aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-11-14 14:31:32 +0800
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-11-14 14:31:32 +0800
commitfcd8c5df2bdb19d3b6b3501bf04bf28b8269113e (patch)
treecdc6aac8d86252f9f499100d3dd3d7296c0e0ce0
parent3022b50aa9d8935b96ad3b475163b9ffccbc5747 (diff)
downloadqueue-3.18-fcd8c5df2bdb19d3b6b3501bf04bf28b8269113e.tar.gz
drop patches now merged
-rw-r--r--alsa-bebob-fix-to-detect-configured-source-of-sampling-clock-for-focusrite-saffire-pro-i-o-series.patch50
-rw-r--r--alsa-hda-ca0132-fix-possible-workqueue-stall.patch41
-rw-r--r--bonding-fix-unexpected-iff_bonding-bit-unset.patch95
-rw-r--r--can-c_can-c_can_poll-only-read-status-register-after-status-irq.patch93
-rw-r--r--can-flexcan-disable-completely-the-ecc-mechanism.patch34
-rw-r--r--can-gs_usb-gs_can_open-prevent-memory-leak.patch32
-rw-r--r--can-peak_usb-fix-a-potential-out-of-sync-while-decoding-packets.patch80
-rw-r--r--can-peak_usb-fix-slab-info-leak.patch39
-rw-r--r--can-usb_8dev-fix-use-after-free-on-disconnect.patch36
-rw-r--r--cdc-ncm-handle-incomplete-transfer-of-mtu.patch46
-rw-r--r--ceph-fix-use-after-free-in-__ceph_remove_cap.patch73
-rw-r--r--drivers-usb-usbip-add-missing-break-statement-to-switch.patch31
-rw-r--r--drm-radeon-fix-si_enable_smc_cac-failed-issue.patch33
-rw-r--r--dump_stack-avoid-the-livelock-of-the-dump_lock.patch47
-rw-r--r--iio-imu-adis16480-make-sure-provided-frequency-is-positive.patch40
-rw-r--r--ipvs-move-old_secure_tcp-into-struct-netns_ipvs.patch110
-rw-r--r--mm-vmstat-hide-proc-pagetypeinfo-from-normal-users.patch57
-rw-r--r--net-fix-data-race-in-neigh_event_send.patch86
-rw-r--r--netfilter-ipset-fix-an-error-code-in-ip_set_sockfn_get.patch47
-rw-r--r--netfilter-nf_tables-align-nft_expr-private-data-to-64-bit.patch60
-rw-r--r--nfc-netlink-fix-double-device-reference-drop.patch41
-rw-r--r--pci-tegra-enable-relaxed-ordering-only-for-tegra20-tegra30.patch66
-rw-r--r--perf-tools-fix-time-sorting.patch46
-rw-r--r--scsi-lpfc-honor-module-parameter-lpfc_use_adisc.patch60
-rw-r--r--scsi-qla2xxx-fixup-incorrect-usage-of-host_byte.patch51
-rw-r--r--scsi-qla2xxx-stop-timer-in-shutdown-path.patch44
-rw-r--r--series29
-rw-r--r--usb-fsl-check-memory-resource-before-releasing-it.patch32
-rw-r--r--usb-gadget-udc-atmel-fix-interrupt-storm-in-fifo-mod.patch37
-rw-r--r--usb-skip-endpoints-with-0-maxpacket-length.patch45
30 files changed, 0 insertions, 1581 deletions
diff --git a/alsa-bebob-fix-to-detect-configured-source-of-sampling-clock-for-focusrite-saffire-pro-i-o-series.patch b/alsa-bebob-fix-to-detect-configured-source-of-sampling-clock-for-focusrite-saffire-pro-i-o-series.patch
deleted file mode 100644
index d839f10..0000000
--- a/alsa-bebob-fix-to-detect-configured-source-of-sampling-clock-for-focusrite-saffire-pro-i-o-series.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 706ad6746a66546daf96d4e4a95e46faf6cf689a Mon Sep 17 00:00:00 2001
-From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
-Date: Sun, 3 Nov 2019 00:09:20 +0900
-Subject: ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series
-
-From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
-
-commit 706ad6746a66546daf96d4e4a95e46faf6cf689a upstream.
-
-For Focusrite Saffire Pro i/o, the lowest 8 bits of register represents
-configured source of sampling clock. The next lowest 8 bits represents
-whether the configured source is actually detected or not just after
-the register is changed for the source.
-
-Current implementation evaluates whole the register to detect configured
-source. This results in failure due to the next lowest 8 bits when the
-source is connected in advance.
-
-This commit fixes the bug.
-
-Fixes: 25784ec2d034 ("ALSA: bebob: Add support for Focusrite Saffire/SaffirePro series")
-Cc: <stable@vger.kernel.org> # v3.16+
-Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
-Link: https://lore.kernel.org/r/20191102150920.20367-1-o-takashi@sakamocchi.jp
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- sound/firewire/bebob/bebob_focusrite.c | 3 +++
- 1 file changed, 3 insertions(+)
-
---- a/sound/firewire/bebob/bebob_focusrite.c
-+++ b/sound/firewire/bebob/bebob_focusrite.c
-@@ -28,6 +28,8 @@
- #define SAFFIRE_CLOCK_SOURCE_SPDIF 1
-
- /* clock sources as returned from register of Saffire Pro 10 and 26 */
-+#define SAFFIREPRO_CLOCK_SOURCE_SELECT_MASK 0x000000ff
-+#define SAFFIREPRO_CLOCK_SOURCE_DETECT_MASK 0x0000ff00
- #define SAFFIREPRO_CLOCK_SOURCE_INTERNAL 0
- #define SAFFIREPRO_CLOCK_SOURCE_SKIP 1 /* never used on hardware */
- #define SAFFIREPRO_CLOCK_SOURCE_SPDIF 2
-@@ -184,6 +186,7 @@ saffirepro_both_clk_src_get(struct snd_b
- map = saffirepro_clk_maps[1];
-
- /* In a case that this driver cannot handle the value of register. */
-+ value &= SAFFIREPRO_CLOCK_SOURCE_SELECT_MASK;
- if (value >= SAFFIREPRO_CLOCK_SOURCE_COUNT || map[value] < 0) {
- err = -EIO;
- goto end;
diff --git a/alsa-hda-ca0132-fix-possible-workqueue-stall.patch b/alsa-hda-ca0132-fix-possible-workqueue-stall.patch
deleted file mode 100644
index 92b3c7e..0000000
--- a/alsa-hda-ca0132-fix-possible-workqueue-stall.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 15c2b3cc09a31620914955cb2a89c277c18ee999 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Tue, 5 Nov 2019 14:43:16 +0100
-Subject: ALSA: hda/ca0132 - Fix possible workqueue stall
-
-From: Takashi Iwai <tiwai@suse.de>
-
-commit 15c2b3cc09a31620914955cb2a89c277c18ee999 upstream.
-
-The unsolicited event handler for the headphone jack on CA0132 codec
-driver tries to reschedule the another delayed work with
-cancel_delayed_work_sync(). It's no good idea, unfortunately,
-especially after we changed the work queue to the standard global
-one; this may lead to a stall because both works are using the same
-global queue.
-
-Fix it by dropping the _sync but does call cancel_delayed_work()
-instead.
-
-Fixes: 993884f6a26c ("ALSA: hda/ca0132 - Delay HP amp turnon.")
-BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1155836
-Cc: <stable@vger.kernel.org>
-Link: https://lore.kernel.org/r/20191105134316.19294-1-tiwai@suse.de
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- sound/pci/hda/patch_ca0132.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/sound/pci/hda/patch_ca0132.c
-+++ b/sound/pci/hda/patch_ca0132.c
-@@ -4415,7 +4415,7 @@ static void hp_callback(struct hda_codec
- /* Delay enabling the HP amp, to let the mic-detection
- * state machine run.
- */
-- cancel_delayed_work_sync(&spec->unsol_hp_work);
-+ cancel_delayed_work(&spec->unsol_hp_work);
- queue_delayed_work(codec->bus->workq, &spec->unsol_hp_work,
- msecs_to_jiffies(500));
- cb->tbl->block_report = 1;
diff --git a/bonding-fix-unexpected-iff_bonding-bit-unset.patch b/bonding-fix-unexpected-iff_bonding-bit-unset.patch
deleted file mode 100644
index 38e57a4..0000000
--- a/bonding-fix-unexpected-iff_bonding-bit-unset.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From 5268c9d51a45f90357072ba0d4f2e18ca179aff5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 21 Oct 2019 18:47:52 +0000
-Subject: bonding: fix unexpected IFF_BONDING bit unset
-
-From: Taehee Yoo <ap420073@gmail.com>
-
-[ Upstream commit 65de65d9033750d2cf1b336c9d6e9da3a8b5cc6e ]
-
-The IFF_BONDING means bonding master or bonding slave device.
-->ndo_add_slave() sets IFF_BONDING flag and ->ndo_del_slave() unsets
-IFF_BONDING flag.
-
-bond0<--bond1
-
-Both bond0 and bond1 are bonding device and these should keep having
-IFF_BONDING flag until they are removed.
-But bond1 would lose IFF_BONDING at ->ndo_del_slave() because that routine
-do not check whether the slave device is the bonding type or not.
-This patch adds the interface type check routine before removing
-IFF_BONDING flag.
-
-Test commands:
- ip link add bond0 type bond
- ip link add bond1 type bond
- ip link set bond1 master bond0
- ip link set bond1 nomaster
- ip link del bond1 type bond
- ip link add bond1 type bond
-
-Splat looks like:
-[ 226.665555] proc_dir_entry 'bonding/bond1' already registered
-[ 226.666440] WARNING: CPU: 0 PID: 737 at fs/proc/generic.c:361 proc_register+0x2a9/0x3e0
-[ 226.667571] Modules linked in: bonding af_packet sch_fq_codel ip_tables x_tables unix
-[ 226.668662] CPU: 0 PID: 737 Comm: ip Not tainted 5.4.0-rc3+ #96
-[ 226.669508] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
-[ 226.670652] RIP: 0010:proc_register+0x2a9/0x3e0
-[ 226.671612] Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 39 01 00 00 48 8b 04 24 48 89 ea 48 c7 c7 a0 0b 14 9f 48 8b b0 e
-0 00 00 00 e8 07 e7 88 ff <0f> 0b 48 c7 c7 40 2d a5 9f e8 59 d6 23 01 48 8b 4c 24 10 48 b8 00
-[ 226.675007] RSP: 0018:ffff888050e17078 EFLAGS: 00010282
-[ 226.675761] RAX: dffffc0000000008 RBX: ffff88805fdd0f10 RCX: ffffffff9dd344e2
-[ 226.676757] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88806c9f6b8c
-[ 226.677751] RBP: ffff8880507160f3 R08: ffffed100d940019 R09: ffffed100d940019
-[ 226.678761] R10: 0000000000000001 R11: ffffed100d940018 R12: ffff888050716008
-[ 226.679757] R13: ffff8880507160f2 R14: dffffc0000000000 R15: ffffed100a0e2c1e
-[ 226.680758] FS: 00007fdc217cc0c0(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000
-[ 226.681886] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[ 226.682719] CR2: 00007f49313424d0 CR3: 0000000050e46001 CR4: 00000000000606f0
-[ 226.683727] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
-[ 226.684725] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
-[ 226.685681] Call Trace:
-[ 226.687089] proc_create_seq_private+0xb3/0xf0
-[ 226.687778] bond_create_proc_entry+0x1b3/0x3f0 [bonding]
-[ 226.691458] bond_netdev_event+0x433/0x970 [bonding]
-[ 226.692139] ? __module_text_address+0x13/0x140
-[ 226.692779] notifier_call_chain+0x90/0x160
-[ 226.693401] register_netdevice+0x9b3/0xd80
-[ 226.694010] ? alloc_netdev_mqs+0x854/0xc10
-[ 226.694629] ? netdev_change_features+0xa0/0xa0
-[ 226.695278] ? rtnl_create_link+0x2ed/0xad0
-[ 226.695849] bond_newlink+0x2a/0x60 [bonding]
-[ 226.696422] __rtnl_newlink+0xb9f/0x11b0
-[ 226.696968] ? rtnl_link_unregister+0x220/0x220
-[ ... ]
-
-Fixes: 0b680e753724 ("[PATCH] bonding: Add priv_flag to avoid event mishandling")
-Signed-off-by: Taehee Yoo <ap420073@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/bonding/bond_main.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
---- a/drivers/net/bonding/bond_main.c
-+++ b/drivers/net/bonding/bond_main.c
-@@ -1615,7 +1615,8 @@ err_detach:
- slave_disable_netpoll(new_slave);
-
- err_close:
-- slave_dev->priv_flags &= ~IFF_BONDING;
-+ if (!netif_is_bond_master(slave_dev))
-+ slave_dev->priv_flags &= ~IFF_BONDING;
- dev_close(slave_dev);
-
- err_restore_mac:
-@@ -1803,7 +1804,8 @@ static int __bond_release_one(struct net
-
- dev_set_mtu(slave_dev, slave->original_mtu);
-
-- slave_dev->priv_flags &= ~IFF_BONDING;
-+ if (!netif_is_bond_master(slave_dev))
-+ slave_dev->priv_flags &= ~IFF_BONDING;
-
- bond_free_slave(slave);
-
diff --git a/can-c_can-c_can_poll-only-read-status-register-after-status-irq.patch b/can-c_can-c_can_poll-only-read-status-register-after-status-irq.patch
deleted file mode 100644
index 4932e27..0000000
--- a/can-c_can-c_can_poll-only-read-status-register-after-status-irq.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 3cb3eaac52c0f145d895f4b6c22834d5f02b8569 Mon Sep 17 00:00:00 2001
-From: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
-Date: Tue, 1 Oct 2019 09:40:36 +0200
-Subject: can: c_can: c_can_poll(): only read status register after status IRQ
-
-From: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
-
-commit 3cb3eaac52c0f145d895f4b6c22834d5f02b8569 upstream.
-
-When the status register is read without the status IRQ pending, the
-chip may not raise the interrupt line for an upcoming status interrupt
-and the driver may miss a status interrupt.
-
-It is critical that the BUSOFF status interrupt is forwarded to the
-higher layers, since no more interrupts will follow without
-intervention.
-
-Thanks to Wolfgang and Joe for bringing up the first idea.
-
-Signed-off-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
-Cc: Wolfgang Grandegger <wg@grandegger.com>
-Cc: Joe Burmeister <joe.burmeister@devtank.co.uk>
-Fixes: fa39b54ccf28 ("can: c_can: Get rid of pointless interrupts")
-Cc: linux-stable <stable@vger.kernel.org>
-Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/net/can/c_can/c_can.c | 25 ++++++++++++++++++++-----
- drivers/net/can/c_can/c_can.h | 1 +
- 2 files changed, 21 insertions(+), 5 deletions(-)
-
---- a/drivers/net/can/c_can/c_can.c
-+++ b/drivers/net/can/c_can/c_can.c
-@@ -96,6 +96,9 @@
- #define BTR_TSEG2_SHIFT 12
- #define BTR_TSEG2_MASK (0x7 << BTR_TSEG2_SHIFT)
-
-+/* interrupt register */
-+#define INT_STS_PENDING 0x8000
-+
- /* brp extension register */
- #define BRP_EXT_BRPE_MASK 0x0f
- #define BRP_EXT_BRPE_SHIFT 0
-@@ -1021,10 +1024,16 @@ static int c_can_poll(struct napi_struct
- u16 curr, last = priv->last_status;
- int work_done = 0;
-
-- priv->last_status = curr = priv->read_reg(priv, C_CAN_STS_REG);
-- /* Ack status on C_CAN. D_CAN is self clearing */
-- if (priv->type != BOSCH_D_CAN)
-- priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
-+ /* Only read the status register if a status interrupt was pending */
-+ if (atomic_xchg(&priv->sie_pending, 0)) {
-+ priv->last_status = curr = priv->read_reg(priv, C_CAN_STS_REG);
-+ /* Ack status on C_CAN. D_CAN is self clearing */
-+ if (priv->type != BOSCH_D_CAN)
-+ priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
-+ } else {
-+ /* no change detected ... */
-+ curr = last;
-+ }
-
- /* handle state changes */
- if ((curr & STATUS_EWARN) && (!(last & STATUS_EWARN))) {
-@@ -1075,10 +1084,16 @@ static irqreturn_t c_can_isr(int irq, vo
- {
- struct net_device *dev = (struct net_device *)dev_id;
- struct c_can_priv *priv = netdev_priv(dev);
-+ int reg_int;
-
-- if (!priv->read_reg(priv, C_CAN_INT_REG))
-+ reg_int = priv->read_reg(priv, C_CAN_INT_REG);
-+ if (!reg_int)
- return IRQ_NONE;
-
-+ /* save for later use */
-+ if (reg_int & INT_STS_PENDING)
-+ atomic_set(&priv->sie_pending, 1);
-+
- /* disable all interrupts and schedule the NAPI */
- c_can_irq_control(priv, false);
- napi_schedule(&priv->napi);
---- a/drivers/net/can/c_can/c_can.h
-+++ b/drivers/net/can/c_can/c_can.h
-@@ -176,6 +176,7 @@ struct c_can_priv {
- struct net_device *dev;
- struct device *device;
- atomic_t tx_active;
-+ atomic_t sie_pending;
- unsigned long tx_dir;
- int last_status;
- u16 (*read_reg) (const struct c_can_priv *priv, enum reg index);
diff --git a/can-flexcan-disable-completely-the-ecc-mechanism.patch b/can-flexcan-disable-completely-the-ecc-mechanism.patch
deleted file mode 100644
index 26c013e..0000000
--- a/can-flexcan-disable-completely-the-ecc-mechanism.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 14fb590af1516a362893c8ef6d2e5657757eeea5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 15 Aug 2019 08:00:26 +0000
-Subject: can: flexcan: disable completely the ECC mechanism
-
-From: Joakim Zhang <qiangqing.zhang@nxp.com>
-
-[ Upstream commit 5e269324db5adb2f5f6ec9a93a9c7b0672932b47 ]
-
-The ECC (memory error detection and correction) mechanism can be
-activated or not, controlled by the ECCDIS bit in CAN_MECR. When
-disabled, updates on indications and reporting registers are stopped.
-So if want to disable ECC completely, had better assert ECCDIS bit, not
-just mask the related interrupts.
-
-Fixes: cdce844865be ("can: flexcan: add vf610 support for FlexCAN")
-Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
-Cc: linux-stable <stable@vger.kernel.org>
-Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/can/flexcan.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/can/flexcan.c
-+++ b/drivers/net/can/flexcan.c
-@@ -992,6 +992,7 @@ static int flexcan_chip_start(struct net
- reg_mecr = flexcan_read(&regs->mecr);
- reg_mecr &= ~FLEXCAN_MECR_ECRWRDIS;
- flexcan_write(reg_mecr, &regs->mecr);
-+ reg_mecr |= FLEXCAN_MECR_ECCDIS;
- reg_mecr &= ~(FLEXCAN_MECR_NCEFAFRZ | FLEXCAN_MECR_HANCEI_MSK |
- FLEXCAN_MECR_FANCEI_MSK);
- flexcan_write(reg_mecr, &regs->mecr);
diff --git a/can-gs_usb-gs_can_open-prevent-memory-leak.patch b/can-gs_usb-gs_can_open-prevent-memory-leak.patch
deleted file mode 100644
index 5ceb1e6..0000000
--- a/can-gs_usb-gs_can_open-prevent-memory-leak.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From fb5be6a7b4863ecc44963bb80ca614584b6c7817 Mon Sep 17 00:00:00 2001
-From: Navid Emamdoost <navid.emamdoost@gmail.com>
-Date: Thu, 19 Sep 2019 21:44:38 -0500
-Subject: can: gs_usb: gs_can_open(): prevent memory leak
-
-From: Navid Emamdoost <navid.emamdoost@gmail.com>
-
-commit fb5be6a7b4863ecc44963bb80ca614584b6c7817 upstream.
-
-In gs_can_open() if usb_submit_urb() fails the allocated urb should be
-released.
-
-Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
-Cc: linux-stable <stable@vger.kernel.org>
-Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
-Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/net/can/usb/gs_usb.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/can/usb/gs_usb.c
-+++ b/drivers/net/can/usb/gs_usb.c
-@@ -617,6 +617,7 @@ static int gs_can_open(struct net_device
- rc);
-
- usb_unanchor_urb(urb);
-+ usb_free_urb(urb);
- break;
- }
-
diff --git a/can-peak_usb-fix-a-potential-out-of-sync-while-decoding-packets.patch b/can-peak_usb-fix-a-potential-out-of-sync-while-decoding-packets.patch
deleted file mode 100644
index 4d6d603..0000000
--- a/can-peak_usb-fix-a-potential-out-of-sync-while-decoding-packets.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From de280f403f2996679e2607384980703710576fed Mon Sep 17 00:00:00 2001
-From: Stephane Grosjean <s.grosjean@peak-system.com>
-Date: Tue, 8 Oct 2019 10:35:44 +0200
-Subject: can: peak_usb: fix a potential out-of-sync while decoding packets
-
-From: Stephane Grosjean <s.grosjean@peak-system.com>
-
-commit de280f403f2996679e2607384980703710576fed upstream.
-
-When decoding a buffer received from PCAN-USB, the first timestamp read in
-a packet is a 16-bit coded time base, and the next ones are an 8-bit
-offset to this base, regardless of the type of packet read.
-
-This patch corrects a potential loss of synchronization by using a
-timestamp index read from the buffer, rather than an index of received
-data packets, to determine on the sizeof the timestamp to be read from the
-packet being decoded.
-
-Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
-Fixes: 46be265d3388 ("can: usb: PEAK-System Technik PCAN-USB specific part")
-Cc: linux-stable <stable@vger.kernel.org>
-Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/net/can/usb/peak_usb/pcan_usb.c | 17 ++++++++++++-----
- 1 file changed, 12 insertions(+), 5 deletions(-)
-
---- a/drivers/net/can/usb/peak_usb/pcan_usb.c
-+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
-@@ -108,7 +108,7 @@ struct pcan_usb_msg_context {
- u8 *end;
- u8 rec_cnt;
- u8 rec_idx;
-- u8 rec_data_idx;
-+ u8 rec_ts_idx;
- struct net_device *netdev;
- struct pcan_usb *pdev;
- };
-@@ -551,10 +551,15 @@ static int pcan_usb_decode_status(struct
- mc->ptr += PCAN_USB_CMD_ARGS;
-
- if (status_len & PCAN_USB_STATUSLEN_TIMESTAMP) {
-- int err = pcan_usb_decode_ts(mc, !mc->rec_idx);
-+ int err = pcan_usb_decode_ts(mc, !mc->rec_ts_idx);
-
- if (err)
- return err;
-+
-+ /* Next packet in the buffer will have a timestamp on a single
-+ * byte
-+ */
-+ mc->rec_ts_idx++;
- }
-
- switch (f) {
-@@ -637,10 +642,13 @@ static int pcan_usb_decode_data(struct p
-
- cf->can_dlc = get_can_dlc(rec_len);
-
-- /* first data packet timestamp is a word */
-- if (pcan_usb_decode_ts(mc, !mc->rec_data_idx))
-+ /* Only first packet timestamp is a word */
-+ if (pcan_usb_decode_ts(mc, !mc->rec_ts_idx))
- goto decode_failed;
-
-+ /* Next packet in the buffer will have a timestamp on a single byte */
-+ mc->rec_ts_idx++;
-+
- /* read data */
- memset(cf->data, 0x0, sizeof(cf->data));
- if (status_len & PCAN_USB_STATUSLEN_RTR) {
-@@ -695,7 +703,6 @@ static int pcan_usb_decode_msg(struct pe
- /* handle normal can frames here */
- } else {
- err = pcan_usb_decode_data(&mc, sl);
-- mc.rec_data_idx++;
- }
- }
-
diff --git a/can-peak_usb-fix-slab-info-leak.patch b/can-peak_usb-fix-slab-info-leak.patch
deleted file mode 100644
index f5786e5..0000000
--- a/can-peak_usb-fix-slab-info-leak.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From f7a1337f0d29b98733c8824e165fca3371d7d4fd Mon Sep 17 00:00:00 2001
-From: Johan Hovold <johan@kernel.org>
-Date: Wed, 23 Oct 2019 10:27:05 +0200
-Subject: can: peak_usb: fix slab info leak
-
-From: Johan Hovold <johan@kernel.org>
-
-commit f7a1337f0d29b98733c8824e165fca3371d7d4fd upstream.
-
-Fix a small slab info leak due to a failure to clear the command buffer
-at allocation.
-
-The first 16 bytes of the command buffer are always sent to the device
-in pcan_usb_send_cmd() even though only the first two may have been
-initialised in case no argument payload is provided (e.g. when waiting
-for a response).
-
-Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
-Cc: stable <stable@vger.kernel.org> # 3.4
-Reported-by: syzbot+863724e7128e14b26732@syzkaller.appspotmail.com
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
-+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
-@@ -732,7 +732,7 @@ static int peak_usb_create_dev(struct pe
- dev = netdev_priv(netdev);
-
- /* allocate a buffer large enough to send commands */
-- dev->cmd_buf = kmalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL);
-+ dev->cmd_buf = kzalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL);
- if (!dev->cmd_buf) {
- err = -ENOMEM;
- goto lbl_free_candev;
diff --git a/can-usb_8dev-fix-use-after-free-on-disconnect.patch b/can-usb_8dev-fix-use-after-free-on-disconnect.patch
deleted file mode 100644
index 8ced081..0000000
--- a/can-usb_8dev-fix-use-after-free-on-disconnect.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 3759739426186a924675651b388d1c3963c5710e Mon Sep 17 00:00:00 2001
-From: Johan Hovold <johan@kernel.org>
-Date: Tue, 1 Oct 2019 12:29:14 +0200
-Subject: can: usb_8dev: fix use-after-free on disconnect
-
-From: Johan Hovold <johan@kernel.org>
-
-commit 3759739426186a924675651b388d1c3963c5710e upstream.
-
-The driver was accessing its driver data after having freed it.
-
-Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices")
-Cc: stable <stable@vger.kernel.org> # 3.9
-Cc: Bernd Krumboeck <b.krumboeck@gmail.com>
-Cc: Wolfgang Grandegger <wg@grandegger.com>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/net/can/usb/usb_8dev.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
---- a/drivers/net/can/usb/usb_8dev.c
-+++ b/drivers/net/can/usb/usb_8dev.c
-@@ -1016,9 +1016,8 @@ static void usb_8dev_disconnect(struct u
- netdev_info(priv->netdev, "device disconnected\n");
-
- unregister_netdev(priv->netdev);
-- free_candev(priv->netdev);
--
- unlink_all_urbs(priv);
-+ free_candev(priv->netdev);
- }
-
- }
diff --git a/cdc-ncm-handle-incomplete-transfer-of-mtu.patch b/cdc-ncm-handle-incomplete-transfer-of-mtu.patch
deleted file mode 100644
index bd4fa87..0000000
--- a/cdc-ncm-handle-incomplete-transfer-of-mtu.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From foo@baz Sun 10 Nov 2019 06:59:26 PM CET
-From: Oliver Neukum <oneukum@suse.com>
-Date: Thu, 7 Nov 2019 09:48:01 +0100
-Subject: CDC-NCM: handle incomplete transfer of MTU
-
-From: Oliver Neukum <oneukum@suse.com>
-
-[ Upstream commit 332f989a3b0041b810836c5c3747e59aad7e9d0b ]
-
-A malicious device may give half an answer when asked
-for its MTU. The driver will proceed after this with
-a garbage MTU. Anything but a complete answer must be treated
-as an error.
-
-V2: used sizeof as request by Alexander
-
-Reported-and-tested-by: syzbot+0631d878823ce2411636@syzkaller.appspotmail.com
-Signed-off-by: Oliver Neukum <oneukum@suse.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/net/usb/cdc_ncm.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
---- a/drivers/net/usb/cdc_ncm.c
-+++ b/drivers/net/usb/cdc_ncm.c
-@@ -532,8 +532,8 @@ static void cdc_ncm_set_dgram_size(struc
- /* read current mtu value from device */
- err = usbnet_read_cmd(dev, USB_CDC_GET_MAX_DATAGRAM_SIZE,
- USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE,
-- 0, iface_no, &max_datagram_size, 2);
-- if (err < 0) {
-+ 0, iface_no, &max_datagram_size, sizeof(max_datagram_size));
-+ if (err < sizeof(max_datagram_size)) {
- dev_dbg(&dev->intf->dev, "GET_MAX_DATAGRAM_SIZE failed\n");
- goto out;
- }
-@@ -544,7 +544,7 @@ static void cdc_ncm_set_dgram_size(struc
- max_datagram_size = cpu_to_le16(ctx->max_datagram_size);
- err = usbnet_write_cmd(dev, USB_CDC_SET_MAX_DATAGRAM_SIZE,
- USB_TYPE_CLASS | USB_DIR_OUT | USB_RECIP_INTERFACE,
-- 0, iface_no, &max_datagram_size, 2);
-+ 0, iface_no, &max_datagram_size, sizeof(max_datagram_size));
- if (err < 0)
- dev_dbg(&dev->intf->dev, "SET_MAX_DATAGRAM_SIZE failed\n");
-
diff --git a/ceph-fix-use-after-free-in-__ceph_remove_cap.patch b/ceph-fix-use-after-free-in-__ceph_remove_cap.patch
deleted file mode 100644
index 57e2611..0000000
--- a/ceph-fix-use-after-free-in-__ceph_remove_cap.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From ea60ed6fcf29eebc78f2ce91491e6309ee005a01 Mon Sep 17 00:00:00 2001
-From: Luis Henriques <lhenriques@suse.com>
-Date: Fri, 25 Oct 2019 14:05:24 +0100
-Subject: ceph: fix use-after-free in __ceph_remove_cap()
-
-From: Luis Henriques <lhenriques@suse.com>
-
-commit ea60ed6fcf29eebc78f2ce91491e6309ee005a01 upstream.
-
-KASAN reports a use-after-free when running xfstest generic/531, with the
-following trace:
-
-[ 293.903362] kasan_report+0xe/0x20
-[ 293.903365] rb_erase+0x1f/0x790
-[ 293.903370] __ceph_remove_cap+0x201/0x370
-[ 293.903375] __ceph_remove_caps+0x4b/0x70
-[ 293.903380] ceph_evict_inode+0x4e/0x360
-[ 293.903386] evict+0x169/0x290
-[ 293.903390] __dentry_kill+0x16f/0x250
-[ 293.903394] dput+0x1c6/0x440
-[ 293.903398] __fput+0x184/0x330
-[ 293.903404] task_work_run+0xb9/0xe0
-[ 293.903410] exit_to_usermode_loop+0xd3/0xe0
-[ 293.903413] do_syscall_64+0x1a0/0x1c0
-[ 293.903417] entry_SYSCALL_64_after_hwframe+0x44/0xa9
-
-This happens because __ceph_remove_cap() may queue a cap release
-(__ceph_queue_cap_release) which can be scheduled before that cap is
-removed from the inode list with
-
- rb_erase(&cap->ci_node, &ci->i_caps);
-
-And, when this finally happens, the use-after-free will occur.
-
-This can be fixed by removing the cap from the inode list before being
-removed from the session list, and thus eliminating the risk of an UAF.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Luis Henriques <lhenriques@suse.com>
-Reviewed-by: Jeff Layton <jlayton@kernel.org>
-Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- fs/ceph/caps.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
---- a/fs/ceph/caps.c
-+++ b/fs/ceph/caps.c
-@@ -913,6 +913,11 @@ void __ceph_remove_cap(struct ceph_cap *
-
- dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
-
-+ /* remove from inode's cap rbtree, and clear auth cap */
-+ rb_erase(&cap->ci_node, &ci->i_caps);
-+ if (ci->i_auth_cap == cap)
-+ ci->i_auth_cap = NULL;
-+
- /* remove from session list */
- spin_lock(&session->s_cap_lock);
- /*
-@@ -939,11 +944,6 @@ void __ceph_remove_cap(struct ceph_cap *
- cap->ci = NULL;
- spin_unlock(&session->s_cap_lock);
-
-- /* remove from inode list */
-- rb_erase(&cap->ci_node, &ci->i_caps);
-- if (ci->i_auth_cap == cap)
-- ci->i_auth_cap = NULL;
--
- if (removed)
- ceph_put_cap(mdsc, cap);
-
diff --git a/drivers-usb-usbip-add-missing-break-statement-to-switch.patch b/drivers-usb-usbip-add-missing-break-statement-to-switch.patch
deleted file mode 100644
index 3852ea0..0000000
--- a/drivers-usb-usbip-add-missing-break-statement-to-switch.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 7c92e5fbf4dac0dd4dd41a0383adc54f16f403e2 Mon Sep 17 00:00:00 2001
-From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
-Date: Thu, 9 Feb 2017 01:49:56 -0600
-Subject: drivers: usb: usbip: Add missing break statement to switch
-
-From: Gustavo A. R. Silva <garsilva@embeddedor.com>
-
-commit 7c92e5fbf4dac0dd4dd41a0383adc54f16f403e2 upstream.
-
-Add missing break statement to prevent the code for case
-USB_PORT_FEAT_C_RESET falling through to the default case.
-
-Addresses-Coverity-ID: 143155
-Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/usb/usbip/vhci_hcd.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/usb/usbip/vhci_hcd.c
-+++ b/drivers/usb/usbip/vhci_hcd.c
-@@ -297,6 +297,7 @@ static int vhci_hub_control(struct usb_h
- default:
- break;
- }
-+ break;
- default:
- usbip_dbg_vhci_rh(" ClearPortFeature: default %x\n",
- wValue);
diff --git a/drm-radeon-fix-si_enable_smc_cac-failed-issue.patch b/drm-radeon-fix-si_enable_smc_cac-failed-issue.patch
deleted file mode 100644
index d30ab33..0000000
--- a/drm-radeon-fix-si_enable_smc_cac-failed-issue.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 2c409ba81be25516afe05ae27a4a15da01740b01 Mon Sep 17 00:00:00 2001
-From: Alex Deucher <alexander.deucher@amd.com>
-Date: Wed, 30 Oct 2019 10:21:28 -0400
-Subject: drm/radeon: fix si_enable_smc_cac() failed issue
-
-From: Alex Deucher <alexander.deucher@amd.com>
-
-commit 2c409ba81be25516afe05ae27a4a15da01740b01 upstream.
-
-Need to set the dte flag on this asic.
-
-Port the fix from amdgpu:
-5cb818b861be114 ("drm/amd/amdgpu: fix si_enable_smc_cac() failed issue")
-
-Reviewed-by: Yong Zhao <yong.zhao@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Cc: stable@vger.kernel.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/gpu/drm/radeon/si_dpm.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/gpu/drm/radeon/si_dpm.c
-+++ b/drivers/gpu/drm/radeon/si_dpm.c
-@@ -1952,6 +1952,7 @@ static void si_initialize_powertune_defa
- case 0x682C:
- si_pi->cac_weights = cac_weights_cape_verde_pro;
- si_pi->dte_data = dte_data_sun_xt;
-+ update_dte_from_pl2 = true;
- break;
- case 0x6825:
- case 0x6827:
diff --git a/dump_stack-avoid-the-livelock-of-the-dump_lock.patch b/dump_stack-avoid-the-livelock-of-the-dump_lock.patch
deleted file mode 100644
index 4136ce2..0000000
--- a/dump_stack-avoid-the-livelock-of-the-dump_lock.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 5cbf2fff3bba8d3c6a4d47c1754de1cf57e2b01f Mon Sep 17 00:00:00 2001
-From: Kevin Hao <haokexin@gmail.com>
-Date: Tue, 5 Nov 2019 21:16:57 -0800
-Subject: dump_stack: avoid the livelock of the dump_lock
-
-From: Kevin Hao <haokexin@gmail.com>
-
-commit 5cbf2fff3bba8d3c6a4d47c1754de1cf57e2b01f upstream.
-
-In the current code, we use the atomic_cmpxchg() to serialize the output
-of the dump_stack(), but this implementation suffers the thundering herd
-problem. We have observed such kind of livelock on a Marvell cn96xx
-board(24 cpus) when heavily using the dump_stack() in a kprobe handler.
-Actually we can let the competitors to wait for the releasing of the
-lock before jumping to atomic_cmpxchg(). This will definitely mitigate
-the thundering herd problem. Thanks Linus for the suggestion.
-
-[akpm@linux-foundation.org: fix comment]
-Link: http://lkml.kernel.org/r/20191030031637.6025-1-haokexin@gmail.com
-Fixes: b58d977432c8 ("dump_stack: serialize the output from dump_stack()")
-Signed-off-by: Kevin Hao <haokexin@gmail.com>
-Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- lib/dump_stack.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
---- a/lib/dump_stack.c
-+++ b/lib/dump_stack.c
-@@ -44,7 +44,12 @@ retry:
- was_locked = 1;
- } else {
- local_irq_restore(flags);
-- cpu_relax();
-+ /*
-+ * Wait for the lock to release before jumping to
-+ * atomic_cmpxchg() in order to mitigate the thundering herd
-+ * problem.
-+ */
-+ do { cpu_relax(); } while (atomic_read(&dump_lock) != -1);
- goto retry;
- }
-
diff --git a/iio-imu-adis16480-make-sure-provided-frequency-is-positive.patch b/iio-imu-adis16480-make-sure-provided-frequency-is-positive.patch
deleted file mode 100644
index 1a23715..0000000
--- a/iio-imu-adis16480-make-sure-provided-frequency-is-positive.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 24e1eb5c0d78cfb9750b690bbe997d4d59170258 Mon Sep 17 00:00:00 2001
-From: Alexandru Ardelean <alexandru.ardelean@analog.com>
-Date: Tue, 8 Oct 2019 17:15:37 +0300
-Subject: iio: imu: adis16480: make sure provided frequency is positive
-
-From: Alexandru Ardelean <alexandru.ardelean@analog.com>
-
-commit 24e1eb5c0d78cfb9750b690bbe997d4d59170258 upstream.
-
-It could happen that either `val` or `val2` [provided from userspace] is
-negative. In that case the computed frequency could get a weird value.
-
-Fix this by checking that neither of the 2 variables is negative, and check
-that the computed result is not-zero.
-
-Fixes: e4f959390178 ("iio: imu: adis16480 switch sampling frequency attr to core support")
-Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
-Cc: <Stable@vger.kernel.org>
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/iio/imu/adis16480.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
---- a/drivers/iio/imu/adis16480.c
-+++ b/drivers/iio/imu/adis16480.c
-@@ -266,8 +266,11 @@ static int adis16480_set_freq(struct iio
- struct adis16480 *st = iio_priv(indio_dev);
- unsigned int t;
-
-+ if (val < 0 || val2 < 0)
-+ return -EINVAL;
-+
- t = val * 1000 + val2 / 1000;
-- if (t <= 0)
-+ if (t == 0)
- return -EINVAL;
-
- t = 2460000 / t;
diff --git a/ipvs-move-old_secure_tcp-into-struct-netns_ipvs.patch b/ipvs-move-old_secure_tcp-into-struct-netns_ipvs.patch
deleted file mode 100644
index 085cb86..0000000
--- a/ipvs-move-old_secure_tcp-into-struct-netns_ipvs.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 791fc670d94001fa4959a4e97435d8fc1a891d20 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 23 Oct 2019 09:53:03 -0700
-Subject: ipvs: move old_secure_tcp into struct netns_ipvs
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit c24b75e0f9239e78105f81c5f03a751641eb07ef ]
-
-syzbot reported the following issue :
-
-BUG: KCSAN: data-race in update_defense_level / update_defense_level
-
-read to 0xffffffff861a6260 of 4 bytes by task 3006 on cpu 1:
- update_defense_level+0x621/0xb30 net/netfilter/ipvs/ip_vs_ctl.c:177
- defense_work_handler+0x3d/0xd0 net/netfilter/ipvs/ip_vs_ctl.c:225
- process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
- worker_thread+0xa0/0x800 kernel/workqueue.c:2415
- kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
- ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
-
-write to 0xffffffff861a6260 of 4 bytes by task 7333 on cpu 0:
- update_defense_level+0xa62/0xb30 net/netfilter/ipvs/ip_vs_ctl.c:205
- defense_work_handler+0x3d/0xd0 net/netfilter/ipvs/ip_vs_ctl.c:225
- process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
- worker_thread+0xa0/0x800 kernel/workqueue.c:2415
- kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
- ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
-
-Reported by Kernel Concurrency Sanitizer on:
-CPU: 0 PID: 7333 Comm: kworker/0:5 Not tainted 5.4.0-rc3+ #0
-Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
-Workqueue: events defense_work_handler
-
-Indeed, old_secure_tcp is currently a static variable, while it
-needs to be a per netns variable.
-
-Fixes: a0840e2e165a ("IPVS: netns, ip_vs_ctl local vars moved to ipvs struct.")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Reported-by: syzbot <syzkaller@googlegroups.com>
-Signed-off-by: Simon Horman <horms@verge.net.au>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/ip_vs.h | 1 +
- net/netfilter/ipvs/ip_vs_ctl.c | 15 +++++++--------
- 2 files changed, 8 insertions(+), 8 deletions(-)
-
---- a/include/net/ip_vs.h
-+++ b/include/net/ip_vs.h
-@@ -887,6 +887,7 @@ struct netns_ipvs {
- struct delayed_work defense_work; /* Work handler */
- int drop_rate;
- int drop_counter;
-+ int old_secure_tcp;
- atomic_t dropentry;
- /* locks in ctl.c */
- spinlock_t dropentry_lock; /* drop entry handling */
---- a/net/netfilter/ipvs/ip_vs_ctl.c
-+++ b/net/netfilter/ipvs/ip_vs_ctl.c
-@@ -97,7 +97,6 @@ static bool __ip_vs_addr_is_local_v6(str
- static void update_defense_level(struct netns_ipvs *ipvs)
- {
- struct sysinfo i;
-- static int old_secure_tcp = 0;
- int availmem;
- int nomem;
- int to_change = -1;
-@@ -178,35 +177,35 @@ static void update_defense_level(struct
- spin_lock(&ipvs->securetcp_lock);
- switch (ipvs->sysctl_secure_tcp) {
- case 0:
-- if (old_secure_tcp >= 2)
-+ if (ipvs->old_secure_tcp >= 2)
- to_change = 0;
- break;
- case 1:
- if (nomem) {
-- if (old_secure_tcp < 2)
-+ if (ipvs->old_secure_tcp < 2)
- to_change = 1;
- ipvs->sysctl_secure_tcp = 2;
- } else {
-- if (old_secure_tcp >= 2)
-+ if (ipvs->old_secure_tcp >= 2)
- to_change = 0;
- }
- break;
- case 2:
- if (nomem) {
-- if (old_secure_tcp < 2)
-+ if (ipvs->old_secure_tcp < 2)
- to_change = 1;
- } else {
-- if (old_secure_tcp >= 2)
-+ if (ipvs->old_secure_tcp >= 2)
- to_change = 0;
- ipvs->sysctl_secure_tcp = 1;
- }
- break;
- case 3:
-- if (old_secure_tcp < 2)
-+ if (ipvs->old_secure_tcp < 2)
- to_change = 1;
- break;
- }
-- old_secure_tcp = ipvs->sysctl_secure_tcp;
-+ ipvs->old_secure_tcp = ipvs->sysctl_secure_tcp;
- if (to_change >= 0)
- ip_vs_protocol_timeout_change(ipvs,
- ipvs->sysctl_secure_tcp > 1);
diff --git a/mm-vmstat-hide-proc-pagetypeinfo-from-normal-users.patch b/mm-vmstat-hide-proc-pagetypeinfo-from-normal-users.patch
deleted file mode 100644
index 2b80ffc..0000000
--- a/mm-vmstat-hide-proc-pagetypeinfo-from-normal-users.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From abaed0112c1db08be15a784a2c5c8a8b3063cdd3 Mon Sep 17 00:00:00 2001
-From: Michal Hocko <mhocko@suse.com>
-Date: Tue, 5 Nov 2019 21:16:40 -0800
-Subject: mm, vmstat: hide /proc/pagetypeinfo from normal users
-
-From: Michal Hocko <mhocko@suse.com>
-
-commit abaed0112c1db08be15a784a2c5c8a8b3063cdd3 upstream.
-
-/proc/pagetypeinfo is a debugging tool to examine internal page
-allocator state wrt to fragmentation. It is not very useful for any
-other use so normal users really do not need to read this file.
-
-Waiman Long has noticed that reading this file can have negative side
-effects because zone->lock is necessary for gathering data and that a)
-interferes with the page allocator and its users and b) can lead to hard
-lockups on large machines which have very long free_list.
-
-Reduce both issues by simply not exporting the file to regular users.
-
-Link: http://lkml.kernel.org/r/20191025072610.18526-2-mhocko@kernel.org
-Fixes: 467c996c1e19 ("Print out statistics in relation to fragmentation avoidance to /proc/pagetypeinfo")
-Signed-off-by: Michal Hocko <mhocko@suse.com>
-Reported-by: Waiman Long <longman@redhat.com>
-Acked-by: Mel Gorman <mgorman@suse.de>
-Acked-by: Vlastimil Babka <vbabka@suse.cz>
-Acked-by: Waiman Long <longman@redhat.com>
-Acked-by: Rafael Aquini <aquini@redhat.com>
-Acked-by: David Rientjes <rientjes@google.com>
-Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
-Cc: David Hildenbrand <david@redhat.com>
-Cc: Johannes Weiner <hannes@cmpxchg.org>
-Cc: Roman Gushchin <guro@fb.com>
-Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
-Cc: Jann Horn <jannh@google.com>
-Cc: Song Liu <songliubraving@fb.com>
-Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- mm/vmstat.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/mm/vmstat.c
-+++ b/mm/vmstat.c
-@@ -1444,7 +1444,7 @@ static int __init setup_vmstat(void)
- #endif
- #ifdef CONFIG_PROC_FS
- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
-- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
-+ proc_create("pagetypeinfo", 0400, NULL, &pagetypeinfo_file_ops);
- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
- #endif
diff --git a/net-fix-data-race-in-neigh_event_send.patch b/net-fix-data-race-in-neigh_event_send.patch
deleted file mode 100644
index eb83021..0000000
--- a/net-fix-data-race-in-neigh_event_send.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From foo@baz Sun 10 Nov 2019 06:59:26 PM CET
-From: Eric Dumazet <edumazet@google.com>
-Date: Thu, 7 Nov 2019 20:08:19 -0800
-Subject: net: fix data-race in neigh_event_send()
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 1b53d64435d56902fc234ff2507142d971a09687 ]
-
-KCSAN reported the following data-race [1]
-
-The fix will also prevent the compiler from optimizing out
-the condition.
-
-[1]
-
-BUG: KCSAN: data-race in neigh_resolve_output / neigh_resolve_output
-
-write to 0xffff8880a41dba78 of 8 bytes by interrupt on cpu 1:
- neigh_event_send include/net/neighbour.h:443 [inline]
- neigh_resolve_output+0x78/0x480 net/core/neighbour.c:1474
- neigh_output include/net/neighbour.h:511 [inline]
- ip_finish_output2+0x4af/0xe40 net/ipv4/ip_output.c:228
- __ip_finish_output net/ipv4/ip_output.c:308 [inline]
- __ip_finish_output+0x23a/0x490 net/ipv4/ip_output.c:290
- ip_finish_output+0x41/0x160 net/ipv4/ip_output.c:318
- NF_HOOK_COND include/linux/netfilter.h:294 [inline]
- ip_output+0xdf/0x210 net/ipv4/ip_output.c:432
- dst_output include/net/dst.h:436 [inline]
- ip_local_out+0x74/0x90 net/ipv4/ip_output.c:125
- __ip_queue_xmit+0x3a8/0xa40 net/ipv4/ip_output.c:532
- ip_queue_xmit+0x45/0x60 include/net/ip.h:237
- __tcp_transmit_skb+0xe81/0x1d60 net/ipv4/tcp_output.c:1169
- tcp_transmit_skb net/ipv4/tcp_output.c:1185 [inline]
- __tcp_retransmit_skb+0x4bd/0x15f0 net/ipv4/tcp_output.c:2976
- tcp_retransmit_skb+0x36/0x1a0 net/ipv4/tcp_output.c:2999
- tcp_retransmit_timer+0x719/0x16d0 net/ipv4/tcp_timer.c:515
- tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:598
- tcp_write_timer+0xd1/0xf0 net/ipv4/tcp_timer.c:618
-
-read to 0xffff8880a41dba78 of 8 bytes by interrupt on cpu 0:
- neigh_event_send include/net/neighbour.h:442 [inline]
- neigh_resolve_output+0x57/0x480 net/core/neighbour.c:1474
- neigh_output include/net/neighbour.h:511 [inline]
- ip_finish_output2+0x4af/0xe40 net/ipv4/ip_output.c:228
- __ip_finish_output net/ipv4/ip_output.c:308 [inline]
- __ip_finish_output+0x23a/0x490 net/ipv4/ip_output.c:290
- ip_finish_output+0x41/0x160 net/ipv4/ip_output.c:318
- NF_HOOK_COND include/linux/netfilter.h:294 [inline]
- ip_output+0xdf/0x210 net/ipv4/ip_output.c:432
- dst_output include/net/dst.h:436 [inline]
- ip_local_out+0x74/0x90 net/ipv4/ip_output.c:125
- __ip_queue_xmit+0x3a8/0xa40 net/ipv4/ip_output.c:532
- ip_queue_xmit+0x45/0x60 include/net/ip.h:237
- __tcp_transmit_skb+0xe81/0x1d60 net/ipv4/tcp_output.c:1169
- tcp_transmit_skb net/ipv4/tcp_output.c:1185 [inline]
- __tcp_retransmit_skb+0x4bd/0x15f0 net/ipv4/tcp_output.c:2976
- tcp_retransmit_skb+0x36/0x1a0 net/ipv4/tcp_output.c:2999
- tcp_retransmit_timer+0x719/0x16d0 net/ipv4/tcp_timer.c:515
- tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:598
-
-Reported by Kernel Concurrency Sanitizer on:
-CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-rc3+ #0
-Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
-
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Reported-by: syzbot <syzkaller@googlegroups.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/net/neighbour.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/include/net/neighbour.h
-+++ b/include/net/neighbour.h
-@@ -366,8 +366,8 @@ static inline int neigh_event_send(struc
- {
- unsigned long now = jiffies;
-
-- if (neigh->used != now)
-- neigh->used = now;
-+ if (READ_ONCE(neigh->used) != now)
-+ WRITE_ONCE(neigh->used, now);
- if (!(neigh->nud_state&(NUD_CONNECTED|NUD_DELAY|NUD_PROBE)))
- return __neigh_event_send(neigh, skb);
- return 0;
diff --git a/netfilter-ipset-fix-an-error-code-in-ip_set_sockfn_get.patch b/netfilter-ipset-fix-an-error-code-in-ip_set_sockfn_get.patch
deleted file mode 100644
index 157d819..0000000
--- a/netfilter-ipset-fix-an-error-code-in-ip_set_sockfn_get.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 30b7244d79651460ff114ba8f7987ed94c86b99a Mon Sep 17 00:00:00 2001
-From: Dan Carpenter <dan.carpenter@oracle.com>
-Date: Sat, 24 Aug 2019 17:49:55 +0300
-Subject: netfilter: ipset: Fix an error code in ip_set_sockfn_get()
-
-From: Dan Carpenter <dan.carpenter@oracle.com>
-
-commit 30b7244d79651460ff114ba8f7987ed94c86b99a upstream.
-
-The copy_to_user() function returns the number of bytes remaining to be
-copied. In this code, that positive return is checked at the end of the
-function and we return zero/success. What we should do instead is
-return -EFAULT.
-
-Fixes: a7b4f989a629 ("netfilter: ipset: IP set core support")
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- net/netfilter/ipset/ip_set_core.c | 8 +++++---
- 1 file changed, 5 insertions(+), 3 deletions(-)
-
---- a/net/netfilter/ipset/ip_set_core.c
-+++ b/net/netfilter/ipset/ip_set_core.c
-@@ -1885,8 +1885,9 @@ ip_set_sockfn_get(struct sock *sk, int o
- }
-
- req_version->version = IPSET_PROTOCOL;
-- ret = copy_to_user(user, req_version,
-- sizeof(struct ip_set_req_version));
-+ if (copy_to_user(user, req_version,
-+ sizeof(struct ip_set_req_version)))
-+ ret = -EFAULT;
- goto done;
- }
- case IP_SET_OP_GET_BYNAME: {
-@@ -1943,7 +1944,8 @@ ip_set_sockfn_get(struct sock *sk, int o
- } /* end of switch(op) */
-
- copy:
-- ret = copy_to_user(user, data, copylen);
-+ if (copy_to_user(user, data, copylen))
-+ ret = -EFAULT;
-
- done:
- vfree(data);
diff --git a/netfilter-nf_tables-align-nft_expr-private-data-to-64-bit.patch b/netfilter-nf_tables-align-nft_expr-private-data-to-64-bit.patch
deleted file mode 100644
index 8545e5b..0000000
--- a/netfilter-nf_tables-align-nft_expr-private-data-to-64-bit.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 250367c59e6ba0d79d702a059712d66edacd4a1a Mon Sep 17 00:00:00 2001
-From: Lukas Wunner <lukas@wunner.de>
-Date: Thu, 31 Oct 2019 11:06:24 +0100
-Subject: netfilter: nf_tables: Align nft_expr private data to 64-bit
-
-From: Lukas Wunner <lukas@wunner.de>
-
-commit 250367c59e6ba0d79d702a059712d66edacd4a1a upstream.
-
-Invoking the following commands on a 32-bit architecture with strict
-alignment requirements (such as an ARMv7-based Raspberry Pi) results
-in an alignment exception:
-
- # nft add table ip test-ip4
- # nft add chain ip test-ip4 output { type filter hook output priority 0; }
- # nft add rule ip test-ip4 output quota 1025 bytes
-
-Alignment trap: not handling instruction e1b26f9f at [<7f4473f8>]
-Unhandled fault: alignment exception (0x001) at 0xb832e824
-Internal error: : 1 [#1] PREEMPT SMP ARM
-Hardware name: BCM2835
-[<7f4473fc>] (nft_quota_do_init [nft_quota])
-[<7f447448>] (nft_quota_init [nft_quota])
-[<7f4260d0>] (nf_tables_newrule [nf_tables])
-[<7f4168dc>] (nfnetlink_rcv_batch [nfnetlink])
-[<7f416bd0>] (nfnetlink_rcv [nfnetlink])
-[<8078b334>] (netlink_unicast)
-[<8078b664>] (netlink_sendmsg)
-[<8071b47c>] (sock_sendmsg)
-[<8071bd18>] (___sys_sendmsg)
-[<8071ce3c>] (__sys_sendmsg)
-[<8071ce94>] (sys_sendmsg)
-
-The reason is that nft_quota_do_init() calls atomic64_set() on an
-atomic64_t which is only aligned to 32-bit, not 64-bit, because it
-succeeds struct nft_expr in memory which only contains a 32-bit pointer.
-Fix by aligning the nft_expr private data to 64-bit.
-
-Fixes: 96518518cc41 ("netfilter: add nftables")
-Signed-off-by: Lukas Wunner <lukas@wunner.de>
-Cc: stable@vger.kernel.org # v3.13+
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- include/net/netfilter/nf_tables.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -365,7 +365,8 @@ struct nft_expr_ops {
- */
- struct nft_expr {
- const struct nft_expr_ops *ops;
-- unsigned char data[];
-+ unsigned char data[]
-+ __attribute__((aligned(__alignof__(u64))));
- };
-
- static inline void *nft_expr_priv(const struct nft_expr *expr)
diff --git a/nfc-netlink-fix-double-device-reference-drop.patch b/nfc-netlink-fix-double-device-reference-drop.patch
deleted file mode 100644
index f369f44..0000000
--- a/nfc-netlink-fix-double-device-reference-drop.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From foo@baz Sun 10 Nov 2019 06:53:36 PM CET
-From: Pan Bian <bianpan2016@163.com>
-Date: Thu, 7 Nov 2019 14:29:50 +0800
-Subject: nfc: netlink: fix double device reference drop
-
-From: Pan Bian <bianpan2016@163.com>
-
-[ Upstream commit 025ec40b81d785a98f76b8bdb509ac10773b4f12 ]
-
-The function nfc_put_device(dev) is called twice to drop the reference
-to dev when there is no associated local llcp. Remove one of them to fix
-the bug.
-
-Fixes: 52feb444a903 ("NFC: Extend netlink interface for LTO, RW, and MIUX parameters support")
-Fixes: d9b8d8e19b07 ("NFC: llcp: Service Name Lookup netlink interface")
-Signed-off-by: Pan Bian <bianpan2016@163.com>
-Reviewed-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/nfc/netlink.c | 2 --
- 1 file changed, 2 deletions(-)
-
---- a/net/nfc/netlink.c
-+++ b/net/nfc/netlink.c
-@@ -982,7 +982,6 @@ static int nfc_genl_llc_set_params(struc
-
- local = nfc_llcp_find_local(dev);
- if (!local) {
-- nfc_put_device(dev);
- rc = -ENODEV;
- goto exit;
- }
-@@ -1044,7 +1043,6 @@ static int nfc_genl_llc_sdreq(struct sk_
-
- local = nfc_llcp_find_local(dev);
- if (!local) {
-- nfc_put_device(dev);
- rc = -ENODEV;
- goto exit;
- }
diff --git a/pci-tegra-enable-relaxed-ordering-only-for-tegra20-tegra30.patch b/pci-tegra-enable-relaxed-ordering-only-for-tegra20-tegra30.patch
deleted file mode 100644
index 2d7dee4..0000000
--- a/pci-tegra-enable-relaxed-ordering-only-for-tegra20-tegra30.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 7be142caabc4780b13a522c485abc806de5c4114 Mon Sep 17 00:00:00 2001
-From: Vidya Sagar <vidyas@nvidia.com>
-Date: Thu, 4 Jul 2019 20:34:28 +0530
-Subject: PCI: tegra: Enable Relaxed Ordering only for Tegra20 & Tegra30
-
-From: Vidya Sagar <vidyas@nvidia.com>
-
-commit 7be142caabc4780b13a522c485abc806de5c4114 upstream.
-
-The PCI Tegra controller conversion to a device tree configurable
-driver in commit d1523b52bff3 ("PCI: tegra: Move PCIe driver
-to drivers/pci/host") implied that code for the driver can be
-compiled in for a kernel supporting multiple platforms.
-
-Unfortunately, a blind move of the code did not check that some of the
-quirks that were applied in arch/arm (eg enabling Relaxed Ordering on
-all PCI devices - since the quirk hook erroneously matches PCI_ANY_ID
-for both Vendor-ID and Device-ID) are now applied in all kernels that
-compile the PCI Tegra controlled driver, DT and ACPI alike.
-
-This is completely wrong, in that enablement of Relaxed Ordering is only
-required by default in Tegra20 platforms as described in the Tegra20
-Technical Reference Manual (available at
-https://developer.nvidia.com/embedded/downloads#?search=tegra%202 in
-Section 34.1, where it is mentioned that Relaxed Ordering bit needs to
-be enabled in its root ports to avoid deadlock in hardware) and in the
-Tegra30 platforms for the same reasons (unfortunately not documented
-in the TRM).
-
-There is no other strict requirement on PCI devices Relaxed Ordering
-enablement on any other Tegra platforms or PCI host bridge driver.
-
-Fix this quite upsetting situation by limiting the vendor and device IDs
-to which the Relaxed Ordering quirk applies to the root ports in
-question, reported above.
-
-Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
-[lorenzo.pieralisi@arm.com: completely rewrote the commit log/fixes tag]
-Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
-Acked-by: Thierry Reding <treding@nvidia.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/pci/host/pci-tegra.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
---- a/drivers/pci/host/pci-tegra.c
-+++ b/drivers/pci/host/pci-tegra.c
-@@ -648,12 +648,15 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NV
- DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA, 0x0e1c, tegra_pcie_fixup_class);
- DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA, 0x0e1d, tegra_pcie_fixup_class);
-
--/* Tegra PCIE requires relaxed ordering */
-+/* Tegra20 and Tegra30 PCIE requires relaxed ordering */
- static void tegra_pcie_relax_enable(struct pci_dev *dev)
- {
- pcie_capability_set_word(dev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_RELAX_EN);
- }
--DECLARE_PCI_FIXUP_FINAL(PCI_ANY_ID, PCI_ANY_ID, tegra_pcie_relax_enable);
-+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0bf0, tegra_pcie_relax_enable);
-+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0bf1, tegra_pcie_relax_enable);
-+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0e1c, tegra_pcie_relax_enable);
-+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0e1d, tegra_pcie_relax_enable);
-
- static int tegra_pcie_setup(int nr, struct pci_sys_data *sys)
- {
diff --git a/perf-tools-fix-time-sorting.patch b/perf-tools-fix-time-sorting.patch
deleted file mode 100644
index 2ab59da..0000000
--- a/perf-tools-fix-time-sorting.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 722ddfde366fd46205456a9c5ff9b3359dc9a75e Mon Sep 17 00:00:00 2001
-From: Jiri Olsa <jolsa@kernel.org>
-Date: Tue, 5 Nov 2019 00:27:11 +0100
-Subject: perf tools: Fix time sorting
-
-From: Jiri Olsa <jolsa@kernel.org>
-
-commit 722ddfde366fd46205456a9c5ff9b3359dc9a75e upstream.
-
-The final sort might get confused when the comparison is done over
-bigger numbers than int like for -s time.
-
-Check the following report for longer workloads:
-
- $ perf report -s time -F time,overhead --stdio
-
-Fix hist_entry__sort() to properly return int64_t and not possible cut
-int.
-
-Fixes: 043ca389a318 ("perf tools: Use hpp formats to sort final output")
-Signed-off-by: Jiri Olsa <jolsa@kernel.org>
-Reviewed-by: Andi Kleen <ak@linux.intel.com>
-Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
-Cc: Michael Petlan <mpetlan@redhat.com>
-Cc: Namhyung Kim <namhyung@kernel.org>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Cc: stable@vger.kernel.org # v3.16+
-Link: http://lore.kernel.org/lkml/20191104232711.16055-1-jolsa@kernel.org
-Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- tools/perf/util/hist.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/tools/perf/util/hist.c
-+++ b/tools/perf/util/hist.c
-@@ -1050,7 +1050,7 @@ void hists__collapse_resort(struct hists
- }
- }
-
--static int hist_entry__sort(struct hist_entry *a, struct hist_entry *b)
-+static int64_t hist_entry__sort(struct hist_entry *a, struct hist_entry *b)
- {
- struct perf_hpp_fmt *fmt;
- int64_t cmp = 0;
diff --git a/scsi-lpfc-honor-module-parameter-lpfc_use_adisc.patch b/scsi-lpfc-honor-module-parameter-lpfc_use_adisc.patch
deleted file mode 100644
index 0d7d382..0000000
--- a/scsi-lpfc-honor-module-parameter-lpfc_use_adisc.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 21d8c8bdfcf19dd4037b0e175f98c7ff28ac6f40 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 22 Oct 2019 09:21:12 +0200
-Subject: scsi: lpfc: Honor module parameter lpfc_use_adisc
-
-From: Daniel Wagner <dwagner@suse.de>
-
-[ Upstream commit 0fd103ccfe6a06e40e2d9d8c91d96332cc9e1239 ]
-
-The initial lpfc_desc_set_adisc implementation in commit
-dea3101e0a5c ("lpfc: add Emulex FC driver version 8.0.28") enabled ADISC if
-
- cfg_use_adisc && RSCN_MODE && FCP_2_DEVICE
-
-In commit 92d7f7b0cde3 ("[SCSI] lpfc: NPIV: add NPIV support on top of
-SLI-3") this changed to
-
- (cfg_use_adisc && RSC_MODE) || FCP_2_DEVICE
-
-and later in commit ffc954936b13 ("[SCSI] lpfc 8.3.13: FC Discovery Fixes
-and enhancements.") to
-
- (cfg_use_adisc && RSC_MODE) || (FCP_2_DEVICE && FCP_TARGET)
-
-A customer reports that after a devloss, an ADISC failure is logged. It
-turns out the ADISC flag is set even the user explicitly set lpfc_use_adisc
-= 0.
-
-[Sat Dec 22 22:55:58 2018] lpfc 0000:82:00.0: 2:(0):0203 Devloss timeout on WWPN 50:01:43:80:12:8e:40:20 NPort x05df00 Data: x82000000 x8 xa
-[Sat Dec 22 23:08:20 2018] lpfc 0000:82:00.0: 2:(0):2755 ADISC failure DID:05DF00 Status:x9/x70000
-
-[mkp: fixed Hannes' email]
-
-Fixes: 92d7f7b0cde3 ("[SCSI] lpfc: NPIV: add NPIV support on top of SLI-3")
-Cc: Dick Kennedy <dick.kennedy@broadcom.com>
-Cc: James Smart <james.smart@broadcom.com>
-Link: https://lore.kernel.org/r/20191022072112.132268-1-dwagner@suse.de
-Reviewed-by: Hannes Reinecke <hare@suse.de>
-Reviewed-by: James Smart <james.smart@broadcom.com>
-Signed-off-by: Daniel Wagner <dwagner@suse.de>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/lpfc/lpfc_nportdisc.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/scsi/lpfc/lpfc_nportdisc.c
-+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
-@@ -742,9 +742,9 @@ lpfc_disc_set_adisc(struct lpfc_vport *v
-
- if (!(vport->fc_flag & FC_PT2PT)) {
- /* Check config parameter use-adisc or FCP-2 */
-- if ((vport->cfg_use_adisc && (vport->fc_flag & FC_RSCN_MODE)) ||
-+ if (vport->cfg_use_adisc && ((vport->fc_flag & FC_RSCN_MODE) ||
- ((ndlp->nlp_fcp_info & NLP_FCP_2_DEVICE) &&
-- (ndlp->nlp_type & NLP_FCP_TARGET))) {
-+ (ndlp->nlp_type & NLP_FCP_TARGET)))) {
- spin_lock_irq(shost->host_lock);
- ndlp->nlp_flag |= NLP_NPR_ADISC;
- spin_unlock_irq(shost->host_lock);
diff --git a/scsi-qla2xxx-fixup-incorrect-usage-of-host_byte.patch b/scsi-qla2xxx-fixup-incorrect-usage-of-host_byte.patch
deleted file mode 100644
index dae78ee..0000000
--- a/scsi-qla2xxx-fixup-incorrect-usage-of-host_byte.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 0cadf480ca11712c0ec89b4fc80d832007fdf1a2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 18 Oct 2019 16:04:58 +0200
-Subject: scsi: qla2xxx: fixup incorrect usage of host_byte
-
-From: Hannes Reinecke <hare@suse.com>
-
-[ Upstream commit 66cf50e65b183c863825f5c28a818e3f47a72e40 ]
-
-DRIVER_ERROR is a a driver byte setting, not a host byte. The qla2xxx
-driver should rather return DID_ERROR here to be in line with the other
-drivers.
-
-Link: https://lore.kernel.org/r/20191018140458.108278-1-hare@suse.de
-Signed-off-by: Hannes Reinecke <hare@suse.com>
-Acked-by: Himanshu Madhani <hmadhani@marvell.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/qla2xxx/qla_bsg.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
---- a/drivers/scsi/qla2xxx/qla_bsg.c
-+++ b/drivers/scsi/qla2xxx/qla_bsg.c
-@@ -252,7 +252,7 @@ qla2x00_process_els(struct fc_bsg_job *b
- srb_t *sp;
- const char *type;
- int req_sg_cnt, rsp_sg_cnt;
-- int rval = (DRIVER_ERROR << 16);
-+ int rval = (DID_ERROR << 16);
- uint16_t nextlid = 0;
-
- if (bsg_job->request->msgcode == FC_BSG_RPT_ELS) {
-@@ -426,7 +426,7 @@ qla2x00_process_ct(struct fc_bsg_job *bs
- struct Scsi_Host *host = bsg_job->shost;
- scsi_qla_host_t *vha = shost_priv(host);
- struct qla_hw_data *ha = vha->hw;
-- int rval = (DRIVER_ERROR << 16);
-+ int rval = (DID_ERROR << 16);
- int req_sg_cnt, rsp_sg_cnt;
- uint16_t loop_id;
- struct fc_port *fcport;
-@@ -1913,7 +1913,7 @@ qlafx00_mgmt_cmd(struct fc_bsg_job *bsg_
- struct Scsi_Host *host = bsg_job->shost;
- scsi_qla_host_t *vha = shost_priv(host);
- struct qla_hw_data *ha = vha->hw;
-- int rval = (DRIVER_ERROR << 16);
-+ int rval = (DID_ERROR << 16);
- struct qla_mt_iocb_rqst_fx00 *piocb_rqst;
- srb_t *sp;
- int req_sg_cnt = 0, rsp_sg_cnt = 0;
diff --git a/scsi-qla2xxx-stop-timer-in-shutdown-path.patch b/scsi-qla2xxx-stop-timer-in-shutdown-path.patch
deleted file mode 100644
index 2017837..0000000
--- a/scsi-qla2xxx-stop-timer-in-shutdown-path.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 17a96338d8fdd1172bb6031efe8e11dadcca08b4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 24 Oct 2019 16:38:04 +1000
-Subject: scsi: qla2xxx: stop timer in shutdown path
-
-From: Nicholas Piggin <npiggin@gmail.com>
-
-[ Upstream commit d3566abb1a1e7772116e4d50fb6a58d19c9802e5 ]
-
-In shutdown/reboot paths, the timer is not stopped:
-
- qla2x00_shutdown
- pci_device_shutdown
- device_shutdown
- kernel_restart_prepare
- kernel_restart
- sys_reboot
-
-This causes lockups (on powerpc) when firmware config space access calls
-are interrupted by smp_send_stop later in reboot.
-
-Fixes: e30d1756480dc ("[SCSI] qla2xxx: Addition of shutdown callback handler.")
-Link: https://lore.kernel.org/r/20191024063804.14538-1-npiggin@gmail.com
-Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
-Acked-by: Himanshu Madhani <hmadhani@marvell.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/qla2xxx/qla_os.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/drivers/scsi/qla2xxx/qla_os.c
-+++ b/drivers/scsi/qla2xxx/qla_os.c
-@@ -3037,6 +3037,10 @@ qla2x00_shutdown(struct pci_dev *pdev)
- /* Stop currently executing firmware. */
- qla2x00_try_to_stop_firmware(vha);
-
-+ /* Disable timer */
-+ if (vha->timer_active)
-+ qla2x00_stop_timer(vha);
-+
- /* Turn adapter off line */
- vha->flags.online = 0;
-
diff --git a/series b/series
index c3a603d..e69de29 100644
--- a/series
+++ b/series
@@ -1,29 +0,0 @@
-cdc-ncm-handle-incomplete-transfer-of-mtu.patch
-net-fix-data-race-in-neigh_event_send.patch
-nfc-netlink-fix-double-device-reference-drop.patch
-alsa-bebob-fix-to-detect-configured-source-of-sampling-clock-for-focusrite-saffire-pro-i-o-series.patch
-alsa-hda-ca0132-fix-possible-workqueue-stall.patch
-mm-vmstat-hide-proc-pagetypeinfo-from-normal-users.patch
-dump_stack-avoid-the-livelock-of-the-dump_lock.patch
-perf-tools-fix-time-sorting.patch
-drm-radeon-fix-si_enable_smc_cac-failed-issue.patch
-ceph-fix-use-after-free-in-__ceph_remove_cap.patch
-iio-imu-adis16480-make-sure-provided-frequency-is-positive.patch
-netfilter-nf_tables-align-nft_expr-private-data-to-64-bit.patch
-netfilter-ipset-fix-an-error-code-in-ip_set_sockfn_get.patch
-can-usb_8dev-fix-use-after-free-on-disconnect.patch
-can-c_can-c_can_poll-only-read-status-register-after-status-irq.patch
-can-peak_usb-fix-a-potential-out-of-sync-while-decoding-packets.patch
-can-gs_usb-gs_can_open-prevent-memory-leak.patch
-can-peak_usb-fix-slab-info-leak.patch
-drivers-usb-usbip-add-missing-break-statement-to-switch.patch
-pci-tegra-enable-relaxed-ordering-only-for-tegra20-tegra30.patch
-bonding-fix-unexpected-iff_bonding-bit-unset.patch
-scsi-qla2xxx-fixup-incorrect-usage-of-host_byte.patch
-scsi-lpfc-honor-module-parameter-lpfc_use_adisc.patch
-ipvs-move-old_secure_tcp-into-struct-netns_ipvs.patch
-usb-fsl-check-memory-resource-before-releasing-it.patch
-usb-gadget-udc-atmel-fix-interrupt-storm-in-fifo-mod.patch
-usb-skip-endpoints-with-0-maxpacket-length.patch
-scsi-qla2xxx-stop-timer-in-shutdown-path.patch
-can-flexcan-disable-completely-the-ecc-mechanism.patch
diff --git a/usb-fsl-check-memory-resource-before-releasing-it.patch b/usb-fsl-check-memory-resource-before-releasing-it.patch
deleted file mode 100644
index 4d1e570..0000000
--- a/usb-fsl-check-memory-resource-before-releasing-it.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From b87c9a744cf51c8bf368ce751d701135f349b864 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 21 Oct 2019 18:21:51 +0800
-Subject: usb: fsl: Check memory resource before releasing it
-
-From: Nikhil Badola <nikhil.badola@freescale.com>
-
-[ Upstream commit bc1e3a2dd0c9954fd956ac43ca2876bbea018c01 ]
-
-Check memory resource existence before releasing it to avoid NULL
-pointer dereference
-
-Signed-off-by: Nikhil Badola <nikhil.badola@freescale.com>
-Reviewed-by: Ran Wang <ran.wang_1@nxp.com>
-Reviewed-by: Peter Chen <peter.chen@nxp.com>
-Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/gadget/udc/fsl_udc_core.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/usb/gadget/udc/fsl_udc_core.c
-+++ b/drivers/usb/gadget/udc/fsl_udc_core.c
-@@ -2549,7 +2549,7 @@ static int __exit fsl_udc_remove(struct
- dma_pool_destroy(udc_controller->td_pool);
- free_irq(udc_controller->irq, udc_controller);
- iounmap(dr_regs);
-- if (pdata->operating_mode == FSL_USB2_DR_DEVICE)
-+ if (res && (pdata->operating_mode == FSL_USB2_DR_DEVICE))
- release_mem_region(res->start, resource_size(res));
-
- /* free udc --wait for the release() finished */
diff --git a/usb-gadget-udc-atmel-fix-interrupt-storm-in-fifo-mod.patch b/usb-gadget-udc-atmel-fix-interrupt-storm-in-fifo-mod.patch
deleted file mode 100644
index d9b7bb4..0000000
--- a/usb-gadget-udc-atmel-fix-interrupt-storm-in-fifo-mod.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From bc481a700642658e03b245ed862a3fca126b7ae1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 4 Oct 2019 20:10:54 +0300
-Subject: usb: gadget: udc: atmel: Fix interrupt storm in FIFO mode.
-
-From: Cristian Birsan <cristian.birsan@microchip.com>
-
-[ Upstream commit ba3a1a915c49cc3023e4ddfc88f21e7514e82aa4 ]
-
-Fix interrupt storm generated by endpoints when working in FIFO mode.
-The TX_COMPLETE interrupt is used only by control endpoints processing.
-Do not enable it for other types of endpoints.
-
-Fixes: 914a3f3b3754 ("USB: add atmel_usba_udc driver")
-Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
-Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/gadget/udc/atmel_usba_udc.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
---- a/drivers/usb/gadget/udc/atmel_usba_udc.c
-+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
-@@ -392,9 +392,11 @@ static void submit_request(struct usba_e
- next_fifo_transaction(ep, req);
- if (req->last_transaction) {
- usba_ep_writel(ep, CTL_DIS, USBA_TX_PK_RDY);
-- usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE);
-+ if (ep_is_control(ep))
-+ usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE);
- } else {
-- usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE);
-+ if (ep_is_control(ep))
-+ usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE);
- usba_ep_writel(ep, CTL_ENB, USBA_TX_PK_RDY);
- }
- }
diff --git a/usb-skip-endpoints-with-0-maxpacket-length.patch b/usb-skip-endpoints-with-0-maxpacket-length.patch
deleted file mode 100644
index 02be8c9..0000000
--- a/usb-skip-endpoints-with-0-maxpacket-length.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 9489ccf362fe6f27abbcea7b4bea50f1d907e391 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 28 Oct 2019 10:52:35 -0400
-Subject: USB: Skip endpoints with 0 maxpacket length
-
-From: Alan Stern <stern@rowland.harvard.edu>
-
-[ Upstream commit d482c7bb0541d19dea8bff437a9f3c5563b5b2d2 ]
-
-Endpoints with a maxpacket length of 0 are probably useless. They
-can't transfer any data, and it's not at all unlikely that an HCD will
-crash or hang when trying to handle an URB for such an endpoint.
-
-Currently the USB core does not check for endpoints having a maxpacket
-value of 0. This patch adds a check, printing a warning and skipping
-over any endpoints it catches.
-
-Now, the USB spec does not rule out endpoints having maxpacket = 0.
-But since they wouldn't have any practical use, there doesn't seem to
-be any good reason for us to accept them.
-
-Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
-
-Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1910281050420.1485-100000@iolanthe.rowland.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/core/config.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/drivers/usb/core/config.c
-+++ b/drivers/usb/core/config.c
-@@ -257,6 +257,12 @@ static int usb_parse_endpoint(struct dev
- endpoint->desc.bInterval = n;
- }
-
-+ if (usb_endpoint_maxp(&endpoint->desc) == 0) {
-+ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n",
-+ cfgno, inum, asnum, d->bEndpointAddress);
-+ goto skip_to_next_endpoint_or_interface_descriptor;
-+ }
-+
- /* Some buggy low-speed devices have Bulk endpoints, which is
- * explicitly forbidden by the USB spec. In an attempt to make
- * them usable, we will try treating them as Interrupt endpoints.