4.9.54-stable review

This is the start of the stable review cycle for the 4.9.54 release. There are 104 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sun Oct 8 08:37:55 UTC 2017. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.54-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 4.9.54-rc1

Gerald Schaefer <[email protected]>
s390/mm: make pmdp_invalidate() do invalidation only

Arnd Bergmann <[email protected]>
ttpci: address stringop overflow warning

Arnd Bergmann <[email protected]>
ALSA: au88x0: avoid theoretical uninitialized access

Nicholas Mc Guire <[email protected]>
ASoC: rt5660: remove double const

Nicholas Mc Guire <[email protected]>
ASoC: rt5659: drop double const

Arnd Bergmann <[email protected]>

    ASoC: rt5514: fix gcc-7 warning

Arnd Bergmann <[email protected]>
ARM: remove duplicate 'const' annotations'

Arnd Bergmann <[email protected]>
IB/qib: fix false-postive maybe-uninitialized warning

Len Brown <[email protected]>
tools/power turbostat: bugfix: GFXMHz column not changing

Jon Mason <[email protected]>
ARM: dts: BCM5301X: Fix memory start address

Gwendal Grignou <[email protected]>
libata: transport: Remove circular dependency at free time

Charles Keepax <[email protected]>
ASoC: wm_adsp: Return an error on write to a disabled volatile control

Darrick J. Wong <[email protected]>
xfs: remove kmem_zalloc_greedy

Heiner Kallweit <[email protected]>
i2c: meson: fix wrong variable usage in meson_i2c_put_data

Pablo Neira Ayuso <[email protected]>

    netfilter: nf_tables: set pktinfo->thoff at AH header if found

Shaohua Li <[email protected]>
md/raid10: submit bio directly to replacement disk

Zhu Yanjun <[email protected]>
rds: ib: add error handle

Laurent Dufour <[email protected]>
mm/cgroup: avoid panic when init with low memory

Mark Rutland <[email protected]>
arm64: kasan: avoid bad virt_to_pfn()

Oleksandr Tyshchenko <[email protected]>
iommu/io-pgtable-arm: Check for leaf entry before dereferencing it

Dou Liyang <[email protected]>
x86/acpi: Restore the order of CPU IDs

Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Update pid_params.sample_rate_ns in pid_param_set()

Nathan Fontenot <[email protected]>
ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs

Jason Yan <[email protected]>
nfs: make nfs4_cb_sv_ops static

Arvind Yadav <[email protected]>
parisc: perf: Fix potential NULL pointer dereference

Liping Zhang <[email protected]>

    netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max

Sagi Grimberg <[email protected]>
nvme-rdma: handle cpu unplug when re-establishing the controller

Matt Redfearn <[email protected]>
MIPS: smp-cps: Fix retrieval of VPE mask on big endian CPUs

Thibault Saunier <[email protected]>
exynos-gsc: Do not swap cb/cr for semi planar formats

Marek Szyprowski <[email protected]>
iommu/exynos: Block SYSMMU while invalidating FLPD cache

Matt Redfearn <[email protected]>
MIPS: IRQ Stack: Unwind IRQ stack onto task stack

Liping Zhang <[email protected]>
netfilter: invoke synchronize_rcu after set the _hook_ to NULL

Randy Dunlap <[email protected]>
drivers/rapidio/devices/tsi721.c: make module parameter variable name unique

Mike Galbraith <[email protected]>
kasan: do not sanitize kexec purgatory

Mike Kravetz <[email protected]>
hugetlbfs: initialize shared policy as part of inode allocation

Ondrej Zary <[email protected]>
sata_via: Enable hotplug only on VT6421

Liu Bo <[email protected]>
Btrfs: fix potential use-after-free for cloned bio

Liu Bo <[email protected]>
Btrfs: fix segmentation fault when doing dio read

Ido Schimmel <[email protected]>
bridge: netlink: register netdevice before executing changelink

Heiner Kallweit <[email protected]>
mmc: sdio: fix alignment issue in struct sdio_func

[email protected] <[email protected]>
qed: Fix possible system hang in the dcbnl-getdcbx() path.

Florian Fainelli <[email protected]>
net: dsa: b53: Include IMP/CPU port in dumb forwarding mode

Ansis Atteka <[email protected]>
udp: disable inner UDP checksum offloads in IPsec case

Roman Spychała <[email protected]>
usb: plusb: Add support for PL-27A1

Pan Bian <[email protected]>
team: fix memory leaks

Alexander Potapenko <[email protected]>
net/packet: check length in getsockopt() called with PACKET_HDRLEN

Myungho Jung <[email protected]>
net: core: Prevent from dereferencing null pointer when releasing SKB

Juerg Haefliger <[email protected]>
lkdtm: Fix Oops when unloading the module

Arvind Yadav <[email protected]>
mips: ath79: clock:- Unmap region obtained by of_iomap

Arnd Bergmann <[email protected]>
MIPS: Lantiq: Fix another request_mem_region() return code check

Benjamin Tissoires <[email protected]>
HID: wacom: release the resources before leaving despite devm

Brian Starkey <[email protected]>
drm: mali-dp: Fix transposed horizontal/vertical flip

Brian Starkey <[email protected]>
drm: mali-dp: Fix destination size handling when rotating

Linus Walleij <[email protected]>
ASoC: dapm: fix some pointer error handling

Axel Köllhofer <[email protected]>
rtl8xxxu: Add additional USB IDs for rtl8192eu devices

Peter Chen <[email protected]>
usb: chipidea: vbus event may exist before starting gadget

Sricharan R <[email protected]>
iommu/arm-smmu: Set privileged attribute to 'default' instead of 'unprivileged'

David E. Box <[email protected]>
spi: pxa2xx: Add support for Intel Gemini Lake

Michal Kazior <[email protected]>
ath10k: prevent sta pointer rcu violation

Richard Guy Briggs <[email protected]>
audit: log 32-bit socketcalls

Linus Walleij <[email protected]>
ASoC: dapm: handle probe deferrals

Alden Tondettar <[email protected]>
partitions/efi: Fix integer overflow in GPT size calculation

Markus Elfring <[email protected]>
pinctrl: mvebu: Use seq_puts() in mvebu_pinconf_group_dbg_show()

Edward Cree <[email protected]>
sfc: get PIO buffer size from the NIC

Johan Hovold <[email protected]>
USB: serial: mos7840: fix control-message error handling

Johan Hovold <[email protected]>
USB: serial: mos7720: fix control-message error handling

Pan Bian <[email protected]>
drm/amdkfd: fix improper return value on error

James Liao <[email protected]>
arm: dts: mt2701: Add subsystem clock controller device nodes

Feras Daoud <[email protected]>

    IB/ipoib: Replace list_del of the neigh->list with list_del_init

Feras Daoud <[email protected]>
IB/ipoib: rtnl_unlock can not come after free_netdev

Feras Daoud <[email protected]>
IB/ipoib: Fix deadlock over vlan_mutex

Alexey Brodkin <[email protected]>
serial: 8250_port: Remove dangerous pr_debug()

Christophe JAILLET <[email protected]>
tty: goldfish: Fix a parameter of a call to free_irq

Matwey V. Kornilov <[email protected]>
serial: 8250: moxa: Store num_ports in brd

Nagaraju, Vathsala <[email protected]>
drm/i915/psr: disable psr2 for resolution greater than 32X20

Afzal Mohammed <[email protected]>
ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM

Bart Van Assche <[email protected]>
IB/rxe: Fix a MR reference leak in check_rkey()

Bart Van Assche <[email protected]>
IB/rxe: Add a runtime check in alloc_index()

Andreas Klinger <[email protected]>
iio: adc: hx711: Add DT binding for avia,hx711

Hans de Goede <[email protected]>
iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications

Javier Martinez Canillas <[email protected]>
iio: adc: imx25-gcq: Fix module autoload

Guenter Roeck <[email protected]>
hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes

John Crispin <[email protected]>
usb: make the MTK XHCI driver compile for older MIPS SoCs

Jose Abreu <[email protected]>

    clk/axs10x: Clear init field in driver probe

Niklas Söderlund <[email protected]>
sh_eth: use correct name for ECMR_MPDE bit

Jiancheng Xue <[email protected]>
reset: ti_syscon: fix a ti_syscon_reset_status issue

Hans de Goede <[email protected]>
extcon: axp288: Use vbus-valid instead of -present to determine cable presence

Guilherme G Piccoli <[email protected]>
igb: re-assign hw address pointer on reset after PCI error

Marcin Niestroj <[email protected]>
ARM: dts: am335x-chilisom: Wakeup from RTC-only state by power on event

Jitendra Bhivare <[email protected]>
scsi: be2iscsi: Add checks to validate CID alloc/free

Hans de Goede <[email protected]>
power: supply: axp288_fuel_gauge: Fix fuel_gauge_reg_readb return on error

Colin Ian King <[email protected]>
MIPS: ralink: Fix incorrect assignment on ralink_soc

John Crispin <[email protected]>
MIPS: ralink: Fix a typo in the pinmux setup.

Marcin Nowakowski <[email protected]>
MIPS: kexec: Do not reserve invalid crashkernel memory on boot

Marcin Nowakowski <[email protected]>
MIPS: fix mem=X@Y commandline processing

Paul Burton <[email protected]>
MIPS: Ensure bss section ends on a long-aligned address

Simon Horman <[email protected]>
ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes

Santosh Shilimkar <[email protected]>
RDS: RDMA: Fix the composite message user notification

Ondrej Jirman <[email protected]>
clk: sunxi-ng: fix PLL_CPUX adjusting on H3

Bartlomiej Zolnierkiewicz <[email protected]>
ARM: dts: exynos: Add CPU OPPs for Exynos4412 Prime

Ville Syrjälä <[email protected]>
drm/i915: Fix the overlay frontbuffer tracking

Dan Carpenter <[email protected]>
GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next

Bartosz Golaszewski <[email protected]>
drm: bridge: add DT bindings for TI ths8135

Kristian H. Kristensen <[email protected]>
drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define

-------------

Diffstat:

 .../bindings/display/bridge/ti,ths8135.txt         |  46 ++++++
 .../devicetree/bindings/iio/adc/avia-hx711.txt     |  18 +++
 .../devicetree/bindings/vendor-prefixes.txt        |   1 +
 Makefile                                           |   4 +-
 arch/arm/Kconfig-nommu                             |   3 +-
 arch/arm/boot/dts/am335x-chilisom.dtsi             |   8 +
 arch/arm/boot/dts/bcm953012k.dts                   |   2 +-
 arch/arm/boot/dts/exynos4412-odroid-common.dtsi    |   4 +-
 arch/arm/boot/dts/exynos4412-odroidu3.dts          |   5 +-
 arch/arm/boot/dts/exynos4412-odroidx2.dts          |   1 +
 arch/arm/boot/dts/exynos4412-prime.dtsi            |  41 ++++++
 arch/arm/boot/dts/exynos4412.dtsi                  |   2 +-
 arch/arm/boot/dts/mt2701.dtsi                      |  36 +++++
 arch/arm/boot/dts/r8a7790.dtsi                     |  12 +-
 arch/arm/mach-at91/pm.c                            |   2 +-
 arch/arm/mach-bcm/bcm_kona_smc.c                   |   2 +-
 arch/arm/mach-cns3xxx/core.c                       |   2 +-
 arch/arm/mach-omap2/prm_common.c                   |   2 +-
 arch/arm/mach-omap2/vc.c                           |   2 +-
 arch/arm/mach-spear/time.c                         |   2 +-
 arch/arm64/mm/kasan_init.c                         |   2 +-
 arch/mips/ath79/clock.c                            |   7 +-
 arch/mips/include/asm/irq.h                        |  15 ++
 arch/mips/kernel/asm-offsets.c                     |   1 +
 arch/mips/kernel/cps-vec.S                         |   2 +-
 arch/mips/kernel/genex.S                           |   8 +-
 arch/mips/kernel/process.c                         |  56 ++++---
 arch/mips/kernel/setup.c                           |   9 ++
 arch/mips/kernel/vmlinux.lds.S                     |   2 +-
 arch/mips/lantiq/xway/sysctrl.c                    |   4 +-
 arch/mips/ralink/mt7620.c                          |  18 +--
 arch/mips/ralink/rt3883.c                          |   2 +-
 arch/parisc/kernel/perf.c                          |  94 ++++++------
 arch/s390/include/asm/pgtable.h                    |   4 +-
 arch/x86/kernel/acpi/boot.c                        |   7 +-
 arch/x86/kernel/apic/apic.c                        |  26 +---
 arch/x86/purgatory/Makefile                        |   1 +
 block/partitions/efi.c                             |  17 ++-
 drivers/ata/libata-transport.c                     |   9 +-
 drivers/ata/sata_via.c                             |  18 ++-
 drivers/clk/axs10x/i2s_pll_clock.c                 |   1 +
 drivers/clk/sunxi-ng/ccu-sun8i-h3.c                |  10 ++
 drivers/cpufreq/intel_pstate.c                     |   1 +
 drivers/extcon/extcon-axp288.c                     |   2 +-
 drivers/gpu/drm/amd/amdkfd/kfd_events.c            |   4 +-
 drivers/gpu/drm/arm/malidp_planes.c                |  13 +-
 drivers/gpu/drm/i915/intel_overlay.c               |  64 +++++---
 drivers/gpu/drm/i915/intel_psr.c                   |  15 +-
 drivers/hid/wacom_sys.c                            |   2 +
 drivers/hwmon/gl520sm.c                            |  25 ++--
 drivers/i2c/busses/i2c-meson.c                     |   2 +-
 drivers/iio/adc/axp288_adc.c                       |  32 +---
 drivers/iio/adc/fsl-imx25-gcq.c                    |   1 +
 drivers/infiniband/hw/qib/qib_iba7322.c            |   2 +-
 drivers/infiniband/sw/rxe/rxe_pool.c               |   1 +
 drivers/infiniband/sw/rxe/rxe_resp.c               |  20 +--
 drivers/infiniband/ulp/ipoib/ipoib_main.c          |   8 +-
 drivers/infiniband/ulp/ipoib/ipoib_vlan.c          |  10 +-
 drivers/iommu/arm-smmu.c                           |   2 +-
 drivers/iommu/exynos-iommu.c                       |   5 +-
 drivers/iommu/io-pgtable-arm.c                     |   6 +-
 drivers/md/raid10.c                                |  19 ++-
 drivers/media/pci/ttpci/av7110_hw.c                |   8 +-
 drivers/media/pci/ttpci/av7110_hw.h                |  12 +-
 drivers/media/platform/exynos-gsc/gsc-core.c       |   2 -
 drivers/misc/lkdtm_core.c                          |   4 +-
 drivers/mmc/core/sdio_bus.c                        |  12 +-
 drivers/net/dsa/b53/b53_common.c                   |  10 ++
 drivers/net/dsa/b53/b53_regs.h                     |   4 +
 drivers/net/ethernet/ibm/ibmvnic.c                 |   2 +
 drivers/net/ethernet/intel/igb/igb_main.c          |   5 +
 drivers/net/ethernet/qlogic/qed/qed_dcbx.c         |   2 +-
 drivers/net/ethernet/renesas/sh_eth.h              |   2 +-
 drivers/net/ethernet/sfc/ef10.c                    |  16 +-
 drivers/net/ethernet/sfc/nic.h                     |   2 +
 drivers/net/ethernet/sfc/tx.c                      |   1 -
 drivers/net/team/team.c                            |   8 +-
 drivers/net/usb/Kconfig                            |   2 +-
 drivers/net/usb/plusb.c                            |  15 +-
 drivers/net/wireless/ath/ath10k/core.h             |   1 +
 drivers/net/wireless/ath/ath10k/mac.c              |  18 +++
 .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  |   7 +
 drivers/nvme/host/rdma.c                           |  28 ++--
 drivers/pinctrl/mvebu/pinctrl-mvebu.c              |   9 +-
 drivers/power/supply/axp288_fuel_gauge.c           |   4 +-
 drivers/rapidio/devices/tsi721.c                   |   4 +-
 drivers/rapidio/devices/tsi721.h                   |   4 +-
 drivers/reset/reset-ti-syscon.c                    |   4 +-
 drivers/scsi/be2iscsi/be_iscsi.c                   | 163 +++++++++++----------
 drivers/scsi/be2iscsi/be_main.c                    |   7 +-
 drivers/scsi/be2iscsi/be_main.h                    |   1 +
 drivers/spi/spi-pxa2xx.c                           |   4 +
 drivers/tty/goldfish.c                             |   2 +-
 drivers/tty/serial/8250/8250_moxa.c                |   1 +
 drivers/tty/serial/8250/8250_port.c                |   4 -
 drivers/usb/chipidea/otg.c                         |  17 ++-
 drivers/usb/host/Kconfig                           |   4 +-
 drivers/usb/serial/mos7720.c                       |   9 +-
 drivers/usb/serial/mos7840.c                       |  19 ++-
 fs/btrfs/inode.c                                   |   8 +-
 fs/btrfs/volumes.c                                 |   2 +-
 fs/gfs2/glock.c                                    |  12 +-
 fs/hugetlbfs/inode.c                               |  25 ++--
 fs/nfs/callback.c                                  |   4 +-
 fs/xfs/kmem.c                                      |  18 ---
 fs/xfs/kmem.h                                      |   2 -
 fs/xfs/xfs_itable.c                                |   6 +-
 include/linux/audit.h                              |  20 +++
 include/linux/mmc/sdio_func.h                      |   2 +-
 include/net/netfilter/nf_tables_ipv6.h             |   6 +-
 include/uapi/drm/drm_fourcc.h                      |   1 +
 mm/memcontrol.c                                    |   7 +-
 net/bridge/br_netlink.c                            |   7 +-
 net/compat.c                                       |  17 ++-
 net/core/dev.c                                     |   3 +
 net/ipv4/netfilter/nf_nat_snmp_basic.c             |   1 +
 net/ipv4/udp_offload.c                             |   3 +
 net/netfilter/nf_conntrack_ecache.c                |   2 +
 net/netfilter/nf_conntrack_netlink.c               |   1 +
 net/netfilter/nf_nat_core.c                        |   2 +
 net/netfilter/nfnetlink_cthelper.c                 |  20 +--
 net/netfilter/nfnetlink_cttimeout.c                |   2 +-
 net/packet/af_packet.c                             |   2 +
 net/rds/ib_cm.c                                    |  47 ++++--
 net/rds/ib_send.c                                  |  25 ++--
 net/rds/rdma.c                                     |  10 ++
 net/rds/rds.h                                      |   1 +
 net/rds/send.c                                     |   4 +-
 sound/pci/au88x0/au88x0_core.c                     |   3 +
 sound/soc/codecs/rt5514.c                          |   4 +-
 sound/soc/codecs/rt5659.c                          |  86 +++++------
 sound/soc/codecs/rt5660.c                          |   4 +-
 sound/soc/codecs/wm_adsp.c                         |   7 +-
 sound/soc/soc-dapm.c                               |  62 ++++++++
 sound/soc/soc-topology.c                           |   9 ++
 tools/power/x86/turbostat/turbostat.c              |   4 +-
 136 files changed, 1057 insertions(+), 541 deletions(-)

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Kristian H. Kristensen" <[email protected]>

[ Upstream commit af913418261d6d3e7a29f06cf35f04610ead667c ]

We need to define DRM_FORMAT_MOD_VENDOR_NONE for the fourcc_mod_code() macro to work correctly.

---
 include/uapi/drm/drm_fourcc.h |    1 +
 1 file changed, 1 insertion(+)

@@ -154,6 +154,7 @@ extern "C" {
 
 /* Vendor Ids: */
 #define DRM_FORMAT_MOD_NONE           0
+#define DRM_FORMAT_MOD_VENDOR_NONE    0
 #define DRM_FORMAT_MOD_VENDOR_INTEL   0x01
 #define DRM_FORMAT_MOD_VENDOR_AMD     0x02
 #define DRM_FORMAT_MOD_VENDOR_NV      0x03

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bartosz Golaszewski <[email protected]>

[ Upstream commit 2e644be30fcc08c736f66b60f4898d274d4873ab ]

THS8135 is a configurable video DAC. Add DT bindings for this chip.

---
 Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt |   46 ++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt

@@ -0,0 +1,46 @@
+THS8135 Video DAC
+-----------------
+
+This is the binding for Texas Instruments THS8135 Video DAC bridge.
+
+Required properties:
+
+- compatible: Must be "ti,ths8135"
+
+Required nodes:
+
+This device has two video ports. Their connections are modelled using the OF
+graph bindings specified in Documentation/devicetree/bindings/graph.txt.
+
+- Video port 0 for RGB input
+- Video port 1 for VGA output
+
+Example
+-------
+
+vga-bridge {
+	compatible = "ti,ths8135";
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+
+			vga_bridge_in: endpoint {
+				remote-endpoint = <&lcdc_out_vga>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+
+			vga_bridge_out: endpoint {
+				remote-endpoint = <&vga_con_in>;
+			};
+		};
+	};
+};

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

[ Upstream commit 14d37564fa3dc4e5d4c6828afcd26ac14e6796c5 ]

This patch fixes a place where function gfs2_glock_iter_next can reference an invalid error pointer.

---
 fs/gfs2/glock.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

@@ -1820,16 +1820,18 @@ void gfs2_glock_exit(void)
 
 static void gfs2_glock_iter_next(struct gfs2_glock_iter *gi)
 {
-	do {
-		gi->gl = rhashtable_walk_next(&gi->hti);
+	while ((gi->gl = rhashtable_walk_next(&gi->hti))) {
 		if (IS_ERR(gi->gl)) {
 			if (PTR_ERR(gi->gl) == -EAGAIN)
 				continue;
 			gi->gl = NULL;
+			return;
 		}
-	/* Skip entries for other sb and dead entries */
-	} while ((gi->gl) && ((gi->sdp != gi->gl->gl_name.ln_sbd) ||
-			      __lockref_is_dead(&gi->gl->gl_lockref)));
+		/* Skip entries for other sb and dead entries */
+		if (gi->sdp == gi->gl->gl_name.ln_sbd &&
+		    !__lockref_is_dead(&gi->gl->gl_lockref))
+			return;
+	}
 }
 
 static void *gfs2_glock_seq_start(struct seq_file *seq, loff_t *pos)

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bartlomiej Zolnierkiewicz <[email protected]>

[ Upstream commit 80b7a2e2498bcffb1a79980dfbeb7a1275577b28 ]

Add CPU operating points for Exynos4412 Prime (it supports additional 1704MHz & 1600MHz OPPs and 1500MHz OPP is just a regular non-turbo OPP on this SoC). Also update relevant cooling maps to account for new OPPs.

ODROID-X2/U2/U3 boards use Exynos4412 Prime SoC version so update their board files accordingly.

Based on Hardkernel's kernel for ODROID-X2/U2/U3 boards.

---
 arch/arm/boot/dts/exynos4412-odroid-common.dtsi |    4 +-
 arch/arm/boot/dts/exynos4412-odroidu3.dts       |    5 +-
 arch/arm/boot/dts/exynos4412-odroidx2.dts       |    1 
 arch/arm/boot/dts/exynos4412-prime.dtsi         |   41 ++++++++++++++++++++++++
 arch/arm/boot/dts/exynos4412.dtsi               |    2 -
 5 files changed, 48 insertions(+), 5 deletions(-)
 create mode 100644 arch/arm/boot/dts/exynos4412-prime.dtsi

@@ -97,11 +97,11 @@
 	thermal-zones {
 		cpu_thermal: cpu-thermal {
 			cooling-maps {
-				map0 {
+				cooling_map0: map0 {
 				     /* Corresponds to 800MHz at freq_table */
 				     cooling-device = <&cpu0 7 7>;
 				};
-				map1 {
+				cooling_map1: map1 {
 				     /* Corresponds to 200MHz at freq_table */
 				     cooling-device = <&cpu0 13 13>;
 			       };

@@ -13,6 +13,7 @@
 
 /dts-v1/;
 #include "exynos4412-odroid-common.dtsi"
+#include "exynos4412-prime.dtsi"
 
 / {
 	model = "Hardkernel ODROID-U3 board based on Exynos4412";

@@ -47,11 +48,11 @@
 			cooling-maps {
 				map0 {
 				     trip = <&cpu_alert1>;
-				     cooling-device = <&cpu0 7 7>;
+				     cooling-device = <&cpu0 9 9>;
 				};
 				map1 {
 				     trip = <&cpu_alert2>;
-				     cooling-device = <&cpu0 13 13>;
+				     cooling-device = <&cpu0 15 15>;
 				};
 				map2 {
 				     trip = <&cpu_alert0>;

@@ -12,6 +12,7 @@
 */
 
 #include "exynos4412-odroidx.dts"
+#include "exynos4412-prime.dtsi"
 
 / {
 	model = "Hardkernel ODROID-X2 board based on Exynos4412";

@@ -130,7 +130,7 @@
 			opp-microvolt = <1287500>;
 			clock-latency-ns = <200000>;
 		};
-		opp@1500000000 {
+		cpu0_opp_1500: opp@1500000000 {
 			opp-hz = /bits/ 64 <1500000000>;
 			opp-microvolt = <1350000>;
 			clock-latency-ns = <200000>;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ondrej Jirman <[email protected]>

[ Upstream commit a43c96427e713bea94e9ef50e8be1f493afc0691 ]

When adjusting PLL_CPUX on H3, the PLL is temporarily driven too high, and the system becomes unstable (oopses or hangs).

Add a notifier to avoid this situation by temporarily switching to a known stable 24 MHz oscillator.

---
 drivers/clk/sunxi-ng/ccu-sun8i-h3.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

@@ -803,6 +803,13 @@ static const struct sunxi_ccu_desc sun8i
 	.num_resets	= ARRAY_SIZE(sun8i_h3_ccu_resets),
 };
 
+static struct ccu_mux_nb sun8i_h3_cpu_nb = {
+	.common		= &cpux_clk.common,
+	.cm		= &cpux_clk.mux,
+	.delay_us	= 1, /* > 8 clock cycles at 24 MHz */
+	.bypass_index	= 1, /* index of 24 MHz oscillator */
+};
+
 static void __init sun8i_h3_ccu_setup(struct device_node *node)
 {
 	void __iomem *reg;

@@ -821,6 +828,9 @@ static void __init sun8i_h3_ccu_setup(st
 	writel(val | (3 << 16), reg + SUN8I_H3_PLL_AUDIO_REG);
 
 	sunxi_ccu_probe(node, reg, &sun8i_h3_ccu_desc);
+
+	ccu_mux_notifier_register(pll_cpux_clk.common.hw.clk,
+				  &sun8i_h3_cpu_nb);
 }
 CLK_OF_DECLARE(sun8i_h3_ccu, "allwinner,sun8i-h3-ccu",
 	       sun8i_h3_ccu_setup);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Santosh Shilimkar <[email protected]>

[ Upstream commit 941f8d55f6d613a460a5e080d25a38509f45eb75 ]

When application sends an RDS RDMA composite message consist of RDMA transfer to be followed up by non RDMA payload, it expect to be notified *only* when the full message gets delivered. RDS RDMA notification doesn't behave this way though.

Thanks to Venkat for debug and root casuing the issue where only first part of the message(RDMA) was successfully delivered but remainder payload delivery failed. In that case, application should not be notified with a false positive of message delivery success.

Fix this case by making sure the user gets notified only after the full message delivery.

---
 net/rds/ib_send.c |   25 +++++++++++++++----------
 net/rds/rdma.c    |   10 ++++++++++
 net/rds/rds.h     |    1 +
 net/rds/send.c    |    4 +++-
 4 files changed, 29 insertions(+), 11 deletions(-)

@@ -69,16 +69,6 @@ static void rds_ib_send_complete(struct
 	complete(rm, notify_status);
 }
 
-static void rds_ib_send_unmap_data(struct rds_ib_connection *ic,
-				   struct rm_data_op *op,
-				   int wc_status)
-{
-	if (op->op_nents)
-		ib_dma_unmap_sg(ic->i_cm_id->device,
-				op->op_sg, op->op_nents,
-				DMA_TO_DEVICE);
-}
-
 static void rds_ib_send_unmap_rdma(struct rds_ib_connection *ic,
 				   struct rm_rdma_op *op,
 				   int wc_status)

@@ -139,6 +129,21 @@ static void rds_ib_send_unmap_atomic(str
 		rds_ib_stats_inc(s_ib_atomic_fadd);
 }
 
+static void rds_ib_send_unmap_data(struct rds_ib_connection *ic,
+				   struct rm_data_op *op,
+				   int wc_status)
+{
+	struct rds_message *rm = container_of(op, struct rds_message, data);
+
+	if (op->op_nents)
+		ib_dma_unmap_sg(ic->i_cm_id->device,
+				op->op_sg, op->op_nents,
+				DMA_TO_DEVICE);
+
+	if (rm->rdma.op_active && rm->data.op_notify)
+		rds_ib_send_unmap_rdma(ic, &rm->rdma, wc_status);
+}
+
 /*
  * Unmap the resources associated with a struct send_work.
  *

@@ -626,6 +626,16 @@ int rds_cmsg_rdma_args(struct rds_sock *
 		}
 		op->op_notifier->n_user_token = args->user_token;
 		op->op_notifier->n_status = RDS_RDMA_SUCCESS;
+
+		/* Enable rmda notification on data operation for composite
+		 * rds messages and make sure notification is enabled only
+		 * for the data operation which follows it so that application
+		 * gets notified only after full message gets delivered.
+		 */
+		if (rm->data.op_sg) {
+			rm->rdma.op_notify = 0;
+			rm->data.op_notify = !!(args->flags & RDS_RDMA_NOTIFY_ME);
+		}
 	}
 
 	/* The cookie contains the R_Key of the remote memory region, and

@@ -414,6 +414,7 @@ struct rds_message {
 		} rdma;
 		struct rm_data_op {
 			unsigned int		op_active:1;
+			unsigned int		op_notify:1;
 			unsigned int		op_nents;
 			unsigned int		op_count;
 			unsigned int		op_dmasg;

@@ -475,12 +475,14 @@ void rds_rdma_send_complete(struct rds_m
 	struct rm_rdma_op *ro;
 	struct rds_notifier *notifier;
 	unsigned long flags;
+	unsigned int notify = 0;
 
 	spin_lock_irqsave(&rm->m_rs_lock, flags);
 
+	notify =  rm->rdma.op_notify | rm->data.op_notify;
 	ro = &rm->rdma;
 	if (test_bit(RDS_MSG_ON_SOCK, &rm->m_flags) &&
-	    ro->op_active && ro->op_notify && ro->op_notifier) {
+	    ro->op_active && notify && ro->op_notifier) {
 		notifier = ro->op_notifier;
 		rs = rm->m_rs;
 		sock_hold(rds_rs_to_sk(rs));

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Simon Horman <[email protected]>

[ Upstream commit 654450baf2afba86cf328e1849ccac61ec4630af ]

Use recently added R-Car Gen 2 fallback binding for msiof nodes in DT for r8a7790 SoC.

This has no run-time effect for the current driver as the initialisation sequence is the same for the SoC-specific binding for r8a7790 and the fallback binding for R-Car Gen 2.

---
 arch/arm/boot/dts/r8a7790.dtsi |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

@@ -1493,7 +1493,8 @@
 	};
 
 	msiof0: spi@e6e20000 {
-		compatible = "renesas,msiof-r8a7790";
+		compatible = "renesas,msiof-r8a7790",
+			     "renesas,rcar-gen2-msiof";
 		reg = <0 0xe6e20000 0 0x0064>;
 		interrupts = <GIC_SPI 156 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&mstp0_clks R8A7790_CLK_MSIOF0>;

@@ -1507,7 +1508,8 @@
 	};
 
 	msiof1: spi@e6e10000 {
-		compatible = "renesas,msiof-r8a7790";
+		compatible = "renesas,msiof-r8a7790",
+			     "renesas,rcar-gen2-msiof";
 		reg = <0 0xe6e10000 0 0x0064>;
 		interrupts = <GIC_SPI 157 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&mstp2_clks R8A7790_CLK_MSIOF1>;

@@ -1521,7 +1523,8 @@
 	};
 
 	msiof2: spi@e6e00000 {
-		compatible = "renesas,msiof-r8a7790";
+		compatible = "renesas,msiof-r8a7790",
+			     "renesas,rcar-gen2-msiof";
 		reg = <0 0xe6e00000 0 0x0064>;
 		interrupts = <GIC_SPI 158 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&mstp2_clks R8A7790_CLK_MSIOF2>;

@@ -1535,7 +1538,8 @@
 	};
 
 	msiof3: spi@e6c90000 {
-		compatible = "renesas,msiof-r8a7790";
+		compatible = "renesas,msiof-r8a7790",
+			     "renesas,rcar-gen2-msiof";
 		reg = <0 0xe6c90000 0 0x0064>;
 		interrupts = <GIC_SPI 159 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&mstp2_clks R8A7790_CLK_MSIOF3>;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paul Burton <[email protected]>

[ Upstream commit 3f00f4d8f083bc61005d0a1ef592b149f5c88bbd ]

When clearing the .bss section in kernel_entry we do so using LONG_S instructions, and branch whilst the current write address doesn't equal the end of the .bss section minus the size of a long integer. The .bss section always begins at a long-aligned address and we always increment the write pointer by the size of a long integer - we therefore rely upon the .bss section ending at a long-aligned address. If this is not the case then the long-aligned write address can never be equal to the non-long-aligned end address & we will continue to increment past the end of the .bss section, attempting to zero the rest of memory.

Despite this requirement that .bss end at a long-aligned address we pass 0 as the end alignment requirement to the BSS_SECTION macro and thus don't guarantee any particular alignment, allowing us to hit the error condition described above.

Fix this by instead passing 8 bytes as the end alignment argument to the BSS_SECTION macro, ensuring that the end of the .bss section is always at least long-aligned.

Patchwork: https://patchwork.linux-mips.org/patch/14526/

---
 arch/mips/kernel/vmlinux.lds.S |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -182,7 +182,7 @@ SECTIONS
 	 * Force .bss to 64K alignment so that .bss..swapper_pg_dir
 	 * gets that alignment.	 .sbss should be empty, so there will be
 	 * no holes after __init_end. */
-	BSS_SECTION(0, 0x10000, 0)
+	BSS_SECTION(0, 0x10000, 8)
 
 	_end = . ;
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marcin Nowakowski <[email protected]>

[ Upstream commit 73fbc1eba7ffa3bf0ad12486232a8a1edb4e4411 ]

When a memory offset is specified through the commandline, add the memory in range PHYS_OFFSET:Y as reserved memory area. Otherwise the bootmem allocator is initialised with low page equal to min_low_pfn = PHYS_OFFSET, and in free_all_bootmem will process pages starting from min_low_pfn instead of PFN(Y).

Patchwork: https://patchwork.linux-mips.org/patch/14613/

---
 arch/mips/kernel/setup.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -589,6 +589,10 @@ static int __init early_parse_mem(char *
 		start = memparse(p + 1, &p);
 
 	add_memory_region(start, size, BOOT_MEM_RAM);
+
+	if (start && start > PHYS_OFFSET)
+		add_memory_region(PHYS_OFFSET, start - PHYS_OFFSET,
+				BOOT_MEM_RESERVED);
 	return 0;
 }
 early_param("mem", early_parse_mem);

Hi Greg,

Please do not apply to stable.

See: https://patchwork.linux-mips.org/patch/17235/

Thanks

Ah, so will you send this and that one for 4.9 when it hits Linus's tree?

I'll go drop this one now, thanks.

greg k-h

Sorry I meant to say do not apply to '4.9 stable branch'. For the other stable branches, I suspect this is just a matter of days before Ralf sends the updated fix.

-M

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marcin Nowakowski <[email protected]>

[ Upstream commit a8f108d70c74d83574c157648383eb2e4285a190 ]

Do not reserve memory for the crashkernel if the commandline argument points to a wrong location. This can happen if the location is specified wrong or if the same commandline is reused when starting the crashkernel
- in the latter case the reserved memory would point to the location from which the crashkernel is executing.

Patchwork: https://patchwork.linux-mips.org/patch/14612/

---
 arch/mips/kernel/setup.c |    5 +++++
 1 file changed, 5 insertions(+)

@@ -668,6 +668,11 @@ static void __init mips_parse_crashkerne
 	if (ret != 0 || crash_size <= 0)
 		return;
 
+	if (!memory_region_available(crash_base, crash_size)) {
+		pr_warn("Invalid memory region reserved for crash kernel\n");
+		return;
+	}
+
 	crashk_res.start = crash_base;
 	crashk_res.end	 = crash_base + crash_size - 1;
 }

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: John Crispin <[email protected]>

[ Upstream commit 58181a117d353427127a2e7afc7cf1ab44759828 ]

There is a typo inside the pinmux setup code. The function is really called utif and not util. This was recently discovered when people were trying to make the UTIF interface work.

Patchwork: https://patchwork.linux-mips.org/patch/14899/

---
 arch/mips/ralink/mt7620.c |   18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

@@ -176,7 +176,7 @@ static struct rt2880_pmx_func spi_cs1_gr
 
 static struct rt2880_pmx_func spis_grp_mt7628[] = {
 	FUNC("pwm_uart2", 3, 14, 4),
-	FUNC("util", 2, 14, 4),
+	FUNC("utif", 2, 14, 4),
 	FUNC("gpio", 1, 14, 4),
 	FUNC("spis", 0, 14, 4),
 };

@@ -190,28 +190,28 @@ static struct rt2880_pmx_func gpio_grp_m
 
 static struct rt2880_pmx_func p4led_kn_grp_mt7628[] = {
 	FUNC("jtag", 3, 30, 1),
-	FUNC("util", 2, 30, 1),
+	FUNC("utif", 2, 30, 1),
 	FUNC("gpio", 1, 30, 1),
 	FUNC("p4led_kn", 0, 30, 1),
 };
 
 static struct rt2880_pmx_func p3led_kn_grp_mt7628[] = {
 	FUNC("jtag", 3, 31, 1),
-	FUNC("util", 2, 31, 1),
+	FUNC("utif", 2, 31, 1),
 	FUNC("gpio", 1, 31, 1),
 	FUNC("p3led_kn", 0, 31, 1),
 };
 
 static struct rt2880_pmx_func p2led_kn_grp_mt7628[] = {
 	FUNC("jtag", 3, 32, 1),
-	FUNC("util", 2, 32, 1),
+	FUNC("utif", 2, 32, 1),
 	FUNC("gpio", 1, 32, 1),
 	FUNC("p2led_kn", 0, 32, 1),
 };
 
 static struct rt2880_pmx_func p1led_kn_grp_mt7628[] = {
 	FUNC("jtag", 3, 33, 1),
-	FUNC("util", 2, 33, 1),
+	FUNC("utif", 2, 33, 1),
 	FUNC("gpio", 1, 33, 1),
 	FUNC("p1led_kn", 0, 33, 1),
 };

@@ -232,28 +232,28 @@ static struct rt2880_pmx_func wled_kn_gr
 
 static struct rt2880_pmx_func p4led_an_grp_mt7628[] = {
 	FUNC("jtag", 3, 39, 1),
-	FUNC("util", 2, 39, 1),
+	FUNC("utif", 2, 39, 1),
 	FUNC("gpio", 1, 39, 1),
 	FUNC("p4led_an", 0, 39, 1),
 };
 
 static struct rt2880_pmx_func p3led_an_grp_mt7628[] = {
 	FUNC("jtag", 3, 40, 1),
-	FUNC("util", 2, 40, 1),
+	FUNC("utif", 2, 40, 1),
 	FUNC("gpio", 1, 40, 1),
 	FUNC("p3led_an", 0, 40, 1),
 };
 
 static struct rt2880_pmx_func p2led_an_grp_mt7628[] = {
 	FUNC("jtag", 3, 41, 1),
-	FUNC("util", 2, 41, 1),
+	FUNC("utif", 2, 41, 1),
 	FUNC("gpio", 1, 41, 1),
 	FUNC("p2led_an", 0, 41, 1),
 };
 
 static struct rt2880_pmx_func p1led_an_grp_mt7628[] = {
 	FUNC("jtag", 3, 42, 1),
-	FUNC("util", 2, 42, 1),
+	FUNC("utif", 2, 42, 1),
 	FUNC("gpio", 1, 42, 1),
 	FUNC("p1led_an", 0, 42, 1),
 };

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Colin Ian King <[email protected]>

[ Upstream commit 08d90c81b714482dceb5323d14f6617bcf55ee61 ]

ralink_soc sould be assigned to RT3883_SOC, replace incorrect comparision with assignment.

Patchwork: https://patchwork.linux-mips.org/patch/14903/

---
 arch/mips/ralink/rt3883.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -145,5 +145,5 @@ void prom_soc_init(struct ralink_soc_inf
 
 	rt2880_pinmux_data = rt3883_pinmux_data;
 
-	ralink_soc == RT3883_SOC;
+	ralink_soc = RT3883_SOC;
 }

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hans de Goede <[email protected]>

[ Upstream commit 6f074bc878dc9b00c0df0bf3a8cb1d9e294cd881 ]

If reading the register fails, return the actual error code, instead of the uninitialized val variable;

---
 drivers/power/supply/axp288_fuel_gauge.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -169,8 +169,10 @@ static int fuel_gauge_reg_readb(struct a
 			break;
 	}
 
-	if (ret < 0)
+	if (ret < 0) {
 		dev_err(&info->pdev->dev, "axp288 reg read err:%d\n", ret);
+		return ret;
+	}
 
 	return val;
 }

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jitendra Bhivare <[email protected]>

[ Upstream commit 413f365657a8b9669bd0ba3628e9fde9ce63604e ]

Set CID slot to 0xffff to indicate empty.
Check if connection already exists in conn_table before binding. Check if endpoint already NULL before putting back CID. Break ep->conn link in free_ep to ignore completions after freeing.

---
 drivers/scsi/be2iscsi/be_iscsi.c |  163 +++++++++++++++++++--------------------
 drivers/scsi/be2iscsi/be_main.c  |    7 -
 drivers/scsi/be2iscsi/be_main.h  |    1 
 3 files changed, 87 insertions(+), 84 deletions(-)

@@ -166,33 +166,6 @@ beiscsi_conn_create(struct iscsi_cls_ses
 }
 
 /**
- * beiscsi_bindconn_cid - Bind the beiscsi_conn with phba connection table
- * @beiscsi_conn: The pointer to  beiscsi_conn structure
- * @phba: The phba instance
- * @cid: The cid to free
- */
-static int beiscsi_bindconn_cid(struct beiscsi_hba *phba,
-				struct beiscsi_conn *beiscsi_conn,
-				unsigned int cid)
-{
-	uint16_t cri_index = BE_GET_CRI_FROM_CID(cid);
-
-	if (phba->conn_table[cri_index]) {
-		beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_CONFIG,
-			    "BS_%d : Connection table already occupied. Detected clash\n");
-
-		return -EINVAL;
-	} else {
-		beiscsi_log(phba, KERN_INFO, BEISCSI_LOG_CONFIG,
-			    "BS_%d : phba->conn_table[%d]=%p(beiscsi_conn)\n",
-			    cri_index, beiscsi_conn);
-
-		phba->conn_table[cri_index] = beiscsi_conn;
-	}
-	return 0;
-}
-
-/**
  * beiscsi_conn_bind - Binds iscsi session/connection with TCP connection
  * @cls_session: pointer to iscsi cls session
  * @cls_conn: pointer to iscsi cls conn

@@ -212,6 +185,7 @@ int beiscsi_conn_bind(struct iscsi_cls_s
 	struct hwi_wrb_context *pwrb_context;
 	struct beiscsi_endpoint *beiscsi_ep;
 	struct iscsi_endpoint *ep;
+	uint16_t cri_index;
 
 	ep = iscsi_lookup_endpoint(transport_fd);
 	if (!ep)

@@ -229,20 +203,34 @@ int beiscsi_conn_bind(struct iscsi_cls_s
 
 		return -EEXIST;
 	}
-
-	pwrb_context = &phwi_ctrlr->wrb_context[BE_GET_CRI_FROM_CID(
-						beiscsi_ep->ep_cid)];
+	cri_index = BE_GET_CRI_FROM_CID(beiscsi_ep->ep_cid);
+	if (phba->conn_table[cri_index]) {
+		if (beiscsi_conn != phba->conn_table[cri_index] ||
+		    beiscsi_ep != phba->conn_table[cri_index]->ep) {
+			__beiscsi_log(phba, KERN_ERR,
+				      "BS_%d : conn_table not empty at %u: cid %u conn %p:%p\n",
+				      cri_index,
+				      beiscsi_ep->ep_cid,
+				      beiscsi_conn,
+				      phba->conn_table[cri_index]);
+			return -EINVAL;
+		}
+	}
 
 	beiscsi_conn->beiscsi_conn_cid = beiscsi_ep->ep_cid;
 	beiscsi_conn->ep = beiscsi_ep;
 	beiscsi_ep->conn = beiscsi_conn;
+	/**
+	 * Each connection is associated with a WRBQ kept in wrb_context.
+	 * Store doorbell offset for transmit path.
+	 */
+	pwrb_context = &phwi_ctrlr->wrb_context[cri_index];
 	beiscsi_conn->doorbell_offset = pwrb_context->doorbell_offset;
-
 	beiscsi_log(phba, KERN_INFO, BEISCSI_LOG_CONFIG,
-		    "BS_%d : beiscsi_conn=%p conn=%p ep_cid=%d\n",
-		    beiscsi_conn, conn, beiscsi_ep->ep_cid);
-
-	return beiscsi_bindconn_cid(phba, beiscsi_conn, beiscsi_ep->ep_cid);
+		    "BS_%d : cid %d phba->conn_table[%u]=%p\n",
+		    beiscsi_ep->ep_cid, cri_index, beiscsi_conn);
+	phba->conn_table[cri_index] = beiscsi_conn;
+	return 0;
 }
 
 static int beiscsi_iface_create_ipv4(struct beiscsi_hba *phba)

@@ -973,9 +961,9 @@ int beiscsi_conn_start(struct iscsi_cls_
  */
 static int beiscsi_get_cid(struct beiscsi_hba *phba)
 {
-	unsigned short cid = 0xFFFF, cid_from_ulp;
-	struct ulp_cid_info *cid_info = NULL;
 	uint16_t cid_avlbl_ulp0, cid_avlbl_ulp1;
+	unsigned short cid, cid_from_ulp;
+	struct ulp_cid_info *cid_info;
 
 	/* Find the ULP which has more CID available */
 	cid_avlbl_ulp0 = (phba->cid_array_info[BEISCSI_ULP0]) ?

@@ -984,20 +972,27 @@ static int beiscsi_get_cid(struct beiscs
 			  BEISCSI_ULP1_AVLBL_CID(phba) : 0;
 	cid_from_ulp = (cid_avlbl_ulp0 > cid_avlbl_ulp1) ?
 			BEISCSI_ULP0 : BEISCSI_ULP1;
+	/**
+	 * If iSCSI protocol is loaded only on ULP 0, and when cid_avlbl_ulp
+	 * is ZERO for both, ULP 1 is returned.
+	 * Check if ULP is loaded before getting new CID.
+	 */
+	if (!test_bit(cid_from_ulp, (void *)&phba->fw_config.ulp_supported))
+		return BE_INVALID_CID;
 
-	if (test_bit(cid_from_ulp, (void *)&phba->fw_config.ulp_supported)) {
-		cid_info = phba->cid_array_info[cid_from_ulp];
-		if (!cid_info->avlbl_cids)
-			return cid;
-
-		cid = cid_info->cid_array[cid_info->cid_alloc++];
-
-		if (cid_info->cid_alloc == BEISCSI_GET_CID_COUNT(
-					   phba, cid_from_ulp))
-			cid_info->cid_alloc = 0;
-
-		cid_info->avlbl_cids--;
-	}
+	cid_info = phba->cid_array_info[cid_from_ulp];
+	cid = cid_info->cid_array[cid_info->cid_alloc];
+	if (!cid_info->avlbl_cids || cid == BE_INVALID_CID) {
+		__beiscsi_log(phba, KERN_ERR,
+				"BS_%d : failed to get cid: available %u:%u\n",
+				cid_info->avlbl_cids, cid_info->cid_free);
+		return BE_INVALID_CID;
+	}
+	/* empty the slot */
+	cid_info->cid_array[cid_info->cid_alloc++] = BE_INVALID_CID;
+	if (cid_info->cid_alloc == BEISCSI_GET_CID_COUNT(phba, cid_from_ulp))
+		cid_info->cid_alloc = 0;
+	cid_info->avlbl_cids--;
 	return cid;
 }
 

@@ -1008,22 +1003,28 @@ static int beiscsi_get_cid(struct beiscs
  */
 static void beiscsi_put_cid(struct beiscsi_hba *phba, unsigned short cid)
 {
-	uint16_t cid_post_ulp;
-	struct hwi_controller *phwi_ctrlr;
-	struct hwi_wrb_context *pwrb_context;
-	struct ulp_cid_info *cid_info = NULL;
 	uint16_t cri_index = BE_GET_CRI_FROM_CID(cid);
+	struct hwi_wrb_context *pwrb_context;
+	struct hwi_controller *phwi_ctrlr;
+	struct ulp_cid_info *cid_info;
+	uint16_t cid_post_ulp;
 
 	phwi_ctrlr = phba->phwi_ctrlr;
 	pwrb_context = &phwi_ctrlr->wrb_context[cri_index];
 	cid_post_ulp = pwrb_context->ulp_num;
 
 	cid_info = phba->cid_array_info[cid_post_ulp];
-	cid_info->avlbl_cids++;
-
+	/* fill only in empty slot */
+	if (cid_info->cid_array[cid_info->cid_free] != BE_INVALID_CID) {
+		__beiscsi_log(phba, KERN_ERR,
+			      "BS_%d : failed to put cid %u: available %u:%u\n",
+			      cid, cid_info->avlbl_cids, cid_info->cid_free);
+		return;
+	}
 	cid_info->cid_array[cid_info->cid_free++] = cid;
 	if (cid_info->cid_free == BEISCSI_GET_CID_COUNT(phba, cid_post_ulp))
 		cid_info->cid_free = 0;
+	cid_info->avlbl_cids++;
 }
 
 /**

@@ -1037,8 +1038,8 @@ static void beiscsi_free_ep(struct beisc
 
 	beiscsi_put_cid(phba, beiscsi_ep->ep_cid);
 	beiscsi_ep->phba = NULL;
-	phba->ep_array[BE_GET_CRI_FROM_CID
-		       (beiscsi_ep->ep_cid)] = NULL;
+	/* clear this to track freeing in beiscsi_ep_disconnect */
+	phba->ep_array[BE_GET_CRI_FROM_CID(beiscsi_ep->ep_cid)] = NULL;
 
 	/**
 	 * Check if any connection resource allocated by driver

@@ -1049,6 +1050,11 @@ static void beiscsi_free_ep(struct beisc
 		return;
 
 	beiscsi_conn = beiscsi_ep->conn;
+	/**
+	 * Break ep->conn link here so that completions after
+	 * this are ignored.
+	 */
+	beiscsi_ep->conn = NULL;
 	if (beiscsi_conn->login_in_progress) {
 		beiscsi_free_mgmt_task_handles(beiscsi_conn,
 					       beiscsi_conn->task);

@@ -1079,7 +1085,7 @@ static int beiscsi_open_conn(struct iscs
 		    "BS_%d : In beiscsi_open_conn\n");
 
 	beiscsi_ep->ep_cid = beiscsi_get_cid(phba);
-	if (beiscsi_ep->ep_cid == 0xFFFF) {
+	if (beiscsi_ep->ep_cid == BE_INVALID_CID) {
 		beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_CONFIG,
 			    "BS_%d : No free cid available\n");
 		return ret;

@@ -1285,26 +1291,6 @@ static int beiscsi_close_conn(struct  be
 }
 
 /**
- * beiscsi_unbind_conn_to_cid - Unbind the beiscsi_conn from phba conn table
- * @phba: The phba instance
- * @cid: The cid to free
- */
-static int beiscsi_unbind_conn_to_cid(struct beiscsi_hba *phba,
-				      unsigned int cid)
-{
-	uint16_t cri_index = BE_GET_CRI_FROM_CID(cid);
-
-	if (phba->conn_table[cri_index])
-		phba->conn_table[cri_index] = NULL;
-	else {
-		beiscsi_log(phba, KERN_INFO, BEISCSI_LOG_CONFIG,
-			    "BS_%d : Connection table Not occupied.\n");
-		return -EINVAL;
-	}
-	return 0;
-}
-
-/**
  * beiscsi_ep_disconnect - Tears down the TCP connection
  * @ep:	endpoint to be used
  *

@@ -1318,13 +1304,23 @@ void beiscsi_ep_disconnect(struct iscsi_
 	unsigned int tag;
 	uint8_t mgmt_invalidate_flag, tcp_upload_flag;
 	unsigned short savecfg_flag = CMD_ISCSI_SESSION_SAVE_CFG_ON_FLASH;
+	uint16_t cri_index;
 
 	beiscsi_ep = ep->dd_data;
 	phba = beiscsi_ep->phba;
 	beiscsi_log(phba, KERN_INFO, BEISCSI_LOG_CONFIG,
-		    "BS_%d : In beiscsi_ep_disconnect for ep_cid = %d\n",
+		    "BS_%d : In beiscsi_ep_disconnect for ep_cid = %u\n",
 		    beiscsi_ep->ep_cid);
 
+	cri_index = BE_GET_CRI_FROM_CID(beiscsi_ep->ep_cid);
+	if (!phba->ep_array[cri_index]) {
+		__beiscsi_log(phba, KERN_ERR,
+			      "BS_%d : ep_array at %u cid %u empty\n",
+			      cri_index,
+			      beiscsi_ep->ep_cid);
+		return;
+	}
+
 	if (beiscsi_ep->conn) {
 		beiscsi_conn = beiscsi_ep->conn;
 		iscsi_suspend_queue(beiscsi_conn->conn);

@@ -1356,7 +1352,12 @@ void beiscsi_ep_disconnect(struct iscsi_
 free_ep:
 	msleep(BEISCSI_LOGOUT_SYNC_DELAY);
 	beiscsi_free_ep(beiscsi_ep);
-	beiscsi_unbind_conn_to_cid(phba, beiscsi_ep->ep_cid);
+	if (!phba->conn_table[cri_index])
+		__beiscsi_log(phba, KERN_ERR,
+				"BS_%d : conn_table empty at %u: cid %u\n",
+				cri_index,
+				beiscsi_ep->ep_cid);
+	phba->conn_table[cri_index] = NULL;
 	iscsi_destroy_endpoint(beiscsi_ep->openiscsi_ep);
 }
 

@@ -4085,9 +4085,10 @@ static int hba_setup_cid_tbls(struct bei
 			}
 
 			/* Allocate memory for CID array */
-			ptr_cid_info->cid_array = kzalloc(sizeof(void *) *
-						  BEISCSI_GET_CID_COUNT(phba,
-						  ulp_num), GFP_KERNEL);
+			ptr_cid_info->cid_array =
+				kcalloc(BEISCSI_GET_CID_COUNT(phba, ulp_num),
+					sizeof(*ptr_cid_info->cid_array),
+					GFP_KERNEL);
 			if (!ptr_cid_info->cid_array) {
 				beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
 					    "BM_%d : Failed to allocate memory"

@@ -358,6 +358,7 @@ struct beiscsi_hba {
 	unsigned int age;
 	struct list_head hba_queue;
 #define BE_MAX_SESSION 2048
+#define BE_INVALID_CID 0xffff
 #define BE_SET_CID_TO_CRI(cri_index, cid) \
 			  (phba->cid_to_cri_map[cid] = cri_index)
 #define BE_GET_CRI_FROM_CID(cid) (phba->cid_to_cri_map[cid])

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marcin Niestroj <[email protected]>

[ Upstream commit ca244a83ecc7f0a9242ee2116e622cb6d7ec2a90 ]

On chiliSOM TPS65217 nWAKEUP pin is connected to AM335x internal RTC EXT_WAKEUP input. In RTC-only state TPS65217 is notifying about power on events (such as power buton presses) by setting nWAKEUP output low. After that it waits 5s for proper device boot. Currently it doesn't happen, as the processor doesn't listen for such events. Consequently TPS65217 changes state from SLEEP (RTC-only state) to OFF.

Enable EXT_WAKEUP input of AM335x's RTC, so the processor can properly detect power on events and recover immediately from RTC-only states, without powering off RTC and losing time.

---
 arch/arm/boot/dts/am335x-chilisom.dtsi |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -124,6 +124,14 @@
 
 &rtc {
 	system-power-controller;
+
+	pinctrl-0 = <&ext_wakeup>;
+	pinctrl-names = "default";
+
+	ext_wakeup: ext-wakeup {
+		pins = "ext_wakeup0";
+		input-enable;
+	};
 };
 
 /* NAND Flash */

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guilherme G Piccoli <[email protected]>

[ Upstream commit 69b97cf6dbce7403845a28bbc75d57f5be7b12ac ]

Whenever the igb driver detects the result of a read operation returns a value composed only by F's (like 0xFFFFFFFF), it will detach the net_device, clear the hw_addr pointer and warn to the user that adapter's link is lost - those steps happen on igb_rd32().

In case a PCI error happens on Power architecture, there's a recovery mechanism called EEH, that will reset the PCI slot and call driver's handlers to reset the adapter and network functionality as well.

We observed that once hw_addr is NULL after the error is detected on igb_rd32(), it's never assigned back, so in the process of resetting the network functionality we got a NULL pointer dereference in both igb_configure_tx_ring() and igb_configure_rx_ring(). In order to avoid such bug, this patch re-assigns the hw_addr value in the slot_reset handler.

---
 drivers/net/ethernet/intel/igb/igb_main.c |    5 +++++
 1 file changed, 5 insertions(+)

@@ -7882,6 +7882,11 @@ static pci_ers_result_t igb_io_slot_rese
 		pci_enable_wake(pdev, PCI_D3hot, 0);
 		pci_enable_wake(pdev, PCI_D3cold, 0);
 
+		/* In case of PCI error, adapter lose its HW address
+		 * so we should re-assign it here.
+		 */
+		hw->hw_addr = adapter->io_addr;
+
 		igb_reset(adapter);
 		wr32(E1000_WUS, ~0);
 		result = PCI_ERS_RESULT_RECOVERED;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hans de Goede <[email protected]>

[ Upstream commit 5757aca10146061befd168dab37fb0db1ccd8f73 ]

The vbus-present bit in the power status register also gets set to 1 when a usb-host cable (id-pin shorted to ground) is plugged in and a 5v boost converter is supplying 5v to the otg usb bus.

This causes a "disconnect or unknown or ID event" warning in dmesg as well as the extcon device to report the last detected charger cable type as being connected even though none is connected.

This commit switches to checking the vbus-valid bit instead, which is only 1 when both vbus is present and the vbus-path is enabled in the vbus-path control register (the vbus-path gets disabled when a usb-host cable is detected, to avoid the pmic drawing power from the 5v boost converter).

---
 drivers/extcon/extcon-axp288.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -168,7 +168,7 @@ static int axp288_handle_chrg_det_event(
 		return ret;
 	}
 
-	vbus_attach = (pwr_stat & PS_STAT_VBUS_PRESENT);
+	vbus_attach = (pwr_stat & PS_STAT_VBUS_VALID);
 	if (!vbus_attach)
 		goto notify_otg;
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jiancheng Xue <[email protected]>

[ Upstream commit 5987b4bf512101137fa60c5c0ccac3db51541221 ]

If STATUS_SET was not set, ti_syscon_reset_status would always return 0 no matter whether the status_bit was set or not.

---
 drivers/reset/reset-ti-syscon.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -154,8 +154,8 @@ static int ti_syscon_reset_status(struct
 	if (ret)
 		return ret;
 
-	return (reset_state & BIT(control->status_bit)) &&
-			(control->flags & STATUS_SET);
+	return !(reset_state & BIT(control->status_bit)) ==
+		!(control->flags & STATUS_SET);
 }
 
 static struct reset_control_ops ti_syscon_reset_ops = {

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jose Abreu <[email protected]>

[ Upstream commit 6205406cf6f282d622f31de25036e6d1ab3a2ff5 ]

Init field must be cleared in driver probe as this structure is not dinamically allocated. If not, wrong flags can be passed to core.

---
 drivers/clk/axs10x/i2s_pll_clock.c |    1 +
 1 file changed, 1 insertion(+)

@@ -182,6 +182,7 @@ static int i2s_pll_clk_probe(struct plat
 	if (IS_ERR(pll_clk->base))
 		return PTR_ERR(pll_clk->base);
 
+	memset(&init, 0, sizeof(init));
 	clk_name = node->name;
 	init.name = clk_name;
 	init.ops = &i2s_pll_ops;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: John Crispin <[email protected]>

[ Upstream commit 808cf33d4817c730008de9b2736b357708a3d7f6 ]

The MIPS based MT7621 shares the same XHCI core as the newer generation of ARM based SoCs. The driver works out of the box and we only need to make it buildable in Kconfig.

---
 drivers/usb/host/Kconfig |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -45,9 +45,9 @@ config USB_XHCI_PLATFORM
 	  If unsure, say N.
 
 config USB_XHCI_MTK
-	tristate "xHCI support for Mediatek MT65xx"
+	tristate "xHCI support for Mediatek MT65xx/MT7621"
 	select MFD_SYSCON
-	depends on ARCH_MEDIATEK || COMPILE_TEST
+	depends on (MIPS && SOC_MT7621) || ARCH_MEDIATEK || COMPILE_TEST
 	---help---
 	  Say 'Y' to enable the support for the xHCI host controller
 	  found in Mediatek MT65xx SoCs.

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <[email protected]>

[ Upstream commit 87cdfa9d60f4f40e6d71b04b10b36d9df3c89282 ]

Writes into limit attributes can overflow due to multplications and additions with unbound input values. Writing into fan limit attributes can result in a crash with a division by zero if very large values are written and the fan divider is larger than 1.

---
 drivers/hwmon/gl520sm.c |   27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

@@ -208,11 +208,13 @@ static ssize_t get_cpu_vid(struct device
 }
 static DEVICE_ATTR(cpu0_vid, S_IRUGO, get_cpu_vid, NULL);
 
-#define VDD_FROM_REG(val) (((val) * 95 + 2) / 4)
-#define VDD_TO_REG(val) clamp_val((((val) * 4 + 47) / 95), 0, 255)
-
-#define IN_FROM_REG(val) ((val) * 19)
-#define IN_TO_REG(val) clamp_val((((val) + 9) / 19), 0, 255)
+#define VDD_FROM_REG(val)	DIV_ROUND_CLOSEST((val) * 95, 4)
+#define VDD_CLAMP(val)		clamp_val(val, 0, 255 * 95 / 4)
+#define VDD_TO_REG(val)		DIV_ROUND_CLOSEST(VDD_CLAMP(val) * 4, 95)
+
+#define IN_FROM_REG(val)	((val) * 19)
+#define IN_CLAMP(val)		clamp_val(val, 0, 255 * 19)
+#define IN_TO_REG(val)		DIV_ROUND_CLOSEST(IN_CLAMP(val), 19)
 
 static ssize_t get_in_input(struct device *dev, struct device_attribute *attr,
 			    char *buf)

@@ -349,8 +351,13 @@ static SENSOR_DEVICE_ATTR(in4_max, S_IRU
 
 #define DIV_FROM_REG(val) (1 << (val))
 #define FAN_FROM_REG(val, div) ((val) == 0 ? 0 : (480000 / ((val) << (div))))
-#define FAN_TO_REG(val, div) ((val) <= 0 ? 0 : \
-	clamp_val((480000 + ((val) << ((div)-1))) / ((val) << (div)), 1, 255))
+
+#define FAN_BASE(div)		(480000 >> (div))
+#define FAN_CLAMP(val, div)	clamp_val(val, FAN_BASE(div) / 255, \
+					  FAN_BASE(div))
+#define FAN_TO_REG(val, div)	((val) == 0 ? 0 : \
+				 DIV_ROUND_CLOSEST(480000, \
+						FAN_CLAMP(val, div) << (div)))
 
 static ssize_t get_fan_input(struct device *dev, struct device_attribute *attr,
 			     char *buf)

@@ -513,9 +520,9 @@ static SENSOR_DEVICE_ATTR(fan2_div, S_IR
 static DEVICE_ATTR(fan1_off, S_IRUGO | S_IWUSR,
 		get_fan_off, set_fan_off);
 
-#define TEMP_FROM_REG(val) (((val) - 130) * 1000)
-#define TEMP_TO_REG(val) clamp_val(((((val) < 0 ? \
-			(val) - 500 : (val) + 500) / 1000) + 130), 0, 255)
+#define TEMP_FROM_REG(val)	(((val) - 130) * 1000)
+#define TEMP_CLAMP(val)		clamp_val(val, -130000, 125000)
+#define TEMP_TO_REG(val)	(DIV_ROUND_CLOSEST(TEMP_CLAMP(val), 1000) + 130)
 
 static ssize_t get_temp_input(struct device *dev, struct device_attribute *attr,
 			      char *buf)

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Javier Martinez Canillas <[email protected]>

[ Upstream commit 8f0d7daf53972da0004f7a5a4d938c85333db300 ]

If the driver is built as a module, autoload won't work because the module alias information is not filled. So user-space can't match the registered device with the corresponding module.

Export the module alias information using the MODULE_DEVICE_TABLE() macro.

Before this patch:

$ modinfo drivers/iio/adc/fsl-imx25-gcq.ko | grep alias
$

After this patch:

$ modinfo drivers/iio/adc/fsl-imx25-gcq.ko | grep alias
alias:          of:N*T*Cfsl,imx25-gcqC*
alias:          of:N*T*Cfsl,imx25-gcq

---
 drivers/iio/adc/fsl-imx25-gcq.c |    1 +
 1 file changed, 1 insertion(+)

@@ -401,6 +401,7 @@ static const struct of_device_id mx25_gc
 	{ .compatible = "fsl,imx25-gcq", },
 	{ /* Sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, mx25_gcq_ids);
 
 static struct platform_driver mx25_gcq_driver = {
 	.driver		= {

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hans de Goede <[email protected]>

[ Upstream commit fa2849e9649b5180ffc4cb3c3b005261c403093a ]

For some reason the axp288_adc driver was modifying the AXP288_ADC_TS_PIN_CTRL register, changing bits 0-1 depending on whether the GP_ADC channel or another channel was written.

These bits control when a bias current is send to the TS_PIN, the GP_ADC has its own pin and a separate bit in another register to control the bias current.

Not only does changing when to enable the TS_PIN bias current (always or only when sampling) when reading the GP_ADC make no sense at all, the code is modifying these bits is writing the entire register, assuming that all the other bits have their default value.

So if the firmware has configured a different bias-current for either pin, then that change gets clobbered by the write, likewise if the firmware has set bit 2 to indicate that the battery has no thermal sensor, this will get clobbered by the write.

This commit fixes all this, by simply removing all writes to the AXP288_ADC_TS_PIN_CTRL register, they are not needed to read the GP_ADC pin, and can actually be harmful.

---
 drivers/iio/adc/axp288_adc.c |   32 +-------------------------------
 1 file changed, 1 insertion(+), 31 deletions(-)

@@ -28,8 +28,6 @@
 #include <linux/iio/driver.h>
 
 #define AXP288_ADC_EN_MASK		0xF1
-#define AXP288_ADC_TS_PIN_GPADC		0xF2
-#define AXP288_ADC_TS_PIN_ON		0xF3
 
 enum axp288_adc_id {
 	AXP288_ADC_TS,

@@ -123,16 +121,6 @@ static int axp288_adc_read_channel(int *
 	return IIO_VAL_INT;
 }
 
-static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
-				unsigned long address)
-{
-	/* channels other than GPADC do not need to switch TS pin */
-	if (address != AXP288_GP_ADC_H)
-		return 0;
-
-	return regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
-}
-
 static int axp288_adc_read_raw(struct iio_dev *indio_dev,
 			struct iio_chan_spec const *chan,
 			int *val, int *val2, long mask)

@@ -143,16 +131,7 @@ static int axp288_adc_read_raw(struct ii
 	mutex_lock(&indio_dev->mlock);
 	switch (mask) {
 	case IIO_CHAN_INFO_RAW:
-		if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
-					chan->address)) {
-			dev_err(&indio_dev->dev, "GPADC mode\n");
-			ret = -EINVAL;
-			break;
-		}
 		ret = axp288_adc_read_channel(val, chan->address, info->regmap);
-		if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
-						chan->address))
-			dev_err(&indio_dev->dev, "TS pin restore\n");
 		break;
 	default:
 		ret = -EINVAL;

@@ -162,15 +141,6 @@ static int axp288_adc_read_raw(struct ii
 	return ret;
 }
 
-static int axp288_adc_set_state(struct regmap *regmap)
-{
-	/* ADC should be always enabled for internal FG to function */
-	if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
-		return -EIO;
-
-	return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
-}
-
 static const struct iio_info axp288_adc_iio_info = {
 	.read_raw = &axp288_adc_read_raw,
 	.driver_module = THIS_MODULE,

@@ -199,7 +169,7 @@ static int axp288_adc_probe(struct platf
 	 * Set ADC to enabled state at all time, including system suspend.
 	 * otherwise internal fuel gauge functionality may be affected.
 	 */
-	ret = axp288_adc_set_state(axp20x->regmap);
+	ret = regmap_write(info->regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
 	if (ret) {
 		dev_err(&pdev->dev, "unable to enable ADC device\n");
 		return ret;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andreas Klinger <[email protected]>

[ Upstream commit ff1293f67734da68e23fecb6ecdae7112b8c43f9 ]

Add DT bindings for avia,hx711
Add vendor avia to vendor list

---
 Documentation/devicetree/bindings/iio/adc/avia-hx711.txt |   18 +++++++++++++++
 Documentation/devicetree/bindings/vendor-prefixes.txt    |    1 
 2 files changed, 19 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/iio/adc/avia-hx711.txt

@@ -0,0 +1,18 @@
+* AVIA HX711 ADC chip for weight cells
+  Bit-banging driver
+
+Required properties:
+ - compatible:	Should be "avia,hx711"
+ - sck-gpios:	Definition of the GPIO for the clock
+ - dout-gpios:	Definition of the GPIO for data-out
+		See Documentation/devicetree/bindings/gpio/gpio.txt
+ - avdd-supply:	Definition of the regulator used as analog supply
+
+Example:
+weight@0 {
+	compatible = "avia,hx711";
+	sck-gpios = <&gpio3 10 GPIO_ACTIVE_HIGH>;
+	dout-gpios = <&gpio0 7 GPIO_ACTIVE_HIGH>;
+	avdd-suppy = <&avdd>;
+};
+

@@ -38,6 +38,7 @@ atmel	Atmel Corporation
 auo	AU Optronics Corporation
 auvidea Auvidea GmbH
 avago	Avago Technologies
+avia	avia semiconductor
 avic	Shanghai AVIC Optoelectronics Co., Ltd.
 axis	Axis Communications AB
 boe	BOE Technology Group Co., Ltd.

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bart Van Assche <[email protected]>

[ Upstream commit 642c7cbcaf2ffc1e27f67eda3dc47347ac5aff37 ]

Since index values equal to or above 'range' can trigger memory corruption, complain if index >= range.

---
 drivers/infiniband/sw/rxe/rxe_pool.c |    1 +
 1 file changed, 1 insertion(+)

@@ -274,6 +274,7 @@ static u32 alloc_index(struct rxe_pool *
 	if (index >= range)
 		index = find_first_zero_bit(pool->table, range);
 
+	WARN_ON_ONCE(index >= range);
 	set_bit(index, pool->table);
 	pool->last = index;
 	return index + pool->min_index;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bart Van Assche <[email protected]>

[ Upstream commit b3a459961014b14c267544c327db033669493295 ]

Avoid that calling check_rkey() for mem->state == RXE_MEM_STATE_FREE triggers an MR reference leak.

---
 drivers/infiniband/sw/rxe/rxe_resp.c |   20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

@@ -418,7 +418,7 @@ static enum resp_states check_length(str
 static enum resp_states check_rkey(struct rxe_qp *qp,
 				   struct rxe_pkt_info *pkt)
 {
-	struct rxe_mem *mem;
+	struct rxe_mem *mem = NULL;
 	u64 va;
 	u32 rkey;
 	u32 resid;

@@ -452,38 +452,38 @@ static enum resp_states check_rkey(struc
 	mem = lookup_mem(qp->pd, access, rkey, lookup_remote);
 	if (!mem) {
 		state = RESPST_ERR_RKEY_VIOLATION;
-		goto err1;
+		goto err;
 	}
 
 	if (unlikely(mem->state == RXE_MEM_STATE_FREE)) {
 		state = RESPST_ERR_RKEY_VIOLATION;
-		goto err1;
+		goto err;
 	}
 
 	if (mem_check_range(mem, va, resid)) {
 		state = RESPST_ERR_RKEY_VIOLATION;
-		goto err2;
+		goto err;
 	}
 
 	if (pkt->mask & RXE_WRITE_MASK)	 {
 		if (resid > mtu) {
 			if (pktlen != mtu || bth_pad(pkt)) {
 				state = RESPST_ERR_LENGTH;
-				goto err2;
+				goto err;
 			}
 
 			qp->resp.resid = mtu;
 		} else {
 			if (pktlen != resid) {
 				state = RESPST_ERR_LENGTH;
-				goto err2;
+				goto err;
 			}
 			if ((bth_pad(pkt) != (0x3 & (-resid)))) {
 				/* This case may not be exactly that
 				 * but nothing else fits.
 				 */
 				state = RESPST_ERR_LENGTH;
-				goto err2;
+				goto err;
 			}
 		}
 	}

@@ -493,9 +493,9 @@ static enum resp_states check_rkey(struc
 	qp->resp.mr = mem;
 	return RESPST_EXECUTE;
 
-err2:
-	rxe_drop_ref(mem);
-err1:
+err:
+	if (mem)
+		rxe_drop_ref(mem);
 	return state;
 }
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Afzal Mohammed <[email protected]>

[ Upstream commit 8a792e9afbce84a0fdaf213fe42bb97382487094 ]

REMAP_VECTORS_TO_RAM depends on DRAM_BASE, but since DRAM_BASE is a hex, REMAP_VECTORS_TO_RAM could never get enabled. Also depending on DRAM_BASE is redundant as whenever REMAP_VECTORS_TO_RAM makes itself available to Kconfig, DRAM_BASE also is available as the Kconfig gets sourced on !MMU.

---
 arch/arm/Kconfig-nommu |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

@@ -34,8 +34,7 @@ config PROCESSOR_ID
 	  used instead of the auto-probing which utilizes the register.
 
 config REMAP_VECTORS_TO_RAM
-	bool 'Install vectors to the beginning of RAM' if DRAM_BASE
-	depends on DRAM_BASE
+	bool 'Install vectors to the beginning of RAM'
 	help
 	  The kernel needs to change the hardware exception vectors.
 	  In nommu mode, the hardware exception vectors are normally

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Nagaraju, Vathsala" <[email protected]>

[ Upstream commit acf45d11050abd751dcec986ab121cb2367dcbba ]

PSR2 is restricted to work with panel resolutions upto 3200x2000, move the check to intel_psr_match_conditions and fully block psr.

---
 drivers/gpu/drm/i915/intel_psr.c |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

@@ -387,6 +387,13 @@ static bool intel_psr_match_conditions(s
 		return false;
 	}
 
+	/* PSR2 is restricted to work with panel resolutions upto 3200x2000 */
+	if (intel_crtc->config->pipe_src_w > 3200 ||
+				intel_crtc->config->pipe_src_h > 2000) {
+		dev_priv->psr.psr2_support = false;
+		return false;
+	}
+
 	dev_priv->psr.source_ok = true;
 	return true;
 }

@@ -425,7 +432,6 @@ void intel_psr_enable(struct intel_dp *i
 	struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
 	struct drm_device *dev = intel_dig_port->base.base.dev;
 	struct drm_i915_private *dev_priv = to_i915(dev);
-	struct intel_crtc *crtc = to_intel_crtc(intel_dig_port->base.base.crtc);
 
 	if (!HAS_PSR(dev)) {
 		DRM_DEBUG_KMS("PSR not supported on this platform\n");

@@ -452,12 +458,7 @@ void intel_psr_enable(struct intel_dp *i
 		hsw_psr_setup_vsc(intel_dp);
 
 		if (dev_priv->psr.psr2_support) {
-			/* PSR2 is restricted to work with panel resolutions upto 3200x2000 */
-			if (crtc->config->pipe_src_w > 3200 ||
-				crtc->config->pipe_src_h > 2000)
-				dev_priv->psr.psr2_support = false;
-			else
-				skl_psr_setup_su_vsc(intel_dp);
+			skl_psr_setup_su_vsc(intel_dp);
 		}
 
 		/*

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Matwey V. Kornilov" <[email protected]>

[ Upstream commit 9c4b60fe5313c125b1bf68ef04b0010512c27f2d ]

When struct moxa8250_board is allocated, then num_ports should be initialized in order to use it later in moxa8250_remove.

---
 drivers/tty/serial/8250/8250_moxa.c |    1 +
 1 file changed, 1 insertion(+)

@@ -68,6 +68,7 @@ static int moxa8250_probe(struct pci_dev
 			   sizeof(unsigned int) * nr_ports, GFP_KERNEL);
 	if (!brd)
 		return -ENOMEM;
+	brd->num_ports = nr_ports;
 
 	memset(&uart, 0, sizeof(struct uart_8250_port));
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christophe JAILLET <[email protected]>

[ Upstream commit 1a5c2d1de7d35f5eb9793266237903348989502b ]

'request_irq()' and 'free_irq()' should be called with the same dev_id.

---
 drivers/tty/goldfish.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -300,7 +300,7 @@ static int goldfish_tty_probe(struct pla
 	return 0;
 
 err_tty_register_device_failed:
-	free_irq(irq, pdev);
+	free_irq(irq, qtty);
 err_request_irq_failed:
 	goldfish_tty_current_line_count--;
 	if (goldfish_tty_current_line_count == 0)

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexey Brodkin <[email protected]>

[ Upstream commit 699a11ba7ec869b006623182881f2f1f5b4aea53 ]

With CONFIG_DYNAMIC_DEBUG if dyndbg enables debug output in 8250_port.c deadlock happens inevitably on UART IRQ handling.

That's the problematic execution path:
---------------------------->8------------------------ UART IRQ:
serial8250_interrupt() ->

    serial8250_handle_irq(): lock "port->lock" ->
      pr_debug() ->
        serial8250_console_write(): bump in locked "port->lock".

      OR (if above pr_debug() gets removed):
      serial8250_tx_chars() ->
        pr_debug() ->
          serial8250_console_write(): bump in locked "port->lock".

---------------------------->8------------------------

So let's get rid of those not that much useful debug entries.

Discussed problem could be easily reproduced with QEMU for x86_64. As well as this fix could be mimicked with muting of dynamic debug for the problematic lines as simple as:
---------------------------->8------------------------ dyndbg="+p; file 8250_port.c line 1756 -p; file 8250_port.c line 1822 -p" ---------------------------->8------------------------

---
 drivers/tty/serial/8250/8250_port.c |    4 ----
 1 file changed, 4 deletions(-)

@@ -1751,8 +1751,6 @@ void serial8250_tx_chars(struct uart_825
 	if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
 		uart_write_wakeup(port);
 
-	pr_debug("%s: THRE\n", __func__);
-
 	/*
 	 * With RPM enabled, we have to wait until the FIFO is empty before the
 	 * HW can go idle. So we get here once again with empty FIFO and disable

@@ -1817,8 +1815,6 @@ int serial8250_handle_irq(struct uart_po
 
 	status = serial_port_in(port, UART_LSR);
 
-	pr_debug("%s: status = %x\n", __func__, status);
-
 	if (status & (UART_LSR_DR | UART_LSR_BI)) {
 		if (!up->dma || handle_rx_dma(up, iir))
 			status = serial8250_rx_chars(up, status);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Feras Daoud <[email protected]>

[ Upstream commit 1c3098cdb05207e740715857df7b0998e372f527 ]

This patch fixes Deadlock while executing ipoib_vlan_delete.

The function takes the vlan_rwsem semaphore and calls unregister_netdevice. The later function calls ipoib_mcast_stop_thread that cause workqueue flush.

When the queue has one of the ipoib_ib_dev_flush_xxx events, a deadlock occur because these events also tries to catch the same vlan_rwsem semaphore.

To fix, unregister_netdevice should be called after releasing the semaphore.

---
 drivers/infiniband/ulp/ipoib/ipoib_vlan.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

@@ -193,7 +193,6 @@ int ipoib_vlan_delete(struct net_device
 	list_for_each_entry_safe(priv, tpriv, &ppriv->child_intfs, list) {
 		if (priv->pkey == pkey &&
 		    priv->child_type == IPOIB_LEGACY_CHILD) {
-			unregister_netdevice(priv->dev);
 			list_del(&priv->list);
 			dev = priv->dev;
 			break;

@@ -201,6 +200,11 @@ int ipoib_vlan_delete(struct net_device
 	}
 	up_write(&ppriv->vlan_rwsem);
 
+	if (dev) {
+		ipoib_dbg(ppriv, "delete child vlan %s\n", dev->name);
+		unregister_netdevice(dev);
+	}
+
 	rtnl_unlock();
 
 	if (dev) {

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Feras Daoud <[email protected]>

[ Upstream commit 89a3987ab7a923c047c6dec008e60ad6f41fac22 ]

The ipoib_vlan_add function calls rtnl_unlock after free_netdev, rtnl_unlock not only releases the lock, but also calls netdev_run_todo. The latter function browses the net_todo_list array and completes the unregistration of all its net_device instances. If we call free_netdev before rtnl_unlock, then netdev_run_todo call over the freed device causes panic.
To fix, move rtnl_unlock call before free_netdev call.

---
 drivers/infiniband/ulp/ipoib/ipoib_vlan.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -165,11 +165,11 @@ int ipoib_vlan_add(struct net_device *pd
 out:
 	up_write(&ppriv->vlan_rwsem);
 
+	rtnl_unlock();
+
 	if (result)
 		free_netdev(priv->dev);
 
-	rtnl_unlock();
-
 	return result;
 }
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Feras Daoud <[email protected]>

[ Upstream commit c586071d1dc8227a7182179b8e50ee92cc43f6d2 ]

In order to resolve a situation where a few process delete the same list element in sequence and cause panic, list_del is replaced with list_del_init. In this case if the first process that calls list_del releases the lock before acquiring it again, other processes who can acquire the lock will call list_del_init.

---
 drivers/infiniband/ulp/ipoib/ipoib_main.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -1302,7 +1302,7 @@ static void __ipoib_reap_neigh(struct ip
 						   rcu_dereference_protected(neigh->hnext,
 									     lockdep_is_held(&priv->lock)));
 				/* remove from path/mc list */
-				list_del(&neigh->list);
+				list_del_init(&neigh->list);
 				call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
 			} else {
 				np = &neigh->hnext;

@@ -1466,7 +1466,7 @@ void ipoib_neigh_free(struct ipoib_neigh
 					   rcu_dereference_protected(neigh->hnext,
 								     lockdep_is_held(&priv->lock)));
 			/* remove from parent list */
-			list_del(&neigh->list);
+			list_del_init(&neigh->list);
 			call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
 			return;
 		} else {

@@ -1551,7 +1551,7 @@ void ipoib_del_neighs_by_gid(struct net_
 						   rcu_dereference_protected(neigh->hnext,
 									     lockdep_is_held(&priv->lock)));
 				/* remove from parent list */
-				list_del(&neigh->list);
+				list_del_init(&neigh->list);
 				call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
 			} else {
 				np = &neigh->hnext;

@@ -1593,7 +1593,7 @@ static void ipoib_flush_neighs(struct ip
 					   rcu_dereference_protected(neigh->hnext,
 								     lockdep_is_held(&priv->lock)));
 			/* remove from path/mc list */
-			list_del(&neigh->list);
+			list_del_init(&neigh->list);
 			call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
 		}
 	}

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: James Liao <[email protected]>

[ Upstream commit f235c7e7a75325f28a33559a71f25a0eca6112db ]

Add MT2701 subsystem clock controllers, inlcude mmsys, imgsys, vdecsys, hifsys, ethsys and bdpsys.

---
 arch/arm/boot/dts/mt2701.dtsi |   36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

@@ -174,4 +174,40 @@
 		clocks = <&uart_clk>;
 		status = "disabled";
 	};
+
+	mmsys: syscon@14000000 {
+		compatible = "mediatek,mt2701-mmsys", "syscon";
+		reg = <0 0x14000000 0 0x1000>;
+		#clock-cells = <1>;
+	};
+
+	imgsys: syscon@15000000 {
+		compatible = "mediatek,mt2701-imgsys", "syscon";
+		reg = <0 0x15000000 0 0x1000>;
+		#clock-cells = <1>;
+	};
+
+	vdecsys: syscon@16000000 {
+		compatible = "mediatek,mt2701-vdecsys", "syscon";
+		reg = <0 0x16000000 0 0x1000>;
+		#clock-cells = <1>;
+	};
+
+	hifsys: syscon@1a000000 {
+		compatible = "mediatek,mt2701-hifsys", "syscon";
+		reg = <0 0x1a000000 0 0x1000>;
+		#clock-cells = <1>;
+	};
+
+	ethsys: syscon@1b000000 {
+		compatible = "mediatek,mt2701-ethsys", "syscon";
+		reg = <0 0x1b000000 0 0x1000>;
+		#clock-cells = <1>;
+	};
+
+	bdpsys: syscon@1c000000 {
+		compatible = "mediatek,mt2701-bdpsys", "syscon";
+		reg = <0 0x1c000000 0 0x1000>;
+		#clock-cells = <1>;
+	};
 };

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pan Bian <[email protected]>

[ Upstream commit 8bf793883da213864efc50c274d2b38ec0ca58b2 ]

In function kfd_wait_on_events(), when the call to copy_from_user() fails, the value of return variable ret is 0. 0 indicates success, which is inconsistent with the execution status. This patch fixes the bug by assigning "-EFAULT" to ret when copy_from_user() returns an unexpected value.

---
 drivers/gpu/drm/amd/amdkfd/kfd_events.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -739,8 +739,10 @@ int kfd_wait_on_events(struct kfd_proces
 		struct kfd_event_data event_data;
 
 		if (copy_from_user(&event_data, &events[i],
-				sizeof(struct kfd_event_data)))
+				sizeof(struct kfd_event_data))) {
+			ret = -EFAULT;
 			goto fail;
+		}
 
 		ret = init_event_waiter(p, &event_waiters[i],
 				event_data.event_id, i);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

[ Upstream commit 0d130367abf582e7cbf60075c2a7ab53817b1d14 ]

Make sure to log an error on short transfers when reading a device register.

Also clear the provided buffer (which if often an uninitialised automatic variable) on errors as the driver currently does not bother to check for errors.

---
 drivers/usb/serial/mos7720.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

@@ -234,11 +234,16 @@ static int read_mos_reg(struct usb_seria
 
 	status = usb_control_msg(usbdev, pipe, request, requesttype, value,
 				     index, buf, 1, MOS_WDR_TIMEOUT);
-	if (status == 1)
+	if (status == 1) {
 		*data = *buf;
-	else if (status < 0)
+	} else {
 		dev_err(&usbdev->dev,
 			"mos7720: usb_control_msg() failed: %d\n", status);
+		if (status >= 0)
+			status = -EIO;
+		*data = 0;
+	}
+
 	kfree(buf);
 
 	return status;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

[ Upstream commit cd8db057e93ddaacbec025b567490555d2bca280 ]

Make sure to detect short transfers when reading a device register.

The modem-status handling had sufficient error checks in place, but move handling of short transfers into the register accessor function itself for consistency.

---
 drivers/usb/serial/mos7840.c |   19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

@@ -285,9 +285,15 @@ static int mos7840_get_reg_sync(struct u
 	ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
 			      MCS_RD_RTYPE, 0, reg, buf, VENDOR_READ_LENGTH,
 			      MOS_WDR_TIMEOUT);
+	if (ret < VENDOR_READ_LENGTH) {
+		if (ret >= 0)
+			ret = -EIO;
+		goto out;
+	}
+
 	*val = buf[0];
 	dev_dbg(&port->dev, "%s offset is %x, return val %x\n", __func__, reg, *val);
-
+out:
 	kfree(buf);
 	return ret;
 }

@@ -353,8 +359,13 @@ static int mos7840_get_uart_reg(struct u
 	ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
 			      MCS_RD_RTYPE, Wval, reg, buf, VENDOR_READ_LENGTH,
 			      MOS_WDR_TIMEOUT);
+	if (ret < VENDOR_READ_LENGTH) {
+		if (ret >= 0)
+			ret = -EIO;
+		goto out;
+	}
 	*val = buf[0];
-
+out:
 	kfree(buf);
 	return ret;
 }

@@ -1490,10 +1501,10 @@ static int mos7840_tiocmget(struct tty_s
 		return -ENODEV;
 
 	status = mos7840_get_uart_reg(port, MODEM_STATUS_REGISTER, &msr);
-	if (status != 1)
+	if (status < 0)
 		return -EIO;
 	status = mos7840_get_uart_reg(port, MODEM_CONTROL_REGISTER, &mcr);
-	if (status != 1)
+	if (status < 0)
 		return -EIO;
 	result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)
 	    | ((mcr & MCR_RTS) ? TIOCM_RTS : 0)

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Edward Cree <[email protected]>

[ Upstream commit c634700f7eec3c0da46e299cd0a0ae8b594f9b55 ]

The 8000 series SFC NICs have 4K PIO buffers, rather than the 2K of
the 7000 series. Rather than having a hard-coded PIO buffer size (ER_DZ_TX_PIOBUF_SIZE), read it from the GET_CAPABILITIES_V2 MCDI response.

---
 drivers/net/ethernet/sfc/ef10.c |   16 ++++++++++------
 drivers/net/ethernet/sfc/nic.h  |    2 ++
 drivers/net/ethernet/sfc/tx.c   |    1 -
 3 files changed, 12 insertions(+), 7 deletions(-)

@@ -197,11 +197,15 @@ static int efx_ef10_init_datapath_caps(s
 	nic_data->datapath_caps =
 		MCDI_DWORD(outbuf, GET_CAPABILITIES_OUT_FLAGS1);
 
-	if (outlen >= MC_CMD_GET_CAPABILITIES_V2_OUT_LEN)
+	if (outlen >= MC_CMD_GET_CAPABILITIES_V2_OUT_LEN) {
 		nic_data->datapath_caps2 = MCDI_DWORD(outbuf,
 				GET_CAPABILITIES_V2_OUT_FLAGS2);
-	else
+		nic_data->piobuf_size = MCDI_WORD(outbuf,
+				GET_CAPABILITIES_V2_OUT_SIZE_PIO_BUFF);
+	} else {
 		nic_data->datapath_caps2 = 0;
+		nic_data->piobuf_size = ER_DZ_TX_PIOBUF_SIZE;
+	}
 
 	/* record the DPCPU firmware IDs to determine VEB vswitching support.
 	 */

@@ -825,8 +829,8 @@ static int efx_ef10_link_piobufs(struct
 			offset = ((efx->tx_channel_offset + efx->n_tx_channels -
 				   tx_queue->channel->channel - 1) *
 				  efx_piobuf_size);
-			index = offset / ER_DZ_TX_PIOBUF_SIZE;
-			offset = offset % ER_DZ_TX_PIOBUF_SIZE;
+			index = offset / nic_data->piobuf_size;
+			offset = offset % nic_data->piobuf_size;
 
 			/* When the host page size is 4K, the first
 			 * host page in the WC mapping may be within

@@ -1161,11 +1165,11 @@ static int efx_ef10_dimension_resources(
 	 * functions of the controller.
 	 */
 	if (efx_piobuf_size != 0 &&
-	    ER_DZ_TX_PIOBUF_SIZE / efx_piobuf_size * EF10_TX_PIOBUF_COUNT >=
+	    nic_data->piobuf_size / efx_piobuf_size * EF10_TX_PIOBUF_COUNT >=
 	    efx->n_tx_channels) {
 		unsigned int n_piobufs =
 			DIV_ROUND_UP(efx->n_tx_channels,
-				     ER_DZ_TX_PIOBUF_SIZE / efx_piobuf_size);
+				     nic_data->piobuf_size / efx_piobuf_size);
 
 		rc = efx_ef10_alloc_piobufs(efx, n_piobufs);
 		if (rc)

@@ -500,6 +500,7 @@ enum {
  * @pio_write_base: Base address for writing PIO buffers
  * @pio_write_vi_base: Relative VI number for @pio_write_base
  * @piobuf_handle: Handle of each PIO buffer allocated
+ * @piobuf_size: size of a single PIO buffer
  * @must_restore_piobufs: Flag: PIO buffers have yet to be restored after MC
  *	reboot
  * @rx_rss_context: Firmware handle for our RSS context

@@ -537,6 +538,7 @@ struct efx_ef10_nic_data {
 	void __iomem *wc_membase, *pio_write_base;
 	unsigned int pio_write_vi_base;
 	unsigned int piobuf_handle[EF10_TX_PIOBUF_COUNT];
+	u16 piobuf_size;
 	bool must_restore_piobufs;
 	u32 rx_rss_context;
 	bool rx_rss_context_exclusive;

@@ -27,7 +27,6 @@
 
 #ifdef EFX_USE_PIO
 
-#define EFX_PIOBUF_SIZE_MAX ER_DZ_TX_PIOBUF_SIZE
 #define EFX_PIOBUF_SIZE_DEF ALIGN(256, L1_CACHE_BYTES)
 unsigned int efx_piobuf_size __read_mostly = EFX_PIOBUF_SIZE_DEF;
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Markus Elfring <[email protected]>

[ Upstream commit 420dc61642920849d824a0de2aa853db59f5244f ]

Strings which did not contain data format specifications should be put into a sequence. Thus use the corresponding function "seq_puts".

This issue was detected by using the Coccinelle software.

---
 drivers/pinctrl/mvebu/pinctrl-mvebu.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

@@ -195,11 +195,12 @@ static void mvebu_pinconf_group_dbg_show
 				seq_printf(s, "o");
 			seq_printf(s, ")");
 		}
-	} else
-		seq_printf(s, "current: UNKNOWN");
+	} else {
+		seq_puts(s, "current: UNKNOWN");
+	}
 
 	if (grp->num_settings > 1) {
-		seq_printf(s, ", available = [");
+		seq_puts(s, ", available = [");
 		for (n = 0; n < grp->num_settings; n++) {
 			if (curr == &grp->settings[n])
 				continue;

@@ -222,7 +223,7 @@ static void mvebu_pinconf_group_dbg_show
 				seq_printf(s, ")");
 			}
 		}
-		seq_printf(s, " ]");
+		seq_puts(s, " ]");
 	}
 	return;
 }

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alden Tondettar <[email protected]>

[ Upstream commit c5082b70adfe8e1ea1cf4a8eff92c9f260e364d2 ]

If a GUID Partition Table claims to have more than 2**25 entries, the calculation of the partition table size in alloc_read_gpt_entries() will overflow a 32-bit integer and not enough space will be allocated for the table.

Nothing seems to get written out of bounds, but later efi_partition() will read up to 32768 bytes from a 128 byte buffer, possibly OOPSing or exposing information to /proc/partitions and uevents.

The problem exists on both 64-bit and 32-bit platforms.

Fix the overflow and also print a meaningful debug message if the table size is too large.

---
 block/partitions/efi.c |   17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

@@ -293,7 +293,7 @@ static gpt_entry *alloc_read_gpt_entries
 	if (!gpt)
 		return NULL;
 
-	count = le32_to_cpu(gpt->num_partition_entries) *
+	count = (size_t)le32_to_cpu(gpt->num_partition_entries) *
                 le32_to_cpu(gpt->sizeof_partition_entry);
 	if (!count)
 		return NULL;

@@ -352,7 +352,7 @@ static int is_gpt_valid(struct parsed_pa
 			gpt_header **gpt, gpt_entry **ptes)
 {
 	u32 crc, origcrc;
-	u64 lastlba;
+	u64 lastlba, pt_size;
 
 	if (!ptes)
 		return 0;

@@ -434,13 +434,20 @@ static int is_gpt_valid(struct parsed_pa
 		goto fail;
 	}
 
+	/* Sanity check partition table size */
+	pt_size = (u64)le32_to_cpu((*gpt)->num_partition_entries) *
+		le32_to_cpu((*gpt)->sizeof_partition_entry);
+	if (pt_size > KMALLOC_MAX_SIZE) {
+		pr_debug("GUID Partition Table is too large: %llu > %lu bytes\n",
+			 (unsigned long long)pt_size, KMALLOC_MAX_SIZE);
+		goto fail;
+	}
+
 	if (!(*ptes = alloc_read_gpt_entries(state, *gpt)))
 		goto fail;
 
 	/* Check the GUID Partition Entry Array CRC */
-	crc = efi_crc32((const unsigned char *) (*ptes),
-			le32_to_cpu((*gpt)->num_partition_entries) *
-			le32_to_cpu((*gpt)->sizeof_partition_entry));
+	crc = efi_crc32((const unsigned char *) (*ptes), pt_size);
 
 	if (crc != le32_to_cpu((*gpt)->partition_entry_array_crc32)) {
 		pr_debug("GUID Partition Entry Array CRC check failed.\n");

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Linus Walleij <[email protected]>

[ Upstream commit 37e1df8c95e2c8a57c77eafc097648f6e40a60ff ]

This starts to handle probe deferrals on regulators and clocks on the ASoC DAPM.

I came to this patch after audio stopped working on Ux500 ages ago and I finally looked into it to see what is wrong. I had messages like this in the console since a while back:

ab8500-codec.0: ASoC: Failed to request audioclk: -517 ab8500-codec.0: ASoC: Failed to create DAPM control audioclk ab8500-codec.0: Failed to create new controls -12 snd-soc-mop500.0: ASoC: failed to instantiate card -12 snd-soc-mop500.0: Error: snd_soc_register_card failed (-12)!
snd-soc-mop500: probe of snd-soc-mop500.0 failed with error -12

Apparently because the widget table for the codec looks like this (sound/soc/codecs/ab8500-codec.c):

static const struct snd_soc_dapm_widget ab8500_dapm_widgets[] = {

        /* Clocks */
        SND_SOC_DAPM_CLOCK_SUPPLY("audioclk"),

        /* Regulators */
        SND_SOC_DAPM_REGULATOR_SUPPLY("V-AUD", 0, 0),
        SND_SOC_DAPM_REGULATOR_SUPPLY("V-AMIC1", 0, 0),
        SND_SOC_DAPM_REGULATOR_SUPPLY("V-AMIC2", 0, 0),
        SND_SOC_DAPM_REGULATOR_SUPPLY("V-DMIC", 0, 0),

So when we call snd_soc_register_codec() and any of these widgets get a deferred probe we do not get an -EPROBE_DEFER (-517) back as we should and instead we just fail. Apparently the code assumes that clocks and regulators must be available at this point and not defer.

After this patch it rather looks like this:

ab8500-codec.0: Failed to create new controls -517 snd-soc-mop500.0: ASoC: failed to instantiate card -517 snd-soc-mop500.0: Error: snd_soc_register_card failed (-517)! (...)
abx500-clk.0: registered clocks for ab850x snd-soc-mop500.0: ab8500-codec-dai.0 <-> ux500-msp-i2s.1 mapping ok snd-soc-mop500.0: ab8500-codec-dai.1 <-> ux500-msp-i2s.3 mapping ok

I'm pretty happy about the patch as it it, but I'm a bit uncertain on how to proceed: there are a lot of users of the external functions snd_soc_dapm_new_control() (111 sites) and that will now return an occassional error pointer, which is not handled in the calling sites.

I want an indication from the maintainers whether I should just go in and augment all these call sites, or if deferred probe is frowned upon when it leads to this much overhead.

---
 sound/soc/soc-dapm.c     |   42 ++++++++++++++++++++++++++++++++++++++++++
 sound/soc/soc-topology.c |    9 +++++++++
 2 files changed, 51 insertions(+)

@@ -358,6 +358,10 @@ static int dapm_kcontrol_data_alloc(stru
 				snd_soc_dapm_new_control_unlocked(widget->dapm,
 				&template);
 			kfree(name);
+			if (IS_ERR(data->widget)) {
+				ret = PTR_ERR(data->widget);
+				goto err_data;
+			}
 			if (!data->widget) {
 				ret = -ENOMEM;
 				goto err_data;

@@ -392,6 +396,10 @@ static int dapm_kcontrol_data_alloc(stru
 			data->widget = snd_soc_dapm_new_control_unlocked(
 						widget->dapm, &template);
 			kfree(name);
+			if (IS_ERR(data->widget)) {
+				ret = PTR_ERR(data->widget);
+				goto err_data;
+			}
 			if (!data->widget) {
 				ret = -ENOMEM;
 				goto err_data;

@@ -3311,11 +3319,22 @@ snd_soc_dapm_new_control(struct snd_soc_
 
 	mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
 	w = snd_soc_dapm_new_control_unlocked(dapm, widget);
+	/* Do not nag about probe deferrals */
+	if (IS_ERR(w)) {
+		int ret = PTR_ERR(w);
+
+		if (ret != -EPROBE_DEFER)
+			dev_err(dapm->dev,
+				"ASoC: Failed to create DAPM control %s (%d)\n",
+				widget->name, ret);
+		goto out_unlock;
+	}
 	if (!w)
 		dev_err(dapm->dev,
 			"ASoC: Failed to create DAPM control %s\n",
 			widget->name);
 
+out_unlock:
 	mutex_unlock(&dapm->card->dapm_mutex);
 	return w;
 }

@@ -3338,6 +3357,8 @@ snd_soc_dapm_new_control_unlocked(struct
 		w->regulator = devm_regulator_get(dapm->dev, w->name);
 		if (IS_ERR(w->regulator)) {
 			ret = PTR_ERR(w->regulator);
+			if (ret == -EPROBE_DEFER)
+				return ERR_PTR(ret);
 			dev_err(dapm->dev, "ASoC: Failed to request %s: %d\n",
 				w->name, ret);
 			return NULL;

@@ -3356,6 +3377,8 @@ snd_soc_dapm_new_control_unlocked(struct
 		w->clk = devm_clk_get(dapm->dev, w->name);
 		if (IS_ERR(w->clk)) {
 			ret = PTR_ERR(w->clk);
+			if (ret == -EPROBE_DEFER)
+				return ERR_PTR(ret);
 			dev_err(dapm->dev, "ASoC: Failed to request %s: %d\n",
 				w->name, ret);
 			return NULL;

@@ -3474,6 +3497,16 @@ int snd_soc_dapm_new_controls(struct snd
 	mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_INIT);
 	for (i = 0; i < num; i++) {
 		w = snd_soc_dapm_new_control_unlocked(dapm, widget);
+		if (IS_ERR(w)) {
+			ret = PTR_ERR(w);
+			/* Do not nag about probe deferrals */
+			if (ret == -EPROBE_DEFER)
+				break;
+			dev_err(dapm->dev,
+				"ASoC: Failed to create DAPM control %s (%d)\n",
+				widget->name, ret);
+			break;
+		}
 		if (!w) {
 			dev_err(dapm->dev,
 				"ASoC: Failed to create DAPM control %s\n",

@@ -3750,6 +3783,15 @@ int snd_soc_dapm_new_pcm(struct snd_soc_
 	dev_dbg(card->dev, "ASoC: adding %s widget\n", link_name);
 
 	w = snd_soc_dapm_new_control_unlocked(&card->dapm, &template);
+	if (IS_ERR(w)) {
+		ret = PTR_ERR(w);
+		/* Do not nag about probe deferrals */
+		if (ret != -EPROBE_DEFER)
+			dev_err(card->dev,
+				"ASoC: Failed to create %s widget (%d)\n",
+				link_name, ret);
+		goto outfree_kcontrol_news;
+	}
 	if (!w) {
 		dev_err(card->dev, "ASoC: Failed to create %s widget\n",
 			link_name);

@@ -1473,6 +1473,15 @@ widget:
 		widget = snd_soc_dapm_new_control(dapm, &template);
 	else
 		widget = snd_soc_dapm_new_control_unlocked(dapm, &template);
+	if (IS_ERR(widget)) {
+		ret = PTR_ERR(widget);
+		/* Do not nag about probe deferrals */
+		if (ret != -EPROBE_DEFER)
+			dev_err(tplg->dev,
+				"ASoC: failed to create widget %s controls (%d)\n",
+				w->name, ret);
+		goto hdr_err;
+	}
 	if (widget == NULL) {
 		dev_err(tplg->dev, "ASoC: failed to create widget %s controls\n",
 			w->name);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Richard Guy Briggs <[email protected]>

[ Upstream commit 62bc306e2083436675e33b5bdeb6a77907d35971 ]

32-bit socketcalls were not being logged by audit on x86_64 systems. Log them. This is basically a duplicate of the call from net/socket.c:sys_socketcall(), but it addresses the impedance mismatch between 32-bit userspace process and 64-bit kernel audit.

See: https://github.com/linux-audit/audit-kernel/issues/14

---
 include/linux/audit.h |   20 ++++++++++++++++++++
 net/compat.c          |   17 ++++++++++++++---
 2 files changed, 34 insertions(+), 3 deletions(-)

@@ -387,6 +387,20 @@ static inline int audit_socketcall(int n
 		return __audit_socketcall(nargs, args);
 	return 0;
 }
+
+static inline int audit_socketcall_compat(int nargs, u32 *args)
+{
+	unsigned long a[AUDITSC_ARGS];
+	int i;
+
+	if (audit_dummy_context())
+		return 0;
+
+	for (i = 0; i < nargs; i++)
+		a[i] = (unsigned long)args[i];
+	return __audit_socketcall(nargs, a);
+}
+
 static inline int audit_sockaddr(int len, void *addr)
 {
 	if (unlikely(!audit_dummy_context()))

@@ -513,6 +527,12 @@ static inline int audit_socketcall(int n
 {
 	return 0;
 }
+
+static inline int audit_socketcall_compat(int nargs, u32 *args)
+{
+	return 0;
+}
+
 static inline void audit_fd_pair(int fd1, int fd2)
 { }
 static inline int audit_sockaddr(int len, void *addr)

@@ -22,6 +22,7 @@
 #include <linux/filter.h>
 #include <linux/compat.h>
 #include <linux/security.h>
+#include <linux/audit.h>
 #include <linux/export.h>
 
 #include <net/scm.h>

@@ -781,14 +782,24 @@ COMPAT_SYSCALL_DEFINE5(recvmmsg, int, fd
 
 COMPAT_SYSCALL_DEFINE2(socketcall, int, call, u32 __user *, args)
 {
-	int ret;
-	u32 a[6];
+	u32 a[AUDITSC_ARGS];
+	unsigned int len;
 	u32 a0, a1;
+	int ret;
 
 	if (call < SYS_SOCKET || call > SYS_SENDMMSG)
 		return -EINVAL;
-	if (copy_from_user(a, args, nas[call]))
+	len = nas[call];
+	if (len > sizeof(a))
+		return -EINVAL;
+
+	if (copy_from_user(a, args, len))
 		return -EFAULT;
+
+	ret = audit_socketcall_compat(len / sizeof(a[0]), a);
+	if (ret)
+		return ret;
+
 	a0 = a[0];
 	a1 = a[1];
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michal Kazior <[email protected]>

[ Upstream commit 0a744d927406389e00687560d9ce3c5ab0e58db9 ]

Station pointers are RCU protected so driver must be extra careful if it tries to store them internally for later use outside of the RCU section it obtained it in.

It was possible for station teardown to race with some htt events. The possible outcome could be a use-after-free and a crash.

Only peer-flow-control capable firmware was affected (so hardware-wise qca99x0 and qca4019).

This could be done in sta_state() itself via explicit synchronize_net() call but there's already a convenient sta_pre_rcu_remove() op that can be hooked up to avoid extra rcu stall.

The peer->sta pointer itself can't be set to NULL/ERR_PTR because it is later used in sta_state() for extra sanity checks.

---
 drivers/net/wireless/ath/ath10k/core.h |    1 +
 drivers/net/wireless/ath/ath10k/mac.c  |   18 ++++++++++++++++++
 2 files changed, 19 insertions(+)

@@ -314,6 +314,7 @@ struct ath10k_peer {
 	struct ieee80211_vif *vif;
 	struct ieee80211_sta *sta;
 
+	bool removed;
 	int vdev_id;
 	u8 addr[ETH_ALEN];
 	DECLARE_BITMAP(peer_ids, ATH10K_MAX_NUM_PEER_IDS);

@@ -3738,6 +3738,9 @@ struct ieee80211_txq *ath10k_mac_txq_loo
 	if (!peer)
 		return NULL;
 
+	if (peer->removed)
+		return NULL;
+
 	if (peer->sta)
 		return peer->sta->txq[tid];
 	else if (peer->vif)

@@ -7422,6 +7425,20 @@ ath10k_mac_op_switch_vif_chanctx(struct
 	return 0;
 }
 
+static void ath10k_mac_op_sta_pre_rcu_remove(struct ieee80211_hw *hw,
+					     struct ieee80211_vif *vif,
+					     struct ieee80211_sta *sta)
+{
+	struct ath10k *ar;
+	struct ath10k_peer *peer;
+
+	ar = hw->priv;
+
+	list_for_each_entry(peer, &ar->peers, list)
+		if (peer->sta == sta)
+			peer->removed = true;
+}
+
 static const struct ieee80211_ops ath10k_ops = {
 	.tx				= ath10k_mac_op_tx,
 	.wake_tx_queue			= ath10k_mac_op_wake_tx_queue,

@@ -7462,6 +7479,7 @@ static const struct ieee80211_ops ath10k
 	.assign_vif_chanctx		= ath10k_mac_op_assign_vif_chanctx,
 	.unassign_vif_chanctx		= ath10k_mac_op_unassign_vif_chanctx,
 	.switch_vif_chanctx		= ath10k_mac_op_switch_vif_chanctx,
+	.sta_pre_rcu_remove		= ath10k_mac_op_sta_pre_rcu_remove,
 
 	CFG80211_TESTMODE_CMD(ath10k_tm_cmd)
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: "David E. Box" <[email protected]>

[ Upstream commit e18a80acd1365e91e3efcd69942d9073936cf851 ]

Gemini Lake reuses the same LPSS SPI configuration as Broxton

---
 drivers/spi/spi-pxa2xx.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -1458,6 +1458,10 @@ static const struct pci_device_id pxa2xx
 	{ PCI_VDEVICE(INTEL, 0x1ac2), LPSS_BXT_SSP },
 	{ PCI_VDEVICE(INTEL, 0x1ac4), LPSS_BXT_SSP },
 	{ PCI_VDEVICE(INTEL, 0x1ac6), LPSS_BXT_SSP },
+	/* GLK */
+	{ PCI_VDEVICE(INTEL, 0x31c2), LPSS_BXT_SSP },
+	{ PCI_VDEVICE(INTEL, 0x31c4), LPSS_BXT_SSP },
+	{ PCI_VDEVICE(INTEL, 0x31c6), LPSS_BXT_SSP },
 	/* APL */
 	{ PCI_VDEVICE(INTEL, 0x5ac2), LPSS_BXT_SSP },
 	{ PCI_VDEVICE(INTEL, 0x5ac4), LPSS_BXT_SSP },

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sricharan R <[email protected]>

[ Upstream commit e19898077cfb642fe151ba22981e795c74d9e114 ]

Currently the driver sets all the device transactions privileges to UNPRIVILEGED, but there are cases where the iommu masters wants to isolate privileged supervisor and unprivileged user.
So don't override the privileged setting to unprivileged, instead set it to default as incoming and let it be controlled by the pagetable settings.

---
 drivers/iommu/arm-smmu.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1211,7 +1211,7 @@ static int arm_smmu_domain_add_master(st
 			continue;
 
 		s2cr[idx].type = type;
-		s2cr[idx].privcfg = S2CR_PRIVCFG_UNPRIV;
+		s2cr[idx].privcfg = S2CR_PRIVCFG_DEFAULT;
 		s2cr[idx].cbndx = cbndx;
 		arm_smmu_write_s2cr(smmu, idx);
 	}

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Peter Chen <[email protected]>

[ Upstream commit c3b674a04b8ab62a1d35e86714d466af0a0ecc18 ]

At some situations, the vbus may already be there before starting gadget. So we need to check vbus event after switching to gadget in order to handle missing vbus event. The typical use cases are plugging vbus cable before driver load or the vbus has already been there after stopping host but before starting gadget.

---
 drivers/usb/chipidea/otg.c |   17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

@@ -134,9 +134,9 @@ void ci_handle_vbus_change(struct ci_hdr
 	if (!ci->is_otg)
 		return;
 
-	if (hw_read_otgsc(ci, OTGSC_BSV))
+	if (hw_read_otgsc(ci, OTGSC_BSV) && !ci->vbus_active)
 		usb_gadget_vbus_connect(&ci->gadget);
-	else
+	else if (!hw_read_otgsc(ci, OTGSC_BSV) && ci->vbus_active)
 		usb_gadget_vbus_disconnect(&ci->gadget);
 }
 

@@ -175,14 +175,21 @@ static void ci_handle_id_switch(struct c
 
 		ci_role_stop(ci);
 
-		if (role == CI_ROLE_GADGET)
+		if (role == CI_ROLE_GADGET &&
+				IS_ERR(ci->platdata->vbus_extcon.edev))
 			/*
-			 * wait vbus lower than OTGSC_BSV before connecting
-			 * to host
+			 * Wait vbus lower than OTGSC_BSV before connecting
+			 * to host. If connecting status is from an external
+			 * connector instead of register, we don't need to
+			 * care vbus on the board, since it will not affect
+			 * external connector status.
 			 */
 			hw_wait_vbus_lower_bsv(ci);
 
 		ci_role_start(ci, role);
+		/* vbus change may have already occurred */
+		if (role == CI_ROLE_GADGET)
+			ci_handle_vbus_change(ci);
 	}
 }
 /**

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Linus Walleij <[email protected]>

[ Upstream commit 639467c8f26d834c934215e8b59129ce442475fe ]

commit 66feeec9322132689d42723df2537d60f96f8e44 "RFC: ASoC: dapm: handle probe deferrals" forgot a to update some two sites where the call was used. The static codechecks quickly found them.

---
 sound/soc/soc-dapm.c |   20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

@@ -3843,6 +3843,16 @@ int snd_soc_dapm_new_dai_widgets(struct
 			template.name);
 
 		w = snd_soc_dapm_new_control_unlocked(dapm, &template);
+		if (IS_ERR(w)) {
+			int ret = PTR_ERR(w);
+
+			/* Do not nag about probe deferrals */
+			if (ret != -EPROBE_DEFER)
+				dev_err(dapm->dev,
+				"ASoC: Failed to create %s widget (%d)\n",
+				dai->driver->playback.stream_name, ret);
+			return ret;
+		}
 		if (!w) {
 			dev_err(dapm->dev, "ASoC: Failed to create %s widget\n",
 				dai->driver->playback.stream_name);

@@ -3862,6 +3872,16 @@ int snd_soc_dapm_new_dai_widgets(struct
 			template.name);
 
 		w = snd_soc_dapm_new_control_unlocked(dapm, &template);
+		if (IS_ERR(w)) {
+			int ret = PTR_ERR(w);
+
+			/* Do not nag about probe deferrals */
+			if (ret != -EPROBE_DEFER)
+				dev_err(dapm->dev,
+				"ASoC: Failed to create %s widget (%d)\n",
+				dai->driver->playback.stream_name, ret);
+			return ret;
+		}
 		if (!w) {
 			dev_err(dapm->dev, "ASoC: Failed to create %s widget\n",
 				dai->driver->capture.stream_name);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brian Starkey <[email protected]>

[ Upstream commit edabb3c4cd2d035bc93a3d67b25a304ea6217301 ]

The destination rectangle provided by userspace in the CRTC_X/Y/W/H properties is already expressed as the dimensions after rotation. This means we shouldn't swap the width and height ourselves when a 90/270 degree rotation is requested, so remove the code doing the swap.

---
 drivers/gpu/drm/arm/malidp_planes.c |    9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

@@ -150,13 +150,8 @@ static void malidp_de_plane_update(struc
 	/* convert src values from Q16 fixed point to integer */
 	src_w = plane->state->src_w >> 16;
 	src_h = plane->state->src_h >> 16;
-	if (plane->state->rotation & MALIDP_ROTATED_MASK) {
-		dest_w = plane->state->crtc_h;
-		dest_h = plane->state->crtc_w;
-	} else {
-		dest_w = plane->state->crtc_w;
-		dest_h = plane->state->crtc_h;
-	}
+	dest_w = plane->state->crtc_w;
+	dest_h = plane->state->crtc_h;
 
 	malidp_hw_write(mp->hwdev, format_id, mp->layer->base);
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brian Starkey <[email protected]>

[ Upstream commit 7916efe5b57505080b3cebf5bdb228b4eda008ea ]

The horizontal and vertical flip flags were the wrong way around, causing reflect-x to result in reflect-y being applied and vice-versa. Fix them.

---
 drivers/gpu/drm/arm/malidp_planes.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -184,9 +184,9 @@ static void malidp_de_plane_update(struc
 	if (plane->state->rotation & DRM_ROTATE_MASK)
 		val = ilog2(plane->state->rotation & DRM_ROTATE_MASK) << LAYER_ROT_OFFSET;
 	if (plane->state->rotation & DRM_REFLECT_X)
-		val |= LAYER_V_FLIP;
-	if (plane->state->rotation & DRM_REFLECT_Y)
 		val |= LAYER_H_FLIP;
+	if (plane->state->rotation & DRM_REFLECT_Y)
+		val |= LAYER_V_FLIP;
 
 	/* set the 'enable layer' bit */
 	val |= LAYER_ENABLE;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Benjamin Tissoires <[email protected]>

[ Upstream commit 5b779fc52020ac6f5beea31c5eafc3d25cf70dc1 ]

In the general case, the resources are properly released by devm without needing to do anything. However, when unplugging the wireless receiver, the kernel segfaults from time to time while calling devres_release_all().

I think in that case the resources attempt to access hid_get_drvdata(hdev) which has been set to null while leaving wacom_remove().

---
 drivers/hid/wacom_sys.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -2433,6 +2433,8 @@ static void wacom_remove(struct hid_devi
 	if (hdev->bus == BUS_BLUETOOTH)
 		device_remove_file(&hdev->dev, &dev_attr_speed);
 
+	wacom_release_resources(wacom);
+
 	hid_set_drvdata(hdev, NULL);
 }
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

[ Upstream commit 98ea51cb0c8ce009d9da1fd7b48f0ff1d7a9bbb0 ]

Hauke already fixed a couple of them, but one instance remains that checks for a negative integer when it should check for a NULL pointer:

arch/mips/lantiq/xway/sysctrl.c: In function 'ltq_soc_init':
arch/mips/lantiq/xway/sysctrl.c:473:19: error: ordered comparison of pointer with integer zero [-Werror=extra]

Patchwork: https://patchwork.linux-mips.org/patch/15043/

---
 arch/mips/lantiq/xway/sysctrl.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -469,8 +469,8 @@ void __init ltq_soc_init(void)
 			panic("Failed to load xbar nodes from devicetree");
 		if (of_address_to_resource(np_xbar, 0, &res_xbar))
 			panic("Failed to get xbar resources");
-		if (request_mem_region(res_xbar.start, resource_size(&res_xbar),
-			res_xbar.name) < 0)
+		if (!request_mem_region(res_xbar.start, resource_size(&res_xbar),
+			res_xbar.name))
 			panic("Failed to get xbar resources");
 
 		ltq_xbar_membase = ioremap_nocache(res_xbar.start,

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arvind Yadav <[email protected]>

[ Upstream commit b3d91db3f71d5f70ea60d900425a3f96aeb3d065 ]

Free memory mapping, if ath79_clocks_init_dt_ng is not successful.

Patchwork: https://patchwork.linux-mips.org/patch/14915/

---
 arch/mips/ath79/clock.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

@@ -508,16 +508,19 @@ static void __init ath79_clocks_init_dt_
 		ar9330_clk_init(ref_clk, pll_base);
 	else {
 		pr_err("%s: could not find any appropriate clk_init()\n", dnfn);
-		goto err_clk;
+		goto err_iounmap;
 	}
 
 	if (of_clk_add_provider(np, of_clk_src_onecell_get, &clk_data)) {
 		pr_err("%s: could not register clk provider\n", dnfn);
-		goto err_clk;
+		goto err_iounmap;
 	}
 
 	return;
 
+err_iounmap:
+	iounmap(pll_base);
+
 err_clk:
 	clk_put(ref_clk);
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Juerg Haefliger <[email protected]>

[ Upstream commit 9ba60573638e2006170ebcc5489fb1e068afbc8f ]

No jprobe is registered when the module is loaded without specifying a crashpoint that uses a jprobe. At the moment, we unconditionally try to unregister the jprobe on module unload which results in an Oops. Add a check to fix this.

---
 drivers/misc/lkdtm_core.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -533,7 +533,9 @@ static void __exit lkdtm_module_exit(voi
 	/* Handle test-specific clean-up. */
 	lkdtm_usercopy_exit();
 
-	unregister_jprobe(lkdtm_jprobe);
+	if (lkdtm_jprobe != NULL)
+		unregister_jprobe(lkdtm_jprobe);
+
 	pr_info("Crash point unregistered\n");
 }
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Myungho Jung <[email protected]>

[ Upstream commit 9899886d5e8ec5b343b1efe44f185a0e68dc6454 ]

Added NULL check to make __dev_kfree_skb_irq consistent with kfree family of functions.

---
 net/core/dev.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -2355,6 +2355,9 @@ void __dev_kfree_skb_irq(struct sk_buff
 {
 	unsigned long flags;
 
+	if (unlikely(!skb))
+		return;
+
 	if (likely(atomic_read(&skb->users) == 1)) {
 		smp_rmb();
 		atomic_set(&skb->users, 0);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexander Potapenko <[email protected]>

[ Upstream commit fd2c83b35752f0a8236b976978ad4658df14a59f ]

In the case getsockopt() is called with PACKET_HDRLEN and optlen < 4 |val| remains uninitialized and the syscall may behave differently depending on its value, and even copy garbage to userspace on certain architectures. To fix this we now return -EINVAL if optlen is too small.

This bug has been detected with KMSAN.

---
 net/packet/af_packet.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -3884,6 +3884,8 @@ static int packet_getsockopt(struct sock
 	case PACKET_HDRLEN:
 		if (len > sizeof(int))
 			len = sizeof(int);
+		if (len < sizeof(int))
+			return -EINVAL;
 		if (copy_from_user(&val, optval, len))
 			return -EFAULT;
 		switch (val) {

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pan Bian <[email protected]>

[ Upstream commit 72ec0bc64b9a5d8e0efcb717abfc757746b101b7 ]

In functions team_nl_send_port_list_get() and team_nl_send_options_get(), pointer skb keeps the return value of nlmsg_new(). When the call to genlmsg_put() fails, the memory is not freed(). This will result in memory leak bugs.