Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichal Kubecek <mkubecek@suse.cz>2019-11-05 21:38:46 +0100
committerMichal Kubecek <mkubecek@suse.cz>2019-11-05 22:03:20 +0100
commit2115d08ae82318173a5ff73fc2522d70227a76c5 (patch)
tree4d302cb512f498afe5f1e72404262ae0747a086c
parente44b1dd3a32f7093dc21747b4a486d2d609c2855 (diff)
parenta38356633d76b76de8597908f39e7cd34e57bdf8 (diff)
Merge branch 'users/tiwai/SLE15-SP2/for-next' into SLE15-SP2
Pull various driver fixes (mostly git-fixes) from Takashi Iwai. Already present: patches.suse/keys-Fix-memory-leak-in-copy_net_ns.patch Refresh: patches.suse/macsec-fix-refcnt-leak-in-module-exit-routine.patch patches.suse/net-remove-unnecessary-variables-and-callback.patch
-rw-r--r--patches.suse/ALSA-hda-ca0132-Fix-possible-workqueue-stall.patch45
-rw-r--r--patches.suse/UAS-Revert-commit-3ae62a42090f-UAS-fix-alignment-of-.patch96
-rw-r--r--patches.suse/USB-ldusb-fix-control-message-timeout.patch39
-rw-r--r--patches.suse/USB-ldusb-fix-ring-buffer-locking.patch53
-rw-r--r--patches.suse/USB-serial-whiteheat-fix-potential-slab-corruption.patch40
-rw-r--r--patches.suse/drm-i915-Fix-PCH-reference-clock-for-FDI-on-HSW-BDW.patch128
-rw-r--r--patches.suse/drm-v3d-Fix-memory-leak-in-v3d_submit_cl_ioctl.patch50
-rw-r--r--patches.suse/hwmon-ina3221-Fix-read-timeout-issue.patch42
-rw-r--r--patches.suse/keys-Fix-memory-leak-in-copy_net_ns.patch5
-rw-r--r--patches.suse/macsec-fix-refcnt-leak-in-module-exit-routine.patch69
-rw-r--r--patches.suse/mt76-dma-fix-buffer-unmap-with-non-linear-skbs.patch69
-rw-r--r--patches.suse/net-remove-unnecessary-variables-and-callback.patch94
-rw-r--r--patches.suse/nl80211-fix-validation-of-mesh-path-nexthop.patch38
-rw-r--r--patches.suse/r8169-fix-wrong-PHY-ID-issue-with-RTL8168dp.patch44
-rw-r--r--patches.suse/usb-dwc3-gadget-fix-race-when-disabling-ep-with-canc.patch45
-rw-r--r--patches.suse/usb-dwc3-pci-prevent-memory-leak-in-dwc3_pci_probe.patch38
-rw-r--r--patches.suse/usb-dwc3-select-CONFIG_REGMAP_MMIO.patch42
-rw-r--r--patches.suse/usb-gadget-udc-atmel-Fix-interrupt-storm-in-FIFO-mod.patch42
-rw-r--r--patches.suse/usb-storage-Revert-commit-747668dbc061-usb-storage-S.patch89
-rw-r--r--patches.suse/usb-xhci-fix-Immediate-Data-Transfer-endianness.patch54
-rw-r--r--patches.suse/virt_wifi-fix-refcnt-leak-in-module-exit-routine.patch167
-rw-r--r--patches.suse/wimax-i2400-Fix-memory-leak-in-i2400m_op_rfkill_sw_t.patch44
-rw-r--r--patches.suse/xhci-Fix-use-after-free-regression-in-xhci-clear-hub.patch129
-rw-r--r--series.conf21
24 files changed, 1434 insertions, 49 deletions
diff --git a/patches.suse/ALSA-hda-ca0132-Fix-possible-workqueue-stall.patch b/patches.suse/ALSA-hda-ca0132-Fix-possible-workqueue-stall.patch
new file mode 100644
index 0000000000..5588395b3d
--- /dev/null
+++ b/patches.suse/ALSA-hda-ca0132-Fix-possible-workqueue-stall.patch
@@ -0,0 +1,45 @@
+From 15c2b3cc09a31620914955cb2a89c277c18ee999 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 5 Nov 2019 14:43:16 +0100
+Subject: [PATCH] ALSA: hda/ca0132 - Fix possible workqueue stall
+References: bsc#1155836
+Git-commit: 15c2b3cc09a31620914955cb2a89c277c18ee999
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
+Patch-mainline: Queued in subsystem maintainer repository
+
+The unsolicited event handler for the headphone jack on CA0132 codec
+driver tries to reschedule the another delayed work with
+cancel_delayed_work_sync(). It's no good idea, unfortunately,
+especially after we changed the work queue to the standard global
+one; this may lead to a stall because both works are using the same
+global queue.
+
+Fix it by dropping the _sync but does call cancel_delayed_work()
+instead.
+
+Fixes: 993884f6a26c ("ALSA: hda/ca0132 - Delay HP amp turnon.")
+Buglink: https://bugzilla.suse.com/show_bug.cgi?id=1155836
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20191105134316.19294-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_ca0132.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 6d1fb7c11f17..b7a1abb3e231 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -7604,7 +7604,7 @@ static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
+ /* Delay enabling the HP amp, to let the mic-detection
+ * state machine run.
+ */
+- cancel_delayed_work_sync(&spec->unsol_hp_work);
++ cancel_delayed_work(&spec->unsol_hp_work);
+ schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500));
+ tbl = snd_hda_jack_tbl_get(codec, cb->nid);
+ if (tbl)
+--
+2.16.4
+
diff --git a/patches.suse/UAS-Revert-commit-3ae62a42090f-UAS-fix-alignment-of-.patch b/patches.suse/UAS-Revert-commit-3ae62a42090f-UAS-fix-alignment-of-.patch
new file mode 100644
index 0000000000..94c2505151
--- /dev/null
+++ b/patches.suse/UAS-Revert-commit-3ae62a42090f-UAS-fix-alignment-of-.patch
@@ -0,0 +1,96 @@
+From 1186f86a71130a7635a20843e355bb880c7349b2 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 23 Oct 2019 11:34:33 -0400
+Subject: [PATCH] UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather segments")
+Git-commit: 1186f86a71130a7635a20843e355bb880c7349b2
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+Commit 3ae62a42090f ("UAS: fix alignment of scatter/gather segments"),
+copying a similar commit for usb-storage, attempted to solve a problem
+involving scatter-gather I/O and USB/IP by setting the
+virt_boundary_mask for mass-storage devices.
+
+However, it now turns out that the analogous change in usb-storage
+interacted badly with commit 09324d32d2a0 ("block: force an unlimited
+segment size on queues with a virt boundary"), which was added later.
+A typical error message is:
+
+ ehci-pci 0000:00:13.2: swiotlb buffer is full (sz: 327680 bytes),
+ total 32768 (slots), used 97 (slots)
+
+There is no longer any reason to keep the virt_boundary_mask setting
+in the uas driver. It was needed in the first place only for
+handling devices with a block size smaller than the maxpacket size and
+where the host controller was not capable of fully general
+scatter-gather operation (that is, able to merge two SG segments into
+a single USB packet). But:
+
+ High-speed or slower connections never use a bulk maxpacket
+ value larger than 512;
+
+ The SCSI layer does not handle block devices with a block size
+ smaller than 512 bytes;
+
+ All the host controllers capable of SuperSpeed operation can
+ handle fully general SG;
+
+ Since commit ea44d190764b ("usbip: Implement SG support to
+ vhci-hcd and stub driver") was merged, the USB/IP driver can
+ also handle SG.
+
+Therefore all supported device/controller combinations should be okay
+with no need for any special virt_boundary_mask. So in order to head
+off potential problems similar to those affecting usb-storage, this
+patch reverts commit 3ae62a42090f.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Cc: Oliver Neukum <oneukum@suse.com>
+Cc: <stable@vger.kernel.org>
+Acked-by: Christoph Hellwig <hch@lst.de>
+Fixes: 3ae62a42090f ("UAS: fix alignment of scatter/gather segments")
+Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1910231132470.1878-100000@iolanthe.rowland.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/storage/uas.c | 20 --------------------
+ 1 file changed, 20 deletions(-)
+
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index bf80d6f81f58..34538253f12c 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -789,29 +789,9 @@ static int uas_slave_alloc(struct scsi_device *sdev)
+ {
+ struct uas_dev_info *devinfo =
+ (struct uas_dev_info *)sdev->host->hostdata;
+- int maxp;
+
+ sdev->hostdata = devinfo;
+
+- /*
+- * We have two requirements here. We must satisfy the requirements
+- * of the physical HC and the demands of the protocol, as we
+- * definitely want no additional memory allocation in this path
+- * ruling out using bounce buffers.
+- *
+- * For a transmission on USB to continue we must never send
+- * a package that is smaller than maxpacket. Hence the length of each
+- * scatterlist element except the last must be divisible by the
+- * Bulk maxpacket value.
+- * If the HC does not ensure that through SG,
+- * the upper layer must do that. We must assume nothing
+- * about the capabilities off the HC, so we use the most
+- * pessimistic requirement.
+- */
+-
+- maxp = usb_maxpacket(devinfo->udev, devinfo->data_in_pipe, 0);
+- blk_queue_virt_boundary(sdev->request_queue, maxp - 1);
+-
+ /*
+ * The protocol has no requirements on alignment in the strict sense.
+ * Controllers may or may not have alignment restrictions.
+--
+2.16.4
+
diff --git a/patches.suse/USB-ldusb-fix-control-message-timeout.patch b/patches.suse/USB-ldusb-fix-control-message-timeout.patch
new file mode 100644
index 0000000000..7c4a34ecf8
--- /dev/null
+++ b/patches.suse/USB-ldusb-fix-control-message-timeout.patch
@@ -0,0 +1,39 @@
+From 52403cfbc635d28195167618690595013776ebde Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 22 Oct 2019 17:31:27 +0200
+Subject: [PATCH] USB: ldusb: fix control-message timeout
+Git-commit: 52403cfbc635d28195167618690595013776ebde
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+USB control-message timeouts are specified in milliseconds, not jiffies.
+Waiting 83 minutes for a transfer to complete is a bit excessive.
+
+Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver")
+Cc: stable <stable@vger.kernel.org> # 2.6.13
+Reported-by: syzbot+a4fbb3bb76cda0ea4e58@syzkaller.appspotmail.com
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191022153127.22295-1-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/misc/ldusb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
+index dd1ea25e42b1..8f86b4ebca89 100644
+--- a/drivers/usb/misc/ldusb.c
++++ b/drivers/usb/misc/ldusb.c
+@@ -581,7 +581,7 @@ static ssize_t ld_usb_write(struct file *file, const char __user *buffer,
+ 1 << 8, 0,
+ dev->interrupt_out_buffer,
+ bytes_to_write,
+- USB_CTRL_SET_TIMEOUT * HZ);
++ USB_CTRL_SET_TIMEOUT);
+ if (retval < 0)
+ dev_err(&dev->intf->dev,
+ "Couldn't submit HID_REQ_SET_REPORT %d\n",
+--
+2.16.4
+
diff --git a/patches.suse/USB-ldusb-fix-ring-buffer-locking.patch b/patches.suse/USB-ldusb-fix-ring-buffer-locking.patch
new file mode 100644
index 0000000000..0bc9c608c7
--- /dev/null
+++ b/patches.suse/USB-ldusb-fix-ring-buffer-locking.patch
@@ -0,0 +1,53 @@
+From d98ee2a19c3334e9343df3ce254b496f1fc428eb Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 22 Oct 2019 16:32:02 +0200
+Subject: [PATCH] USB: ldusb: fix ring-buffer locking
+Git-commit: d98ee2a19c3334e9343df3ce254b496f1fc428eb
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+The custom ring-buffer implementation was merged without any locking or
+explicit memory barriers, but a spinlock was later added by commit
+9d33efd9a791 ("USB: ldusb bugfix").
+
+The lock did not cover the update of the tail index once the entry had
+been processed, something which could lead to memory corruption on
+weakly ordered architectures or due to compiler optimisations.
+
+Specifically, a completion handler running on another CPU might observe
+the incremented tail index and update the entry before ld_usb_read() is
+done with it.
+
+Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver")
+Fixes: 9d33efd9a791 ("USB: ldusb bugfix")
+Cc: stable <stable@vger.kernel.org> # 2.6.13
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191022143203.5260-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/misc/ldusb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
+index 15b5f06fb0b3..c3e764909fd0 100644
+--- a/drivers/usb/misc/ldusb.c
++++ b/drivers/usb/misc/ldusb.c
+@@ -495,11 +495,11 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
+ retval = -EFAULT;
+ goto unlock_exit;
+ }
+- dev->ring_tail = (dev->ring_tail+1) % ring_buffer_size;
+-
+ retval = bytes_to_read;
+
+ spin_lock_irq(&dev->rbsl);
++ dev->ring_tail = (dev->ring_tail + 1) % ring_buffer_size;
++
+ if (dev->buffer_overflow) {
+ dev->buffer_overflow = 0;
+ spin_unlock_irq(&dev->rbsl);
+--
+2.16.4
+
diff --git a/patches.suse/USB-serial-whiteheat-fix-potential-slab-corruption.patch b/patches.suse/USB-serial-whiteheat-fix-potential-slab-corruption.patch
new file mode 100644
index 0000000000..9e2559cbd4
--- /dev/null
+++ b/patches.suse/USB-serial-whiteheat-fix-potential-slab-corruption.patch
@@ -0,0 +1,40 @@
+From 1251dab9e0a2c4d0d2d48370ba5baa095a5e8774 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 29 Oct 2019 11:23:53 +0100
+Subject: [PATCH] USB: serial: whiteheat: fix potential slab corruption
+Git-commit: 1251dab9e0a2c4d0d2d48370ba5baa095a5e8774
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+Fix a user-controlled slab buffer overflow due to a missing sanity check
+on the bulk-out transfer buffer used for control requests.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191029102354.2733-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/whiteheat.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
+index 79314d8c94a4..76cabcb30d21 100644
+--- a/drivers/usb/serial/whiteheat.c
++++ b/drivers/usb/serial/whiteheat.c
+@@ -559,6 +559,10 @@ static int firm_send_command(struct usb_serial_port *port, __u8 command,
+
+ command_port = port->serial->port[COMMAND_PORT];
+ command_info = usb_get_serial_port_data(command_port);
++
++ if (command_port->bulk_out_size < datasize + 1)
++ return -EIO;
++
+ mutex_lock(&command_info->mutex);
+ command_info->command_finished = false;
+
+--
+2.16.4
+
diff --git a/patches.suse/drm-i915-Fix-PCH-reference-clock-for-FDI-on-HSW-BDW.patch b/patches.suse/drm-i915-Fix-PCH-reference-clock-for-FDI-on-HSW-BDW.patch
new file mode 100644
index 0000000000..9c513b81a8
--- /dev/null
+++ b/patches.suse/drm-i915-Fix-PCH-reference-clock-for-FDI-on-HSW-BDW.patch
@@ -0,0 +1,128 @@
+From 59cd826fb5e7889515bf5771e295e0624c348571 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Tue, 22 Oct 2019 21:56:43 +0300
+Subject: [PATCH] drm/i915: Fix PCH reference clock for FDI on HSW/BDW
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 59cd826fb5e7889515bf5771e295e0624c348571
+Patch-mainline: v5.4-rc6
+No-fix: dd5279c71405533d4ddbb9453effc60f0f5bf211
+References: git-fixes
+
+The change to skip the PCH reference initialization during fastboot
+did end up breaking FDI. To fix that let's try to do the PCH reference
+init whenever we're disabling a DPLL that was using said reference
+previously.
+
+Cc: stable@vger.kernel.org
+Tested-by: Andrija <akijo97@gmail.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112084
+Fixes: b16c7ed95caf ("drm/i915: Do not touch the PCH SSC reference if a PLL is using it")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191022185643.1483-1-ville.syrjala@linux.intel.com
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+(cherry picked from commit dd5279c71405533d4ddbb9453effc60f0f5bf211)
+
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/i915/display/intel_display.c | 11 ++++++-----
+ drivers/gpu/drm/i915/display/intel_dpll_mgr.c | 15 +++++++++++++++
+ drivers/gpu/drm/i915/i915_drv.h | 2 ++
+ 3 files changed, 23 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
+index aa54bb22796d..dfff6f4357b8 100644
+--- a/drivers/gpu/drm/i915/display/intel_display.c
++++ b/drivers/gpu/drm/i915/display/intel_display.c
+@@ -9315,7 +9315,6 @@ static bool wrpll_uses_pch_ssc(struct drm_i915_private *dev_priv,
+ static void lpt_init_pch_refclk(struct drm_i915_private *dev_priv)
+ {
+ struct intel_encoder *encoder;
+- bool pch_ssc_in_use = false;
+ bool has_fdi = false;
+
+ for_each_intel_encoder(&dev_priv->drm, encoder) {
+@@ -9343,22 +9342,24 @@ static void lpt_init_pch_refclk(struct drm_i915_private *dev_priv)
+ * clock hierarchy. That would also allow us to do
+ * clock bending finally.
+ */
++ dev_priv->pch_ssc_use = 0;
++
+ if (spll_uses_pch_ssc(dev_priv)) {
+ DRM_DEBUG_KMS("SPLL using PCH SSC\n");
+- pch_ssc_in_use = true;
++ dev_priv->pch_ssc_use |= BIT(DPLL_ID_SPLL);
+ }
+
+ if (wrpll_uses_pch_ssc(dev_priv, DPLL_ID_WRPLL1)) {
+ DRM_DEBUG_KMS("WRPLL1 using PCH SSC\n");
+- pch_ssc_in_use = true;
++ dev_priv->pch_ssc_use |= BIT(DPLL_ID_WRPLL1);
+ }
+
+ if (wrpll_uses_pch_ssc(dev_priv, DPLL_ID_WRPLL2)) {
+ DRM_DEBUG_KMS("WRPLL2 using PCH SSC\n");
+- pch_ssc_in_use = true;
++ dev_priv->pch_ssc_use |= BIT(DPLL_ID_WRPLL2);
+ }
+
+- if (pch_ssc_in_use)
++ if (dev_priv->pch_ssc_use)
+ return;
+
+ if (has_fdi) {
+diff --git a/drivers/gpu/drm/i915/display/intel_dpll_mgr.c b/drivers/gpu/drm/i915/display/intel_dpll_mgr.c
+index b8148f838354..d5a298c3c83b 100644
+--- a/drivers/gpu/drm/i915/display/intel_dpll_mgr.c
++++ b/drivers/gpu/drm/i915/display/intel_dpll_mgr.c
+@@ -525,16 +525,31 @@ static void hsw_ddi_wrpll_disable(struct drm_i915_private *dev_priv,
+ val = I915_READ(WRPLL_CTL(id));
+ I915_WRITE(WRPLL_CTL(id), val & ~WRPLL_PLL_ENABLE);
+ POSTING_READ(WRPLL_CTL(id));
++
++ /*
++ * Try to set up the PCH reference clock once all DPLLs
++ * that depend on it have been shut down.
++ */
++ if (dev_priv->pch_ssc_use & BIT(id))
++ intel_init_pch_refclk(dev_priv);
+ }
+
+ static void hsw_ddi_spll_disable(struct drm_i915_private *dev_priv,
+ struct intel_shared_dpll *pll)
+ {
++ enum intel_dpll_id id = pll->info->id;
+ u32 val;
+
+ val = I915_READ(SPLL_CTL);
+ I915_WRITE(SPLL_CTL, val & ~SPLL_PLL_ENABLE);
+ POSTING_READ(SPLL_CTL);
++
++ /*
++ * Try to set up the PCH reference clock once all DPLLs
++ * that depend on it have been shut down.
++ */
++ if (dev_priv->pch_ssc_use & BIT(id))
++ intel_init_pch_refclk(dev_priv);
+ }
+
+ static bool hsw_ddi_wrpll_get_hw_state(struct drm_i915_private *dev_priv,
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 772154e4073e..953e1d12c23c 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1723,6 +1723,8 @@ struct drm_i915_private {
+ struct work_struct idle_work;
+ } gem;
+
++ u8 pch_ssc_use;
++
+ /* For i945gm vblank irq vs. C3 workaround */
+ struct {
+ struct work_struct work;
+--
+2.16.4
+
diff --git a/patches.suse/drm-v3d-Fix-memory-leak-in-v3d_submit_cl_ioctl.patch b/patches.suse/drm-v3d-Fix-memory-leak-in-v3d_submit_cl_ioctl.patch
new file mode 100644
index 0000000000..ec5f036525
--- /dev/null
+++ b/patches.suse/drm-v3d-Fix-memory-leak-in-v3d_submit_cl_ioctl.patch
@@ -0,0 +1,50 @@
+From 29cd13cfd7624726d9e6becbae9aa419ef35af7f Mon Sep 17 00:00:00 2001
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Mon, 21 Oct 2019 13:52:49 -0500
+Subject: [PATCH] drm/v3d: Fix memory leak in v3d_submit_cl_ioctl
+Git-commit: 29cd13cfd7624726d9e6becbae9aa419ef35af7f
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+In the impelementation of v3d_submit_cl_ioctl() there are two memory
+leaks. One is when allocation for bin fails, and the other is when bin
+initialization fails. If kcalloc fails to allocate memory for bin then
+render->base should be put. Also, if v3d_job_init() fails to initialize
+bin->base then allocated memory for bin should be released.
+
+Fixes: a783a09ee76d ("drm/v3d: Refactor job management.")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191021185250.26130-1-navid.emamdoost@gmail.com
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/v3d/v3d_gem.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
+index 5d80507b539b..19c092d75266 100644
+--- a/drivers/gpu/drm/v3d/v3d_gem.c
++++ b/drivers/gpu/drm/v3d/v3d_gem.c
+@@ -557,13 +557,16 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
+
+ if (args->bcl_start != args->bcl_end) {
+ bin = kcalloc(1, sizeof(*bin), GFP_KERNEL);
+- if (!bin)
++ if (!bin) {
++ v3d_job_put(&render->base);
+ return -ENOMEM;
++ }
+
+ ret = v3d_job_init(v3d, file_priv, &bin->base,
+ v3d_job_free, args->in_sync_bcl);
+ if (ret) {
+ v3d_job_put(&render->base);
++ kfree(bin);
+ return ret;
+ }
+
+--
+2.16.4
+
diff --git a/patches.suse/hwmon-ina3221-Fix-read-timeout-issue.patch b/patches.suse/hwmon-ina3221-Fix-read-timeout-issue.patch
new file mode 100644
index 0000000000..e50e926aae
--- /dev/null
+++ b/patches.suse/hwmon-ina3221-Fix-read-timeout-issue.patch
@@ -0,0 +1,42 @@
+From 2ccb4f16d013a0954459061d38172b1c53553ba6 Mon Sep 17 00:00:00 2001
+From: Nicolin Chen <nicoleotsuka@gmail.com>
+Date: Mon, 21 Oct 2019 17:59:22 -0700
+Subject: [PATCH] hwmon: (ina3221) Fix read timeout issue
+Git-commit: 2ccb4f16d013a0954459061d38172b1c53553ba6
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+After introducing "samples" to the calculation of wait time, the
+driver might timeout at the regmap_field_read_poll_timeout call,
+because the wait time could be longer than the 100000 usec limit
+due to a large "samples" number.
+
+So this patch sets the timeout limit to 2 times of the wait time
+in order to fix this issue.
+
+Fixes: 5c090abf945b ("hwmon: (ina3221) Add averaging mode support")
+Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Link: https://lore.kernel.org/r/20191022005922.30239-1-nicoleotsuka@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwmon/ina3221.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/ina3221.c b/drivers/hwmon/ina3221.c
+index 0037e2bdacd6..8a51dcf055ea 100644
+--- a/drivers/hwmon/ina3221.c
++++ b/drivers/hwmon/ina3221.c
+@@ -170,7 +170,7 @@ static inline int ina3221_wait_for_data(struct ina3221_data *ina)
+
+ /* Polling the CVRF bit to make sure read data is ready */
+ return regmap_field_read_poll_timeout(ina->fields[F_CVRF],
+- cvrf, cvrf, wait, 100000);
++ cvrf, cvrf, wait, wait * 2);
+ }
+
+ static int ina3221_read_value(struct ina3221_data *ina, unsigned int reg,
+--
+2.16.4
+
diff --git a/patches.suse/keys-Fix-memory-leak-in-copy_net_ns.patch b/patches.suse/keys-Fix-memory-leak-in-copy_net_ns.patch
index e23adc0a48..29791e2c28 100644
--- a/patches.suse/keys-Fix-memory-leak-in-copy_net_ns.patch
+++ b/patches.suse/keys-Fix-memory-leak-in-copy_net_ns.patch
@@ -3,7 +3,7 @@ Date: Sat, 19 Oct 2019 15:34:43 +0900
Subject: keys: Fix memory leak in copy_net_ns
Patch-mainline: v5.4-rc6
Git-commit: 82ecff655e7968151b0047f1b5de03b249e5c1c4
-References: bsc#1154353
+References: bsc#1154353 git-fixes
If copy_net_ns() failed after net_alloc(), net->key_domain is leaked.
Fix this, by freeing key_domain in error path.
@@ -41,13 +41,14 @@ Reported-and-tested-by: syzbot+3b3296d032353c33184b@syzkaller.appspotmail.com
Signed-off-by: Takeshi Misawa <jeliantsurux@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
---
net/core/net_namespace.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
-@@ -479,6 +479,7 @@ struct net *copy_net_ns(unsigned long fl
+@@ -479,6 +479,7 @@ struct net *copy_net_ns(unsigned long flags,
if (rv < 0) {
put_userns:
diff --git a/patches.suse/macsec-fix-refcnt-leak-in-module-exit-routine.patch b/patches.suse/macsec-fix-refcnt-leak-in-module-exit-routine.patch
new file mode 100644
index 0000000000..e7e2cda30a
--- /dev/null
+++ b/patches.suse/macsec-fix-refcnt-leak-in-module-exit-routine.patch
@@ -0,0 +1,69 @@
+From: Taehee Yoo <ap420073@gmail.com>
+Subject: macsec: fix refcnt leak in module exit routine
+Patch-mainline: v5.4-rc6
+Git-commit: 2bce1ebed17da54c65042ec2b962e3234bad5b47
+References: git-fixes
+
+When a macsec interface is created, it increases a refcnt to a lower
+device(real device). when macsec interface is deleted, the refcnt is
+decreased in macsec_free_netdev(), which is ->priv_destructor() of
+macsec interface.
+
+The problem scenario is this.
+When nested macsec interfaces are exiting, the exit routine of the
+macsec module makes refcnt leaks.
+
+Test commands:
+ ip link add dummy0 type dummy
+ ip link add macsec0 link dummy0 type macsec
+ ip link add macsec1 link macsec0 type macsec
+ modprobe -rv macsec
+
+[ 208.629433] unregister_netdevice: waiting for macsec0 to become free. Usage count = 1
+
+Steps of exit routine of macsec module are below.
+1. Calls ->dellink() in __rtnl_link_unregister().
+2. Checks refcnt and wait refcnt to be 0 if refcnt is not 0 in
+netdev_run_todo().
+3. Calls ->priv_destruvtor() in netdev_run_todo().
+
+Step2 checks refcnt, but step3 decreases refcnt.
+So, step2 waits forever.
+
+This patch makes the macsec module do not hold a refcnt of the lower
+device because it already holds a refcnt of the lower device with
+netdev_upper_dev_link().
+
+Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/macsec.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -3000,12 +3000,10 @@ static const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX + 1] = {
+ static void macsec_free_netdev(struct net_device *dev)
+ {
+ struct macsec_dev *macsec = macsec_priv(dev);
+- struct net_device *real_dev = macsec->real_dev;
+
+ free_percpu(macsec->stats);
+ free_percpu(macsec->secy.tx_sc.stats);
+
+- dev_put(real_dev);
+ }
+
+ static void macsec_setup(struct net_device *dev)
+@@ -3260,8 +3258,6 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ if (err < 0)
+ return err;
+
+- dev_hold(real_dev);
+-
+ macsec->nest_level = dev_get_nest_level(real_dev) + 1;
+
+ err = netdev_upper_dev_link(real_dev, dev, extack);
diff --git a/patches.suse/mt76-dma-fix-buffer-unmap-with-non-linear-skbs.patch b/patches.suse/mt76-dma-fix-buffer-unmap-with-non-linear-skbs.patch
new file mode 100644
index 0000000000..cb9c13cd43
--- /dev/null
+++ b/patches.suse/mt76-dma-fix-buffer-unmap-with-non-linear-skbs.patch
@@ -0,0 +1,69 @@
+From 7bd0650be63cbb9e45e394d689c81365fe48e495 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sun, 27 Oct 2019 20:53:09 +0100
+Subject: [PATCH] mt76: dma: fix buffer unmap with non-linear skbs
+Git-commit: 7bd0650be63cbb9e45e394d689c81365fe48e495
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+mt76 dma layer is supposed to unmap skb data buffers while keep txwi
+mapped on hw dma ring. At the moment mt76 wrongly unmap txwi or does
+not unmap data fragments in even positions for non-linear skbs. This
+issue may result in hw hangs with A-MSDU if the system relies on IOMMU
+or SWIOTLB. Fix this behaviour properly unmapping data fragments on
+non-linear skbs.
+
+Fixes: 17f1de56df05 ("mt76: add common code shared between multiple chipsets")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/mediatek/mt76/dma.c | 6 ++++--
+ drivers/net/wireless/mediatek/mt76/mt76.h | 5 +++--
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index c747eb24581c..8f69d00bd940 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -53,8 +53,10 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
+ u32 ctrl;
+ int i, idx = -1;
+
+- if (txwi)
++ if (txwi) {
+ q->entry[q->head].txwi = DMA_DUMMY_DATA;
++ q->entry[q->head].skip_buf0 = true;
++ }
+
+ for (i = 0; i < nbufs; i += 2, buf += 2) {
+ u32 buf0 = buf[0].addr, buf1 = 0;
+@@ -97,7 +99,7 @@ mt76_dma_tx_cleanup_idx(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ __le32 __ctrl = READ_ONCE(q->desc[idx].ctrl);
+ u32 ctrl = le32_to_cpu(__ctrl);
+
+- if (!e->txwi || !e->skb) {
++ if (!e->skip_buf0) {
+ __le32 addr = READ_ONCE(q->desc[idx].buf0);
+ u32 len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctrl);
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
+index dc468ed9434a..8aec7ccf2d79 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76.h
+@@ -93,8 +93,9 @@ struct mt76_queue_entry {
+ struct urb *urb;
+ };
+ enum mt76_txq_id qid;
+- bool schedule;
+- bool done;
++ bool skip_buf0:1;
++ bool schedule:1;
++ bool done:1;
+ };
+
+ struct mt76_queue_regs {
+--
+2.16.4
+
diff --git a/patches.suse/net-remove-unnecessary-variables-and-callback.patch b/patches.suse/net-remove-unnecessary-variables-and-callback.patch
index b34ab772f0..b89ceb6aa4 100644
--- a/patches.suse/net-remove-unnecessary-variables-and-callback.patch
+++ b/patches.suse/net-remove-unnecessary-variables-and-callback.patch
@@ -1,5 +1,4 @@
From: Taehee Yoo <ap420073@gmail.com>
-Date: Mon, 21 Oct 2019 18:47:58 +0000
Subject: net: remove unnecessary variables and callback
Patch-mainline: v5.4-rc6
Git-commit: f3b0a18bb6cb07a9abb75e21b1f08eeaefa78e81
@@ -22,27 +21,28 @@ So, this patch removes ->ndo_get_lock_subclass() callback.
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+
---
- drivers/net/bonding/bond_alb.c | 2 +-
- drivers/net/bonding/bond_main.c | 15 ---------------
- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 +-
- drivers/net/macsec.c | 9 ---------
- drivers/net/macvlan.c | 7 -------
- include/linux/if_macvlan.h | 1 -
- include/linux/if_vlan.h | 11 -----------
- include/linux/netdevice.h | 12 ------------
- include/net/bonding.h | 1 -
- net/8021q/vlan.c | 1 -
- net/8021q/vlan_dev.c | 6 ------
- net/core/dev.c | 19 -------------------
- net/core/dev_addr_lists.c | 12 ++++++------
- net/smc/smc_core.c | 2 +-
- net/smc/smc_pnet.c | 2 +-
+ drivers/net/bonding/bond_alb.c | 2 +-
+ drivers/net/bonding/bond_main.c | 15 ---------------
+ .../net/ethernet/mellanox/mlx5/core/en_tc.c | 2 +-
+ drivers/net/macsec.c | 9 ---------
+ drivers/net/macvlan.c | 7 -------
+ include/linux/if_macvlan.h | 1 -
+ include/linux/if_vlan.h | 11 -----------
+ include/linux/netdevice.h | 12 ------------
+ include/net/bonding.h | 1 -
+ net/8021q/vlan.c | 1 -
+ net/8021q/vlan_dev.c | 6 ------
+ net/core/dev.c | 19 -------------------
+ net/core/dev_addr_lists.c | 12 ++++++------
+ net/smc/smc_core.c | 2 +-
+ net/smc/smc_pnet.c | 2 +-
15 files changed, 10 insertions(+), 92 deletions(-)
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
-@@ -952,7 +952,7 @@ static int alb_upper_dev_walk(struct net
+@@ -952,7 +952,7 @@ static int alb_upper_dev_walk(struct net_device *upper, void *_data)
struct bond_vlan_tag *tags;
if (is_vlan_dev(upper) &&
@@ -53,7 +53,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
vlan_dev_vlan_proto(upper),
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
-@@ -1733,8 +1733,6 @@ int bond_enslave(struct net_device *bond
+@@ -1733,8 +1733,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
goto err_upper_unlink;
}
@@ -62,7 +62,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
/* If the mode uses primary, then the following is handled by
* bond_change_active_slave().
*/
-@@ -1957,9 +1955,6 @@ static int __bond_release_one(struct net
+@@ -1957,9 +1955,6 @@ static int __bond_release_one(struct net_device *bond_dev,
if (!bond_has_slaves(bond)) {
bond_set_carrier(bond);
eth_hw_addr_random(bond_dev);
@@ -72,7 +72,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
}
unblock_netpoll_tx();
-@@ -3444,13 +3439,6 @@ static void bond_fold_stats(struct rtnl_
+@@ -3444,13 +3439,6 @@ static void bond_fold_stats(struct rtnl_link_stats64 *_res,
}
}
@@ -86,7 +86,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
static void bond_get_stats(struct net_device *bond_dev,
struct rtnl_link_stats64 *stats)
{
-@@ -4270,7 +4258,6 @@ static const struct net_device_ops bond_
+@@ -4270,7 +4258,6 @@ static const struct net_device_ops bond_netdev_ops = {
.ndo_neigh_setup = bond_neigh_setup,
.ndo_vlan_rx_add_vid = bond_vlan_rx_add_vid,
.ndo_vlan_rx_kill_vid = bond_vlan_rx_kill_vid,
@@ -94,7 +94,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
#ifdef CONFIG_NET_POLL_CONTROLLER
.ndo_netpoll_setup = bond_netpoll_setup,
.ndo_netpoll_cleanup = bond_netpoll_cleanup,
-@@ -4769,8 +4756,6 @@ static int bond_init(struct net_device *
+@@ -4769,8 +4756,6 @@ static int bond_init(struct net_device *bond_dev)
if (!bond->wq)
return -ENOMEM;
@@ -105,7 +105,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
lockdep_register_key(&bond->stats_lock_key);
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-@@ -3160,7 +3160,7 @@ static int add_vlan_pop_action(struct ml
+@@ -3160,7 +3160,7 @@ static int add_vlan_pop_action(struct mlx5e_priv *priv,
struct mlx5_esw_flow_attr *attr,
u32 *action)
{
@@ -124,7 +124,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
};
/**
-@@ -2957,11 +2956,6 @@ static int macsec_get_iflink(const struc
+@@ -2957,11 +2956,6 @@ static int macsec_get_iflink(const struct net_device *dev)
return macsec_priv(dev)->real_dev->ifindex;
}
@@ -136,7 +136,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
static const struct net_device_ops macsec_netdev_ops = {
.ndo_init = macsec_dev_init,
.ndo_uninit = macsec_dev_uninit,
-@@ -2975,7 +2969,6 @@ static const struct net_device_ops macse
+@@ -2975,7 +2969,6 @@ static const struct net_device_ops macsec_netdev_ops = {
.ndo_start_xmit = macsec_start_xmit,
.ndo_get_stats64 = macsec_get_stats64,
.ndo_get_iflink = macsec_get_iflink,
@@ -144,9 +144,9 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
};
static const struct device_type macsec_type = {
-@@ -3262,8 +3255,6 @@ static int macsec_newlink(struct net *ne
-
- dev_hold(real_dev);
+@@ -3258,8 +3251,6 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ if (err < 0)
+ return err;
- macsec->nest_level = dev_get_nest_level(real_dev) + 1;
-
@@ -155,7 +155,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
goto unregister;
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
-@@ -867,11 +867,6 @@ static int macvlan_do_ioctl(struct net_d
+@@ -867,11 +867,6 @@ static int macvlan_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
#define MACVLAN_STATE_MASK \
((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))
@@ -167,7 +167,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
static int macvlan_init(struct net_device *dev)
{
struct macvlan_dev *vlan = netdev_priv(dev);
-@@ -1149,7 +1144,6 @@ static const struct net_device_ops macvl
+@@ -1149,7 +1144,6 @@ static const struct net_device_ops macvlan_netdev_ops = {
.ndo_fdb_add = macvlan_fdb_add,
.ndo_fdb_del = macvlan_fdb_del,
.ndo_fdb_dump = ndo_dflt_fdb_dump,
@@ -175,7 +175,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
#ifdef CONFIG_NET_POLL_CONTROLLER
.ndo_poll_controller = macvlan_dev_poll_controller,
.ndo_netpoll_setup = macvlan_dev_netpoll_setup,
-@@ -1433,7 +1427,6 @@ int macvlan_common_newlink(struct net *s
+@@ -1433,7 +1427,6 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
vlan->dev = dev;
vlan->port = port;
vlan->set_features = MACVLAN_FEATURES;
@@ -203,7 +203,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
};
static inline struct vlan_dev_priv *vlan_dev_priv(const struct net_device *dev)
-@@ -221,11 +220,6 @@ extern void vlan_vids_del_by_dev(struct
+@@ -221,11 +220,6 @@ extern void vlan_vids_del_by_dev(struct net_device *dev,
extern bool vlan_uses_dev(const struct net_device *dev);
@@ -215,7 +215,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
#else
static inline struct net_device *
__vlan_find_dev_deep_rcu(struct net_device *real_dev,
-@@ -295,11 +289,6 @@ static inline bool vlan_uses_dev(const s
+@@ -295,11 +289,6 @@ static inline bool vlan_uses_dev(const struct net_device *dev)
{
return false;
}
@@ -237,7 +237,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
int (*ndo_set_tx_maxrate)(struct net_device *dev,
int queue_index,
u32 maxrate);
-@@ -4050,16 +4049,6 @@ static inline void netif_addr_lock(struc
+@@ -4050,16 +4049,6 @@ static inline void netif_addr_lock(struct net_device *dev)
spin_lock(&dev->addr_list_lock);
}
@@ -254,7 +254,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
static inline void netif_addr_lock_bh(struct net_device *dev)
{
spin_lock_bh(&dev->addr_list_lock);
-@@ -4344,7 +4333,6 @@ void netdev_lower_state_changed(struct n
+@@ -4344,7 +4333,6 @@ void netdev_lower_state_changed(struct net_device *lower_dev,
extern u8 netdev_rss_key[NETDEV_RSS_KEY_LEN] __read_mostly;
void netdev_rss_key_fill(void *buffer, size_t len);
@@ -274,7 +274,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
struct slave *);
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
-@@ -172,7 +172,6 @@ int register_vlan_dev(struct net_device
+@@ -172,7 +172,6 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack)
if (err < 0)
goto out_uninit_mvrp;
@@ -284,7 +284,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
goto out_uninit_mvrp;
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
-@@ -489,11 +489,6 @@ static void vlan_dev_set_rx_mode(struct
+@@ -489,11 +489,6 @@ static void vlan_dev_set_rx_mode(struct net_device *vlan_dev)
dev_uc_sync(vlan_dev_priv(vlan_dev)->real_dev, vlan_dev);
}
@@ -296,7 +296,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
static const struct header_ops vlan_header_ops = {
.create = vlan_dev_hard_header,
.parse = eth_header_parse,
-@@ -785,7 +780,6 @@ static const struct net_device_ops vlan_
+@@ -785,7 +780,6 @@ static const struct net_device_ops vlan_netdev_ops = {
.ndo_netpoll_cleanup = vlan_dev_netpoll_cleanup,
#endif
.ndo_fix_features = vlan_dev_fix_features,
@@ -306,7 +306,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
--- a/net/core/dev.c
+++ b/net/core/dev.c
-@@ -7615,25 +7615,6 @@ void *netdev_lower_dev_get_private(struc
+@@ -7615,25 +7615,6 @@ void *netdev_lower_dev_get_private(struct net_device *dev,
EXPORT_SYMBOL(netdev_lower_dev_get_private);
@@ -334,7 +334,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
* @lower_dev: device
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
-@@ -637,7 +637,7 @@ int dev_uc_sync(struct net_device *to, s
+@@ -637,7 +637,7 @@ int dev_uc_sync(struct net_device *to, struct net_device *from)
if (to->addr_len != from->addr_len)
return -EINVAL;
@@ -343,7 +343,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len);
if (!err)
__dev_set_rx_mode(to);
-@@ -667,7 +667,7 @@ int dev_uc_sync_multiple(struct net_devi
+@@ -667,7 +667,7 @@ int dev_uc_sync_multiple(struct net_device *to, struct net_device *from)
if (to->addr_len != from->addr_len)
return -EINVAL;
@@ -352,7 +352,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
err = __hw_addr_sync_multiple(&to->uc, &from->uc, to->addr_len);
if (!err)
__dev_set_rx_mode(to);
-@@ -691,7 +691,7 @@ void dev_uc_unsync(struct net_device *to
+@@ -691,7 +691,7 @@ void dev_uc_unsync(struct net_device *to, struct net_device *from)
return;
netif_addr_lock_bh(from);
@@ -361,7 +361,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
__hw_addr_unsync(&to->uc, &from->uc, to->addr_len);
__dev_set_rx_mode(to);
netif_addr_unlock(to);
-@@ -858,7 +858,7 @@ int dev_mc_sync(struct net_device *to, s
+@@ -858,7 +858,7 @@ int dev_mc_sync(struct net_device *to, struct net_device *from)
if (to->addr_len != from->addr_len)
return -EINVAL;
@@ -370,7 +370,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
err = __hw_addr_sync(&to->mc, &from->mc, to->addr_len);
if (!err)
__dev_set_rx_mode(to);
-@@ -888,7 +888,7 @@ int dev_mc_sync_multiple(struct net_devi
+@@ -888,7 +888,7 @@ int dev_mc_sync_multiple(struct net_device *to, struct net_device *from)
if (to->addr_len != from->addr_len)
return -EINVAL;
@@ -379,7 +379,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
err = __hw_addr_sync_multiple(&to->mc, &from->mc, to->addr_len);
if (!err)
__dev_set_rx_mode(to);
-@@ -912,7 +912,7 @@ void dev_mc_unsync(struct net_device *to
+@@ -912,7 +912,7 @@ void dev_mc_unsync(struct net_device *to, struct net_device *from)
return;
netif_addr_lock_bh(from);
@@ -390,7 +390,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
netif_addr_unlock(to);
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
-@@ -558,7 +558,7 @@ int smc_vlan_by_tcpsk(struct socket *clc
+@@ -558,7 +558,7 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
}
rtnl_lock();
@@ -401,7 +401,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
-@@ -718,7 +718,7 @@ static struct net_device *pnet_find_base
+@@ -718,7 +718,7 @@ static struct net_device *pnet_find_base_ndev(struct net_device *ndev)
int i, nest_lvl;
rtnl_lock();
diff --git a/patches.suse/nl80211-fix-validation-of-mesh-path-nexthop.patch b/patches.suse/nl80211-fix-validation-of-mesh-path-nexthop.patch
new file mode 100644
index 0000000000..da5af02e74
--- /dev/null
+++ b/patches.suse/nl80211-fix-validation-of-mesh-path-nexthop.patch
@@ -0,0 +1,38 @@
+From 1fab1b89e2e8f01204a9c05a39fd0b6411a48593 Mon Sep 17 00:00:00 2001
+From: Markus Theil <markus.theil@tu-ilmenau.de>
+Date: Tue, 29 Oct 2019 10:30:03 +0100
+Subject: [PATCH] nl80211: fix validation of mesh path nexthop
+Git-commit: 1fab1b89e2e8f01204a9c05a39fd0b6411a48593
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+Mesh path nexthop should be a ethernet address, but current validation
+checks against 4 byte integers.
+
+Cc: stable@vger.kernel.org
+Fixes: 2ec600d672e74 ("nl80211/cfg80211: support for mesh, sta dumping")
+Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
+Link: https://lore.kernel.org/r/20191029093003.10355-1-markus.theil@tu-ilmenau.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/wireless/nl80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 4453dd375de9..7b72286922f7 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -393,7 +393,7 @@ const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
+ [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
+ .len = IEEE80211_MAX_MESH_ID_LEN },
+- [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
++ [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
+
+ [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
+ [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
+--
+2.16.4
+
diff --git a/patches.suse/r8169-fix-wrong-PHY-ID-issue-with-RTL8168dp.patch b/patches.suse/r8169-fix-wrong-PHY-ID-issue-with-RTL8168dp.patch
new file mode 100644
index 0000000000..be4b6204ec
--- /dev/null
+++ b/patches.suse/r8169-fix-wrong-PHY-ID-issue-with-RTL8168dp.patch
@@ -0,0 +1,44 @@
+From 62bdc8fd1c21d4263ebd18bec57f82532d09249f Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 1 Nov 2019 00:10:21 +0100
+Subject: [PATCH] r8169: fix wrong PHY ID issue with RTL8168dp
+Git-commit: 62bdc8fd1c21d4263ebd18bec57f82532d09249f
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+As reported in [0] at least one RTL8168dp version has problems
+establishing a link. This chip version has an integrated RTL8211b PHY,
+however the chip seems to report a wrong PHY ID, resulting in a wrong
+PHY driver (for Generic Realtek PHY) being loaded.
+Work around this issue by adding a hook to r8168dp_2_mdio_read()
+for returning the correct PHY ID.
+
+[0] https://bbs.archlinux.org/viewtopic.php?id=246508
+
+Fixes: 242cd9b5866a ("r8169: use phy_resume/phy_suspend")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 350b0d949611..5064c292b873 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -1029,6 +1029,10 @@ static int r8168dp_2_mdio_read(struct rtl8169_private *tp, int reg)
+ {
+ int value;
+
++ /* Work around issue with chip reporting wrong PHY ID */
++ if (reg == MII_PHYSID2)
++ return 0xc912;
++
+ r8168dp_2_mdio_start(tp);
+
+ value = r8169_mdio_read(tp, reg);
+--
+2.16.4
+
diff --git a/patches.suse/usb-dwc3-gadget-fix-race-when-disabling-ep-with-canc.patch b/patches.suse/usb-dwc3-gadget-fix-race-when-disabling-ep-with-canc.patch
new file mode 100644
index 0000000000..afe146aa78
--- /dev/null
+++ b/patches.suse/usb-dwc3-gadget-fix-race-when-disabling-ep-with-canc.patch
@@ -0,0 +1,45 @@
+From d8eca64eec7103ab1fbabc0a187dbf6acfb2af93 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Thu, 31 Oct 2019 11:07:13 +0200
+Subject: [PATCH] usb: dwc3: gadget: fix race when disabling ep with cancelled xfers
+Git-commit: d8eca64eec7103ab1fbabc0a187dbf6acfb2af93
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+When disabling an endpoint which has cancelled requests, we should
+make sure to giveback requests that are currently pending in the
+cancelled list, otherwise we may fall into a situation where command
+completion interrupt fires after endpoint has been disabled, therefore
+causing a splat.
+
+Fixes: fec9095bdef4 "usb: dwc3: gadget: remove wait_end_transfer"
+Reported-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Link: https://lore.kernel.org/r/20191031090713.1452818-1-felipe.balbi@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/dwc3/gadget.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 86dc1db788a9..a9aba716bf80 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -707,6 +707,12 @@ static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep)
+
+ dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
+ }
++
++ while (!list_empty(&dep->cancelled_list)) {
++ req = next_request(&dep->cancelled_list);
++
++ dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
++ }
+ }
+
+ /**
+--
+2.16.4
+
diff --git a/patches.suse/usb-dwc3-pci-prevent-memory-leak-in-dwc3_pci_probe.patch b/patches.suse/usb-dwc3-pci-prevent-memory-leak-in-dwc3_pci_probe.patch
new file mode 100644
index 0000000000..9dbfc97bbe
--- /dev/null
+++ b/patches.suse/usb-dwc3-pci-prevent-memory-leak-in-dwc3_pci_probe.patch
@@ -0,0 +1,38 @@
+From 9bbfceea12a8f145097a27d7c7267af25893c060 Mon Sep 17 00:00:00 2001
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Sun, 29 Sep 2019 21:41:45 -0500
+Subject: [PATCH] usb: dwc3: pci: prevent memory leak in dwc3_pci_probe
+Git-commit: 9bbfceea12a8f145097a27d7c7267af25893c060
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+In dwc3_pci_probe a call to platform_device_alloc allocates a device
+which is correctly put in case of error except one case: when the call to
+platform_device_add_properties fails it directly returns instead of
+going to error handling. This commit replaces return with the goto.
+
+Fixes: 1a7b12f69a94 ("usb: dwc3: pci: Supply device properties via driver data")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/dwc3/dwc3-pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 5e8e18222f92..023f0357efd7 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -258,7 +258,7 @@ static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+
+ ret = platform_device_add_properties(dwc->dwc3, p);
+ if (ret < 0)
+- return ret;
++ goto err;
+
+ ret = dwc3_pci_quirks(dwc);
+ if (ret)
+--
+2.16.4
+
diff --git a/patches.suse/usb-dwc3-select-CONFIG_REGMAP_MMIO.patch b/patches.suse/usb-dwc3-select-CONFIG_REGMAP_MMIO.patch
new file mode 100644
index 0000000000..6a8ac4bac7
--- /dev/null
+++ b/patches.suse/usb-dwc3-select-CONFIG_REGMAP_MMIO.patch
@@ -0,0 +1,42 @@
+From a51bab592fbbef10f0e42a8aed86adfbf6a68fa7 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 21 Oct 2019 16:18:36 +0200
+Subject: [PATCH] usb: dwc3: select CONFIG_REGMAP_MMIO
+Git-commit: a51bab592fbbef10f0e42a8aed86adfbf6a68fa7
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+After many randconfig builds, one configuration caused a link
+error with dwc3-meson-g12a lacking the regmap-mmio code:
+
+Drivers/usb/dwc3/dwc3-meson-g12a.o: In function `dwc3_meson_g12a_probe':
+dwc3-meson-g12a.c:(.text+0x9f): undefined reference to `__devm_regmap_init_mmio_clk'
+
+Add the select statement that we have for all other users
+of that dependency.
+
+Fixes: c99993376f72 ("usb: dwc3: Add Amlogic G12A DWC3 glue")
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/dwc3/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig
+index 89abc6078703..556a876c7896 100644
+--- a/drivers/usb/dwc3/Kconfig
++++ b/drivers/usb/dwc3/Kconfig
+@@ -102,6 +102,7 @@ config USB_DWC3_MESON_G12A
+ depends on ARCH_MESON || COMPILE_TEST
+ default USB_DWC3
+ select USB_ROLE_SWITCH
++ select REGMAP_MMIO
+ help
+ Support USB2/3 functionality in Amlogic G12A platforms.
+ Say 'Y' or 'M' if you have one such device.
+--
+2.16.4
+
diff --git a/patches.suse/usb-gadget-udc-atmel-Fix-interrupt-storm-in-FIFO-mod.patch b/patches.suse/usb-gadget-udc-atmel-Fix-interrupt-storm-in-FIFO-mod.patch
new file mode 100644
index 0000000000..eb98bcdca3
--- /dev/null
+++ b/patches.suse/usb-gadget-udc-atmel-Fix-interrupt-storm-in-FIFO-mod.patch
@@ -0,0 +1,42 @@
+From ba3a1a915c49cc3023e4ddfc88f21e7514e82aa4 Mon Sep 17 00:00:00 2001
+From: Cristian Birsan <cristian.birsan@microchip.com>
+Date: Fri, 4 Oct 2019 20:10:54 +0300
+Subject: [PATCH] usb: gadget: udc: atmel: Fix interrupt storm in FIFO mode.
+Git-commit: ba3a1a915c49cc3023e4ddfc88f21e7514e82aa4
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+Fix interrupt storm generated by endpoints when working in FIFO mode.
+The TX_COMPLETE interrupt is used only by control endpoints processing.
+Do not enable it for other types of endpoints.
+
+Fixes: 914a3f3b3754 ("USB: add atmel_usba_udc driver")
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/gadget/udc/atmel_usba_udc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
+index 86ffc8307864..1d0d8952a74b 100644
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -449,9 +449,11 @@ static void submit_request(struct usba_ep *ep, struct usba_request *req)
+ next_fifo_transaction(ep, req);
+ if (req->last_transaction) {
+ usba_ep_writel(ep, CTL_DIS, USBA_TX_PK_RDY);
+- usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE);
++ if (ep_is_control(ep))
++ usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE);
+ } else {
+- usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE);
++ if (ep_is_control(ep))
++ usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE);
+ usba_ep_writel(ep, CTL_ENB, USBA_TX_PK_RDY);
+ }
+ }
+--
+2.16.4
+
diff --git a/patches.suse/usb-storage-Revert-commit-747668dbc061-usb-storage-S.patch b/patches.suse/usb-storage-Revert-commit-747668dbc061-usb-storage-S.patch
new file mode 100644
index 0000000000..b0a21333f1
--- /dev/null
+++ b/patches.suse/usb-storage-Revert-commit-747668dbc061-usb-storage-S.patch
@@ -0,0 +1,89 @@
+From 9a976949613132977098fc49510b46fa8678d864 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 21 Oct 2019 11:48:06 -0400
+Subject: [PATCH] usb-storage: Revert commit 747668dbc061 ("usb-storage: Set virt_boundary_mask to avoid SG overflows")
+Git-commit: 9a976949613132977098fc49510b46fa8678d864
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+Commit 747668dbc061 ("usb-storage: Set virt_boundary_mask to avoid SG
+overflows") attempted to solve a problem involving scatter-gather I/O
+and USB/IP by setting the virt_boundary_mask for mass-storage devices.
+
+However, it now turns out that this interacts badly with commit
+09324d32d2a0 ("block: force an unlimited segment size on queues with a
+virt boundary"), which was added later. A typical error message is:
+
+ ehci-pci 0000:00:13.2: swiotlb buffer is full (sz: 327680 bytes),
+ total 32768 (slots), used 97 (slots)
+
+There is no longer any reason to keep the virt_boundary_mask setting
+for usb-storage. It was needed in the first place only for handling
+devices with a block size smaller than the maxpacket size and where
+the host controller was not capable of fully general scatter-gather
+operation (that is, able to merge two SG segments into a single USB
+packet). But:
+
+ High-speed or slower connections never use a bulk maxpacket
+ value larger than 512;
+
+ The SCSI layer does not handle block devices with a block size
+ smaller than 512 bytes;
+
+ All the host controllers capable of SuperSpeed operation can
+ handle fully general SG;
+
+ Since commit ea44d190764b ("usbip: Implement SG support to
+ vhci-hcd and stub driver") was merged, the USB/IP driver can
+ also handle SG.
+
+Therefore all supported device/controller combinations should be okay
+with no need for any special virt_boundary_mask. So in order to fix
+the swiotlb problem, this patch reverts commit 747668dbc061.
+
+Reported-and-tested-by: Piergiorgio Sartor <piergiorgio.sartor@nexgo.de>
+Link: https://marc.info/?l=linux-usb&m=157134199501202&w=2
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Cc: Seth Bollinger <Seth.Bollinger@digi.com>
+Cc: <stable@vger.kernel.org>
+Fixes: 747668dbc061 ("usb-storage: Set virt_boundary_mask to avoid SG overflows")
+Acked-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1910211145520.1673-100000@iolanthe.rowland.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/storage/scsiglue.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index 6737fab94959..54a3c8195c96 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -68,7 +68,6 @@ static const char* host_info(struct Scsi_Host *host)
+ static int slave_alloc (struct scsi_device *sdev)
+ {
+ struct us_data *us = host_to_us(sdev->host);
+- int maxp;
+
+ /*
+ * Set the INQUIRY transfer length to 36. We don't use any of
+@@ -77,15 +76,6 @@ static int slave_alloc (struct scsi_device *sdev)
+ */
+ sdev->inquiry_len = 36;
+
+- /*
+- * USB has unusual scatter-gather requirements: the length of each
+- * scatterlist element except the last must be divisible by the
+- * Bulk maxpacket value. Fortunately this value is always a
+- * power of 2. Inform the block layer about this requirement.
+- */
+- maxp = usb_maxpacket(us->pusb_dev, us->recv_bulk_pipe, 0);
+- blk_queue_virt_boundary(sdev->request_queue, maxp - 1);
+-
+ /*
+ * Some host controllers may have alignment requirements.
+ * We'll play it safe by requiring 512-byte alignment always.
+--
+2.16.4
+
diff --git a/patches.suse/usb-xhci-fix-Immediate-Data-Transfer-endianness.patch b/patches.suse/usb-xhci-fix-Immediate-Data-Transfer-endianness.patch
new file mode 100644
index 0000000000..c6a9f85d7d
--- /dev/null
+++ b/patches.suse/usb-xhci-fix-Immediate-Data-Transfer-endianness.patch
@@ -0,0 +1,54 @@
+From bfa3dbb343f664573292afb9e44f9abeb81a19de Mon Sep 17 00:00:00 2001
+From: Samuel Holland <samuel@sholland.org>
+Date: Fri, 25 Oct 2019 17:30:28 +0300
+Subject: [PATCH] usb: xhci: fix Immediate Data Transfer endianness
+Git-commit: bfa3dbb343f664573292afb9e44f9abeb81a19de
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+The arguments to queue_trb are always byteswapped to LE for placement in
+the ring, but this should not happen in the case of immediate data; the
+bytes copied out of transfer_buffer are already in the correct order.
+Add a complementary byteswap so the bytes end up in the ring correctly.
+
+This was observed on BE ppc64 with a "Texas Instruments TUSB73x0
+SuperSpeed USB 3.0 xHCI Host Controller [104c:8241]" as a ch341
+usb-serial adapter ("1a86:7523 QinHeng Electronics HL-340 USB-Serial
+adapter") always transmitting the same character (generally NUL) over
+the serial link regardless of the key pressed.
+
+Cc: <stable@vger.kernel.org> # 5.2+
+Fixes: 33e39350ebd2 ("usb: xhci: add Immediate Data Transfer support")
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/1572013829-14044-3-git-send-email-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/host/xhci-ring.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 85ceb43e3405..e7aab31fd9a5 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3330,6 +3330,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ if (xhci_urb_suitable_for_idt(urb)) {
+ memcpy(&send_addr, urb->transfer_buffer,
+ trb_buff_len);
++ le64_to_cpus(&send_addr);
+ field |= TRB_IDT;
+ }
+ }
+@@ -3475,6 +3476,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ if (xhci_urb_suitable_for_idt(urb)) {
+ memcpy(&addr, urb->transfer_buffer,
+ urb->transfer_buffer_length);
++ le64_to_cpus(&addr);
+ field |= TRB_IDT;
+ } else {
+ addr = (u64) urb->transfer_dma;
+--
+2.16.4
+
diff --git a/patches.suse/virt_wifi-fix-refcnt-leak-in-module-exit-routine.patch b/patches.suse/virt_wifi-fix-refcnt-leak-in-module-exit-routine.patch
new file mode 100644
index 0000000000..cf83bfaa36
--- /dev/null
+++ b/patches.suse/virt_wifi-fix-refcnt-leak-in-module-exit-routine.patch
@@ -0,0 +1,167 @@
+From 1962f86b42ed06ea6af9ff09390243b99d9eb83a Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Mon, 21 Oct 2019 18:47:59 +0000
+Subject: [PATCH] virt_wifi: fix refcnt leak in module exit routine
+Git-commit: 1962f86b42ed06ea6af9ff09390243b99d9eb83a
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+virt_wifi_newlink() calls netdev_upper_dev_link() and it internally
+holds reference count of lower interface.
+
+Current code does not release a reference count of the lower interface
+when the lower interface is being deleted.
+So, reference count leaks occur.
+
+Test commands:
+ ip link add dummy0 type dummy
+ ip link add vw1 link dummy0 type virt_wifi
+ ip link del dummy0
+
+Splat looks like:
+[ 133.787526][ T788] WARNING: CPU: 1 PID: 788 at net/core/dev.c:8274 rollback_registered_many+0x835/0xc80
+[ 133.788355][ T788] Modules linked in: virt_wifi cfg80211 dummy team af_packet sch_fq_codel ip_tables x_tables unix
+[ 133.789377][ T788] CPU: 1 PID: 788 Comm: ip Not tainted 5.4.0-rc3+ #96
+[ 133.790069][ T788] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+[ 133.791167][ T788] RIP: 0010:rollback_registered_many+0x835/0xc80
+[ 133.791906][ T788] Code: 00 4d 85 ff 0f 84 b5 fd ff ff ba c0 0c 00 00 48 89 de 4c 89 ff e8 9b 58 04 00 48 89 df e8 30
+[ 133.794317][ T788] RSP: 0018:ffff88805ba3f338 EFLAGS: 00010202
+[ 133.795080][ T788] RAX: ffff88805e57e801 RBX: ffff88805ba34000 RCX: ffffffffa9294723
+[ 133.796045][ T788] RDX: 1ffff1100b746816 RSI: 0000000000000008 RDI: ffffffffabcc4240
+[ 133.797006][ T788] RBP: ffff88805ba3f4c0 R08: fffffbfff5798849 R09: fffffbfff5798849
+[ 133.797993][ T788] R10: 0000000000000001 R11: fffffbfff5798848 R12: dffffc0000000000
+[ 133.802514][ T788] R13: ffff88805ba3f440 R14: ffff88805ba3f400 R15: ffff88805ed622c0
+[ 133.803237][ T788] FS: 00007f2e9608c0c0(0000) GS:ffff88806cc00000(0000) knlGS:0000000000000000
+[ 133.804002][ T788] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 133.804664][ T788] CR2: 00007f2e95610603 CR3: 000000005f68c004 CR4: 00000000000606e0
+[ 133.805363][ T788] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 133.806073][ T788] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 133.806787][ T788] Call Trace:
+[ 133.807069][ T788] ? generic_xdp_install+0x310/0x310
+[ 133.807612][ T788] ? lock_acquire+0x164/0x3b0
+[ 133.808077][ T788] ? is_bpf_text_address+0x5/0xf0
+[ 133.808640][ T788] ? deref_stack_reg+0x9c/0xd0
+[ 133.809138][ T788] ? __nla_validate_parse+0x98/0x1ab0
+[ 133.809944][ T788] unregister_netdevice_many.part.122+0x13/0x1b0
+[ 133.810599][ T788] rtnl_delete_link+0xbc/0x100
+[ 133.811073][ T788] ? rtnl_af_register+0xc0/0xc0
+[ 133.811672][ T788] rtnl_dellink+0x30e/0x8a0
+[ 133.812205][ T788] ? is_bpf_text_address+0x5/0xf0
+[ ... ]
+
+[ 144.110530][ T788] unregister_netdevice: waiting for dummy0 to become free. Usage count = 1
+
+This patch adds notifier routine to delete upper interface before deleting
+lower interface.
+
+Fixes: c7cdba31ed8b ("mac80211-next: rtnetlink wifi simulation device")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/virt_wifi.c | 54 ++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 52 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/virt_wifi.c b/drivers/net/wireless/virt_wifi.c
+index be92e1220284..7997cc6de334 100644
+--- a/drivers/net/wireless/virt_wifi.c
++++ b/drivers/net/wireless/virt_wifi.c
+@@ -548,6 +548,7 @@ static int virt_wifi_newlink(struct net *src_net, struct net_device *dev,
+ priv->is_connected = false;
+ priv->is_up = false;
+ INIT_DELAYED_WORK(&priv->connect, virt_wifi_connect_complete);
++ __module_get(THIS_MODULE);
+
+ return 0;
+ unregister_netdev:
+@@ -578,6 +579,7 @@ static void virt_wifi_dellink(struct net_device *dev,
+ netdev_upper_dev_unlink(priv->lowerdev, dev);
+
+ unregister_netdevice_queue(dev, head);
++ module_put(THIS_MODULE);
+
+ /* Deleting the wiphy is handled in the module destructor. */
+ }
+@@ -590,6 +592,42 @@ static struct rtnl_link_ops virt_wifi_link_ops = {
+ .priv_size = sizeof(struct virt_wifi_netdev_priv),
+ };
+
++static bool netif_is_virt_wifi_dev(const struct net_device *dev)
++{
++ return rcu_access_pointer(dev->rx_handler) == virt_wifi_rx_handler;
++}
++
++static int virt_wifi_event(struct notifier_block *this, unsigned long event,
++ void *ptr)
++{
++ struct net_device *lower_dev = netdev_notifier_info_to_dev(ptr);
++ struct virt_wifi_netdev_priv *priv;
++ struct net_device *upper_dev;
++ LIST_HEAD(list_kill);
++
++ if (!netif_is_virt_wifi_dev(lower_dev))
++ return NOTIFY_DONE;
++
++ switch (event) {
++ case NETDEV_UNREGISTER:
++ priv = rtnl_dereference(lower_dev->rx_handler_data);
++ if (!priv)
++ return NOTIFY_DONE;
++
++ upper_dev = priv->upperdev;
++
++ upper_dev->rtnl_link_ops->dellink(upper_dev, &list_kill);
++ unregister_netdevice_many(&list_kill);
++ break;
++ }
++
++ return NOTIFY_DONE;
++}
++
++static struct notifier_block virt_wifi_notifier = {
++ .notifier_call = virt_wifi_event,
++};
++
+ /* Acquires and releases the rtnl lock. */
+ static int __init virt_wifi_init_module(void)
+ {
+@@ -598,14 +636,25 @@ static int __init virt_wifi_init_module(void)
+ /* Guaranteed to be locallly-administered and not multicast. */
+ eth_random_addr(fake_router_bssid);
+
++ err = register_netdevice_notifier(&virt_wifi_notifier);
++ if (err)
++ return err;
++
++ err = -ENOMEM;
+ common_wiphy = virt_wifi_make_wiphy();
+ if (!common_wiphy)
+- return -ENOMEM;
++ goto notifier;
+
+ err = rtnl_link_register(&virt_wifi_link_ops);
+ if (err)
+- virt_wifi_destroy_wiphy(common_wiphy);
++ goto destroy_wiphy;
+
++ return 0;
++
++destroy_wiphy:
++ virt_wifi_destroy_wiphy(common_wiphy);
++notifier:
++ unregister_netdevice_notifier(&virt_wifi_notifier);
+ return err;
+ }
+
+@@ -615,6 +664,7 @@ static void __exit virt_wifi_cleanup_module(void)
+ /* Will delete any devices that depend on the wiphy. */
+ rtnl_link_unregister(&virt_wifi_link_ops);
+ virt_wifi_destroy_wiphy(common_wiphy);
++ unregister_netdevice_notifier(&virt_wifi_notifier);
+ }
+
+ module_init(virt_wifi_init_module);
+--
+2.16.4
+
diff --git a/patches.suse/wimax-i2400-Fix-memory-leak-in-i2400m_op_rfkill_sw_t.patch b/patches.suse/wimax-i2400-Fix-memory-leak-in-i2400m_op_rfkill_sw_t.patch
new file mode 100644
index 0000000000..5fb67654d0
--- /dev/null
+++ b/patches.suse/wimax-i2400-Fix-memory-leak-in-i2400m_op_rfkill_sw_t.patch
@@ -0,0 +1,44 @@
+From 6f3ef5c25cc762687a7341c18cbea5af54461407 Mon Sep 17 00:00:00 2001
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Fri, 25 Oct 2019 23:53:30 -0500
+Subject: [PATCH] wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle
+Git-commit: 6f3ef5c25cc762687a7341c18cbea5af54461407
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+In the implementation of i2400m_op_rfkill_sw_toggle() the allocated
+buffer for cmd should be released before returning. The
+documentation for i2400m_msg_to_dev() says when it returns the buffer
+can be reused. Meaning cmd should be released in either case. Move
+kfree(cmd) before return to be reached by all execution paths.
+
+Fixes: 2507e6ab7a9a ("wimax: i2400: fix memory leak")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wimax/i2400m/op-rfkill.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c
+index 8efb493ceec2..5c79f052cad2 100644
+--- a/drivers/net/wimax/i2400m/op-rfkill.c
++++ b/drivers/net/wimax/i2400m/op-rfkill.c
+@@ -127,12 +127,12 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev,
+ "%d\n", result);
+ result = 0;
+ error_cmd:
+- kfree(cmd);
+ kfree_skb(ack_skb);
+ error_msg_to_dev:
+ error_alloc:
+ d_fnend(4, dev, "(wimax_dev %p state %d) = %d\n",
+ wimax_dev, state, result);
++ kfree(cmd);
+ return result;
+ }
+
+--
+2.16.4
+
diff --git a/patches.suse/xhci-Fix-use-after-free-regression-in-xhci-clear-hub.patch b/patches.suse/xhci-Fix-use-after-free-regression-in-xhci-clear-hub.patch
new file mode 100644
index 0000000000..192b743c6e
--- /dev/null
+++ b/patches.suse/xhci-Fix-use-after-free-regression-in-xhci-clear-hub.patch
@@ -0,0 +1,129 @@
+From 18b74067ac78a2dea65783314c13df98a53d071c Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 25 Oct 2019 17:30:27 +0300
+Subject: [PATCH] xhci: Fix use-after-free regression in xhci clear hub TT implementation
+Git-commit: 18b74067ac78a2dea65783314c13df98a53d071c
+Patch-mainline: v5.4-rc6
+References: git-fixes
+
+commit ef513be0a905 ("usb: xhci: Add Clear_TT_Buffer") schedules work
+to clear TT buffer, but causes a use-after-free regression at the same time
+
+Make sure hub_tt_work finishes before endpoint is disabled, otherwise
+the work will dereference already freed endpoint and device related
+pointers.
+
+This was triggered when usb core failed to read the configuration
+descriptor of a FS/LS device during enumeration.
+xhci driver queued clear_tt_work while usb core freed and reallocated
+a new device for the next enumeration attempt.
+
+EHCI driver implents ehci_endpoint_disable() that makes sure
+clear_tt_work has finished before it returns, but xhci lacks this support.
+usb core will call hcd->driver->endpoint_disable() callback before
+disabling endpoints, so we want this in xhci as well.
+
+The added xhci_endpoint_disable() is based on ehci_endpoint_disable()
+
+Fixes: ef513be0a905 ("usb: xhci: Add Clear_TT_Buffer")
+Cc: <stable@vger.kernel.org> # v5.3
+Reported-by: Johan Hovold <johan@kernel.org>
+Suggested-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Johan Hovold <johan@kernel.org>
+Tested-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/1572013829-14044-2-git-send-email-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/host/xhci.c | 54 ++++++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 45 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 517ec3206f6e..6c17e3fe181a 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3071,6 +3071,48 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci, unsigned int ep_index,
+ }
+ }
+
++static void xhci_endpoint_disable(struct usb_hcd *hcd,
++ struct usb_host_endpoint *host_ep)
++{
++ struct xhci_hcd *xhci;
++ struct xhci_virt_device *vdev;
++ struct xhci_virt_ep *ep;
++ struct usb_device *udev;
++ unsigned long flags;
++ unsigned int ep_index;
++
++ xhci = hcd_to_xhci(hcd);
++rescan:
++ spin_lock_irqsave(&xhci->lock, flags);
++
++ udev = (struct usb_device *)host_ep->hcpriv;
++ if (!udev || !udev->slot_id)
++ goto done;
++
++ vdev = xhci->devs[udev->slot_id];
++ if (!vdev)
++ goto done;
++
++ ep_index = xhci_get_endpoint_index(&host_ep->desc);
++ ep = &vdev->eps[ep_index];
++ if (!ep)
++ goto done;
++
++ /* wait for hub_tt_work to finish clearing hub TT */
++ if (ep->ep_state & EP_CLEARING_TT) {
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ schedule_timeout_uninterruptible(1);
++ goto rescan;
++ }
++
++ if (ep->ep_state)
++ xhci_dbg(xhci, "endpoint disable with ep_state 0x%x\n",
++ ep->ep_state);
++done:
++ host_ep->hcpriv = NULL;
++ spin_unlock_irqrestore(&xhci->lock, flags);
++}
++
+ /*
+ * Called after usb core issues a clear halt control message.
+ * The host side of the halt should already be cleared by a reset endpoint
+@@ -5238,20 +5280,13 @@ static void xhci_clear_tt_buffer_complete(struct usb_hcd *hcd,
+ unsigned int ep_index;
+ unsigned long flags;
+
+- /*
+- * udev might be NULL if tt buffer is cleared during a failed device
+- * enumeration due to a halted control endpoint. Usb core might
+- * have allocated a new udev for the next enumeration attempt.
+- */
+-
+ xhci = hcd_to_xhci(hcd);
++
++ spin_lock_irqsave(&xhci->lock, flags);
+ udev = (struct usb_device *)ep->hcpriv;
+- if (!udev)
+- return;
+ slot_id = udev->slot_id;
+ ep_index = xhci_get_endpoint_index(&ep->desc);
+
+- spin_lock_irqsave(&xhci->lock, flags);
+ xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_CLEARING_TT;
+ xhci_ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+@@ -5288,6 +5323,7 @@ static const struct hc_driver xhci_hc_driver = {
+ .free_streams = xhci_free_streams,
+ .add_endpoint = xhci_add_endpoint,
+ .drop_endpoint = xhci_drop_endpoint,
++ .endpoint_disable = xhci_endpoint_disable,
+ .endpoint_reset = xhci_endpoint_reset,
+ .check_bandwidth = xhci_check_bandwidth,
+ .reset_bandwidth = xhci_reset_bandwidth,
+--
+2.16.4
+
diff --git a/series.conf b/series.conf
index 0c223418c2..8a07a91ab3 100644
--- a/series.conf
+++ b/series.conf
@@ -2818,6 +2818,8 @@
patches.suse/RDMA-mlx5-Use-irq-xarray-locking-for-mkey_table.patch
patches.suse/RDMA-iw_cxgb4-Avoid-freeing-skb-twice-in-arp-failure.patch
patches.suse/RDMA-hns-Prevent-memory-leaks-of-eq-buf_list.patch
+ patches.suse/drm-v3d-Fix-memory-leak-in-v3d_submit_cl_ioctl.patch
+ patches.suse/drm-i915-Fix-PCH-reference-clock-for-FDI-on-HSW-BDW.patch
patches.suse/efi-tpm-Return-EINVAL-when-determining-tpm-final-eve.patch
patches.suse/SUNRPC-The-TCP-back-channel-mustn-t-disappear-while-.patch
patches.suse/SUNRPC-The-RDMA-back-channel-mustn-t-disappear-while.patch
@@ -2851,9 +2853,11 @@
patches.suse/bonding-fix-unexpected-IFF_BONDING-bit-unset.patch
patches.suse/bonding-use-dynamic-lockdep-key-instead-of-subclass.patch
patches.suse/team-fix-nested-locking-lockdep-warning.patch
+ patches.suse/macsec-fix-refcnt-leak-in-module-exit-routine.patch
patches.suse/net-core-add-ignore-flag-to-netdev_adjacent-structur.patch
patches.suse/vxlan-add-adjacent-link-to-limit-depth-level.patch
patches.suse/net-remove-unnecessary-variables-and-callback.patch
+ patches.suse/virt_wifi-fix-refcnt-leak-in-module-exit-routine.patch
patches.suse/net-sch_generic-Use-pfifo_fast-as-fallback-scheduler.patch
patches.suse/netns-fix-GFP-flags-in-rtnl_net_notifyid.patch
patches.suse/cxgb4-request-the-TX-CIDX-updates-to-status-page.patch
@@ -2877,6 +2881,7 @@
patches.suse/udp-fix-data-race-in-udp_set_dev_scratch.patch
patches.suse/net-fix-sk_page_frag-recursion-from-memory-reclaim.patch
patches.suse/net-hisilicon-Fix-Trying-to-free-already-free-IRQ.patch
+ patches.suse/wimax-i2400-Fix-memory-leak-in-i2400m_op_rfkill_sw_t.patch
patches.suse/net-mlx4_core-Dynamically-set-guaranteed-amount-of-c.patch
patches.suse/net-hisilicon-Fix-ping-latency-when-deal-with-high-t.patch
patches.suse/erspan-fix-the-tun_info-options_len-check-for-erspan.patch
@@ -2900,8 +2905,10 @@
patches.suse/net-annotate-accesses-to-sk-sk_incoming_cpu.patch
patches.suse/net-annotate-lockless-accesses-to-sk-sk_napi_id.patch
patches.suse/cxgb4-fix-panic-when-attaching-to-ULD-fail.patch
+ patches.suse/nl80211-fix-validation-of-mesh-path-nexthop.patch
patches.suse/netdevsim-Fix-use-after-free-during-device-dismantle.patch
patches.suse/tcp-increase-tcp_max_syn_backlog-max-value.patch
+ patches.suse/mt76-dma-fix-buffer-unmap-with-non-linear-skbs.patch
patches.suse/igb-igc-Don-t-warn-on-fatal-read-failures-when-the-d.patch
patches.suse/igb-Enable-media-autosense-for-the-i350.patch
patches.suse/igb-Fix-constant-media-auto-sense-switching-when-no-.patch
@@ -2910,6 +2917,7 @@
patches.suse/ixgbe-Remove-duplicate-clear_bit-call.patch
patches.suse/inet-stop-leaking-jiffies-on-the-wire.patch
patches.suse/net-phylink-Fix-phylink_dbg-macro.patch
+ patches.suse/r8169-fix-wrong-PHY-ID-issue-with-RTL8168dp.patch
patches.suse/net-cls_bpf-fix-NULL-deref-on-offload-filter-removal.patch
patches.suse/net-fix-installing-orphaned-programs.patch
patches.suse/powerpc-powernv-Fix-CPU-idle-to-be-called-with-IRQs-.patch
@@ -2918,6 +2926,18 @@
patches.suse/scsi-qla2xxx-Initialized-mailbox-to-prevent-driver-l.patch
patches.suse/scsi-qla2xxx-Fix-partial-flash-write-of-MBI.patch
patches.suse/scsi-qla2xxx-stop-timer-in-shutdown-path.patch
+ patches.suse/hwmon-ina3221-Fix-read-timeout-issue.patch
+ patches.suse/usb-dwc3-select-CONFIG_REGMAP_MMIO.patch
+ patches.suse/usb-gadget-udc-atmel-Fix-interrupt-storm-in-FIFO-mod.patch
+ patches.suse/usb-dwc3-pci-prevent-memory-leak-in-dwc3_pci_probe.patch
+ patches.suse/USB-ldusb-fix-ring-buffer-locking.patch
+ patches.suse/USB-ldusb-fix-control-message-timeout.patch
+ patches.suse/xhci-Fix-use-after-free-regression-in-xhci-clear-hub.patch
+ patches.suse/usb-xhci-fix-Immediate-Data-Transfer-endianness.patch
+ patches.suse/usb-storage-Revert-commit-747668dbc061-usb-storage-S.patch
+ patches.suse/UAS-Revert-commit-3ae62a42090f-UAS-fix-alignment-of-.patch
+ patches.suse/USB-serial-whiteheat-fix-potential-slab-corruption.patch
+ patches.suse/usb-dwc3-gadget-fix-race-when-disabling-ep-with-canc.patch
# jejb/scsi for-next
patches.suse/scsi-lpfc-Fix-pt2pt-discovery-on-SLI3-HBAs.patch
@@ -2988,6 +3008,7 @@
patches.suse/autonuma-fix-watermark-checking-in-migrate_balanced_pgdat.patch
patches.suse/autonuma-reduce-cache-footprint-when-scanning-page-tables.patch
patches.suse/stacktrace-Don-t-skip-first-entry-on-noncurrent-task.patch
+ patches.suse/ALSA-hda-ca0132-Fix-possible-workqueue-stall.patch
########################################################
# kbuild/module infrastructure fixes