more patches

11 files changed, 584 insertions, 0 deletions

diff --git a/bonding-fix-unexpected-iff_bonding-bit-unset.patch b/bonding-fix-unexpected-iff_bonding-bit-unset.patch
new file mode 100644
index 0000000..38e57a4
--- /dev/null
+++ b/bonding-fix-unexpected-iff_bonding-bit-unset.patch
@@ -0,0 +1,95 @@
+From 5268c9d51a45f90357072ba0d4f2e18ca179aff5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 18:47:52 +0000
+Subject: bonding: fix unexpected IFF_BONDING bit unset
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit 65de65d9033750d2cf1b336c9d6e9da3a8b5cc6e ]
+
+The IFF_BONDING means bonding master or bonding slave device.
+->ndo_add_slave() sets IFF_BONDING flag and ->ndo_del_slave() unsets
+IFF_BONDING flag.
+
+bond0<--bond1
+
+Both bond0 and bond1 are bonding device and these should keep having
+IFF_BONDING flag until they are removed.
+But bond1 would lose IFF_BONDING at ->ndo_del_slave() because that routine
+do not check whether the slave device is the bonding type or not.
+This patch adds the interface type check routine before removing
+IFF_BONDING flag.
+
+Test commands:
+    ip link add bond0 type bond
+    ip link add bond1 type bond
+    ip link set bond1 master bond0
+    ip link set bond1 nomaster
+    ip link del bond1 type bond
+    ip link add bond1 type bond
+
+Splat looks like:
+[  226.665555] proc_dir_entry 'bonding/bond1' already registered
+[  226.666440] WARNING: CPU: 0 PID: 737 at fs/proc/generic.c:361 proc_register+0x2a9/0x3e0
+[  226.667571] Modules linked in: bonding af_packet sch_fq_codel ip_tables x_tables unix
+[  226.668662] CPU: 0 PID: 737 Comm: ip Not tainted 5.4.0-rc3+ #96
+[  226.669508] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+[  226.670652] RIP: 0010:proc_register+0x2a9/0x3e0
+[  226.671612] Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 39 01 00 00 48 8b 04 24 48 89 ea 48 c7 c7 a0 0b 14 9f 48 8b b0 e
+0 00 00 00 e8 07 e7 88 ff <0f> 0b 48 c7 c7 40 2d a5 9f e8 59 d6 23 01 48 8b 4c 24 10 48 b8 00
+[  226.675007] RSP: 0018:ffff888050e17078 EFLAGS: 00010282
+[  226.675761] RAX: dffffc0000000008 RBX: ffff88805fdd0f10 RCX: ffffffff9dd344e2
+[  226.676757] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88806c9f6b8c
+[  226.677751] RBP: ffff8880507160f3 R08: ffffed100d940019 R09: ffffed100d940019
+[  226.678761] R10: 0000000000000001 R11: ffffed100d940018 R12: ffff888050716008
+[  226.679757] R13: ffff8880507160f2 R14: dffffc0000000000 R15: ffffed100a0e2c1e
+[  226.680758] FS:  00007fdc217cc0c0(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000
+[  226.681886] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  226.682719] CR2: 00007f49313424d0 CR3: 0000000050e46001 CR4: 00000000000606f0
+[  226.683727] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[  226.684725] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[  226.685681] Call Trace:
+[  226.687089]  proc_create_seq_private+0xb3/0xf0
+[  226.687778]  bond_create_proc_entry+0x1b3/0x3f0 [bonding]
+[  226.691458]  bond_netdev_event+0x433/0x970 [bonding]
+[  226.692139]  ? __module_text_address+0x13/0x140
+[  226.692779]  notifier_call_chain+0x90/0x160
+[  226.693401]  register_netdevice+0x9b3/0xd80
+[  226.694010]  ? alloc_netdev_mqs+0x854/0xc10
+[  226.694629]  ? netdev_change_features+0xa0/0xa0
+[  226.695278]  ? rtnl_create_link+0x2ed/0xad0
+[  226.695849]  bond_newlink+0x2a/0x60 [bonding]
+[  226.696422]  __rtnl_newlink+0xb9f/0x11b0
+[  226.696968]  ? rtnl_link_unregister+0x220/0x220
+[ ... ]
+
+Fixes: 0b680e753724 ("[PATCH] bonding: Add priv_flag to avoid event mishandling")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_main.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1615,7 +1615,8 @@ err_detach:
+ 	slave_disable_netpoll(new_slave);
+ 
+ err_close:
+-	slave_dev->priv_flags &= ~IFF_BONDING;
++	if (!netif_is_bond_master(slave_dev))
++		slave_dev->priv_flags &= ~IFF_BONDING;
+ 	dev_close(slave_dev);
+ 
+ err_restore_mac:
+@@ -1803,7 +1804,8 @@ static int __bond_release_one(struct net
+ 
+ 	dev_set_mtu(slave_dev, slave->original_mtu);
+ 
+-	slave_dev->priv_flags &= ~IFF_BONDING;
++	if (!netif_is_bond_master(slave_dev))
++		slave_dev->priv_flags &= ~IFF_BONDING;
+ 
+ 	bond_free_slave(slave);
+ 
diff --git a/can-flexcan-disable-completely-the-ecc-mechanism.patch b/can-flexcan-disable-completely-the-ecc-mechanism.patch
new file mode 100644
index 0000000..26c013e
--- /dev/null
+++ b/can-flexcan-disable-completely-the-ecc-mechanism.patch
@@ -0,0 +1,34 @@
+From 14fb590af1516a362893c8ef6d2e5657757eeea5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 08:00:26 +0000
+Subject: can: flexcan: disable completely the ECC mechanism
+
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+
+[ Upstream commit 5e269324db5adb2f5f6ec9a93a9c7b0672932b47 ]
+
+The ECC (memory error detection and correction) mechanism can be
+activated or not, controlled by the ECCDIS bit in CAN_MECR. When
+disabled, updates on indications and reporting registers are stopped.
+So if want to disable ECC completely, had better assert ECCDIS bit, not
+just mask the related interrupts.
+
+Fixes: cdce844865be ("can: flexcan: add vf610 support for FlexCAN")
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Cc: linux-stable <stable@vger.kernel.org>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/flexcan.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -992,6 +992,7 @@ static int flexcan_chip_start(struct net
+ 		reg_mecr = flexcan_read(&regs->mecr);
+ 		reg_mecr &= ~FLEXCAN_MECR_ECRWRDIS;
+ 		flexcan_write(reg_mecr, &regs->mecr);
++		reg_mecr |= FLEXCAN_MECR_ECCDIS;
+ 		reg_mecr &= ~(FLEXCAN_MECR_NCEFAFRZ | FLEXCAN_MECR_HANCEI_MSK |
+ 				FLEXCAN_MECR_FANCEI_MSK);
+ 		flexcan_write(reg_mecr, &regs->mecr);
diff --git a/ipvs-move-old_secure_tcp-into-struct-netns_ipvs.patch b/ipvs-move-old_secure_tcp-into-struct-netns_ipvs.patch
new file mode 100644
index 0000000..085cb86
--- /dev/null
+++ b/ipvs-move-old_secure_tcp-into-struct-netns_ipvs.patch
@@ -0,0 +1,110 @@
+From 791fc670d94001fa4959a4e97435d8fc1a891d20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 09:53:03 -0700
+Subject: ipvs: move old_secure_tcp into struct netns_ipvs
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit c24b75e0f9239e78105f81c5f03a751641eb07ef ]
+
+syzbot reported the following issue :
+
+BUG: KCSAN: data-race in update_defense_level / update_defense_level
+
+read to 0xffffffff861a6260 of 4 bytes by task 3006 on cpu 1:
+ update_defense_level+0x621/0xb30 net/netfilter/ipvs/ip_vs_ctl.c:177
+ defense_work_handler+0x3d/0xd0 net/netfilter/ipvs/ip_vs_ctl.c:225
+ process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
+ worker_thread+0xa0/0x800 kernel/workqueue.c:2415
+ kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
+
+write to 0xffffffff861a6260 of 4 bytes by task 7333 on cpu 0:
+ update_defense_level+0xa62/0xb30 net/netfilter/ipvs/ip_vs_ctl.c:205
+ defense_work_handler+0x3d/0xd0 net/netfilter/ipvs/ip_vs_ctl.c:225
+ process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
+ worker_thread+0xa0/0x800 kernel/workqueue.c:2415
+ kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 0 PID: 7333 Comm: kworker/0:5 Not tainted 5.4.0-rc3+ #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Workqueue: events defense_work_handler
+
+Indeed, old_secure_tcp is currently a static variable, while it
+needs to be a per netns variable.
+
+Fixes: a0840e2e165a ("IPVS: netns, ip_vs_ctl local vars moved to ipvs struct.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip_vs.h            |    1 +
+ net/netfilter/ipvs/ip_vs_ctl.c |   15 +++++++--------
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -887,6 +887,7 @@ struct netns_ipvs {
+ 	struct delayed_work	defense_work;   /* Work handler */
+ 	int			drop_rate;
+ 	int			drop_counter;
++	int			old_secure_tcp;
+ 	atomic_t		dropentry;
+ 	/* locks in ctl.c */
+ 	spinlock_t		dropentry_lock;  /* drop entry handling */
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -97,7 +97,6 @@ static bool __ip_vs_addr_is_local_v6(str
+ static void update_defense_level(struct netns_ipvs *ipvs)
+ {
+ 	struct sysinfo i;
+-	static int old_secure_tcp = 0;
+ 	int availmem;
+ 	int nomem;
+ 	int to_change = -1;
+@@ -178,35 +177,35 @@ static void update_defense_level(struct
+ 	spin_lock(&ipvs->securetcp_lock);
+ 	switch (ipvs->sysctl_secure_tcp) {
+ 	case 0:
+-		if (old_secure_tcp >= 2)
++		if (ipvs->old_secure_tcp >= 2)
+ 			to_change = 0;
+ 		break;
+ 	case 1:
+ 		if (nomem) {
+-			if (old_secure_tcp < 2)
++			if (ipvs->old_secure_tcp < 2)
+ 				to_change = 1;
+ 			ipvs->sysctl_secure_tcp = 2;
+ 		} else {
+-			if (old_secure_tcp >= 2)
++			if (ipvs->old_secure_tcp >= 2)
+ 				to_change = 0;
+ 		}
+ 		break;
+ 	case 2:
+ 		if (nomem) {
+-			if (old_secure_tcp < 2)
++			if (ipvs->old_secure_tcp < 2)
+ 				to_change = 1;
+ 		} else {
+-			if (old_secure_tcp >= 2)
++			if (ipvs->old_secure_tcp >= 2)
+ 				to_change = 0;
+ 			ipvs->sysctl_secure_tcp = 1;
+ 		}
+ 		break;
+ 	case 3:
+-		if (old_secure_tcp < 2)
++		if (ipvs->old_secure_tcp < 2)
+ 			to_change = 1;
+ 		break;
+ 	}
+-	old_secure_tcp = ipvs->sysctl_secure_tcp;
++	ipvs->old_secure_tcp = ipvs->sysctl_secure_tcp;
+ 	if (to_change >= 0)
+ 		ip_vs_protocol_timeout_change(ipvs,
+ 					      ipvs->sysctl_secure_tcp > 1);
diff --git a/pci-tegra-enable-relaxed-ordering-only-for-tegra20-tegra30.patch b/pci-tegra-enable-relaxed-ordering-only-for-tegra20-tegra30.patch
new file mode 100644
index 0000000..2d7dee4
--- /dev/null
+++ b/pci-tegra-enable-relaxed-ordering-only-for-tegra20-tegra30.patch
@@ -0,0 +1,66 @@
+From 7be142caabc4780b13a522c485abc806de5c4114 Mon Sep 17 00:00:00 2001
+From: Vidya Sagar <vidyas@nvidia.com>
+Date: Thu, 4 Jul 2019 20:34:28 +0530
+Subject: PCI: tegra: Enable Relaxed Ordering only for Tegra20 & Tegra30
+
+From: Vidya Sagar <vidyas@nvidia.com>
+
+commit 7be142caabc4780b13a522c485abc806de5c4114 upstream.
+
+The PCI Tegra controller conversion to a device tree configurable
+driver in commit d1523b52bff3 ("PCI: tegra: Move PCIe driver
+to drivers/pci/host") implied that code for the driver can be
+compiled in for a kernel supporting multiple platforms.
+
+Unfortunately, a blind move of the code did not check that some of the
+quirks that were applied in arch/arm (eg enabling Relaxed Ordering on
+all PCI devices - since the quirk hook erroneously matches PCI_ANY_ID
+for both Vendor-ID and Device-ID) are now applied in all kernels that
+compile the PCI Tegra controlled driver, DT and ACPI alike.
+
+This is completely wrong, in that enablement of Relaxed Ordering is only
+required by default in Tegra20 platforms as described in the Tegra20
+Technical Reference Manual (available at
+https://developer.nvidia.com/embedded/downloads#?search=tegra%202 in
+Section 34.1, where it is mentioned that Relaxed Ordering bit needs to
+be enabled in its root ports to avoid deadlock in hardware) and in the
+Tegra30 platforms for the same reasons (unfortunately not documented
+in the TRM).
+
+There is no other strict requirement on PCI devices Relaxed Ordering
+enablement on any other Tegra platforms or PCI host bridge driver.
+
+Fix this quite upsetting situation by limiting the vendor and device IDs
+to which the Relaxed Ordering quirk applies to the root ports in
+question, reported above.
+
+Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
+[lorenzo.pieralisi@arm.com: completely rewrote the commit log/fixes tag]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pci-tegra.c |    7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/host/pci-tegra.c
++++ b/drivers/pci/host/pci-tegra.c
+@@ -648,12 +648,15 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NV
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA, 0x0e1c, tegra_pcie_fixup_class);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA, 0x0e1d, tegra_pcie_fixup_class);
+ 
+-/* Tegra PCIE requires relaxed ordering */
++/* Tegra20 and Tegra30 PCIE requires relaxed ordering */
+ static void tegra_pcie_relax_enable(struct pci_dev *dev)
+ {
+ 	pcie_capability_set_word(dev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_RELAX_EN);
+ }
+-DECLARE_PCI_FIXUP_FINAL(PCI_ANY_ID, PCI_ANY_ID, tegra_pcie_relax_enable);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0bf0, tegra_pcie_relax_enable);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0bf1, tegra_pcie_relax_enable);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0e1c, tegra_pcie_relax_enable);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0e1d, tegra_pcie_relax_enable);
+ 
+ static int tegra_pcie_setup(int nr, struct pci_sys_data *sys)
+ {
diff --git a/scsi-lpfc-honor-module-parameter-lpfc_use_adisc.patch b/scsi-lpfc-honor-module-parameter-lpfc_use_adisc.patch
new file mode 100644
index 0000000..0d7d382
--- /dev/null
+++ b/scsi-lpfc-honor-module-parameter-lpfc_use_adisc.patch
@@ -0,0 +1,60 @@
+From 21d8c8bdfcf19dd4037b0e175f98c7ff28ac6f40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 09:21:12 +0200
+Subject: scsi: lpfc: Honor module parameter lpfc_use_adisc
+
+From: Daniel Wagner <dwagner@suse.de>
+
+[ Upstream commit 0fd103ccfe6a06e40e2d9d8c91d96332cc9e1239 ]
+
+The initial lpfc_desc_set_adisc implementation in commit
+dea3101e0a5c ("lpfc: add Emulex FC driver version 8.0.28") enabled ADISC if
+
+	cfg_use_adisc && RSCN_MODE && FCP_2_DEVICE
+
+In commit 92d7f7b0cde3 ("[SCSI] lpfc: NPIV: add NPIV support on top of
+SLI-3") this changed to
+
+	(cfg_use_adisc && RSC_MODE) || FCP_2_DEVICE
+
+and later in commit ffc954936b13 ("[SCSI] lpfc 8.3.13: FC Discovery Fixes
+and enhancements.") to
+
+	(cfg_use_adisc && RSC_MODE) || (FCP_2_DEVICE && FCP_TARGET)
+
+A customer reports that after a devloss, an ADISC failure is logged. It
+turns out the ADISC flag is set even the user explicitly set lpfc_use_adisc
+= 0.
+
+[Sat Dec 22 22:55:58 2018] lpfc 0000:82:00.0: 2:(0):0203 Devloss timeout on WWPN 50:01:43:80:12:8e:40:20 NPort x05df00 Data: x82000000 x8 xa
+[Sat Dec 22 23:08:20 2018] lpfc 0000:82:00.0: 2:(0):2755 ADISC failure DID:05DF00 Status:x9/x70000
+
+[mkp: fixed Hannes' email]
+
+Fixes: 92d7f7b0cde3 ("[SCSI] lpfc: NPIV: add NPIV support on top of SLI-3")
+Cc: Dick Kennedy <dick.kennedy@broadcom.com>
+Cc: James Smart <james.smart@broadcom.com>
+Link: https://lore.kernel.org/r/20191022072112.132268-1-dwagner@suse.de
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Daniel Wagner <dwagner@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_nportdisc.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -742,9 +742,9 @@ lpfc_disc_set_adisc(struct lpfc_vport *v
+ 
+ 	if (!(vport->fc_flag & FC_PT2PT)) {
+ 		/* Check config parameter use-adisc or FCP-2 */
+-		if ((vport->cfg_use_adisc && (vport->fc_flag & FC_RSCN_MODE)) ||
++		if (vport->cfg_use_adisc && ((vport->fc_flag & FC_RSCN_MODE) ||
+ 		    ((ndlp->nlp_fcp_info & NLP_FCP_2_DEVICE) &&
+-		     (ndlp->nlp_type & NLP_FCP_TARGET))) {
++		     (ndlp->nlp_type & NLP_FCP_TARGET)))) {
+ 			spin_lock_irq(shost->host_lock);
+ 			ndlp->nlp_flag |= NLP_NPR_ADISC;
+ 			spin_unlock_irq(shost->host_lock);
diff --git a/scsi-qla2xxx-fixup-incorrect-usage-of-host_byte.patch b/scsi-qla2xxx-fixup-incorrect-usage-of-host_byte.patch
new file mode 100644
index 0000000..dae78ee
--- /dev/null
+++ b/scsi-qla2xxx-fixup-incorrect-usage-of-host_byte.patch
@@ -0,0 +1,51 @@
+From 0cadf480ca11712c0ec89b4fc80d832007fdf1a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2019 16:04:58 +0200
+Subject: scsi: qla2xxx: fixup incorrect usage of host_byte
+
+From: Hannes Reinecke <hare@suse.com>
+
+[ Upstream commit 66cf50e65b183c863825f5c28a818e3f47a72e40 ]
+
+DRIVER_ERROR is a a driver byte setting, not a host byte.  The qla2xxx
+driver should rather return DID_ERROR here to be in line with the other
+drivers.
+
+Link: https://lore.kernel.org/r/20191018140458.108278-1-hare@suse.de
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_bsg.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -252,7 +252,7 @@ qla2x00_process_els(struct fc_bsg_job *b
+ 	srb_t *sp;
+ 	const char *type;
+ 	int req_sg_cnt, rsp_sg_cnt;
+-	int rval =  (DRIVER_ERROR << 16);
++	int rval =  (DID_ERROR << 16);
+ 	uint16_t nextlid = 0;
+ 
+ 	if (bsg_job->request->msgcode == FC_BSG_RPT_ELS) {
+@@ -426,7 +426,7 @@ qla2x00_process_ct(struct fc_bsg_job *bs
+ 	struct Scsi_Host *host = bsg_job->shost;
+ 	scsi_qla_host_t *vha = shost_priv(host);
+ 	struct qla_hw_data *ha = vha->hw;
+-	int rval = (DRIVER_ERROR << 16);
++	int rval = (DID_ERROR << 16);
+ 	int req_sg_cnt, rsp_sg_cnt;
+ 	uint16_t loop_id;
+ 	struct fc_port *fcport;
+@@ -1913,7 +1913,7 @@ qlafx00_mgmt_cmd(struct fc_bsg_job *bsg_
+ 	struct Scsi_Host *host = bsg_job->shost;
+ 	scsi_qla_host_t *vha = shost_priv(host);
+ 	struct qla_hw_data *ha = vha->hw;
+-	int rval = (DRIVER_ERROR << 16);
++	int rval = (DID_ERROR << 16);
+ 	struct qla_mt_iocb_rqst_fx00 *piocb_rqst;
+ 	srb_t *sp;
+ 	int req_sg_cnt = 0, rsp_sg_cnt = 0;
diff --git a/scsi-qla2xxx-stop-timer-in-shutdown-path.patch b/scsi-qla2xxx-stop-timer-in-shutdown-path.patch
new file mode 100644
index 0000000..2017837
--- /dev/null
+++ b/scsi-qla2xxx-stop-timer-in-shutdown-path.patch
@@ -0,0 +1,44 @@
+From 17a96338d8fdd1172bb6031efe8e11dadcca08b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2019 16:38:04 +1000
+Subject: scsi: qla2xxx: stop timer in shutdown path
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit d3566abb1a1e7772116e4d50fb6a58d19c9802e5 ]
+
+In shutdown/reboot paths, the timer is not stopped:
+
+  qla2x00_shutdown
+  pci_device_shutdown
+  device_shutdown
+  kernel_restart_prepare
+  kernel_restart
+  sys_reboot
+
+This causes lockups (on powerpc) when firmware config space access calls
+are interrupted by smp_send_stop later in reboot.
+
+Fixes: e30d1756480dc ("[SCSI] qla2xxx: Addition of shutdown callback handler.")
+Link: https://lore.kernel.org/r/20191024063804.14538-1-npiggin@gmail.com
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3037,6 +3037,10 @@ qla2x00_shutdown(struct pci_dev *pdev)
+ 	/* Stop currently executing firmware. */
+ 	qla2x00_try_to_stop_firmware(vha);
+ 
++	/* Disable timer */
++	if (vha->timer_active)
++		qla2x00_stop_timer(vha);
++
+ 	/* Turn adapter off line */
+ 	vha->flags.online = 0;
+ 
diff --git a/series b/series
index a37ae54..c3a603d 100644
--- a/series
+++ b/series
@@ -17,3 +17,13 @@ can-peak_usb-fix-a-potential-out-of-sync-while-decoding-packets.patch
 can-gs_usb-gs_can_open-prevent-memory-leak.patch
 can-peak_usb-fix-slab-info-leak.patch
 drivers-usb-usbip-add-missing-break-statement-to-switch.patch
+pci-tegra-enable-relaxed-ordering-only-for-tegra20-tegra30.patch
+bonding-fix-unexpected-iff_bonding-bit-unset.patch
+scsi-qla2xxx-fixup-incorrect-usage-of-host_byte.patch
+scsi-lpfc-honor-module-parameter-lpfc_use_adisc.patch
+ipvs-move-old_secure_tcp-into-struct-netns_ipvs.patch
+usb-fsl-check-memory-resource-before-releasing-it.patch
+usb-gadget-udc-atmel-fix-interrupt-storm-in-fifo-mod.patch
+usb-skip-endpoints-with-0-maxpacket-length.patch
+scsi-qla2xxx-stop-timer-in-shutdown-path.patch
+can-flexcan-disable-completely-the-ecc-mechanism.patch
diff --git a/usb-fsl-check-memory-resource-before-releasing-it.patch b/usb-fsl-check-memory-resource-before-releasing-it.patch
new file mode 100644
index 0000000..4d1e570
--- /dev/null
+++ b/usb-fsl-check-memory-resource-before-releasing-it.patch
@@ -0,0 +1,32 @@
+From b87c9a744cf51c8bf368ce751d701135f349b864 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 18:21:51 +0800
+Subject: usb: fsl: Check memory resource before releasing it
+
+From: Nikhil Badola <nikhil.badola@freescale.com>
+
+[ Upstream commit bc1e3a2dd0c9954fd956ac43ca2876bbea018c01 ]
+
+Check memory resource existence before releasing it to avoid NULL
+pointer dereference
+
+Signed-off-by: Nikhil Badola <nikhil.badola@freescale.com>
+Reviewed-by: Ran Wang <ran.wang_1@nxp.com>
+Reviewed-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fsl_udc_core.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/fsl_udc_core.c
++++ b/drivers/usb/gadget/udc/fsl_udc_core.c
+@@ -2549,7 +2549,7 @@ static int __exit fsl_udc_remove(struct
+ 	dma_pool_destroy(udc_controller->td_pool);
+ 	free_irq(udc_controller->irq, udc_controller);
+ 	iounmap(dr_regs);
+-	if (pdata->operating_mode == FSL_USB2_DR_DEVICE)
++	if (res && (pdata->operating_mode == FSL_USB2_DR_DEVICE))
+ 		release_mem_region(res->start, resource_size(res));
+ 
+ 	/* free udc --wait for the release() finished */
diff --git a/usb-gadget-udc-atmel-fix-interrupt-storm-in-fifo-mod.patch b/usb-gadget-udc-atmel-fix-interrupt-storm-in-fifo-mod.patch
new file mode 100644
index 0000000..d9b7bb4
--- /dev/null
+++ b/usb-gadget-udc-atmel-fix-interrupt-storm-in-fifo-mod.patch
@@ -0,0 +1,37 @@
+From bc481a700642658e03b245ed862a3fca126b7ae1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 20:10:54 +0300
+Subject: usb: gadget: udc: atmel: Fix interrupt storm in FIFO mode.
+
+From: Cristian Birsan <cristian.birsan@microchip.com>
+
+[ Upstream commit ba3a1a915c49cc3023e4ddfc88f21e7514e82aa4 ]
+
+Fix interrupt storm generated by endpoints when working in FIFO mode.
+The TX_COMPLETE interrupt is used only by control endpoints processing.
+Do not enable it for other types of endpoints.
+
+Fixes: 914a3f3b3754 ("USB: add atmel_usba_udc driver")
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/atmel_usba_udc.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -392,9 +392,11 @@ static void submit_request(struct usba_e
+ 		next_fifo_transaction(ep, req);
+ 		if (req->last_transaction) {
+ 			usba_ep_writel(ep, CTL_DIS, USBA_TX_PK_RDY);
+-			usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE);
++			if (ep_is_control(ep))
++				usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE);
+ 		} else {
+-			usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE);
++			if (ep_is_control(ep))
++				usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE);
+ 			usba_ep_writel(ep, CTL_ENB, USBA_TX_PK_RDY);
+ 		}
+ 	}
diff --git a/usb-skip-endpoints-with-0-maxpacket-length.patch b/usb-skip-endpoints-with-0-maxpacket-length.patch
new file mode 100644
index 0000000..02be8c9
--- /dev/null
+++ b/usb-skip-endpoints-with-0-maxpacket-length.patch
@@ -0,0 +1,45 @@
+From 9489ccf362fe6f27abbcea7b4bea50f1d907e391 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 10:52:35 -0400
+Subject: USB: Skip endpoints with 0 maxpacket length
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+[ Upstream commit d482c7bb0541d19dea8bff437a9f3c5563b5b2d2 ]
+
+Endpoints with a maxpacket length of 0 are probably useless.  They
+can't transfer any data, and it's not at all unlikely that an HCD will
+crash or hang when trying to handle an URB for such an endpoint.
+
+Currently the USB core does not check for endpoints having a maxpacket
+value of 0.  This patch adds a check, printing a warning and skipping
+over any endpoints it catches.
+
+Now, the USB spec does not rule out endpoints having maxpacket = 0.
+But since they wouldn't have any practical use, there doesn't seem to
+be any good reason for us to accept them.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+
+Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1910281050420.1485-100000@iolanthe.rowland.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/config.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -257,6 +257,12 @@ static int usb_parse_endpoint(struct dev
+ 		endpoint->desc.bInterval = n;
+ 	}
+ 
++	if (usb_endpoint_maxp(&endpoint->desc) == 0) {
++		dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n",
++		    cfgno, inum, asnum, d->bEndpointAddress);
++		goto skip_to_next_endpoint_or_interface_descriptor;
++	}
++
+ 	/* Some buggy low-speed devices have Bulk endpoints, which is
+ 	 * explicitly forbidden by the USB spec.  In an attempt to make
+ 	 * them usable, we will try treating them as Interrupt endpoints.