5.4.13-stable review

This is the start of the stable review cycle for the 5.4.13 release. There are 203 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 18 Jan 2020 23:16:00 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.13-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.4.13-rc1

Kai Li <[email protected]>
ocfs2: call journal flush to mark journal as empty after journal recovery when mount

Nick Desaulniers <[email protected]>
hexagon: work around compiler crash

Nick Desaulniers <[email protected]>
hexagon: parenthesize registers in asm predicates

Ard Biesheuvel <[email protected]>
kbuild/deb-pkg: annotate libelf-dev dependency as :native

Sakari Ailus <[email protected]>
media: intel-ipu3: Align struct ipu3_uapi_awb_fr_config_s to 32 bytes

changzhu <[email protected]>
drm/amdgpu: enable gfxoff for raven1 refresh

[email protected] <[email protected]>
ioat: ioat_alloc_ring() failure handling.

Julian Wiedmann <[email protected]>
s390/qeth: lock the card while changing its hsuid

John Stultz <[email protected]>
dmaengine: k3dma: Avoid null pointer traversal

David Howells <[email protected]>
rxrpc: Fix missing security check on incoming calls

David Howells <[email protected]>

    rxrpc: Don't take call->user_mutex in rxrpc_new_incoming_call()

David Howells <[email protected]>
rxrpc: Unlock new call in rxrpc_new_incoming_call() rather than the caller

Ben Dooks (Codethink) <[email protected]>
drm/arm/mali: make malidp_mw_connector_helper_funcs static

Jouni Hogander <[email protected]>
MIPS: Prevent link failure with kcov instrumentation

Tetsuo Handa <[email protected]>
tomoyo: Suppress RCU warning at list_for_each_entry_rcu().

Vincenzo Frascino <[email protected]>
mips: Fix gettimeofday() in the vdso library

Vladimir Kondratiev <[email protected]>
mips: cacheinfo: report shared CPU map

Olof Johansson <[email protected]>
riscv: export flush_icache_all to modules

Mathieu Desnoyers <[email protected]>
rseq/selftests: Turn off timeout setting

Shuah Khan <[email protected]>
selftests: firmware: Fix it to do root uid check and skip

Israel Rukshin <[email protected]>
scsi: target/iblock: Fix protection error with blocks greater than 512B

Varun Prakash <[email protected]>
scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy()

Johnson CH Chen (陳昭勳) <[email protected]>

    gpio: mpc8xxx: Add platform device to gpiochip->parent

Matti Vaittinen <[email protected]>
rtc: bd70528: Add MODULE ALIAS to autoload module

Chuhong Yuan <[email protected]>
rtc: brcmstb-waketimer: add missed clk_disable_unprepare

Kars de Jong <[email protected]>
rtc: msm6242: Fix reading of 10-hour digit

Olga Kornievskaia <[email protected]>
NFSD fixing possible null pointer derefering in copy offload

Chao Yu <[email protected]>
f2fs: fix potential overflow

Victorien Molle <[email protected]>
sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO

Luca Coelho <[email protected]>
iwlwifi: mvm: fix support for single antenna diversity

Nathan Chancellor <[email protected]>
rtlwifi: Remove unnecessary NULL check in rtl_regd_init

Mordechay Goodstein <[email protected]>
iwlwifi: mvm: consider ieee80211 station max amsdu value

Navid Emamdoost <[email protected]>
spi: lpspi: fix memory leak in fsl_lpspi_probe

Geert Uytterhoeven <[email protected]>
spi: rspi: Use platform_get_irq_byname_optional() for optional irqs

Mans Rullgard <[email protected]>
spi: atmel: fix handling of cs_change set on non-last xfer

Daniel Vetter <[email protected]>

    spi: pxa2xx: Set controller->max_transfer_size in dma mode

Sergei Shtylyov <[email protected]>
mtd: spi-nor: fix silent truncation in spi_nor_read_raw()

Sergei Shtylyov <[email protected]>
mtd: spi-nor: fix silent truncation in spi_nor_read()

Huanpeng Xin <[email protected]>
spi: sprd: Fix the incorrect SPI register

Zhihao Cheng <[email protected]>
ubifs: do_kill_orphans: Fix a memory leak bug

Ben Dooks (Codethink) <[email protected]>
ubifs: Fixed missed le64_to_cpu() in journal

Richard Weinberger <[email protected]>
Revert "ubifs: Fix memory leak bug in alloc_ubifs_info() error path"

Yong Wu <[email protected]>
memory: mtk-smi: Add PM suspend and resume ops

Yong Wu <[email protected]>
iommu/mediatek: Add a new tlb_lock for tlb_flush

Yong Wu <[email protected]>
iommu/mediatek: Correct the flush_iotlb_all callback

Jonas Karlman <[email protected]>
media: hantro: Set H264 FIELDPIC_FLAG_E flag correctly

Navid Emamdoost <[email protected]>
media: aspeed-video: Fix memory leaks in aspeed_video_probe

Jonas Karlman <[email protected]>
media: hantro: Do not reorder H264 scaling list

Jonas Karlman <[email protected]>
media: cedrus: Use correct H264 8x8 scaling list

Philipp Zabel <[email protected]>
media: coda: fix deadlock between decoder picture run and start command

Seung-Woo Kim <[email protected]>
media: exynos4-is: Fix recursive locking in isp_video_release()

Christophe JAILLET <[email protected]>
media: v4l: cadence: Fix how unsued lanes are handled in 'csi2rx_start()'

Boris Brezillon <[email protected]>
media: hantro: h264: Fix the frame_num wraparound case

Niklas Söderlund <[email protected]>
media: rcar-vin: Fix incorrect return statement in rvin_try_format()

Janusz Krzysztofik <[email protected]>
media: ov6650: Fix default format not applied on device probe

Janusz Krzysztofik <[email protected]>
media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support

Janusz Krzysztofik <[email protected]>
media: ov6650: Fix some format attributes not under control

Janusz Krzysztofik <[email protected]>
media: ov6650: Fix incorrect use of JPEG colorspace

Dietmar Eggemann <[email protected]>
ARM: 8943/1: Fix topology setup in case of CPU hotplug for CONFIG_SCHED_MC

Peng Fan <[email protected]>
tty: serial: pch_uart: correct usage of dma_unmap_sg

Peng Fan <[email protected]>
tty: serial: imx: use the sg count from dma_map_sg

Thomas Bogendoerfer <[email protected]>
MIPS: SGI-IP27: Fix crash, when CPUs are disabled via nr_cpus parameter

Tiezhu Yang <[email protected]>
MIPS: Loongson: Fix return value of loongson_hwmon_init

Thomas Bogendoerfer <[email protected]>
MIPS: PCI: remember nasid changed by set interrupt affinity

Oliver O'Halloran <[email protected]>
powerpc/powernv: Disable native PCIe port management

Bjorn Helgaas <[email protected]>
PCI/PTM: Remove spurious "d" from granularity message

Hewenliang <[email protected]>
tools: PCI: Fix fd leakage

Bjorn Helgaas <[email protected]>
PCI/PM: Clear PCIe PME Status even for legacy power management

Rob Herring <[email protected]>
PCI: Fix missing bridge dma_ranges resource list cleanup

Niklas Cassel <[email protected]>
PCI: dwc: Fix find_next_bit() usage

Remi Pommarel <[email protected]>
PCI: aardvark: Fix PCI_EXP_RTCTL register configuration

Remi Pommarel <[email protected]>
PCI: aardvark: Use LTSSM state to build link training flag

Arnd Bergmann <[email protected]>
compat_ioctl: handle SIOCOUTQNSD

Arnd Bergmann <[email protected]>
af_unix: add compat_ioctl support

Arnd Bergmann <[email protected]>
gfs2: add compat_ioctl support

Loic Poulain <[email protected]>

    arm64: dts: apq8096-db820c: Increase load on l21 for SDCARD

Arnd Bergmann <[email protected]>
scsi: sd: enable compat ioctls for sed-opal

Xiaojie Yuan <[email protected]>
drm/amdgpu/discovery: reserve discovery data at the top of VRAM

Christian König <[email protected]>
drm/amdgpu: cleanup creating BOs at fixed location (v2)

Greg Kroah-Hartman <[email protected]>
Revert "drm/virtio: switch virtio_gpu_wait_ioctl() to gem helper."

Mika Westerberg <[email protected]>
PCI: pciehp: Do not disable interrupt twice on suspend

Andy Shevchenko <[email protected]>
pinctrl: lewisburg: Update pin list according to v1.1v6

Geert Uytterhoeven <[email protected]>
pinctrl: sh-pfc: Do not use platform_get_irq() to count interrupts

Keiya Nobuta <[email protected]>
pinctrl: sh-pfc: Fix PINMUX_IPSR_PHYS() to set GPSR

Colin Ian King <[email protected]>
pinctl: ti: iodelay: fix error checking on pinctrl_count_index_with_args call

Navid Emamdoost <[email protected]>
affs: fix a memory leak in affs_remount

Denis Efremov <[email protected]>
rsi: fix potential null dereference in rsi_probe()

Leonard Crestez <[email protected]>
clk: imx: pll14xx: Fix quick switch of S/K parameter

Andy Shevchenko <[email protected]>
dmaengine: dw: platform: Mark 'hclk' clock optional

Kishon Vijay Abraham I <[email protected]>
clk: Fix memory leak in clk_unregister()

Marian Mihailescu <[email protected]>
clk: samsung: exynos5420: Preserve CPU clocks configuration during suspend/resume

Jerome Brunet <[email protected]>
clk: meson: axg-audio: fix regmap last register

Alexander Usyskin <[email protected]>
mei: fix modalias documentation

Alexandru Ardelean <[email protected]>
iio: imu: adis16480: assign bias value only if operation succeeded

Lorenzo Bianconi <[email protected]>
iio: imu: st_lsm6dsx: fix gyro gain definitions for LSM9DS1

Trond Myklebust <[email protected]>
NFSv4.x: Drop the slot if nfs4_delegreturn_prepare waits for layoutreturn

Trond Myklebust <[email protected]>
NFSv4.x: Handle bad/dead sessions correctly in nfs41_sequence_process()

Scott Mayhew <[email protected]>
nfsd: v4 support requires CRYPTO_SHA256

Scott Mayhew <[email protected]>

    nfsd: Fix cld_net->cn_tfm initialization

Trond Myklebust <[email protected]>
NFSv2: Fix a typo in encode_sattr()

Eric Biggers <[email protected]>
crypto: geode-aes - convert to skcipher API and make thread-safe

Herbert Xu <[email protected]>
crypto: algif_skcipher - Use chunksize instead of blocksize

Ard Biesheuvel <[email protected]>
crypto: virtio - implement missing support for output IVs

Yunfeng Ye <[email protected]>
crypto: arm64/aes-neonbs - add return value of skcipher_walk_done() in __xts_crypt()

Zhou Wang <[email protected]>
crypto: hisilicon - select NEED_SG_DMA_LENGTH in qm Kconfig

Phani Kiran Hemadri <[email protected]>
crypto: cavium/nitrox - fix firmware assignment to AE cores

Can Guo <[email protected]>
scsi: ufs: Give an unique ID to each ufs-bsg

Diego Calleja <[email protected]>
dm: add dm-clone to the documentation index

Chuck Lever <[email protected]>
xprtrdma: Fix oops in Receive handler after device removal

Chuck Lever <[email protected]>
xprtrdma: Fix completion wait during device removal

Chuck Lever <[email protected]>
xprtrdma: Fix create_qp crash on device unload

Vadim Pasternak <[email protected]>
Documentation/ABI: Add missed attribute for mlxreg-io sysfs interfaces

Vadim Pasternak <[email protected]>
Documentation/ABI: Fix documentation inconsistency for mlxreg-io sysfs interfaces

Mike Rapoport <[email protected]>
asm-generic/nds32: don't redefine cacheflush primitives

Hans de Goede <[email protected]>
platform/x86: GPD pocket fan: Use default values when wrong modparams are given

Jian-Hong Pan <[email protected]>
platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0

Liming Sun <[email protected]>
platform/mellanox: fix potential deadlock in the tmfifo driver

Xiang Chen <[email protected]>

    scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI

James Bottomley <[email protected]>
scsi: enclosure: Fix stale device oops with hot replug

David Howells <[email protected]>
keys: Fix request_key() cache

David Howells <[email protected]>
afs: Fix afs_lookup() to not clobber the version on a new dentry

David Howells <[email protected]>
afs: Fix use-after-loss-of-ref

Andrii Nakryiko <[email protected]>
libbpf: Fix Makefile' libbpf symbol mismatch diagnostic

Stanislav Fomichev <[email protected]>
bpf: Support pre-2.25-binutils objcopy for vmlinux BTF

John Fastabend <[email protected]>
bpf: skmsg, fix potential psock NULL pointer dereference

Daniel Borkmann <[email protected]>
bpf: Make use of probe_user_write in probe write helper

Daniel Borkmann <[email protected]>
uaccess: Add non-pagefault user-space write function

Bart Van Assche <[email protected]>
RDMA/srpt: Report the SCSI residual to the initiator

Leon Romanovsky <[email protected]>
RDMA/mlx5: Return proper error value

Jason Gunthorpe <[email protected]>
rdma: Remove nes ABI header

Yangyang Li <[email protected]>
RDMA/hns: Bugfix for qpc/cqc timer configuration

Lijun Ou <[email protected]>
RDMA/hns: Fix to support 64K page for srq

Chuck Lever <[email protected]>
xprtrdma: Close window between waking RPC senders and posting Receives

Chuck Lever <[email protected]>
xprtrdma: Fix MR list handling

Chuck Lever <[email protected]>
xprtrdma: Connection becomes unstable after a reconnect

Chuck Lever <[email protected]>
xprtrdma: Add unique trace points for posting Local Invalidate WRs

Yangyang Li <[email protected]>
RDMA/hns: Release qp resources when failed to destroy qp

Arnd Bergmann <[email protected]>
RDMA/hns: Fix build error again

Bart Van Assche <[email protected]>
RDMA/siw: Fix port number endianness in a debug message

Mark Zhang <[email protected]>
RDMA/counter: Prevent QP counter manual binding in auto mode

Lang Cheng <[email protected]>
RDMA/hns: Modify return value of restrack functions

Weihang Li <[email protected]>
RDMA/hns: remove a redundant le16_to_cpu

Jason Gunthorpe <[email protected]>
RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()

Nilkanth Ahirrao <[email protected]>
ASoC: rsnd: fix DALIGN register for SSIU

Takashi Iwai <[email protected]>
ASoC: core: Fix compile warning with CONFIG_DEBUG_FS=n

Pierre-Louis Bossart <[email protected]>
ASoC: SOF: Intel: Broadwell: clarify mutual exclusion with legacy driver

Shengjiu Wang <[email protected]>
ASoC: fsl_esai: Add spin lock to protect reset, stop and start

Daniel Baluta <[email protected]>
ASoC: simple_card_utils.h: Add missing include

Tzung-Bi Shih <[email protected]>
ASoC: dt-bindings: mt8183: add missing update

Arnd Bergmann <[email protected]>
netfilter: nft_meta: use 64-bit time arithmetic

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables_offload: release flow_rule on error from commit path

Goldwyn Rodrigues <[email protected]>
btrfs: simplify inode locking for RWF_NOWAIT

Taehee Yoo <[email protected]>
hsr: fix slab-out-of-bounds Read in hsr_debugfs_rename()

Sami Tolvanen <[email protected]>
syscalls/x86: Fix function types in COND_SYSCALL

Sami Tolvanen <[email protected]>
syscalls/x86: Use the correct function type for sys_ni_syscall

Sami Tolvanen <[email protected]>
syscalls/x86: Use COMPAT_SYSCALL_DEFINE0 for IA32 (rt_)sigreturn

Andy Lutomirski <[email protected]>
syscalls/x86: Wire up COMPAT_SYSCALL_DEFINE0

Ed Maste <[email protected]>
perf vendor events s390: Remove name from L1D_RO_EXCL_WRITES description

David Howells <[email protected]>
afs: Fix missing cell comparison in afs_test_super()

Florian Fainelli <[email protected]>
reset: brcmstb: Remove resource checks

Florian Fainelli <[email protected]>
dt-bindings: reset: Fix brcmstb-reset example

Marc Kleine-Budde <[email protected]>
can: j1939: fix address claim code example

Christian Lamparter <[email protected]>
ath9k: use iowrite32 over __raw_writel

Andy Shevchenko <[email protected]>
MAINTAINERS: Append missed file to the database

Paul Menzel <[email protected]>
scsi: smartpqi: Update attribute name to driver_version

Nathan Chancellor <[email protected]>
cifs: Adjust indentation in smb2_open_file

Julian Wiedmann <[email protected]>
s390/qeth: fix initialization on old HW

Alexandra Winter <[email protected]>
s390/qeth: vnicc Fix init to default

Alexandra Winter <[email protected]>
s390/qeth: Fix vnicc_is_in_use if rx_bcast not set

Alexandra Winter <[email protected]>
s390/qeth: fix false reporting of VNIC CHAR config failure

Julian Wiedmann <[email protected]>
s390/qeth: fix qdio teardown after early init error

Taehee Yoo <[email protected]>
hsr: reset network header when supervision frame is created

Taehee Yoo <[email protected]>
hsr: rename debugfs file when interface name is changed

Taehee Yoo <[email protected]>
hsr: add hsr root debugfs directory

Thierry Reding <[email protected]>
drm/tegra: Fix ordering of cleanup code

Neil Armstrong <[email protected]>
PCI: amlogic: Fix probed clock names

Arnd Bergmann <[email protected]>
PM / devfreq: tegra: Add COMMON_CLK dependency

Geert Uytterhoeven <[email protected]>
gpio: Fix error message on out-of-range GPIO in lookup table

Dan Carpenter <[email protected]>
scsi: mpt3sas: Fix double free in attach error handling

Ming Lei <[email protected]>
fs: move guard_bio_eod() after bio_set_op_attrs

Roman Gushchin <[email protected]>
bpf: cgroup: prevent out-of-order release of cgroup bpf

Jon Derrick <[email protected]>
iommu: Remove device link to group on failure

Jon Derrick <[email protected]>
iommu/vt-d: Unlink device if failed to add to group

Hangbin Liu <[email protected]>
selftests: loopback.sh: skip this test if the driver does not support

Qianggui Song <[email protected]>
pinctrl: meson: Fix wrong shift value when get drive-strength

Swapna Manupati <[email protected]>
gpio: zynq: Fix for bug in zynq_gpio_restore_context API

Peter Ujfalusi <[email protected]>
mtd: onenand: omap2: Pass correct flags for prep_dma_memcpy

Daniel Baluta <[email protected]>
ASoC: SOF: imx8: Fix dsp_box offset

wenxu <[email protected]>
netfilter: nft_flow_offload: fix underflow in flowtable reference counter

Arnd Bergmann <[email protected]>
pinctrl: lochnagar: select GPIOLIB

Olivier Moysan <[email protected]>
ASoC: stm32: spdifrx: fix input pin state management

Olivier Moysan <[email protected]>
ASoC: stm32: spdifrx: fix race condition in irq handler

Olivier Moysan <[email protected]>
ASoC: stm32: spdifrx: fix inconsistent lock state

Daniel Baluta <[email protected]>
ASoC: soc-core: Set dpcm_playback / dpcm_capture

Colin Ian King <[email protected]>

    ASoC: SOF: imx8: fix memory allocation failure check on priv->pd_dev

Stefan Wahren <[email protected]>
i2c: bcm2835: Store pointer to bus clock

Christophe Kerello <[email protected]>
mtd: rawnand: stm32_fmc2: avoid to lock the CPU bus

Kaike Wan <[email protected]>
IB/hfi1: Don't cancel unused work item

Selvin Xavier <[email protected]>
RDMA/bnxt_re: Fix Send Work Entry state check while polling completions

Selvin Xavier <[email protected]>
RDMA/bnxt_re: Avoid freeing MR resources if dereg fails

Tony Lindgren <[email protected]>
phy: mapphone-mdm6600: Fix uninitialized status value regression

Ran Bi <[email protected]>
rtc: mt6397: fix alarm register overwrite

Jiri Kosina <[email protected]>
HID: hidraw, uhid: Always report EPOLLOUT

-------------

Diffstat:

 Documentation/ABI/stable/sysfs-driver-mlxreg-io    |  13 +-
 Documentation/ABI/testing/sysfs-bus-mei            |   2 +-
 Documentation/admin-guide/device-mapper/index.rst  |   1 +
 .../bindings/reset/brcm,brcmstb-reset.txt          |   2 +-
 .../sound/mt8183-mt6358-ts3a227-max98357.txt       |   4 +-
 Documentation/networking/j1939.rst                 |   2 +-
 Documentation/scsi/smartpqi.txt                    |   2 +-
 MAINTAINERS                                        |   1 +
 Makefile                                           |   4 +-
 arch/arm/kernel/smp.c                              |   4 +
 arch/arm/kernel/topology.c                         |  10 +-
 arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi       |   2 +
 arch/arm64/crypto/aes-neonbs-glue.c                |   2 +-
 arch/hexagon/include/asm/atomic.h                  |   8 +-
 arch/hexagon/include/asm/bitops.h                  |   8 +-
 arch/hexagon/include/asm/cmpxchg.h                 |   2 +-
 arch/hexagon/include/asm/futex.h                   |   6 +-
 arch/hexagon/include/asm/spinlock.h                |  20 +-
 arch/hexagon/kernel/stacktrace.c                   |   4 +-
 arch/hexagon/kernel/vm_entry.S                     |   2 +-
 arch/mips/boot/compressed/Makefile                 |   3 +
 arch/mips/include/asm/vdso/gettimeofday.h          |  13 -
 arch/mips/kernel/cacheinfo.c                       |  27 +-
 arch/mips/pci/pci-xtalk-bridge.c                   |   5 +-
 arch/mips/sgi-ip27/ip27-irq.c                      |   4 +
 arch/mips/vdso/vgettimeofday.c                     |  20 +
 arch/nds32/include/asm/cacheflush.h                |  11 +-
 arch/powerpc/platforms/powernv/pci.c               |  17 +
 arch/riscv/mm/cacheflush.c                         |   1 +
 arch/x86/entry/syscall_32.c                        |   8 +-
 arch/x86/entry/syscall_64.c                        |  14 +-
 arch/x86/entry/syscalls/syscall_32.tbl             |   8 +-
 arch/x86/ia32/ia32_signal.c                        |   5 +-
 arch/x86/include/asm/syscall_wrapper.h             |  53 ++-
 block/bio.c                                        |  12 +-
 crypto/algif_skcipher.c                            |   2 +-
 drivers/clk/clk.c                                  |   1 +
 drivers/clk/imx/clk-pll14xx.c                      |  40 +-
 drivers/clk/meson/axg-audio.c                      |   2 +-
 drivers/clk/samsung/clk-exynos5420.c               |   2 +
 drivers/crypto/cavium/nitrox/nitrox_main.c         |   9 +-
 drivers/crypto/geode-aes.c                         | 440 +++++++--------------
 drivers/crypto/geode-aes.h                         |  15 +-
 drivers/crypto/hisilicon/Kconfig                   |   1 +
 drivers/crypto/virtio/virtio_crypto_algs.c         |   9 +
 drivers/devfreq/Kconfig                            |   1 +
 drivers/dma/dw/platform.c                          |   2 +-
 drivers/dma/ioat/dma.c                             |   3 +-
 drivers/dma/k3dma.c                                |  12 +-
 drivers/gpio/gpio-mpc8xxx.c                        |   1 +
 drivers/gpio/gpio-zynq.c                           |   8 +-
 drivers/gpio/gpiolib.c                             |   5 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu.h                |   1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c      |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.h      |   2 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |  61 +++
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.h         |   3 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c            |  85 +---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  99 ++---
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |  15 +-
 drivers/gpu/drm/amd/include/discovery.h            |   1 -
 drivers/gpu/drm/arm/malidp_mw.c                    |   2 +-
 drivers/gpu/drm/tegra/drm.c                        |  14 +-
 drivers/gpu/drm/virtio/virtgpu_ioctl.c             |  28 +-
 drivers/hid/hidraw.c                               |   7 +-
 drivers/hid/uhid.c                                 |   5 +-
 drivers/i2c/busses/i2c-bcm2835.c                   |  17 +-
 drivers/iio/imu/adis16480.c                        |   6 +-
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c       |   7 +-
 drivers/infiniband/core/counters.c                 |  12 +-
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |   4 +-
 drivers/infiniband/hw/bnxt_re/qplib_fp.c           |  12 +-
 drivers/infiniband/hw/hfi1/iowait.c                |   4 +-
 drivers/infiniband/hw/hns/Kconfig                  |  17 +-
 drivers/infiniband/hw/hns/Makefile                 |   8 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |  18 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.h         |   4 +-
 drivers/infiniband/hw/hns/hns_roce_qp.c            |  10 +-
 drivers/infiniband/hw/hns/hns_roce_restrack.c      |   2 +-
 drivers/infiniband/hw/mlx5/mr.c                    |   2 +-
 drivers/infiniband/sw/siw/siw_cm.c                 |   9 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c              |  24 ++
 drivers/iommu/intel-iommu.c                        |  13 +-
 drivers/iommu/iommu.c                              |   1 +
 drivers/iommu/mtk_iommu.c                          |  25 +-
 drivers/iommu/mtk_iommu.h                          |   1 +
 drivers/media/i2c/ov6650.c                         |  79 ++--
 drivers/media/platform/aspeed-video.c              |   3 +-
 drivers/media/platform/cadence/cdns-csi2rx.c       |   2 +-
 drivers/media/platform/coda/coda-common.c          |   4 +-
 drivers/media/platform/exynos4-is/fimc-isp-video.c |   2 +-
 drivers/media/platform/rcar-vin/rcar-v4l2.c        |   3 +-
 drivers/memory/mtk-smi.c                           |   4 +
 drivers/misc/enclosure.c                           |   3 +-
 drivers/mtd/nand/onenand/omap2.c                   |   3 +-
 drivers/mtd/nand/raw/stm32_fmc2_nand.c             |  38 +-
 drivers/mtd/spi-nor/spi-nor.c                      |   4 +-
 .../net/wireless/ath/ath9k/ath9k_pci_owl_loader.c  |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c        |  20 +-
 drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c     |   8 +-
 drivers/net/wireless/intel/iwlwifi/mvm/tx.c        |   7 +-
 drivers/net/wireless/realtek/rtlwifi/regd.c        |   2 +-
 drivers/net/wireless/rsi/rsi_91x_usb.c             |   2 +-
 drivers/pci/controller/dwc/pci-meson.c             |   6 +-
 drivers/pci/controller/dwc/pcie-designware-host.c  |  11 +-
 drivers/pci/controller/pci-aardvark.c              |  42 +-
 drivers/pci/hotplug/pciehp_core.c                  |  25 +-
 drivers/pci/pci-driver.c                           |   3 +-
 drivers/pci/pcie/ptm.c                             |   2 +-
 drivers/pci/probe.c                                |   1 +
 drivers/phy/motorola/phy-mapphone-mdm6600.c        |  11 +-
 drivers/pinctrl/cirrus/Kconfig                     |   1 +
 drivers/pinctrl/intel/pinctrl-lewisburg.c          | 171 ++++----
 drivers/pinctrl/meson/pinctrl-meson.c              |   1 +
 drivers/pinctrl/sh-pfc/core.c                      |  16 +-
 drivers/pinctrl/sh-pfc/sh_pfc.h                    |   4 +-
 drivers/pinctrl/ti/pinctrl-ti-iodelay.c            |   2 +-
 drivers/platform/mellanox/mlxbf-tmfifo.c           |  19 +-
 drivers/platform/mips/cpu_hwmon.c                  |   2 +-
 drivers/platform/x86/asus-wmi.c                    |   8 +-
 drivers/platform/x86/gpd-pocket-fan.c              |  25 +-
 drivers/reset/reset-brcmstb.c                      |   6 -
 drivers/rtc/rtc-bd70528.c                          |   1 +
 drivers/rtc/rtc-brcmstb-waketimer.c                |   1 +
 drivers/rtc/rtc-msm6242.c                          |   3 +-
 drivers/rtc/rtc-mt6397.c                           |  47 ++-
 drivers/s390/net/qeth_core_main.c                  |  29 +-
 drivers/s390/net/qeth_l2_main.c                    |  10 +-
 drivers/s390/net/qeth_l3_main.c                    |   2 +-
 drivers/s390/net/qeth_l3_sys.c                     |  40 +-
 drivers/scsi/cxgbi/libcxgbi.c                      |   3 +-
 drivers/scsi/mpt3sas/mpt3sas_base.c                |   1 -
 drivers/scsi/sd.c                                  |  18 +-
 drivers/scsi/ufs/ufs_bsg.c                         |   2 +-
 drivers/spi/spi-atmel.c                            |  10 +-
 drivers/spi/spi-fsl-lpspi.c                        |   2 +-
 drivers/spi/spi-pxa2xx.c                           |   7 +
 drivers/spi/spi-rspi.c                             |   8 +-
 drivers/spi/spi-sprd.c                             |   2 +-
 drivers/staging/media/hantro/hantro_g1_h264_dec.c  |   2 +-
 drivers/staging/media/hantro/hantro_h264.c         |  73 ++--
 drivers/staging/media/ipu3/include/intel-ipu3.h    |   2 +-
 drivers/staging/media/sunxi/cedrus/cedrus_h264.c   |   4 +-
 drivers/target/target_core_iblock.c                |   4 +-
 drivers/tty/serial/imx.c                           |   2 +-
 drivers/tty/serial/pch_uart.c                      |   5 +-
 fs/affs/super.c                                    |   6 -
 fs/afs/dir.c                                       |  18 +-
 fs/afs/super.c                                     |   1 +
 fs/btrfs/file.c                                    |   5 +-
 fs/buffer.c                                        |   8 +-
 fs/cifs/smb2file.c                                 |   2 +-
 fs/f2fs/data.c                                     |   2 +-
 fs/f2fs/file.c                                     |   2 +-
 fs/gfs2/file.c                                     |  30 ++
 fs/internal.h                                      |   2 +-
 fs/mpage.c                                         |   2 +-
 fs/nfs/nfs2xdr.c                                   |   2 +-
 fs/nfs/nfs4proc.c                                  |  38 +-
 fs/nfsd/Kconfig                                    |   2 +-
 fs/nfsd/nfs4proc.c                                 |   3 +-
 fs/nfsd/nfs4recover.c                              |  12 +-
 fs/ocfs2/journal.c                                 |   8 +
 fs/ubifs/journal.c                                 |   2 +-
 fs/ubifs/orphan.c                                  |  17 +-
 fs/ubifs/super.c                                   |   4 +-
 include/asm-generic/cacheflush.h                   |  33 +-
 include/crypto/internal/skcipher.h                 |  30 --
 include/crypto/skcipher.h                          |  30 ++
 include/linux/uaccess.h                            |  12 +
 include/sound/simple_card_utils.h                  |   1 +
 include/trace/events/afs.h                         |  12 +-
 include/trace/events/rpcrdma.h                     |  25 ++
 include/uapi/rdma/nes-abi.h                        | 115 ------
 kernel/bpf/cgroup.c                                |  11 +-
 kernel/cred.c                                      |   4 +-
 kernel/trace/bpf_trace.c                           |   6 +-
 mm/maccess.c                                       |  45 ++-
 net/core/skmsg.c                                   |  13 +-
 net/hsr/hsr_debugfs.c                              |  36 +-
 net/hsr/hsr_device.c                               |   2 +
 net/hsr/hsr_main.c                                 |   5 +
 net/hsr/hsr_main.h                                 |  10 +
 net/hsr/hsr_netlink.c                              |   1 +
 net/netfilter/nf_tables_offload.c                  |  26 +-
 net/netfilter/nft_flow_offload.c                   |   3 -
 net/netfilter/nft_meta.c                           |  10 +-
 net/rxrpc/ar-internal.h                            |  10 +-
 net/rxrpc/call_accept.c                            |  60 +--
 net/rxrpc/conn_event.c                             |  16 +-
 net/rxrpc/conn_service.c                           |   4 +
 net/rxrpc/input.c                                  |  18 -
 net/rxrpc/rxkad.c                                  |   5 +-
 net/rxrpc/security.c                               |  70 ++--
 net/sched/sch_cake.c                               |   1 +
 net/socket.c                                       |   1 +
 net/sunrpc/xprtrdma/frwr_ops.c                     |   4 +-
 net/sunrpc/xprtrdma/rpc_rdma.c                     |   1 +
 net/sunrpc/xprtrdma/transport.c                    |   3 +
 net/sunrpc/xprtrdma/verbs.c                        | 103 +++--
 net/sunrpc/xprtrdma/xprt_rdma.h                    |   3 +
 net/unix/af_unix.c                                 |  19 +
 scripts/link-vmlinux.sh                            |   7 +-
 scripts/package/mkdebian                           |   2 +-
 security/tomoyo/common.c                           |   9 +-
 security/tomoyo/domain.c                           |  15 +-
 security/tomoyo/group.c                            |   9 +-
 security/tomoyo/util.c                             |   6 +-
 sound/soc/fsl/fsl_esai.c                           |  12 +
 sound/soc/intel/Kconfig                            |   3 +
 sound/soc/sh/rcar/core.c                           |  20 +-
 sound/soc/soc-core.c                               |   2 +
 sound/soc/soc-pcm.c                                |   2 +
 sound/soc/sof/imx/imx8.c                           |   5 +-
 sound/soc/sof/intel/Kconfig                        |  10 +-
 sound/soc/stm/stm32_spdifrx.c                      |  40 +-
 tools/lib/bpf/Makefile                             |   2 +-
 tools/pci/pcitest.c                                |   1 +
 .../perf/pmu-events/arch/s390/cf_z14/extended.json |   2 +-
 tools/testing/selftests/firmware/fw_lib.sh         |   6 +
 tools/testing/selftests/net/forwarding/loopback.sh |   8 +
 tools/testing/selftests/rseq/settings              |   1 +
 222 files changed, 1849 insertions(+), 1423 deletions(-)

From: Jiri Kosina <[email protected]>

[ Upstream commit 9e635c2851df6caee651e589fbf937b637973c91 ]

hidraw and uhid device nodes are always available for writing so we should always report EPOLLOUT and EPOLLWRNORM bits, not only in the cases when there is nothing to read.

---
 drivers/hid/hidraw.c |    7 ++++---
 drivers/hid/uhid.c   |    5 +++--
 2 files changed, 7 insertions(+), 5 deletions(-)

@@ -249,13 +249,14 @@ out:
 static __poll_t hidraw_poll(struct file *file, poll_table *wait)
 {
 	struct hidraw_list *list = file->private_data;
+	__poll_t mask = EPOLLOUT | EPOLLWRNORM; /* hidraw is always writable */
 
 	poll_wait(file, &list->hidraw->wait, wait);
 	if (list->head != list->tail)
-		return EPOLLIN | EPOLLRDNORM;
+		mask |= EPOLLIN | EPOLLRDNORM;
 	if (!list->hidraw->exist)
-		return EPOLLERR | EPOLLHUP;
-	return EPOLLOUT | EPOLLWRNORM;
+		mask |= EPOLLERR | EPOLLHUP;
+	return mask;
 }
 
 static int hidraw_open(struct inode *inode, struct file *file)

@@ -766,13 +766,14 @@ unlock:
 static __poll_t uhid_char_poll(struct file *file, poll_table *wait)
 {
 	struct uhid_device *uhid = file->private_data;
+	__poll_t mask = EPOLLOUT | EPOLLWRNORM; /* uhid is always writable */
 
 	poll_wait(file, &uhid->waitq, wait);
 
 	if (uhid->head != uhid->tail)
-		return EPOLLIN | EPOLLRDNORM;
+		mask |= EPOLLIN | EPOLLRDNORM;
 
-	return EPOLLOUT | EPOLLWRNORM;
+	return mask;
 }
 
 static const struct file_operations uhid_fops = {

From: Ran Bi <[email protected]>

commit 653997eeecef95c3ead4fba1b2d27e6a5854d6cd upstream.

Alarm registers high byte was reserved for other functions. This add mask in alarm registers operation functions. This also fix error condition in interrupt handler.

---
 drivers/rtc/rtc-mt6397.c |   47 +++++++++++++++++++++++++++++++++--------------
 1 file changed, 33 insertions(+), 14 deletions(-)

@@ -47,6 +47,14 @@
 
 #define RTC_AL_SEC		0x0018
 
+#define RTC_AL_SEC_MASK		0x003f
+#define RTC_AL_MIN_MASK		0x003f
+#define RTC_AL_HOU_MASK		0x001f
+#define RTC_AL_DOM_MASK		0x001f
+#define RTC_AL_DOW_MASK		0x0007
+#define RTC_AL_MTH_MASK		0x000f
+#define RTC_AL_YEA_MASK		0x007f
+
 #define RTC_PDN2		0x002e
 #define RTC_PDN2_PWRON_ALARM	BIT(4)
 

@@ -103,7 +111,7 @@ static irqreturn_t mtk_rtc_irq_handler_t
 		irqen = irqsta & ~RTC_IRQ_EN_AL;
 		mutex_lock(&rtc->lock);
 		if (regmap_write(rtc->regmap, rtc->addr_base + RTC_IRQ_EN,
-				 irqen) < 0)
+				 irqen) == 0)
 			mtk_rtc_write_trigger(rtc);
 		mutex_unlock(&rtc->lock);
 

@@ -225,12 +233,12 @@ static int mtk_rtc_read_alarm(struct dev
 	alm->pending = !!(pdn2 & RTC_PDN2_PWRON_ALARM);
 	mutex_unlock(&rtc->lock);
 
-	tm->tm_sec = data[RTC_OFFSET_SEC];
-	tm->tm_min = data[RTC_OFFSET_MIN];
-	tm->tm_hour = data[RTC_OFFSET_HOUR];
-	tm->tm_mday = data[RTC_OFFSET_DOM];
-	tm->tm_mon = data[RTC_OFFSET_MTH];
-	tm->tm_year = data[RTC_OFFSET_YEAR];
+	tm->tm_sec = data[RTC_OFFSET_SEC] & RTC_AL_SEC_MASK;
+	tm->tm_min = data[RTC_OFFSET_MIN] & RTC_AL_MIN_MASK;
+	tm->tm_hour = data[RTC_OFFSET_HOUR] & RTC_AL_HOU_MASK;
+	tm->tm_mday = data[RTC_OFFSET_DOM] & RTC_AL_DOM_MASK;
+	tm->tm_mon = data[RTC_OFFSET_MTH] & RTC_AL_MTH_MASK;
+	tm->tm_year = data[RTC_OFFSET_YEAR] & RTC_AL_YEA_MASK;
 
 	tm->tm_year += RTC_MIN_YEAR_OFFSET;
 	tm->tm_mon--;

@@ -251,14 +259,25 @@ static int mtk_rtc_set_alarm(struct devi
 	tm->tm_year -= RTC_MIN_YEAR_OFFSET;
 	tm->tm_mon++;
 
-	data[RTC_OFFSET_SEC] = tm->tm_sec;
-	data[RTC_OFFSET_MIN] = tm->tm_min;
-	data[RTC_OFFSET_HOUR] = tm->tm_hour;
-	data[RTC_OFFSET_DOM] = tm->tm_mday;
-	data[RTC_OFFSET_MTH] = tm->tm_mon;
-	data[RTC_OFFSET_YEAR] = tm->tm_year;
-
 	mutex_lock(&rtc->lock);
+	ret = regmap_bulk_read(rtc->regmap, rtc->addr_base + RTC_AL_SEC,
+			       data, RTC_OFFSET_COUNT);
+	if (ret < 0)
+		goto exit;
+
+	data[RTC_OFFSET_SEC] = ((data[RTC_OFFSET_SEC] & ~(RTC_AL_SEC_MASK)) |
+				(tm->tm_sec & RTC_AL_SEC_MASK));
+	data[RTC_OFFSET_MIN] = ((data[RTC_OFFSET_MIN] & ~(RTC_AL_MIN_MASK)) |
+				(tm->tm_min & RTC_AL_MIN_MASK));
+	data[RTC_OFFSET_HOUR] = ((data[RTC_OFFSET_HOUR] & ~(RTC_AL_HOU_MASK)) |
+				(tm->tm_hour & RTC_AL_HOU_MASK));
+	data[RTC_OFFSET_DOM] = ((data[RTC_OFFSET_DOM] & ~(RTC_AL_DOM_MASK)) |
+				(tm->tm_mday & RTC_AL_DOM_MASK));
+	data[RTC_OFFSET_MTH] = ((data[RTC_OFFSET_MTH] & ~(RTC_AL_MTH_MASK)) |
+				(tm->tm_mon & RTC_AL_MTH_MASK));
+	data[RTC_OFFSET_YEAR] = ((data[RTC_OFFSET_YEAR] & ~(RTC_AL_YEA_MASK)) |
+				(tm->tm_year & RTC_AL_YEA_MASK));
+
 	if (alm->enabled) {
 		ret = regmap_bulk_write(rtc->regmap,
 					rtc->addr_base + RTC_AL_SEC,

From: Tony Lindgren <[email protected]>

commit af5d44de571811a151510bfd1236407b7f551cd9 upstream.

Only the used bits get cleared with bitmap_zero() when we call gpiod_get_array_value_cansleep(). We must mask only the bits we're using for ddata->status as the other bits in the bitmap may not be initialized.

And let's also drop useless debug code accidentally left over while at it.

---
 drivers/phy/motorola/phy-mapphone-mdm6600.c |   11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

@@ -200,7 +200,7 @@ static void phy_mdm6600_status(struct wo
 	struct phy_mdm6600 *ddata;
 	struct device *dev;
 	DECLARE_BITMAP(values, PHY_MDM6600_NR_STATUS_LINES);
-	int error, i, val = 0;
+	int error;
 
 	ddata = container_of(work, struct phy_mdm6600, status_work.work);
 	dev = ddata->dev;

@@ -212,16 +212,11 @@ static void phy_mdm6600_status(struct wo
 	if (error)
 		return;
 
-	for (i = 0; i < PHY_MDM6600_NR_STATUS_LINES; i++) {
-		val |= test_bit(i, values) << i;
-		dev_dbg(ddata->dev, "XXX %s: i: %i values[i]: %i val: %i\n",
-			__func__, i, test_bit(i, values), val);
-	}
-	ddata->status = values[0];
+	ddata->status = values[0] & ((1 << PHY_MDM6600_NR_STATUS_LINES) - 1);
 
 	dev_info(dev, "modem status: %i %s\n",
 		 ddata->status,
-		 phy_mdm6600_status_name[ddata->status & 7]);
+		 phy_mdm6600_status_name[ddata->status]);
 	complete(&ddata->ack);
 }
 

From: Selvin Xavier <[email protected]>

commit 9a4467a6b282a299b932608ac2c9034f8415359f upstream.

The driver returns an error code for MR dereg, but frees the MR structure. When the MR dereg is retried due to previous error, the system crashes as the structure is already freed.

  BUG: unable to handle kernel NULL pointer dereference at 00000000000001b8
  PGD 0 P4D 0
  Oops: 0000 [#1] SMP PTI
  CPU: 7 PID: 12178 Comm: ib_send_bw Kdump: loaded Not tainted 4.18.0-124.el8.x86_64 #1
  Hardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 1.1.10 03/10/2015
  RIP: 0010:__dev_printk+0x2a/0x70
  Code: 0f 1f 44 00 00 49 89 d1 48 85 f6 0f 84 f6 2b 00 00 4c 8b 46 70 4d 85 c0 75 04 4c 8b

46 10 48 8b 86 a8 00 00 00 48 85 c0 74 16 <48> 8b 08 0f be 7f 01 48 c7 c2 13 ac ac 83 83 ef 30 e9 10 fe ff ff
RSP: 0018:ffffaf7c04607a60 EFLAGS: 00010006
RAX: 00000000000001b8 RBX: ffffa0010c91c488 RCX: 0000000000000246
RDX: ffffaf7c04607a68 RSI: ffffa0010c91caa8 RDI: ffffffff83a788eb
RBP: ffffaf7c04607ac8 R08: 0000000000000000 R09: ffffaf7c04607a68
R10: 0000000000000000 R11: 0000000000000001 R12: ffffaf7c04607b90
R13: 000000000000000e R14: 0000000000000000 R15: 00000000ffffa001
FS: 0000146fa1f1cdc0(0000) GS:ffffa0012fac0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000001b8 CR3: 000000007680a003 CR4: 00000000001606e0

  Call Trace:
   dev_err+0x6c/0x90
   ? dev_printk_emit+0x4e/0x70
   bnxt_qplib_rcfw_send_message+0x594/0x660 [bnxt_re]
   ? dev_err+0x6c/0x90
   bnxt_qplib_free_mrw+0x80/0xe0 [bnxt_re]
   bnxt_re_dereg_mr+0x2e/0xd0 [bnxt_re]
   ib_dereg_mr+0x2f/0x50 [ib_core]
   destroy_hw_idr_uobject+0x20/0x70 [ib_uverbs]
   uverbs_destroy_uobject+0x2e/0x170 [ib_uverbs]
   __uverbs_cleanup_ufile+0x6e/0x90 [ib_uverbs]
   uverbs_destroy_ufile_hw+0x61/0x130 [ib_uverbs]
   ib_uverbs_close+0x1f/0x80 [ib_uverbs]
   __fput+0xb7/0x230
   task_work_run+0x8a/0xb0
   do_exit+0x2da/0xb40
...
  RIP: 0033:0x146fa113a387
  Code: Bad RIP value.
  RSP: 002b:00007fff945d1478 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff02
  RAX: 0000000000000000 RBX: 000055a248908d70 RCX: 0000000000000000
  RDX: 0000146fa1f2b000 RSI: 0000000000000001 RDI: 000055a248906488
  RBP: 000055a248909630 R08: 0000000000010000 R09: 0000000000000000
  R10: 0000000000000000 R11: 0000000000000000 R12: 000055a248906488
  R13: 0000000000000001 R14: 0000000000000000 R15: 000055a2489095f0

Do not free the MR structures, when driver returns error to the stack.

---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -3323,8 +3323,10 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr
 	int rc;
 
 	rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
-	if (rc)
+	if (rc) {
 		dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc);
+		return rc;
+	}
 
 	if (mr->pages) {
 		rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res,

From: Selvin Xavier <[email protected]>

commit c5275723580922e5f3264f96751337661a153c7d upstream.

Some adapters need a fence Work Entry to handle retransmission. Currently the driver checks for this condition, only if the Send queue entry is signalled. Implement the condition check, irrespective of the signalled state of the Work queue entries

Failure to add the fence can result in access to memory that is already marked as completed, triggering data corruption, transmission failure, IOMMU failures, etc.

---
 drivers/infiniband/hw/bnxt_re/qplib_fp.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

@@ -2283,13 +2283,13 @@ static int bnxt_qplib_cq_process_req(str
 			/* Add qp to flush list of the CQ */
 			bnxt_qplib_add_flush_qp(qp);
 		} else {
+			/* Before we complete, do WA 9060 */
+			if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
+				      cqe_sq_cons)) {
+				*lib_qp = qp;
+				goto out;
+			}
 			if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) {
-				/* Before we complete, do WA 9060 */
-				if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
-					      cqe_sq_cons)) {
-					*lib_qp = qp;
-					goto out;
-				}
 				cqe->status = CQ_REQ_STATUS_OK;
 				cqe++;
 				(*budget)--;

From: Kaike Wan <[email protected]>

commit ca9033ba69c7e3477f207df69867b2ea969197c8 upstream.

In the iowait structure, two iowait_work entries were included to queue a given object: one for normal IB operations, and the other for TID RDMA operations. For non-TID RDMA operations, the iowait_work structure for TID RDMA is initialized to contain a NULL function (not used). When the QP is reset, the function iowait_cancel_work will be called to cancel any pending work. The problem is that this function will call cancel_work_sync() for both iowait_work entries, even though the one for TID RDMA is not used at all. Eventually, the call cascades to __flush_work(), wherein a WARN_ON will be triggered due to the fact that work->func is NULL.

The WARN_ON was introduced in commit 4d43d395fed1 ("workqueue: Try to catch flush_work() without INIT_WORK().")

This patch fixes the issue by making sure that a work function is present for TID RDMA before calling cancel_work_sync in iowait_cancel_work.

---
 drivers/infiniband/hw/hfi1/iowait.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -81,7 +81,9 @@ void iowait_init(struct iowait *wait, u3
 void iowait_cancel_work(struct iowait *w)
 {
 	cancel_work_sync(&iowait_get_ib_work(w)->iowork);
-	cancel_work_sync(&iowait_get_tid_work(w)->iowork);
+	/* Make sure that the iowork for TID RDMA is used */
+	if (iowait_get_tid_work(w)->iowork.func)
+		cancel_work_sync(&iowait_get_tid_work(w)->iowork);
 }
 
 /**

From: Christophe Kerello <[email protected]>

commit 4114b17af41272e14939b000ce8f3ed7ba937e3c upstream.

We are currently using nand_soft_waitrdy to poll the status of the NAND flash. FMC2 enables the wait feature bit (this feature is mandatory for the sequencer mode). By enabling this feature, we can't poll the status of the NAND flash, the read status command is stucked in FMC2 pipeline until R/B# signal is high, and locks the CPU bus.
To avoid to lock the CPU bus, we poll FMC2 ISR register. This register reports the status of the R/B# signal.

---
 drivers/mtd/nand/raw/stm32_fmc2_nand.c |   38 +++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

@@ -37,6 +37,7 @@
 /* Max ECC buffer length */
 #define FMC2_MAX_ECC_BUF_LEN		(FMC2_BCHDSRS_LEN * FMC2_MAX_SG)
 
+#define FMC2_TIMEOUT_US			1000
 #define FMC2_TIMEOUT_MS			1000
 
 /* Timings */

@@ -53,6 +54,8 @@
 #define FMC2_PMEM			0x88
 #define FMC2_PATT			0x8c
 #define FMC2_HECCR			0x94
+#define FMC2_ISR			0x184
+#define FMC2_ICR			0x188
 #define FMC2_CSQCR			0x200
 #define FMC2_CSQCFGR1			0x204
 #define FMC2_CSQCFGR2			0x208

@@ -118,6 +121,12 @@
 #define FMC2_PATT_ATTHIZ(x)		(((x) & 0xff) << 24)
 #define FMC2_PATT_DEFAULT		0x0a0a0a0a
 
+/* Register: FMC2_ISR */
+#define FMC2_ISR_IHLF			BIT(1)
+
+/* Register: FMC2_ICR */
+#define FMC2_ICR_CIHLF			BIT(1)
+
 /* Register: FMC2_CSQCR */
 #define FMC2_CSQCR_CSQSTART		BIT(0)
 

@@ -1322,6 +1331,31 @@ static void stm32_fmc2_write_data(struct
 		stm32_fmc2_set_buswidth_16(fmc2, true);
 }
 
+static int stm32_fmc2_waitrdy(struct nand_chip *chip, unsigned long timeout_ms)
+{
+	struct stm32_fmc2_nfc *fmc2 = to_stm32_nfc(chip->controller);
+	const struct nand_sdr_timings *timings;
+	u32 isr, sr;
+
+	/* Check if there is no pending requests to the NAND flash */
+	if (readl_relaxed_poll_timeout_atomic(fmc2->io_base + FMC2_SR, sr,
+					      sr & FMC2_SR_NWRF, 1,
+					      FMC2_TIMEOUT_US))
+		dev_warn(fmc2->dev, "Waitrdy timeout\n");
+
+	/* Wait tWB before R/B# signal is low */
+	timings = nand_get_sdr_timings(&chip->data_interface);
+	ndelay(PSEC_TO_NSEC(timings->tWB_max));
+
+	/* R/B# signal is low, clear high level flag */
+	writel_relaxed(FMC2_ICR_CIHLF, fmc2->io_base + FMC2_ICR);
+
+	/* Wait R/B# signal is high */
+	return readl_relaxed_poll_timeout_atomic(fmc2->io_base + FMC2_ISR,
+						 isr, isr & FMC2_ISR_IHLF,
+						 5, 1000 * timeout_ms);
+}
+
 static int stm32_fmc2_exec_op(struct nand_chip *chip,
 			      const struct nand_operation *op,
 			      bool check_only)

@@ -1366,8 +1400,8 @@ static int stm32_fmc2_exec_op(struct nan
 			break;
 
 		case NAND_OP_WAITRDY_INSTR:
-			ret = nand_soft_waitrdy(chip,
-						instr->ctx.waitrdy.timeout_ms);
+			ret = stm32_fmc2_waitrdy(chip,
+						 instr->ctx.waitrdy.timeout_ms);
 			break;
 		}
 	}

From: Stefan Wahren <[email protected]>

commit 3b722da6672df8392f9c43d7c7e04bddd81d7e37 upstream.

The commit bebff81fb8b9 ("i2c: bcm2835: Model Divider in CCF") introduced a NULL pointer dereference on driver unload. It seems that we can't fetch the bus clock via devm_clk_get in bcm2835_i2c_remove. As an alternative approach store a pointer to the bus clock in the private driver structure.

---
 drivers/i2c/busses/i2c-bcm2835.c |   17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

@@ -58,6 +58,7 @@ struct bcm2835_i2c_dev {
 	struct i2c_adapter adapter;
 	struct completion completion;
 	struct i2c_msg *curr_msg;
+	struct clk *bus_clk;
 	int num_msgs;
 	u32 msg_err;
 	u8 *msg_buf;

@@ -404,7 +405,6 @@ static int bcm2835_i2c_probe(struct plat
 	struct resource *mem, *irq;
 	int ret;
 	struct i2c_adapter *adap;
-	struct clk *bus_clk;
 	struct clk *mclk;
 	u32 bus_clk_rate;
 

@@ -427,11 +427,11 @@ static int bcm2835_i2c_probe(struct plat
 		return PTR_ERR(mclk);
 	}
 
-	bus_clk = bcm2835_i2c_register_div(&pdev->dev, mclk, i2c_dev);
+	i2c_dev->bus_clk = bcm2835_i2c_register_div(&pdev->dev, mclk, i2c_dev);
 
-	if (IS_ERR(bus_clk)) {
+	if (IS_ERR(i2c_dev->bus_clk)) {
 		dev_err(&pdev->dev, "Could not register clock\n");
-		return PTR_ERR(bus_clk);
+		return PTR_ERR(i2c_dev->bus_clk);
 	}
 
 	ret = of_property_read_u32(pdev->dev.of_node, "clock-frequency",

@@ -442,13 +442,13 @@ static int bcm2835_i2c_probe(struct plat
 		bus_clk_rate = 100000;
 	}
 
-	ret = clk_set_rate_exclusive(bus_clk, bus_clk_rate);
+	ret = clk_set_rate_exclusive(i2c_dev->bus_clk, bus_clk_rate);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "Could not set clock frequency\n");
 		return ret;
 	}
 
-	ret = clk_prepare_enable(bus_clk);
+	ret = clk_prepare_enable(i2c_dev->bus_clk);
 	if (ret) {
 		dev_err(&pdev->dev, "Couldn't prepare clock");
 		return ret;

@@ -491,10 +491,9 @@ static int bcm2835_i2c_probe(struct plat
 static int bcm2835_i2c_remove(struct platform_device *pdev)
 {
 	struct bcm2835_i2c_dev *i2c_dev = platform_get_drvdata(pdev);
-	struct clk *bus_clk = devm_clk_get(i2c_dev->dev, "div");
 
-	clk_rate_exclusive_put(bus_clk);
-	clk_disable_unprepare(bus_clk);
+	clk_rate_exclusive_put(i2c_dev->bus_clk);
+	clk_disable_unprepare(i2c_dev->bus_clk);
 
 	free_irq(i2c_dev->irq, i2c_dev);
 	i2c_del_adapter(&i2c_dev->adapter);

From: Colin Ian King <[email protected]>

commit 98910e1d61384430a080b4bcf986c3b0cf3fdf46 upstream.

The memory allocation failure check for priv->pd_dev is incorrectly pointer checking priv instead of priv->pd_dev. Fix this.

Addresses-Coverity: ("Logically dead code")

---
 sound/soc/sof/imx/imx8.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -209,7 +209,7 @@ static int imx8_probe(struct snd_sof_dev
 
 	priv->pd_dev = devm_kmalloc_array(&pdev->dev, priv->num_domains,
 					  sizeof(*priv->pd_dev), GFP_KERNEL);
-	if (!priv)
+	if (!priv->pd_dev)
 		return -ENOMEM;
 
 	priv->link = devm_kmalloc_array(&pdev->dev, priv->num_domains,

From: Daniel Baluta <[email protected]>

commit 218fe9b7ec7f32c10a07539365488d80af7b0084 upstream.

When converting a normal link to a DPCM link we need to set dpcm_playback / dpcm_capture otherwise playback/capture streams will not be created resulting in errors like this:

[   36.039111]  sai1-wm8960-hifi: ASoC: no backend playback stream

---
 sound/soc/soc-core.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -1886,6 +1886,8 @@ match:
 
 			/* convert non BE into BE */
 			dai_link->no_pcm = 1;
+			dai_link->dpcm_playback = 1;
+			dai_link->dpcm_capture = 1;
 
 			/* override any BE fixups */
 			dai_link->be_hw_params_fixup =

From: Olivier Moysan <[email protected]>

commit 2859b1784031b5709446af8f6039c467f136e67d upstream.

In current spdifrx driver locks may be requested as follows:
- request lock on iec capture control, when starting synchronization.
- request lock in interrupt context, when spdifrx stop is called from IRQ handler.

Take lock with IRQs disabled, to avoid the possible deadlock.

Lockdep report:

[   74.278059] ================================
[   74.282306] WARNING: inconsistent lock state
[   74.290120] --------------------------------
...
[   74.314373]        CPU0
[   74.314377]        ----
[   74.314381]   lock(&(&spdifrx->lock)->rlock);
[   74.314396]   <Interrupt>
[   74.314400]     lock(&(&spdifrx->lock)->rlock);

---
 sound/soc/stm/stm32_spdifrx.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

@@ -320,6 +320,7 @@ static void stm32_spdifrx_dma_ctrl_stop(
 static int stm32_spdifrx_start_sync(struct stm32_spdifrx_data *spdifrx)
 {
 	int cr, cr_mask, imr, ret;
+	unsigned long flags;
 
 	/* Enable IRQs */
 	imr = SPDIFRX_IMR_IFEIE | SPDIFRX_IMR_SYNCDIE | SPDIFRX_IMR_PERRIE;

@@ -327,7 +328,7 @@ static int stm32_spdifrx_start_sync(stru
 	if (ret)
 		return ret;
 
-	spin_lock(&spdifrx->lock);
+	spin_lock_irqsave(&spdifrx->lock, flags);
 
 	spdifrx->refcount++;
 

@@ -360,7 +361,7 @@ static int stm32_spdifrx_start_sync(stru
 				"Failed to start synchronization\n");
 	}
 
-	spin_unlock(&spdifrx->lock);
+	spin_unlock_irqrestore(&spdifrx->lock, flags);
 
 	return ret;
 }

@@ -368,11 +369,12 @@ static int stm32_spdifrx_start_sync(stru
 static void stm32_spdifrx_stop(struct stm32_spdifrx_data *spdifrx)
 {
 	int cr, cr_mask, reg;
+	unsigned long flags;
 
-	spin_lock(&spdifrx->lock);
+	spin_lock_irqsave(&spdifrx->lock, flags);
 
 	if (--spdifrx->refcount) {
-		spin_unlock(&spdifrx->lock);
+		spin_unlock_irqrestore(&spdifrx->lock, flags);
 		return;
 	}
 

@@ -391,7 +393,7 @@ static void stm32_spdifrx_stop(struct st
 	regmap_read(spdifrx->regmap, STM32_SPDIFRX_DR, &reg);
 	regmap_read(spdifrx->regmap, STM32_SPDIFRX_CSR, &reg);
 
-	spin_unlock(&spdifrx->lock);
+	spin_unlock_irqrestore(&spdifrx->lock, flags);
 }
 
 static int stm32_spdifrx_dma_ctrl_register(struct device *dev,

From: Olivier Moysan <[email protected]>

commit 86e1956af4c863d653136fd6e5694adf2054dbaa upstream.

When snd_pcm_stop() is called in interrupt routine, substream context may have already been released. Add protection on substream context.

---
 sound/soc/stm/stm32_spdifrx.c |   24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

@@ -220,6 +220,7 @@
  * @slave_config: dma slave channel runtime config pointer
  * @phys_addr: SPDIFRX registers physical base address
  * @lock: synchronization enabling lock
+ * @irq_lock: prevent race condition with IRQ on stream state
  * @cs: channel status buffer
  * @ub: user data buffer
  * @irq: SPDIFRX interrupt line

@@ -240,6 +241,7 @@ struct stm32_spdifrx_data {
 	struct dma_slave_config slave_config;
 	dma_addr_t phys_addr;
 	spinlock_t lock;  /* Sync enabling lock */
+	spinlock_t irq_lock; /* Prevent race condition on stream state */
 	unsigned char cs[SPDIFRX_CS_BYTES_NB];
 	unsigned char ub[SPDIFRX_UB_BYTES_NB];
 	int irq;

@@ -665,7 +667,6 @@ static const struct regmap_config stm32_
 static irqreturn_t stm32_spdifrx_isr(int irq, void *devid)
 {
 	struct stm32_spdifrx_data *spdifrx = (struct stm32_spdifrx_data *)devid;
-	struct snd_pcm_substream *substream = spdifrx->substream;
 	struct platform_device *pdev = spdifrx->pdev;
 	unsigned int cr, mask, sr, imr;
 	unsigned int flags;

@@ -733,14 +734,19 @@ static irqreturn_t stm32_spdifrx_isr(int
 		regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_CR,
 				   SPDIFRX_CR_SPDIFEN_MASK, cr);
 
-		if (substream)
-			snd_pcm_stop(substream, SNDRV_PCM_STATE_DISCONNECTED);
+		spin_lock(&spdifrx->irq_lock);
+		if (spdifrx->substream)
+			snd_pcm_stop(spdifrx->substream,
+				     SNDRV_PCM_STATE_DISCONNECTED);
+		spin_unlock(&spdifrx->irq_lock);
 
 		return IRQ_HANDLED;
 	}
 
-	if (err_xrun && substream)
-		snd_pcm_stop_xrun(substream);
+	spin_lock(&spdifrx->irq_lock);
+	if (err_xrun && spdifrx->substream)
+		snd_pcm_stop_xrun(spdifrx->substream);
+	spin_unlock(&spdifrx->irq_lock);
 
 	return IRQ_HANDLED;
 }

@@ -749,9 +755,12 @@ static int stm32_spdifrx_startup(struct
 				 struct snd_soc_dai *cpu_dai)
 {
 	struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
+	unsigned long flags;
 	int ret;
 
+	spin_lock_irqsave(&spdifrx->irq_lock, flags);
 	spdifrx->substream = substream;
+	spin_unlock_irqrestore(&spdifrx->irq_lock, flags);
 
 	ret = clk_prepare_enable(spdifrx->kclk);
 	if (ret)

@@ -827,8 +836,12 @@ static void stm32_spdifrx_shutdown(struc
 				   struct snd_soc_dai *cpu_dai)
 {
 	struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
+	unsigned long flags;
 
+	spin_lock_irqsave(&spdifrx->irq_lock, flags);
 	spdifrx->substream = NULL;
+	spin_unlock_irqrestore(&spdifrx->irq_lock, flags);
+
 	clk_disable_unprepare(spdifrx->kclk);
 }
 

@@ -932,6 +945,7 @@ static int stm32_spdifrx_probe(struct pl
 	spdifrx->pdev = pdev;
 	init_completion(&spdifrx->cs_completion);
 	spin_lock_init(&spdifrx->lock);
+	spin_lock_init(&spdifrx->irq_lock);
 
 	platform_set_drvdata(pdev, spdifrx);
 

From: Olivier Moysan <[email protected]>

commit 3b7658679d88b5628939f9bdc8e613f79cd821f9 upstream.

Changing input state in iec capture control is not safe, as the pin state may be changed concurrently by ASoC framework.
Remove pin state handling in iec capture control.

Note: This introduces a restriction on capture control, when pin sleep state is defined in device tree. In this case channel status can be captured only when an audio stream capture is active.

---
 sound/soc/stm/stm32_spdifrx.c |    4 ----
 1 file changed, 4 deletions(-)

@@ -12,7 +12,6 @@
 #include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/of_platform.h>
-#include <linux/pinctrl/consumer.h>
 #include <linux/regmap.h>
 #include <linux/reset.h>
 

@@ -482,8 +481,6 @@ static int stm32_spdifrx_get_ctrl_data(s
 	memset(spdifrx->cs, 0, SPDIFRX_CS_BYTES_NB);
 	memset(spdifrx->ub, 0, SPDIFRX_UB_BYTES_NB);
 
-	pinctrl_pm_select_default_state(&spdifrx->pdev->dev);
-
 	ret = stm32_spdifrx_dma_ctrl_start(spdifrx);
 	if (ret < 0)
 		return ret;

@@ -515,7 +512,6 @@ static int stm32_spdifrx_get_ctrl_data(s
 
 end:
 	clk_disable_unprepare(spdifrx->kclk);
-	pinctrl_pm_select_sleep_state(&spdifrx->pdev->dev);
 
 	return ret;
 }

From: Arnd Bergmann <[email protected]>

commit f7e36e18946b4ec756b9c5cf4fb8891be8d1e4a3 upstream.

In a rare randconfig build I came across one configuration that does not enable CONFIG_GPIOLIB, which is needed by lochnagar:

ERROR: "devm_gpiochip_add_data" [drivers/pinctrl/cirrus/pinctrl-lochnagar.ko] undefined!
ERROR: "gpiochip_generic_free" [drivers/pinctrl/cirrus/pinctrl-lochnagar.ko] undefined!
ERROR: "gpiochip_generic_request" [drivers/pinctrl/cirrus/pinctrl-lochnagar.ko] undefined!
ERROR: "gpiochip_get_data" [drivers/pinctrl/cirrus/pinctrl-lochnagar.ko] undefined!

Add another 'select' like all other pinctrl drivers have.

---
 drivers/pinctrl/cirrus/Kconfig |    1 +
 1 file changed, 1 insertion(+)

@@ -2,6 +2,7 @@
 config PINCTRL_LOCHNAGAR
 	tristate "Cirrus Logic Lochnagar pinctrl driver"
 	depends on MFD_LOCHNAGAR
+	select GPIOLIB
 	select PINMUX
 	select PINCONF
 	select GENERIC_PINCONF

From: wenxu <[email protected]>

commit 8ca79606cdfde2e37ee4f0707b9d1874a6f0eb38 upstream.

The .deactivate and .activate interfaces already deal with the reference counter. Otherwise, this results in spurious "Device is busy" errors.

---
 net/netfilter/nft_flow_offload.c |    3 ---
 1 file changed, 3 deletions(-)

@@ -197,9 +197,6 @@ static void nft_flow_offload_activate(co
 static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
 				     const struct nft_expr *expr)
 {
-	struct nft_flow_offload *priv = nft_expr_priv(expr);
-
-	priv->flowtable->use--;
 	nf_ct_netns_put(ctx->net, ctx->family);
 }
 

From: Daniel Baluta <[email protected]>

commit dcf08d0f8f09081b16f69071dd55d51d5e964e84 upstream.

dsp_box is used to keep DSP initiated messages. The value of dsp_offset is set by the DSP with the first message, so we need a way to bootstrap it in order to get the first message.

We do this by setting the correct default dsp_box offset which on i.MX8 is not zero.

Very interesting is why it has worked until now.

On i.MX8, DSP communicates with ARM core using a shared SDRAM memory area. Actually, there are two shared areas:
* SDRAM0 - starting at 0x92400000, size 0x800000
* SDRAM1 - starting at 0x92C00000, size 0x800000

SDRAM0 keeps the data sections, starting with .rodata. By chance fw_ready structure was placed at the beginning of .rodata.

dsp_box_base is defined as SDRAM0 + dsp_box_offset and it is placed at the beginning of SDRAM1 (dsp_box_offset should be 0x800000). But because it is zero initialized by default it points to SDRAM0 where by chance the fw_ready was placed in the SOF firmware.

Anyhow, SOF commit 7466bee378dd811b ("clk: make freq arrays constant") fw_ready is no longer at the beginning of SDRAM0 and everything shows how lucky we were until now.

Fix this by properly setting the default dsp_box offset.

---
 sound/soc/sof/imx/imx8.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -304,6 +304,9 @@ static int imx8_probe(struct snd_sof_dev
 	}
 	sdev->mailbox_bar = SOF_FW_BLK_TYPE_SRAM;
 
+	/* set default mailbox offset for FW ready message */
+	sdev->dsp_box.offset = MBOX_OFFSET;
+
 	return 0;
 
 exit_pdev_unregister:

From: Peter Ujfalusi <[email protected]>

commit 8bcef0d54067077cf9a6cb129022c77559926e8c upstream.

The commit converting the driver to DMAengine was missing the flags for the memcpy prepare call.
It went unnoticed since the omap-dma driver was ignoring them.

---
 drivers/mtd/nand/onenand/omap2.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -328,7 +328,8 @@ static inline int omap2_onenand_dma_tran
 	struct dma_async_tx_descriptor *tx;
 	dma_cookie_t cookie;
 
-	tx = dmaengine_prep_dma_memcpy(c->dma_chan, dst, src, count, 0);
+	tx = dmaengine_prep_dma_memcpy(c->dma_chan, dst, src, count,
+				       DMA_CTRL_ACK | DMA_PREP_INTERRUPT);
 	if (!tx) {
 		dev_err(&c->pdev->dev, "Failed to prepare DMA memcpy\n");
 		return -EIO;

From: Swapna Manupati <[email protected]>

commit 36f2e7207f21a83ca0054116191f119ac64583ab upstream.

This patch writes the inverse value of Interrupt Mask Status register into the Interrupt Enable register in zynq_gpio_restore_context API to fix the bug.

---
 drivers/gpio/gpio-zynq.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

@@ -681,6 +681,8 @@ static void zynq_gpio_restore_context(st
 	unsigned int bank_num;
 
 	for (bank_num = 0; bank_num < gpio->p_data->max_bank; bank_num++) {
+		writel_relaxed(ZYNQ_GPIO_IXR_DISABLE_ALL, gpio->base_addr +
+				ZYNQ_GPIO_INTDIS_OFFSET(bank_num));
 		writel_relaxed(gpio->context.datalsw[bank_num],
 			       gpio->base_addr +
 			       ZYNQ_GPIO_DATA_LSW_OFFSET(bank_num));

@@ -690,9 +692,6 @@ static void zynq_gpio_restore_context(st
 		writel_relaxed(gpio->context.dirm[bank_num],
 			       gpio->base_addr +
 			       ZYNQ_GPIO_DIRM_OFFSET(bank_num));
-		writel_relaxed(gpio->context.int_en[bank_num],
-			       gpio->base_addr +
-			       ZYNQ_GPIO_INTEN_OFFSET(bank_num));
 		writel_relaxed(gpio->context.int_type[bank_num],
 			       gpio->base_addr +
 			       ZYNQ_GPIO_INTTYPE_OFFSET(bank_num));

@@ -702,6 +701,9 @@ static void zynq_gpio_restore_context(st
 		writel_relaxed(gpio->context.int_any[bank_num],
 			       gpio->base_addr +
 			       ZYNQ_GPIO_INTANY_OFFSET(bank_num));
+		writel_relaxed(~(gpio->context.int_en[bank_num]),
+			       gpio->base_addr +
+			       ZYNQ_GPIO_INTEN_OFFSET(bank_num));
 	}
 }
 

From: Qianggui Song <[email protected]>

commit 35c60be220572de7d6605c4318f640d133982040 upstream.

In meson_pinconf_get_drive_strength, variable bit is calculated by meson_calc_reg_and_bit, this value is the offset from the first pin of a certain bank to current pin, while Meson SoCs use two bits for each pin to depict drive-strength. So a left shift by 1 should be done or node pinconf-pins shows wrong message.

---
 drivers/pinctrl/meson/pinctrl-meson.c |    1 +
 1 file changed, 1 insertion(+)

@@ -441,6 +441,7 @@ static int meson_pinconf_get_drive_stren
 		return ret;
 
 	meson_calc_reg_and_bit(bank, pin, REG_DS, &reg, &bit);
+	bit = bit << 1;
 
 	ret = regmap_read(pc->reg_ds, reg, &val);
 	if (ret)

From: Hangbin Liu <[email protected]>

commit cc7e3f63d7299dd1119be39aa187b867d6f8aa17 upstream.

The loopback feature is only supported on a few drivers like broadcom, mellanox, etc. The default veth driver has not supported it yet. To avoid returning failed and making the runner feel confused, let's just skip the test on drivers that not support loopback.

---
 tools/testing/selftests/net/forwarding/loopback.sh |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -1,6 +1,9 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
 ALL_TESTS="loopback_test"
 NUM_NETIFS=2
 source tc_common.sh

@@ -72,6 +75,11 @@ setup_prepare()
 
 	h1_create
 	h2_create
+
+	if ethtool -k $h1 | grep loopback | grep -q fixed; then
+		log_test "SKIP: dev $h1 does not support loopback feature"
+		exit $ksft_skip
+	fi
 }
 
 cleanup()

From: Jon Derrick <[email protected]>

commit f78947c409204138a4bc0609f98e07ef9d01ac0a upstream.

If the device fails to be added to the group, make sure to unlink the reference before returning.

---
 drivers/iommu/intel-iommu.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

@@ -5593,8 +5593,10 @@ static int intel_iommu_add_device(struct
 
 	group = iommu_group_get_for_dev(dev);
 
-	if (IS_ERR(group))
-		return PTR_ERR(group);
+	if (IS_ERR(group)) {
+		ret = PTR_ERR(group);
+		goto unlink;
+	}
 
 	iommu_group_put(group);
 

@@ -5620,7 +5622,8 @@ static int intel_iommu_add_device(struct
 				if (!get_private_domain_for_dev(dev)) {
 					dev_warn(dev,
 						 "Failed to get a private domain.\n");
-					return -ENOMEM;
+					ret = -ENOMEM;
+					goto unlink;
 				}
 
 				dev_info(dev,

@@ -5635,6 +5638,10 @@ static int intel_iommu_add_device(struct
 	}
 
 	return 0;
+
+unlink:
+	iommu_device_unlink(&iommu->iommu, dev);
+	return ret;
 }
 
 static void intel_iommu_remove_device(struct device *dev)

From: Jon Derrick <[email protected]>

commit 7d4e6ccd1fb09dbfbc49746ca82bd5c25ad4bfe4 upstream.

This adds the missing teardown step that removes the device link from the group when the device addition fails.

---
 drivers/iommu/iommu.c |    1 +
 1 file changed, 1 insertion(+)

@@ -751,6 +751,7 @@ err_put_group:
 	mutex_unlock(&group->mutex);
 	dev->iommu_group = NULL;
 	kobject_put(group->devices_kobj);
+	sysfs_remove_link(group->devices_kobj, device->name);
 err_free_name:
 	kfree(device->name);
 err_remove_link:

From: Roman Gushchin <[email protected]>

commit e10360f815ca6367357b2c2cfef17fc663e50f7b upstream.

Before commit 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself") cgroup bpf structures were released with
corresponding cgroup structures. It guaranteed the hierarchical order
of destruction: children were always first. It preserved attached
programs from being released before their propagated copies.

But with cgroup auto-detachment there are no such guarantees anymore:
cgroup bpf is released as soon as the cgroup is offline and there are no live associated sockets. It means that an attached program can be detached and released, while its propagated copy is still living in the cgroup subtree. This will obviously lead to an use-after-free bug.

To reproduce the issue the following script can be used:

#!/bin/bash

CGROOT=/sys/fs/cgroup

  mkdir -p ${CGROOT}/A ${CGROOT}/B ${CGROOT}/A/C
  sleep 1

  ./test_cgrp2_attach ${CGROOT}/A egress &
  A_PID=$!
  ./test_cgrp2_attach ${CGROOT}/B egress &
  B_PID=$!

  echo $$ > ${CGROOT}/A/C/cgroup.procs
  iperf -s &
  S_PID=$!
  iperf -c localhost -t 100 &
  C_PID=$!

sleep 1

  echo $$ > ${CGROOT}/B/cgroup.procs
  echo ${S_PID} > ${CGROOT}/B/cgroup.procs
  echo ${C_PID} > ${CGROOT}/B/cgroup.procs

sleep 1

  rmdir ${CGROOT}/A/C
  rmdir ${CGROOT}/A

sleep 1

  kill -9 ${S_PID} ${C_PID} ${A_PID} ${B_PID}

On the unpatched kernel the following stacktrace can be obtained:

[   33.619799] BUG: unable to handle page fault for address: ffffbdb4801ab002
[   33.620677] #PF: supervisor read access in kernel mode
[   33.621293] #PF: error_code(0x0000) - not-present page
[   33.622754] Oops: 0000 [#1] SMP NOPTI
[   33.623202] CPU: 0 PID: 601 Comm: iperf Not tainted 5.5.0-rc2+ #23
[   33.625545] RIP: 0010:__cgroup_bpf_run_filter_skb+0x29f/0x3d0
[   33.635809] Call Trace:
[   33.636118]  ? __cgroup_bpf_run_filter_skb+0x2bf/0x3d0
[   33.636728]  ? __switch_to_asm+0x40/0x70
[   33.637196]  ip_finish_output+0x68/0xa0
[   33.637654]  ip_output+0x76/0xf0
[   33.638046]  ? __ip_finish_output+0x1c0/0x1c0
[   33.638576]  __ip_queue_xmit+0x157/0x410
[   33.639049]  __tcp_transmit_skb+0x535/0xaf0
[   33.639557]  tcp_write_xmit+0x378/0x1190
[   33.640049]  ? _copy_from_iter_full+0x8d/0x260
[   33.640592]  tcp_sendmsg_locked+0x2a2/0xdc0
[   33.641098]  ? sock_has_perm+0x10/0xa0
[   33.641574]  tcp_sendmsg+0x28/0x40
[   33.641985]  sock_sendmsg+0x57/0x60
[   33.642411]  sock_write_iter+0x97/0x100
[   33.642876]  new_sync_write+0x1b6/0x1d0
[   33.643339]  vfs_write+0xb6/0x1a0
[   33.643752]  ksys_write+0xa7/0xe0
[   33.644156]  do_syscall_64+0x5b/0x1b0
[   33.644605]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fix this by grabbing a reference to the bpf structure of each ancestor on the initialization of the cgroup bpf structure, and dropping the reference at the end of releasing the cgroup bpf structure.

This will restore the hierarchical order of cgroup bpf releasing, without adding any operations on hot paths.

Thanks to Josef Bacik for the debugging and the initial analysis of the problem.

---
 kernel/bpf/cgroup.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

@@ -35,8 +35,8 @@ void cgroup_bpf_offline(struct cgroup *c
  */
 static void cgroup_bpf_release(struct work_struct *work)
 {
-	struct cgroup *cgrp = container_of(work, struct cgroup,
-					   bpf.release_work);
+	struct cgroup *p, *cgrp = container_of(work, struct cgroup,
+					       bpf.release_work);
 	enum bpf_cgroup_storage_type stype;
 	struct bpf_prog_array *old_array;
 	unsigned int type;

@@ -65,6 +65,9 @@ static void cgroup_bpf_release(struct wo
 
 	mutex_unlock(&cgroup_mutex);
 
+	for (p = cgroup_parent(cgrp); p; p = cgroup_parent(p))
+		cgroup_bpf_put(p);
+
 	percpu_ref_exit(&cgrp->bpf.refcnt);
 	cgroup_put(cgrp);
 }

@@ -199,6 +202,7 @@ int cgroup_bpf_inherit(struct cgroup *cg
  */
 #define	NR ARRAY_SIZE(cgrp->bpf.effective)
 	struct bpf_prog_array *arrays[NR] = {};
+	struct cgroup *p;
 	int ret, i;
 
 	ret = percpu_ref_init(&cgrp->bpf.refcnt, cgroup_bpf_release_fn, 0,

@@ -206,6 +210,9 @@ int cgroup_bpf_inherit(struct cgroup *cg
 	if (ret)
 		return ret;
 
+	for (p = cgroup_parent(cgrp); p; p = cgroup_parent(p))
+		cgroup_bpf_get(p);
+
 	for (i = 0; i < NR; i++)
 		INIT_LIST_HEAD(&cgrp->bpf.progs[i]);
 

From: Ming Lei <[email protected]>

commit 83c9c547168e8b914ea6398430473a4de68c52cc upstream.

Commit 85a8ce62c2ea ("block: add bio_truncate to fix guard_bio_eod") adds bio_truncate() for handling bio EOD. However, bio_truncate() doesn't use the passed 'op' parameter from guard_bio_eod's callers.

So bio_trunacate() may retrieve wrong 'op', and zering pages may not be done for READ bio.

Fixes this issue by moving guard_bio_eod() after bio_set_op_attrs() in submit_bh_wbc() so that bio_truncate() can always retrieve correct op info.

Meantime remove the 'op' parameter from guard_bio_eod() because it isn't used any more.

Fold in kerneldoc and bio_op() change.

---
 block/bio.c   |   12 +++++++++++-
 fs/buffer.c   |    8 ++++----
 fs/internal.h |    2 +-
 fs/mpage.c    |    2 +-
 4 files changed, 17 insertions(+), 7 deletions(-)

@@ -535,6 +535,16 @@ void zero_fill_bio_iter(struct bio *bio,
 }
 EXPORT_SYMBOL(zero_fill_bio_iter);
 
+/**
+ * bio_truncate - truncate the bio to small size of @new_size
+ * @bio:	the bio to be truncated
+ * @new_size:	new size for truncating the bio
+ *
+ * Description:
+ *   Truncate the bio to new size of @new_size. If bio_op(bio) is
+ *   REQ_OP_READ, zero the truncated part. This function should only
+ *   be used for handling corner cases, such as bio eod.
+ */
 void bio_truncate(struct bio *bio, unsigned new_size)
 {
 	struct bio_vec bv;

@@ -545,7 +555,7 @@ void bio_truncate(struct bio *bio, unsig
 	if (new_size >= bio->bi_iter.bi_size)
 		return;
 
-	if (bio_data_dir(bio) != READ)
+	if (bio_op(bio) != REQ_OP_READ)
 		goto exit;
 
 	bio_for_each_segment(bv, bio, iter) {

@@ -2991,7 +2991,7 @@ static void end_bio_bh_io_sync(struct bi
  * errors, this only handles the "we need to be able to
  * do IO at the final sector" case.
  */
-void guard_bio_eod(int op, struct bio *bio)
+void guard_bio_eod(struct bio *bio)
 {
 	sector_t maxsector;
 	struct hd_struct *part;

@@ -3055,15 +3055,15 @@ static int submit_bh_wbc(int op, int op_
 	bio->bi_end_io = end_bio_bh_io_sync;
 	bio->bi_private = bh;
 
-	/* Take care of bh's that straddle the end of the device */
-	guard_bio_eod(op, bio);
-
 	if (buffer_meta(bh))
 		op_flags |= REQ_META;
 	if (buffer_prio(bh))
 		op_flags |= REQ_PRIO;
 	bio_set_op_attrs(bio, op, op_flags);
 
+	/* Take care of bh's that straddle the end of the device */
+	guard_bio_eod(bio);
+
 	if (wbc) {
 		wbc_init_bio(wbc, bio);
 		wbc_account_cgroup_owner(wbc, bh->b_page, bh->b_size);

@@ -38,7 +38,7 @@ static inline int __sync_blockdev(struct
 /*
  * buffer.c
  */
-extern void guard_bio_eod(int rw, struct bio *bio);
+extern void guard_bio_eod(struct bio *bio);
 extern int __block_write_begin_int(struct page *page, loff_t pos, unsigned len,
 		get_block_t *get_block, struct iomap *iomap);
 

@@ -62,7 +62,7 @@ static struct bio *mpage_bio_submit(int
 {
 	bio->bi_end_io = mpage_end_io;
 	bio_set_op_attrs(bio, op, op_flags);
-	guard_bio_eod(op, bio);
+	guard_bio_eod(bio);
 	submit_bio(bio);
 	return NULL;
 }

From: Dan Carpenter <[email protected]>

commit ee560e7bbab0c10cf3f0e71997fbc354ab2ee5cb upstream.

The caller also calls _base_release_memory_pools() on error so it leads to a number of double frees:

drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->chain_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->hpr_lookup' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->internal_lookup' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->pcie_sgl_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->reply_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->reply_free_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->reply_post_free_array_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->reply_post_free_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->sense_dma_pool' double freed

---
 drivers/scsi/mpt3sas/mpt3sas_base.c |    1 -
 1 file changed, 1 deletion(-)

@@ -5234,7 +5234,6 @@ _base_allocate_memory_pools(struct MPT3S
 					&ct->chain_buffer_dma);
 			if (!ct->chain_buffer) {
 				ioc_err(ioc, "chain_lookup: pci_pool_alloc failed\n");
-				_base_release_memory_pools(ioc);
 				goto out;
 			}
 		}

From: Geert Uytterhoeven <[email protected]>

commit d935bd50dd14a7714cbdba9a76435dbb56edb1ae upstream.

When a GPIO offset in a lookup table is out-of-range, the printed error message (1) does not include the actual out-of-range value, and (2) contains an off-by-one error in the upper bound.

Avoid user confusion by also printing the actual GPIO offset, and correcting the upper bound of the range.
While at it, use "%u" for unsigned int.

Sample impact:

    -requested GPIO 0 is out of range [0..32] for chip e6052000.gpio
    +requested GPIO 0 (45) is out of range [0..31] for chip e6052000.gpio

---
 drivers/gpio/gpiolib.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -4328,8 +4328,9 @@ static struct gpio_desc *gpiod_find(stru
 
 		if (chip->ngpio <= p->chip_hwnum) {
 			dev_err(dev,
-				"requested GPIO %d is out of range [0..%d] for chip %s\n",
-				idx, chip->ngpio, chip->label);
+				"requested GPIO %u (%u) is out of range [0..%u] for chip %s\n",
+				idx, p->chip_hwnum, chip->ngpio - 1,
+				chip->label);
 			return ERR_PTR(-EINVAL);
 		}
 

From: Arnd Bergmann <[email protected]>

commit 5fdb0684b5b0f41402161f068d3d84bf6ed1c3f4 upstream.

Compile-testing this driver fails if CONFIG_COMMON_CLK is not set:

drivers/devfreq/tegra30-devfreq.o: In function `tegra_devfreq_target':
tegra30-devfreq.c:(.text+0x164): undefined reference to `clk_set_min_rate'

---
 drivers/devfreq/Kconfig |    1 +
 1 file changed, 1 insertion(+)

@@ -99,6 +99,7 @@ config ARM_TEGRA_DEVFREQ
 		ARCH_TEGRA_210_SOC || \
 		COMPILE_TEST
 	select PM_OPP
+	depends on COMMON_CLK
 	help
 	  This adds the DEVFREQ driver for the Tegra family of SoCs.
 	  It reads ACTMON counters of memory controllers and adjusts the

From: Neil Armstrong <[email protected]>

commit eacaf7dcf08eb062a1059c6c115fa3fced3374ae upstream.

Fix the clock names used in the probe function according to the bindings.

---
 drivers/pci/controller/dwc/pci-meson.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -250,15 +250,15 @@ static int meson_pcie_probe_clocks(struc
 	if (IS_ERR(res->port_clk))
 		return PTR_ERR(res->port_clk);
 
-	res->mipi_gate = meson_pcie_probe_clock(dev, "pcie_mipi_en", 0);
+	res->mipi_gate = meson_pcie_probe_clock(dev, "mipi", 0);
 	if (IS_ERR(res->mipi_gate))
 		return PTR_ERR(res->mipi_gate);
 
-	res->general_clk = meson_pcie_probe_clock(dev, "pcie_general", 0);
+	res->general_clk = meson_pcie_probe_clock(dev, "general", 0);
 	if (IS_ERR(res->general_clk))
 		return PTR_ERR(res->general_clk);
 
-	res->clk = meson_pcie_probe_clock(dev, "pcie", 0);
+	res->clk = meson_pcie_probe_clock(dev, "pclk", 0);
 	if (IS_ERR(res->clk))
 		return PTR_ERR(res->clk);
 

From: Thierry Reding <[email protected]>

commit 051172e8c1ceef8749f19faacc1d3bef65d20d8d upstream.

Commit Fixes: b9f8b09ce256 ("drm/tegra: Setup shared IOMMU domain after initialization") changed the initialization order of the IOMMU related bits but didn't update the cleanup path accordingly. This asymmetry can cause failures during error recovery.

---
 drivers/gpu/drm/tegra/drm.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

@@ -201,19 +201,19 @@ hub:
 	if (tegra->hub)
 		tegra_display_hub_cleanup(tegra->hub);
 device:
-	host1x_device_exit(device);
-fbdev:
-	drm_kms_helper_poll_fini(drm);
-	tegra_drm_fb_free(drm);
-config:
-	drm_mode_config_cleanup(drm);
-
 	if (tegra->domain) {
 		mutex_destroy(&tegra->mm_lock);
 		drm_mm_takedown(&tegra->mm);
 		put_iova_domain(&tegra->carveout.domain);
 		iova_cache_put();
 	}
+
+	host1x_device_exit(device);
+fbdev:
+	drm_kms_helper_poll_fini(drm);
+	tegra_drm_fb_free(drm);
+config:
+	drm_mode_config_cleanup(drm);
 domain:
 	if (tegra->domain)
 		iommu_domain_free(tegra->domain);

From: Taehee Yoo <[email protected]>

commit c6c4ccd7f96993e106dfea7ef18127f972f2db5e upstream.

In current hsr code, when hsr interface is created, it creates debugfs directory /sys/kernel/debug/<interface name>.
If there is same directory or file name in there, it fails. In order to reduce possibility of failure of creation of debugfs, this patch adds root directory.

Test commands:
ip link add dummy0 type dummy
ip link add dummy1 type dummy
ip link add hsr0 type hsr slave1 dummy0 slave2 dummy1

Before this patch:
/sys/kernel/debug/hsr0/node_table

After this patch:
/sys/kernel/debug/hsr/hsr0/node_table

---
 net/hsr/hsr_debugfs.c |   23 ++++++++++++++++++++---
 net/hsr/hsr_main.c    |    1 +
 net/hsr/hsr_main.h    |    6 ++++++
 net/hsr/hsr_netlink.c |    1 +
 4 files changed, 28 insertions(+), 3 deletions(-)

@@ -20,6 +20,8 @@
 #include "hsr_main.h"
 #include "hsr_framereg.h"
 
+static struct dentry *hsr_debugfs_root_dir;
+
 static void print_mac_address(struct seq_file *sfp, unsigned char *mac)
 {
 	seq_printf(sfp, "%02x:%02x:%02x:%02x:%02x:%02x:",

@@ -81,9 +83,9 @@ void hsr_debugfs_init(struct hsr_priv *p
 {
 	struct dentry *de = NULL;
 
-	de = debugfs_create_dir(hsr_dev->name, NULL);
+	de = debugfs_create_dir(hsr_dev->name, hsr_debugfs_root_dir);
 	if (IS_ERR(de)) {
-		pr_err("Cannot create hsr debugfs root\n");
+		pr_err("Cannot create hsr debugfs directory\n");
 		return;
 	}
 

@@ -93,7 +95,7 @@ void hsr_debugfs_init(struct hsr_priv *p
 				 priv->node_tbl_root, priv,
 				 &hsr_fops);
 	if (IS_ERR(de)) {
-		pr_err("Cannot create hsr node_table directory\n");
+		pr_err("Cannot create hsr node_table file\n");
 		debugfs_remove(priv->node_tbl_root);
 		priv->node_tbl_root = NULL;
 		return;

@@ -115,3 +117,18 @@ hsr_debugfs_term(struct hsr_priv *priv)
 	debugfs_remove(priv->node_tbl_root);
 	priv->node_tbl_root = NULL;
 }
+
+void hsr_debugfs_create_root(void)
+{
+	hsr_debugfs_root_dir = debugfs_create_dir("hsr", NULL);
+	if (IS_ERR(hsr_debugfs_root_dir)) {
+		pr_err("Cannot create hsr debugfs root directory\n");
+		hsr_debugfs_root_dir = NULL;
+	}
+}
+
+void hsr_debugfs_remove_root(void)
+{
+	/* debugfs_remove() internally checks NULL and ERROR */
+	debugfs_remove(hsr_debugfs_root_dir);
+}

@@ -123,6 +123,7 @@ static void __exit hsr_exit(void)
 {
 	unregister_netdevice_notifier(&hsr_nb);
 	hsr_netlink_exit();
+	hsr_debugfs_remove_root();
 }
 
 module_init(hsr_init);

@@ -187,12 +187,18 @@ static inline u16 hsr_get_skb_sequence_n
 #if IS_ENABLED(CONFIG_DEBUG_FS)
 void hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev);
 void hsr_debugfs_term(struct hsr_priv *priv);
+void hsr_debugfs_create_root(void);
+void hsr_debugfs_remove_root(void);
 #else
 static inline void hsr_debugfs_init(struct hsr_priv *priv,
 				    struct net_device *hsr_dev)
 {}
 static inline void hsr_debugfs_term(struct hsr_priv *priv)
 {}
+static inline void hsr_debugfs_create_root(void)
+{}
+static inline void hsr_debugfs_remove_root(void)
+{}
 #endif
 
 #endif /*  __HSR_PRIVATE_H */

@@ -476,6 +476,7 @@ int __init hsr_netlink_init(void)
 	if (rc)
 		goto fail_genl_register_family;
 
+	hsr_debugfs_create_root();
 	return 0;
 
 fail_genl_register_family:

From: Taehee Yoo <[email protected]>

commit 4c2d5e33dcd3a6333a7895be3b542ff3d373177c upstream.

hsr interface has own debugfs file, which name is same with interface name. So, interface name is changed, debugfs file name should be changed too.

---
 net/hsr/hsr_debugfs.c |   13 +++++++++++++
 net/hsr/hsr_main.c    |    3 +++
 net/hsr/hsr_main.h    |    4 ++++
 3 files changed, 20 insertions(+)

@@ -65,6 +65,19 @@ hsr_node_table_open(struct inode *inode,
 	return single_open(filp, hsr_node_table_show, inode->i_private);
 }
 
+void hsr_debugfs_rename(struct net_device *dev)
+{
+	struct hsr_priv *priv = netdev_priv(dev);
+	struct dentry *d;
+
+	d = debugfs_rename(hsr_debugfs_root_dir, priv->node_tbl_root,
+			   hsr_debugfs_root_dir, dev->name);
+	if (IS_ERR(d))
+		netdev_warn(dev, "failed to rename\n");
+	else
+		priv->node_tbl_root = d;
+}
+
 static const struct file_operations hsr_fops = {
 	.open	= hsr_node_table_open,
 	.read	= seq_read,

@@ -45,6 +45,9 @@ static int hsr_netdev_notify(struct noti
 	case NETDEV_CHANGE:	/* Link (carrier) state changes */
 		hsr_check_carrier_and_operstate(hsr);
 		break;
+	case NETDEV_CHANGENAME:
+		hsr_debugfs_rename(dev);
+		break;
 	case NETDEV_CHANGEADDR:
 		if (port->type == HSR_PT_MASTER) {
 			/* This should not happen since there's no

@@ -185,11 +185,15 @@ static inline u16 hsr_get_skb_sequence_n
 }
 
 #if IS_ENABLED(CONFIG_DEBUG_FS)
+void hsr_debugfs_rename(struct net_device *dev);
 void hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev);
 void hsr_debugfs_term(struct hsr_priv *priv);
 void hsr_debugfs_create_root(void);
 void hsr_debugfs_remove_root(void);
 #else
+static inline void void hsr_debugfs_rename(struct net_device *dev)
+{
+}
 static inline void hsr_debugfs_init(struct hsr_priv *priv,
 				    struct net_device *hsr_dev)
 {}

From: Taehee Yoo <[email protected]>

commit 3ed0a1d563903bdb4b4c36c58c4d9c1bcb23a6e6 upstream.

The supervision frame is L2 frame.
When supervision frame is created, hsr module doesn't set network header. If tap routine is enabled, dev_queue_xmit_nit() is called and it checks network_header. If network_header pointer wasn't set(or invalid), it resets network_header and warns.
In order to avoid unnecessary warning message, resetting network_header is needed.

Test commands:
ip netns add nst
ip link add veth0 type veth peer name veth1
ip link add veth2 type veth peer name veth3
ip link set veth1 netns nst
ip link set veth3 netns nst
ip link set veth0 up
ip link set veth2 up
ip link add hsr0 type hsr slave1 veth0 slave2 veth2
ip a a 192.168.100.1/24 dev hsr0
ip link set hsr0 up
ip netns exec nst ip link set veth1 up
ip netns exec nst ip link set veth3 up
ip netns exec nst ip link add hsr1 type hsr slave1 veth1 slave2 veth3 ip netns exec nst ip a a 192.168.100.2/24 dev hsr1
ip netns exec nst ip link set hsr1 up
tcpdump -nei veth0

Splat looks like:

[  175.852292][    C3] protocol 88fb is buggy, dev veth0

---
 net/hsr/hsr_device.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -272,6 +272,8 @@ static void send_hsr_supervision_frame(s
 			    skb->dev->dev_addr, skb->len) <= 0)
 		goto out;
 	skb_reset_mac_header(skb);
+	skb_reset_network_header(skb);
+	skb_reset_transport_header(skb);
 
 	if (hsr_ver > 0) {
 		hsr_tag = skb_put(skb, sizeof(struct hsr_tag));

From: Julian Wiedmann <[email protected]>

commit 8b5026bc16938920e4780b9094c3bf20e1e0939d upstream.

qeth_l?_set_online() goes through a number of initialization steps, and on any error uses qeth_l?_stop_card() to tear down the residual state.

The first initialization step is qeth_core_hardsetup_card(). When this fails after having established a QDIO context on the device (ie. somewhere after qeth_mpc_initialize()), qeth_l?_stop_card() doesn't shut down this QDIO context again (since the card state hasn't progressed from DOWN at this stage).

Even worse, we then call qdio_free() as final teardown step to free the QDIO data structures - while some of them are still hooked into wider QDIO infrastructure such as the IRQ list. This is inevitably followed by use-after-frees and other nastyness.

Fix this by unconditionally calling qeth_qdio_clear_card() to shut down the QDIO context, and also to halt/clear any pending activity on the various IO channels.
Remove the naive attempt at handling the teardown in qeth_mpc_initialize(), it clearly doesn't suffice and we're handling it properly now in the wider teardown code.

---
 drivers/s390/net/qeth_core_main.c |   20 ++++++++------------
 drivers/s390/net/qeth_l2_main.c   |    2 +-
 drivers/s390/net/qeth_l3_main.c   |    2 +-
 3 files changed, 10 insertions(+), 14 deletions(-)

@@ -2451,50 +2451,46 @@ static int qeth_mpc_initialize(struct qe
 	rc = qeth_cm_enable(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "2err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_cm_setup(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "3err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_ulp_enable(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "4err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_ulp_setup(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "5err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_alloc_qdio_queues(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "5err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_qdio_establish(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "6err%d", rc);
 		qeth_free_qdio_queues(card);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_qdio_activate(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "7err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_dm_act(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "8err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 
 	return 0;
-out_qdio:
-	qeth_qdio_clear_card(card, !IS_IQD(card));
-	qdio_free(CARD_DDEV(card));
-	return rc;
 }
 
 void qeth_print_status_message(struct qeth_card *card)

@@ -287,12 +287,12 @@ static void qeth_l2_stop_card(struct qet
 		card->state = CARD_STATE_HARDSETUP;
 	}
 	if (card->state == CARD_STATE_HARDSETUP) {
-		qeth_qdio_clear_card(card, 0);
 		qeth_drain_output_queues(card);
 		qeth_clear_working_pool_list(card);
 		card->state = CARD_STATE_DOWN;
 	}
 
+	qeth_qdio_clear_card(card, 0);
 	flush_workqueue(card->event_wq);
 	card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
 	card->info.promisc_mode = 0;

@@ -1426,12 +1426,12 @@ static void qeth_l3_stop_card(struct qet
 		card->state = CARD_STATE_HARDSETUP;
 	}
 	if (card->state == CARD_STATE_HARDSETUP) {
-		qeth_qdio_clear_card(card, 0);
 		qeth_drain_output_queues(card);
 		qeth_clear_working_pool_list(card);
 		card->state = CARD_STATE_DOWN;
 	}
 
+	qeth_qdio_clear_card(card, 0);
 	flush_workqueue(card->event_wq);
 	card->info.promisc_mode = 0;
 }

From: Alexandra Winter <[email protected]>

commit 68c57bfd52836e31bff33e5e1fc64029749d2c35 upstream.

Symptom: Error message "Configuring the VNIC characteristics failed" in dmesg whenever an OSA interface on z15 is set online.

The VNIC characteristics get re-programmed when setting a L2 device online. This follows the selected 'wanted' characteristics - with the exception that the INVISIBLE characteristic unconditionally gets switched off.

For devices that don't support INVISIBLE (ie. OSA), the resulting IO failure raises a noisy error message
("Configuring the VNIC characteristics failed").
For IQD, INVISIBLE is off by default anyways.

So don't unnecessarily special-case the INVISIBLE characteristic, and thereby suppress the misleading error message on OSA devices.

---
 drivers/s390/net/qeth_l2_main.c |    1 -
 1 file changed, 1 deletion(-)

@@ -2072,7 +2072,6 @@ static void qeth_l2_vnicc_init(struct qe
 	error |= qeth_l2_vnicc_recover_timeout(card, QETH_VNICC_LEARNING,
 					       timeout);
 	chars_tmp = card->options.vnicc.wanted_chars ^ QETH_VNICC_DEFAULT;
-	chars_tmp |= QETH_VNICC_BRIDGE_INVISIBLE;
 	chars_len = sizeof(card->options.vnicc.wanted_chars) * BITS_PER_BYTE;
 	for_each_set_bit(i, &chars_tmp, chars_len) {
 		vnicc = BIT(i);

From: Alexandra Winter <[email protected]>

commit e8a66d800471e2df7f0b484e2e46898b21d1fa82 upstream.

Symptom: After vnicc/rx_bcast has been manually set to 0,
bridge_* sysfs parameters can still be set or written.
Only occurs on HiperSockets, as OSA doesn't support changing rx_bcast.

Vnic characteristics and bridgeport settings are mutually exclusive. rx_bcast defaults to 1, so manually setting it to 0 should disable bridge_* parameters.

Instead it makes sense here to check the supported mask. If the card does not support vnicc at all, bridge commands are always allowed.

---
 drivers/s390/net/qeth_l2_main.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

@@ -1983,8 +1983,7 @@ int qeth_l2_vnicc_get_timeout(struct qet
 /* check if VNICC is currently enabled */
 bool qeth_l2_vnicc_is_in_use(struct qeth_card *card)
 {
-	/* if everything is turned off, VNICC is not active */
-	if (!card->options.vnicc.cur_chars)
+	if (!card->options.vnicc.sup_chars)
 		return false;
 	/* default values are only OK if rx_bcast was not enabled by user
 	 * or the card is offline.

From: Alexandra Winter <[email protected]>

commit d1b9ae1864fc3c000e0eb4af8482d78c63e0915a upstream.

During vnicc_init wanted_char should be compared to cur_char and not to QETH_VNICC_DEFAULT. Without this patch there is no way to enforce the default values as desired values.

Note, that it is expected, that a card comes online with default values. This patch was tested with private card firmware.

---
 drivers/s390/net/qeth_l2_main.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -2070,7 +2070,9 @@ static void qeth_l2_vnicc_init(struct qe
 	/* enforce assumed default values and recover settings, if changed  */
 	error |= qeth_l2_vnicc_recover_timeout(card, QETH_VNICC_LEARNING,
 					       timeout);
-	chars_tmp = card->options.vnicc.wanted_chars ^ QETH_VNICC_DEFAULT;
+	/* Change chars, if necessary  */
+	chars_tmp = card->options.vnicc.wanted_chars ^
+		    card->options.vnicc.cur_chars;
 	chars_len = sizeof(card->options.vnicc.wanted_chars) * BITS_PER_BYTE;
 	for_each_set_bit(i, &chars_tmp, chars_len) {
 		vnicc = BIT(i);

From: Julian Wiedmann <[email protected]>

commit 0b698c838e84149b690c7e979f78cccb6f8aa4b9 upstream.

I stumbled over an old OSA model that claims to support DIAG_ASSIST, but then rejects the cmd to query its DIAG capabilities.

In the old code this was ok, as the returned raw error code was > 0. Now that we translate the raw codes to errnos, the "rc < 0" causes us to fail the initialization of the device.

The fix is trivial: don't bail out when the DIAG query fails. Such an error is not critical, we can still use the device (with a slightly reduced set of features).

---
 drivers/s390/net/qeth_core_main.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

@@ -4968,10 +4968,8 @@ retriable:
 	}
 	if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST)) {
 		rc = qeth_query_setdiagass(card);
-		if (rc < 0) {
+		if (rc)
 			QETH_CARD_TEXT_(card, 2, "8err%d", rc);
-			goto out;
-		}
 	}
 	return 0;
 out:

From: Nathan Chancellor <[email protected]>

commit 7935799e041ae10d380d04ea23868240f082bd11 upstream.

Clang warns:

../fs/cifs/smb2file.c:70:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]

         if (oparms->tcon->use_resilient) {
         ^
../fs/cifs/smb2file.c:66:2: note: previous statement is here
        if (rc)
        ^

1 warning generated.

This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.

---
 fs/cifs/smb2file.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -67,7 +67,7 @@ smb2_open_file(const unsigned int xid, s
 		goto out;
 
 
-	 if (oparms->tcon->use_resilient) {
+	if (oparms->tcon->use_resilient) {
 		/* default timeout is 0, servers pick default (120 seconds) */
 		nr_ioctl_req.Timeout =
 			cpu_to_le32(oparms->tcon->handle_timeout);

From: Paul Menzel <[email protected]>

commit a2bdd0c904da12b223c8d7218e98138d4e6d9f4f upstream.

The file name in the documentation is currently incorrect, so fix it.

---
 Documentation/scsi/smartpqi.txt |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -29,7 +29,7 @@ smartpqi specific entries in /sys
   smartpqi host attributes:
   -------------------------
   /sys/class/scsi_host/host*/rescan
-  /sys/class/scsi_host/host*/version
+  /sys/class/scsi_host/host*/driver_version
 
   The host rescan attribute is a write only attribute. Writing to this
   attribute will trigger the driver to scan for new, changed, or removed

From: Andy Shevchenko <[email protected]>

commit 44fe5cb32c7599a4059931a98794e0418619aa96 upstream.

When gpiolib.h internal header had been split to few, the commit 77cb907abe6c ("gpiolib: acpi: Split ACPI stuff to gpiolib-acpi.h") in particular missed the MAINTAINERS database update. Do it here.

---
 MAINTAINERS |    1 +
 1 file changed, 1 insertion(+)

@@ -6973,6 +6973,7 @@ L:	[email protected]
 S:	Maintained
 F:	Documentation/firmware-guide/acpi/gpio-properties.rst
 F:	drivers/gpio/gpiolib-acpi.c
+F:	drivers/gpio/gpiolib-acpi.h
 
 GPIO IR Transmitter
 M:	Sean Young <[email protected]>

From: Christian Lamparter <[email protected]>

commit 22d0d5ae7a089967e9295a06694aa3e8a812b15e upstream.

This patch changes the ath9k_pci_owl_loader to use the same iowrite32 memory accessor that ath9k_pci is using to communicate with the PCI(e) chip.

This will fix endian issues that came up during testing with loaned AVM Fritz!Box 7360 (Lantiq MIPS SoCs + AR9287).

---
 drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -84,7 +84,7 @@ static int ath9k_pci_fixup(struct pci_de
 			val = swahb32(val);
 		}
 
-		__raw_writel(val, mem + reg);
+		iowrite32(val, mem + reg);
 		usleep_range(100, 120);
 	}
 

From: Marc Kleine-Budde <[email protected]>

commit 8ac9d71d601374222a230804e419cd40c4492e1c upstream.

During development the define J1939_PGN_ADDRESS_REQUEST was renamed to J1939_PGN_REQUEST. It was forgotten to adjust the documentation accordingly.

This patch fixes the name of the symbol.

---
 Documentation/networking/j1939.rst |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -339,7 +339,7 @@ To claim an address following code examp
 			.pgn = J1939_PGN_ADDRESS_CLAIMED,
 			.pgn_mask = J1939_PGN_PDU1_MAX,
 		}, {
-			.pgn = J1939_PGN_ADDRESS_REQUEST,
+			.pgn = J1939_PGN_REQUEST,
 			.pgn_mask = J1939_PGN_PDU1_MAX,
 		}, {
 			.pgn = J1939_PGN_ADDRESS_COMMANDED,

From: Florian Fainelli <[email protected]>

commit 392a9f63058f2cdcec8363b849a25532ee40da9f upstream.

The reset controller has a #reset-cells value of 1, so we should see a phandle plus a register identifier, fix the example.

---
 Documentation/devicetree/bindings/reset/brcm,brcmstb-reset.txt |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -22,6 +22,6 @@ Example:
 	};
 
 	&ethernet_switch {
-		resets = <&reset>;
+		resets = <&reset 26>;
 		reset-names = "switch";
 	};

From: Florian Fainelli <[email protected]>

commit ce89d8d3a70fa530e16f0b0f8994385a214cd0c0 upstream.

The use of IS_ALIGNED() is incorrect, the typical resource we pass looks like this: start: 0x8404318, size: 0x30. When using IS_ALIGNED() we will get the following 0x8404318 & (0x18 - 1) = 0x10 which is definitively not equal to 0, same goes with the size. These two checks would make the driver fail probing.

Remove the resource checks, since there should be no constraint on the base addresse or size.

---
 drivers/reset/reset-brcmstb.c |    6 ------
 1 file changed, 6 deletions(-)

@@ -91,12 +91,6 @@ static int brcmstb_reset_probe(struct pl
 		return -ENOMEM;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	if (!IS_ALIGNED(res->start, SW_INIT_BANK_SIZE) ||
-	    !IS_ALIGNED(resource_size(res), SW_INIT_BANK_SIZE)) {
-		dev_err(kdev, "incorrect register range\n");
-		return -EINVAL;
-	}
-
 	priv->base = devm_ioremap_resource(kdev, res);
 	if (IS_ERR(priv->base))
 		return PTR_ERR(priv->base);

From: David Howells <[email protected]>

commit 106bc79843c3c6f4f00753d1f46e54e815f99377 upstream.

Fix missing cell comparison in afs_test_super(). Without this, any pair volumes that have the same volume ID will share a superblock, no matter the cell, unless they're in different network namespaces.

Normally, most users will only deal with a single cell and so they won't see this. Even if they do look into a second cell, they won't see a problem unless they happen to hit a volume with the same ID as one they've already got mounted.

Before the patch:

    # ls /afs/grand.central.org/archive
    linuxdev/  mailman/  moin/  mysql/  pipermail/  stage/  twiki/
    # ls /afs/kth.se/
    linuxdev/  mailman/  moin/  mysql/  pipermail/  stage/  twiki/
    # cat /proc/mounts | grep afs
    none /afs afs rw,relatime,dyn,autocell 0 0
    #grand.central.org:root.cell /afs/grand.central.org afs ro,relatime 0 0
    #grand.central.org:root.archive /afs/grand.central.org/archive afs ro,relatime 0 0
    #grand.central.org:root.archive /afs/kth.se afs ro,relatime 0 0

After the patch:

    # ls /afs/grand.central.org/archive
    linuxdev/  mailman/  moin/  mysql/  pipermail/  stage/  twiki/
    # ls /afs/kth.se/
    admin/        common/  install/  OldFiles/  service/  system/
    bakrestores/  home/    misc/     pkg/       src/      wsadmin/
    # cat /proc/mounts | grep afs
    none /afs afs rw,relatime,dyn,autocell 0 0
    #grand.central.org:root.cell /afs/grand.central.org afs ro,relatime 0 0
    #grand.central.org:root.archive /afs/grand.central.org/archive afs ro,relatime 0 0
    #kth.se:root.cell /afs/kth.se afs ro,relatime 0 0

---
 fs/afs/super.c |    1 +
 1 file changed, 1 insertion(+)

@@ -404,6 +404,7 @@ static int afs_test_super(struct super_b
 	return (as->net_ns == fc->net_ns &&
 		as->volume &&
 		as->volume->vid == ctx->volume->vid &&
+		as->cell == ctx->cell &&
 		!as->dyn_root);
 }
 

From: Ed Maste <[email protected]>

commit 58b3bafff8257c6946df5d6aeb215b8ac839ed2a upstream.

In 7fcfa9a2d9 an unintended prefix "Counter:18 Name:" was removed from the description for L1D_RO_EXCL_WRITES, but the extra name remained in the description. Remove it too.

---
 tools/perf/pmu-events/arch/s390/cf_z14/extended.json |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -4,7 +4,7 @@
 		"EventCode": "128",
 		"EventName": "L1D_RO_EXCL_WRITES",
 		"BriefDescription": "L1D Read-only Exclusive Writes",
-		"PublicDescription": "L1D_RO_EXCL_WRITES A directory write to the Level-1 Data cache where the line was originally in a Read-Only state in the cache but has been updated to be in the Exclusive state that allows stores to the cache line"
+		"PublicDescription": "A directory write to the Level-1 Data cache where the line was originally in a Read-Only state in the cache but has been updated to be in the Exclusive state that allows stores to the cache line"
 	},
 	{
 		"Unit": "CPU-M-CF",

From: Andy Lutomirski <[email protected]>

commit cf3b83e19d7c928e05a5d193c375463182c6029a upstream.

x86 has special handling for COMPAT_SYSCALL_DEFINEx, but there was no override for COMPAT_SYSCALL_DEFINE0. Wire it up so that we can use it for rt_sigreturn.

---
 arch/x86/include/asm/syscall_wrapper.h |   32 ++++++++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

@@ -28,13 +28,21 @@
  * kernel/sys_ni.c and SYS_NI in kernel/time/posix-stubs.c to cover this
  * case as well.
  */
+#define __IA32_COMPAT_SYS_STUB0(x, name)				\
+	asmlinkage long __ia32_compat_sys_##name(const struct pt_regs *regs);\
+	ALLOW_ERROR_INJECTION(__ia32_compat_sys_##name, ERRNO);		\
+	asmlinkage long __ia32_compat_sys_##name(const struct pt_regs *regs)\
+	{								\
+		return __se_compat_sys_##name();			\
+	}
+
 #define __IA32_COMPAT_SYS_STUBx(x, name, ...)				\
 	asmlinkage long __ia32_compat_sys##name(const struct pt_regs *regs);\
 	ALLOW_ERROR_INJECTION(__ia32_compat_sys##name, ERRNO);		\
 	asmlinkage long __ia32_compat_sys##name(const struct pt_regs *regs)\
 	{								\
 		return __se_compat_sys##name(SC_IA32_REGS_TO_ARGS(x,__VA_ARGS__));\
-	}								\
+	}
 
 #define __IA32_SYS_STUBx(x, name, ...)					\
 	asmlinkage long __ia32_sys##name(const struct pt_regs *regs);	\

@@ -76,15 +84,24 @@
  * of the x86-64-style parameter ordering of x32 syscalls. The syscalls common
  * with x86_64 obviously do not need such care.
  */
+#define __X32_COMPAT_SYS_STUB0(x, name, ...)				\
+	asmlinkage long __x32_compat_sys_##name(const struct pt_regs *regs);\
+	ALLOW_ERROR_INJECTION(__x32_compat_sys_##name, ERRNO);		\
+	asmlinkage long __x32_compat_sys_##name(const struct pt_regs *regs)\
+	{								\
+		return __se_compat_sys_##name();\
+	}
+
 #define __X32_COMPAT_SYS_STUBx(x, name, ...)				\
 	asmlinkage long __x32_compat_sys##name(const struct pt_regs *regs);\
 	ALLOW_ERROR_INJECTION(__x32_compat_sys##name, ERRNO);		\
 	asmlinkage long __x32_compat_sys##name(const struct pt_regs *regs)\
 	{								\
 		return __se_compat_sys##name(SC_X86_64_REGS_TO_ARGS(x,__VA_ARGS__));\
-	}								\
+	}
 
 #else /* CONFIG_X86_X32 */
+#define __X32_COMPAT_SYS_STUB0(x, name)
 #define __X32_COMPAT_SYS_STUBx(x, name, ...)
 #endif /* CONFIG_X86_X32 */
 

@@ -95,6 +112,17 @@
  * mapping of registers to parameters, we need to generate stubs for each
  * of them.
  */
+#define COMPAT_SYSCALL_DEFINE0(name)					\
+	static long __se_compat_sys_##name(void);			\
+	static inline long __do_compat_sys_##name(void);		\
+	__IA32_COMPAT_SYS_STUB0(x, name)				\
+	__X32_COMPAT_SYS_STUB0(x, name)					\
+	static long __se_compat_sys_##name(void)			\
+	{								\
+		return __do_compat_sys_##name();			\
+	}								\
+	static inline long __do_compat_sys_##name(void)
+
 #define COMPAT_SYSCALL_DEFINEx(x, name, ...)					\
 	static long __se_compat_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__));	\
 	static inline long __do_compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__));\

From: Sami Tolvanen <[email protected]>

commit 00198a6eaf66609de5e4de9163bb42c7ca9dd7b7 upstream.

Use COMPAT_SYSCALL_DEFINE0 to define (rt_)sigreturn() syscalls to replace sys32_sigreturn() and sys32_rt_sigreturn(). This fixes indirect call mismatches with Control-Flow Integrity (CFI) checking.

---
 arch/x86/entry/syscalls/syscall_32.tbl |    4 ++--
 arch/x86/ia32/ia32_signal.c            |    5 +++--
 2 files changed, 5 insertions(+), 4 deletions(-)

@@ -130,7 +130,7 @@
 116	i386	sysinfo			sys_sysinfo			__ia32_compat_sys_sysinfo
 117	i386	ipc			sys_ipc				__ia32_compat_sys_ipc
 118	i386	fsync			sys_fsync			__ia32_sys_fsync
-119	i386	sigreturn		sys_sigreturn			sys32_sigreturn
+119	i386	sigreturn		sys_sigreturn			__ia32_compat_sys_sigreturn
 120	i386	clone			sys_clone			__ia32_compat_sys_x86_clone
 121	i386	setdomainname		sys_setdomainname		__ia32_sys_setdomainname
 122	i386	uname			sys_newuname			__ia32_sys_newuname

@@ -184,7 +184,7 @@
 170	i386	setresgid		sys_setresgid16			__ia32_sys_setresgid16
 171	i386	getresgid		sys_getresgid16			__ia32_sys_getresgid16
 172	i386	prctl			sys_prctl			__ia32_sys_prctl
-173	i386	rt_sigreturn		sys_rt_sigreturn		sys32_rt_sigreturn
+173	i386	rt_sigreturn		sys_rt_sigreturn		__ia32_compat_sys_rt_sigreturn
 174	i386	rt_sigaction		sys_rt_sigaction		__ia32_compat_sys_rt_sigaction
 175	i386	rt_sigprocmask		sys_rt_sigprocmask		__ia32_compat_sys_rt_sigprocmask
 176	i386	rt_sigpending		sys_rt_sigpending		__ia32_compat_sys_rt_sigpending

@@ -21,6 +21,7 @@
 #include <linux/personality.h>
 #include <linux/compat.h>
 #include <linux/binfmts.h>
+#include <linux/syscalls.h>
 #include <asm/ucontext.h>
 #include <linux/uaccess.h>
 #include <asm/fpu/internal.h>

@@ -118,7 +119,7 @@ static int ia32_restore_sigcontext(struc
 	return err;
 }
 
-asmlinkage long sys32_sigreturn(void)
+COMPAT_SYSCALL_DEFINE0(sigreturn)
 {
 	struct pt_regs *regs = current_pt_regs();
 	struct sigframe_ia32 __user *frame = (struct sigframe_ia32 __user *)(regs->sp-8);

@@ -144,7 +145,7 @@ badframe:
 	return 0;
 }
 
-asmlinkage long sys32_rt_sigreturn(void)
+COMPAT_SYSCALL_DEFINE0(rt_sigreturn)
 {
 	struct pt_regs *regs = current_pt_regs();
 	struct rt_sigframe_ia32 __user *frame;

From: Sami Tolvanen <[email protected]>

commit f48f01a92cca09e86d46c91d8edf9d5a71c61727 upstream.

Use the correct function type for sys_ni_syscall() in system call tables to fix indirect call mismatches with Control-Flow Integrity (CFI) checking.

---
 arch/x86/entry/syscall_32.c            |    8 +++-----
 arch/x86/entry/syscall_64.c            |   14 ++++++++++----
 arch/x86/entry/syscalls/syscall_32.tbl |    4 ++--
 3 files changed, 15 insertions(+), 11 deletions(-)

@@ -10,13 +10,11 @@
 #ifdef CONFIG_IA32_EMULATION
 /* On X86_64, we use struct pt_regs * to pass parameters to syscalls */
 #define __SYSCALL_I386(nr, sym, qual) extern asmlinkage long sym(const struct pt_regs *);
-
-/* this is a lie, but it does not hurt as sys_ni_syscall just returns -EINVAL */
-extern asmlinkage long sys_ni_syscall(const struct pt_regs *);
-
+#define __sys_ni_syscall __ia32_sys_ni_syscall
 #else /* CONFIG_IA32_EMULATION */
 #define __SYSCALL_I386(nr, sym, qual) extern asmlinkage long sym(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long);
 extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long);
+#define __sys_ni_syscall sys_ni_syscall
 #endif /* CONFIG_IA32_EMULATION */
 
 #include <asm/syscalls_32.h>

@@ -29,6 +27,6 @@ __visible const sys_call_ptr_t ia32_sys_
 	 * Smells like a compiler bug -- it doesn't work
 	 * when the & below is removed.
 	 */
-	[0 ... __NR_syscall_compat_max] = &sys_ni_syscall,
+	[0 ... __NR_syscall_compat_max] = &__sys_ni_syscall,
 #include <asm/syscalls_32.h>
 };

@@ -4,11 +4,17 @@
 #include <linux/linkage.h>
 #include <linux/sys.h>
 #include <linux/cache.h>
+#include <linux/syscalls.h>
 #include <asm/asm-offsets.h>
 #include <asm/syscall.h>
 
-/* this is a lie, but it does not hurt as sys_ni_syscall just returns -EINVAL */
-extern asmlinkage long sys_ni_syscall(const struct pt_regs *);
+extern asmlinkage long sys_ni_syscall(void);
+
+SYSCALL_DEFINE0(ni_syscall)
+{
+	return sys_ni_syscall();
+}
+
 #define __SYSCALL_64(nr, sym, qual) extern asmlinkage long sym(const struct pt_regs *);
 #define __SYSCALL_X32(nr, sym, qual) __SYSCALL_64(nr, sym, qual)
 #include <asm/syscalls_64.h>

@@ -23,7 +29,7 @@ asmlinkage const sys_call_ptr_t sys_call
 	 * Smells like a compiler bug -- it doesn't work
 	 * when the & below is removed.
 	 */
-	[0 ... __NR_syscall_max] = &sys_ni_syscall,
+	[0 ... __NR_syscall_max] = &__x64_sys_ni_syscall,
 #include <asm/syscalls_64.h>
 };
 

@@ -40,7 +46,7 @@ asmlinkage const sys_call_ptr_t x32_sys_
 	 * Smells like a compiler bug -- it doesn't work
 	 * when the & below is removed.
 	 */
-	[0 ... __NR_syscall_x32_max] = &sys_ni_syscall,
+	[0 ... __NR_syscall_x32_max] = &__x64_sys_ni_syscall,
 #include <asm/syscalls_64.h>
 };
 

@@ -124,7 +124,7 @@
 110	i386	iopl			sys_iopl			__ia32_sys_iopl
 111	i386	vhangup			sys_vhangup			__ia32_sys_vhangup
 112	i386	idle
-113	i386	vm86old			sys_vm86old			sys_ni_syscall
+113	i386	vm86old			sys_vm86old			__ia32_sys_ni_syscall
 114	i386	wait4			sys_wait4			__ia32_compat_sys_wait4
 115	i386	swapoff			sys_swapoff			__ia32_sys_swapoff
 116	i386	sysinfo			sys_sysinfo			__ia32_compat_sys_sysinfo

@@ -177,7 +177,7 @@
 163	i386	mremap			sys_mremap			__ia32_sys_mremap
 164	i386	setresuid		sys_setresuid16			__ia32_sys_setresuid16
 165	i386	getresuid		sys_getresuid16			__ia32_sys_getresuid16
-166	i386	vm86			sys_vm86			sys_ni_syscall
+166	i386	vm86			sys_vm86			__ia32_sys_ni_syscall
 167	i386	query_module
 168	i386	poll			sys_poll			__ia32_sys_poll
 169	i386	nfsservctl

From: Sami Tolvanen <[email protected]>

commit 6e4847640c6aebcaa2d9b3686cecc91b41f09269 upstream.

Define a weak function in COND_SYSCALL instead of a weak alias to sys_ni_syscall(), which has an incompatible type. This fixes indirect call mismatches with Control-Flow Integrity (CFI) checking.

---
 arch/x86/include/asm/syscall_wrapper.h |   21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

@@ -6,6 +6,8 @@
 #ifndef _ASM_X86_SYSCALL_WRAPPER_H
 #define _ASM_X86_SYSCALL_WRAPPER_H
 
+struct pt_regs;
+
 /* Mapping of registers to parameters for syscalls on x86-64 and x32 */
 #define SC_X86_64_REGS_TO_ARGS(x, ...)					\
 	__MAP(x,__SC_ARGS						\

@@ -64,9 +66,15 @@
 	SYSCALL_ALIAS(__ia32_sys_##sname, __x64_sys_##sname);		\
 	asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused)
 
-#define COND_SYSCALL(name)						\
-	cond_syscall(__x64_sys_##name);					\
-	cond_syscall(__ia32_sys_##name)
+#define COND_SYSCALL(name)							\
+	asmlinkage __weak long __x64_sys_##name(const struct pt_regs *__unused)	\
+	{									\
+		return sys_ni_syscall();					\
+	}									\
+	asmlinkage __weak long __ia32_sys_##name(const struct pt_regs *__unused)\
+	{									\
+		return sys_ni_syscall();					\
+	}
 
 #define SYS_NI(name)							\
 	SYSCALL_ALIAS(__x64_sys_##name, sys_ni_posix_timers);		\

@@ -218,7 +226,11 @@
 #endif
 
 #ifndef COND_SYSCALL
-#define COND_SYSCALL(name) cond_syscall(__x64_sys_##name)
+#define COND_SYSCALL(name) 							\
+	asmlinkage __weak long __x64_sys_##name(const struct pt_regs *__unused)	\
+	{									\
+		return sys_ni_syscall();					\
+	}
 #endif
 
 #ifndef SYS_NI

@@ -230,7 +242,6 @@
  * For VSYSCALLS, we need to declare these three syscalls with the new
  * pt_regs-based calling convention for in-kernel use.
  */
-struct pt_regs;
 asmlinkage long __x64_sys_getcpu(const struct pt_regs *regs);
 asmlinkage long __x64_sys_gettimeofday(const struct pt_regs *regs);
 asmlinkage long __x64_sys_time(const struct pt_regs *regs);

From: Taehee Yoo <[email protected]>

commit 04b69426d846cd04ca9acefff1ea39e1c64d2714 upstream.

hsr slave interfaces don't have debugfs directory.
So, hsr_debugfs_rename() shouldn't be called when hsr slave interface name is changed.

Test commands:
ip link add dummy0 type dummy
ip link add dummy1 type dummy
ip link add hsr0 type hsr slave1 dummy0 slave2 dummy1 ip link set dummy0 name ap

Splat looks like:

[21071.899367][T22666] ap: renamed from dummy0
[21071.914005][T22666] ==================================================================
[21071.919008][T22666] BUG: KASAN: slab-out-of-bounds in hsr_debugfs_rename+0xaa/0xb0 [hsr]
[21071.923640][T22666] Read of size 8 at addr ffff88805febcd98 by task ip/22666
[21071.926941][T22666]
[21071.927750][T22666] CPU: 0 PID: 22666 Comm: ip Not tainted 5.5.0-rc2+ #240
[21071.929919][T22666] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[21071.935094][T22666] Call Trace:
[21071.935867][T22666]  dump_stack+0x96/0xdb
[21071.936687][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
[21071.937774][T22666]  print_address_description.constprop.5+0x1be/0x360
[21071.939019][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
[21071.940081][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
[21071.940949][T22666]  __kasan_report+0x12a/0x16f
[21071.941758][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
[21071.942674][T22666]  kasan_report+0xe/0x20
[21071.943325][T22666]  hsr_debugfs_rename+0xaa/0xb0 [hsr]
[21071.944187][T22666]  hsr_netdev_notify+0x1fe/0x9b0 [hsr]
[21071.945052][T22666]  ? __module_text_address+0x13/0x140
[21071.945897][T22666]  notifier_call_chain+0x90/0x160
[21071.946743][T22666]  dev_change_name+0x419/0x840
[21071.947496][T22666]  ? __read_once_size_nocheck.constprop.6+0x10/0x10
[21071.948600][T22666]  ? netdev_adjacent_rename_links+0x280/0x280
[21071.949577][T22666]  ? __read_once_size_nocheck.constprop.6+0x10/0x10
[21071.950672][T22666]  ? lock_downgrade+0x6e0/0x6e0
[21071.951345][T22666]  ? do_setlink+0x811/0x2ef0
[21071.951991][T22666]  do_setlink+0x811/0x2ef0
[21071.952613][T22666]  ? is_bpf_text_address+0x81/0xe0

[ ... ]

---
 net/hsr/hsr_main.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -46,7 +46,8 @@ static int hsr_netdev_notify(struct noti
 		hsr_check_carrier_and_operstate(hsr);
 		break;
 	case NETDEV_CHANGENAME:
-		hsr_debugfs_rename(dev);
+		if (is_hsr_master(dev))
+			hsr_debugfs_rename(dev);
 		break;
 	case NETDEV_CHANGEADDR:
 		if (port->type == HSR_PT_MASTER) {

From: Goldwyn Rodrigues <[email protected]>

commit 9cf35f673583ccc9f3e2507498b3079d56614ad3 upstream.

This is similar to 942491c9e6d6 ("xfs: fix AIM7 regression"). Apparently our current rwsem code doesn't like doing the trylock, then lock for real scheme. This causes extra contention on the lock and can be measured eg. by AIM7 benchmark. So change our read/write methods to just do the trylock for the RWF_NOWAIT case.

---
 fs/btrfs/file.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -1903,9 +1903,10 @@ static ssize_t btrfs_file_write_iter(str
 	    (iocb->ki_flags & IOCB_NOWAIT))
 		return -EOPNOTSUPP;
 
-	if (!inode_trylock(inode)) {
-		if (iocb->ki_flags & IOCB_NOWAIT)
+	if (iocb->ki_flags & IOCB_NOWAIT) {
+		if (!inode_trylock(inode))
 			return -EAGAIN;
+	} else {
 		inode_lock(inode);
 	}
 

From: Pablo Neira Ayuso <[email protected]>

commit 23403cd8898dbc9808d3eb2f63bc1db8a340b751 upstream.

If hardware offload commit path fails, release all flow_rule objects.

---
 net/netfilter/nf_tables_offload.c |   26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

@@ -358,14 +358,14 @@ int nft_flow_rule_offload_commit(struct
 				continue;
 
 			if (trans->ctx.flags & NLM_F_REPLACE ||
-			    !(trans->ctx.flags & NLM_F_APPEND))
-				return -EOPNOTSUPP;
-
+			    !(trans->ctx.flags & NLM_F_APPEND)) {
+				err = -EOPNOTSUPP;
+				break;
+			}
 			err = nft_flow_offload_rule(trans->ctx.chain,
 						    nft_trans_rule(trans),
 						    nft_trans_flow_rule(trans),
 						    FLOW_CLS_REPLACE);
-			nft_flow_rule_destroy(nft_trans_flow_rule(trans));
 			break;
 		case NFT_MSG_DELRULE:
 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))

@@ -379,7 +379,23 @@ int nft_flow_rule_offload_commit(struct
 		}
 
 		if (err)
-			return err;
+			break;
+	}
+
+	list_for_each_entry(trans, &net->nft.commit_list, list) {
+		if (trans->ctx.family != NFPROTO_NETDEV)
+			continue;
+
+		switch (trans->msg_type) {
+		case NFT_MSG_NEWRULE:
+			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
+				continue;
+
+			nft_flow_rule_destroy(nft_trans_flow_rule(trans));
+			break;
+		default:
+			break;
+		}
 	}
 
 	return err;

From: Arnd Bergmann <[email protected]>

commit 6408c40c39d8eee5caaf97f5219b7dd4e041cc59 upstream.

On 32-bit architectures, get_seconds() returns an unsigned 32-bit time value, which also matches the type used in the nft_meta code. This will not overflow in year 2038 as a time_t would, but it still suffers from the overflow problem later on in year 2106.

Change this instance to use the time64_t type consistently and avoid the deprecated get_seconds().

The nft_meta_weekday() calculation potentially gets a little slower on 32-bit architectures, but now it has the same behavior as on 64-bit architectures and does not overflow.

---
 net/netfilter/nft_meta.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

@@ -33,19 +33,19 @@
 
 static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state);
 
-static u8 nft_meta_weekday(unsigned long secs)
+static u8 nft_meta_weekday(time64_t secs)
 {
 	unsigned int dse;
 	u8 wday;
 
 	secs -= NFT_META_SECS_PER_MINUTE * sys_tz.tz_minuteswest;
-	dse = secs / NFT_META_SECS_PER_DAY;
+	dse = div_u64(secs, NFT_META_SECS_PER_DAY);
 	wday = (4 + dse) % NFT_META_DAYS_PER_WEEK;
 
 	return wday;
 }
 
-static u32 nft_meta_hour(unsigned long secs)
+static u32 nft_meta_hour(time64_t secs)
 {
 	struct tm tm;
 

@@ -250,10 +250,10 @@ void nft_meta_get_eval(const struct nft_
 		nft_reg_store64(dest, ktime_get_real_ns());
 		break;
 	case NFT_META_TIME_DAY:
-		nft_reg_store8(dest, nft_meta_weekday(get_seconds()));
+		nft_reg_store8(dest, nft_meta_weekday(ktime_get_real_seconds()));
 		break;
 	case NFT_META_TIME_HOUR:
-		*dest = nft_meta_hour(get_seconds());
+		*dest = nft_meta_hour(ktime_get_real_seconds());
 		break;
 	default:
 		WARN_ON(1);

From: Tzung-Bi Shih <[email protected]>

commit 7cf2804775f8a388411624b3e768e55d08711e9d upstream.

Headset codec is optional. Add missing update to DT binding document.

---
 Documentation/devicetree/bindings/sound/mt8183-mt6358-ts3a227-max98357.txt |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -2,9 +2,11 @@ MT8183 with MT6358, TS3A227 and MAX98357
 
 Required properties:
 - compatible : "mediatek,mt8183_mt6358_ts3a227_max98357"
-- mediatek,headset-codec: the phandles of ts3a227 codecs
 - mediatek,platform: the phandle of MT8183 ASoC platform
 
+Optional properties:
+- mediatek,headset-codec: the phandles of ts3a227 codecs
+
 Example:
 
 	sound {

From: Daniel Baluta <[email protected]>

commit 4bbee14d8e5487e3d2662138e3767cf4678cdf57 upstream.

When debug is enabled compiler cannot find the definition of clk_get_rate resulting in the following error:

./include/sound/simple_card_utils.h:168:40: note: previous implicit declaration of ‘clk_get_rate’ was here
dev_dbg(dev, "%s clk %luHz\n", name, clk_get_rate(dai->clk));
./include/sound/simple_card_utils.h:168:3: note: in expansion of macro ‘dev_dbg’
dev_dbg(dev, "%s clk %luHz\n", name, clk_get_rate(dai->clk));

Fix this by including the appropriate header.

---
 include/sound/simple_card_utils.h |    1 +
 1 file changed, 1 insertion(+)

@@ -8,6 +8,7 @@
 #ifndef __SIMPLE_CARD_UTILS_H
 #define __SIMPLE_CARD_UTILS_H
 
+#include <linux/clk.h>
 #include <sound/soc.h>
 
 #define asoc_simple_init_hp(card, sjack, prefix) \

From: Shengjiu Wang <[email protected]>

commit 35dac627471938eda89fa39ee4ead1f7667e0f57 upstream.

xrun may happen at the end of stream, the trigger->fsl_esai_trigger_stop maybe called in the middle of fsl_esai_hw_reset, this may cause esai in wrong state after stop, and there may be endless xrun interrupt.

This issue may also happen with trigger->fsl_esai_trigger_start.

So Add spin lock to lock those functions.

---
 sound/soc/fsl/fsl_esai.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

@@ -33,6 +33,7 @@
  * @fsysclk: system clock source to derive HCK, SCK and FS
  * @spbaclk: SPBA clock (optional, depending on SoC design)
  * @task: tasklet to handle the reset operation
+ * @lock: spin lock between hw_reset() and trigger()
  * @fifo_depth: depth of tx/rx FIFO
  * @slot_width: width of each DAI slot
  * @slots: number of slots

@@ -56,6 +57,7 @@ struct fsl_esai {
 	struct clk *fsysclk;
 	struct clk *spbaclk;
 	struct tasklet_struct task;
+	spinlock_t lock; /* Protect hw_reset and trigger */
 	u32 fifo_depth;
 	u32 slot_width;
 	u32 slots;

@@ -676,8 +678,10 @@ static void fsl_esai_hw_reset(unsigned l
 {
 	struct fsl_esai *esai_priv = (struct fsl_esai *)arg;
 	bool tx = true, rx = false, enabled[2];
+	unsigned long lock_flags;
 	u32 tfcr, rfcr;
 
+	spin_lock_irqsave(&esai_priv->lock, lock_flags);
 	/* Save the registers */
 	regmap_read(esai_priv->regmap, REG_ESAI_TFCR, &tfcr);
 	regmap_read(esai_priv->regmap, REG_ESAI_RFCR, &rfcr);

@@ -715,6 +719,8 @@ static void fsl_esai_hw_reset(unsigned l
 		fsl_esai_trigger_start(esai_priv, tx);
 	if (enabled[rx])
 		fsl_esai_trigger_start(esai_priv, rx);
+
+	spin_unlock_irqrestore(&esai_priv->lock, lock_flags);
 }
 
 static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd,

@@ -722,6 +728,7 @@ static int fsl_esai_trigger(struct snd_p
 {
 	struct fsl_esai *esai_priv = snd_soc_dai_get_drvdata(dai);
 	bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK;
+	unsigned long lock_flags;
 
 	esai_priv->channels[tx] = substream->runtime->channels;
 

@@ -729,12 +736,16 @@ static int fsl_esai_trigger(struct snd_p
 	case SNDRV_PCM_TRIGGER_START:
 	case SNDRV_PCM_TRIGGER_RESUME:
 	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		spin_lock_irqsave(&esai_priv->lock, lock_flags);
 		fsl_esai_trigger_start(esai_priv, tx);
+		spin_unlock_irqrestore(&esai_priv->lock, lock_flags);
 		break;
 	case SNDRV_PCM_TRIGGER_SUSPEND:
 	case SNDRV_PCM_TRIGGER_STOP:
 	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+		spin_lock_irqsave(&esai_priv->lock, lock_flags);
 		fsl_esai_trigger_stop(esai_priv, tx);
+		spin_unlock_irqrestore(&esai_priv->lock, lock_flags);
 		break;
 	default:
 		return -EINVAL;

@@ -1002,6 +1013,7 @@ static int fsl_esai_probe(struct platfor
 
 	dev_set_drvdata(&pdev->dev, esai_priv);
 
+	spin_lock_init(&esai_priv->lock);
 	ret = fsl_esai_hw_init(esai_priv);
 	if (ret)
 		return ret;

From: Pierre-Louis Bossart <[email protected]>

commit a6955fe0e2309feeab5ec71e4b0dcbe498f4f497 upstream.

Some distros select all options blindly, which leads to confusion and bug reports. SOF does not fully support Broadwell due to firmware dependencies, the machine drivers can only support one option, and UCM/topology files are still being propagated to downstream distros, so make SOF on Broadwell an opt-in option that first require distros to opt-out of existing defaults.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204237

---
 sound/soc/intel/Kconfig     |    3 +++
 sound/soc/sof/intel/Kconfig |   10 +++++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

@@ -59,6 +59,9 @@ config SND_SOC_INTEL_HASWELL
 	  If you have a Intel Haswell or Broadwell platform connected to
 	  an I2S codec, then enable this option by saying Y or m. This is
 	  typically used for Chromebooks. This is a recommended option.
+	  This option is mutually exclusive with the SOF support on
+	  Broadwell. If you want to enable SOF on Broadwell, you need to
+	  deselect this option first.
 
 config SND_SOC_INTEL_BAYTRAIL
 	tristate "Baytrail (legacy) Platforms"

@@ -76,10 +76,18 @@ config SND_SOC_SOF_BAYTRAIL
 
 config SND_SOC_SOF_BROADWELL_SUPPORT
 	bool "SOF support for Broadwell"
+	depends on SND_SOC_INTEL_HASWELL=n
 	help
 	  This adds support for Sound Open Firmware for Intel(R) platforms
 	  using the Broadwell processors.
-	  Say Y if you have such a device.
+	  This option is mutually exclusive with the Haswell/Broadwell legacy
+	  driver. If you want to enable SOF on Broadwell you need to deselect
+	  the legacy driver first.
+	  SOF does fully support Broadwell yet, so this option is not
+	  recommended for distros. At some point all legacy drivers will be
+	  deprecated but not before all userspace firmware/topology/UCM files
+	  are made available to downstream distros.
+	  Say Y if you want to enable SOF on Broadwell
 	  If unsure select "N".
 
 config SND_SOC_SOF_BROADWELL