fixes: add fixes for fixes commits

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>

3 files changed, 102 insertions, 0 deletions

diff --git a/queue/Bluetooth-BT_HCIUART-now-depends-on-SERIAL_DEV_BUS.patch b/queue/Bluetooth-BT_HCIUART-now-depends-on-SERIAL_DEV_BUS.patch
new file mode 100644
index 0000000..06f8023
--- /dev/null
+++ b/queue/Bluetooth-BT_HCIUART-now-depends-on-SERIAL_DEV_BUS.patch
@@ -0,0 +1,44 @@
+From 05e89fb576f580ac95e7a5d00bdb34830b09671a Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 11 Oct 2017 15:47:54 +0200
+Subject: [PATCH] Bluetooth: BT_HCIUART now depends on SERIAL_DEV_BUS
+
+commit 05e89fb576f580ac95e7a5d00bdb34830b09671a upstream.
+
+It is no longer possible to build BT_HCIUART into the kernel
+when SERIAL_DEV_BUS is a loadable module, even if none of the
+SERIAL_DEV_BUS based implementations are selected:
+
+drivers/bluetooth/hci_ldisc.o: In function `hci_uart_set_flow_control':
+hci_ldisc.c:(.text+0xb40): undefined reference to `serdev_device_set_flow_control'
+hci_ldisc.c:(.text+0xb5c): undefined reference to `serdev_device_set_tiocm'
+
+This adds a dependency to avoid the broken configuration.
+
+Fixes: 7841d554809b ("Bluetooth: hci_uart_set_flow_control: Fix NULL deref when using serdev")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+
+diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
+index 082e1c7329de..6475f8c0d3b2 100644
+--- a/drivers/bluetooth/Kconfig
++++ b/drivers/bluetooth/Kconfig
+@@ -65,6 +65,7 @@ config BT_HCIBTSDIO
+ 
+ config BT_HCIUART
+ 	tristate "HCI UART driver"
++	depends on SERIAL_DEV_BUS || !SERIAL_DEV_BUS
+ 	depends on TTY
+ 	help
+ 	  Bluetooth HCI UART driver.
+@@ -79,7 +80,6 @@ config BT_HCIUART
+ config BT_HCIUART_SERDEV
+ 	bool
+ 	depends on SERIAL_DEV_BUS && BT_HCIUART
+-	depends on SERIAL_DEV_BUS=y || SERIAL_DEV_BUS=BT_HCIUART
+ 	default y
+ 
+ config BT_HCIUART_H4
+-- 
+2.15.0
+
diff --git a/queue/IB-rxe-put-the-pool-on-allocation-failure.patch b/queue/IB-rxe-put-the-pool-on-allocation-failure.patch
new file mode 100644
index 0000000..087e482
--- /dev/null
+++ b/queue/IB-rxe-put-the-pool-on-allocation-failure.patch
@@ -0,0 +1,56 @@
+From 6b9f8970cd30929cb6b372fa44fa66da9e59c650 Mon Sep 17 00:00:00 2001
+From: Doug Ledford <dledford@redhat.com>
+Date: Mon, 9 Oct 2017 09:11:32 -0400
+Subject: [PATCH] IB/rxe: put the pool on allocation failure
+
+commit 6b9f8970cd30929cb6b372fa44fa66da9e59c650 upstream.
+
+If the allocation of elem fails, it is not sufficient to simply check
+for NULL and return.  We need to also put our reference on the pool or
+else we will leave the pool with a permanent ref count and we will never
+be able to free it.
+
+Fixes: 4831ca9e4a8e ("IB/rxe: check for allocation failure on elem")
+Suggested-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c
+index 3b4916680018..b4a8acc7bb7d 100644
+--- a/drivers/infiniband/sw/rxe/rxe_pool.c
++++ b/drivers/infiniband/sw/rxe/rxe_pool.c
+@@ -394,23 +394,25 @@ void *rxe_alloc(struct rxe_pool *pool)
+ 
+ 	kref_get(&pool->rxe->ref_cnt);
+ 
+-	if (atomic_inc_return(&pool->num_elem) > pool->max_elem) {
+-		atomic_dec(&pool->num_elem);
+-		rxe_dev_put(pool->rxe);
+-		rxe_pool_put(pool);
+-		return NULL;
+-	}
++	if (atomic_inc_return(&pool->num_elem) > pool->max_elem)
++		goto out_put_pool;
+ 
+ 	elem = kmem_cache_zalloc(pool_cache(pool),
+ 				 (pool->flags & RXE_POOL_ATOMIC) ?
+ 				 GFP_ATOMIC : GFP_KERNEL);
+ 	if (!elem)
+-		return NULL;
++		goto out_put_pool;
+ 
+ 	elem->pool = pool;
+ 	kref_init(&elem->ref_cnt);
+ 
+ 	return elem;
++
++out_put_pool:
++	atomic_dec(&pool->num_elem);
++	rxe_dev_put(pool->rxe);
++	rxe_pool_put(pool);
++	return NULL;
+ }
+ 
+ void rxe_elem_release(struct kref *kref)
+-- 
+2.15.0
+
diff --git a/queue/series b/queue/series
index a0578e6..7c51135 100644
--- a/queue/series
+++ b/queue/series
@@ -18,9 +18,11 @@ igb-check-memory-allocation-failure.patch
 i40e-use-the-safe-hash-table-iterator-when-deleting-.patch
 ixgbe-fix-use-of-uninitialized-padding.patch
 IB-rxe-check-for-allocation-failure-on-elem.patch
+IB-rxe-put-the-pool-on-allocation-failure.patch
 block-bfq-Disable-writeback-throttling.patch
 md-always-set-THREAD_WAKEUP-and-wake-up-wqueue-if-th.patch
 Bluetooth-hci_uart_set_flow_control-Fix-NULL-deref-w.patch
+Bluetooth-BT_HCIUART-now-depends-on-SERIAL_DEV_BUS.patch
 PCI-AER-Report-non-fatal-errors-only-to-the-affected.patch
 tracing-Exclude-generic-fields-from-histograms.patch
 ASoC-img-parallel-out-Add-pm_runtime_get-put-to-set_.patch