them
+to index emu->portptrs[i]->ctrls, emu->portptrs[info.port]->ctrls and
+emu->portptrs.
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ sound/synth/emux/emux_hwdep.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/synth/emux/emux_hwdep.c b/sound/synth/emux/emux_hwdep.c
+index e557946718a9..d9fcae071b47 100644
+--- a/sound/synth/emux/emux_hwdep.c
++++ b/sound/synth/emux/emux_hwdep.c
+@@ -22,9 +22,9 @@
+ #include <sound/core.h>
+ #include <sound/hwdep.h>
+ #include <linux/uaccess.h>
++#include <linux/nospec.h>
+ #include "emux_voice.h"
+
+-
+ #define TMP_CLIENT_ID 0x1001
+
+ /*
+@@ -66,13 +66,16 @@ snd_emux_hwdep_misc_mode(struct snd_emux *emu, void __user *arg)
+ return -EFAULT;
+ if (info.mode < 0 || info.mode >= EMUX_MD_END)
+ return -EINVAL;
++ info.mode = array_index_nospec(info.mode, EMUX_MD_END);
+
+ if (info.port < 0) {
+ for (i = 0; i < emu->num_ports; i++)
+ emu->portptrs[i]->ctrls[info.mode] = info.value;
+ } else {
+- if (info.port < emu->num_ports)
++ if (info.port < emu->num_ports) {
++ info.port = array_index_nospec(info.port, emu->num_ports);
+ emu->portptrs[info.port]->ctrls[info.mode] = info.value;
++ }
+ }
+ return 0;
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-034-ALSA-hda-add-mute-LED-support-for-HP-EliteBoo.patch b/patches.kernel.org/4.4.170-034-ALSA-hda-add-mute-LED-support-for-HP-EliteBoo.patch
new file mode 100644
index 0000000000..ef3103a76b
--- /dev/null
+++ b/patches.kernel.org/4.4.170-034-ALSA-hda-add-mute-LED-support-for-HP-EliteBoo.patch
@@ -0,0 +1,41 @@
+From: =?UTF-8?q?Mantas=20Mikul=C4=97nas?= <grawity@gmail.com>
+Date: Sun, 16 Dec 2018 15:44:47 +0200
+Subject: [PATCH] ALSA: hda: add mute LED support for HP EliteBook 840 G4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 40906ebe3af6a48457151b3c6726b480f6a6cb13
+
+commit 40906ebe3af6a48457151b3c6726b480f6a6cb13 upstream.
+
+Tested with 4.19.9.
+
+v2: Changed from CXT_FIXUP_MUTE_LED_GPIO to CXT_FIXUP_HP_DOCK because
+ that's what the existing fixups for EliteBooks use.
+
+Signed-off-by: Mantas Mikulėnas <grawity@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index aea3cc2abe3a..536184ac315d 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -853,6 +853,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
++ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-035-ALSA-hda-tegra-clear-pending-irq-handlers.patch b/patches.kernel.org/4.4.170-035-ALSA-hda-tegra-clear-pending-irq-handlers.patch
new file mode 100644
index 0000000000..e4093a3f7d
--- /dev/null
+++ b/patches.kernel.org/4.4.170-035-ALSA-hda-tegra-clear-pending-irq-handlers.patch
@@ -0,0 +1,48 @@
+From: Sameer Pujar <spujar@nvidia.com>
+Date: Wed, 26 Dec 2018 16:04:49 +0530
+Subject: [PATCH] ALSA: hda/tegra: clear pending irq handlers
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 63d2a9ec310d8bcc955574220d4631aa55c1a80c
+
+commit 63d2a9ec310d8bcc955574220d4631aa55c1a80c upstream.
+
+Even after disabling interrupts on the module, it could be possible
+that irq handlers are still running. System hang is seen during
+suspend path. It was found that, there were pending writes on the
+HDA bus and clock was disabled by that time.
+
+Above mentioned issue is fixed by clearing any pending irq handlers
+before disabling clocks and returning from hda suspend.
+
+Suggested-by: Mohan Kumar <mkumard@nvidia.com>
+Suggested-by: Dara Ramesh <dramesh@nvidia.com>
+Signed-off-by: Sameer Pujar <spujar@nvidia.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ sound/pci/hda/hda_tegra.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
+index 17fd81736d3d..039fbbb1e53c 100644
+--- a/sound/pci/hda/hda_tegra.c
++++ b/sound/pci/hda/hda_tegra.c
+@@ -249,10 +249,12 @@ static int hda_tegra_suspend(struct device *dev)
+ struct snd_card *card = dev_get_drvdata(dev);
+ struct azx *chip = card->private_data;
+ struct hda_tegra *hda = container_of(chip, struct hda_tegra, chip);
++ struct hdac_bus *bus = azx_bus(chip);
+
+ snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
+
+ azx_stop_chip(chip);
++ synchronize_irq(bus->irq);
+ azx_enter_link_reset(chip);
+ hda_tegra_disable_clocks(hda);
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-036-USB-serial-pl2303-add-ids-for-Hewlett-Packard.patch b/patches.kernel.org/4.4.170-036-USB-serial-pl2303-add-ids-for-Hewlett-Packard.patch
new file mode 100644
index 0000000000..03a460300b
--- /dev/null
+++ b/patches.kernel.org/4.4.170-036-USB-serial-pl2303-add-ids-for-Hewlett-Packard.patch
@@ -0,0 +1,69 @@
+From: Scott Chen <scott@labau.com.tw>
+Date: Thu, 13 Dec 2018 06:01:47 -0500
+Subject: [PATCH] USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole
+ displays
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 8d503f206c336677954160ac62f0c7d9c219cd89
+
+commit 8d503f206c336677954160ac62f0c7d9c219cd89 upstream.
+
+Add device ids to pl2303 for the HP POS pole displays:
+LM920: 03f0:026b
+TD620: 03f0:0956
+LD960TA: 03f0:4439
+LD220TA: 03f0:4349
+LM940: 03f0:5039
+
+Signed-off-by: Scott Chen <scott@labau.com.tw>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/usb/serial/pl2303.c | 5 +++++
+ drivers/usb/serial/pl2303.h | 5 +++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 3da25ad267a2..4966768d3c98 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -86,9 +86,14 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
+ { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) },
+ { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
+ { USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
+ { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 123289085ee2..a84f0959ab34 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -123,10 +123,15 @@
+
+ /* Hewlett-Packard POS Pole Displays */
+ #define HP_VENDOR_ID 0x03f0
++#define HP_LM920_PRODUCT_ID 0x026b
++#define HP_TD620_PRODUCT_ID 0x0956
+ #define HP_LD960_PRODUCT_ID 0x0b39
+ #define HP_LCM220_PRODUCT_ID 0x3139
+ #define HP_LCM960_PRODUCT_ID 0x3239
+ #define HP_LD220_PRODUCT_ID 0x3524
++#define HP_LD220TA_PRODUCT_ID 0x4349
++#define HP_LD960TA_PRODUCT_ID 0x4439
++#define HP_LM940_PRODUCT_ID 0x5039
+
+ /* Cressi Edy (diving computer) PC interface */
+ #define CRESSI_VENDOR_ID 0x04b8
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-037-USB-serial-option-add-Fibocom-NL678-series.patch b/patches.kernel.org/4.4.170-037-USB-serial-option-add-Fibocom-NL678-series.patch
new file mode 100644
index 0000000000..9d07704c7e
--- /dev/null
+++ b/patches.kernel.org/4.4.170-037-USB-serial-option-add-Fibocom-NL678-series.patch
@@ -0,0 +1,72 @@
+From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
+Date: Fri, 21 Dec 2018 14:40:44 +0100
+Subject: [PATCH] USB: serial: option: add Fibocom NL678 series
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 4b2c01ad902ec02fa962b233decd2f14be3714ba
+
+commit 4b2c01ad902ec02fa962b233decd2f14be3714ba upstream.
+
+Added USB serial option driver support for Fibocom NL678 series cellular
+module: VID 2cb7 and PIDs 0x0104 and 0x0105.
+Reserved network and ADB interfaces.
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=2cb7 ProdID=0104 Rev=03.10
+S: Manufacturer=Fibocom
+S: Product=Fibocom NL678-E Modem
+S: SerialNumber=12345678
+C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=2cb7 ProdID=0105 Rev=03.10
+S: Manufacturer=Fibocom
+S: Product=Fibocom NL678-E Modem
+S: SerialNumber=12345678
+C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+
+Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 1e3445dd84b2..7bc2c9fef605 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1956,6 +1956,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
+ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */
+ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
++ { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */
++ .driver_info = RSVD(4) | RSVD(5) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */
++ .driver_info = RSVD(6) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-038-usb-r8a66597-Fix-a-possible-concurrency-use-a.patch b/patches.kernel.org/4.4.170-038-usb-r8a66597-Fix-a-possible-concurrency-use-a.patch
new file mode 100644
index 0000000000..9668882407
--- /dev/null
+++ b/patches.kernel.org/4.4.170-038-usb-r8a66597-Fix-a-possible-concurrency-use-a.patch
@@ -0,0 +1,73 @@
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Tue, 18 Dec 2018 20:04:25 +0800
+Subject: [PATCH] usb: r8a66597: Fix a possible concurrency use-after-free bug
+ in r8a66597_endpoint_disable()
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: c85400f886e3d41e69966470879f635a2b50084c
+
+commit c85400f886e3d41e69966470879f635a2b50084c upstream.
+
+The function r8a66597_endpoint_disable() and r8a66597_urb_enqueue() may
+be concurrently executed.
+The two functions both access a possible shared variable "hep->hcpriv".
+
+This shared variable is freed by r8a66597_endpoint_disable() via the
+call path:
+r8a66597_endpoint_disable
+ kfree(hep->hcpriv) (line 1995 in Linux-4.19)
+
+This variable is read by r8a66597_urb_enqueue() via the call path:
+r8a66597_urb_enqueue
+ spin_lock_irqsave(&r8a66597->lock)
+ init_pipe_info
+ enable_r8a66597_pipe
+ pipe = hep->hcpriv (line 802 in Linux-4.19)
+
+The read operation is protected by a spinlock, but the free operation
+is not protected by this spinlock, thus a concurrency use-after-free bug
+may occur.
+
+To fix this bug, the spin-lock and spin-unlock function calls in
+r8a66597_endpoint_disable() are moved to protect the free operation.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/usb/host/r8a66597-hcd.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
+index a11c2c8bda53..a217f71b45c6 100644
+--- a/drivers/usb/host/r8a66597-hcd.c
++++ b/drivers/usb/host/r8a66597-hcd.c
+@@ -1990,6 +1990,8 @@ static int r8a66597_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
+
+ static void r8a66597_endpoint_disable(struct usb_hcd *hcd,
+ struct usb_host_endpoint *hep)
++__acquires(r8a66597->lock)
++__releases(r8a66597->lock)
+ {
+ struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
+ struct r8a66597_pipe *pipe = (struct r8a66597_pipe *)hep->hcpriv;
+@@ -2002,13 +2004,14 @@ static void r8a66597_endpoint_disable(struct usb_hcd *hcd,
+ return;
+ pipenum = pipe->info.pipenum;
+
++ spin_lock_irqsave(&r8a66597->lock, flags);
+ if (pipenum == 0) {
+ kfree(hep->hcpriv);
+ hep->hcpriv = NULL;
++ spin_unlock_irqrestore(&r8a66597->lock, flags);
+ return;
+ }
+
+- spin_lock_irqsave(&r8a66597->lock, flags);
+ pipe_stop(r8a66597, pipe);
+ pipe_irq_disable(r8a66597, pipenum);
+ disable_irq_empty(r8a66597, pipenum);
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-039-Input-elan_i2c-add-ACPI-ID-for-touchpad-in-AS.patch b/patches.kernel.org/4.4.170-039-Input-elan_i2c-add-ACPI-ID-for-touchpad-in-AS.patch
new file mode 100644
index 0000000000..f43389f72a
--- /dev/null
+++ b/patches.kernel.org/4.4.170-039-Input-elan_i2c-add-ACPI-ID-for-touchpad-in-AS.patch
@@ -0,0 +1,37 @@
+From: Patrick Dreyer <Patrick@Dreyer.name>
+Date: Sun, 23 Dec 2018 10:06:35 -0800
+Subject: [PATCH] Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire
+ F5-573G
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 7db54c89f0b30a101584e09d3729144e6170059d
+
+commit 7db54c89f0b30a101584e09d3729144e6170059d upstream.
+
+This adds ELAN0501 to the ACPI table to support Elan touchpad found in ASUS
+Aspire F5-573G.
+
+Signed-off-by: Patrick Dreyer <Patrick.Dreyer@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/input/mouse/elan_i2c_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index 471984ec2db0..30adc5745cba 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1240,6 +1240,7 @@ MODULE_DEVICE_TABLE(i2c, elan_id);
+ static const struct acpi_device_id elan_acpi_id[] = {
+ { "ELAN0000", 0 },
+ { "ELAN0100", 0 },
++ { "ELAN0501", 0 },
+ { "ELAN0600", 0 },
+ { "ELAN0602", 0 },
+ { "ELAN0605", 0 },
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-040-KVM-x86-Use-jmp-to-invoke-kvm_spurious_fault-.patch b/patches.kernel.org/4.4.170-040-KVM-x86-Use-jmp-to-invoke-kvm_spurious_fault-.patch
new file mode 100644
index 0000000000..e2f6310bd3
--- /dev/null
+++ b/patches.kernel.org/4.4.170-040-KVM-x86-Use-jmp-to-invoke-kvm_spurious_fault-.patch
@@ -0,0 +1,141 @@
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Thu, 20 Dec 2018 14:21:08 -0800
+Subject: [PATCH] KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: e81434995081fd7efb755fd75576b35dbb0850b1
+
+commit e81434995081fd7efb755fd75576b35dbb0850b1 upstream.
+
+____kvm_handle_fault_on_reboot() provides a generic exception fixup
+handler that is used to cleanly handle faults on VMX/SVM instructions
+during reboot (or at least try to). If there isn't a reboot in
+progress, ____kvm_handle_fault_on_reboot() treats any exception as
+fatal to KVM and invokes kvm_spurious_fault(), which in turn generates
+a BUG() to get a stack trace and die.
+
+When it was originally added by commit 4ecac3fd6dc2 ("KVM: Handle
+virtualization instruction #UD faults during reboot"), the "call" to
+kvm_spurious_fault() was handcoded as PUSH+JMP, where the PUSH'd value
+is the RIP of the faulting instructing.
+
+The PUSH+JMP trickery is necessary because the exception fixup handler
+code lies outside of its associated function, e.g. right after the
+function. An actual CALL from the .fixup code would show a slightly
+bogus stack trace, e.g. an extra "random" function would be inserted
+into the trace, as the return RIP on the stack would point to no known
+function (and the unwinder will likely try to guess who owns the RIP).
+
+Unfortunately, the JMP was replaced with a CALL when the macro was
+reworked to not spin indefinitely during reboot (commit b7c4145ba2eb
+"KVM: Don't spin on virt instruction faults during reboot"). This
+causes the aforementioned behavior where a bogus function is inserted
+into the stack trace, e.g. my builds like to blame free_kvm_area().
+
+Revert the CALL back to a JMP. The changelog for commit b7c4145ba2eb
+("KVM: Don't spin on virt instruction faults during reboot") contains
+nothing that indicates the switch to CALL was deliberate. This is
+backed up by the fact that the PUSH <insn RIP> was left intact.
+
+Note that an alternative to the PUSH+JMP magic would be to JMP back
+to the "real" code and CALL from there, but that would require adding
+a JMP in the non-faulting path to avoid calling kvm_spurious_fault()
+and would add no value, i.e. the stack trace would be the same.
+
+Using CALL:
+
+------------[ cut here ]------------
+kernel BUG at /home/sean/go/src/kernel.org/linux/arch/x86/kvm/x86.c:356!
+invalid opcode: 0000 [#1] SMP
+CPU: 4 PID: 1057 Comm: qemu-system-x86 Not tainted 4.20.0-rc6+ #75
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
+RIP: 0010:kvm_spurious_fault+0x5/0x10 [kvm]
+Code: <0f> 0b 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 55 49 89 fd 41
+RSP: 0018:ffffc900004bbcc8 EFLAGS: 00010046
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffffffffff
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+RBP: ffff888273fd8000 R08: 00000000000003e8 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000784 R12: ffffc90000371fb0
+R13: 0000000000000000 R14: 000000026d763cf4 R15: ffff888273fd8000
+FS: 00007f3d69691700(0000) GS:ffff888277800000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 000055f89bc56fe0 CR3: 0000000271a5a001 CR4: 0000000000362ee0
+Call Trace:
+ free_kvm_area+0x1044/0x43ea [kvm_intel]
+ ? vmx_vcpu_run+0x156/0x630 [kvm_intel]
+ ? kvm_arch_vcpu_ioctl_run+0x447/0x1a40 [kvm]
+ ? kvm_vcpu_ioctl+0x368/0x5c0 [kvm]
+ ? kvm_vcpu_ioctl+0x368/0x5c0 [kvm]
+ ? __set_task_blocked+0x38/0x90
+ ? __set_current_blocked+0x50/0x60
+ ? __fpu__restore_sig+0x97/0x490
+ ? do_vfs_ioctl+0xa1/0x620
+ ? __x64_sys_futex+0x89/0x180
+ ? ksys_ioctl+0x66/0x70
+ ? __x64_sys_ioctl+0x16/0x20
+ ? do_syscall_64+0x4f/0x100
+ ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
+Modules linked in: vhost_net vhost tap kvm_intel kvm irqbypass bridge stp llc
+---[ end trace 9775b14b123b1713 ]---
+
+Using JMP:
+
+------------[ cut here ]------------
+kernel BUG at /home/sean/go/src/kernel.org/linux/arch/x86/kvm/x86.c:356!
+invalid opcode: 0000 [#1] SMP
+CPU: 6 PID: 1067 Comm: qemu-system-x86 Not tainted 4.20.0-rc6+ #75
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
+RIP: 0010:kvm_spurious_fault+0x5/0x10 [kvm]
+Code: <0f> 0b 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 55 49 89 fd 41
+RSP: 0018:ffffc90000497cd0 EFLAGS: 00010046
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffffffffff
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+RBP: ffff88827058bd40 R08: 00000000000003e8 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000784 R12: ffffc90000369fb0
+R13: 0000000000000000 R14: 00000003c8fc6642 R15: ffff88827058bd40
+FS: 00007f3d7219e700(0000) GS:ffff888277900000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f3d64001000 CR3: 0000000271c6b004 CR4: 0000000000362ee0
+Call Trace:
+ vmx_vcpu_run+0x156/0x630 [kvm_intel]
+ ? kvm_arch_vcpu_ioctl_run+0x447/0x1a40 [kvm]
+ ? kvm_vcpu_ioctl+0x368/0x5c0 [kvm]
+ ? kvm_vcpu_ioctl+0x368/0x5c0 [kvm]
+ ? __set_task_blocked+0x38/0x90
+ ? __set_current_blocked+0x50/0x60
+ ? __fpu__restore_sig+0x97/0x490
+ ? do_vfs_ioctl+0xa1/0x620
+ ? __x64_sys_futex+0x89/0x180
+ ? ksys_ioctl+0x66/0x70
+ ? __x64_sys_ioctl+0x16/0x20
+ ? do_syscall_64+0x4f/0x100
+ ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
+Modules linked in: vhost_net vhost tap kvm_intel kvm irqbypass bridge stp llc
+---[ end trace f9daedb85ab3ddba ]---
+
+Fixes: b7c4145ba2eb ("KVM: Don't spin on virt instruction faults during reboot")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/x86/include/asm/kvm_host.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index c048d0d70cc4..2cb49ac1b2b2 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1200,7 +1200,7 @@ asmlinkage void kvm_spurious_fault(void);
+ "cmpb $0, kvm_rebooting \n\t" \
+ "jne 668b \n\t" \
+ __ASM_SIZE(push) " $666b \n\t" \
+- "call kvm_spurious_fault \n\t" \
++ "jmp kvm_spurious_fault \n\t" \
+ ".popsection \n\t" \
+ _ASM_EXTABLE(666b, 667b)
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-041-perf-pmu-Suppress-potential-format-truncation.patch b/patches.kernel.org/4.4.170-041-perf-pmu-Suppress-potential-format-truncation.patch
new file mode 100644
index 0000000000..a885ff8200
--- /dev/null
+++ b/patches.kernel.org/4.4.170-041-perf-pmu-Suppress-potential-format-truncation.patch
@@ -0,0 +1,81 @@
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Sun, 11 Nov 2018 18:45:24 +0000
+Subject: [PATCH] perf pmu: Suppress potential format-truncation warning
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 11a64a05dc649815670b1be9fe63d205cb076401
+
+commit 11a64a05dc649815670b1be9fe63d205cb076401 upstream.
+
+Depending on which functions are inlined in util/pmu.c, the snprintf()
+calls in perf_pmu__parse_{scale,unit,per_pkg,snapshot}() might trigger a
+warning:
+
+ util/pmu.c: In function 'pmu_aliases':
+ util/pmu.c:178:31: error: '%s' directive output may be truncated writing up to 255 bytes into a region of size between 0 and 4095 [-Werror=format-truncation=]
+ snprintf(path, PATH_MAX, "%s/%s.unit", dir, name);
+ ^~
+
+I found this when trying to build perf from Linux 3.16 with gcc 8.
+However I can reproduce the problem in mainline if I force
+__perf_pmu__new_alias() to be inlined.
+
+Suppress this by using scnprintf() as has been done elsewhere in perf.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: stable@vger.kernel.org
+Link: http://lkml.kernel.org/r/20181111184524.fux4taownc6ndbx6@decadent.org.uk
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ tools/perf/util/pmu.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index 593066c68e3d..4f650ebd564a 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -100,7 +100,7 @@ static int perf_pmu__parse_scale(struct perf_pmu_alias *alias, char *dir, char *
+ char path[PATH_MAX];
+ const char *lc;
+
+- snprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
++ scnprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1)
+@@ -147,7 +147,7 @@ static int perf_pmu__parse_unit(struct perf_pmu_alias *alias, char *dir, char *n
+ ssize_t sret;
+ int fd;
+
+- snprintf(path, PATH_MAX, "%s/%s.unit", dir, name);
++ scnprintf(path, PATH_MAX, "%s/%s.unit", dir, name);
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1)
+@@ -177,7 +177,7 @@ perf_pmu__parse_per_pkg(struct perf_pmu_alias *alias, char *dir, char *name)
+ char path[PATH_MAX];
+ int fd;
+
+- snprintf(path, PATH_MAX, "%s/%s.per-pkg", dir, name);
++ scnprintf(path, PATH_MAX, "%s/%s.per-pkg", dir, name);
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1)
+@@ -195,7 +195,7 @@ static int perf_pmu__parse_snapshot(struct perf_pmu_alias *alias,
+ char path[PATH_MAX];
+ int fd;
+
+- snprintf(path, PATH_MAX, "%s/%s.snapshot", dir, name);
++ scnprintf(path, PATH_MAX, "%s/%s.snapshot", dir, name);
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1)
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-042-ext4-fix-possible-use-after-free-in-ext4_quot.patch b/patches.kernel.org/4.4.170-042-ext4-fix-possible-use-after-free-in-ext4_quot.patch
new file mode 100644
index 0000000000..839ca4c7ed
--- /dev/null
+++ b/patches.kernel.org/4.4.170-042-ext4-fix-possible-use-after-free-in-ext4_quot.patch
@@ -0,0 +1,42 @@
+From: Pan Bian <bianpan2016@163.com>
+Date: Mon, 3 Dec 2018 23:28:02 -0500
+Subject: [PATCH] ext4: fix possible use after free in ext4_quota_enable
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 61157b24e60fb3cd1f85f2c76a7b1d628f970144
+
+commit 61157b24e60fb3cd1f85f2c76a7b1d628f970144 upstream.
+
+The function frees qf_inode via iput but then pass qf_inode to
+lockdep_set_quota_inode on the failure path. This may result in a
+use-after-free bug. The patch frees df_inode only when it is never used.
+
+Fixes: daf647d2dd5 ("ext4: add lockdep annotations for i_data_sem")
+Cc: stable@kernel.org # 4.6
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/ext4/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index cd9cd581fd92..62a6b75969cf 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5184,9 +5184,9 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
+ qf_inode->i_flags |= S_NOQUOTA;
+ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA);
+ err = dquot_enable(qf_inode, type, format_id, flags);
+- iput(qf_inode);
+ if (err)
+ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL);
++ iput(qf_inode);
+
+ return err;
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-043-ext4-missing-unlock-put_page-in-ext4_try_to_w.patch b/patches.kernel.org/4.4.170-043-ext4-missing-unlock-put_page-in-ext4_try_to_w.patch
new file mode 100644
index 0000000000..8b00b9a607
--- /dev/null
+++ b/patches.kernel.org/4.4.170-043-ext4-missing-unlock-put_page-in-ext4_try_to_w.patch
@@ -0,0 +1,43 @@
+From: Maurizio Lombardi <mlombard@redhat.com>
+Date: Tue, 4 Dec 2018 00:06:53 -0500
+Subject: [PATCH] ext4: missing unlock/put_page() in
+ ext4_try_to_write_inline_data()
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 132d00becb31e88469334e1e62751c81345280e0
+
+commit 132d00becb31e88469334e1e62751c81345280e0 upstream.
+
+In case of error, ext4_try_to_write_inline_data() should unlock
+and release the page it holds.
+
+Fixes: f19d5870cbf7 ("ext4: add normal write support for inline data")
+Cc: stable@kernel.org # 3.8
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/ext4/inline.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 1aec46733ef8..46d4fac48cf4 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -701,8 +701,11 @@ int ext4_try_to_write_inline_data(struct address_space *mapping,
+
+ if (!PageUptodate(page)) {
+ ret = ext4_read_inline_page(inode, page);
+- if (ret < 0)
++ if (ret < 0) {
++ unlock_page(page);
++ put_page(page);
+ goto out_up_read;
++ }
+ }
+
+ ret = 1;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-044-ext4-fix-EXT4_IOC_GROUP_ADD-ioctl.patch b/patches.kernel.org/4.4.170-044-ext4-fix-EXT4_IOC_GROUP_ADD-ioctl.patch
new file mode 100644
index 0000000000..6983fbfaa1
--- /dev/null
+++ b/patches.kernel.org/4.4.170-044-ext4-fix-EXT4_IOC_GROUP_ADD-ioctl.patch
@@ -0,0 +1,45 @@
+From: =?UTF-8?q?ruippan=20=28=E6=BD=98=E7=9D=BF=29?= <ruippan@tencent.com>
+Date: Tue, 4 Dec 2018 01:04:12 -0500
+Subject: [PATCH] ext4: fix EXT4_IOC_GROUP_ADD ioctl
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: e647e29196b7f802f8242c39ecb7cc937f5ef217
+
+commit e647e29196b7f802f8242c39ecb7cc937f5ef217 upstream.
+
+Commit e2b911c53584 ("ext4: clean up feature test macros with
+predicate functions") broke the EXT4_IOC_GROUP_ADD ioctl. This was
+not noticed since only very old versions of resize2fs (before
+e2fsprogs 1.42) use this ioctl. However, using a new kernel with an
+enterprise Linux userspace will cause attempts to use online resize to
+fail with "No reserved GDT blocks".
+
+Fixes: e2b911c53584 ("ext4: clean up feature test macros with predicate...")
+Cc: stable@kernel.org # v4.4
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: ruippan (潘睿) <ruippan@tencent.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/ext4/resize.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index bad13f049fb0..2fc1564f62dd 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1600,7 +1600,7 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
+ }
+
+ if (reserved_gdb || gdb_off == 0) {
+- if (ext4_has_feature_resize_inode(sb) ||
++ if (!ext4_has_feature_resize_inode(sb) ||
+ !le16_to_cpu(es->s_reserved_gdt_blocks)) {
+ ext4_warning(sb,
+ "No reserved GDT blocks, can't resize");
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-045-ext4-force-inode-writes-when-nfsd-calls-commi.patch b/patches.kernel.org/4.4.170-045-ext4-force-inode-writes-when-nfsd-calls-commi.patch
new file mode 100644
index 0000000000..a0adffcf72
--- /dev/null
+++ b/patches.kernel.org/4.4.170-045-ext4-force-inode-writes-when-nfsd-calls-commi.patch
@@ -0,0 +1,93 @@
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 19 Dec 2018 14:07:58 -0500
+Subject: [PATCH] ext4: force inode writes when nfsd calls commit_metadata()
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: fde872682e175743e0c3ef939c89e3c6008a1529
+
+commit fde872682e175743e0c3ef939c89e3c6008a1529 upstream.
+
+Some time back, nfsd switched from calling vfs_fsync() to using a new
+commit_metadata() hook in export_operations(). If the file system did
+not provide a commit_metadata() hook, it fell back to using
+sync_inode_metadata(). Unfortunately doesn't work on all file
+systems. In particular, it doesn't work on ext4 due to how the inode
+gets journalled --- the VFS writeback code will not always call
+ext4_write_inode().
+
+So we need to provide our own ext4_nfs_commit_metdata() method which
+calls ext4_write_inode() directly.
+
+Google-Bug-Id: 121195940
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/ext4/super.c | 11 +++++++++++
+ include/trace/events/ext4.h | 20 ++++++++++++++++++++
+ 2 files changed, 31 insertions(+)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 62a6b75969cf..6a7df72cb3da 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1049,6 +1049,16 @@ static struct dentry *ext4_fh_to_parent(struct super_block *sb, struct fid *fid,
+ ext4_nfs_get_inode);
+ }
+
++static int ext4_nfs_commit_metadata(struct inode *inode)
++{
++ struct writeback_control wbc = {
++ .sync_mode = WB_SYNC_ALL
++ };
++
++ trace_ext4_nfs_commit_metadata(inode);
++ return ext4_write_inode(inode, &wbc);
++}
++
+ /*
+ * Try to release metadata pages (indirect blocks, directories) which are
+ * mapped via the block device. Since these pages could have journal heads
+@@ -1143,6 +1153,7 @@ static const struct export_operations ext4_export_ops = {
+ .fh_to_dentry = ext4_fh_to_dentry,
+ .fh_to_parent = ext4_fh_to_parent,
+ .get_parent = ext4_get_parent,
++ .commit_metadata = ext4_nfs_commit_metadata,
+ };
+
+ enum {
+diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h
+index 594b4b29a224..7ef11b97cb2a 100644
+--- a/include/trace/events/ext4.h
++++ b/include/trace/events/ext4.h
+@@ -223,6 +223,26 @@ TRACE_EVENT(ext4_drop_inode,
+ (unsigned long) __entry->ino, __entry->drop)
+ );
+
++TRACE_EVENT(ext4_nfs_commit_metadata,
++ TP_PROTO(struct inode *inode),
++
++ TP_ARGS(inode),
++
++ TP_STRUCT__entry(
++ __field( dev_t, dev )
++ __field( ino_t, ino )
++ ),
++
++ TP_fast_assign(
++ __entry->dev = inode->i_sb->s_dev;
++ __entry->ino = inode->i_ino;
++ ),
++
++ TP_printk("dev %d,%d ino %lu",
++ MAJOR(__entry->dev), MINOR(__entry->dev),
++ (unsigned long) __entry->ino)
++);
++
+ TRACE_EVENT(ext4_mark_inode_dirty,
+ TP_PROTO(struct inode *inode, unsigned long IP),
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-046-spi-bcm2835-Fix-race-on-DMA-termination.patch b/patches.kernel.org/4.4.170-046-spi-bcm2835-Fix-race-on-DMA-termination.patch
new file mode 100644
index 0000000000..438d96da60
--- /dev/null
+++ b/patches.kernel.org/4.4.170-046-spi-bcm2835-Fix-race-on-DMA-termination.patch
@@ -0,0 +1,67 @@
+From: Lukas Wunner <lukas@wunner.de>
+Date: Thu, 8 Nov 2018 08:06:10 +0100
+Subject: [PATCH] spi: bcm2835: Fix race on DMA termination
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: e82b0b3828451c1cd331d9f304c6078fcd43b62e
+
+commit e82b0b3828451c1cd331d9f304c6078fcd43b62e upstream.
+
+If a DMA transfer finishes orderly right when spi_transfer_one_message()
+determines that it has timed out, the callbacks bcm2835_spi_dma_done()
+and bcm2835_spi_handle_err() race to call dmaengine_terminate_all(),
+potentially leading to double termination.
+
+Prevent by atomically changing the dma_pending flag before calling
+dmaengine_terminate_all().
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Fixes: 3ecd37edaa2a ("spi: bcm2835: enable dma modes for transfers meeting certain conditions")
+Cc: stable@vger.kernel.org # v4.2+
+Cc: Mathias Duckeck <m.duckeck@kunbus.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+Cc: Martin Sperl <kernel@martin.sperl.org>
+Cc: Noralf Trønnes <noralf@tronnes.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/spi/spi-bcm2835.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index cf04960cc3e6..62875d855627 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -233,10 +233,9 @@ static void bcm2835_spi_dma_done(void *data)
+ * is called the tx-dma must have finished - can't get to this
+ * situation otherwise...
+ */
+- dmaengine_terminate_all(master->dma_tx);
+-
+- /* mark as no longer pending */
+- bs->dma_pending = 0;
++ if (cmpxchg(&bs->dma_pending, true, false)) {
++ dmaengine_terminate_all(master->dma_tx);
++ }
+
+ /* and mark as completed */;
+ complete(&master->xfer_completion);
+@@ -617,10 +616,9 @@ static void bcm2835_spi_handle_err(struct spi_master *master,
+ struct bcm2835_spi *bs = spi_master_get_devdata(master);
+
+ /* if an error occurred and we have an active dma, then terminate */
+- if (bs->dma_pending) {
++ if (cmpxchg(&bs->dma_pending, true, false)) {
+ dmaengine_terminate_all(master->dma_tx);
+ dmaengine_terminate_all(master->dma_rx);
+- bs->dma_pending = 0;
+ }
+ /* and reset */
+ bcm2835_spi_reset_hw(master);
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-047-spi-bcm2835-Fix-book-keeping-of-DMA-terminati.patch b/patches.kernel.org/4.4.170-047-spi-bcm2835-Fix-book-keeping-of-DMA-terminati.patch
new file mode 100644
index 0000000000..27062809cc
--- /dev/null
+++ b/patches.kernel.org/4.4.170-047-spi-bcm2835-Fix-book-keeping-of-DMA-terminati.patch
@@ -0,0 +1,50 @@
+From: Lukas Wunner <lukas@wunner.de>
+Date: Thu, 8 Nov 2018 08:06:10 +0100
+Subject: [PATCH] spi: bcm2835: Fix book-keeping of DMA termination
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: dbc944115eed48af110646992893dc43321368d8
+
+commit dbc944115eed48af110646992893dc43321368d8 upstream.
+
+If submission of a DMA TX transfer succeeds but submission of the
+corresponding RX transfer does not, the BCM2835 SPI driver terminates
+the TX transfer but neglects to reset the dma_pending flag to false.
+
+Thus, if the next transfer uses interrupt mode (because it is shorter
+than BCM2835_SPI_DMA_MIN_LENGTH) and runs into a timeout,
+dmaengine_terminate_all() will be called both for TX (once more) and
+for RX (which was never started in the first place). Fix it.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Fixes: 3ecd37edaa2a ("spi: bcm2835: enable dma modes for transfers meeting certain conditions")
+Cc: stable@vger.kernel.org # v4.2+
+Cc: Mathias Duckeck <m.duckeck@kunbus.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+Cc: Martin Sperl <kernel@martin.sperl.org>
+Cc: Noralf Trønnes <noralf@tronnes.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/spi/spi-bcm2835.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index 62875d855627..bb0ea7b578d1 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -341,6 +341,7 @@ static int bcm2835_spi_transfer_one_dma(struct spi_master *master,
+ if (ret) {
+ /* need to reset on errors */
+ dmaengine_terminate_all(master->dma_tx);
++ bs->dma_pending = false;
+ bcm2835_spi_reset_hw(master);
+ return ret;
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-048-spi-bcm2835-Avoid-finishing-transfer-prematur.patch b/patches.kernel.org/4.4.170-048-spi-bcm2835-Avoid-finishing-transfer-prematur.patch
new file mode 100644
index 0000000000..39b6953854
--- /dev/null
+++ b/patches.kernel.org/4.4.170-048-spi-bcm2835-Avoid-finishing-transfer-prematur.patch
@@ -0,0 +1,66 @@
+From: Lukas Wunner <lukas@wunner.de>
+Date: Thu, 8 Nov 2018 08:06:10 +0100
+Subject: [PATCH] spi: bcm2835: Avoid finishing transfer prematurely in IRQ
+ mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 56c1723426d3cfd4723bfbfce531d7b38bae6266
+
+commit 56c1723426d3cfd4723bfbfce531d7b38bae6266 upstream.
+
+The IRQ handler bcm2835_spi_interrupt() first reads as much as possible
+from the RX FIFO, then writes as much as possible to the TX FIFO.
+Afterwards it decides whether the transfer is finished by checking if
+the TX FIFO is empty.
+
+If very few bytes were written to the TX FIFO, they may already have
+been transmitted by the time the FIFO's emptiness is checked. As a
+result, the transfer will be declared finished and the chip will be
+reset without reading the corresponding received bytes from the RX FIFO.
+
+The odds of this happening increase with a high clock frequency (such
+that the TX FIFO drains quickly) and either passing "threadirqs" on the
+command line or enabling CONFIG_PREEMPT_RT_BASE (such that the IRQ
+handler may be preempted between filling the TX FIFO and checking its
+emptiness).
+
+Fix by instead checking whether rx_len has reached zero, which means
+that the transfer has been received in full. This is also more
+efficient as it avoids one bus read access per interrupt. Note that
+bcm2835_spi_transfer_one_poll() likewise uses rx_len to determine
+whether the transfer has finished.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Fixes: e34ff011c70e ("spi: bcm2835: move to the transfer_one driver model")
+Cc: stable@vger.kernel.org # v4.1+
+Cc: Mathias Duckeck <m.duckeck@kunbus.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+Cc: Martin Sperl <kernel@martin.sperl.org>
+Cc: Noralf Trønnes <noralf@tronnes.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/spi/spi-bcm2835.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index bb0ea7b578d1..92f45b6fd278 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -155,8 +155,7 @@ static irqreturn_t bcm2835_spi_interrupt(int irq, void *dev_id)
+ /* Write as many bytes as possible to FIFO */
+ bcm2835_wr_fifo(bs);
+
+- /* based on flags decide if we can finish the transfer */
+- if (bcm2835_rd(bs, BCM2835_SPI_CS) & BCM2835_SPI_CS_DONE) {
++ if (!bs->rx_len) {
+ /* Transfer complete - reset SPI HW */
+ bcm2835_spi_reset_hw(master);
+ /* wake up the framework */
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-049-cdc-acm-fix-abnormal-DATA-RX-issue-for-Mediat.patch b/patches.kernel.org/4.4.170-049-cdc-acm-fix-abnormal-DATA-RX-issue-for-Mediat.patch
new file mode 100644
index 0000000000..154e590ff5
--- /dev/null
+++ b/patches.kernel.org/4.4.170-049-cdc-acm-fix-abnormal-DATA-RX-issue-for-Mediat.patch
@@ -0,0 +1,87 @@
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+Date: Wed, 19 Dec 2018 12:11:03 +0800
+Subject: [PATCH] cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: eafb27fa5283599ce6c5492ea18cf636a28222bb
+
+commit eafb27fa5283599ce6c5492ea18cf636a28222bb upstream.
+
+Mediatek Preloader is a proprietary embedded boot loader for loading
+Little Kernel and Linux into device DRAM.
+
+This boot loader also handle firmware update. Mediatek Preloader will be
+enumerated as a virtual COM port when the device is connected to Windows
+or Linux OS via CDC-ACM class driver. When the USB enumeration has been
+done, Mediatek Preloader will send out handshake command "READY" to PC
+actively instead of waiting command from the download tool.
+
+Since Linux 4.12, the commit "tty: reset termios state on device
+registration" (93857edd9829e144acb6c7e72d593f6e01aead66) causes Mediatek
+Preloader receiving some abnoraml command like "READYXX" as it sent.
+This will be recognized as an incorrect response. The behavior change
+also causes the download handshake fail. This change only affects
+subsequent connects if the reconnected device happens to get the same minor
+number.
+
+By disabling the ECHO termios flag could avoid this problem. However, it
+cannot be done by user space configuration when download tool open
+/dev/ttyACM0. This is because the device running Mediatek Preloader will
+send handshake command "READY" immediately once the CDC-ACM driver is
+ready.
+
+This patch wants to fix above problem by introducing "DISABLE_ECHO"
+property in driver_info. When Mediatek Preloader is connected, the
+CDC-ACM driver could disable ECHO flag in termios to avoid the problem.
+
+Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Johan Hovold <johan@kernel.org>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/usb/class/cdc-acm.c | 10 ++++++++++
+ drivers/usb/class/cdc-acm.h | 1 +
+ 2 files changed, 11 insertions(+)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 0a8e5ac891d4..3919ea066bf9 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -507,6 +507,13 @@ static int acm_tty_install(struct tty_driver *driver, struct tty_struct *tty)
+ if (retval)
+ goto error_init_termios;
+
++ /*
++ * Suppress initial echoing for some devices which might send data
++ * immediately after acm driver has been installed.
++ */
++ if (acm->quirks & DISABLE_ECHO)
++ tty->termios.c_lflag &= ~ECHO;
++
+ tty->driver_data = acm;
+
+ return 0;
+@@ -1677,6 +1684,9 @@ static const struct usb_device_id acm_ids[] = {
+ { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */
+ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+ },
++ { USB_DEVICE(0x0e8d, 0x2000), /* MediaTek Inc Preloader */
++ .driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */
++ },
+ { USB_DEVICE(0x0e8d, 0x3329), /* MediaTek Inc GPS */
+ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+ },
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index b30ac5fcde68..1ad9ff9f493d 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -134,3 +134,4 @@ struct acm {
+ #define QUIRK_CONTROL_LINE_STATE BIT(6)
+ #define CLEAR_HALT_CONDITIONS BIT(7)
+ #define SEND_ZERO_PACKET BIT(8)
++#define DISABLE_ECHO BIT(9)
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-050-media-vivid-free-bitmap_cap-when-updating-std.patch b/patches.kernel.org/4.4.170-050-media-vivid-free-bitmap_cap-when-updating-std.patch
new file mode 100644
index 0000000000..cb38a4d11a
--- /dev/null
+++ b/patches.kernel.org/4.4.170-050-media-vivid-free-bitmap_cap-when-updating-std.patch
@@ -0,0 +1,38 @@
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Date: Fri, 9 Nov 2018 08:37:44 -0500
+Subject: [PATCH] media: vivid: free bitmap_cap when updating std/timings/etc.
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 560ccb75c2caa6b1039dec1a53cd2ef526f5bf03
+
+commit 560ccb75c2caa6b1039dec1a53cd2ef526f5bf03 upstream.
+
+When vivid_update_format_cap() is called it should free any overlay
+bitmap since the compose size will change.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: syzbot+0cc8e3cc63ca373722c6@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org> # for v3.18 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/media/platform/vivid/vivid-vid-cap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
+index ef5412311b2f..a84954f1be34 100644
+--- a/drivers/media/platform/vivid/vivid-vid-cap.c
++++ b/drivers/media/platform/vivid/vivid-vid-cap.c
+@@ -461,6 +461,8 @@ void vivid_update_format_cap(struct vivid_dev *dev, bool keep_controls)
+ tpg_s_rgb_range(&dev->tpg, v4l2_ctrl_g_ctrl(dev->rgb_range_cap));
+ break;
+ }
++ vfree(dev->bitmap_cap);
++ dev->bitmap_cap = NULL;
+ vivid_update_quality(dev);
+ tpg_reset_source(&dev->tpg, dev->src_rect.width, dev->src_rect.height, dev->field_cap);
+ dev->crop_cap = dev->src_rect;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-051-MIPS-Ensure-pmd_present-returns-false-after-p.patch b/patches.kernel.org/4.4.170-051-MIPS-Ensure-pmd_present-returns-false-after-p.patch
new file mode 100644
index 0000000000..01f9b292af
--- /dev/null
+++ b/patches.kernel.org/4.4.170-051-MIPS-Ensure-pmd_present-returns-false-after-p.patch
@@ -0,0 +1,50 @@
+From: Huacai Chen <chenhc@lemote.com>
+Date: Thu, 15 Nov 2018 15:53:54 +0800
+Subject: [PATCH] MIPS: Ensure pmd_present() returns false after
+ pmd_mknotpresent()
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 92aa0718c9fa5160ad2f0e7b5bffb52f1ea1e51a
+
+commit 92aa0718c9fa5160ad2f0e7b5bffb52f1ea1e51a upstream.
+
+This patch is borrowed from ARM64 to ensure pmd_present() returns false
+after pmd_mknotpresent(). This is needed for THP.
+
+References: 5bb1cc0ff9a6 ("arm64: Ensure pmd_present() returns false after pmd_mknotpresent()")
+Reviewed-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/21135/
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <james.hogan@mips.com>
+Cc: Steven J . Hill <Steven.Hill@cavium.com>
+Cc: linux-mips@linux-mips.org
+Cc: Fuxin Zhang <zhangfx@lemote.com>
+Cc: Zhangjin Wu <wuzhangjin@gmail.com>
+Cc: <stable@vger.kernel.org> # 3.8+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/mips/include/asm/pgtable-64.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h
+index cf661a2fb141..16fade4f49dd 100644
+--- a/arch/mips/include/asm/pgtable-64.h
++++ b/arch/mips/include/asm/pgtable-64.h
+@@ -189,6 +189,11 @@ static inline int pmd_bad(pmd_t pmd)
+
+ static inline int pmd_present(pmd_t pmd)
+ {
++#ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
++ if (unlikely(pmd_val(pmd) & _PAGE_HUGE))
++ return pmd_val(pmd) & _PAGE_PRESENT;
++#endif
++
+ return pmd_val(pmd) != (unsigned long) invalid_pte_table;
+ }
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-052-MIPS-Align-kernel-load-address-to-64KB.patch b/patches.kernel.org/4.4.170-052-MIPS-Align-kernel-load-address-to-64KB.patch
new file mode 100644
index 0000000000..18e13e683b
--- /dev/null
+++ b/patches.kernel.org/4.4.170-052-MIPS-Align-kernel-load-address-to-64KB.patch
@@ -0,0 +1,62 @@
+From: Huacai Chen <chenhc@lemote.com>
+Date: Thu, 15 Nov 2018 15:53:56 +0800
+Subject: [PATCH] MIPS: Align kernel load address to 64KB
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: bec0de4cfad21bd284dbddee016ed1767a5d2823
+
+commit bec0de4cfad21bd284dbddee016ed1767a5d2823 upstream.
+
+KEXEC needs the new kernel's load address to be aligned on a page
+boundary (see sanity_check_segment_list()), but on MIPS the default
+vmlinuz load address is only explicitly aligned to 16 bytes.
+
+Since the largest PAGE_SIZE supported by MIPS kernels is 64KB, increase
+the alignment calculated by calc_vmlinuz_load_addr to 64KB.
+
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/21131/
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <james.hogan@mips.com>
+Cc: Steven J . Hill <Steven.Hill@cavium.com>
+Cc: linux-mips@linux-mips.org
+Cc: Fuxin Zhang <zhangfx@lemote.com>
+Cc: Zhangjin Wu <wuzhangjin@gmail.com>
+Cc: <stable@vger.kernel.org> # 2.6.36+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
+index 37fe58c19a90..542c3ede9722 100644
+--- a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
++++ b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
+@@ -13,6 +13,7 @@
+ #include <stdint.h>
+ #include <stdio.h>
+ #include <stdlib.h>
++#include "../../../../include/linux/sizes.h"
+
+ int main(int argc, char *argv[])
+ {
+@@ -45,11 +46,11 @@ int main(int argc, char *argv[])
+ vmlinuz_load_addr = vmlinux_load_addr + vmlinux_size;
+
+ /*
+- * Align with 16 bytes: "greater than that used for any standard data
+- * types by a MIPS compiler." -- See MIPS Run Linux (Second Edition).
++ * Align with 64KB: KEXEC needs load sections to be aligned to PAGE_SIZE,
++ * which may be as large as 64KB depending on the kernel configuration.
+ */
+
+- vmlinuz_load_addr += (16 - vmlinux_size % 16);
++ vmlinuz_load_addr += (SZ_64K - vmlinux_size % SZ_64K);
+
+ printf("0x%llx\n", vmlinuz_load_addr);
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-053-CIFS-Fix-error-mapping-for-SMB2_LOCK-command-.patch b/patches.kernel.org/4.4.170-053-CIFS-Fix-error-mapping-for-SMB2_LOCK-command-.patch
new file mode 100644
index 0000000000..072742ff9a
--- /dev/null
+++ b/patches.kernel.org/4.4.170-053-CIFS-Fix-error-mapping-for-SMB2_LOCK-command-.patch
@@ -0,0 +1,58 @@
+From: Georgy A Bystrenin <gkot@altlinux.org>
+Date: Fri, 21 Dec 2018 00:11:42 -0600
+Subject: [PATCH] CIFS: Fix error mapping for SMB2_LOCK command which caused
+ OFD lock problem
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 9a596f5b39593414c0ec80f71b94a226286f084e
+
+commit 9a596f5b39593414c0ec80f71b94a226286f084e upstream.
+
+While resolving a bug with locks on samba shares found a strange behavior.
+When a file locked by one node and we trying to lock it from another node
+it fail with errno 5 (EIO) but in that case errno must be set to
+(EACCES | EAGAIN).
+This isn't happening when we try to lock file second time on same node.
+In this case it returns EACCES as expected.
+Also this issue not reproduces when we use SMB1 protocol (vers=1.0 in
+mount options).
+
+Further investigation showed that the mapping from status_to_posix_error
+is different for SMB1 and SMB2+ implementations.
+For SMB1 mapping is [NT_STATUS_LOCK_NOT_GRANTED to ERRlock]
+(See fs/cifs/netmisc.c line 66)
+but for SMB2+ mapping is [STATUS_LOCK_NOT_GRANTED to -EIO]
+(see fs/cifs/smb2maperror.c line 383)
+
+Quick changes in SMB2+ mapping from EIO to EACCES has fixed issue.
+
+BUG: https://bugzilla.kernel.org/show_bug.cgi?id=201971
+
+Signed-off-by: Georgy A Bystrenin <gkot@altlinux.org>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/cifs/smb2maperror.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c
+index 8257a5a97cc0..98c25b969ab8 100644
+--- a/fs/cifs/smb2maperror.c
++++ b/fs/cifs/smb2maperror.c
+@@ -377,8 +377,8 @@ static const struct status_to_posix_error smb2_error_map_table[] = {
+ {STATUS_NONEXISTENT_EA_ENTRY, -EIO, "STATUS_NONEXISTENT_EA_ENTRY"},
+ {STATUS_NO_EAS_ON_FILE, -ENODATA, "STATUS_NO_EAS_ON_FILE"},
+ {STATUS_EA_CORRUPT_ERROR, -EIO, "STATUS_EA_CORRUPT_ERROR"},
+- {STATUS_FILE_LOCK_CONFLICT, -EIO, "STATUS_FILE_LOCK_CONFLICT"},
+- {STATUS_LOCK_NOT_GRANTED, -EIO, "STATUS_LOCK_NOT_GRANTED"},
++ {STATUS_FILE_LOCK_CONFLICT, -EACCES, "STATUS_FILE_LOCK_CONFLICT"},
++ {STATUS_LOCK_NOT_GRANTED, -EACCES, "STATUS_LOCK_NOT_GRANTED"},
+ {STATUS_DELETE_PENDING, -ENOENT, "STATUS_DELETE_PENDING"},
+ {STATUS_CTL_FILE_NOT_SUPPORTED, -ENOSYS,
+ "STATUS_CTL_FILE_NOT_SUPPORTED"},
+--
+2.20.1
+
diff --git a/patches.fixes/x86-kvm-vmx-do-not-use-vm-exit-instruction-length-fo.patch b/patches.kernel.org/4.4.170-054-x86-kvm-vmx-do-not-use-vm-exit-instruction-le.patch
index f85b8bb4c4..1a24412a9b 100644
--- a/patches.fixes/x86-kvm-vmx-do-not-use-vm-exit-instruction-length-fo.patch
+++ b/patches.kernel.org/4.4.170-054-x86-kvm-vmx-do-not-use-vm-exit-instruction-le.patch
@@ -1,13 +1,15 @@
-From d391f1207067268261add0485f0f34503539c5b0 Mon Sep 17 00:00:00 2001
From: Vitaly Kuznetsov <vkuznets@redhat.com>
Date: Thu, 25 Jan 2018 16:37:07 +0100
-Subject: [PATCH] x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when running nested
-Mime-version: 1.0
-Content-type: text/plain; charset=UTF-8
-Content-transfer-encoding: 8bit
+Subject: [PATCH] x86/kvm/vmx: do not use vm-exit instruction length for fast
+ MMIO when running nested
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Patch-mainline: 4.4.170
+References: bnc#1012382 bsc#1081431
Git-commit: d391f1207067268261add0485f0f34503539c5b0
-Patch-mainline: v4.16-rc1
-References: bsc#1081431
+
+commit d391f1207067268261add0485f0f34503539c5b0 upstream.
I was investigating an issue with seabios >= 1.10 which stopped working
for nested KVM on Hyper-V. The problem appears to be in
@@ -33,17 +35,21 @@ Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
-Signed-off-by: Matwey V. Kornilov <matwey.kornilov@gmail.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+[mhaboustak: backport to 4.9.y]
+Signed-off-by: Mike Haboustak <haboustak@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
- arch/x86/kvm/vmx.c | 19 +++++++++++++++++--
- arch/x86/kvm/x86.c | 3 ++-
+ arch/x86/kvm/vmx.c | 19 +++++++++++++++++--
+ arch/x86/kvm/x86.c | 3 ++-
2 files changed, 19 insertions(+), 3 deletions(-)
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index e4b5fd72ca24..3bdb2e747b89 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
-@@ -5986,9 +5986,24 @@ static int handle_ept_misconfig(struct k
+@@ -6163,9 +6163,24 @@ static int handle_ept_misconfig(struct kvm_vcpu *vcpu)
gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
if (!kvm_io_bus_write(vcpu, KVM_FAST_MMIO_BUS, gpa, 0, NULL)) {
@@ -51,28 +57,30 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
trace_kvm_fast_mmio(gpa);
- return 1;
+ /*
-+ * Doing kvm_skip_emulated_instruction() depends on undefined
-+ * behavior: Intel's manual doesn't mandate
-+ * VM_EXIT_INSTRUCTION_LEN to be set in VMCS when EPT MISCONFIG
-+ * occurs and while on real hardware it was observed to be set,
-+ * other hypervisors (namely Hyper-V) don't set it, we end up
-+ * advancing IP with some random value. Disable fast mmio when
-+ * running nested and keep it for real hardware in hope that
-+ * VM_EXIT_INSTRUCTION_LEN will always be set correctly.
-+ */
++ * Doing kvm_skip_emulated_instruction() depends on undefined
++ * behavior: Intel's manual doesn't mandate
++ * VM_EXIT_INSTRUCTION_LEN to be set in VMCS when EPT MISCONFIG
++ * occurs and while on real hardware it was observed to be set,
++ * other hypervisors (namely Hyper-V) don't set it, we end up
++ * advancing IP with some random value. Disable fast mmio when
++ * running nested and keep it for real hardware in hope that
++ * VM_EXIT_INSTRUCTION_LEN will always be set correctly.
++ */
+ if (!static_cpu_has(X86_FEATURE_HYPERVISOR)) {
+ skip_emulated_instruction(vcpu);
+ return 1;
-+ } else {
++ }
++ else
+ return x86_emulate_instruction(vcpu, gpa, EMULTYPE_SKIP,
+ NULL, 0) == EMULATE_DONE;
-+ }
}
ret = handle_mmio_page_fault(vcpu, gpa, true);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index aa1a0277a678..1a934bb8ed1c 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
-@@ -5408,7 +5408,8 @@ int x86_emulate_instruction(struct kvm_v
+@@ -5436,7 +5436,8 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
* handle watchpoints yet, those would be handled in
* the emulate_ops.
*/
@@ -82,3 +90,6 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
return r;
ctxt->interruptibility = 0;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-055-spi-bcm2835-Unbreak-the-build-of-esoteric-con.patch b/patches.kernel.org/4.4.170-055-spi-bcm2835-Unbreak-the-build-of-esoteric-con.patch
new file mode 100644
index 0000000000..fe24f342d3
--- /dev/null
+++ b/patches.kernel.org/4.4.170-055-spi-bcm2835-Unbreak-the-build-of-esoteric-con.patch
@@ -0,0 +1,47 @@
+From: Lukas Wunner <lukas@wunner.de>
+Date: Thu, 29 Nov 2018 15:14:49 +0100
+Subject: [PATCH] spi: bcm2835: Unbreak the build of esoteric configs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 29bdedfd9cf40e59456110ca417a8cb672ac9b92
+
+commit 29bdedfd9cf40e59456110ca417a8cb672ac9b92 upstream.
+
+Commit e82b0b382845 ("spi: bcm2835: Fix race on DMA termination") broke
+the build with COMPILE_TEST=y on arches whose cmpxchg() requires 32-bit
+operands (xtensa, older arm ISAs).
+
+Fix by changing the dma_pending flag's type from bool to unsigned int.
+
+Fixes: e82b0b382845 ("spi: bcm2835: Fix race on DMA termination")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+Cc: Martin Sperl <kernel@martin.sperl.org>
+Cc: Noralf Trønnes <noralf@tronnes.org>
+Cc: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/spi/spi-bcm2835.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index 92f45b6fd278..1a1368f5863c 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -88,7 +88,7 @@ struct bcm2835_spi {
+ u8 *rx_buf;
+ int tx_len;
+ int rx_len;
+- bool dma_pending;
++ unsigned int dma_pending;
+ };
+
+ static inline u32 bcm2835_rd(struct bcm2835_spi *bs, unsigned reg)
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-056-powerpc-Fix-COFF-zImage-booting-on-old-powerm.patch b/patches.kernel.org/4.4.170-056-powerpc-Fix-COFF-zImage-booting-on-old-powerm.patch
new file mode 100644
index 0000000000..60bb177616
--- /dev/null
+++ b/patches.kernel.org/4.4.170-056-powerpc-Fix-COFF-zImage-booting-on-old-powerm.patch
@@ -0,0 +1,59 @@
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Tue, 27 Nov 2018 09:01:54 +1100
+Subject: [PATCH] powerpc: Fix COFF zImage booting on old powermacs
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 5564597d51c8ff5b88d95c76255e18b13b760879
+
+[ Upstream commit 5564597d51c8ff5b88d95c76255e18b13b760879 ]
+
+Commit 6975a783d7b4 ("powerpc/boot: Allow building the zImage wrapper
+as a relocatable ET_DYN", 2011-04-12) changed the procedure descriptor
+at the start of crt0.S to have a hard-coded start address of 0x500000
+rather than a reference to _zimage_start, presumably because having
+a reference to a symbol introduced a relocation which is awkward to
+handle in a position-independent executable. Unfortunately, what is
+at 0x500000 in the COFF image is not the first instruction, but the
+procedure descriptor itself, that is, a word containing 0x500000,
+which is not a valid instruction. Hence, booting a COFF zImage
+results in a "DEFAULT CATCH!, code=FFF00700" message from Open
+Firmware.
+
+This fixes the problem by (a) putting the procedure descriptor in the
+data section and (b) adding a branch to _zimage_start as the first
+instruction in the program.
+
+Fixes: 6975a783d7b4 ("powerpc/boot: Allow building the zImage wrapper as a relocatable ET_DYN")
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/powerpc/boot/crt0.S | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S
+index 5c2199857aa8..a3550e8f1a77 100644
+--- a/arch/powerpc/boot/crt0.S
++++ b/arch/powerpc/boot/crt0.S
+@@ -15,7 +15,7 @@
+ RELA = 7
+ RELACOUNT = 0x6ffffff9
+
+- .text
++ .data
+ /* A procedure descriptor used when booting this as a COFF file.
+ * When making COFF, this comes first in the link and we're
+ * linked at 0x500000.
+@@ -23,6 +23,8 @@ RELACOUNT = 0x6ffffff9
+ .globl _zimage_start_opd
+ _zimage_start_opd:
+ .long 0x500000, 0, 0, 0
++ .text
++ b _zimage_start
+
+ #ifdef __powerpc64__
+ .balign 8
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-057-ARM-imx-update-the-cpu-power-up-timing-settin.patch b/patches.kernel.org/4.4.170-057-ARM-imx-update-the-cpu-power-up-timing-settin.patch
new file mode 100644
index 0000000000..6a50bbe816
--- /dev/null
+++ b/patches.kernel.org/4.4.170-057-ARM-imx-update-the-cpu-power-up-timing-settin.patch
@@ -0,0 +1,43 @@
+From: Anson Huang <anson.huang@nxp.com>
+Date: Tue, 4 Dec 2018 03:17:45 +0000
+Subject: [PATCH] ARM: imx: update the cpu power up timing setting on i.mx6sx
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 1e434b703248580b7aaaf8a115d93e682f57d29f
+
+[ Upstream commit 1e434b703248580b7aaaf8a115d93e682f57d29f ]
+
+The sw2iso count should cover ARM LDO ramp-up time,
+the MAX ARM LDO ramp-up time may be up to more than
+100us on some boards, this patch sets sw2iso to 0xf
+(~384us) which is the reset value, and it is much
+more safe to cover different boards, since we have
+observed that some customer boards failed with current
+setting of 0x2.
+
+Fixes: 05136f0897b5 ("ARM: imx: support arm power off in cpuidle for i.mx6sx")
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/arm/mach-imx/cpuidle-imx6sx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-imx/cpuidle-imx6sx.c b/arch/arm/mach-imx/cpuidle-imx6sx.c
+index 3c6672b3796b..7f5df8992008 100644
+--- a/arch/arm/mach-imx/cpuidle-imx6sx.c
++++ b/arch/arm/mach-imx/cpuidle-imx6sx.c
+@@ -97,7 +97,7 @@ int __init imx6sx_cpuidle_init(void)
+ * except for power up sw2iso which need to be
+ * larger than LDO ramp up time.
+ */
+- imx_gpc_set_arm_power_up_timing(2, 1);
++ imx_gpc_set_arm_power_up_timing(0xf, 1);
+ imx_gpc_set_arm_power_down_timing(1, 1);
+
+ return cpuidle_register(&imx6sx_cpuidle_driver, NULL);
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-058-Input-restore-EV_ABS-ABS_RESERVED.patch b/patches.kernel.org/4.4.170-058-Input-restore-EV_ABS-ABS_RESERVED.patch
new file mode 100644
index 0000000000..1be1144c2d
--- /dev/null
+++ b/patches.kernel.org/4.4.170-058-Input-restore-EV_ABS-ABS_RESERVED.patch
@@ -0,0 +1,46 @@
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 6 Dec 2018 09:03:36 +1000
+Subject: [PATCH] Input: restore EV_ABS ABS_RESERVED
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: c201e3808e0e4be9b98d192802085a9f491bd80c
+
+[ Upstream commit c201e3808e0e4be9b98d192802085a9f491bd80c ]
+
+ABS_RESERVED was added in d9ca1c990a7 and accidentally removed as part of
+ffe0e7cf290f5c9 when the high-resolution scrolling code was removed.
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Martin Kepplinger <martin.kepplinger@ginzinger.com>
+Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/uapi/linux/input-event-codes.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
+index 87cf351bab03..9e07bf4259e1 100644
+--- a/include/uapi/linux/input-event-codes.h
++++ b/include/uapi/linux/input-event-codes.h
+@@ -708,6 +708,15 @@
+
+ #define ABS_MISC 0x28
+
++/*
++ * 0x2e is reserved and should not be used in input drivers.
++ * It was used by HID as ABS_MISC+6 and userspace needs to detect if
++ * the next ABS_* event is correct or is just ABS_MISC + n.
++ * We define here ABS_RESERVED so userspace can rely on it and detect
++ * the situation described above.
++ */
++#define ABS_RESERVED 0x2e
++
+ #define ABS_MT_SLOT 0x2f /* MT slot being modified */
+ #define ABS_MT_TOUCH_MAJOR 0x30 /* Major axis of touching ellipse */
+ #define ABS_MT_TOUCH_MINOR 0x31 /* Minor axis (omit if circular) */
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-059-checkstack.pl-fix-for-aarch64.patch b/patches.kernel.org/4.4.170-059-checkstack.pl-fix-for-aarch64.patch
new file mode 100644
index 0000000000..cc39e4e4cc
--- /dev/null
+++ b/patches.kernel.org/4.4.170-059-checkstack.pl-fix-for-aarch64.patch
@@ -0,0 +1,49 @@
+From: Qian Cai <cai@lca.pw>
+Date: Fri, 14 Dec 2018 14:17:20 -0800
+Subject: [PATCH] checkstack.pl: fix for aarch64
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: f1733a1d3cd32a9492f4cf866be37bb46e10163d
+
+[ Upstream commit f1733a1d3cd32a9492f4cf866be37bb46e10163d ]
+
+There is actually a space after "sp," like this,
+
+ ffff2000080813c8: a9bb7bfd stp x29, x30, [sp, #-80]!
+
+Right now, checkstack.pl isn't able to print anything on aarch64,
+because it won't be able to match the stating objdump line of a function
+due to this missing space. Hence, it displays every stack as zero-size.
+
+After this patch, checkpatch.pl is able to match the start of a
+function's objdump, and is then able to calculate each function's stack
+correctly.
+
+Link: http://lkml.kernel.org/r/20181207195843.38528-1-cai@lca.pw
+Signed-off-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ scripts/checkstack.pl | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl
+index dd8397894d5c..12a6940741fe 100755
+--- a/scripts/checkstack.pl
++++ b/scripts/checkstack.pl
+@@ -46,8 +46,8 @@ my (@stack, $re, $dre, $x, $xs, $funcre);
+ $xs = "[0-9a-f ]"; # hex character or space
+ $funcre = qr/^$x* <(.*)>:$/;
+ if ($arch eq 'aarch64') {
+- #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp,#-80]!
+- $re = qr/^.*stp.*sp,\#-([0-9]{1,8})\]\!/o;
++ #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp, #-80]!
++ $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o;
+ } elsif ($arch eq 'arm') {
+ #c0008ffc: e24dd064 sub sp, sp, #100 ; 0x64
+ $re = qr/.*sub.*sp, sp, #(([0-9]{2}|[3-9])[0-9]{2})/o;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-060-xfrm-Fix-bucket-count-reported-to-userspace.patch b/patches.kernel.org/4.4.170-060-xfrm-Fix-bucket-count-reported-to-userspace.patch
new file mode 100644
index 0000000000..db67a06235
--- /dev/null
+++ b/patches.kernel.org/4.4.170-060-xfrm-Fix-bucket-count-reported-to-userspace.patch
@@ -0,0 +1,37 @@
+From: Benjamin Poirier <bpoirier@suse.com>
+Date: Mon, 5 Nov 2018 17:00:53 +0900
+Subject: [PATCH] xfrm: Fix bucket count reported to userspace
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: ca92e173ab34a4f7fc4128bd372bd96f1af6f507
+
+[ Upstream commit ca92e173ab34a4f7fc4128bd372bd96f1af6f507 ]
+
+sadhcnt is reported by `ip -s xfrm state count` as "buckets count", not the
+hash mask.
+
+Fixes: 28d8909bc790 ("[XFRM]: Export SAD info.")
+Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/xfrm/xfrm_state.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 9b6e51450fc5..13f261feb75c 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -623,7 +623,7 @@ void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
+ {
+ spin_lock_bh(&net->xfrm.xfrm_state_lock);
+ si->sadcnt = net->xfrm.state_num;
+- si->sadhcnt = net->xfrm.state_hmask;
++ si->sadhcnt = net->xfrm.state_hmask + 1;
+ si->sadhmcnt = xfrm_state_hashmax;
+ spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-061-scsi-bnx2fc-Fix-NULL-dereference-in-error-han.patch b/patches.kernel.org/4.4.170-061-scsi-bnx2fc-Fix-NULL-dereference-in-error-han.patch
new file mode 100644
index 0000000000..b833e1a875
--- /dev/null
+++ b/patches.kernel.org/4.4.170-061-scsi-bnx2fc-Fix-NULL-dereference-in-error-han.patch
@@ -0,0 +1,37 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 1 Nov 2018 08:25:30 +0300
+Subject: [PATCH] scsi: bnx2fc: Fix NULL dereference in error handling
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 9ae4f8420ed7be4b13c96600e3568c144d101a23
+
+[ Upstream commit 9ae4f8420ed7be4b13c96600e3568c144d101a23 ]
+
+If "interface" is NULL then we can't release it and trying to will only
+lead to an Oops.
+
+Fixes: aea71a024914 ("[SCSI] bnx2fc: Introduce interface structure for each vlan interface")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+index d0b227ffbd5f..573aeec7a02b 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+@@ -2279,7 +2279,7 @@ static int _bnx2fc_create(struct net_device *netdev,
+ if (!interface) {
+ printk(KERN_ERR PFX "bnx2fc_interface_create failed\n");
+ rc = -ENOMEM;
+- goto ifput_err;
++ goto netdev_err;
+ }
+
+ if (netdev->priv_flags & IFF_802_1Q_VLAN) {
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-062-Input-omap-keypad-fix-idle-configuration-to-n.patch b/patches.kernel.org/4.4.170-062-Input-omap-keypad-fix-idle-configuration-to-n.patch
new file mode 100644
index 0000000000..d0129cb3e1
--- /dev/null
+++ b/patches.kernel.org/4.4.170-062-Input-omap-keypad-fix-idle-configuration-to-n.patch
@@ -0,0 +1,86 @@
+From: Tony Lindgren <tony@atomide.com>
+Date: Tue, 4 Dec 2018 13:52:49 -0800
+Subject: [PATCH] Input: omap-keypad - fix idle configuration to not block SoC
+ idle states
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: e2ca26ec4f01486661b55b03597c13e2b9c18b73
+
+[ Upstream commit e2ca26ec4f01486661b55b03597c13e2b9c18b73 ]
+
+With PM enabled, I noticed that pressing a key on the droid4 keyboard will
+block deeper idle states for the SoC. Let's fix this by using IRQF_ONESHOT
+and stop constantly toggling the device OMAP4_KBD_IRQENABLE register as
+suggested by Dmitry Torokhov <dmitry.torokhov@gmail.com>.
+
+From the hardware point of view, looks like we need to manage the registers
+for OMAP4_KBD_IRQENABLE and OMAP4_KBD_WAKEUPENABLE together to avoid
+blocking deeper SoC idle states. And with toggling of OMAP4_KBD_IRQENABLE
+register now gone with IRQF_ONESHOT, also the SoC idle state problem is
+gone during runtime. We still also need to clear OMAP4_KBD_WAKEUPENABLE in
+omap4_keypad_close() though to pair it with omap4_keypad_open() to prevent
+blocking deeper SoC idle states after rmmod omap4-keypad.
+
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/input/keyboard/omap4-keypad.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index f78c464899db..3d2c60c8de83 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -126,12 +126,8 @@ static irqreturn_t omap4_keypad_irq_handler(int irq, void *dev_id)
+ {
+ struct omap4_keypad *keypad_data = dev_id;
+
+- if (kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)) {
+- /* Disable interrupts */
+- kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+- OMAP4_VAL_IRQDISABLE);
++ if (kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS))
+ return IRQ_WAKE_THREAD;
+- }
+
+ return IRQ_NONE;
+ }
+@@ -173,11 +169,6 @@ static irqreturn_t omap4_keypad_irq_thread_fn(int irq, void *dev_id)
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+ kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+
+- /* enable interrupts */
+- kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+- OMAP4_DEF_IRQENABLE_EVENTEN |
+- OMAP4_DEF_IRQENABLE_LONGKEY);
+-
+ return IRQ_HANDLED;
+ }
+
+@@ -214,9 +205,10 @@ static void omap4_keypad_close(struct input_dev *input)
+
+ disable_irq(keypad_data->irq);
+
+- /* Disable interrupts */
++ /* Disable interrupts and wake-up events */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+ OMAP4_VAL_IRQDISABLE);
++ kbd_writel(keypad_data, OMAP4_KBD_WAKEUPENABLE, 0);
+
+ /* clear pending interrupts */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+@@ -364,7 +356,7 @@ static int omap4_keypad_probe(struct platform_device *pdev)
+ }
+
+ error = request_threaded_irq(keypad_data->irq, omap4_keypad_irq_handler,
+- omap4_keypad_irq_thread_fn, 0,
++ omap4_keypad_irq_thread_fn, IRQF_ONESHOT,
+ "omap4-keypad", keypad_data);
+ if (error) {
+ dev_err(&pdev->dev, "failed to register interrupt\n");
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-063-scsi-zfcp-fix-posting-too-many-status-read-bu.patch b/patches.kernel.org/4.4.170-063-scsi-zfcp-fix-posting-too-many-status-read-bu.patch
new file mode 100644
index 0000000000..c7154b441c
--- /dev/null
+++ b/patches.kernel.org/4.4.170-063-scsi-zfcp-fix-posting-too-many-status-read-bu.patch
@@ -0,0 +1,98 @@
+From: Steffen Maier <maier@linux.ibm.com>
+Date: Thu, 6 Dec 2018 17:31:20 +0100
+Subject: [PATCH] scsi: zfcp: fix posting too many status read buffers leading
+ to adapter shutdown
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 60a161b7e5b2a252ff0d4c622266a7d8da1120ce
+
+commit 60a161b7e5b2a252ff0d4c622266a7d8da1120ce upstream.
+
+Suppose adapter (open) recovery is between opened QDIO queues and before
+(the end of) initial posting of status read buffers (SRBs). This time
+window can be seconds long due to FSF_PROT_HOST_CONNECTION_INITIALIZING
+causing by design looping with exponential increase sleeps in the function
+performing exchange config data during recovery
+[zfcp_erp_adapter_strat_fsf_xconf()]. Recovery triggered by local link up.
+
+Suppose an event occurs for which the FCP channel would send an unsolicited
+notification to zfcp by means of a previously posted SRB. We saw it with
+local cable pull (link down) in multi-initiator zoning with multiple
+NPIV-enabled subchannels of the same shared FCP channel.
+
+As soon as zfcp_erp_adapter_strategy_open_fsf() starts posting the initial
+status read buffers from within the adapter's ERP thread, the channel does
+send an unsolicited notification.
+
+Since v2.6.27 commit d26ab06ede83 ("[SCSI] zfcp: receiving an unsolicted
+status can lead to I/O stall"), zfcp_fsf_status_read_handler() schedules
+adapter->stat_work to re-fill the just consumed SRB from a work item.
+
+Now the ERP thread and the work item post SRBs in parallel. Both contexts
+call the helper function zfcp_status_read_refill(). The tracking of
+missing (to be posted / re-filled) SRBs is not thread-safe due to separate
+atomic_read() and atomic_dec(), in order to depend on posting
+success. Hence, both contexts can see
+atomic_read(&adapter->stat_miss) == 1. One of the two contexts posts
+one too many SRB. Zfcp gets QDIO_ERROR_SLSB_STATE on the output queue
+(trace tag "qdireq1") leading to zfcp_erp_adapter_shutdown() in
+zfcp_qdio_handler_error().
+
+An obvious and seemingly clean fix would be to schedule stat_work from the
+ERP thread and wait for it to finish. This would serialize all SRB
+re-fills. However, we already have another work item wait on the ERP
+thread: adapter->scan_work runs zfcp_fc_scan_ports() which calls
+zfcp_fc_eval_gpn_ft(). The latter calls zfcp_erp_wait() to wait for all the
+open port recoveries during zfcp auto port scan, but in fact it waits for
+any pending recovery including an adapter recovery. This approach leads to
+a deadlock. [see also v3.19 commit 18f87a67e6d6 ("zfcp: auto port scan
+resiliency"); v2.6.37 commit d3e1088d6873
+("[SCSI] zfcp: No ERP escalation on gpn_ft eval");
+v2.6.28 commit fca55b6fb587
+("[SCSI] zfcp: fix deadlock between wq triggered port scan and ERP")
+fixing v2.6.27 commit c57a39a45a76
+("[SCSI] zfcp: wait until adapter is finished with ERP during auto-port");
+v2.6.27 commit cc8c282963bd
+("[SCSI] zfcp: Automatically attach remote ports")]
+
+Instead make the accounting of missing SRBs atomic for parallel execution
+in both the ERP thread and adapter->stat_work.
+
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Fixes: d26ab06ede83 ("[SCSI] zfcp: receiving an unsolicted status can lead to I/O stall")
+Cc: <stable@vger.kernel.org> #2.6.27+
+Reviewed-by: Jens Remus <jremus@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/s390/scsi/zfcp_aux.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
+index 38c8e308d4c8..a96c98e3fc73 100644
+--- a/drivers/s390/scsi/zfcp_aux.c
++++ b/drivers/s390/scsi/zfcp_aux.c
+@@ -275,16 +275,16 @@ static void zfcp_free_low_mem_buffers(struct zfcp_adapter *adapter)
+ */
+ int zfcp_status_read_refill(struct zfcp_adapter *adapter)
+ {
+- while (atomic_read(&adapter->stat_miss) > 0)
++ while (atomic_add_unless(&adapter->stat_miss, -1, 0))
+ if (zfcp_fsf_status_read(adapter->qdio)) {
++ atomic_inc(&adapter->stat_miss); /* undo add -1 */
+ if (atomic_read(&adapter->stat_miss) >=
+ adapter->stat_read_buf_num) {
+ zfcp_erp_adapter_reopen(adapter, 0, "axsref1");
+ return 1;
+ }
+ break;
+- } else
+- atomic_dec(&adapter->stat_miss);
++ }
+ return 0;
+ }
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-064-fork-record-start_time-late.patch b/patches.kernel.org/4.4.170-064-fork-record-start_time-late.patch
new file mode 100644
index 0000000000..d1a04b69b8
--- /dev/null
+++ b/patches.kernel.org/4.4.170-064-fork-record-start_time-late.patch
@@ -0,0 +1,83 @@
+From: David Herrmann <dh.herrmann@gmail.com>
+Date: Tue, 8 Jan 2019 13:58:52 +0100
+Subject: [PATCH] fork: record start_time late
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 7b55851367136b1efd84d98fea81ba57a98304cf
+
+commit 7b55851367136b1efd84d98fea81ba57a98304cf upstream.
+
+This changes the fork(2) syscall to record the process start_time after
+initializing the basic task structure but still before making the new
+process visible to user-space.
+
+Technically, we could record the start_time anytime during fork(2). But
+this might lead to scenarios where a start_time is recorded long before
+a process becomes visible to user-space. For instance, with
+userfaultfd(2) and TLS, user-space can delay the execution of fork(2)
+for an indefinite amount of time (and will, if this causes network
+access, or similar).
+
+By recording the start_time late, it much closer reflects the point in
+time where the process becomes live and can be observed by other
+processes.
+
+Lastly, this makes it much harder for user-space to predict and control
+the start_time they get assigned. Previously, user-space could fork a
+process and stall it in copy_thread_tls() before its pid is allocated,
+but after its start_time is recorded. This can be misused to later-on
+cycle through PIDs and resume the stalled fork(2) yielding a process
+that has the same pid and start_time as a process that existed before.
+This can be used to circumvent security systems that identify processes
+by their pid+start_time combination.
+
+Even though user-space was always aware that start_time recording is
+flaky (but several projects are known to still rely on start_time-based
+identification), changing the start_time to be recorded late will help
+mitigate existing attacks and make it much harder for user-space to
+control the start_time a process gets assigned.
+
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Tom Gundersen <teg@jklm.no>
+Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/fork.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/fork.c b/kernel/fork.c
+index dd2f79ac0771..e4b81913a998 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1411,8 +1411,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+
+ posix_cpu_timers_init(p);
+
+- p->start_time = ktime_get_ns();
+- p->real_start_time = ktime_get_boot_ns();
+ p->io_context = NULL;
+ p->audit_context = NULL;
+ cgroup_fork(p);
+@@ -1572,6 +1570,17 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ if (retval)
+ goto bad_fork_free_pid;
+
++ /*
++ * From this point on we must avoid any synchronous user-space
++ * communication until we take the tasklist-lock. In particular, we do
++ * not want user-space to be able to predict the process start-time by
++ * stalling fork(2) after we recorded the start_time but before it is
++ * visible to the system.
++ */
++
++ p->start_time = ktime_get_ns();
++ p->real_start_time = ktime_get_boot_ns();
++
+ /*
+ * Make it visible to the rest of the system, but dont wake it up yet.
+ * Need tasklist lock for parent etc handling!
+--
+2.20.1
+
diff --git a/patches.fixes/0001-hwpoison-memory_hotplug-allow-hwpoisoned-pages-to-be.patch b/patches.kernel.org/4.4.170-065-hwpoison-memory_hotplug-allow-hwpoisoned-page.patch
index 95eb48f8b2..158eb70bd4 100644
--- a/patches.fixes/0001-hwpoison-memory_hotplug-allow-hwpoisoned-pages-to-be.patch
+++ b/patches.kernel.org/4.4.170-065-hwpoison-memory_hotplug-allow-hwpoisoned-page.patch
@@ -1,52 +1,55 @@
-From 51c2cfdd270f76f068ea875fba77384e49156ac6 Mon Sep 17 00:00:00 2001
From: Michal Hocko <mhocko@suse.com>
-Date: Mon, 3 Dec 2018 10:27:18 +0100
-Subject: [RFC PATCH] hwpoison, memory_hotplug: allow hwpoisoned pages to be
+Date: Fri, 28 Dec 2018 00:38:01 -0800
+Subject: [PATCH] hwpoison, memory_hotplug: allow hwpoisoned pages to be
offlined
-Patch-mainline: not yet, under discussion
-References: bnc#1116336
+References: bnc#1012382 bnc#1116336
+Patch-mainline: 4.4.170
+Git-commit: b15c87263a69272423771118c653e9a1d0672caa
+
+commit b15c87263a69272423771118c653e9a1d0672caa upstream.
We have received a bug report that an injected MCE about faulty memory
-prevents memory offline to succeed on 4.4 base kernel. The underlying
-reason was that the HWPoison page has an elevated reference count and
-the migration keeps failing. There are two problems with that. First
-of all it is dubious to migrate the poisoned page because we know that
-accessing that memory is possible to fail. Secondly it doesn't make any
-sense to migrate a potentially broken content and preserve the memory
-corruption over to a new location.
+prevents memory offline to succeed on 4.4 base kernel. The underlying
+reason was that the HWPoison page has an elevated reference count and the
+migration keeps failing. There are two problems with that. First of all
+it is dubious to migrate the poisoned page because we know that accessing
+that memory is possible to fail. Secondly it doesn't make any sense to
+migrate a potentially broken content and preserve the memory corruption
+over to a new location.
Oscar has found out that 4.4 and the current upstream kernels behave
slightly differently with his simply testcase
+
===
int main(void)
{
- int ret;
- int i;
- int fd;
- char *array = malloc(4096);
- char *array_locked = malloc(4096);
+ int ret;
+ int i;
+ int fd;
+ char *array = malloc(4096);
+ char *array_locked = malloc(4096);
- fd = open("/tmp/data", O_RDONLY);
- read(fd, array, 4095);
+ fd = open("/tmp/data", O_RDONLY);
+ read(fd, array, 4095);
- for (i = 0; i < 4096; i++)
- array_locked[i] = 'd';
+ for (i = 0; i < 4096; i++)
+ array_locked[i] = 'd';
- ret = mlock((void *)PAGE_ALIGN((unsigned long)array_locked), sizeof(array_locked));
- if (ret)
- perror("mlock");
+ ret = mlock((void *)PAGE_ALIGN((unsigned long)array_locked), sizeof(array_locked));
+ if (ret)
+ perror("mlock");
- sleep (20);
+ sleep (20);
- ret = madvise((void *)PAGE_ALIGN((unsigned long)array_locked), 4096, MADV_HWPOISON);
- if (ret)
- perror("madvise");
+ ret = madvise((void *)PAGE_ALIGN((unsigned long)array_locked), 4096, MADV_HWPOISON);
+ if (ret)
+ perror("madvise");
- for (i = 0; i < 4096; i++)
- array_locked[i] = 'd';
+ for (i = 0; i < 4096; i++)
+ array_locked[i] = 'd';
- return 0;
+ return 0;
}
===
@@ -75,27 +78,29 @@ kernel: [<ffffffff81215f08>] do_execve+0x28/0x30
kernel: [<ffffffff81095ddb>] call_usermodehelper_exec_async+0xfb/0x130
kernel: [<ffffffff8161c045>] ret_from_fork+0x55/0x80
-And that later confuses the hotremove path because an LRU page is
+And that latter confuses the hotremove path because an LRU page is
attempted to be migrated and that fails due to an elevated reference
-count. It is quite possible that the reuse of the HWPoisoned page is
-some kind of fixed race condition but I am not really sure about that.
+count. It is quite possible that the reuse of the HWPoisoned page is some
+kind of fixed race condition but I am not really sure about that.
-With the upstream kernel the failure is slightly different. The page
-doesn't seem to have LRU bit set but isolate_movable_page simply fails
-and do_migrate_range simply puts all the isolated pages back to LRU and
+With the upstream kernel the failure is slightly different. The page
+doesn't seem to have LRU bit set but isolate_movable_page simply fails and
+do_migrate_range simply puts all the isolated pages back to LRU and
therefore no progress is made and scan_movable_pages finds same set of
pages over and over again.
-Fix both cases by explicitly checking HWPoisoned pages before we even
-try to get a reference on the page, try to unmap it if it is still
-mapped. As explained by Naoya
+Fix both cases by explicitly checking HWPoisoned pages before we even try
+to get reference on the page, try to unmap it if it is still mapped. As
+explained by Naoya:
+
: Hwpoison code never unmapped those for no big reason because
: Ksm pages never dominate memory, so we simply didn't have strong
: motivation to save the pages.
Also put WARN_ON(PageLRU) in case there is a race and we can hit LRU
-HWPoison pages which shouldn't happen but I couldn't convince myself
-about that. Naoya has noted the following
+HWPoison pages which shouldn't happen but I couldn't convince myself about
+that. Naoya has noted the following:
+
: Theoretically no such gurantee, because try_to_unmap() doesn't have a
: guarantee of success and then memory_failure() returns immediately
: when hwpoison_user_mappings fails.
@@ -115,29 +120,35 @@ about that. Naoya has noted the following
: So I think it's OK to keep "if (WARN_ON(PageLRU(page)))" block in
: current version of your patch.
-Debugged-by: Oscar Salvador <osalvador@suse.com>
-Cc: stable
+Link: http://lkml.kernel.org/r/20181206120135.14079-1-mhocko@kernel.org
+Signed-off-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Oscar Salvador <osalvador@suse.com>
+Debugged-by: Oscar Salvador <osalvador@suse.com>
Tested-by: Oscar Salvador <osalvador@suse.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
-Signed-off-by: Michal Hocko <mhocko@suse.com>
-
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
- mm/memory_hotplug.c | 16 ++++++++++++++++
+ mm/memory_hotplug.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index a18923e4359d..0addef5f8aa3 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
-@@ -34,6 +34,7 @@
+@@ -32,6 +32,7 @@
+ #include <linux/hugetlb.h>
#include <linux/memblock.h>
#include <linux/bootmem.h>
- #include <linux/compaction.h>
+#include <linux/rmap.h>
#include <asm/tlbflush.h>
-@@ -1453,6 +1454,21 @@ do_migrate_range(unsigned long start_pfn
+@@ -1471,6 +1472,21 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
continue;
}
@@ -159,3 +170,6 @@ Signed-off-by: Michal Hocko <mhocko@suse.com>
if (!get_page_unless_zero(page))
continue;
/*
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-067-mm-devm_memremap_pages-kill-mapping-System-RA.patch b/patches.kernel.org/4.4.170-067-mm-devm_memremap_pages-kill-mapping-System-RA.patch
new file mode 100644
index 0000000000..5c3dda2d35
--- /dev/null
+++ b/patches.kernel.org/4.4.170-067-mm-devm_memremap_pages-kill-mapping-System-RA.patch
@@ -0,0 +1,65 @@
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Fri, 28 Dec 2018 00:34:54 -0800
+Subject: [PATCH] mm, devm_memremap_pages: kill mapping "System RAM" support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 06489cfbd915ff36c8e36df27f1c2dc60f97ca56
+
+commit 06489cfbd915ff36c8e36df27f1c2dc60f97ca56 upstream.
+
+Given the fact that devm_memremap_pages() requires a percpu_ref that is
+torn down by devm_memremap_pages_release() the current support for mapping
+RAM is broken.
+
+Support for remapping "System RAM" has been broken since the beginning and
+there is no existing user of this this code path, so just kill the support
+and make it an explicit error.
+
+This cleanup also simplifies a follow-on patch to fix the error path when
+setting a devm release action for devm_memremap_pages_release() fails.
+
+Link: http://lkml.kernel.org/r/154275557997.76910.14689813630968180480.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: "Jérôme Glisse" <jglisse@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Cc: Balbir Singh <bsingharora@gmail.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/memremap.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/memremap.c b/kernel/memremap.c
+index 71d28a5dbfc2..1be42f9b3e00 100644
+--- a/kernel/memremap.c
++++ b/kernel/memremap.c
+@@ -171,15 +171,12 @@ void *devm_memremap_pages(struct device *dev, struct resource *res)
+ struct page_map *page_map;
+ int error, nid;
+
+- if (is_ram == REGION_MIXED) {
+- WARN_ONCE(1, "%s attempted on mixed region %pr\n",
+- __func__, res);
++ if (is_ram != REGION_DISJOINT) {
++ WARN_ONCE(1, "%s attempted on %s region %pr\n", __func__,
++ is_ram == REGION_MIXED ? "mixed" : "ram", res);
+ return ERR_PTR(-ENXIO);
+ }
+
+- if (is_ram == REGION_INTERSECTS)
+- return __va(res->start);
+-
+ page_map = devres_alloc_node(devm_memremap_pages_release,
+ sizeof(*page_map), GFP_KERNEL, dev_to_node(dev));
+ if (!page_map)
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-068-sunrpc-fix-cache_head-leak-due-to-queued-requ.patch b/patches.kernel.org/4.4.170-068-sunrpc-fix-cache_head-leak-due-to-queued-requ.patch
new file mode 100644
index 0000000000..bcbd91e004
--- /dev/null
+++ b/patches.kernel.org/4.4.170-068-sunrpc-fix-cache_head-leak-due-to-queued-requ.patch
@@ -0,0 +1,74 @@
+From: Vasily Averin <vvs@virtuozzo.com>
+Date: Wed, 28 Nov 2018 11:45:57 +0300
+Subject: [PATCH] sunrpc: fix cache_head leak due to queued request
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 4ecd55ea074217473f94cfee21bb72864d39f8d7
+
+commit 4ecd55ea074217473f94cfee21bb72864d39f8d7 upstream.
+
+After commit d202cce8963d, an expired cache_head can be removed from the
+cache_detail's hash.
+
+However, the expired cache_head may be waiting for a reply from a
+previously submitted request. Such a cache_head has an increased
+refcounter and therefore it won't be freed after cache_put(freeme).
+
+Because the cache_head was removed from the hash it cannot be found
+during cache_clean() and can be leaked forever, together with stalled
+cache_request and other taken resources.
+
+In our case we noticed it because an entry in the export cache was
+holding a reference on a filesystem.
+
+Fixes d202cce8963d ("sunrpc: never return expired entries in sunrpc_cache_lookup")
+Cc: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
+Cc: stable@kernel.org # 2.6.35
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Reviewed-by: NeilBrown <neilb@suse.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/sunrpc/cache.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index 63fb5ee212cf..af17b00145e1 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -54,6 +54,11 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail)
+ h->last_refresh = now;
+ }
+
++static void cache_fresh_locked(struct cache_head *head, time_t expiry,
++ struct cache_detail *detail);
++static void cache_fresh_unlocked(struct cache_head *head,
++ struct cache_detail *detail);
++
+ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
+ struct cache_head *key, int hash)
+ {
+@@ -95,6 +100,7 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
+ if (cache_is_expired(detail, tmp)) {
+ hlist_del_init(&tmp->cache_list);
+ detail->entries --;
++ cache_fresh_locked(tmp, 0, detail);
+ freeme = tmp;
+ break;
+ }
+@@ -110,8 +116,10 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
+ cache_get(new);
+ write_unlock(&detail->hash_lock);
+
+- if (freeme)
++ if (freeme) {
++ cache_fresh_unlocked(freeme, detail);
+ cache_put(freeme, detail);
++ }
+ return new;
+ }
+ EXPORT_SYMBOL_GPL(sunrpc_cache_lookup);
+--
+2.20.1
+
diff --git a/patches.fixes/sunrpc-use-SVC_NET-in-svcauth_gss_-functions.patch b/patches.kernel.org/4.4.170-069-sunrpc-use-SVC_NET-in-svcauth_gss_-functions.patch
index ba4231c4ba..a7ac7feeb7 100644
--- a/patches.fixes/sunrpc-use-SVC_NET-in-svcauth_gss_-functions.patch
+++ b/patches.kernel.org/4.4.170-069-sunrpc-use-SVC_NET-in-svcauth_gss_-functions.patch
@@ -1,21 +1,26 @@
From: Vasily Averin <vvs@virtuozzo.com>
Date: Mon, 24 Dec 2018 14:44:42 +0300
Subject: [PATCH] sunrpc: use SVC_NET() in svcauth_gss_* functions
-Patch-mainline: Submitted, Mon, 24 Dec 2018 14:44:42 +0300 - linux-nfs@vger.kernel.org
-References: bsc#1119946 CVE-2018-16884
+References: bnc#1012382 bsc#1119946 CVE-2018-16884
+Patch-mainline: 4.4.170
+Git-commit: b8be5674fa9a6f3677865ea93f7803c4212f3e10
+commit b8be5674fa9a6f3677865ea93f7803c4212f3e10 upstream.
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
-Signed-off-by: NeilBrown <neilb@suse.com>
-Acked-by: NeilBrown <neilb@suse.com>
-
+Cc: stable@vger.kernel.org
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
- net/sunrpc/auth_gss/svcauth_gss.c | 8 ++++----
+ net/sunrpc/auth_gss/svcauth_gss.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index 036bbf2b44c1..b5291ea54a3d 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
-@@ -1104,7 +1104,7 @@ static int svcauth_gss_legacy_init(struc
+@@ -1105,7 +1105,7 @@ static int svcauth_gss_legacy_init(struct svc_rqst *rqstp,
struct kvec *resv = &rqstp->rq_res.head[0];
struct rsi *rsip, rsikey;
int ret;
@@ -24,7 +29,7 @@ Acked-by: NeilBrown <neilb@suse.com>
memset(&rsikey, 0, sizeof(rsikey));
ret = gss_read_verf(gc, argv, authp,
-@@ -1215,7 +1215,7 @@ static int svcauth_gss_proxy_init(struct
+@@ -1216,7 +1216,7 @@ static int svcauth_gss_proxy_init(struct svc_rqst *rqstp,
uint64_t handle;
int status;
int ret;
@@ -33,7 +38,7 @@ Acked-by: NeilBrown <neilb@suse.com>
struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
memset(&ud, 0, sizeof(ud));
-@@ -1405,7 +1405,7 @@ svcauth_gss_accept(struct svc_rqst *rqst
+@@ -1406,7 +1406,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
__be32 *rpcstart;
__be32 *reject_stat = resv->iov_base + resv->iov_len;
int ret;
@@ -42,7 +47,7 @@ Acked-by: NeilBrown <neilb@suse.com>
dprintk("RPC: svcauth_gss: argv->iov_len = %zd\n",
argv->iov_len);
-@@ -1693,7 +1693,7 @@ svcauth_gss_release(struct svc_rqst *rqs
+@@ -1694,7 +1694,7 @@ svcauth_gss_release(struct svc_rqst *rqstp)
struct rpc_gss_wire_cred *gc = &gsd->clcred;
struct xdr_buf *resbuf = &rqstp->rq_res;
int stat = -EINVAL;
@@ -51,3 +56,6 @@ Acked-by: NeilBrown <neilb@suse.com>
if (gc->gc_proc != RPC_GSS_PROC_DATA)
goto out;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-070-crypto-x86-chacha20-avoid-sleeping-with-preem.patch b/patches.kernel.org/4.4.170-070-crypto-x86-chacha20-avoid-sleeping-with-preem.patch
new file mode 100644
index 0000000000..3f95bde17f
--- /dev/null
+++ b/patches.kernel.org/4.4.170-070-crypto-x86-chacha20-avoid-sleeping-with-preem.patch
@@ -0,0 +1,43 @@
+From: Eric Biggers <ebiggers@google.com>
+Date: Mon, 7 Jan 2019 15:15:59 -0800
+Subject: [PATCH] crypto: x86/chacha20 - avoid sleeping with preemption
+ disabled
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 557f16c7fe26a2d16013c2821c5ce5a90a7da97e
+
+In chacha20-simd, clear the MAY_SLEEP flag in the blkcipher_desc to
+prevent sleeping with preemption disabled, under kernel_fpu_begin().
+
+This was fixed upstream incidentally by a large refactoring,
+commit 9ae433bc79f9 ("crypto: chacha20 - convert generic and x86
+versions to skcipher"). But syzkaller easily trips over this when
+running on older kernels, as it's easily reachable via AF_ALG.
+Therefore, this patch makes the minimal fix for older kernels.
+
+Fixes: c9320b6dcb89 ("crypto: chacha20 - Add a SSSE3 SIMD variant for x86_64")
+Cc: linux-crypto@vger.kernel.org
+Cc: Martin Willi <martin@strongswan.org>
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/x86/crypto/chacha20_glue.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/crypto/chacha20_glue.c b/arch/x86/crypto/chacha20_glue.c
+index 8baaff5af0b5..75b9d43069f1 100644
+--- a/arch/x86/crypto/chacha20_glue.c
++++ b/arch/x86/crypto/chacha20_glue.c
+@@ -77,6 +77,7 @@ static int chacha20_simd(struct blkcipher_desc *desc, struct scatterlist *dst,
+
+ blkcipher_walk_init(&walk, dst, src, nbytes);
+ err = blkcipher_walk_virt_block(desc, &walk, CHACHA20_BLOCK_SIZE);
++ desc->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+
+ crypto_chacha20_init(state, crypto_blkcipher_ctx(desc->tfm), walk.iv);
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-071-ALSA-cs46xx-Potential-NULL-dereference-in-pro.patch b/patches.kernel.org/4.4.170-071-ALSA-cs46xx-Potential-NULL-dereference-in-pro.patch
new file mode 100644
index 0000000000..50b46a3d02
--- /dev/null
+++ b/patches.kernel.org/4.4.170-071-ALSA-cs46xx-Potential-NULL-dereference-in-pro.patch
@@ -0,0 +1,39 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 8 Jan 2019 10:43:30 +0300
+Subject: [PATCH] ALSA: cs46xx: Potential NULL dereference in probe
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 1524f4e47f90b27a3ac84efbdd94c63172246a6f
+
+commit 1524f4e47f90b27a3ac84efbdd94c63172246a6f upstream.
+
+The "chip->dsp_spos_instance" can be NULL on some of the ealier error
+paths in snd_cs46xx_create().
+
+Reported-by: "Yavuz, Tuba" <tuba@ece.ufl.edu>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ sound/pci/cs46xx/dsp_spos.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/pci/cs46xx/dsp_spos.c b/sound/pci/cs46xx/dsp_spos.c
+index d2951ed4bf71..1984291ebd07 100644
+--- a/sound/pci/cs46xx/dsp_spos.c
++++ b/sound/pci/cs46xx/dsp_spos.c
+@@ -899,6 +899,9 @@ int cs46xx_dsp_proc_done (struct snd_cs46xx *chip)
+ struct dsp_spos_instance * ins = chip->dsp_spos_instance;
+ int i;
+
++ if (!ins)
++ return 0;
++
+ snd_info_free_entry(ins->proc_sym_info_entry);
+ ins->proc_sym_info_entry = NULL;
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-072-ALSA-usb-audio-Avoid-access-before-bLength-ch.patch b/patches.kernel.org/4.4.170-072-ALSA-usb-audio-Avoid-access-before-bLength-ch.patch
new file mode 100644
index 0000000000..0bf9c172d3
--- /dev/null
+++ b/patches.kernel.org/4.4.170-072-ALSA-usb-audio-Avoid-access-before-bLength-ch.patch
@@ -0,0 +1,54 @@
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 19 Dec 2018 12:36:27 +0100
+Subject: [PATCH] ALSA: usb-audio: Avoid access before bLength check in
+ build_audio_procunit()
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: f4351a199cc120ff9d59e06d02e8657d08e6cc46
+
+commit f4351a199cc120ff9d59e06d02e8657d08e6cc46 upstream.
+
+The parser for the processing unit reads bNrInPins field before the
+bLength sanity check, which may lead to an out-of-bound access when a
+malformed descriptor is given. Fix it by assignment after the bLength
+check.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ sound/usb/mixer.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 97d6a18e6956..f7eb0d2f797b 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1816,7 +1816,7 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ char *name)
+ {
+ struct uac_processing_unit_descriptor *desc = raw_desc;
+- int num_ins = desc->bNrInPins;
++ int num_ins;
+ struct usb_mixer_elem_info *cval;
+ struct snd_kcontrol *kctl;
+ int i, err, nameid, type, len;
+@@ -1831,7 +1831,13 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ 0, NULL, default_value_info
+ };
+
+- if (desc->bLength < 13 || desc->bLength < 13 + num_ins ||
++ if (desc->bLength < 13) {
++ usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid);
++ return -EINVAL;
++ }
++
++ num_ins = desc->bNrInPins;
++ if (desc->bLength < 13 + num_ins ||
+ desc->bLength < num_ins + uac_processing_unit_bControlSize(desc, state->mixer->protocol)) {
+ usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid);
+ return -EINVAL;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-073-ALSA-usb-audio-Fix-an-out-of-bound-read-in-cr.patch b/patches.kernel.org/4.4.170-073-ALSA-usb-audio-Fix-an-out-of-bound-read-in-cr.patch
new file mode 100644
index 0000000000..74e0bc687a
--- /dev/null
+++ b/patches.kernel.org/4.4.170-073-ALSA-usb-audio-Fix-an-out-of-bound-read-in-cr.patch
@@ -0,0 +1,51 @@
+From: Hui Peng <benquike@163.com>
+Date: Tue, 25 Dec 2018 18:11:52 -0500
+Subject: [PATCH] ALSA: usb-audio: Fix an out-of-bound read in
+ create_composite_quirks
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: cbb2ebf70daf7f7d97d3811a2ff8e39655b8c184
+
+commit cbb2ebf70daf7f7d97d3811a2ff8e39655b8c184 upstream.
+
+In `create_composite_quirk`, the terminating condition of for loops is
+`quirk->ifnum < 0`. So any composite quirks should end with `struct
+snd_usb_audio_quirk` object with ifnum < 0.
+
+ for (quirk = quirk_comp->data; quirk->ifnum >= 0; ++quirk) {
+
+ .....
+ }
+
+the data field of Bower's & Wilkins PX headphones usb device device quirks
+do not end with {.ifnum = -1}, wihch may result in out-of-bound read.
+
+This Patch fix the bug by adding an ending quirk object.
+
+Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
+Signed-off-by: Hui Peng <benquike@163.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ sound/usb/quirks-table.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 15cbe2565703..d32727c74a16 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3321,6 +3321,9 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ }
+ }
+ },
++ {
++ .ifnum = -1
++ },
+ }
+ }
+ },
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-074-dlm-fixed-memory-leaks-after-failed-ls_remove.patch b/patches.kernel.org/4.4.170-074-dlm-fixed-memory-leaks-after-failed-ls_remove.patch
new file mode 100644
index 0000000000..9e0f6342ce
--- /dev/null
+++ b/patches.kernel.org/4.4.170-074-dlm-fixed-memory-leaks-after-failed-ls_remove.patch
@@ -0,0 +1,46 @@
+From: Vasily Averin <vvs@virtuozzo.com>
+Date: Thu, 15 Nov 2018 13:15:05 +0300
+Subject: [PATCH] dlm: fixed memory leaks after failed ls_remove_names
+ allocation
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: b982896cdb6e6a6b89d86dfb39df489d9df51e14
+
+commit b982896cdb6e6a6b89d86dfb39df489d9df51e14 upstream.
+
+If allocation fails on last elements of array need to free already
+allocated elements.
+
+v2: just move existing out_rsbtbl label to right place
+
+Fixes 789924ba635f ("dlm: fix race between remove and lookup")
+Cc: stable@kernel.org # 3.6
+
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/dlm/lockspace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
+index f3e72787e7f9..30e4e01db35a 100644
+--- a/fs/dlm/lockspace.c
++++ b/fs/dlm/lockspace.c
+@@ -673,11 +673,11 @@ static int new_lockspace(const char *name, const char *cluster,
+ kfree(ls->ls_recover_buf);
+ out_lkbidr:
+ idr_destroy(&ls->ls_lkbidr);
++ out_rsbtbl:
+ for (i = 0; i < DLM_REMOVE_NAMES_MAX; i++) {
+ if (ls->ls_remove_names[i])
+ kfree(ls->ls_remove_names[i]);
+ }
+- out_rsbtbl:
+ vfree(ls->ls_rsbtbl);
+ out_lsfree:
+ if (do_unreg)
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-075-dlm-possible-memory-leak-on-error-path-in-cre.patch b/patches.kernel.org/4.4.170-075-dlm-possible-memory-leak-on-error-path-in-cre.patch
new file mode 100644
index 0000000000..f6a3f03dc8
--- /dev/null
+++ b/patches.kernel.org/4.4.170-075-dlm-possible-memory-leak-on-error-path-in-cre.patch
@@ -0,0 +1,35 @@
+From: Vasily Averin <vvs@virtuozzo.com>
+Date: Thu, 15 Nov 2018 13:18:18 +0300
+Subject: [PATCH] dlm: possible memory leak on error path in create_lkb()
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 23851e978f31eda8b2d01bd410d3026659ca06c7
+
+commit 23851e978f31eda8b2d01bd410d3026659ca06c7 upstream.
+
+Fixes 3d6aa675fff9 ("dlm: keep lkbs in idr")
+Cc: stable@kernel.org # 3.1
+
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/dlm/lock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index 35502d4046f5..1d404c832e33 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -1210,6 +1210,7 @@ static int create_lkb(struct dlm_ls *ls, struct dlm_lkb **lkb_ret)
+
+ if (rv < 0) {
+ log_error(ls, "create_lkb idr error %d", rv);
++ dlm_free_lkb(lkb);
+ return rv;
+ }
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-076-dlm-lost-put_lkb-on-error-path-in-receive_con.patch b/patches.kernel.org/4.4.170-076-dlm-lost-put_lkb-on-error-path-in-receive_con.patch
new file mode 100644
index 0000000000..587a30980e
--- /dev/null
+++ b/patches.kernel.org/4.4.170-076-dlm-lost-put_lkb-on-error-path-in-receive_con.patch
@@ -0,0 +1,44 @@
+From: Vasily Averin <vvs@virtuozzo.com>
+Date: Thu, 15 Nov 2018 13:18:24 +0300
+Subject: [PATCH] dlm: lost put_lkb on error path in receive_convert() and
+ receive_unlock()
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: c0174726c3976e67da8649ac62cae43220ae173a
+
+commit c0174726c3976e67da8649ac62cae43220ae173a upstream.
+
+Fixes 6d40c4a708e0 ("dlm: improve error and debug messages")
+Cc: stable@kernel.org # 3.5
+
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/dlm/lock.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index 1d404c832e33..1e6a3a391849 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -4178,6 +4178,7 @@ static int receive_convert(struct dlm_ls *ls, struct dlm_message *ms)
+ (unsigned long long)lkb->lkb_recover_seq,
+ ms->m_header.h_nodeid, ms->m_lkid);
+ error = -ENOENT;
++ dlm_put_lkb(lkb);
+ goto fail;
+ }
+
+@@ -4231,6 +4232,7 @@ static int receive_unlock(struct dlm_ls *ls, struct dlm_message *ms)
+ lkb->lkb_id, lkb->lkb_remid,
+ ms->m_header.h_nodeid, ms->m_lkid);
+ error = -ENOENT;
++ dlm_put_lkb(lkb);
+ goto fail;
+ }
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-077-dlm-memory-leaks-on-error-path-in-dlm_user_re.patch b/patches.kernel.org/4.4.170-077-dlm-memory-leaks-on-error-path-in-dlm_user_re.patch
new file mode 100644
index 0000000000..5ea5b940ba
--- /dev/null
+++ b/patches.kernel.org/4.4.170-077-dlm-memory-leaks-on-error-path-in-dlm_user_re.patch
@@ -0,0 +1,61 @@
+From: Vasily Averin <vvs@virtuozzo.com>
+Date: Thu, 15 Nov 2018 13:18:56 +0300
+Subject: [PATCH] dlm: memory leaks on error path in dlm_user_request()
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: d47b41aceeadc6b58abc9c7c6485bef7cfb75636
+
+commit d47b41aceeadc6b58abc9c7c6485bef7cfb75636 upstream.
+
+According to comment in dlm_user_request() ua should be freed
+in dlm_free_lkb() after successful attach to lkb.
+
+However ua is attached to lkb not in set_lock_args() but later,
+inside request_lock().
+
+Fixes 597d0cae0f99 ("[DLM] dlm: user locks")
+Cc: stable@kernel.org # 2.6.19
+
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/dlm/lock.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index 1e6a3a391849..3a7f401e943c 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -5795,20 +5795,20 @@ int dlm_user_request(struct dlm_ls *ls, struct dlm_user_args *ua,
+ goto out;
+ }
+ }
+-
+- /* After ua is attached to lkb it will be freed by dlm_free_lkb().
+- When DLM_IFL_USER is set, the dlm knows that this is a userspace
+- lock and that lkb_astparam is the dlm_user_args structure. */
+-
+ error = set_lock_args(mode, &ua->lksb, flags, namelen, timeout_cs,
+ fake_astfn, ua, fake_bastfn, &args);
+- lkb->lkb_flags |= DLM_IFL_USER;
+-
+ if (error) {
++ kfree(ua->lksb.sb_lvbptr);
++ ua->lksb.sb_lvbptr = NULL;
++ kfree(ua);
+ __put_lkb(ls, lkb);
+ goto out;
+ }
+
++ /* After ua is attached to lkb it will be freed by dlm_free_lkb().
++ When DLM_IFL_USER is set, the dlm knows that this is a userspace
++ lock and that lkb_astparam is the dlm_user_args structure. */
++ lkb->lkb_flags |= DLM_IFL_USER;
+ error = request_lock(ls, lkb, name, namelen, &args);
+
+ switch (error) {
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-078-gfs2-Fix-loop-in-gfs2_rbm_find.patch b/patches.kernel.org/4.4.170-078-gfs2-Fix-loop-in-gfs2_rbm_find.patch
new file mode 100644
index 0000000000..65175eba55
--- /dev/null
+++ b/patches.kernel.org/4.4.170-078-gfs2-Fix-loop-in-gfs2_rbm_find.patch
@@ -0,0 +1,42 @@
+From: Andreas Gruenbacher <agruenba@redhat.com>
+Date: Tue, 4 Dec 2018 15:06:27 +0100
+Subject: [PATCH] gfs2: Fix loop in gfs2_rbm_find
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 2d29f6b96d8f80322ed2dd895bca590491c38d34
+
+commit 2d29f6b96d8f80322ed2dd895bca590491c38d34 upstream.
+
+Fix the resource group wrap-around logic in gfs2_rbm_find that commit
+e579ed4f44 broke. The bug can lead to unnecessary repeated scanning of the
+same bitmaps; there is a risk that future changes will turn this into an
+endless loop.
+
+Fixes: e579ed4f44 ("GFS2: Introduce rbm field bii")
+Cc: stable@vger.kernel.org # v3.13+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/gfs2/rgrp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index ef24894edecc..763fe7737065 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1720,9 +1720,9 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext,
+ goto next_iter;
+ }
+ if (ret == -E2BIG) {
++ n += rbm->bii - initial_bii;
+ rbm->bii = 0;
+ rbm->offset = 0;
+- n += (rbm->bii - initial_bii);
+ goto res_covered_end_of_rgrp;
+ }
+ return ret;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-079-b43-Fix-error-in-cordic-routine.patch b/patches.kernel.org/4.4.170-079-b43-Fix-error-in-cordic-routine.patch
new file mode 100644
index 0000000000..2557b80ccf
--- /dev/null
+++ b/patches.kernel.org/4.4.170-079-b43-Fix-error-in-cordic-routine.patch
@@ -0,0 +1,48 @@
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 19 Nov 2018 20:01:24 +0200
+Subject: [PATCH] b43: Fix error in cordic routine
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 8ea3819c0bbef57a51d8abe579e211033e861677
+
+commit 8ea3819c0bbef57a51d8abe579e211033e861677 upstream.
+
+The cordic routine for calculating sines and cosines that was added in
+commit 6f98e62a9f1b ("b43: update cordic code to match current specs")
+contains an error whereby a quantity declared u32 can in fact go negative.
+
+This problem was detected by Priit Laes who is switching b43 to use the
+routine in the library functions of the kernel.
+
+Fixes: 986504540306 ("b43: make cordic common (LP-PHY and N-PHY need it)")
+Reported-by: Priit Laes <plaes@plaes.org>
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Cc: Stable <stable@vger.kernel.org> # 2.6.34
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Priit Laes <plaes@plaes.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/wireless/b43/phy_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
+index ec2b9c577b90..3644c9edaf81 100644
+--- a/drivers/net/wireless/b43/phy_common.c
++++ b/drivers/net/wireless/b43/phy_common.c
+@@ -616,7 +616,7 @@ struct b43_c32 b43_cordic(int theta)
+ u8 i;
+ s32 tmp;
+ s8 signx = 1;
+- u32 angle = 0;
++ s32 angle = 0;
+ struct b43_c32 ret = { .i = 39797, .q = 0, };
+
+ while (theta > (180 << 16))
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-080-9p-net-put-a-lower-bound-on-msize.patch b/patches.kernel.org/4.4.170-080-9p-net-put-a-lower-bound-on-msize.patch
new file mode 100644
index 0000000000..d444f6b239
--- /dev/null
+++ b/patches.kernel.org/4.4.170-080-9p-net-put-a-lower-bound-on-msize.patch
@@ -0,0 +1,86 @@
+From: Dominique Martinet <dominique.martinet@cea.fr>
+Date: Mon, 5 Nov 2018 09:52:48 +0100
+Subject: [PATCH] 9p/net: put a lower bound on msize
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: 574d356b7a02c7e1b01a1d9cba8a26b3c2888f45
+
+commit 574d356b7a02c7e1b01a1d9cba8a26b3c2888f45 upstream.
+
+If the requested msize is too small (either from command line argument
+or from the server version reply), we won't get any work done.
+If it's *really* too small, nothing will work, and this got caught by
+syzbot recently (on a new kmem_cache_create_usercopy() call)
+
+Just set a minimum msize to 4k in both code paths, until someone
+complains they have a use-case for a smaller msize.
+
+We need to check in both mount option and server reply individually
+because the msize for the first version request would be unchecked
+with just a global check on clnt->msize.
+
+Link: http://lkml.kernel.org/r/1541407968-31350-1-git-send-email-asmadeus@codewreck.org
+Reported-by: syzbot+0c1d61e4db7db94102ca@syzkaller.appspotmail.com
+Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
+Cc: Eric Van Hensbergen <ericvh@gmail.com>
+Cc: Latchesar Ionkov <lucho@ionkov.net>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/9p/client.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/net/9p/client.c b/net/9p/client.c
+index ed8738c4dc09..8fba9cd973c1 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -156,6 +156,12 @@ static int parse_opts(char *opts, struct p9_client *clnt)
+ ret = r;
+ continue;
+ }
++ if (option < 4096) {
++ p9_debug(P9_DEBUG_ERROR,
++ "msize should be at least 4k\n");
++ ret = -EINVAL;
++ continue;
++ }
+ clnt->msize = option;
+ break;
+ case Opt_trans:
+@@ -972,10 +978,18 @@ static int p9_client_version(struct p9_client *c)
+ else if (!strncmp(version, "9P2000", 6))
+ c->proto_version = p9_proto_legacy;
+ else {
++ p9_debug(P9_DEBUG_ERROR,
++ "server returned an unknown version: %s\n", version);
+ err = -EREMOTEIO;
+ goto error;
+ }
+
++ if (msize < 4096) {
++ p9_debug(P9_DEBUG_ERROR,
++ "server returned a msize < 4096: %d\n", msize);
++ err = -EREMOTEIO;
++ goto error;
++ }
+ if (msize < c->msize)
+ c->msize = msize;
+
+@@ -1040,6 +1054,13 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
+ if (clnt->msize > clnt->trans_mod->maxsize)
+ clnt->msize = clnt->trans_mod->maxsize;
+
++ if (clnt->msize < 4096) {
++ p9_debug(P9_DEBUG_ERROR,
++ "Please specify a msize of at least 4k\n");
++ err = -EINVAL;
++ goto free_client;
++ }
++
+ err = p9_client_version(clnt);
+ if (err)
+ goto close_trans;
+--
+2.20.1
+
diff --git a/patches.drivers/iommu-vt-d-handle-domain-agaw-being-less-than-iommu-agaw b/patches.kernel.org/4.4.170-081-iommu-vt-d-Handle-domain-agaw-being-less-than.patch
index 5ea5bb81ef..42b1e88d82 100644
--- a/patches.drivers/iommu-vt-d-handle-domain-agaw-being-less-than-iommu-agaw
+++ b/patches.kernel.org/4.4.170-081-iommu-vt-d-Handle-domain-agaw-being-less-than.patch
@@ -1,9 +1,11 @@
From: Sohil Mehta <sohil.mehta@intel.com>
Date: Wed, 21 Nov 2018 15:29:33 -0800
-Subject: iommu/vt-d: Handle domain agaw being less than iommu agaw
+Subject: [PATCH] iommu/vt-d: Handle domain agaw being less than iommu agaw
+Patch-mainline: 4.4.170
+References: bnc#1012382 bsc#1106105
Git-commit: 3569dd07aaad71920c5ea4da2d5cc9a167c1ffd4
-Patch-mainline: v5.0-rc1
-References: bsc#1106105
+
+commit 3569dd07aaad71920c5ea4da2d5cc9a167c1ffd4 upstream.
The Intel IOMMU driver opportunistically skips a few top level page
tables from the domain paging directory while programming the IOMMU
@@ -29,15 +31,17 @@ Reported-by: Ramos Falcon, Ernesto R <ernesto.r.ramos.falcon@intel.com>
Tested-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Signed-off-by: Sohil Mehta <sohil.mehta@intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/iommu/intel-iommu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
-index f3ccf025108b..fdf79baf1d79 100644
+index 7feaa82f8c7c..8b4a4d95669a 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
-@@ -2044,7 +2044,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain,
+@@ -2041,7 +2041,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain,
* than default. Unnecessary for PT mode.
*/
if (translation != CONTEXT_TT_PASS_THROUGH) {
@@ -46,7 +50,7 @@ index f3ccf025108b..fdf79baf1d79 100644
ret = -ENOMEM;
pgd = phys_to_virt(dma_pte_addr(pgd));
if (!dma_pte_present(pgd))
-@@ -2058,7 +2058,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain,
+@@ -2055,7 +2055,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain,
translation = CONTEXT_TT_MULTI_LEVEL;
context_set_address_root(context, virt_to_phys(pgd));
@@ -55,4 +59,6 @@ index f3ccf025108b..fdf79baf1d79 100644
} else {
/*
* In pass through mode, AW must be programmed to
+--
+2.20.1
diff --git a/patches.fixes/ceph-don-t-update-importing-cap-s-mseq-when-handing-cap-export.patch b/patches.kernel.org/4.4.170-082-ceph-don-t-update-importing-cap-s-mseq-when-h.patch
index 6d6a130efa..14884e1afa 100644
--- a/patches.fixes/ceph-don-t-update-importing-cap-s-mseq-when-handing-cap-export.patch
+++ b/patches.kernel.org/4.4.170-082-ceph-don-t-update-importing-cap-s-mseq-when-h.patch
@@ -1,9 +1,12 @@
From: "Yan, Zheng" <zyan@redhat.com>
Date: Thu, 29 Nov 2018 11:22:50 +0800
-Subject: ceph: don't update importing cap's mseq when handing cap export
+Subject: [PATCH] ceph: don't update importing cap's mseq when handing cap
+ export
+Patch-mainline: 4.4.170
+References: bnc#1012382 bsc#1121275
Git-commit: 3c1392d4c49962a31874af14ae9ff289cb2b3851
-Patch-mainline: v5.0-rc1
-References: bsc#1121275
+
+commit 3c1392d4c49962a31874af14ae9ff289cb2b3851 upstream.
Updating mseq makes client think importer mds has accepted all prior
cap messages and importer mds knows what caps client wants. Actually
@@ -15,16 +18,17 @@ reset by cap import message.
Cc: stable@vger.kernel.org
Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Acked-by: Luis Henriques <lhenriques@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/ceph/caps.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
-index f3496db4bb3e..a58666a3f8dd 100644
+index 0e3de1bb6500..e7b54514d99a 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
-@@ -3569,7 +3569,6 @@ static void handle_cap_export(struct inode *inode, struct ceph_mds_caps *ex,
+@@ -3243,7 +3243,6 @@ static void handle_cap_export(struct inode *inode, struct ceph_mds_caps *ex,
tcap->cap_id = t_cap_id;
tcap->seq = t_seq - 1;
tcap->issue_seq = t_seq - 1;
@@ -32,4 +36,6 @@ index f3496db4bb3e..a58666a3f8dd 100644
tcap->issued |= issued;
tcap->implemented |= issued;
if (cap == ci->i_auth_cap)
+--
+2.20.1
diff --git a/patches.kernel.org/4.4.170-083-genwqe-Fix-size-check.patch b/patches.kernel.org/4.4.170-083-genwqe-Fix-size-check.patch
new file mode 100644
index 0000000000..653d40ca2b
--- /dev/null
+++ b/patches.kernel.org/4.4.170-083-genwqe-Fix-size-check.patch
@@ -0,0 +1,70 @@
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+Date: Wed, 12 Dec 2018 14:45:18 +0100
+Subject: [PATCH] genwqe: Fix size check
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: fdd669684655c07dacbdb0d753fd13833de69a33
+
+commit fdd669684655c07dacbdb0d753fd13833de69a33 upstream.
+
+Calling the test program genwqe_cksum with the default buffer size of
+2MB triggers the following kernel warning on s390:
+
+WARNING: CPU: 30 PID: 9311 at mm/page_alloc.c:3189 __alloc_pages_nodemask+0x45c/0xbe0
+CPU: 30 PID: 9311 Comm: genwqe_cksum Kdump: loaded Not tainted 3.10.0-957.el7.s390x #1
+task: 00000005e5d13980 ti: 00000005e7c6c000 task.ti: 00000005e7c6c000
+Krnl PSW : 0704c00180000000 00000000002780ac (__alloc_pages_nodemask+0x45c/0xbe0)
+ R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 EA:3
+Krnl GPRS: 00000000002932b8 0000000000b73d7c 0000000000000010 0000000000000009
+ 0000000000000041 00000005e7c6f9b8 0000000000000001 00000000000080d0
+ 0000000000000000 0000000000b70500 0000000000000001 0000000000000000
+ 0000000000b70528 00000000007682c0 0000000000277df2 00000005e7c6f9a0
+Krnl Code: 000000000027809e: de7195001000 ed 1280(114,%r9),0(%r1)
+ 00000000002780a4: a774fead brc 7,277dfe
+ #00000000002780a8: a7f40001 brc 15,2780aa
+ >00000000002780ac: 92011000 mvi 0(%r1),1
+ 00000000002780b0: a7f4fea7 brc 15,277dfe
+ 00000000002780b4: 9101c6b6 tm 1718(%r12),1
+ 00000000002780b8: a784ff3a brc 8,277f2c
+ 00000000002780bc: a7f4fe2e brc 15,277d18
+Call Trace:
+([<0000000000277df2>] __alloc_pages_nodemask+0x1a2/0xbe0)
+ [<000000000013afae>] s390_dma_alloc+0xfe/0x310
+ [<000003ff8065f362>] __genwqe_alloc_consistent+0xfa/0x148 [genwqe_card]
+ [<000003ff80658f7a>] genwqe_mmap+0xca/0x248 [genwqe_card]
+ [<00000000002b2712>] mmap_region+0x4e2/0x778
+ [<00000000002b2c54>] do_mmap+0x2ac/0x3e0
+ [<0000000000292d7e>] vm_mmap_pgoff+0xd6/0x118
+ [<00000000002b081c>] SyS_mmap_pgoff+0xdc/0x268
+ [<00000000002b0a34>] SyS_old_mmap+0x8c/0xb0
+ [<000000000074e518>] sysc_tracego+0x14/0x1e
+ [<000003ffacf87dc6>] 0x3ffacf87dc6
+
+turns out the check in __genwqe_alloc_consistent uses "> MAX_ORDER"
+while the mm code uses ">= MAX_ORDER". Fix genwqe.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Frank Haverkamp <haver@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/misc/genwqe/card_utils.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
+index 524660510599..0c15ba21fa54 100644
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -217,7 +217,7 @@ u32 genwqe_crc32(u8 *buff, size_t len, u32 init)
+ void *__genwqe_alloc_consistent(struct genwqe_dev *cd, size_t size,
+ dma_addr_t *dma_handle)
+ {
+- if (get_order(size) > MAX_ORDER)
++ if (get_order(size) >= MAX_ORDER)
+ return NULL;
+
+ return dma_alloc_coherent(&cd->pci_dev->dev, size, dma_handle,
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-084-intel_th-msu-Fix-an-off-by-one-in-attribute-s.patch b/patches.kernel.org/4.4.170-084-intel_th-msu-Fix-an-off-by-one-in-attribute-s.patch
new file mode 100644
index 0000000000..5ab97df4ba
--- /dev/null
+++ b/patches.kernel.org/4.4.170-084-intel_th-msu-Fix-an-off-by-one-in-attribute-s.patch
@@ -0,0 +1,57 @@
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 19 Dec 2018 17:19:22 +0200
+Subject: [PATCH] intel_th: msu: Fix an off-by-one in attribute store
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: ec5b5ad6e272d8d6b92d1007f79574919862a2d2
+
+commit ec5b5ad6e272d8d6b92d1007f79574919862a2d2 upstream.
+
+The 'nr_pages' attribute of the 'msc' subdevices parses a comma-separated
+list of window sizes, passed from userspace. However, there is a bug in
+the string parsing logic wherein it doesn't exclude the comma character
+from the range of characters as it consumes them. This leads to an
+out-of-bounds access given a sufficiently long list. For example:
+
+> # echo 8,8,8,8 > /sys/bus/intel_th/devices/0-msc0/nr_pages
+> ==================================================================
+> BUG: KASAN: slab-out-of-bounds in memchr+0x1e/0x40
+> Read of size 1 at addr ffff8803ffcebcd1 by task sh/825
+>
+> CPU: 3 PID: 825 Comm: npktest.sh Tainted: G W 4.20.0-rc1+
+> Call Trace:
+> dump_stack+0x7c/0xc0
+> print_address_description+0x6c/0x23c
+> ? memchr+0x1e/0x40
+> kasan_report.cold.5+0x241/0x308
+> memchr+0x1e/0x40
+> nr_pages_store+0x203/0xd00 [intel_th_msu]
+
+Fix this by accounting for the comma character.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: ba82664c134ef ("intel_th: Add Memory Storage Unit driver")
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/hwtracing/intel_th/msu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
+index 70ca27e45602..9d9e47eb0842 100644
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -1418,7 +1418,8 @@ nr_pages_store(struct device *dev, struct device_attribute *attr,
+ if (!end)
+ break;
+
+- len -= end - p;
++ /* consume the number and the following comma, hence +1 */
++ len -= end - p + 1;
+ p = end + 1;
+ } while (len);
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-085-power-supply-olpc_battery-correct-the-tempera.patch b/patches.kernel.org/4.4.170-085-power-supply-olpc_battery-correct-the-tempera.patch
new file mode 100644
index 0000000000..bee05dee49
--- /dev/null
+++ b/patches.kernel.org/4.4.170-085-power-supply-olpc_battery-correct-the-tempera.patch
@@ -0,0 +1,56 @@
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Fri, 16 Nov 2018 17:23:47 +0100
+Subject: [PATCH] power: supply: olpc_battery: correct the temperature units
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: ed54ffbe554f0902689fd6d1712bbacbacd11376
+
+commit ed54ffbe554f0902689fd6d1712bbacbacd11376 upstream.
+
+According to [1] and [2], the temperature values are in tenths of degree
+Celsius. Exposing the Celsius value makes the battery appear on fire:
+
+ $ upower -i /org/freedesktop/UPower/devices/battery_olpc_battery
+ ...
+ temperature: 236.9 degrees C
+
+Tested on OLPC XO-1 and OLPC XO-1.75 laptops.
+
+[1] include/linux/power_supply.h
+[2] Documentation/power/power_supply_class.txt
+
+Fixes: fb972873a767 ("[BATTERY] One Laptop Per Child power/battery driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/power/olpc_battery.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/olpc_battery.c b/drivers/power/olpc_battery.c
+index 9e29b1321648..15783869e1a0 100644
+--- a/drivers/power/olpc_battery.c
++++ b/drivers/power/olpc_battery.c
+@@ -427,14 +427,14 @@ static int olpc_bat_get_property(struct power_supply *psy,
+ if (ret)
+ return ret;
+
+- val->intval = (s16)be16_to_cpu(ec_word) * 100 / 256;
++ val->intval = (s16)be16_to_cpu(ec_word) * 10 / 256;
+ break;
+ case POWER_SUPPLY_PROP_TEMP_AMBIENT:
+ ret = olpc_ec_cmd(EC_AMB_TEMP, NULL, 0, (void *)&ec_word, 2);
+ if (ret)
+ return ret;
+
+- val->intval = (int)be16_to_cpu(ec_word) * 100 / 256;
++ val->intval = (int)be16_to_cpu(ec_word) * 10 / 256;
+ break;
+ case POWER_SUPPLY_PROP_CHARGE_COUNTER:
+ ret = olpc_ec_cmd(EC_BAT_ACR, NULL, 0, (void *)&ec_word, 2);
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.170-086-Linux-4.4.170.patch b/patches.kernel.org/4.4.170-086-Linux-4.4.170.patch
new file mode 100644
index 0000000000..5c5018f9c9
--- /dev/null
+++ b/patches.kernel.org/4.4.170-086-Linux-4.4.170.patch
@@ -0,0 +1,27 @@
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Sun, 13 Jan 2019 10:05:34 +0100
+Subject: [PATCH] Linux 4.4.170
+References: bnc#1012382
+Patch-mainline: 4.4.170
+Git-commit: b83b3fa78445387f351cef477a112e503d72b9f0
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 0d41b0626c0c..bc58f206c0da 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 169
++SUBLEVEL = 170
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+
+--
+2.20.1
+
diff --git a/patches.suse/0046-perf-tools-omit-unnecessary-cast-in-perf_pmu__parse_scale b/patches.suse/0046-perf-tools-omit-unnecessary-cast-in-perf_pmu__parse_scale
index 39475866e0..78522abe34 100644
--- a/patches.suse/0046-perf-tools-omit-unnecessary-cast-in-perf_pmu__parse_scale
+++ b/patches.suse/0046-perf-tools-omit-unnecessary-cast-in-perf_pmu__parse_scale
@@ -19,23 +19,21 @@ Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20160308184230.GB7897@krava.redhat.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
- tools/perf/util/pmu.c | 4 ++--
+ tools/perf/util/pmu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
-index d8cd038baed2..adef23b1352e 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
-@@ -98,7 +98,7 @@ static int perf_pmu__parse_scale(struct perf_pmu_alias *alias, char *dir, char *
+@@ -98,7 +98,7 @@ static int perf_pmu__parse_scale(struct
char scale[128];
int fd, ret = -1;
char path[PATH_MAX];
- const char *lc;
+ char *lc;
- snprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
+ scnprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
-@@ -146,7 +146,7 @@ static int perf_pmu__parse_scale(struct perf_pmu_alias *alias, char *dir, char *
+@@ -146,7 +146,7 @@ static int perf_pmu__parse_scale(struct
/* restore locale */
setlocale(LC_NUMERIC, lc);
@@ -44,4 +42,3 @@ index d8cd038baed2..adef23b1352e 100644
ret = 0;
error:
-
diff --git a/patches.suse/0047-perf-pmu-factor-out-scale-conversion-code b/patches.suse/0047-perf-pmu-factor-out-scale-conversion-code
index 0f72b1728e..ffbf74e477 100644
--- a/patches.suse/0047-perf-pmu-factor-out-scale-conversion-code
+++ b/patches.suse/0047-perf-pmu-factor-out-scale-conversion-code
@@ -17,14 +17,12 @@ Link: http://lkml.kernel.org/r/20170103150833.6694-2-andi@firstfloor.org
[ Keep returning -ENOMEM when strdup() fails in perf_pmu__parse_scale()/convert_scale() ]
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
- tools/perf/util/pmu.c | 62 ++++++++++++++++++++++++++++-----------------------
+ tools/perf/util/pmu.c | 62 +++++++++++++++++++++++++++-----------------------
1 file changed, 34 insertions(+), 28 deletions(-)
-diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
-index dc6ccaa4e927..78b16100567d 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
-@@ -94,32 +94,10 @@ static int pmu_format(const char *name, struct list_head *format)
+@@ -94,32 +94,10 @@ static int pmu_format(const char *name,
return 0;
}
@@ -38,7 +36,7 @@ index dc6ccaa4e927..78b16100567d 100644
- char path[PATH_MAX];
char *lc;
-
-- snprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
+- scnprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
-
- fd = open(path, O_RDONLY);
- if (fd == -1)
@@ -59,7 +57,7 @@ index dc6ccaa4e927..78b16100567d 100644
/*
* save current locale
-@@ -134,7 +112,7 @@ static int perf_pmu__parse_scale(struct perf_pmu_alias *alias, char *dir, char *
+@@ -134,7 +112,7 @@ static int perf_pmu__parse_scale(struct
lc = strdup(lc);
if (!lc) {
ret = -ENOMEM;
@@ -68,7 +66,7 @@ index dc6ccaa4e927..78b16100567d 100644
}
/*
-@@ -144,14 +122,42 @@ static int perf_pmu__parse_scale(struct perf_pmu_alias *alias, char *dir, char *
+@@ -144,14 +122,42 @@ static int perf_pmu__parse_scale(struct
*/
setlocale(LC_NUMERIC, "C");
@@ -91,7 +89,7 @@ index dc6ccaa4e927..78b16100567d 100644
+ int fd, ret = -1;
+ char path[PATH_MAX];
+
-+ snprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
++ scnprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1)
@@ -114,4 +112,3 @@ index dc6ccaa4e927..78b16100567d 100644
error:
close(fd);
return ret;
-
diff --git a/patches.suse/mm-compaction-introduce-kcompactd.patch b/patches.suse/mm-compaction-introduce-kcompactd.patch
index 141f8fc6f7..41aab0fdeb 100644
--- a/patches.suse/mm-compaction-introduce-kcompactd.patch
+++ b/patches.suse/mm-compaction-introduce-kcompactd.patch
@@ -96,21 +96,19 @@ Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Mel Gorman <mgorman@suse.de>
---
- include/linux/compaction.h | 16 +++
- include/linux/mmzone.h | 6 ++
- include/linux/vm_event_item.h | 1 +
- include/trace/events/compaction.h | 55 ++++++++++
- mm/compaction.c | 222 ++++++++++++++++++++++++++++++++++++++
- mm/memory_hotplug.c | 9 +-
- mm/page_alloc.c | 3 +
- mm/vmstat.c | 1 +
+ include/linux/compaction.h | 16 ++
+ include/linux/mmzone.h | 6 +
+ include/linux/vm_event_item.h | 1
+ include/trace/events/compaction.h | 55 +++++++++
+ mm/compaction.c | 222 ++++++++++++++++++++++++++++++++++++++
+ mm/memory_hotplug.c | 9 +
+ mm/page_alloc.c | 3
+ mm/vmstat.c | 1
8 files changed, 311 insertions(+), 2 deletions(-)
-diff --git a/include/linux/compaction.h b/include/linux/compaction.h
-index 4cd4ddf64cc7..d7c8de583a23 100644
--- a/include/linux/compaction.h
+++ b/include/linux/compaction.h
-@@ -52,6 +52,10 @@ extern void compaction_defer_reset(struct zone *zone, int order,
+@@ -52,6 +52,10 @@ extern void compaction_defer_reset(struc
bool alloc_success);
extern bool compaction_restarting(struct zone *zone, int order);
@@ -121,7 +119,7 @@ index 4cd4ddf64cc7..d7c8de583a23 100644
#else
static inline unsigned long try_to_compact_pages(gfp_t gfp_mask,
unsigned int order, int alloc_flags,
-@@ -84,6 +88,18 @@ static inline bool compaction_deferred(struct zone *zone, int order)
+@@ -84,6 +88,18 @@ static inline bool compaction_deferred(s
return true;
}
@@ -140,11 +138,9 @@ index 4cd4ddf64cc7..d7c8de583a23 100644
#endif /* CONFIG_COMPACTION */
#if defined(CONFIG_COMPACTION) && defined(CONFIG_SYSFS) && defined(CONFIG_NUMA)
-diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
-index 5a2c3d3d824f..5b557150f83f 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
-@@ -674,6 +674,12 @@ typedef struct pglist_data {
+@@ -669,6 +669,12 @@ typedef struct pglist_data {
mem_hotplug_begin/end() */
int kswapd_max_order;
enum zone_type classzone_idx;
@@ -157,11 +153,9 @@ index 5a2c3d3d824f..5b557150f83f 100644
#ifdef CONFIG_NUMA_BALANCING
/* Lock serializing the migrate rate limiting window */
spinlock_t numabalancing_migrate_lock;
-diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h
-index e623d392db0c..823a629f9033 100644
--- a/include/linux/vm_event_item.h
+++ b/include/linux/vm_event_item.h
-@@ -52,6 +52,7 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT,
+@@ -53,6 +53,7 @@ enum vm_event_item { PGPGIN, PGPGOUT, PS
COMPACTMIGRATE_SCANNED, COMPACTFREE_SCANNED,
COMPACTISOLATED,
COMPACTSTALL, COMPACTFAIL, COMPACTSUCCESS,
@@ -169,11 +163,9 @@ index e623d392db0c..823a629f9033 100644
#endif
#ifdef CONFIG_HUGETLB_PAGE
HTLB_BUDDY_PGALLOC, HTLB_BUDDY_PGALLOC_FAIL,
-diff --git a/include/trace/events/compaction.h b/include/trace/events/compaction.h
-index c92d1e1cbad9..223450aeb49e 100644
--- a/include/trace/events/compaction.h
+++ b/include/trace/events/compaction.h
-@@ -350,6 +350,61 @@ DEFINE_EVENT(mm_compaction_defer_template, mm_compaction_defer_reset,
+@@ -350,6 +350,61 @@ DEFINE_EVENT(mm_compaction_defer_templat
);
#endif
@@ -235,8 +227,6 @@ index c92d1e1cbad9..223450aeb49e 100644
#endif /* _TRACE_COMPACTION_H */
/* This part must be outside protection */
-diff --git a/mm/compaction.c b/mm/compaction.c
-index 1ffc62a05d27..da34d4397f1f 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -7,6 +7,7 @@
@@ -256,7 +246,7 @@ index 1ffc62a05d27..da34d4397f1f 100644
#include "internal.h"
#ifdef CONFIG_COMPACTION
-@@ -1732,4 +1735,223 @@ void compaction_unregister_node(struct node *node)
+@@ -1721,4 +1724,223 @@ void compaction_unregister_node(struct n
}
#endif /* CONFIG_SYSFS && CONFIG_NUMA */
@@ -480,19 +470,17 @@ index 1ffc62a05d27..da34d4397f1f 100644
+subsys_initcall(kcompactd_init)
+
#endif /* CONFIG_COMPACTION */
-diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
-index 6c3c05849484..afca0da46d6b 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
-@@ -32,6 +32,7 @@
+@@ -33,6 +33,7 @@
#include <linux/hugetlb.h>
#include <linux/memblock.h>
#include <linux/bootmem.h>
+#include <linux/compaction.h>
+ #include <linux/rmap.h>
#include <asm/tlbflush.h>
-
-@@ -1073,8 +1074,10 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_typ
+@@ -1101,8 +1102,10 @@ int __ref online_pages(unsigned long pfn
init_per_zone_wmark_min();
@@ -504,7 +492,7 @@ index 6c3c05849484..afca0da46d6b 100644
vm_total_pages = nr_free_pagecache_pages();
-@@ -1838,8 +1841,10 @@ static int __ref __offline_pages(unsigned long start_pfn,
+@@ -1895,8 +1898,10 @@ repeat:
zone_pcp_update(zone);
node_states_clear_node(node, &arg);
@@ -516,11 +504,9 @@ index 6c3c05849484..afca0da46d6b 100644
vm_total_pages = nr_free_pagecache_pages();
writeback_set_ratelimit();
-diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 33974cda62de..2a1031669034 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
-@@ -5282,6 +5282,9 @@ static void __paginginit free_area_init_core(struct pglist_data *pgdat)
+@@ -5737,6 +5737,9 @@ static void __paginginit free_area_init_
#endif
init_waitqueue_head(&pgdat->kswapd_wait);
init_waitqueue_head(&pgdat->pfmemalloc_wait);
@@ -530,11 +516,9 @@ index 33974cda62de..2a1031669034 100644
pgdat_page_ext_init(pgdat);
for (j = 0; j < MAX_NR_ZONES; j++) {
-diff --git a/mm/vmstat.c b/mm/vmstat.c
-index 88011eca5283..d267d426ce3b 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
-@@ -825,6 +825,7 @@ const char * const vmstat_text[] = {
+@@ -801,6 +801,7 @@ const char * const vmstat_text[] = {
"compact_stall",
"compact_fail",
"compact_success",
diff --git a/series.conf b/series.conf
index 54ae628bd8..d7ac832df1 100644
--- a/series.conf
+++ b/series.conf
@@ -4789,7 +4789,6 @@
patches.kernel.org/4.4.164-159-drm-dp_mst-Check-if-primary-mstb-is-null.patch
patches.kernel.org/4.4.164-160-drm-i915-hdmi-Add-HDMI-2.0-audio-clock-recove.patch
patches.kernel.org/4.4.164-161-Linux-4.4.164.patch
-
patches.kernel.org/4.4.165-001-flow_dissector-do-not-dissect-l4-ports-for-fr.patch
patches.kernel.org/4.4.165-002-ip_tunnel-don-t-force-DF-when-MTU-is-locked.patch
patches.kernel.org/4.4.165-003-net-gro-reset-skb-pkt_type-in-napi_reuse_skb.patch
@@ -5126,6 +5125,132 @@
patches.kernel.org/4.4.168-087-rocker-fix-rocker_tlv_put_-functions-for-KASA.patch
patches.kernel.org/4.4.168-088-selftests-Move-networking-timestamping-from-D.patch
patches.kernel.org/4.4.168-089-Linux-4.4.168.patch
+ patches.kernel.org/4.4.169-001-lib-interval_tree_test.c-make-test-options-mo.patch
+ patches.kernel.org/4.4.169-002-lib-interval_tree_test.c-allow-full-tree-sear.patch
+ patches.kernel.org/4.4.169-003-lib-rbtree_test.c-make-input-module-parameter.patch
+ patches.kernel.org/4.4.169-004-lib-rbtree-test-lower-default-params.patch
+ patches.kernel.org/4.4.169-005-lib-interval_tree_test.c-allow-users-to-limit.patch
+ patches.kernel.org/4.4.169-006-timer-debug-Change-proc-timer_list-from-0444-.patch
+ patches.kernel.org/4.4.169-007-powerpc-boot-Fix-random-libfdt-related-build-.patch
+ patches.kernel.org/4.4.169-008-pinctrl-sunxi-a83t-Fix-IRQ-offset-typo-for-PH.patch
+ patches.kernel.org/4.4.169-009-aio-fix-spectre-gadget-in-lookup_ioctx.patch
+ patches.kernel.org/4.4.169-010-MMC-OMAP-fix-broken-MMC-on-OMAP15XX-OMAP5910-.patch
+ patches.kernel.org/4.4.169-011-tracing-Fix-memory-leak-in-set_trigger_filter.patch
+ patches.kernel.org/4.4.169-012-tracing-Fix-memory-leak-of-instance-function-.patch
+ patches.kernel.org/4.4.169-013-powerpc-msi-Fix-NULL-pointer-access-in-teardo.patch
+ patches.kernel.org/4.4.169-014-Revert-drm-rockchip-Allow-driver-to-be-shutdo.patch
+ patches.kernel.org/4.4.169-015-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_con.patch
+ patches.kernel.org/4.4.169-016-mac80211-don-t-WARN-on-bad-WMM-parameters-fro.patch
+ patches.kernel.org/4.4.169-017-mac80211-Fix-condition-validating-WMM-IE.patch
+ patches.kernel.org/4.4.169-018-mac80211_hwsim-fix-module-init-error-paths-fo.patch
+ patches.kernel.org/4.4.169-019-scsi-libiscsi-Fix-NULL-pointer-dereference-in.patch
+ patches.kernel.org/4.4.169-020-scsi-vmw_pscsi-Rearrange-code-to-avoid-multip.patch
+ patches.kernel.org/4.4.169-021-x86-earlyprintk-efi-Fix-infinite-loop-on-some.patch
+ patches.kernel.org/4.4.169-022-drm-msm-Grab-a-vblank-reference-when-waiting-.patch
+ patches.kernel.org/4.4.169-023-ARC-io.h-Implement-reads-x-writes-x.patch
+ patches.kernel.org/4.4.169-024-bonding-fix-802.3ad-state-sent-to-partner-whe.patch
+ patches.kernel.org/4.4.169-025-SUNRPC-Fix-a-potential-race-in-xprt_connect.patch
+ patches.kernel.org/4.4.169-026-sbus-char-add-of_node_put.patch
+ patches.kernel.org/4.4.169-027-drivers-sbus-char-add-of_node_put.patch
+ patches.kernel.org/4.4.169-028-drivers-tty-add-missing-of_node_put.patch
+ patches.kernel.org/4.4.169-029-ide-pmac-add-of_node_put.patch
+ patches.kernel.org/4.4.169-030-clk-mmp-Off-by-one-in-mmp_clk_add.patch
+ patches.kernel.org/4.4.169-031-Input-omap-keypad-fix-keyboard-debounce-confi.patch
+ patches.kernel.org/4.4.169-032-libata-whitelist-all-SAMSUNG-MZ7KM-solid-stat.patch
+ patches.kernel.org/4.4.169-033-mv88e6060-disable-hardware-level-MAC-learning.patch
+ patches.kernel.org/4.4.169-034-ARM-8814-1-mm-improve-fix-ARM-v7_dma_inv_rang.patch
+ patches.kernel.org/4.4.169-035-cifs-In-Kconfig-CONFIG_CIFS_POSIX-needs-depen.patch
+ patches.kernel.org/4.4.169-036-i2c-axxia-properly-handle-master-timeout.patch
+ patches.kernel.org/4.4.169-037-i2c-scmi-Fix-probe-error-on-devices-with-an-e.patch
+ patches.kernel.org/4.4.169-038-rtc-snvs-add-a-missing-write-sync.patch
+ patches.kernel.org/4.4.169-039-rtc-snvs-Add-timeouts-to-avoid-kernel-lockups.patch
+ patches.kernel.org/4.4.169-040-ALSA-isa-wavefront-prevent-some-out-of-bound-.patch
+ patches.kernel.org/4.4.169-041-Linux-4.4.169.patch
+ patches.kernel.org/4.4.170-001-USB-hso-Fix-OOB-memory-access-in-hso_probe-hs.patch
+ patches.kernel.org/4.4.170-002-xhci-Don-t-prevent-USB2-bus-suspend-in-state-.patch
+ patches.kernel.org/4.4.170-003-USB-serial-option-add-GosunCn-ZTE-WeLink-ME36.patch
+ patches.kernel.org/4.4.170-004-USB-serial-option-add-HP-lt4132.patch
+ patches.kernel.org/4.4.170-005-USB-serial-option-add-Simcom-SIM7500-SIM7600-.patch
+ patches.kernel.org/4.4.170-006-USB-serial-option-add-Fibocom-NL668-series.patch
+ patches.kernel.org/4.4.170-007-USB-serial-option-add-Telit-LN940-series.patch
+ patches.kernel.org/4.4.170-008-mmc-core-Reset-HPI-enabled-state-during-re-in.patch
+ patches.kernel.org/4.4.170-009-mmc-omap_hsmmc-fix-DMA-API-warning.patch
+ patches.kernel.org/4.4.170-010-gpio-max7301-fix-driver-for-use-with-CONFIG_V.patch
+ patches.kernel.org/4.4.170-011-Drivers-hv-vmbus-Return-EINVAL-for-the-sys-fi.patch
+ patches.kernel.org/4.4.170-012-x86-mtrr-Don-t-copy-uninitialized-gentry-fiel.patch
+ patches.kernel.org/4.4.170-013-drm-ioctl-Fix-Spectre-v1-vulnerabilities.patch
+ patches.kernel.org/4.4.170-014-ip6mr-Fix-potential-Spectre-v1-vulnerability.patch
+ patches.kernel.org/4.4.170-015-ipv4-Fix-potential-Spectre-v1-vulnerability.patch
+ patches.kernel.org/4.4.170-016-ax25-fix-a-use-after-free-in-ax25_fillin_cb.patch
+ patches.kernel.org/4.4.170-017-ibmveth-fix-DMA-unmap-error-in-ibmveth_xmit_s.patch
+ patches.kernel.org/4.4.170-018-ieee802154-lowpan_header_create-check-must-ch.patch
+ patches.kernel.org/4.4.170-019-ipv6-explicitly-initialize-udp6_addr-in-udp_s.patch
+ patches.kernel.org/4.4.170-020-isdn-fix-kernel-infoleak-in-capi_unlocked_ioc.patch
+ patches.kernel.org/4.4.170-021-netrom-fix-locking-in-nr_find_socket.patch
+ patches.kernel.org/4.4.170-022-packet-validate-address-length.patch
+ patches.kernel.org/4.4.170-023-packet-validate-address-length-if-non-zero.patch
+ patches.kernel.org/4.4.170-024-sctp-initialize-sin6_flowinfo-for-ipv6-addrs-.patch
+ patches.kernel.org/4.4.170-025-vhost-make-sure-used-idx-is-seen-before-log-i.patch
+ patches.kernel.org/4.4.170-026-VSOCK-Send-reset-control-packet-when-socket-i.patch
+ patches.kernel.org/4.4.170-027-xen-netfront-tolerate-frags-with-no-data.patch
+ patches.kernel.org/4.4.170-028-gro_cell-add-napi_disable-in-gro_cells_destro.patch
+ patches.kernel.org/4.4.170-029-sock-Make-sock-sk_stamp-thread-safe.patch
+ patches.kernel.org/4.4.170-030-ALSA-rme9652-Fix-potential-Spectre-v1-vulnera.patch
+ patches.kernel.org/4.4.170-031-ALSA-emu10k1-Fix-potential-Spectre-v1-vulnera.patch
+ patches.kernel.org/4.4.170-032-ALSA-pcm-Fix-potential-Spectre-v1-vulnerabili.patch
+ patches.kernel.org/4.4.170-033-ALSA-emux-Fix-potential-Spectre-v1-vulnerabil.patch
+ patches.kernel.org/4.4.170-034-ALSA-hda-add-mute-LED-support-for-HP-EliteBoo.patch
+ patches.kernel.org/4.4.170-035-ALSA-hda-tegra-clear-pending-irq-handlers.patch
+ patches.kernel.org/4.4.170-036-USB-serial-pl2303-add-ids-for-Hewlett-Packard.patch
+ patches.kernel.org/4.4.170-037-USB-serial-option-add-Fibocom-NL678-series.patch
+ patches.kernel.org/4.4.170-038-usb-r8a66597-Fix-a-possible-concurrency-use-a.patch
+ patches.kernel.org/4.4.170-039-Input-elan_i2c-add-ACPI-ID-for-touchpad-in-AS.patch
+ patches.kernel.org/4.4.170-040-KVM-x86-Use-jmp-to-invoke-kvm_spurious_fault-.patch
+ patches.kernel.org/4.4.170-041-perf-pmu-Suppress-potential-format-truncation.patch
+ patches.kernel.org/4.4.170-042-ext4-fix-possible-use-after-free-in-ext4_quot.patch
+ patches.kernel.org/4.4.170-043-ext4-missing-unlock-put_page-in-ext4_try_to_w.patch
+ patches.kernel.org/4.4.170-044-ext4-fix-EXT4_IOC_GROUP_ADD-ioctl.patch
+ patches.kernel.org/4.4.170-045-ext4-force-inode-writes-when-nfsd-calls-commi.patch
+ patches.kernel.org/4.4.170-046-spi-bcm2835-Fix-race-on-DMA-termination.patch
+ patches.kernel.org/4.4.170-047-spi-bcm2835-Fix-book-keeping-of-DMA-terminati.patch
+ patches.kernel.org/4.4.170-048-spi-bcm2835-Avoid-finishing-transfer-prematur.patch
+ patches.kernel.org/4.4.170-049-cdc-acm-fix-abnormal-DATA-RX-issue-for-Mediat.patch
+ patches.kernel.org/4.4.170-050-media-vivid-free-bitmap_cap-when-updating-std.patch
+ patches.kernel.org/4.4.170-051-MIPS-Ensure-pmd_present-returns-false-after-p.patch
+ patches.kernel.org/4.4.170-052-MIPS-Align-kernel-load-address-to-64KB.patch
+ patches.kernel.org/4.4.170-053-CIFS-Fix-error-mapping-for-SMB2_LOCK-command-.patch
+ patches.kernel.org/4.4.170-054-x86-kvm-vmx-do-not-use-vm-exit-instruction-le.patch
+ patches.kernel.org/4.4.170-055-spi-bcm2835-Unbreak-the-build-of-esoteric-con.patch
+ patches.kernel.org/4.4.170-056-powerpc-Fix-COFF-zImage-booting-on-old-powerm.patch
+ patches.kernel.org/4.4.170-057-ARM-imx-update-the-cpu-power-up-timing-settin.patch
+ patches.kernel.org/4.4.170-058-Input-restore-EV_ABS-ABS_RESERVED.patch
+ patches.kernel.org/4.4.170-059-checkstack.pl-fix-for-aarch64.patch
+ patches.kernel.org/4.4.170-060-xfrm-Fix-bucket-count-reported-to-userspace.patch
+ patches.kernel.org/4.4.170-061-scsi-bnx2fc-Fix-NULL-dereference-in-error-han.patch
+ patches.kernel.org/4.4.170-062-Input-omap-keypad-fix-idle-configuration-to-n.patch
+ patches.kernel.org/4.4.170-063-scsi-zfcp-fix-posting-too-many-status-read-bu.patch
+ patches.kernel.org/4.4.170-064-fork-record-start_time-late.patch
+ patches.kernel.org/4.4.170-065-hwpoison-memory_hotplug-allow-hwpoisoned-page.patch
+ patches.kernel.org/4.4.170-067-mm-devm_memremap_pages-kill-mapping-System-RA.patch
+ patches.kernel.org/4.4.170-068-sunrpc-fix-cache_head-leak-due-to-queued-requ.patch
+ patches.kernel.org/4.4.170-069-sunrpc-use-SVC_NET-in-svcauth_gss_-functions.patch
+ patches.kernel.org/4.4.170-070-crypto-x86-chacha20-avoid-sleeping-with-preem.patch
+ patches.kernel.org/4.4.170-071-ALSA-cs46xx-Potential-NULL-dereference-in-pro.patch
+ patches.kernel.org/4.4.170-072-ALSA-usb-audio-Avoid-access-before-bLength-ch.patch
+ patches.kernel.org/4.4.170-073-ALSA-usb-audio-Fix-an-out-of-bound-read-in-cr.patch
+ patches.kernel.org/4.4.170-074-dlm-fixed-memory-leaks-after-failed-ls_remove.patch
+ patches.kernel.org/4.4.170-075-dlm-possible-memory-leak-on-error-path-in-cre.patch
+ patches.kernel.org/4.4.170-076-dlm-lost-put_lkb-on-error-path-in-receive_con.patch
+ patches.kernel.org/4.4.170-077-dlm-memory-leaks-on-error-path-in-dlm_user_re.patch
+ patches.kernel.org/4.4.170-078-gfs2-Fix-loop-in-gfs2_rbm_find.patch
+ patches.kernel.org/4.4.170-079-b43-Fix-error-in-cordic-routine.patch
+ patches.kernel.org/4.4.170-080-9p-net-put-a-lower-bound-on-msize.patch
+ patches.kernel.org/4.4.170-081-iommu-vt-d-Handle-domain-agaw-being-less-than.patch
+ patches.kernel.org/4.4.170-082-ceph-don-t-update-importing-cap-s-mseq-when-h.patch
+ patches.kernel.org/4.4.170-083-genwqe-Fix-size-check.patch
+ patches.kernel.org/4.4.170-084-intel_th-msu-Fix-an-off-by-one-in-attribute-s.patch
+ patches.kernel.org/4.4.170-085-power-supply-olpc_battery-correct-the-tempera.patch
+ patches.kernel.org/4.4.170-086-Linux-4.4.170.patch
########################################################
# Build fixes that apply to the vanilla kernel too.
@@ -21334,7 +21459,6 @@
patches.drivers/0022-ipmi_ssif-remove-redundant-null-check-on-array-clien.patch
patches.drivers/0023-ipmi-Use-the-proper-default-value-for-register-size-.patch
patches.drivers/0024-ipmi-ssif-Use-i2c_adapter_id-instead-of-adapter-nr.patch
- patches.fixes/0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch
patches.fixes/mm-make-PR_SET_THP_DISABLE-immediately-active.patch
patches.suse/0001-mm-memory_hotplug-support-movable_node-for-hotplugab.patch
patches.fixes/0001-mm-memory_hotplug-simplify-empty-node-mask-handling-.patch
@@ -22804,7 +22928,6 @@
patches.drivers/ibmvnic-Remove-skb-protocol-checks-in-ibmvnic_xmit.patch
patches.fixes/0001-seq_file-fix-incomplete-reset-on-read-from-zero-offs.patch
patches.drivers/0004-KVM-arm-arm64-Handle-CPU_PM_ENTER_FAILED.patch
- patches.fixes/x86-kvm-vmx-do-not-use-vm-exit-instruction-length-fo.patch
patches.arch/KVM-PPC-Book3S-PR-Fix-svcpu-copying-with-preemption-.patch
patches.drivers/0040-bcache-add-journal-statistic.patch
patches.drivers/0041-bcache-fix-high-CPU-occupancy-during-journal.patch
@@ -22973,7 +23096,6 @@
patches.drivers/ibmvnic-Potential-NULL-dereference-in-clean_one_tx_p.patch
patches.drivers/net-ena-Eliminate-duplicate-barriers-on-weakly-order.patch
patches.drivers/net-mlx5e-Remove-unused-define-MLX5_MPWRQ_STRIDES_PE.patch
- patches.drivers/mac80211-don-t-WARN-on-bad-WMM-parameters-from-buggy
patches.drivers/ibmvnic-Disable-irqs-before-exiting-reset-from-close.patch
patches.drivers/media-au0828-fix-VIDEO_V4L2-dependency
patches.fixes/xfs-Remove-dead-code-from-inode-recover-function.patch
@@ -23200,7 +23322,6 @@
patches.drivers/nvmet-switch-loopback-target-state-to-connecting-whe.patch
patches.arch/powerpc-pseries-Fix-CONFIG_NUMA-n-build.patch
patches.fixes/ceph-fix-rsize-wsize-capping-in-ceph_direct_read_write.patch
- patches.drivers/mac80211-Fix-condition-validating-WMM-IE
patches.drivers/net-mlx5-E-Switch-Include-VF-RDMA-stats-in-vport-sta.patch
patches.drivers/net-mlx5e-Err-if-asked-to-offload-TC-match-on-frag-b.patch
patches.suse/init-fix-false-positives-in-w-x-checking.patch
@@ -23717,17 +23838,14 @@
patches.fixes/0001-fscache-Fix-race-in-fscache_op_complete-due-to-split.patch
patches.fixes/0001-xen-x86-add-diagnostic-printout-to-xen_mc_flush-in-c.patch
patches.fixes/scsi-lpfc-fix-block-guard-enablement-on-sli3-adapters.patch
- patches.fixes/SUNRPC-Fix-a-potential-race-in-xprt_connect.patch
patches.fixes/nvme-validate-controller-state-before-rescheduling-k.patch
patches.drivers/revert-pci-aspm-do-not-initialize-link-state-when-aspm_disabled-is-set
patches.drivers/net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch
patches.fixes/ipv4-ipv6-netfilter-Adjust-the-frag-mem-limit-when-t.patch
patches.drivers/net-mlx4_core-Correctly-set-PFC-param-if-global-paus.patch
patches.drivers/IB-hfi1-Fix-an-out-of-bounds-access-in-get_hw_stats.patch
- patches.fixes/0001-Revert-drm-rockchip-Allow-driver-to-be-shutdown-on-r.patch
patches.arch/ibmvnic-Convert-reset-work-item-mutex-to-spin-lock.patch
patches.arch/ibmvnic-Fix-non-atomic-memory-allocation-in-IRQ-cont.patch
- patches.drivers/USB-hso-Fix-OOB-memory-access-in-hso_probe-hso_get_c.patch
patches.fixes/net-ipv4-do-not-handle-duplicate-fragments-as-overla.patch
patches.fixes/0001-drm-rcar-du-Fix-vblank-initialization.patch
patches.fixes/0001-drm-rcar-du-Fix-external-clock-error-checks.patch
@@ -23735,9 +23853,7 @@
patches.fixes/scsi-target-add-emulate_pr-backstore-attr-to-toggle-.patch
patches.fixes/scsi-target-drop-unused-pi_prot_format-attribute-sto.patch
patches.drivers/revert-iommu-io-pgtable-arm-check-for-v7s-incapable-systems
- patches.drivers/iommu-vt-d-handle-domain-agaw-being-less-than-iommu-agaw
patches.drivers/iommu-amd-fix-amd_iommu-force_isolation
- patches.fixes/ceph-don-t-update-importing-cap-s-mseq-when-handing-cap-export.patch
patches.fixes/0001-fbdev-fbmem-behave-better-with-small-rotated-display.patch
patches.fixes/0001-fbdev-fbcon-Fix-unregister-crash-when-more-than-one-.patch
@@ -24016,12 +24132,13 @@
patches.fixes/0005-mm-memory_hotplug-be-more-verbose-for-memory-offline.patch
patches.fixes/mm-put_and_wait_on_page_locked-while-page-is-migrated.patch
- patches.fixes/0001-hwpoison-memory_hotplug-allow-hwpoisoned-pages-to-be.patch
patches.kabi/0001-hwpoison-memory_hotplug-allow-hwpoisoned-pages-to-be-kabi.patch
# bsc#1119204
patches.fixes/0001-fix-huge_pte_alloc-bug-on.patch
+ patches.fixes/vfs-Avoid-softlockups-in-drop_pagecache_sb.patch
+
########################################################
# IPC patches
########################################################
@@ -24367,7 +24484,6 @@
patches.fixes/nfs-direct-write-fix.patch
patches.kabi/0008-pnfs-set-NFS_IOHDR_REDO-in-pnfs_read_resend_pnfs.patch
patches.kabi/0001-NFS-Ensure-we-commit-after-writeback-is-complete.kabi
- patches.fixes/sunrpc-use-SVC_NET-in-svcauth_gss_-functions.patch
patches.fixes/sunrpc-use-after-free-in-svc_process_common.patch
patches.kabi/sunrpc-use-after-free-in-svc_process_common.patch