Linux/linux 2339e91drivers/media/platform vim2m.c, drivers/media/v4l2-core v4l2-ioctl.c

Merge tag 'media/v5.0-1' of 
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media fixes from Mauro Carvalho Chehab:

 - a regression fix at v4l2 core, with affects multi-plane streams

 - a fix at vim2m driver

* tag 'media/v5.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: vim2m: only cancel work if it is for right context
  media: v4l: ioctl: Validate num_planes for debug messages
  media: v4l: ioctl: Validate num_planes before using it
  media: v4l2-ioctl: Clear only per-plane reserved fields

Linux/linux d28f3e7drivers/pci Kconfig msi.c

Merge tag 'pci-v5.0-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci

Pull PCI fixes from Bjorn Helgaas::

 - Fix PCI kconfig menu organization (Rob Herring)

 - Fix pci_alloc_irq_vectors_affinity() error return to allow "reduce
   and retry" for drivers using IRQ sets (Ming Lei)

 - Fix "pci=disable_acs_redir" initdata use-after-free problem (Logan
   Gunthorpe)

* tag 'pci-v5.0-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  PCI: Fix __initdata issue with "pci=disable_acs_redir" parameter
  PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity()
  PCI: Fix PCI kconfig menu organization

Linux/linux 8b4fe58drivers/i3c/master dw-i3c-master.c i3c-master-cdns.c

Merge tag 'i3c/fixes-for-5.0-rc3' of 
git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux

Pull i3c fixes from Boris Brezillon:

 - Fix the error check on master->sysclk val in the Cadence driver

 - Fix reattach implementation in the Designware driver

* tag 'i3c/fixes-for-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux:
  i3c: master: dw-i3c-master: fix i3c_attach/reattach
  i3c: master: Fix an error checking typo in 'cdns_i3c_master_probe()'

Linux/linux 3cdf680drivers/mtd/nand/raw fsmc_nand.c denali.c

Merge tag 'mtd/fixes-for-5.0-rc3' of git://git.infradead.org/linux-mtd

Pull mtd fixes from Boris Brezillon:
 "Raw NAND changes:

   - jz4740: fix a compilation warning

   - fsmc: fix a regression introduced by ->select_chip() deprecation

   - denali: fix a regression introduced by NAND_KEEP_TIMINGS addition"

* tag 'mtd/fixes-for-5.0-rc3' of git://git.infradead.org/linux-mtd:
  mtd: rawnand: denali: get ->setup_data_interface() working again
  mtd: nand: jz4740: fix '__iomem *' vs. '* __iomem'
  mtd: rawnand: fsmc: Keep bank enable bit set

Linux/linux 6e4673bdrivers/base/regmap regmap-irq.c

Merge tag 'regmap-fix-v5.0-rc2' of 
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap

Pull regmap fixes from Mark Brown:
 "The cleanups for the way we handle type information introduced during
  the merge window revealed that we'd been abusing the irq APIs for a
  long time, causing breakage for systems.

  This has a couple of minimal fixes for that which restore the previous
  behaviour for the time being, we'll fix it properly for v5.1 but
  that'd be a bit much to do as a bug fix"

* tag 'regmap-fix-v5.0-rc2' of 
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap-irq: do not write mask register if mask_base is zero
  regmap: regmap-irq: silently ignore unsupported type settings

Linux/linux c5b7098arch/powerpc/kernel signal_64.c head_8xx.S, arch/powerpc/kernel/trace ftrace.c

Merge tag 'powerpc-5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Pull powerpc fixes from Michael Ellerman:
 "A couple of weeks of fixes.

  There's one fix for an oops on Power9 machines with Open CAPI
  adapters.

  And a fix for probable memory corruption in some of the new NPU code,
  caught by smatch though and not seen in the wild.

  Plus a few other minor fixes.

  There's one non-fix which is the perf_regs change. That was sent
  during the merge window but I accidentally only merged the first of
  two patches in the series. It's been in linux-next so hopefully
  doesn't conflict with anything in acme's tree.

  Thanks to: Alexey Kardashevskiy, Andrew Donnellan, Breno Leitao,
  Christian Lamparter, Christophe Leroy, Dan Carpenter, Frederic Barrat,
  Greg Kurz, Jason A. Donenfeld, Madhavan Srinivasan"

* tag 'powerpc-5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/syscalls: Fix syscall tracing
  powerpc/pseries: Fix build break due to pnv_npu2_init()

    [6 lines not shown]

Linux/linux e6ec2fdarch/x86/xen time.c enlighten_pv.c, drivers/xen pvcalls-front.c pvcalls-back.c

Merge tag 'for-linus-5.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fixes from Juergen Gross:

 - Several fixes for the Xen pvcalls drivers (1 fix for the backend and
   8 for the frontend).

 - A fix for a rather longstanding bug in the Xen sched_clock()
   interface which led to weird time jumps when migrating the system.

 - A fix for avoiding accesses to x2apic MSRs in Xen PV guests.

* tag 'for-linus-5.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen: Fix x86 sched_clock() interface for xen
  pvcalls-front: fix potential null dereference
  always clear the X2APIC_ENABLE bit for PV guest
  pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock
  xen/pvcalls: remove set but not used variable 'intf'
  pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read
  pvcalls-front: don't return error when the ring is full
  pvcalls-front: properly allocate sk
  pvcalls-front: don't try to free unallocated rings
  pvcalls-front: read all data before closing the connection

Linux/linux dc6fef2crypto authenc.c, drivers/crypto talitos.c

Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:
 "This fixes the following issues:
   - Zero-length DMA mapping in caam
   - Invalidly mapping stack memory for DMA in talitos
   - Use after free in cavium/nitrox
   - Key parsing in authenc
   - Undefined shift in sm3
   - Bogus completion call in authencesn
   - SHA support detection in caam"

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: sm3 - fix undefined shift by >= width of value
  crypto: talitos - fix ablkcipher for CONFIG_VMAP_STACK
  crypto: talitos - reorder code in talitos_edesc_alloc()
  crypto: adiantum - initialize crypto_spawn::inst
  crypto: cavium/nitrox - Use after free in process_response_list()
  crypto: authencesn - Avoid twice completion call in decrypt path
  crypto: caam - fix SHA support detection
  crypto: caam - fix zero-length buffer DMA mapping
  crypto: ccree - convert to use crypto_authenc_extractkeys()
  crypto: bcm - convert to use crypto_authenc_extractkeys()
  crypto: authenc - fix parsing key with misaligned rta_len

Linux/linux 6e434bfarch/x86 Kconfig, drivers/acpi bus.c internal.h

Merge tag 'acpi-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI fixes from Rafael Wysocki:
 "These fix an ACPI initialization ordering issue introduced in the 4.17
  time frame and causing functional problems to appear on multiple
  systems and fix some fallout of the recent change to enable building
  kernels with ACPI support and without PCI.

  Specifics:

   - Restore the ACPI initialization ordering changed implicitly by the
     module-level AML handling rework during the 4.17 development cycle
     that caused the EC address space handler based on information from
     ECDT to be set up before loading AML definition blocks, making it
     effectively not accessible by AML on some systems that don't work
     as expected any more (Rafael Wysocki).

   - Add direct dependencies on PCI to Kconfig in multiple places for
     code that depends on both ACPI and PCI, but the PCI dependency was
     implicitly satisfied by the ACPI dependency before, to prevent
     invalid configurations from being created, for example by
     randconfig (Sinan Kaya)"

* tag 'acpi-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: EC: Look for ECDT EC after calling acpi_load_tables()

    [8 lines not shown]

Linux/linux 2a8cbf2Documentation/fb fbcon.txt, drivers/video/fbdev offb.c

Merge tag 'fbdev-v5.0-rc3' of git://github.com/bzolnier/linux

Pull fbdev fixes from Bartlomiej Zolnierkiewicz:

 - fix stack memory leak in omap2fb driver (Vlad Tsyrklevich)

 - fix OF node name handling v4.20 regression in offb driver (Rob
   Herring)

 - convert CONFIG_FB_LOGO_CENTER config option added in v5.0-rc1 into a
   kernel parameter (Peter Rosin)

* tag 'fbdev-v5.0-rc3' of git://github.com/bzolnier/linux:
  fbdev: fbmem: convert CONFIG_FB_LOGO_CENTER into a cmd line option
  fbdev: offb: Fix OF node name handling
  omap2fb: Fix stack memory disclosure

Linux/linux c3653ebdrivers/gpu/drm/nouveau/nvkm/engine/device base.c

Merge tag 'drm-fixes-2019-01-18-1' of git://anongit.freedesktop.org/drm/drm

Pull drm update from Dave Airlie:
 "Add nouveau TU102 (RTX 2080 Ti) support"

* tag 'drm-fixes-2019-01-18-1' of git://anongit.freedesktop.org/drm/drm:
  drm/nouveau/core: recognise TU102

Linux/linux 11ee2a3arch/x86 Kconfig, drivers/acpi internal.h Makefile

Merge branch 'acpi-pci'

* acpi-pci:
  drivers: thermal: int340x_thermal: Make PCI dependency explicit
  x86/intel/lpss: Make PCI dependency explicit
  platform/x86: apple-gmux: Make PCI dependency explicit
  platform/x86: intel_pmc: Make PCI dependency explicit
  platform/x86: intel_ips: make PCI dependency explicit
  vga-switcheroo: make PCI dependency explicit
  ata: pata_acpi: Make PCI dependency explicit
  ACPI / LPSS: Make PCI dependency explicit

Linux/linux d311e0cdrivers/mtd/nand/raw denali.c

mtd: rawnand: denali: get ->setup_data_interface() working again

Commit 7a08dbaedd36 ("mtd: rawnand: Move ->setup_data_interface() to
nand_controller_ops") missed to invert the if-conditonal for denali.
Since then, the Denali NAND driver cannnot invoke setup_data_interface.

Fixes: 7a08dbaedd36 ("mtd: rawnand: Move ->setup_data_interface() to nand_controller_ops")
Signed-off-by: Masahiro Yamada <yamada.masahiro at socionext.com>
Acked-by: Miquel Raynal <miquel.raynal at bootlin.com>
Signed-off-by: Boris Brezillon <bbrezillon at kernel.org>

Linux/linux 01eeb92drivers/mtd/nand/raw jz4740_nand.c

mtd: nand: jz4740: fix '__iomem *' vs. '* __iomem'

The function jz_nand_ioremap_resource() needs a pointer to an __iomem
pointer as its last argument but this argument is declared as:
        void * __iomem *base

Fix this by using the correct declaration:
        void __iomem **base
which then also removes the following Sparse's warnings:
  282:15: warning: incorrect type in assignment (different address spaces)
  282:15:    expected void *[noderef] <asn:2>
  282:15:    got void [noderef] <asn:2> *
  322:57: warning: incorrect type in argument 4 (different address spaces)
  322:57:    expected void *[noderef] <asn:2> *base
  322:57:    got void [noderef] <asn:2> **
  402:67: warning: incorrect type in argument 4 (different address spaces)
  402:67:    expected void *[noderef] <asn:2> *base
  402:67:    got void [noderef] <asn:2> **

Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck at gmail.com>
Acked-by: Miquel Raynal <miquel.raynal at bootlin.com>
Signed-off-by: Boris Brezillon <bbrezillon at kernel.org>

Linux/linux 9420151drivers/gpu/drm/nouveau/nvkm/engine/device base.c

Merge branch 'linux-4.21' of git://github.com/skeggsb/linux into drm-fixes

nouveau support for TU102 (RTX 2080 Ti)

Signed-off-by: Dave Airlie <airlied at redhat.com>
From: Ben Skeggs <bskeggs at redhat.com>
Link: 
https://patchwork.freedesktop.org/patch/msgid/CABDvA=mQsRr0BpRpv3n6UjthHush4u_kQR3oUGHkBtAHTmyCYw at mail.gmail.com

Linux/linux d739322drivers/infiniband/core uverbs_ioctl.c uverbs_cmd.c, drivers/infiniband/hw/mthca mthca_provider.c

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes frfom Jason Gunthorpe:
 "Not much so far. We have the usual batch of bugs and two fixes to code
  merged this cycle:

   - Restore valgrind support for the ioctl verbs interface merged this
     window, and fix a missed error code on an error path from that
     conversion

   - A user reported crash on obsolete mthca hardware

   - pvrdma was using the wrong command opcode toward the hypervisor

   - NULL pointer crash regression when dumping rdma-cm over netlink

   - Be conservative about exposing the global rkey"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/uverbs: Mark ioctl responses with UVERBS_ATTR_F_VALID_OUTPUT
  RDMA/mthca: Clear QP objects during their allocation
  RDMA/vmw_pvrdma: Return the correct opcode when creating WR
  RDMA/cma: Add cm_id restrack resource based on kernel or user cm_id type
  RDMA/nldev: Don't expose unsafe global rkey to regular user
  RDMA/uverbs: Fix post send success return value in case of error

Linux/linux 1092a94drivers/gpu/drm/amd/amdgpu amdgpu_display.c, drivers/gpu/drm/amd/amdkfd kfd_topology.c

Merge tag 'drm-fixes-2019-01-18' of git://anongit.freedesktop.org/drm/drm

Pull drm fixes from Dave Airlie:
 "The rc3 fixes are a bit scattered:

   - meson, sun4i and rockchip all had missing of_node_put.

   - qxl and virtio both were advertising dma-buf to userspace when they
     really shouldn't have.

  Otherwise:

  meson:
   - modesetting regression fix

  i915 GVT:
   - one cmd parser failure fix
   - region cleanup fix in vGPU destroy

  amdgpu:
   - KFD fixes for arm64 mixed APU/DGPU
   - vega12 powerplay fix
   - raven DC fixes
   - freesync fix"


    [21 lines not shown]

Linux/linux 2451f37drivers/leds leds-lp5523.c

Merge tag 'led-fix-for-5.0-rc3' of 
git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds

Pull LED fix from Jacek Anaszewski.

* tag 'led-fix-for-5.0-rc3' of 
git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds:
  leds: lp5523: fix a missing check of return value of lp55xx_read

Linux/linux 0a2fbeddrivers/hwmon nct6775.c lm80.c, drivers/hwmon/occ common.c

Merge tag 'hwmon-for-v5.0-rc3' of 
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:
 "Minor fixes/regressions"

* tag 'hwmon-for-v5.0-rc3' of 
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device 
ID table
  hwmon: (occ) Fix potential integer overflow
  hwmon: (lm80) Fix missing unlock on error in set_fan_div()
  hwmon: (nct6775) Enable IO mapping for NCT6797D and NCT6798D
  hwmon: (nct6775) Fix chip ID for NCT6798D

Linux/linux 7ebec5fdrivers/gpu/drm/nouveau/nvkm/engine/device base.c

drm/nouveau/core: recognise TU102

Would usually do this split-out, verifying each component indivitually, but
this has been squashed together to be more palatable for merging in 5.0-rc.

Signed-off-by: Ben Skeggs <bskeggs at redhat.com>

Linux/linux df0219bdrivers/gpu/drm/meson meson_crtc.c meson_drv.c, drivers/gpu/drm/qxl qxl_prime.c qxl_drv.c

Merge tag 'drm-misc-fixes-2019-01-17' of git://anongit.freedesktop.org/drm/drm-misc into 
drm-fixes

drm-misc-fixes for v5.0-rc3:
- Add missing calls to of_node_put to sun4i, meson, and rockchip.
- Drop unimplemented prime callbacks in virtio and qxl, so support
  for prime is not advertised on those drivers.
- Fix mode switching regression in meson.

Signed-off-by: Dave Airlie <airlied at redhat.com>

From: Maarten Lankhorst <maarten.lankhorst at linux.intel.com>
Link: 
https://patchwork.freedesktop.org/patch/msgid/9af07312-f435-2fda-65a2-9fe92cdf5da4 at linux.intel.com

Linux/linux 4ac4cb7drivers/gpu/drm/i915/gvt kvmgt.c mpt.h

Merge tag 'drm-intel-fixes-2019-01-17' of git://anongit.freedesktop.org/drm/drm-intel into 
drm-fixes

drm/i915/gvt fixes for v5.0-rc3

"This contains one cmd parser failure fix to allow cmd access for one
register, and fix region cleanup properly in vGPU destroy, and another
fix for critical mmap size check mistake."

Signed-off-by: Dave Airlie <airlied at redhat.com>

From: Jani Nikula <jani.nikula at intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/87ef9bfusc.fsf at intel.com

Linux/linux 586cdb0drivers/gpu/drm/amd/amdgpu amdgpu_display.c, drivers/gpu/drm/amd/amdkfd kfd_topology.c kfd_crat.c

Merge branch 'drm-fixes-5.0' of git://people.freedesktop.org/~agd5f/linux into drm-fixes

Fixes for 5.0:
- Fix KFD on ARM64
- Fix KFD topology with mixed APU and dGPU systems
- Powerplay fix for vega12
- DC Raven fixes
- Freesync fix

Signed-off-by: Dave Airlie <airlied at redhat.com>
From: Alex Deucher <alexdeucher at gmail.com>
Link: 
https://patchwork.freedesktop.org/patch/msgid/20190116224524.3314-1-alexander.deucher at amd.com

Linux/linux 248b570drivers/leds leds-lp5523.c

leds: lp5523: fix a missing check of return value of lp55xx_read

When lp55xx_read() fails, "status" is an uninitialized variable and thus
may contain random value; using it leads to undefined behaviors.

The fix inserts a check for the return value of lp55xx_read: if it
fails, returns with its error code.

Signed-off-by: Kangjie Lu <kjlu at umn.edu>
Signed-off-by: Jacek Anaszewski <jacek.anaszewski at gmail.com>

Linux/linux f422449drivers/hwmon tmp421.c

hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID 
table

Correct a typo in OF device ID table
The last one should be 'ti,tmp442'

Signed-off-by: Cheng-Min Ao <tony_ao at wiwynn.com>
Signed-off-by: Yu-Hsiang Chen <matt_chen at wiwynn.com>
Signed-off-by: Guenter Roeck <linux at roeck-us.net>

Linux/linux a3a8025fs/afs rxrpc.c protocol_yfs.h, include/trace/events afs.h

Merge tag 'afs-fixes-20190117' of 
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs

Pull AFS fixes from David Howells:
 "Here's a set of fixes for AFS:

   - Use struct_size() for kzalloc() size calculation.

   - When calling YFS.CreateFile rather than AFS.CreateFile, it is
     possible to create a file with a file lock already held. The
     default value indicating no lock required is actually -1, not 0.

   - Fix an oops in inode/vnode validation if the target inode doesn't
     have a server interest assigned (ie. a server that will notify us
     of changes by third parties).

   - Fix refcounting of keys in file locking.

   - Fix a race in refcounting asynchronous operations in the event of
     an error during request transmission. The provision of a dedicated
     function to get an extra ref on a call is split into a separate
     commit"

* tag 'afs-fixes-20190117' of 
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:

    [6 lines not shown]

Linux/linux 6d060fakernel/dma swiotlb.c

Merge branch 'stable/for-linus-5.0' of 
git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb

Pull swiotlb fix from Konrad Rzeszutek Wilk:
 "A tiny fix for v5.0-rc2:

  This fixes an issue with GPU cards not working anymore with the DMA
  mapping work Christopher did - as the SWIOTLB is initialized first and
  then free'd (as IOMMU is available) but we forgot to clear our start
  and end entries which are used and BOOM"

* 'stable/for-linus-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb:
  swiotlb: clear io_tlb_start and io_tlb_end in swiotlb_exit

Linux/linux e4484a4. Makefile, arch/h8300 Makefile

Merge tag 'kbuild-fixes-v5.0' of 
git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

Pull Kbuild fixes from Masahiro Yamada:

 - clean generated files in scripts/kconfig/ by 'make mrproper'

 - fix conflict between dead code elimination and ftrace for GCC <= 4.7

 - fix external module build with CONFIG_STACKPROTECTOR

 - remove unused code

* tag 'kbuild-fixes-v5.0' of 
git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
  kbuild: mark prepare0 as PHONY to fix external module build
  openrisc: remove unneeded code in arch/openrisc/Makefile
  nds32: remove unneeded code in arch/nds32/Makefile
  ia64: remove redundant 'export AWK'
  kbuild: remove unused archmrproper
  kbuild: remove unused baseprereq
  kbuild: Disable LD_DEAD_CODE_DATA_ELIMINATION with ftrace & GCC <= 4.7
  kconfig: clean generated *conf-cfg files

Linux/linux d471c4dDocumentation/devicetree/bindings/arm topology.txt, Documentation/devicetree/bindings/soc/qcom qcom,smp2p.txt

Merge tag 'devicetree-fixes-for-5.0' of 
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

Pull Devicetree fixes from Rob Herring:

 - Remove now unused struct device_node.type pointer

 - Fix meson-axg reset header SPDX tag

 - Add missing of_node_put in of_graph_get_remote_port_parent

 - Fix several binding doc file references and typos

* tag 'devicetree-fixes-for-5.0' of 
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
  dt-bindings: reset: meson-axg: fix SPDX license id
  dt-bindings: soc: qcom: Fix trivial language typos
  doc: gpio-mvebu: fix broken reference to cp110-system-controller0.txt file
  OF: properties: add missing of_node_put
  doc: bindings: fix bad reference to ARM CPU bindings
  dt-bindings: marvell,mmp2: fix typos in bindings doc
  of: Remove struct device_node.type pointer

Linux/linux 34fa476fs/afs rxrpc.c, include/trace/events afs.h

afs: Fix race in async call refcounting

There's a race between afs_make_call() and afs_wake_up_async_call() in the
case that an error is returned from rxrpc_kernel_send_data() after it has
queued the final packet.

afs_make_call() will try and clean up the mess, but the call state may have
been moved on thereby causing afs_process_async_call() to also try and to
delete the call.

Fix this by:

 (1) Getting an extra ref for an asynchronous call for the call itself to
     hold.  This makes sure the call doesn't evaporate on us accidentally
     and will allow the call to be retained by the caller in a future
     patch.  The ref is released on leaving afs_make_call() or
     afs_wait_for_call_to_complete().

 (2) In the event of an error from rxrpc_kernel_send_data():

     (a) Don't set the call state to AFS_CALL_COMPLETE until *after* the
         call has been aborted and ended.  This prevents
         afs_deliver_to_call() from doing anything with any notifications
         it gets.


    [12 lines not shown]

Linux/linux 7a75b00fs/afs rxrpc.c

afs: Provide a function to get a ref on a call

Provide a function to get a reference on an afs_call struct.

Signed-off-by: David Howells <dhowells at redhat.com>
DeltaFile
+12-6fs/afs/rxrpc.c
+12-61 files

Linux/linux 59d4907fs/afs flock.c inode.c

afs: Fix key refcounting in file locking code

Fix the refcounting of the authentication keys in the file locking code.
The vnode->lock_key member points to a key on which it expects to be
holding a ref, but it isn't always given an extra ref, however.

Fixes: 0fafdc9f888b ("afs: Fix file locking")
Signed-off-by: David Howells <dhowells at redhat.com>

Linux/linux 4882a27fs/afs inode.c

afs: Don't set vnode->cb_s_break in afs_validate()

A cb_interest record is not necessarily attached to the vnode on entry to
afs_validate(), which can cause an oops when we try to bring the vnode's
cb_s_break up to date in the default case (ie. no current callback promise
and the vnode has not been deleted).

Fix this by simply removing the line, as vnode->cb_s_break will be set when
needed by afs_register_server_cb_interest() when we next get a callback
promise from RPC call.

The oops looks something like:

    BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
    ...
    RIP: 0010:afs_validate+0x66/0x250 [kafs]
    ...
    Call Trace:
     afs_d_revalidate+0x8d/0x340 [kafs]
     ? __d_lookup+0x61/0x150
     lookup_dcache+0x44/0x70
     ? lookup_dcache+0x44/0x70
     __lookup_hash+0x24/0xa0
     do_unlinkat+0x11d/0x2c0
     __x64_sys_unlink+0x23/0x30

    [6 lines not shown]
DeltaFile
+0-1fs/afs/inode.c
+0-11 files

Linux/linux d2fd6e8drivers/pci pci.c

PCI: Fix __initdata issue with "pci=disable_acs_redir" parameter

The disable_acs_redir parameter stores a pointer to the string passed to
pci_setup().  However, the string passed to PCI setup is actually a
temporary copy allocated in static __initdata memory.  After init, once the
memory is freed, it is no longer valid to reference this pointer.

This bug was noticed in v5.0-rc1 after a change in commit c5eb1190074c
("PCI / PM: Allow runtime PM without callback functions") caused
pci_disable_acs_redir() to be called during shutdown which manifested
as an unable to handle kernel paging request at:

  RIP: 0010:pci_enable_acs+0x3f/0x1e0
  Call Trace:
     pci_restore_state.part.44+0x159/0x3c0
     pci_restore_standard_config+0x33/0x40
     pci_pm_runtime_resume+0x2b/0xd0
     ? pci_restore_standard_config+0x40/0x40
     __rpm_callback+0xbc/0x1b0
     rpm_callback+0x1f/0x70
     ? pci_restore_standard_config+0x40/0x40
      rpm_resume+0x4f9/0x710
     ? pci_conf1_read+0xb6/0xf0
     ? pci_conf1_write+0xb2/0xe0
     __pm_runtime_resume+0x47/0x70

    [22 lines not shown]
DeltaFile
+2-1drivers/pci/pci.c
+2-11 files

Linux/linux e00d888. Makefile

kbuild: mark prepare0 as PHONY to fix external module build

Commit c3ff2a5193fa ("powerpc/32: add stack protector support")
caused kernel panic on PowerPC when an external module is used with
CONFIG_STACKPROTECTOR because the 'prepare' target was not executed
for the external module build.

Commit e07db28eea38 ("kbuild: fix single target build for external
module") turned it into a build error because the 'prepare' target is
now executed but the 'prepare0' target is missing for the external
module build.

External module on arm/arm64 with CONFIG_STACKPROTECTOR_PER_TASK is
also broken in the same way.

Move 'PHONY += prepare0' to the common place. GNU Make is fine with
missing rule for phony targets. I also removed the comment which is
wrong irrespective of this commit.

I minimize the change so it can be easily backported to 4.20.x

To fix v4.20, please backport e07db28eea38 ("kbuild: fix single target
build for external module"), and then this commit.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=201891

    [10 lines not shown]
DeltaFile
+2-2Makefile
+2-21 files

Linux/linux 1b504a7arch/openrisc Makefile

openrisc: remove unneeded code in arch/openrisc/Makefile

 - LDFLAGS_vmlinux is cleared by the top Makefile

 - 'all: vmlinux' is specified by the top Makefile

Signed-off-by: Masahiro Yamada <yamada.masahiro at socionext.com>

Linux/linux 558ee61arch/nds32 Makefile

nds32: remove unneeded code in arch/nds32/Makefile

 - scripts/Kbuild.include already defined 'comma'

 - The top Makefile has 'PHONY += FORCE'

 - include/asm-*/ was moved to arch/*/include/asm/ a decade ago

Signed-off-by: Masahiro Yamada <yamada.masahiro at socionext.com>

Linux/linux 15c0519drivers/gpu/drm/i915/gvt kvmgt.c mpt.h

Merge tag 'gvt-fixes-2018-01-17' of https://github.com/intel/gvt-linux into 
drm-intel-fixes

gvt-fixes-2018-01-17

- Fix one register cmd parser failure (Colin)
- Fix region cleanup for vGPU destroy (Henry)
- Fix mmap size check (Zhenyu)

Signed-off-by: Jani Nikula <jani.nikula at intel.com>
From: Zhenyu Wang <zhenyuw at linux.intel.com>
Link: 
https://patchwork.freedesktop.org/patch/msgid/20190117074604.GI18272 at zhen-hp.sh.intel.com

Linux/linux 7fbfee7kernel seccomp.c, security security.c

Merge branch 'fixes-v5.0-rc2' of 
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull security subsystem fixes from James Morris:
 "Fixes for the security subsystem.

  The first (by Casey actually - it's misattributed) fixes a regression
  introduced with the LSM stacking changes"

* 'fixes-v5.0-rc2' of 
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  LSM: Check for NULL cred-security on free
  Yama: Check for pid death before checking ancestry
  seccomp: fix UAF in user-trap code

Linux/linux a5795fdsecurity security.c

LSM: Check for NULL cred-security on free

From: Casey Schaufler <casey at schaufler-ca.com>

Check that the cred security blob has been set before trying
to clean it up. There is a case during credential initialization
that could result in this.

Signed-off-by: Casey Schaufler <casey at schaufler-ca.com>
Acked-by: John Johansen <john.johansen at canonical.com>
Signed-off-by: James Morris <james.morris at microsoft.com>
Reported-by: syzbot+69ca07954461f189e808 at syzkaller.appspotmail.com

Linux/linux 35dad45drivers/gpu/drm/amd/display/amdgpu_dm amdgpu_dm.c, drivers/gpu/drm/amd/display/dc dc_link.h dc_stream.h

drm/amd/display: Detach backlight from stream

[Why]
Backlight is conceptually a property of links, not streams.
All backlight programming is done on links, but there is a
stream property bl_pwm_level that is used to restore backlight
on dpms on and s3 resume.  This is unnecessary, as backlight
is already restored by hardware with no driver intervention.

[How]
Remove bl_pwm_level, and the stream argument to set_backlight

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=109375
Signed-off-by: David Francis <David.Francis at amd.com>
Reviewed-by: Harry Wentland <Harry.Wentland at amd.com>
Acked-by: Anthony Koo <Anthony.Koo at amd.com>
Acked-by: Leo Li <sunpeng.li at amd.com>
Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
(cherry picked from commit 923fe4951282cbdfce05186c10380bbc45b5e03b)

Linux/linux 9474f4esecurity/yama yama_lsm.c

Yama: Check for pid death before checking ancestry

It's possible that a pid has died before we take the rcu lock, in which
case we can't walk the ancestry list as it may be detached. Instead, check
for death first before doing the walk.

Reported-by: syzbot+a9ac39bf55329e206219 at syzkaller.appspotmail.com
Fixes: 2d514487faf1 ("security: Yama LSM")
Cc: stable at vger.kernel.org
Suggested-by: Oleg Nesterov <oleg at redhat.com>
Signed-off-by: Kees Cook <keescook at chromium.org>
Signed-off-by: James Morris <james.morris at microsoft.com>

Linux/linux 889f4ceDocumentation/devicetree/bindings/gpio gpio-mvebu.txt

doc: gpio-mvebu: fix broken reference to cp110-system-controller0.txt file

The cp110-system-controller0.txt file was renamed to
cp110-system-controller.txt.

Fixes: 4aa5496980e4 ("dt-bindings: cp110: rename cp110 syscon file")
Signed-off-by: Otto Sabart <ottosabart at seberm.com>
Signed-off-by: Rob Herring <robh at kernel.org>

Linux/linux 3705addinclude/dt-bindings/reset amlogic,meson-axg-reset.h

dt-bindings: reset: meson-axg: fix SPDX license id

As reported, the SPDX license id is not placed correctly and the variant
of the BSD License used should be specified.

Fixes: c16292578ffa ("dt-bindings: reset: Add bindings for the Meson-AXG SoC Reset 
Controller")
Reported-by: Thomas Gleixner <tglx at linutronix.de>
Signed-off-by: Jerome Brunet <jbrunet at baylibre.com>
Reviewed-by: Thomas Gleixner <tglx at linutronix.de>
Signed-off-by: Rob Herring <robh at kernel.org>

Linux/linux 9eac0aeDocumentation/devicetree/bindings/soc/qcom qcom,smp2p.txt qcom,glink.txt

dt-bindings: soc: qcom: Fix trivial language typos

Fix few trivial language typos in bindings.

Signed-off-by: Krzysztof Kozlowski <krzk at kernel.org>
Signed-off-by: Rob Herring <robh at kernel.org>

Linux/linux 28b170edrivers/of property.c

OF: properties: add missing of_node_put

Add an of_node_put when the result of of_graph_get_remote_port_parent is
not available.

The semantic match that finds this problem is as follows
(http://coccinelle.lip6.fr):

// <smpl>
@r exists@
local idexpression e;
expression x;
@@
e = of_graph_get_remote_port_parent(...);
... when != x = e
    when != true e == NULL
    when != of_node_put(e)
    when != of_fwnode_handle(e)
(
return e;
|
*return ...;
)
// </smpl>


    [3 lines not shown]

Linux/linux 867cefbarch/x86/xen time.c, drivers/xen/events events_base.c

xen: Fix x86 sched_clock() interface for xen

Commit f94c8d11699759 ("sched/clock, x86/tsc: Rework the x86 'unstable'
sched_clock() interface") broke Xen guest time handling across
migration:

[  187.249951] Freezing user space processes ... (elapsed 0.001 seconds) done.
[  187.251137] OOM killer disabled.
[  187.251137] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done.
[  187.252299] suspending xenstore...
[  187.266987] xen:grant_table: Grant tables using version 1 layout
[18446743811.706476] OOM killer enabled.
[18446743811.706478] Restarting tasks ... done.
[18446743811.720505] Setting capacity to 16777216

Fix that by setting xen_sched_clock_offset at resume time to ensure a
monotonic clock value.

[boris: replaced pr_info() with pr_info_once() in xen_callback_vector()
 to avoid printing with incorrect timestamp during resume (as we
 haven't re-adjusted the clock yet)]

Fixes: f94c8d11699759 ("sched/clock, x86/tsc: Rework the x86 'unstable' sched_clock() 
interface")
Cc: <stable at vger.kernel.org> # 4.11

    [4 lines not shown]

Linux/linux 890d14dDocumentation/fb fbcon.txt, drivers/video/fbdev/core fbmem.c fbcon.c

fbdev: fbmem: convert CONFIG_FB_LOGO_CENTER into a cmd line option

A command line option is much more flexible than a config option and
the supporting code is small. Gets rid of #ifdefs in the code too...

Suggested-by: Geert Uytterhoeven <geert at linux-m68k.org>
Cc: Jonathan Corbet <corbet at lwn.net>
Signed-off-by: Peter Rosin <peda at axentia.se>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie at samsung.com>

Linux/linux 240809edrivers/media/platform vim2m.c

media: vim2m: only cancel work if it is for right context

cancel_delayed_work_sync() was called for any queue, but it should only
be called for the queue that is associated with the currently running job.

Otherwise, if two filehandles are streaming at the same time, then closing the
first will cancel the work which might still be running for a job from the
second filehandle. As a result the second filehandle will never be able to
finish the job and an attempt to stop streaming on that second filehandle will
stall.

Fixes: 52117be68b82 ("media: vim2m: use cancel_delayed_work_sync instead of 
flush_schedule_work")

Signed-off-by: Hans Verkuil <hverkuil-cisco at xs4all.nl>
Cc: <stable at vger.kernel.org>      # for v4.20 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung at kernel.org>

Linux/linux 7fe9f01drivers/media/v4l2-core v4l2-ioctl.c

media: v4l: ioctl: Validate num_planes for debug messages

The num_planes field in struct v4l2_pix_format_mplane is used in a loop
before validating it. As the use is printing a debug message in this case,
just cap the value to the maximum allowed.

Signed-off-by: Sakari Ailus <sakari.ailus at linux.intel.com>
Cc: stable at vger.kernel.org
Reviewed-by: Thierry Reding <treding at nvidia.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco at xs4all.nl>
Cc: <stable at vger.kernel.org>      # for v4.12 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung at kernel.org>