commit 2179863ede7c9ea56d80fbfe9bfc710c269c7e69
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sat Dec 9 18:29:48 2017 +0100

    Linux 3.18.87

commit 5b45ab61a85666735663dbdbff8f214f25beb9e2
Author: Colin Ian King <colin.king@canonical.com>
Date:   Tue Nov 7 16:45:04 2017 +0000

    usb: host: fix incorrect updating of offset
    
    commit 1d5a31582ef046d3b233f0da1a68ae26519b2f0a upstream.
    
    The variable temp is incorrectly being updated, instead it should
    be offset otherwise the loop just reads the same capability value
    and loops forever.  Thanks to Alan Stern for pointing out the
    correct fix to my original fix.  Fix also cleans up clang warning:
    
    drivers/usb/host/ehci-dbg.c:840:4: warning: Value stored to 'temp'
    is never read
    
    Fixes: d49d43174400 ("USB: misc ehci updates")
    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c051e2d3d8e86d04a21072a962a6457116d13393
Author: Oliver Neukum <oneukum@suse.com>
Date:   Thu Nov 23 16:39:52 2017 +0100

    USB: usbfs: Filter flags passed in from user space
    
    commit 446f666da9f019ce2ffd03800995487e79a91462 upstream.
    
    USBDEVFS_URB_ISO_ASAP must be accepted only for ISO endpoints.
    Improve sanity checking.
    
    Reported-by: Andrey Konovalov <andreyknvl@google.com>
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a98161fdd24462acae1a8f135126dbb2ba833539
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Fri Sep 22 23:43:25 2017 +0300

    USB: devio: Prevent integer overflow in proc_do_submiturb()
    
    commit 57999d1107c1e60c2ca7088f2ac0f819e2f554b3 upstream.
    
    There used to be an integer overflow check in proc_do_submiturb() but
    we removed it.  It turns out that it's still required.  The
    uurb->buffer_length variable is a signed integer and it's controlled by
    the user.  It can lead to an integer overflow when we do:
    
            num_sgs = DIV_ROUND_UP(uurb->buffer_length, USB_SG_SIZE);
    
    If we strip away the macro then that line looks like this:
    
            num_sgs = (uurb->buffer_length + USB_SG_SIZE - 1) / USB_SG_SIZE;
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    It's the first addition which can overflow.
    
    Fixes: 1129d270cbfb ("USB: Increase usbfs transfer limit")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b8a9e8d2c8085ec5f909115df7e3fb7ce8901847
Author: Mateusz Berezecki <mateuszb@fastmail.fm>
Date:   Wed Dec 21 09:19:14 2016 -0800

    USB: Increase usbfs transfer limit
    
    commit 1129d270cbfbb7e2b1ec3dede4a13930bdd10e41 upstream.
    
    Promote a variable keeping track of USB transfer memory usage to a
    wider data type and allow for higher bandwidth transfers from a large
    number of USB devices connected to a single host.
    
    Signed-off-by: Mateusz Berezecki <mateuszb@fastmail.fm>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9906ad70c51c3037a29c1b1fb0fed17fa395ff88
Author: Mike Looijmans <mike.looijmans@topic.nl>
Date:   Thu Nov 9 13:16:46 2017 +0100

    usb: hub: Cycle HUB power when initialization fails
    
    commit 973593a960ddac0f14f0d8877d2d0abe0afda795 upstream.
    
    Sometimes the USB device gets confused about the state of the initialization and
    the connection fails. In particular, the device thinks that it's already set up
    and running while the host thinks the device still needs to be configured. To
    work around this issue, power-cycle the hub's output to issue a sort of "reset"
    to the device. This makes the device restart its state machine and then the
    initialization succeeds.
    
    This fixes problems where the kernel reports a list of errors like this:
    
    usb 1-1.3: device not accepting address 19, error -71
    
    The end result is a non-functioning device. After this patch, the sequence
    becomes like this:
    
    usb 1-1.3: new high-speed USB device number 18 using ci_hdrc
    usb 1-1.3: device not accepting address 18, error -71
    usb 1-1.3: new high-speed USB device number 19 using ci_hdrc
    usb 1-1.3: device not accepting address 19, error -71
    usb 1-1-port3: attempt power cycle
    usb 1-1.3: new high-speed USB device number 21 using ci_hdrc
    usb-storage 1-1.3:1.2: USB Mass Storage device detected
    
    Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 01d9d14f89e4cec6a4002974f6e574ec271cc4ea
Author: Matt Wilson <msw@amazon.com>
Date:   Mon Nov 13 11:31:31 2017 -0800

    serial: 8250_pci: Add Amazon PCI serial device ID
    
    commit 3bfd1300abfe3adb18e84a89d97a0e82a22124bb upstream.
    
    This device will be used in future Amazon EC2 instances as the primary
    serial port (i.e., data sent to this port will be available via the
    GetConsoleOuput [1] EC2 API).
    
    [1] http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetConsoleOutput.html
    
    Signed-off-by: Matt Wilson <msw@amazon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e1ed329f60f6054aa7f045adab5d7a50c1daecd5
Author: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date:   Tue Nov 14 01:31:15 2017 -0500

    usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub
    
    commit e43a12f1793ae1fe006e26fe9327a8840a92233c upstream.
    
    KY-688 USB 3.1 Type-C Hub internally uses a Genesys Logic hub to connect
    to Realtek r8153.
    
    Similar to commit ("7496cfe5431f2 usb: quirks: Add no-lpm quirk for Moshi
    USB to Ethernet Adapter"), no-lpm can make r8153 ethernet work.
    
    Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 94eeab3e1d012fce178f45fd32e44304b96cc0a1
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Tue Nov 14 19:27:22 2017 +0100

    uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices
    
    commit 7fee72d5e8f1e7b8d8212e28291b1a0243ecf2f1 upstream.
    
    We've been adding this as a quirk on a per device basis hoping that
    newer disk enclosures would do better, but that has not happened,
    so simply apply this quirk to all Seagate devices.
    
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d51a980a967748e889815c304e7bdcb4d6c37fd3
Author: Boshi Wang <wangboshi@huawei.com>
Date:   Fri Oct 20 16:01:03 2017 +0800

    ima: fix hash algorithm initialization
    
    
    [ Upstream commit ebe7c0a7be92bbd34c6ff5b55810546a0ee05bee ]
    
    The hash_setup function always sets the hash_setup_done flag, even
    when the hash algorithm is invalid.  This prevents the default hash
    algorithm defined as CONFIG_IMA_DEFAULT_HASH from being used.
    
    This patch sets hash_setup_done flag only for valid hash algorithms.
    
    Fixes: e7a2ad7eb6f4 "ima: enable support for larger default filedata hash algorithms"
    Signed-off-by: Boshi Wang <wangboshi@huawei.com>
    Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ce48aa52f90fd7b8dfa62f1c81452974d0a982c7
Author: Rui Sousa <rui.sousa@nxp.com>
Date:   Mon Feb 13 10:01:25 2017 +0800

    net: fec: fix multicast filtering hardware setup
    
    
    [ Upstream commit 01f8902bcf3ff124d0aeb88a774180ebcec20ace ]
    
    Fix hardware setup of multicast address hash:
    - Never clear the hardware hash (to avoid packet loss)
    - Construct the hash register values in software and then write once
    to hardware
    
    Signed-off-by: Rui Sousa <rui.sousa@nxp.com>
    Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ccf653b185f9cb39c403e7b58a9d5ed08d924768
Author: Jan Kara <jack@suse.cz>
Date:   Wed Feb 8 14:30:53 2017 -0800

    mm: avoid returning VM_FAULT_RETRY from ->page_mkwrite handlers
    
    
    [ Upstream commit 0911d0041c22922228ca52a977d7b0b0159fee4b ]
    
    Some ->page_mkwrite handlers may return VM_FAULT_RETRY as its return
    code (GFS2 or Lustre can definitely do this).  However VM_FAULT_RETRY
    from ->page_mkwrite is completely unhandled by the mm code and results
    in locking and writeably mapping the page which definitely is not what
    the caller wanted.
    
    Fix Lustre and block_page_mkwrite_ret() used by other filesystems
    (notably GFS2) to return VM_FAULT_NOPAGE instead which results in
    bailing out from the fault code, the CPU then retries the access, and we
    fault again effectively doing what the handler wanted.
    
    Link: http://lkml.kernel.org/r/20170203150729.15863-1-jack@suse.cz
    Signed-off-by: Jan Kara <jack@suse.cz>
    Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
    Reviewed-by: Jinshan Xiong <jinshan.xiong@intel.com>
    Cc: Matthew Wilcox <willy@infradead.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 42c53dc2ca8ca6c9d7f8f2092bfdbed0e129806a
Author: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Date:   Tue Jan 24 13:00:48 2017 +0100

    tipc: fix cleanup at module unload
    
    
    [ Upstream commit 35e22e49a5d6a741ebe7f2dd280b2052c3003ef7 ]
    
    In tipc_server_stop(), we iterate over the connections with limiting
    factor as server's idr_in_use. We ignore the fact that this variable
    is decremented in tipc_close_conn(), leading to premature exit.
    
    In this commit, we iterate until the we have no connections left.
    
    Acked-by: Ying Xue <ying.xue@windriver.com>
    Acked-by: Jon Maloy <jon.maloy@ericsson.com>
    Tested-by: John Thompson <thompa.atl@gmail.com>
    Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7c3f696de8d19e56b8685ab70eba5e139e61696f
Author: Colin Ian King <colin.king@canonical.com>
Date:   Fri Jan 20 13:01:57 2017 +0000

    net: sctp: fix array overrun read on sctp_timer_tbl
    
    
    [ Upstream commit 0e73fc9a56f22f2eec4d2b2910c649f7af67b74d ]
    
    The comparison on the timeout can lead to an array overrun
    read on sctp_timer_tbl because of an off-by-one error. Fix
    this by using < instead of <= and also compare to the array
    size rather than SCTP_EVENT_TIMEOUT_MAX.
    
    Fixes CoverityScan CID#1397639 ("Out-of-bounds read")
    
    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 741a5969398f43203bf09768d9b7983eeeee0d29
Author: Trond Myklebust <trond.myklebust@primarydata.com>
Date:   Fri Jan 13 13:31:32 2017 -0500

    NFSv4: Fix client recovery when server reboots multiple times
    
    
    [ Upstream commit c6180a6237174f481dc856ed6e890d8196b6f0fb ]
    
    If the server reboots multiple times, the client should rely on the
    server to tell it that it cannot reclaim state as per section 9.6.3.4
    in RFC7530 and section 8.4.2.1 in RFC5661.
    Currently, the client is being to conservative, and is assuming that
    if the server reboots while state recovery is in progress, then it must
    ignore state that was not recovered before the reboot.
    
    Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 351f504358fc4c7b44f6540949d6b71d89af2d0b
Author: Vlad Tsyrklevich <vlad@tsyrklevich.net>
Date:   Mon Jan 9 20:57:48 2017 +0700

    net/appletalk: Fix kernel memory disclosure
    
    
    [ Upstream commit ce7e40c432ba84da104438f6799d460a4cad41bc ]
    
    ipddp_route structs contain alignment padding so kernel heap memory
    is leaked when they are copied to user space in
    ipddp_ioctl(SIOCFINDIPDDPRT). Change kmalloc() to kzalloc() to clear
    that memory.
    
    Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ae8e8f2b0f5fc7d11d9a06af37e50f9e6dc44b6a
Author: David Forster <dforster@brocade.com>
Date:   Fri Jan 6 10:27:59 2017 +0000

    vti6: fix device register to report IFLA_INFO_KIND
    
    
    [ Upstream commit 93e246f783e6bd1bc64fdfbfe68b18161f69b28e ]
    
    vti6 interface is registered before the rtnl_link_ops block
    is attached. As a result the resulting RTM_NEWLINK is missing
    IFLA_INFO_KIND. Re-order attachment of rtnl_link_ops block to fix.
    
    Signed-off-by: Dave Forster <dforster@brocade.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2be09ca3fe9c0ffcd82139b4efe06b7f91d6cae5
Author: Peter Ujfalusi <peter.ujfalusi@ti.com>
Date:   Tue Jan 3 13:22:34 2017 +0200

    ARM: OMAP1: DMA: Correct the number of logical channels
    
    
    [ Upstream commit 657279778af54f35e54b07b6687918f254a2992c ]
    
    OMAP1510, OMAP5910 and OMAP310 have only 9 logical channels.
    OMAP1610, OMAP5912, OMAP1710, OMAP730, and OMAP850 have 16 logical channels
    available.
    
    The wired 17 for the lch_count must have been used to cover the 16 + 1
    dedicated LCD channel, in reality we can only use 9 or 16 channels.
    
    The d->chan_count is not used by the omap-dma stack, so we can skip the
    setup. chan_count was configured to the number of logical channels and not
    the actual number of physical channels anyways.
    
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
    Acked-by: Aaro Koskinen <aaro.koskinen@iki.fi>
    Signed-off-by: Tony Lindgren <tony@atomide.com>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 462b3549034fc4f1b3119c3364cd636484fb1f52
Author: Thomas Richter <tmricht@linux.vnet.ibm.com>
Date:   Wed Sep 13 10:12:09 2017 +0200

    perf test attr: Fix ignored test case result
    
    
    [ Upstream commit 22905582f6dd4bbd0c370fe5732c607452010c04 ]
    
    Command perf test -v 16 (Setup struct perf_event_attr test) always
    reports success even if the test case fails.  It works correctly if you
    also specify -F (for don't fork).
    
       root@s35lp76 perf]# ./perf test -v 16
       15: Setup struct perf_event_attr               :
       --- start ---
       running './tests/attr/test-record-no-delay'
       [ perf record: Woken up 1 times to write data ]
       [ perf record: Captured and wrote 0.002 MB /tmp/tmp4E1h7R/perf.data
         (1 samples) ]
       expected task=0, got 1
       expected precise_ip=0, got 3
       expected wakeup_events=1, got 0
       FAILED './tests/attr/test-record-no-delay' - match failure
       test child finished with 0
       ---- end ----
       Setup struct perf_event_attr: Ok
    
    The reason for the wrong error reporting is the return value of the
    system() library call. It is called in run_dir() file tests/attr.c and
    returns the exit status, in above case 0xff00.
    
    This value is given as parameter to the exit() function which can only
    handle values 0-0xff.
    
    The child process terminates with exit value of 0 and the parent does
    not detect any error.
    
    This patch corrects the error reporting and prints the correct test
    result.
    
    Signed-off-by: Thomas-Mich Richter <tmricht@linux.vnet.ibm.com>
    Acked-by: Jiri Olsa <jolsa@kernel.org>
    Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
    Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
    Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Cc: Thomas-Mich Richter <tmricht@linux.vnet.ibm.com>
    LPU-Reference: 20170913081209.39570-2-tmricht@linux.vnet.ibm.com
    Link: http://lkml.kernel.org/n/tip-rdube6rfcjsr1nzue72c7lqn@git.kernel.org
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 079e07453a78efcf3dbee3a40a89a6c31516c224
Author: Jibin Xu <jibin.xu@windriver.com>
Date:   Sun Sep 10 20:11:42 2017 -0700

    sysrq : fix Show Regs call trace on ARM
    
    
    [ Upstream commit b00bebbc301c8e1f74f230dc82282e56b7e7a6db ]
    
    When kernel configuration SMP,PREEMPT and DEBUG_PREEMPT are enabled,
    echo 1 >/proc/sys/kernel/sysrq
    echo p >/proc/sysrq-trigger
    kernel will print call trace as below:
    
    sysrq: SysRq : Show Regs
    BUG: using __this_cpu_read() in preemptible [00000000] code: sh/435
    caller is __this_cpu_preempt_check+0x18/0x20
    Call trace:
    [<ffffff8008088e80>] dump_backtrace+0x0/0x1d0
    [<ffffff8008089074>] show_stack+0x24/0x30
    [<ffffff8008447970>] dump_stack+0x90/0xb0
    [<ffffff8008463950>] check_preemption_disabled+0x100/0x108
    [<ffffff8008463998>] __this_cpu_preempt_check+0x18/0x20
    [<ffffff80084c9194>] sysrq_handle_showregs+0x1c/0x40
    [<ffffff80084c9c7c>] __handle_sysrq+0x12c/0x1a0
    [<ffffff80084ca140>] write_sysrq_trigger+0x60/0x70
    [<ffffff8008251e00>] proc_reg_write+0x90/0xd0
    [<ffffff80081f1788>] __vfs_write+0x48/0x90
    [<ffffff80081f241c>] vfs_write+0xa4/0x190
    [<ffffff80081f3354>] SyS_write+0x54/0xb0
    [<ffffff80080833f0>] el0_svc_naked+0x24/0x28
    
    This can be seen on a common board like an r-pi3.
    This happens because when echo p >/proc/sysrq-trigger,
    get_irq_regs() is called outside of IRQ context,
    if preemption is enabled in this situation,kernel will
    print the call trace. Since many prior discussions on
    the mailing lists have made it clear that get_irq_regs
    either just returns NULL or stale data when used outside
    of IRQ context,we simply avoid calling it outside of
    IRQ context.
    
    Signed-off-by: Jibin Xu <jibin.xu@windriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4b72e3bb6bb1214da311a031f864c70ef51188a6
Author: Gustavo A. R. Silva <garsilva@embeddedor.com>
Date:   Mon Oct 16 12:40:29 2017 -0500

    EDAC, sb_edac: Fix missing break in switch
    
    
    [ Upstream commit a8e9b186f153a44690ad0363a56716e7077ad28c ]
    
    Add missing break statement in order to prevent the code from falling
    through.
    
    Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
    Cc: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
    Cc: linux-edac <linux-edac@vger.kernel.org>
    Link: http://lkml.kernel.org/r/20171016174029.GA19757@embeddedor.com
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e95cdfbe08b7d3ee15b514dc9d01df8005524979
Author: Hiromitsu Yamasaki <hiromitsu.yamasaki.ym@renesas.com>
Date:   Thu Nov 2 10:32:36 2017 +0100

    spi: sh-msiof: Fix DMA transfer size check
    
    
    [ Upstream commit 36735783fdb599c94b9c86824583df367c65900b ]
    
    DMA supports 32-bit words only,
    even if BITLEN1 of SITMDR2 register is 16bit.
    
    Fixes: b0d0ce8b6b91 ("spi: sh-msiof: Add DMA support")
    Signed-off-by: Hiromitsu Yamasaki <hiromitsu.yamasaki.ym@renesas.com>
    Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
    Acked-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Acked-by: Dirk Behme <dirk.behme@de.bosch.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 826b2a0b10bf91e84fdc220e26e9c7daeda60161
Author: Lukas Wunner <lukas@wunner.de>
Date:   Sat Oct 28 11:35:49 2017 +0200

    serial: 8250_fintek: Fix rs485 disablement on invalid ioctl()
    
    
    [ Upstream commit 3236a965486ba0c6043cf2c7b51943d8b382ae29 ]
    
    This driver's ->rs485_config callback checks if SER_RS485_RTS_ON_SEND
    and SER_RS485_RTS_AFTER_SEND have the same value.  If they do, it means
    the user has passed in invalid data with the TIOCSRS485 ioctl()
    since RTS must have a different polarity when sending and when not
    sending.  In this case, rs485 mode is not enabled (the RS485_URA bit
    is not set in the RS485 Enable Register) and this is supposed to be
    signaled back to the user by clearing the SER_RS485_ENABLED bit in
    struct serial_rs485 ... except a missing tilde character is preventing
    that from happening.
    
    Fixes: 28e3fb6c4dce ("serial: Add support for Fintek F81216A LPC to 4 UART")
    Cc: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
    Cc: "Ji-Ze Hong (Peter Hong)" <hpeter@gmail.com>
    Signed-off-by: Lukas Wunner <lukas@wunner.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa541bf05f1750c04579e70f4737967da65a611b
Author: Rui Hua <huarui.dev@gmail.com>
Date:   Fri Nov 24 15:14:26 2017 -0800

    bcache: recover data from backing when data is clean
    
    commit e393aa2446150536929140739f09c6ecbcbea7f0 upstream.
    
    When we send a read request and hit the clean data in cache device, there
    is a situation called cache read race in bcache(see the commit in the tail
    of cache_look_up(), the following explaination just copy from there):
    The bucket we're reading from might be reused while our bio is in flight,
    and we could then end up reading the wrong data. We guard against this
    by checking (in bch_cache_read_endio()) if the pointer is stale again;
    if so, we treat it as an error (s->iop.error = -EINTR) and reread from
    the backing device (but we don't pass that error up anywhere)
    
    It should be noted that cache read race happened under normal
    circumstances, not the circumstance when SSD failed, it was counted
    and shown in  /sys/fs/bcache/XXX/internal/cache_read_races.
    
    Without this patch, when we use writeback mode, we will never reread from
    the backing device when cache read race happened, until the whole cache
    device is clean, because the condition
    (s->recoverable && (dc && !atomic_read(&dc->has_dirty))) is false in
    cached_dev_read_error(). In this situation, the s->iop.error(= -EINTR)
    will be passed up, at last, user will receive -EINTR when it's bio end,
    this is not suitable, and wield to up-application.
    
    In this patch, we use s->read_dirty_data to judge whether the read
    request hit dirty data in cache device, it is safe to reread data from
    the backing device when the read request hit clean data. This can not
    only handle cache read race, but also recover data when failed read
    request from cache device.
    
    [edited by mlyle to fix up whitespace, commit log title, comment
    spelling]
    
    Fixes: d59b23795933 ("bcache: only permit to recovery read error when cache device is clean")
    Signed-off-by: Hua Rui <huarui.dev@gmail.com>
    Reviewed-by: Michael Lyle <mlyle@lyle.org>
    Reviewed-by: Coly Li <colyli@suse.de>
    Signed-off-by: Michael Lyle <mlyle@lyle.org>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aa129cb1754de24f56ed60faec18fdae2e17e262
Author: Coly Li <colyli@suse.de>
Date:   Mon Oct 30 14:46:31 2017 -0700

    bcache: only permit to recovery read error when cache device is clean
    
    commit d59b23795933678c9638fd20c942d2b4f3cd6185 upstream.
    
    When bcache does read I/Os, for example in writeback or writethrough mode,
    if a read request on cache device is failed, bcache will try to recovery
    the request by reading from cached device. If the data on cached device is
    not synced with cache device, then requester will get a stale data.
    
    For critical storage system like database, providing stale data from
    recovery may result an application level data corruption, which is
    unacceptible.
    
    With this patch, for a failed read request in writeback or writethrough
    mode, recovery a recoverable read request only happens when cache device
    is clean. That is to say, all data on cached device is up to update.
    
    For other cache modes in bcache, read request will never hit
    cached_dev_read_error(), they don't need this patch.
    
    Please note, because cache mode can be switched arbitrarily in run time, a
    writethrough mode might be switched from a writeback mode. Therefore
    checking dc->has_data in writethrough mode still makes sense.
    
    Changelog:
    V4: Fix parens error pointed by Michael Lyle.
    v3: By response from Kent Oversteet, he thinks recovering stale data is a
        bug to fix, and option to permit it is unnecessary. So this version
        the sysfs file is removed.
    v2: rename sysfs entry from allow_stale_data_on_failure  to
        allow_stale_data_on_failure, and fix the confusing commit log.
    v1: initial patch posted.
    
    [small change to patch comment spelling by mlyle]
    
    Signed-off-by: Coly Li <colyli@suse.de>
    Signed-off-by: Michael Lyle <mlyle@lyle.org>
    Reported-by: Arne Wolf <awolf@lenovo.com>
    Reviewed-by: Michael Lyle <mlyle@lyle.org>
    Cc: Kent Overstreet <kent.overstreet@gmail.com>
    Cc: Nix <nix@esperi.org.uk>
    Cc: Kai Krakow <hurikhan77@gmail.com>
    Cc: Eric Wheeler <bcache@lists.ewheeler.net>
    Cc: Junhui Tang <tang.junhui@zte.com.cn>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>