stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 4.14 000/343] 4.14.168-stable review
@ 2020-01-24  9:26 Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.14 001/343] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
                   ` (347 more replies)
  0 siblings, 348 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	ben.hutchings, lkft-triage, stable

This is the start of the stable review cycle for the 4.14.168 release.
There are 343 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sun, 26 Jan 2020 09:26:30 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.168-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.14.168-rc1

Finn Thain <fthain@telegraphics.com.au>
    m68k: Call timer_interrupt() with interrupts disabled

Fabrice Gasnier <fabrice.gasnier@st.com>
    serial: stm32: fix clearing interrupt error flags

Max Gurtovoy <maxg@mellanox.com>
    IB/iser: Fix dma_nents type definition

Andre Przywara <andre.przywara@arm.com>
    arm64: dts: juno: Fix UART frequency

Sam Bobroff <sbobroff@linux.ibm.com>
    drm/radeon: fix bad DMA from INTERRUPT_CNTL2

Chuhong Yuan <hslester96@gmail.com>
    dmaengine: ti: edma: fix missed failure handling

Navid Emamdoost <navid.emamdoost@gmail.com>
    affs: fix a memory leak in affs_remount

H. Nikolaus Schaller <hns@goldelico.com>
    mmc: core: fix wl1251 sdio quirks

H. Nikolaus Schaller <hns@goldelico.com>
    mmc: sdio: fix wl1251 vendor id

Eric Dumazet <edumazet@google.com>
    packet: fix data-race in fanout_flow_is_huge()

Eric Dumazet <edumazet@google.com>
    net: neigh: use long type to store jiffies delta

Stephen Hemminger <sthemmin@microsoft.com>
    hv_netvsc: flag software created hash value

Tiezhu Yang <yangtiezhu@loongson.cn>
    MIPS: Loongson: Fix return value of loongson_hwmon_init

Marc Dionne <marc.dionne@auristor.com>
    afs: Fix large file support

Stefan Wahren <stefan.wahren@in-tech.com>
    net: qca_spi: Move reset_count to struct qcaspi

Jakub Kicinski <jakub.kicinski@netronome.com>
    net: netem: correct the parent's backlog when corrupted packet was dropped

Jakub Kicinski <jakub.kicinski@netronome.com>
    net: netem: fix error path for corrupted GSO frames

Robin Gong <yibin.gong@nxp.com>
    dmaengine: imx-sdma: fix size check for sdma script_number

Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
    drm/msm/dsi: Implement reset correctly

Eric Dumazet <edumazet@google.com>
    tcp: annotate lockless access to tcp_memory_pressure

Eric Dumazet <edumazet@google.com>
    net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head

Eric Dumazet <edumazet@google.com>
    net: avoid possible false sharing in sk_leave_memory_pressure()

YueHaibing <yuehaibing@huawei.com>
    act_mirred: Fix mirred_init_module error handling

Antonio Borneo <antonio.borneo@st.com>
    net: stmmac: fix length of PTP clock's name string

Eric Biggers <ebiggers@google.com>
    llc: fix sk_buff refcounting in llc_conn_state_process()

Eric Biggers <ebiggers@google.com>
    llc: fix another potential sk_buff leak in llc_ui_sendmsg()

Johannes Berg <johannes.berg@intel.com>
    mac80211: accept deauth frames in IBSS mode

Jose Abreu <Jose.Abreu@synopsys.com>
    net: stmmac: gmac4+: Not all Unicast addresses may be available

Ard Biesheuvel <ard.biesheuvel@linaro.org>
    nvme: retain split access workaround for capability reads

Dan Carpenter <dan.carpenter@oracle.com>
    net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()

Dan Carpenter <dan.carpenter@oracle.com>
    of: mdio: Fix a signedness bug in of_phy_get_and_connect()

Dan Carpenter <dan.carpenter@oracle.com>
    net: axienet: fix a signedness bug in probe

Dan Carpenter <dan.carpenter@oracle.com>
    net: stmmac: dwmac-meson8b: Fix signedness bug in probe

Dan Carpenter <dan.carpenter@oracle.com>
    net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()

Dan Carpenter <dan.carpenter@oracle.com>
    net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()

Dan Carpenter <dan.carpenter@oracle.com>
    net: aquantia: Fix aq_vec_isr_legacy() return value

Filippo Sironi <sironi@amazon.de>
    iommu/amd: Wait for completion of IOTLB flush in attach_device

Gerd Rausch <gerd.rausch@oracle.com>
    net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'

Håkon Bugge <haakon.bugge@oracle.com>
    RDMA/cma: Fix false error message

Nicolas Boichat <drinkcat@chromium.org>
    ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet

Li Jin <li.jin@broadcom.com>
    pinctrl: iproc-gpio: Fix incorrect pinconf configurations

Mao Wenan <maowenan@huawei.com>
    net: sonic: replace dev_kfree_skb in sonic_send_packet

Dan Robertson <dan@dlrobertson.com>
    hwmon: (shtc1) fix shtc1 and shtw1 id mask

Firo Yang <firo.yang@suse.com>
    ixgbe: sync the first fragment unconditionally

Omar Sandoval <osandov@fb.com>
    btrfs: use correct count in btrfs_file_write_iter()

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix inode cache waiters hanging on path allocation failure

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix inode cache waiters hanging on failure to start caching thread

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix hang when loading existing inode cache off disk

Govindarajulu Varadarajan <gvaradar@cisco.com>
    scsi: fnic: fix msix interrupt allocation

Mao Wenan <maowenan@huawei.com>
    net: sonic: return NETDEV_TX_OK if failed to map buffer

Andrey Smirnov <andrew.smirnov@gmail.com>
    tty: serial: fsl_lpuart: Use appropriate lpuart32_* I/O funcs

Lorenzo Bianconi <lorenzo@kernel.org>
    ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init

Colin Ian King <colin.king@canonical.com>
    iio: dac: ad5380: fix incorrect assignment to val

Colin Ian King <colin.king@canonical.com>
    bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA

Dexuan Cui <decui@microsoft.com>
    irqdomain: Add the missing assignment of domain->fwnode for named fwnode

Dan Carpenter <dan.carpenter@oracle.com>
    staging: greybus: light: fix a couple double frees

Masami Hiramatsu <mhiramat@kernel.org>
    x86, perf: Fix the dependency of the x86 insn decoder selftest

Stephen Boyd <swboyd@chromium.org>
    power: supply: Init device wakeup after device_add()

Guenter Roeck <linux@roeck-us.net>
    hwmon: (lm75) Fix write operations for negative temperatures

Linus Torvalds <torvalds@linux-foundation.org>
    Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    ahci: Do not export local variable ahci_em_messages

Yong Wu <yong.wu@mediatek.com>
    iommu/mediatek: Fix iova_to_phys PA start for 4GB mode

Nick Desaulniers <ndesaulniers@google.com>
    mips: avoid explicit UB in assignment of mips_io_port_base

Bruno Thomsen <bruno.thomsen@gmail.com>
    rtc: pcf2127: bugfix: read rtc disables watchdog

Alexandre Kroupski <alexandre.kroupski@ingenico.com>
    media: atmel: atmel-isi: fix timeout value for stop streaming

Felix Fietkau <nbd@nbd.name>
    mac80211: minstrel_ht: fix per-group max throughput rate initialization

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    dmaengine: dw: platform: Switch to acpi_dma_controller_register()

Maxime Ripard <maxime.ripard@bootlin.com>
    ASoC: sun4i-i2s: RX and TX counter registers are swapped

Eric W. Biederman <ebiederm@xmission.com>
    signal: Allow cifs and drbd to receive their terminating signals

Vasundhara Volam <vasundhara-v.volam@broadcom.com>
    bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails

Gerd Rausch <gerd.rausch@oracle.com>
    net/rds: Add a few missing rds_stat_names entries

YueHaibing <yuehaibing@huawei.com>
    ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls

YueHaibing <yuehaibing@huawei.com>
    ASoC: cs4349: Use PM ops 'cs4349_runtime_pm'

YueHaibing <yuehaibing@huawei.com>
    ASoC: es8328: Fix copy-paste error in es8328_right_line_controls

Colin Ian King <colin.king@canonical.com>
    ext4: set error return correctly when ext4_htree_store_dirent fails

Iuliana Prodan <iuliana.prodan@nxp.com>
    crypto: caam - free resources in case caam_rng registration failed

Steve French <stfrench@microsoft.com>
    cifs: fix rmmod regression in cifs.ko caused by force_sig changes

Mark Zhang <markz@mellanox.com>
    net/mlx5: Fix mlx5_ifc_query_lag_out_bits

Fabrice Gasnier <fabrice.gasnier@st.com>
    ARM: dts: stm32: add missing vdda-supply to adc on stm32h743i-eval

Jon Maloy <jon.maloy@ericsson.com>
    tipc: reduce risk of wakeup queue starvation

Johannes Berg <johannes@sipsolutions.net>
    ALSA: aoa: onyx: always initialize register read value

Arnd Bergmann <arnd@arndb.de>
    crypto: ccp - Reduce maximum stack usage

Thomas Gleixner <tglx@linutronix.de>
    x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI

Arnd Bergmann <arnd@arndb.de>
    mic: avoid statically declaring a 'struct device'.

Ruslan Bilovol <ruslan.bilovol@gmail.com>
    usb: host: xhci-hub: fix extra endianness conversion

Arnd Bergmann <arnd@arndb.de>
    qed: reduce maximum stack frame size

YueHaibing <yuehaibing@huawei.com>
    libertas_tf: Use correct channel range in lbtf_geo_init

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    PM: sleep: Fix possible overflow in pm_system_cancel_wakeup()

Icenowy Zheng <icenowy@aosc.io>
    clk: sunxi-ng: v3s: add the missing PLL_DDR1

Colin Ian King <colin.king@canonical.com>
    scsi: libfc: fix null pointer dereference on a null lport

Wen Yang <wen.yang99@zte.com.cn>
    net: pasemi: fix an use-after-free in pasemi_mac_phy_init()

Xi Wang <wangxi11@huawei.com>
    RDMA/hns: Fixs hw access invalid dma memory error

Arnd Bergmann <arnd@arndb.de>
    devres: allow const resource arguments

David Howells <dhowells@redhat.com>
    rxrpc: Fix uninitialized error code in rxrpc_send_data_packet()

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    mfd: intel-lpss: Release IDA resources

Kevin Mitchell <kevmitch@arista.com>
    iommu/amd: Make iommu_disable safer

Michael Chan <michael.chan@broadcom.com>
    bnxt_en: Fix ethtool selftest crash under error conditions.

Bryan O'Donoghue <pure.logic@nexus-software.ie>
    nvmem: imx-ocotp: Ensure WAIT bits are preserved when setting timing

Nathan Huckleberry <nhuck@google.com>
    clk: qcom: Fix -Wunused-const-variable

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width"

Ravi Bangoria <ravi.bangoria@linux.ibm.com>
    perf/ioctl: Add check for the sample_period value

Rob Clark <robdclark@chromium.org>
    drm/msm/a3xx: remove TPL1 regs from snapshot

Chen-Yu Tsai <wens@csie.org>
    rtc: pcf8563: Clear event flags and disable interrupts before requesting irq

Chen-Yu Tsai <wens@csie.org>
    rtc: pcf8563: Fix interrupt trigger method

Peter Ujfalusi <peter.ujfalusi@ti.com>
    ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs

Julian Wiedmann <jwi@linux.ibm.com>
    net/af_iucv: always register net_device notifier

Jakub Kicinski <jakub.kicinski@netronome.com>
    net: netem: fix backlog accounting for corrupted GSO frames

Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
    drm/msm/mdp5: Fix mdp5_cfg_init error return

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild

Michal Kalderon <michal.kalderon@marvell.com>
    qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state

Eric Auger <eric.auger@redhat.com>
    iommu/vt-d: Duplicate iommu_resv_region objects per device list

George Wilkie <gwilkie@vyatta.att-mail.com>
    mpls: fix warning with multi-label encap

Colin Ian King <colin.king@canonical.com>
    media: vivid: fix incorrect assignment operation when setting video mode

Florian Fainelli <f.fainelli@gmail.com>
    cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency

Florian Fainelli <f.fainelli@gmail.com>
    cpufreq: brcmstb-avs-cpufreq: Fix initial command check

Stephen Hemminger <stephen@networkplumber.org>
    netvsc: unshare skb in VF rx handler

Eric Dumazet <edumazet@google.com>
    inet: frags: call inet_frags_fini() after unregister_pernet_subsys()

Eric W. Biederman <ebiederm@xmission.com>
    signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig

Lu Baolu <baolu.lu@linux.intel.com>
    iommu: Use right function to get group for device

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    PCI: PM: Avoid possible suspend-to-idle issue

Nathan Chancellor <natechancellor@gmail.com>
    misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa

Erwan Le Ray <erwan.leray@st.com>
    serial: stm32: fix wakeup source initialization

Erwan Le Ray <erwan.leray@st.com>
    serial: stm32: Add support of TC bit status check

Erwan Le Ray <erwan.leray@st.com>
    serial: stm32: fix transmit_chars when tx is stopped

Erwan Le Ray <erwan.leray@st.com>
    serial: stm32: fix rx error handling

Hook, Gary <Gary.Hook@amd.com>
    crypto: ccp - Fix 3DES complaint from ccp-crypto module

Hook, Gary <Gary.Hook@amd.com>
    crypto: ccp - fix AES CFB error exposed by new test vectors

Christophe Leroy <christophe.leroy@c-s.fr>
    spi: spi-fsl-spi: call spi_finalize_current_message() at the end

Sagiv Ozeri <sagiv.ozeri@marvell.com>
    RDMA/qedr: Fix incorrect device rate.

Jerome Brunet <jbrunet@baylibre.com>
    arm64: dts: meson: libretech-cc: set eMMC as removable

Jon Hunter <jonathanh@nvidia.com>
    dmaengine: tegra210-adma: Fix crash during probe

Jernej Skrabec <jernej.skrabec@siol.net>
    ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT

Robert Richter <rrichter@marvell.com>
    EDAC/mc: Fix edac_mc_find() in case no device is found

Matthias Kaehlcke <mka@chromium.org>
    thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power

Brian Masney <masneyb@onstation.org>
    backlight: lm3630a: Return 0 on success in update_status functions

Dan Carpenter <dan.carpenter@oracle.com>
    kdb: do a sanity check on the cpu in kdb_per_cpu()

Russell King <rmk+kernel@armlinux.org.uk>
    ARM: riscpc: fix lack of keyboard interrupts after irq conversion

Bichao Zheng <bichao.zheng@amlogic.com>
    pwm: meson: Don't disable PWM when setting duty repeatedly

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    pwm: meson: Consider 128 a valid pre-divider

Florian Westphal <fw@strlen.de>
    netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule

Iuliana Prodan <iuliana.prodan@nxp.com>
    crypto: caam - fix caam_dump_sg that iterates through scatterlist

Dan Carpenter <dan.carpenter@oracle.com>
    platform/x86: alienware-wmi: printing the wrong error code

Dan Carpenter <dan.carpenter@oracle.com>
    media: davinci/vpbe: array underflow in vpbe_enum_outputs()

Dan Carpenter <dan.carpenter@oracle.com>
    media: omap_vout: potential buffer overflow in vidioc_dqbuf()

YueHaibing <yuehaibing@huawei.com>
    l2tp: Fix possible NULL pointer dereference

Parav Pandit <parav@mellanox.com>
    vfio/mdev: Fix aborting mdev child device removal if one fails

Parav Pandit <parav@mellanox.com>
    vfio/mdev: Avoid release parent reference during error path

David Howells <dhowells@redhat.com>
    afs: Fix the afs.cell and afs.volume xattr handlers

Igor Konopko <igor.j.konopko@intel.com>
    lightnvm: pblk: fix lock order in pblk_rb_tear_down_check

Pan Bian <bianpan2016@163.com>
    mmc: core: fix possible use after free of host

Sameer Pujar <spujar@nvidia.com>
    dmaengine: tegra210-adma: restore channel status

Sameeh Jubran <sameehj@amazon.com>
    net: ena: fix ena_com_fill_hash_function() implementation

Sameeh Jubran <sameehj@amazon.com>
    net: ena: fix incorrect test of supported hash function

Sameeh Jubran <sameehj@amazon.com>
    net: ena: fix: Free napi resources when ena_up() fails

Sameeh Jubran <sameehj@amazon.com>
    net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry

Lu Baolu <baolu.lu@linux.intel.com>
    iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU

Jack Morgenstein <jackm@dev.mellanox.co.il>
    IB/mlx5: Add missing XRC options to QP optional params mask

Minas Harutyunyan <minas.harutyunyan@synopsys.com>
    dwc2: gadget: Fix completed transfer size calculation in DDMA

Arnd Bergmann <arnd@arndb.de>
    usb: gadget: fsl: fix link error against usb-gadget module

Jerome Brunet <jbrunet@baylibre.com>
    ASoC: fix valid stream condition

Willem de Bruijn <willemb@google.com>
    packet: in recvmsg msg_name return at least sizeof sockaddr_ll

Bart Van Assche <bvanassche@acm.org>
    scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory

Bart Van Assche <bvanassche@acm.org>
    scsi: qla2xxx: Fix a format specifier

Hongbo Yao <yaohongbo@huawei.com>
    irqchip/gic-v3-its: fix some definitions of inner cacheability attributes

Trond Myklebust <trondmy@gmail.com>
    NFS: Don't interrupt file writeout due to fatal errors

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()

Alexandru Ardelean <alexandru.ardelean@analog.com>
    dmaengine: axi-dmac: Don't check the number of frames for alignment

Dan Carpenter <dan.carpenter@oracle.com>
    6lowpan: Off by one handling ->nexthdr

Akinobu Mita <akinobu.mita@gmail.com>
    media: ov2659: fix unbalanced mutex_lock/unlock

Vladimir Oltean <olteanv@gmail.com>
    ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect

Ben Hutchings <ben@decadent.org.uk>
    powerpc: vdso: Make vdso32 installation conditional in vdso_install

Kees Cook <keescook@chromium.org>
    selftests/ipc: Fix msgque compiler warnings

Jie Liu <liujie165@huawei.com>
    tipc: set sysctl_tipc_rmem and named_timeout right range

Colin Ian King <colin.king@canonical.com>
    platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer

Guenter Roeck <linux@roeck-us.net>
    hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses

Yunsheng Lin <linyunsheng@huawei.com>
    net: hns3: fix for vport->bw_limit overflow problem

YueHaibing <yuehaibing@huawei.com>
    ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"

Bart Van Assche <bvanassche@acm.org>
    scsi: target/core: Fix a race condition in the LUN lookup code

Bart Van Assche <bvanassche@acm.org>
    scsi: qla2xxx: Unregister chrdev if module initialization fails

YueHaibing <yuehaibing@huawei.com>
    ehea: Fix a copy-paste err in ehea_init_port_res

Martin Sperl <kernel@martin.sperl.org>
    spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios

Dan Carpenter <dan.carpenter@oracle.com>
    soc/fsl/qe: Fix an error code in qe_pin_request()

Sowjanya Komatineni <skomatineni@nvidia.com>
    spi: tegra114: configure dma burst size to fifo trig level

Sowjanya Komatineni <skomatineni@nvidia.com>
    spi: tegra114: flush fifos

Sowjanya Komatineni <skomatineni@nvidia.com>
    spi: tegra114: terminate dma and reset on transfer timeout

Sowjanya Komatineni <skomatineni@nvidia.com>
    spi: tegra114: fix for unpacked mode transfers

Sowjanya Komatineni <skomatineni@nvidia.com>
    spi: tegra114: clear packed bit for unpacked mode

YueHaibing <yuehaibing@huawei.com>
    media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame

Arnd Bergmann <arnd@arndb.de>
    media: davinci-isif: avoid uninitialized variable use

Tony Lindgren <tony@atomide.com>
    ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset()

Maxime Ripard <maxime.ripard@bootlin.com>
    arm64: dts: allwinner: a64: Add missing PIO clocks

Finn Thain <fthain@telegraphics.com.au>
    m68k: mac: Fix VIA timer counter accesses

Jon Maloy <jon.maloy@ericsson.com>
    tipc: tipc clang warning

Arnd Bergmann <arnd@arndb.de>
    jfs: fix bogus variable self-initialization

Axel Lin <axel.lin@ingics.com>
    regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB

Nicholas Mc Guire <hofrat@osadl.org>
    media: cx23885: check allocation return

Dan Carpenter <dan.carpenter@oracle.com>
    media: wl128x: Fix an error code in fm_download_firmware()

Dan Carpenter <dan.carpenter@oracle.com>
    media: cx18: update *pos correctly in cx18_read_pos()

Dan Carpenter <dan.carpenter@oracle.com>
    media: ivtv: update *pos correctly in ivtv_read_pos()

Axel Lin <axel.lin@ingics.com>
    regulator: lp87565: Fix missing register for LP87565_BUCK_0

Kangjie Lu <kjlu@umn.edu>
    net: sh_eth: fix a missing check of of_get_phy_mode

Dan Carpenter <dan.carpenter@oracle.com>
    xen, cpu_hotplug: Prevent an out of bounds access

Dan Carpenter <dan.carpenter@oracle.com>
    drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()

Steve Sistare <steven.sistare@oracle.com>
    scsi: megaraid_sas: reduce module load time

Qian Cai <cai@lca.pw>
    x86/mm: Remove unused variable 'cpu'

Guenter Roeck <linux@roeck-us.net>
    nios2: ksyms: Add missing symbol exports

Rashmica Gupta <rashmica.g@gmail.com>
    powerpc/mm: Check secondary hash page table

Igor Russkikh <Igor.Russkikh@aquantia.com>
    net: aquantia: fixed instack structure overflow

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE()

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nft_set_hash: fix lookups with fixed size hash on big endian

Axel Lin <axel.lin@ingics.com>
    regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA

Vladimir Murzin <vladimir.murzin@arm.com>
    ARM: 8848/1: virt: Align GIC version check with arm64 counterpart

Marek Szyprowski <m.szyprowski@samsung.com>
    ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used

Stefan Wahren <stefan.wahren@i2se.com>
    mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount

Mattias Jacobsson <2pi@mok.nu>
    platform/x86: wmi: fix potential null pointer dereference

Marek Szyprowski <m.szyprowski@samsung.com>
    clocksource/drivers/exynos_mct: Fix error path in timer resources initialization

Chen-Yu Tsai <wens@csie.org>
    clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFS: Fix a soft lockup in the delegation recovery code

Michael Ellerman <mpe@ellerman.id.au>
    powerpc/64s: Fix logic when handling unknown CPU features

Nathan Chancellor <natechancellor@gmail.com>
    staging: rtlwifi: Use proper enum for return in halmac_parse_psd_data_88xx

Eric W. Biederman <ebiederm@xmission.com>
    fs/nfs: Fix nfs_parse_devname to not modify it's argument

Takashi Iwai <tiwai@suse.de>
    ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()

Colin Ian King <colin.king@canonical.com>
    drm/nouveau/pmu: don't print reply values if exec is false

Colin Ian King <colin.king@canonical.com>
    drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON

Vinod Koul <vkoul@kernel.org>
    net: dsa: qca8k: Enable delay for RGMII_ID mode

Axel Lin <axel.lin@ingics.com>
    regulator: pv88090: Fix array out-of-bounds access

Axel Lin <axel.lin@ingics.com>
    regulator: pv88080: Fix array out-of-bounds access

Axel Lin <axel.lin@ingics.com>
    regulator: pv88060: Fix array out-of-bounds access

YueHaibing <yuehaibing@huawei.com>
    cdc-wdm: pass return value of recover_from_urb_loss

Robin Murphy <robin.murphy@arm.com>
    dmaengine: mv_xor: Use correct device for DMA API

Nicholas Mc Guire <hofrat@osadl.org>
    staging: r8822be: check kzalloc return or bail

Alexey Kardashevskiy <aik@ozlabs.ru>
    KVM: PPC: Release all hardware TCE tables attached to a group

Vadim Pasternak <vadimp@mellanox.com>
    hwmon: (pmbus/tps53679) Fix driver info initialization in probe routine

Eric Auger <eric.auger@redhat.com>
    vfio_pci: Enable memory accesses before calling pci_map_rom

David Howells <dhowells@redhat.com>
    keys: Timestamp new keys

Ming Lei <ming.lei@redhat.com>
    block: don't use bio->bi_vcnt to figure out segment number

Sven Van Asbroeck <thesven73@gmail.com>
    usb: phy: twl6030-usb: fix possible use-after-free on remove

Wen Yang <wen.yang99@zte.com.cn>
    PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio()

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: emev2: Add missing pinmux functions

Dan Carpenter <dan.carpenter@oracle.com>
    drm/etnaviv: potential NULL dereference

Steve Wise <swise@opengridcomputing.com>
    iw_cxgb4: use tos when finding ipv6 routes

Steve Wise <swise@opengridcomputing.com>
    iw_cxgb4: use tos when importing the endpoint

YueHaibing <yuehaibing@huawei.com>
    fbdev: chipsfb: remove set but not used variable 'size'

Colin Ian King <colin.king@canonical.com>
    rtc: pm8xxx: fix unintended sign extension

Colin Ian King <colin.king@canonical.com>
    rtc: 88pm80x: fix unintended sign extension

Colin Ian King <colin.king@canonical.com>
    rtc: 88pm860x: fix unintended sign extension

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    rtc: ds1307: rx8130: Fix alarm handling

Moritz Fischer <mdf@kernel.org>
    net: phy: fixed_phy: Fix fixed_phy not checking GPIO

Michael Kao <michael.kao@mediatek.com>
    thermal: mediatek: fix register index error

Colin Ian King <colin.king@canonical.com>
    rtc: ds1672: fix unintended sign extension

Colin Ian King <colin.king@canonical.com>
    staging: most: cdev: add missing check for cdev_add failure

Sara Sharon <sara.sharon@intel.com>
    iwlwifi: mvm: fix RSS config command

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: reparent keypad controller to SIC1

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: add required clocks property to keypad device node

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    driver core: Do not resume suppliers under device_links_write_lock()

Corentin Labbe <clabbe@baylibre.com>
    crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments

Liu Jian <liujian56@huawei.com>
    driver: uio: fix possible use-after-free in __uio_register_device

Liu Jian <liujian56@huawei.com>
    driver: uio: fix possible memory leak in __uio_register_device

YueHaibing <yuehaibing@huawei.com>
    tty: ipwireless: Fix potential NULL pointer dereference

Johannes Berg <johannes.berg@intel.com>
    iwlwifi: mvm: fix A-MPDU reference assignment

Moni Shoua <monis@mellanox.com>
    net/mlx5: Take lock with IRQs disabled to avoid deadlock

Mordechay Goodstein <mordechay.goodstein@intel.com>
    iwlwifi: mvm: avoid possible access out of array.

Chen-Yu Tsai <wens@csie.org>
    clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it

YueHaibing <yuehaibing@huawei.com>
    spi/topcliff_pch: Fix potential NULL dereference on allocation error

Eric Wong <e@80x24.org>
    rtc: cmos: ignore bogus century byte

Israel Rukshin <israelr@mellanox.com>
    IB/iser: Pass the correct number of entries for dma mapped SGL

Stefan Agner <stefan@agner.ch>
    ASoC: imx-sgtl5000: put of nodes if finding codec fails

Eric Biggers <ebiggers@google.com>
    crypto: tgr192 - fix unaligned memory access

YueHaibing <yuehaibing@huawei.com>
    crypto: brcm - Fix some set-but-not-used warning

Masahiro Yamada <yamada.masahiro@socionext.com>
    kbuild: mark prepare0 as PHONY to fix external module build

Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
    media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL

Dan Carpenter <dan.carpenter@oracle.com>
    drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()

Raju Rangoju <rajur@chelsio.com>
    RDMA/iw_cxgb4: Fix the unchecked ep dereference

Charles Keepax <ckeepax@opensource.cirrus.com>
    spi: cadence: Correct initialisation of runtime PM

Loic Poulain <loic.poulain@linaro.org>
    arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD

YueHaibing <yuehaibing@huawei.com>
    drm/shmob: Fix return value check in shmob_drm_probe

Gal Pressman <galpress@amazon.com>
    RDMA/qedr: Fix out of bounds index check in query pkey

Gal Pressman <galpress@amazon.com>
    RDMA/ocrdma: Fix out of bounds index check in query pkey

Gal Pressman <galpress@amazon.com>
    IB/usnic: Fix out of bounds index check in query pkey

Jonas Gorski <jonas.gorski@gmail.com>
    MIPS: BCM63XX: drop unused and broken DSP platform device

Yangtao Li <tiny.windzz@gmail.com>
    clk: dove: fix refcount leak in dove_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: armada-xp: fix refcount leak in axp_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: kirkwood: fix refcount leak in kirkwood_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: armada-370: fix refcount leak in a370_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: vf610: fix refcount leak in vf610_clocks_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: imx7d: fix refcount leak in imx7d_clocks_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: imx6sx: fix refcount leak in imx6sx_clocks_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: imx6q: fix refcount leak in imx6q_clocks_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()

Yangtao Li <tiny.windzz@gmail.com>
    clk: socfpga: fix refcount leak

Yangtao Li <tiny.windzz@gmail.com>
    clk: qoriq: fix refcount leak in clockgen_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: highbank: fix refcount leak in hb_clk_init()

Dan Carpenter <dan.carpenter@oracle.com>
    Input: nomadik-ske-keypad - fix a loop timeout test

Petr Machata <petrm@mellanox.com>
    vxlan: changelink: Fix handling of default remotes

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh7734: Add missing IPSR11 field

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group

Kelvin Cao <kelvin.cao@microchip.com>
    switchtec: Remove immediate status check after submitting MRPC command

Stefan Wahren <stefan.wahren@i2se.com>
    staging: bcm2835-camera: Abort probe if there is no camera

Yuval Shaia <yuval.shaia@oracle.com>
    IB/rxe: Fix incorrect cache cleanup in error flow

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    net: phy: Fix not to call phy_resume() if PHY is not attached

Lyude Paul <lyude@redhat.com>
    drm/dp_mst: Skip validating ports during destruction, just ref

YueHaibing <yuehaibing@huawei.com>
    exportfs: fix 'passing zero to ERR_PTR()' warning

Colin Ian King <colin.king@canonical.com>
    pcrypt: use format specifier in kobject_add

Gustavo A. R. Silva <gustavo@embeddedor.com>
    NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks

Petr Machata <petrm@mellanox.com>
    mlxsw: reg: QEEC: Add minimum shaper fields

Maxime Ripard <maxime.ripard@bootlin.com>
    drm/sun4i: hdmi: Fix double flag assignation

Christophe Leroy <christophe.leroy@c-s.fr>
    powerpc/kgdb: add kgdb_arch_set/remove_breakpoint()

Hans de Goede <hdegoede@redhat.com>
    pwm: lpss: Release runtime-pm reference from the driver's remove callback

Spencer E. Olson <olsonse@umich.edu>
    staging: comedi: ni_mio_common: protect register write overflow

Nicolas Huaman <nicolas@herochao.de>
    ALSA: usb-audio: update quirk for B&W PX to remove microphone

Linus Walleij <linus.walleij@linaro.org>
    regulator: fixed: Default enable high on DT regulators

Alex Estrin <alex.estrin@intel.com>
    IB/hfi1: Add mtu check for operational data VLs

Zhu Yanjun <yanjun.zhu@oracle.com>
    IB/rxe: replace kvfree with vfree

John Garry <john.garry@huawei.com>
    drm/hisilicon: hibmc: Don't overwrite fb helper surface depth

Jitendra Bhivare <jitendra.bhivare@broadcom.com>
    PCI: iproc: Remove PAXC slot check to allow VF support

Jann Horn <jannh@google.com>
    apparmor: don't try to replace stale label in ptrace access check

Anders Roxell <anders.roxell@linaro.org>
    ALSA: hda: fix unused variable warning

Dan Carpenter <dan.carpenter@oracle.com>
    drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()

Peter Rosin <peda@axentia.se>
    drm/sti: do not remove the drm_bridge that was never added

Jean-Jacques Hiblot <jjhiblot@ti.com>
    leds: tlc591xx: update the maximum brightness

Corentin Labbe <clabbe.montjoie@gmail.com>
    crypto: sun4i-ss - fix big endian issues

Lorenzo Bianconi <lorenzo@kernel.org>
    mt7601u: fix bbp version check in mt7601u_wait_bbp_ready

Tung Nguyen <tung.q.nguyen@dektech.com.au>
    tipc: fix wrong timeout input for tipc_wait_for_cond()

Ard Biesheuvel <ardb@kernel.org>
    powerpc/archrandom: fix arch_get_random_seed_int()

Jarkko Nikula <jarkko.nikula@linux.intel.com>
    mfd: intel-lpss: Add default I2C device properties for Gemini Lake

Jan Kara <jack@suse.cz>
    xfs: Sanity check flags of Q_XQUOTARM call


-------------

Diffstat:

 Makefile                                           |   8 +-
 arch/arm/boot/dts/lpc3250-phy3250.dts              |   4 +-
 arch/arm/boot/dts/lpc32xx.dtsi                     |  10 +-
 arch/arm/boot/dts/ls1021a-twr.dts                  |   9 +-
 arch/arm/boot/dts/ls1021a.dtsi                     |  11 +-
 arch/arm/boot/dts/stm32h743i-eval.dts              |   1 +
 arch/arm/boot/dts/sun8i-h3-beelink-x2.dts          |   4 +
 arch/arm/common/mcpm_entry.c                       |   2 +-
 arch/arm/include/asm/suspend.h                     |   1 +
 arch/arm/kernel/hyp-stub.S                         |   4 +-
 arch/arm/kernel/sleep.S                            |  12 ++
 arch/arm/mach-omap2/omap_hwmod.c                   |   2 +-
 arch/arm/mach-rpc/irq.c                            |   3 +-
 arch/arm/plat-pxa/ssp.c                            |   6 -
 arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi      |   3 +-
 .../dts/amlogic/meson-gxl-s905x-libretech-cc.dts   |   1 -
 arch/arm64/boot/dts/arm/juno-clocks.dtsi           |   4 +-
 arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi          |   2 +
 arch/m68k/amiga/cia.c                              |   9 ++
 arch/m68k/atari/ataints.c                          |   4 +-
 arch/m68k/atari/time.c                             |  15 ++-
 arch/m68k/bvme6000/config.c                        |  20 +--
 arch/m68k/hp300/time.c                             |  10 +-
 arch/m68k/mac/via.c                                | 119 ++++++++++-------
 arch/m68k/mvme147/config.c                         |  18 +--
 arch/m68k/mvme16x/config.c                         |  21 +--
 arch/m68k/q40/q40ints.c                            |  19 +--
 arch/m68k/sun3/sun3ints.c                          |   3 +
 arch/m68k/sun3x/time.c                             |  16 ++-
 arch/mips/bcm63xx/Makefile                         |   6 +-
 arch/mips/bcm63xx/boards/board_bcm963xx.c          |  20 ---
 arch/mips/bcm63xx/dev-dsp.c                        |  56 --------
 arch/mips/include/asm/io.h                         |  14 +-
 .../include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h     |  14 --
 .../mips/include/asm/mach-bcm63xx/board_bcm963xx.h |   5 -
 arch/mips/kernel/setup.c                           |   2 +-
 arch/nios2/kernel/nios2_ksyms.c                    |  12 ++
 arch/powerpc/Makefile                              |   2 +
 arch/powerpc/include/asm/archrandom.h              |   2 +-
 arch/powerpc/include/asm/kgdb.h                    |   5 +-
 arch/powerpc/kernel/cacheinfo.c                    |  21 +++
 arch/powerpc/kernel/cacheinfo.h                    |   4 +
 arch/powerpc/kernel/dt_cpu_ftrs.c                  |  17 +--
 arch/powerpc/kernel/kgdb.c                         |  43 ++++--
 arch/powerpc/kvm/book3s_64_vio.c                   |   1 -
 arch/powerpc/mm/dump_hashpagetable.c               |   2 +-
 arch/powerpc/platforms/pseries/mobility.c          |  10 ++
 arch/x86/Kconfig.debug                             |   2 +-
 arch/x86/kernel/kgdb.c                             |   2 +-
 arch/x86/mm/tlb.c                                  |   3 -
 block/blk-merge.c                                  |   8 +-
 crypto/pcrypt.c                                    |   2 +-
 crypto/tgr192.c                                    |   6 +-
 drivers/ata/libahci.c                              |   1 -
 drivers/base/core.c                                |  20 ++-
 drivers/base/power/wakeup.c                        |   2 +-
 drivers/bcma/driver_pci.c                          |   4 +-
 drivers/block/drbd/drbd_main.c                     |   2 +
 drivers/clk/clk-highbank.c                         |   1 +
 drivers/clk/clk-qoriq.c                            |   1 +
 drivers/clk/imx/clk-imx6q.c                        |   1 +
 drivers/clk/imx/clk-imx6sx.c                       |   1 +
 drivers/clk/imx/clk-imx7d.c                        |   1 +
 drivers/clk/imx/clk-vf610.c                        |   1 +
 drivers/clk/mvebu/armada-370.c                     |   4 +-
 drivers/clk/mvebu/armada-xp.c                      |   4 +-
 drivers/clk/mvebu/dove.c                           |   8 +-
 drivers/clk/mvebu/kirkwood.c                       |   2 +
 drivers/clk/mvebu/mv98dx3236.c                     |   4 +-
 drivers/clk/qcom/gcc-msm8996.c                     |  36 -----
 drivers/clk/samsung/clk-exynos4.c                  |   1 +
 drivers/clk/socfpga/clk-pll-a10.c                  |   1 +
 drivers/clk/socfpga/clk-pll.c                      |   1 +
 drivers/clk/sunxi-ng/ccu-sun8i-a23.c               |   2 +-
 drivers/clk/sunxi-ng/ccu-sun8i-v3s.c               |  19 ++-
 drivers/clk/sunxi-ng/ccu-sun8i-v3s.h               |   6 +-
 drivers/clocksource/exynos_mct.c                   |  14 +-
 drivers/clocksource/timer-sun5i.c                  |  10 ++
 drivers/cpufreq/brcmstb-avs-cpufreq.c              |  12 +-
 drivers/crypto/amcc/crypto4xx_trng.h               |   4 +-
 drivers/crypto/bcm/cipher.c                        |   6 +-
 drivers/crypto/caam/caamrng.c                      |   5 +-
 drivers/crypto/caam/error.c                        |   2 +-
 drivers/crypto/ccp/ccp-crypto-aes.c                |   8 +-
 drivers/crypto/ccp/ccp-ops.c                       |  67 +++++-----
 drivers/crypto/sunxi-ss/sun4i-ss-hash.c            |  21 +--
 drivers/dma/dma-axi-dmac.c                         |   2 +-
 drivers/dma/dw/platform.c                          |  14 +-
 drivers/dma/edma.c                                 |   6 +-
 drivers/dma/hsu/hsu.c                              |   4 +-
 drivers/dma/imx-sdma.c                             |   8 ++
 drivers/dma/mv_xor.c                               |   2 +-
 drivers/dma/tegra210-adma.c                        |  72 ++++++++--
 drivers/edac/edac_mc.c                             |  12 +-
 drivers/gpu/drm/drm_dp_mst_topology.c              |  15 ++-
 drivers/gpu/drm/etnaviv/etnaviv_dump.c             |   2 +-
 drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c        |   2 +-
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c  |   1 -
 drivers/gpu/drm/msm/adreno/a3xx_gpu.c              |  24 ++--
 drivers/gpu/drm/msm/dsi/dsi_host.c                 |   6 +-
 drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c            |   2 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c     |   2 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c     |   4 +-
 drivers/gpu/drm/radeon/cik.c                       |   4 +-
 drivers/gpu/drm/radeon/r600.c                      |   4 +-
 drivers/gpu/drm/radeon/si.c                        |   4 +-
 drivers/gpu/drm/shmobile/shmob_drm_drv.c           |   4 +-
 drivers/gpu/drm/sti/sti_hda.c                      |   1 -
 drivers/gpu/drm/sti/sti_hdmi.c                     |   1 -
 drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c        |   2 +-
 drivers/gpu/drm/virtio/virtgpu_vq.c                |   5 +-
 drivers/hwmon/lm75.c                               |   2 +-
 drivers/hwmon/pmbus/tps53679.c                     |   9 +-
 drivers/hwmon/shtc1.c                              |   2 +-
 drivers/hwmon/w83627hf.c                           |  42 +++++-
 drivers/iio/dac/ad5380.c                           |   2 +-
 drivers/infiniband/core/cma.c                      |   2 +-
 drivers/infiniband/hw/cxgb4/cm.c                   |  24 ++--
 drivers/infiniband/hw/hfi1/chip.c                  |  26 +++-
 drivers/infiniband/hw/hns/hns_roce_qp.c            |   1 -
 drivers/infiniband/hw/mlx5/qp.c                    |  21 +++
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c        |   2 +-
 drivers/infiniband/hw/qedr/verbs.c                 |  27 ++--
 drivers/infiniband/hw/usnic/usnic_ib_verbs.c       |   2 +-
 drivers/infiniband/sw/rxe/rxe_cq.c                 |   4 +-
 drivers/infiniband/sw/rxe/rxe_pool.c               |  26 ++--
 drivers/infiniband/sw/rxe/rxe_qp.c                 |   5 +-
 drivers/infiniband/ulp/iser/iscsi_iser.h           |   2 +-
 drivers/infiniband/ulp/iser/iser_memory.c          |  10 +-
 drivers/input/keyboard/nomadik-ske-keypad.c        |   2 +-
 drivers/iommu/amd_iommu.c                          |   2 +
 drivers/iommu/amd_iommu_init.c                     |   3 +
 drivers/iommu/intel-iommu.c                        |  39 +++---
 drivers/iommu/iommu.c                              |   6 +-
 drivers/iommu/mtk_iommu.c                          |  26 +++-
 drivers/leds/leds-tlc591xx.c                       |   7 +-
 drivers/lightnvm/pblk-rb.c                         |   2 +-
 drivers/media/i2c/ov2659.c                         |   2 +-
 drivers/media/pci/cx18/cx18-fileops.c              |   2 +-
 drivers/media/pci/cx23885/cx23885-dvb.c            |   5 +-
 drivers/media/pci/ivtv/ivtv-fileops.c              |   2 +-
 drivers/media/pci/tw5864/tw5864-video.c            |   4 +-
 drivers/media/platform/atmel/atmel-isi.c           |   2 +-
 drivers/media/platform/davinci/isif.c              |   9 --
 drivers/media/platform/davinci/vpbe.c              |   2 +-
 drivers/media/platform/omap/omap_vout.c            |  15 +--
 drivers/media/platform/s5p-jpeg/jpeg-core.c        |   2 +-
 drivers/media/platform/vivid/vivid-osd.c           |   2 +-
 drivers/media/radio/wl128x/fmdrv_common.c          |   5 +-
 drivers/mfd/intel-lpss-pci.c                       |  28 ++--
 drivers/mfd/intel-lpss.c                           |   1 +
 drivers/misc/mic/card/mic_x100.c                   |  28 ++--
 drivers/misc/sgi-xp/xpc_partition.c                |   2 +-
 drivers/mmc/core/host.c                            |   2 -
 drivers/mmc/core/quirks.h                          |   7 +
 drivers/mmc/host/sdhci-brcmstb.c                   |   4 +-
 drivers/net/dsa/qca8k.c                            |  12 ++
 drivers/net/dsa/qca8k.h                            |   1 +
 drivers/net/ethernet/amazon/ena/ena_com.c          |   3 +-
 drivers/net/ethernet/amazon/ena/ena_ethtool.c      |   4 +-
 drivers/net/ethernet/amazon/ena/ena_netdev.c       |   1 +
 drivers/net/ethernet/aquantia/atlantic/aq_vec.c    |  15 +--
 .../ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c  |   4 +-
 .../ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c  |   4 +-
 drivers/net/ethernet/broadcom/bcmsysport.c         |   2 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c  |  18 ++-
 drivers/net/ethernet/hisilicon/hix5hd2_gmac.c      |   2 +-
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h    |   2 +-
 drivers/net/ethernet/ibm/ehea/ehea_main.c          |   2 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c      |  16 ++-
 drivers/net/ethernet/mellanox/mlx5/core/qp.c       |   5 +-
 drivers/net/ethernet/mellanox/mlxsw/reg.h          |  22 +++-
 drivers/net/ethernet/natsemi/sonic.c               |   6 +-
 drivers/net/ethernet/pasemi/pasemi_mac.c           |   2 +-
 drivers/net/ethernet/qlogic/qed/qed_iwarp.c        |  16 ++-
 drivers/net/ethernet/qlogic/qed/qed_l2.c           |  34 +++--
 drivers/net/ethernet/qualcomm/qca_spi.c            |   9 +-
 drivers/net/ethernet/qualcomm/qca_spi.h            |   1 +
 drivers/net/ethernet/renesas/sh_eth.c              |   6 +-
 .../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c    |   2 +-
 .../net/ethernet/stmicro/stmmac/dwmac-meson8b.c    |   2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c  |   2 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c   |   2 +-
 drivers/net/ethernet/xilinx/xilinx_axienet_main.c  |   2 +-
 drivers/net/hyperv/netvsc_drv.c                    |  13 +-
 drivers/net/phy/fixed_phy.c                        |   6 +-
 drivers/net/phy/phy_device.c                       |  11 +-
 drivers/net/vxlan.c                                |   7 +-
 drivers/net/wireless/ath/ath10k/sdio.c             |  29 +++--
 drivers/net/wireless/ath/ath9k/dynack.c            |   8 +-
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c        |  12 +-
 drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c      |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c       |  19 ++-
 drivers/net/wireless/marvell/libertas_tf/cmd.c     |   2 +-
 drivers/net/wireless/mediatek/mt7601u/phy.c        |   2 +-
 drivers/ntb/hw/idt/ntb_hw_idt.c                    |   8 +-
 drivers/nvme/host/pci.c                            |   2 +-
 drivers/nvmem/imx-ocotp.c                          |   3 +-
 drivers/of/of_mdio.c                               |   2 +-
 drivers/pci/endpoint/functions/pci-epf-test.c      |   4 +-
 drivers/pci/host/pcie-iproc.c                      |   8 --
 drivers/pci/pci-driver.c                           |  17 ++-
 drivers/pci/switch/switchtec.c                     |   4 -
 drivers/pinctrl/bcm/pinctrl-iproc-gpio.c           |  96 +++++++++++---
 drivers/pinctrl/sh-pfc/pfc-emev2.c                 |  20 +++
 drivers/pinctrl/sh-pfc/pfc-r8a7740.c               |   3 +-
 drivers/pinctrl/sh-pfc/pfc-r8a7791.c               |   8 +-
 drivers/pinctrl/sh-pfc/pfc-r8a7792.c               |   1 +
 drivers/pinctrl/sh-pfc/pfc-r8a7794.c               |   2 +-
 drivers/pinctrl/sh-pfc/pfc-r8a77995.c              |   8 +-
 drivers/pinctrl/sh-pfc/pfc-sh7269.c                |   2 +-
 drivers/pinctrl/sh-pfc/pfc-sh73a0.c                |   4 +-
 drivers/pinctrl/sh-pfc/pfc-sh7734.c                |   4 +-
 drivers/platform/mips/cpu_hwmon.c                  |   2 +-
 drivers/platform/x86/alienware-wmi.c               |  19 ++-
 drivers/platform/x86/wmi.c                         |   3 +
 drivers/power/supply/power_supply_core.c           |  10 +-
 drivers/pwm/pwm-lpss.c                             |   6 +
 drivers/pwm/pwm-meson.c                            |   9 +-
 drivers/rapidio/rio_cm.c                           |   4 +-
 drivers/regulator/fixed.c                          |  11 +-
 drivers/regulator/lp87565-regulator.c              |   2 +-
 drivers/regulator/pv88060-regulator.c              |   2 +-
 drivers/regulator/pv88080-regulator.c              |   2 +-
 drivers/regulator/pv88090-regulator.c              |   2 +-
 drivers/regulator/tps65086-regulator.c             |   4 +-
 drivers/regulator/wm831x-dcdc.c                    |   4 +-
 drivers/rtc/rtc-88pm80x.c                          |  21 ++-
 drivers/rtc/rtc-88pm860x.c                         |  21 ++-
 drivers/rtc/rtc-ds1307.c                           |   7 +-
 drivers/rtc/rtc-ds1672.c                           |   3 +-
 drivers/rtc/rtc-mc146818-lib.c                     |   2 +-
 drivers/rtc/rtc-pcf2127.c                          |  32 ++---
 drivers/rtc/rtc-pcf8563.c                          |  13 +-
 drivers/rtc/rtc-pm8xxx.c                           |   6 +-
 drivers/scsi/fnic/fnic_isr.c                       |   4 +-
 drivers/scsi/libfc/fc_exch.c                       |   2 +-
 drivers/scsi/megaraid/megaraid_sas_base.c          |   4 +-
 drivers/scsi/qla2xxx/qla_os.c                      |  34 +++--
 drivers/scsi/qla2xxx/qla_target.c                  |  14 +-
 drivers/soc/fsl/qe/gpio.c                          |   4 +-
 drivers/spi/spi-bcm2835aux.c                       |  13 +-
 drivers/spi/spi-cadence.c                          |  11 +-
 drivers/spi/spi-fsl-spi.c                          |   2 +-
 drivers/spi/spi-tegra114.c                         | 145 +++++++++++++++------
 drivers/spi/spi-topcliff-pch.c                     |   6 +
 drivers/staging/comedi/drivers/ni_mio_common.c     |  24 +++-
 drivers/staging/greybus/light.c                    |  12 +-
 drivers/staging/most/aim-cdev/cdev.c               |   5 +-
 .../rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c  |   5 +-
 .../vc04_services/bcm2835-camera/bcm2835-camera.c  |   9 ++
 drivers/target/target_core_device.c                |   4 +-
 drivers/thermal/cpu_cooling.c                      |   2 +-
 drivers/thermal/mtk_thermal.c                      |   6 +-
 drivers/tty/ipwireless/hardware.c                  |   2 +
 drivers/tty/serial/fsl_lpuart.c                    |  28 ++--
 drivers/tty/serial/stm32-usart.c                   | 123 +++++++++--------
 drivers/tty/serial/stm32-usart.h                   |  10 +-
 drivers/uio/uio.c                                  |  10 +-
 drivers/usb/class/cdc-wdm.c                        |   2 +-
 drivers/usb/dwc2/gadget.c                          |   1 +
 drivers/usb/host/xhci-hub.c                        |   2 +-
 drivers/usb/phy/Kconfig                            |   2 +-
 drivers/usb/phy/phy-twl6030-usb.c                  |   2 +-
 drivers/vfio/mdev/mdev_core.c                      |  11 +-
 drivers/vfio/pci/vfio_pci.c                        |  19 ++-
 drivers/video/backlight/lm3630a_bl.c               |   4 +-
 drivers/video/fbdev/chipsfb.c                      |   3 +-
 drivers/xen/cpu_hotplug.c                          |   2 +-
 drivers/xen/pvcalls-back.c                         |   2 +-
 fs/affs/super.c                                    |   6 -
 fs/afs/super.c                                     |   1 +
 fs/afs/xattr.c                                     |   4 +-
 fs/btrfs/file.c                                    |   3 +-
 fs/btrfs/inode-map.c                               |  28 +++-
 fs/cifs/connect.c                                  |   3 +-
 fs/exportfs/expfs.c                                |   1 +
 fs/ext4/inline.c                                   |   2 +-
 fs/jfs/jfs_txnmgr.c                                |   3 +-
 fs/nfs/delegation.c                                |  20 +--
 fs/nfs/delegation.h                                |   1 +
 fs/nfs/flexfilelayout/flexfilelayout.h             |  32 +++--
 fs/nfs/pnfs.c                                      |  33 +++--
 fs/nfs/pnfs.h                                      |   1 +
 fs/nfs/super.c                                     |   2 +-
 fs/nfs/write.c                                     |   2 +-
 fs/xfs/xfs_quotaops.c                              |   3 +
 include/linux/device.h                             |   3 +-
 include/linux/irqchip/arm-gic-v3.h                 |  12 +-
 include/linux/mlx5/mlx5_ifc.h                      |   2 -
 include/linux/mmc/sdio_ids.h                       |   2 +
 include/linux/pci.h                                |   1 +
 include/linux/platform_data/dma-imx-sdma.h         |   3 +
 include/linux/signal.h                             |  15 ++-
 include/media/davinci/vpbe.h                       |   2 +-
 include/net/request_sock.h                         |   4 +-
 include/net/tcp.h                                  |   2 +-
 kernel/debug/kdb/kdb_main.c                        |   2 +-
 kernel/events/core.c                               |   3 +
 kernel/irq/irqdomain.c                             |   1 +
 kernel/signal.c                                    |   5 +
 lib/devres.c                                       |   3 +-
 lib/kfifo.c                                        |   3 +-
 net/6lowpan/nhc.c                                  |   2 +-
 net/bridge/netfilter/ebtables.c                    |   4 +-
 net/core/neighbour.c                               |   4 +-
 net/core/sock.c                                    |   4 +-
 net/ieee802154/6lowpan/reassembly.c                |   2 +-
 net/ipv4/inet_connection_sock.c                    |   2 +-
 net/ipv4/tcp.c                                     |   4 +-
 net/ipv6/reassembly.c                              |   2 +-
 net/iucv/af_iucv.c                                 |  27 +++-
 net/l2tp/l2tp_core.c                               |   3 +-
 net/llc/af_llc.c                                   |  34 +++--
 net/llc/llc_conn.c                                 |  35 ++---
 net/llc/llc_if.c                                   |  12 +-
 net/mac80211/rc80211_minstrel_ht.c                 |   2 +-
 net/mac80211/rx.c                                  |  11 +-
 net/mpls/mpls_iptunnel.c                           |   2 +-
 net/netfilter/nft_set_hash.c                       |  23 +++-
 net/packet/af_packet.c                             |  25 +++-
 net/rds/ib_stats.c                                 |   2 +-
 net/rds/stats.c                                    |   2 +
 net/rxrpc/output.c                                 |   3 +
 net/sched/act_mirred.c                             |   6 +-
 net/sched/sch_netem.c                              |  18 ++-
 net/tipc/link.c                                    |  29 +++--
 net/tipc/node.c                                    |   7 +-
 net/tipc/socket.c                                  |   2 +-
 net/tipc/sysctl.c                                  |   8 +-
 security/apparmor/include/context.h                |   2 +
 security/apparmor/lsm.c                            |   4 +-
 security/keys/key.c                                |   1 +
 sound/aoa/codecs/onyx.c                            |   4 +-
 sound/pci/hda/hda_controller.h                     |   9 +-
 sound/soc/codecs/cs4349.c                          |   1 +
 sound/soc/codecs/es8328.c                          |   2 +-
 sound/soc/codecs/wm8737.c                          |   2 +-
 sound/soc/davinci/davinci-mcasp.c                  |  13 +-
 sound/soc/fsl/imx-sgtl5000.c                       |   3 +-
 sound/soc/qcom/apq8016_sbc.c                       |  21 ++-
 sound/soc/soc-pcm.c                                |   4 +-
 sound/soc/sunxi/sun4i-i2s.c                        |   4 +-
 sound/usb/mixer.c                                  |   4 +-
 sound/usb/quirks-table.h                           |   9 +-
 tools/testing/selftests/ipc/msgque.c               |  11 +-
 346 files changed, 2015 insertions(+), 1275 deletions(-)



^ permalink raw reply	[flat|nested] 352+ messages in thread

* [PATCH 4.14 001/343] xfs: Sanity check flags of Q_XQUOTARM call
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 002/343] mfd: intel-lpss: Add default I2C device properties for Gemini Lake Greg Kroah-Hartman
                   ` (346 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yang Xu, Jan Kara, Eric Sandeen,
	Darrick J. Wong

From: Jan Kara <jack@suse.cz>

commit 3dd4d40b420846dd35869ccc8f8627feef2cff32 upstream.

Flags passed to Q_XQUOTARM were not sanity checked for invalid values.
Fix that.

Fixes: 9da93f9b7cdf ("xfs: fix Q_XQUOTARM ioctl")
Reported-by: Yang Xu <xuyang2018.jy@cn.fujitsu.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/xfs/xfs_quotaops.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/xfs/xfs_quotaops.c
+++ b/fs/xfs/xfs_quotaops.c
@@ -214,6 +214,9 @@ xfs_fs_rm_xquota(
 	if (XFS_IS_QUOTA_ON(mp))
 		return -EINVAL;
 
+	if (uflags & ~(FS_USER_QUOTA | FS_GROUP_QUOTA | FS_PROJ_QUOTA))
+		return -EINVAL;
+
 	if (uflags & FS_USER_QUOTA)
 		flags |= XFS_DQ_USER;
 	if (uflags & FS_GROUP_QUOTA)



^ permalink raw reply	[flat|nested] 352+ messages in thread

* [PATCH 4.14 002/343] mfd: intel-lpss: Add default I2C device properties for Gemini Lake
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.14 001/343] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 003/343] powerpc/archrandom: fix arch_get_random_seed_int() Greg Kroah-Hartman
                   ` (345 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Chiu, Jarkko Nikula,
	Andy Shevchenko, Lee Jones

From: Jarkko Nikula <jarkko.nikula@linux.intel.com>

commit 3f31bc67e4dc6a555341dffefe328ddd58e8b431 upstream.

It turned out Intel Gemini Lake doesn't use the same I2C timing
parameters as Broxton.

I got confirmation from the Windows team that Gemini Lake systems should
use updated timing parameters that differ from those used in Broxton
based systems.

Fixes: f80e78aa11ad ("mfd: intel-lpss: Add Intel Gemini Lake PCI IDs")
Tested-by: Chris Chiu <chiu@endlessm.com>
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mfd/intel-lpss-pci.c |   28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

--- a/drivers/mfd/intel-lpss-pci.c
+++ b/drivers/mfd/intel-lpss-pci.c
@@ -126,6 +126,18 @@ static const struct intel_lpss_platform_
 	.properties = apl_i2c_properties,
 };
 
+static struct property_entry glk_i2c_properties[] = {
+	PROPERTY_ENTRY_U32("i2c-sda-hold-time-ns", 313),
+	PROPERTY_ENTRY_U32("i2c-sda-falling-time-ns", 171),
+	PROPERTY_ENTRY_U32("i2c-scl-falling-time-ns", 290),
+	{ },
+};
+
+static const struct intel_lpss_platform_info glk_i2c_info = {
+	.clk_rate = 133000000,
+	.properties = glk_i2c_properties,
+};
+
 static const struct intel_lpss_platform_info cnl_i2c_info = {
 	.clk_rate = 216000000,
 	.properties = spt_i2c_properties,
@@ -165,14 +177,14 @@ static const struct pci_device_id intel_
 	{ PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info },
 	{ PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info },
 	/* GLK */
-	{ PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31b0), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31b2), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31b4), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31b6), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31b8), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31ba), (kernel_ulong_t)&bxt_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31b0), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31b2), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31b4), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31b6), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31b8), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31ba), (kernel_ulong_t)&glk_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x31bc), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x31be), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x31c0), (kernel_ulong_t)&bxt_uart_info },



^ permalink raw reply	[flat|nested] 352+ messages in thread

* [PATCH 4.14 003/343] powerpc/archrandom: fix arch_get_random_seed_int()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.14 001/343] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 002/343] mfd: intel-lpss: Add default I2C device properties for Gemini Lake Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 004/343] tipc: fix wrong timeout input for tipc_wait_for_cond() Greg Kroah-Hartman
                   ` (344 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Michael Ellerman

From: Ard Biesheuvel <ardb@kernel.org>

commit b6afd1234cf93aa0d71b4be4788c47534905f0be upstream.

Commit 01c9348c7620ec65

  powerpc: Use hardware RNG for arch_get_random_seed_* not arch_get_random_*

updated arch_get_random_[int|long]() to be NOPs, and moved the hardware
RNG backing to arch_get_random_seed_[int|long]() instead. However, it
failed to take into account that arch_get_random_int() was implemented
in terms of arch_get_random_long(), and so we ended up with a version
of the former that is essentially a NOP as well.

Fix this by calling arch_get_random_seed_long() from
arch_get_random_seed_int() instead.

Fixes: 01c9348c7620ec65 ("powerpc: Use hardware RNG for arch_get_random_seed_* not arch_get_random_*")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20191204115015.18015-1-ardb@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/archrandom.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/include/asm/archrandom.h
+++ b/arch/powerpc/include/asm/archrandom.h
@@ -28,7 +28,7 @@ static inline int arch_get_random_seed_i
 	unsigned long val;
 	int rc;
 
-	rc = arch_get_random_long(&val);
+	rc = arch_get_random_seed_long(&val);
 	if (rc)
 		*v = val;
 



^ permalink raw reply	[flat|nested] 352+ messages in thread

* [PATCH 4.14 004/343] tipc: fix wrong timeout input for tipc_wait_for_cond()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 003/343] powerpc/archrandom: fix arch_get_random_seed_int() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 005/343] mt7601u: fix bbp version check in mt7601u_wait_bbp_ready Greg Kroah-Hartman
                   ` (343 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tung Nguyen, Jon Maloy, David S. Miller

From: Tung Nguyen <tung.q.nguyen@dektech.com.au>

commit 12db3c8083fcab4270866a88191933f2d9f24f89 upstream.

In function __tipc_shutdown(), the timeout value passed to
tipc_wait_for_cond() is not jiffies.

This commit fixes it by converting that value from milliseconds
to jiffies.

Fixes: 365ad353c256 ("tipc: reduce risk of user starvation during link congestion")
Signed-off-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/tipc/socket.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -487,7 +487,7 @@ static void __tipc_shutdown(struct socke
 	struct sock *sk = sock->sk;
 	struct tipc_sock *tsk = tipc_sk(sk);
 	struct net *net = sock_net(sk);
-	long timeout = CONN_TIMEOUT_DEFAULT;
+	long timeout = msecs_to_jiffies(CONN_TIMEOUT_DEFAULT);
 	u32 dnode = tsk_peer_node(tsk);
 	struct sk_buff *skb;
 



^ permalink raw reply	[flat|nested] 352+ messages in thread

* [PATCH 4.14 005/343] mt7601u: fix bbp version check in mt7601u_wait_bbp_ready
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 004/343] tipc: fix wrong timeout input for tipc_wait_for_cond() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 006/343] crypto: sun4i-ss - fix big endian issues Greg Kroah-Hartman
                   ` (342 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Lorenzo Bianconi, Kalle Valo

From: Lorenzo Bianconi <lorenzo@kernel.org>

commit 15e14f76f85f4f0eab3b8146e1cd3c58ce272823 upstream.

Fix bbp ready check in mt7601u_wait_bbp_ready. The issue is reported by
coverity with the following error:

Logical vs. bitwise operator
The expression's value does not depend on the operands; inadvertent use
of the wrong operator is a likely logic error.

Addresses-Coverity-ID: 1309441 ("Logical vs. bitwise operator")
Fixes: c869f77d6abb ("add mt7601u driver")
Acked-by: Jakub Kicinski <kubakici@wp.pl>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mediatek/mt7601u/phy.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/mediatek/mt7601u/phy.c
+++ b/drivers/net/wireless/mediatek/mt7601u/phy.c
@@ -221,7 +221,7 @@ int mt7601u_wait_bbp_ready(struct mt7601
 
 	do {
 		val = mt7601u_bbp_rr(dev, MT_BBP_REG_VERSION);
-		if (val && ~val)
+		if (val && val != 0xff)
 			break;
 	} while (--i);
 



^ permalink raw reply	[flat|nested] 352+ messages in thread

* [PATCH 4.14 006/343] crypto: sun4i-ss - fix big endian issues
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 005/343] mt7601u: fix bbp version check in mt7601u_wait_bbp_ready Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 007/343] leds: tlc591xx: update the maximum brightness Greg Kroah-Hartman
                   ` (341 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Corentin Labbe, Herbert Xu

From: Corentin Labbe <clabbe.montjoie@gmail.com>

commit d1d787bcebfe122a5bd443ae565696661e2e9656 upstream.

When testing BigEndian kernel, the sun4i-ss was failling all crypto
tests.
This patch fix endian issues with it.

Fixes: 6298e948215f ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/crypto/sunxi-ss/sun4i-ss-hash.c |   21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

--- a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
+++ b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
@@ -179,7 +179,7 @@ static int sun4i_hash(struct ahash_reque
 	 */
 	unsigned int i = 0, end, fill, min_fill, nwait, nbw = 0, j = 0, todo;
 	unsigned int in_i = 0;
-	u32 spaces, rx_cnt = SS_RX_DEFAULT, bf[32] = {0}, wb = 0, v, ivmode = 0;
+	u32 spaces, rx_cnt = SS_RX_DEFAULT, bf[32] = {0}, v, ivmode = 0;
 	struct sun4i_req_ctx *op = ahash_request_ctx(areq);
 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
 	struct sun4i_tfm_ctx *tfmctx = crypto_ahash_ctx(tfm);
@@ -188,6 +188,7 @@ static int sun4i_hash(struct ahash_reque
 	struct sg_mapping_iter mi;
 	int in_r, err = 0;
 	size_t copied = 0;
+	__le32 wb = 0;
 
 	dev_dbg(ss->dev, "%s %s bc=%llu len=%u mode=%x wl=%u h0=%0x",
 		__func__, crypto_tfm_alg_name(areq->base.tfm),
@@ -399,7 +400,7 @@ hash_final:
 
 		nbw = op->len - 4 * nwait;
 		if (nbw) {
-			wb = *(u32 *)(op->buf + nwait * 4);
+			wb = cpu_to_le32(*(u32 *)(op->buf + nwait * 4));
 			wb &= GENMASK((nbw * 8) - 1, 0);
 
 			op->byte_count += nbw;
@@ -408,7 +409,7 @@ hash_final:
 
 	/* write the remaining bytes of the nbw buffer */
 	wb |= ((1 << 7) << (nbw * 8));
-	bf[j++] = wb;
+	bf[j++] = le32_to_cpu(wb);
 
 	/*
 	 * number of space to pad to obtain 64o minus 8(size) minus 4 (final 1)
@@ -427,13 +428,13 @@ hash_final:
 
 	/* write the length of data */
 	if (op->mode == SS_OP_SHA1) {
-		__be64 bits = cpu_to_be64(op->byte_count << 3);
-		bf[j++] = lower_32_bits(bits);
-		bf[j++] = upper_32_bits(bits);
+		__be64 *bits = (__be64 *)&bf[j];
+		*bits = cpu_to_be64(op->byte_count << 3);
+		j += 2;
 	} else {
-		__le64 bits = op->byte_count << 3;
-		bf[j++] = lower_32_bits(bits);
-		bf[j++] = upper_32_bits(bits);
+		__le64 *bits = (__le64 *)&bf[j];
+		*bits = cpu_to_le64(op->byte_count << 3);
+		j += 2;
 	}
 	writesl(ss->base + SS_RXFIFO, bf, j);
 
@@ -475,7 +476,7 @@ hash_final:
 		}
 	} else {
 		for (i = 0; i < 4; i++) {
-			v = readl(ss->base + SS_MD0 + i * 4);
+			v = cpu_to_le32(readl(ss->base + SS_MD0 + i * 4));
 			memcpy(areq->result + i * 4, &v, 4);
 		}
 	}



^ permalink raw reply	[flat|nested] 352+ messages in thread

* [PATCH 4.14 007/343] leds: tlc591xx: update the maximum brightness
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 006/343] crypto: sun4i-ss - fix big endian issues Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 008/343] drm/sti: do not remove the drm_bridge that was never added Greg Kroah-Hartman
                   ` (340 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jean-Jacques Hiblot, Pavel Machek

From: Jean-Jacques Hiblot <jjhiblot@ti.com>

commit a2cafdfd8cf5ad8adda6c0ce44a59f46431edf02 upstream.

The TLC chips actually offer 257 levels:
- 0: led OFF
- 1-255: Led dimmed is using a PWM. The duty cycle range from 0.4% to 99.6%
- 256: led fully ON

Fixes: e370d010a5fe ("leds: tlc591xx: Driver for the TI 8/16 Channel i2c LED driver")
Signed-off-by: Jean-Jacques Hiblot <jjhiblot@ti.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/leds/leds-tlc591xx.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/leds/leds-tlc591xx.c
+++ b/drivers/leds/leds-tlc591xx.c
@@ -16,6 +16,7 @@
 #include <linux/slab.h>
 
 #define TLC591XX_MAX_LEDS	16
+#define TLC591XX_MAX_BRIGHTNESS	256
 
 #define TLC591XX_REG_MODE1	0x00
 #define MODE1_RESPON_ADDR_MASK	0xF0
@@ -115,11 +116,11 @@ tlc591xx_brightness_set(struct led_class
 	struct tlc591xx_priv *priv = led->priv;
 	int err;
 
-	switch (brightness) {
+	switch ((int)brightness) {
 	case 0:
 		err = tlc591xx_set_ledout(priv, led, LEDOUT_OFF);
 		break;
-	case LED_FULL:
+	case TLC591XX_MAX_BRIGHTNESS:
 		err = tlc591xx_set_ledout(priv, led, LEDOUT_ON);
 		break;
 	default:
@@ -160,7 +161,7 @@ tlc591xx_configure(struct device *dev,
 		led->priv = priv;
 		led->led_no = i;
 		led->ldev.brightness_set_blocking = tlc591xx_brightness_set;
-		led->ldev.max_brightness = LED_FULL;
+		led->ldev.max_brightness = TLC591XX_MAX_BRIGHTNESS;
 		err = led_classdev_register(dev, &led->ldev);
 		if (err < 0) {
 			dev_err(dev, "couldn't register LED %s\n",



^ permalink raw reply	[flat|nested] 352+ messages in thread

* [PATCH 4.14 008/343] drm/sti: do not remove the drm_bridge that was never added
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 007/343] leds: tlc591xx: update the maximum brightness Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 009/343] drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() Greg Kroah-Hartman
                   ` (339 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Vetter, Peter Rosin,
	Benjamin Gaignard, Sasha Levin

From: Peter Rosin <peda@axentia.se>

[ Upstream commit 66e31a72dc38543b2d9d1ce267dc78ba9beebcfd ]

Removing the drm_bridge_remove call should avoid a NULL dereference
during list processing in drm_bridge_remove if the error path is ever
taken.

The more natural approach would perhaps be to add a drm_bridge_add,
but there are several other bridges that never call drm_bridge_add.
Just removing the drm_bridge_remove is the easier fix.

Fixes: 84601dbdea36 ("drm: sti: rework init sequence")
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20180806061910.29914-2-peda@axentia.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/sti/sti_hda.c  | 1 -
 drivers/gpu/drm/sti/sti_hdmi.c | 1 -
 2 files changed, 2 deletions(-)

diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c
index cf65e32b5090a..0399bb18d3872 100644
--- a/drivers/gpu/drm/sti/sti_hda.c
+++ b/drivers/gpu/drm/sti/sti_hda.c
@@ -721,7 +721,6 @@ static int sti_hda_bind(struct device *dev, struct device *master, void *data)
 	return 0;
 
 err_sysfs:
-	drm_bridge_remove(bridge);
 	return -EINVAL;
 }
 
diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c
index 30f02d2fdd034..bbb195a92e93f 100644
--- a/drivers/gpu/drm/sti/sti_hdmi.c
+++ b/drivers/gpu/drm/sti/sti_hdmi.c
@@ -1314,7 +1314,6 @@ static int sti_hdmi_bind(struct device *dev, struct device *master, void *data)
 	return 0;
 
 err_sysfs:
-	drm_bridge_remove(bridge);
 	hdmi->drm_connector = NULL;
 	return -EINVAL;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 009/343] drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 008/343] drm/sti: do not remove the drm_bridge that was never added Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 010/343] ALSA: hda: fix unused variable warning Greg Kroah-Hartman
                   ` (338 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Gerd Hoffmann, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 09c4b49457434fa74749ad6194ef28464d9f5df9 ]

This doesn't affect runtime because in the current code "idx" is always
valid.

First, we read from "vgdev->capsets[idx].max_size" before checking
whether "idx" is within bounds.  And secondly the bounds check is off by
one so we could end up reading one element beyond the end of the
vgdev->capsets[] array.

Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20180704094250.m7sgvvzg3dhcvv3h@kili.mountain
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/virtio/virtgpu_vq.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 21c2de81f3e32..a3be65e689fd2 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -648,11 +648,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
 {
 	struct virtio_gpu_get_capset *cmd_p;
 	struct virtio_gpu_vbuffer *vbuf;
-	int max_size = vgdev->capsets[idx].max_size;
+	int max_size;
 	struct virtio_gpu_drv_cap_cache *cache_ent;
 	void *resp_buf;
 
-	if (idx > vgdev->num_capsets)
+	if (idx >= vgdev->num_capsets)
 		return -EINVAL;
 
 	if (version > vgdev->capsets[idx].max_version)
@@ -662,6 +662,7 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
 	if (!cache_ent)
 		return -ENOMEM;
 
+	max_size = vgdev->capsets[idx].max_size;
 	cache_ent->caps_cache = kmalloc(max_size, GFP_KERNEL);
 	if (!cache_ent->caps_cache) {
 		kfree(cache_ent);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 010/343] ALSA: hda: fix unused variable warning
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 009/343] drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 011/343] apparmor: dont try to replace stale label in ptrace access check Greg Kroah-Hartman
                   ` (337 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anders Roxell, Takashi Iwai, Sasha Levin

From: Anders Roxell <anders.roxell@linaro.org>

[ Upstream commit 5b03006d5c58ddd31caf542eef4d0269bcf265b3 ]

When CONFIG_X86=n function azx_snoop doesn't use the variable chip it
only returns true.

sound/pci/hda/hda_intel.c: In function ‘dma_alloc_pages’:
sound/pci/hda/hda_intel.c:2002:14: warning: unused variable ‘chip’ [-Wunused-variable]
  struct azx *chip = bus_to_azx(bus);
              ^~~~

Create a inline function of azx_snoop.

Fixes: a41d122449be ("ALSA: hda - Embed bus into controller object")
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/hda_controller.h | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
index 8a9dd4767b1ec..63cc10604afc7 100644
--- a/sound/pci/hda/hda_controller.h
+++ b/sound/pci/hda/hda_controller.h
@@ -176,11 +176,10 @@ struct azx {
 #define azx_bus(chip)	(&(chip)->bus.core)
 #define bus_to_azx(_bus)	container_of(_bus, struct azx, bus.core)
 
-#ifdef CONFIG_X86
-#define azx_snoop(chip)		((chip)->snoop)
-#else
-#define azx_snoop(chip)		true
-#endif
+static inline bool azx_snoop(struct azx *chip)
+{
+	return !IS_ENABLED(CONFIG_X86) || chip->snoop;
+}
 
 /*
  * macros for easy use
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 011/343] apparmor: dont try to replace stale label in ptrace access check
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 010/343] ALSA: hda: fix unused variable warning Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 012/343] PCI: iproc: Remove PAXC slot check to allow VF support Greg Kroah-Hartman
                   ` (336 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jann Horn, John Johansen, Sasha Levin

From: Jann Horn <jannh@google.com>

[ Upstream commit 1f8266ff58840d698a1e96d2274189de1bdf7969 ]

As a comment above begin_current_label_crit_section() explains,
begin_current_label_crit_section() must run in sleepable context because
when label_is_stale() is true, aa_replace_current_label() runs, which uses
prepare_creds(), which can sleep.
Until now, the ptrace access check (which runs with a task lock held)
violated this rule.

Also add a might_sleep() assertion to begin_current_label_crit_section(),
because asserts are less likely to be ignored than comments.

Fixes: b2d09ae449ced ("apparmor: move ptrace checks to using labels")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/include/context.h | 2 ++
 security/apparmor/lsm.c             | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/security/apparmor/include/context.h b/security/apparmor/include/context.h
index 6ae07e9aaa172..812cdec9dd3be 100644
--- a/security/apparmor/include/context.h
+++ b/security/apparmor/include/context.h
@@ -191,6 +191,8 @@ static inline struct aa_label *begin_current_label_crit_section(void)
 {
 	struct aa_label *label = aa_current_raw_label();
 
+	might_sleep();
+
 	if (label_is_stale(label)) {
 		label = aa_get_newest_label(label);
 		if (aa_replace_current_label(label) == 0)
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 1346ee5be04f1..4f08023101f3c 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -108,12 +108,12 @@ static int apparmor_ptrace_access_check(struct task_struct *child,
 	struct aa_label *tracer, *tracee;
 	int error;
 
-	tracer = begin_current_label_crit_section();
+	tracer = __begin_current_label_crit_section();
 	tracee = aa_get_task_label(child);
 	error = aa_may_ptrace(tracer, tracee,
 		  mode == PTRACE_MODE_READ ? AA_PTRACE_READ : AA_PTRACE_TRACE);
 	aa_put_label(tracee);
-	end_current_label_crit_section(tracer);
+	__end_current_label_crit_section(tracer);
 
 	return error;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 012/343] PCI: iproc: Remove PAXC slot check to allow VF support
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 011/343] apparmor: dont try to replace stale label in ptrace access check Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 013/343] drm/hisilicon: hibmc: Dont overwrite fb helper surface depth Greg Kroah-Hartman
                   ` (335 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jitendra Bhivare, Ray Jui,
	Lorenzo Pieralisi, Andy Gospodarek, Sasha Levin

From: Jitendra Bhivare <jitendra.bhivare@broadcom.com>

[ Upstream commit 4da6b4480766e5bc9c4d7bc14bf1d0939a1a5fa7 ]

Fix previous incorrect logic that limits PAXC slot number to zero only.
In order for SRIOV/VF to work, we need to allow the slot number to be
greater than zero.

Fixes: 46560388c476c ("PCI: iproc: Allow multiple devices except on PAXC")
Signed-off-by: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
Signed-off-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/host/pcie-iproc.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/drivers/pci/host/pcie-iproc.c b/drivers/pci/host/pcie-iproc.c
index c0ecc9f35667f..8f8dac0155d63 100644
--- a/drivers/pci/host/pcie-iproc.c
+++ b/drivers/pci/host/pcie-iproc.c
@@ -573,14 +573,6 @@ static void __iomem *iproc_pcie_map_cfg_bus(struct iproc_pcie *pcie,
 			return (pcie->base + offset);
 	}
 
-	/*
-	 * PAXC is connected to an internally emulated EP within the SoC.  It
-	 * allows only one device.
-	 */
-	if (pcie->ep_is_internal)
-		if (slot > 0)
-			return NULL;
-
 	return iproc_pcie_map_ep_cfg_reg(pcie, busno, slot, fn, where);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 013/343] drm/hisilicon: hibmc: Dont overwrite fb helper surface depth
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 012/343] PCI: iproc: Remove PAXC slot check to allow VF support Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 014/343] IB/rxe: replace kvfree with vfree Greg Kroah-Hartman
                   ` (334 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Garry, Xinliang Liu, Sasha Levin

From: John Garry <john.garry@huawei.com>

[ Upstream commit 0ff9f49646353ce31312411e7e7bd2281492a40e ]

Currently the driver overwrites the surface depth provided by the fb
helper to give an invalid bpp/surface depth combination.

This has been exposed by commit 70109354fed2 ("drm: Reject unknown legacy
bpp and depth for drm_mode_addfb ioctl"), which now causes the driver to
fail to probe.

Fix by not overwriting the surface depth.

Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer")
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
Signed-off-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
index 8bd29075ae4eb..edcca17615001 100644
--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
@@ -71,7 +71,6 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper,
 	DRM_DEBUG_DRIVER("surface width(%d), height(%d) and bpp(%d)\n",
 			 sizes->surface_width, sizes->surface_height,
 			 sizes->surface_bpp);
-	sizes->surface_depth = 32;
 
 	bytes_per_pixel = DIV_ROUND_UP(sizes->surface_bpp, 8);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 014/343] IB/rxe: replace kvfree with vfree
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 013/343] drm/hisilicon: hibmc: Dont overwrite fb helper surface depth Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 015/343] IB/hfi1: Add mtu check for operational data VLs Greg Kroah-Hartman
                   ` (333 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Zhu Yanjun,
	Jason Gunthorpe, Sasha Levin

From: Zhu Yanjun <yanjun.zhu@oracle.com>

[ Upstream commit 721ad7e643f7002efa398838693f90284ea216d1 ]

The buf is allocated by vmalloc_user in the function rxe_queue_init.
So it is better to free it by vfree.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_cq.c | 4 ++--
 drivers/infiniband/sw/rxe/rxe_qp.c | 5 +++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
index c4aabf78dc90f..f6e036ded046e 100644
--- a/drivers/infiniband/sw/rxe/rxe_cq.c
+++ b/drivers/infiniband/sw/rxe/rxe_cq.c
@@ -30,7 +30,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  */
-
+#include <linux/vmalloc.h>
 #include "rxe.h"
 #include "rxe_loc.h"
 #include "rxe_queue.h"
@@ -97,7 +97,7 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
 	err = do_mmap_info(rxe, udata, false, context, cq->queue->buf,
 			   cq->queue->buf_size, &cq->queue->ip);
 	if (err) {
-		kvfree(cq->queue->buf);
+		vfree(cq->queue->buf);
 		kfree(cq->queue);
 		return err;
 	}
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
index aeea994b04c43..25055a68a2c07 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -34,6 +34,7 @@
 #include <linux/skbuff.h>
 #include <linux/delay.h>
 #include <linux/sched.h>
+#include <linux/vmalloc.h>
 
 #include "rxe.h"
 #include "rxe_loc.h"
@@ -255,7 +256,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
 			   qp->sq.queue->buf_size, &qp->sq.queue->ip);
 
 	if (err) {
-		kvfree(qp->sq.queue->buf);
+		vfree(qp->sq.queue->buf);
 		kfree(qp->sq.queue);
 		return err;
 	}
@@ -308,7 +309,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
 				   qp->rq.queue->buf_size,
 				   &qp->rq.queue->ip);
 		if (err) {
-			kvfree(qp->rq.queue->buf);
+			vfree(qp->rq.queue->buf);
 			kfree(qp->rq.queue);
 			return err;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 015/343] IB/hfi1: Add mtu check for operational data VLs
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 014/343] IB/rxe: replace kvfree with vfree Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 016/343] regulator: fixed: Default enable high on DT regulators Greg Kroah-Hartman
                   ` (332 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mike Marciniszyn, Michael J. Ruhl,
	Alex Estrin, Dennis Dalessandro, Jason Gunthorpe, Sasha Levin

From: Alex Estrin <alex.estrin@intel.com>

[ Upstream commit eb50130964e8c1379f37c3d3bab33a411ec62e98 ]

Since Virtual Lanes BCT credits and MTU are set through separate MADs, we
have to ensure both are valid, and data VLs are ready for transmission
before we allow port transition to Armed state.

Fixes: 5e2d6764a729 ("IB/hfi1: Verify port data VLs credits on transition to Armed")
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Alex Estrin <alex.estrin@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hfi1/chip.c | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 9f78bb07744c7..4a0b7c0034771 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -10552,12 +10552,29 @@ void set_link_down_reason(struct hfi1_pportdata *ppd, u8 lcl_reason,
 	}
 }
 
-/*
- * Verify if BCT for data VLs is non-zero.
+/**
+ * data_vls_operational() - Verify if data VL BCT credits and MTU
+ *			    are both set.
+ * @ppd: pointer to hfi1_pportdata structure
+ *
+ * Return: true - Ok, false -otherwise.
  */
 static inline bool data_vls_operational(struct hfi1_pportdata *ppd)
 {
-	return !!ppd->actual_vls_operational;
+	int i;
+	u64 reg;
+
+	if (!ppd->actual_vls_operational)
+		return false;
+
+	for (i = 0; i < ppd->vls_supported; i++) {
+		reg = read_csr(ppd->dd, SEND_CM_CREDIT_VL + (8 * i));
+		if ((reg && !ppd->dd->vld[i].mtu) ||
+		    (!reg && ppd->dd->vld[i].mtu))
+			return false;
+	}
+
+	return true;
 }
 
 /*
@@ -10662,7 +10679,8 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state)
 
 		if (!data_vls_operational(ppd)) {
 			dd_dev_err(dd,
-				   "%s: data VLs not operational\n", __func__);
+				   "%s: Invalid data VL credits or mtu\n",
+				   __func__);
 			ret = -EINVAL;
 			break;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 016/343] regulator: fixed: Default enable high on DT regulators
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 015/343] IB/hfi1: Add mtu check for operational data VLs Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24 13:46   ` Linus Walleij
  2020-01-24  9:27 ` [PATCH 4.14 017/343] ALSA: usb-audio: update quirk for B&W PX to remove microphone Greg Kroah-Hartman
                   ` (331 subsequent siblings)
  347 siblings, 1 reply; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leonard Crestez, Fabio Estevam,
	John Stultz, Anders Roxell, Linus Walleij, Mark Brown,
	Sasha Levin

From: Linus Walleij <linus.walleij@linaro.org>

[ Upstream commit 28be5f15df2ee6882b0a122693159c96a28203c7 ]

commit efdfeb079cc3
("regulator: fixed: Convert to use GPIO descriptor only")
switched to use gpiod_get() to look up the regulator from the
gpiolib core whether that is device tree or boardfile.

This meant that we activate the code in
a603a2b8d86e ("gpio: of: Add special quirk to parse regulator flags")
which means the descriptors coming from the device tree already
have the right inversion and open drain semantics set up from
the gpiolib core.

As the fixed regulator was inspected again we got the
inverted inversion and things broke.

Fix it by ignoring the config in the device tree for now: the
later patches in the series will push all inversion handling
over to the gpiolib core and set it up properly in the
boardfiles for legacy devices, but I did not finish that
for this kernel cycle.

Fixes: commit efdfeb079cc3 ("regulator: fixed: Convert to use GPIO descriptor only")
Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
Reported-by: Fabio Estevam <festevam@gmail.com>
Reported-by: John Stultz <john.stultz@linaro.org>
Reported-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Tested-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/fixed.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
index 988a7472c2ab5..d68ff65a5adc9 100644
--- a/drivers/regulator/fixed.c
+++ b/drivers/regulator/fixed.c
@@ -84,9 +84,14 @@ of_get_fixed_voltage_config(struct device *dev,
 
 	of_property_read_u32(np, "startup-delay-us", &config->startup_delay);
 
-	config->enable_high = of_property_read_bool(np, "enable-active-high");
-	config->gpio_is_open_drain = of_property_read_bool(np,
-							   "gpio-open-drain");
+	/*
+	 * FIXME: we pulled active low/high and open drain handling into
+	 * gpiolib so it will be handled there. Delete this in the second
+	 * step when we also remove the custom inversion handling for all
+	 * legacy boardfiles.
+	 */
+	config->enable_high = 1;
+	config->gpio_is_open_drain = 0;
 
 	if (of_find_property(np, "vin-supply", NULL))
 		config->input_supply = "vin";
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 017/343] ALSA: usb-audio: update quirk for B&W PX to remove microphone
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 016/343] regulator: fixed: Default enable high on DT regulators Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 018/343] staging: comedi: ni_mio_common: protect register write overflow Greg Kroah-Hartman
                   ` (330 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Huaman, Takashi Iwai, Sasha Levin

From: Nicolas Huaman <nicolas@herochao.de>

[ Upstream commit c369c8db15d51fa175d2ba85928f79d16af6b562 ]

A quirk in snd-usb-audio was added to automate setting sample rate to
4800k and remove the previously exposed nonfunctional microphone for
the Bowers & Wilkins PX:
commit 240a8af929c7c57dcde28682725b29cf8474e8e5
https://lore.kernel.org/patchwork/patch/919689/

However the headphones where updated shortly after that to remove the
unintentional microphone functionality. I guess because of this the
headphones now crash when connecting them via USB while the quirk is
active. Dmesg:

snd-usb-audio: probe of 2-3:1.0 failed with error -22
usb 2-3: 2:1: cannot get min/max values for control 2 (id 2)

This patch removes the microfone and allows the headphones to connect
and work out of the box. It is based on the current mainline kernel
 and successfully applied an tested on my machine (4.18.10.arch1-1).

Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
Signed-off-by: Nicolas Huaman <nicolas@herochao.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/quirks-table.h | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index d32727c74a168..c892b4d1e733f 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3293,19 +3293,14 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
 				.ifnum = 0,
 				.type = QUIRK_AUDIO_STANDARD_MIXER,
 			},
-			/* Capture */
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE,
-			},
 			/* Playback */
 			{
-				.ifnum = 2,
+				.ifnum = 1,
 				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
 				.data = &(const struct audioformat) {
 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
 					.channels = 2,
-					.iface = 2,
+					.iface = 1,
 					.altsetting = 1,
 					.altset_idx = 1,
 					.attributes = UAC_EP_CS_ATTR_FILL_MAX |
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 018/343] staging: comedi: ni_mio_common: protect register write overflow
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 017/343] ALSA: usb-audio: update quirk for B&W PX to remove microphone Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 019/343] pwm: lpss: Release runtime-pm reference from the drivers remove callback Greg Kroah-Hartman
                   ` (329 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Spencer E. Olson, Ian Abbott, Sasha Levin

From: Spencer E. Olson <olsonse@umich.edu>

[ Upstream commit 1cbca5852d6c16e85a21487a15d211195aacd4a1 ]

Fixes two problems introduced as early as
commit 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code"):
(1) Ensures that the last four bits of NISTC_RTSI_TRIGB_OUT_REG register is
    not unduly overwritten on e-series devices.  On e-series devices, the
    first three of the last four bits are reserved.  The last bit defines
    the output selection of the RGOUT0 pin, otherwise known as
    RTSI_Sub_Selection.  For m-series devices, these last four bits are
    indeed used as the output selection of the RTSI7 pin (and the
    RTSI_Sub_Selection bit for the RGOUT0 pin is moved to the
    RTSI_Trig_Direction register.
(2) Allows all 4 RTSI_BRD lines to be treated as valid sources for RTSI
    lines.

This patch also cleans up the ni_get_rtsi_routing command for readability.

Fixes: 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code")
Signed-off-by: Spencer E. Olson <olsonse@umich.edu>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../staging/comedi/drivers/ni_mio_common.c    | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index 36361bdf934ac..2f82dcb1fd062 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -4991,7 +4991,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev,
 	case NI_RTSI_OUTPUT_G_SRC0:
 	case NI_RTSI_OUTPUT_G_GATE0:
 	case NI_RTSI_OUTPUT_RGOUT0:
-	case NI_RTSI_OUTPUT_RTSI_BRD_0:
+	case NI_RTSI_OUTPUT_RTSI_BRD(0):
+	case NI_RTSI_OUTPUT_RTSI_BRD(1):
+	case NI_RTSI_OUTPUT_RTSI_BRD(2):
+	case NI_RTSI_OUTPUT_RTSI_BRD(3):
 		return 1;
 	case NI_RTSI_OUTPUT_RTSI_OSC:
 		return (devpriv->is_m_series) ? 1 : 0;
@@ -5012,11 +5015,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev,
 		devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src);
 		ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg,
 			      NISTC_RTSI_TRIGA_OUT_REG);
-	} else if (chan < 8) {
+	} else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
 		devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan);
 		devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src);
 		ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg,
 			      NISTC_RTSI_TRIGB_OUT_REG);
+	} else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
+		/* probably should never reach this, since the
+		 * ni_valid_rtsi_output_source above errors out if chan is too
+		 * high
+		 */
+		dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
+		return -EINVAL;
 	}
 	return 2;
 }
@@ -5032,12 +5042,12 @@ static unsigned int ni_get_rtsi_routing(struct comedi_device *dev,
 	} else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
 		return NISTC_RTSI_TRIG_TO_SRC(chan,
 					      devpriv->rtsi_trig_b_output_reg);
-	} else {
-		if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN)
-			return NI_RTSI_OUTPUT_RTSI_OSC;
-		dev_err(dev->class_dev, "bug! should never get here?\n");
-		return 0;
+	} else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
+		return NI_RTSI_OUTPUT_RTSI_OSC;
 	}
+
+	dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
+	return -EINVAL;
 }
 
 static int ni_rtsi_insn_config(struct comedi_device *dev,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 019/343] pwm: lpss: Release runtime-pm reference from the drivers remove callback
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 018/343] staging: comedi: ni_mio_common: protect register write overflow Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 020/343] powerpc/kgdb: add kgdb_arch_set/remove_breakpoint() Greg Kroah-Hartman
                   ` (328 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Hans de Goede,
	Thierry Reding, Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit 42885551cedb45961879d2fc3dc3c4dc545cc23e ]

For each pwm output which gets enabled through pwm_lpss_apply(), we do a
pm_runtime_get_sync().

This commit adds pm_runtime_put() calls to pwm_lpss_remove() to balance
these when the driver gets removed with some of the outputs still enabled.

Fixes: f080be27d7d9 ("pwm: lpss: Add support for runtime PM")
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-lpss.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
index 1e69c1c9ec096..7a4a6406cf69a 100644
--- a/drivers/pwm/pwm-lpss.c
+++ b/drivers/pwm/pwm-lpss.c
@@ -216,6 +216,12 @@ EXPORT_SYMBOL_GPL(pwm_lpss_probe);
 
 int pwm_lpss_remove(struct pwm_lpss_chip *lpwm)
 {
+	int i;
+
+	for (i = 0; i < lpwm->info->npwm; i++) {
+		if (pwm_is_enabled(&lpwm->chip.pwms[i]))
+			pm_runtime_put(lpwm->chip.dev);
+	}
 	return pwmchip_remove(&lpwm->chip);
 }
 EXPORT_SYMBOL_GPL(pwm_lpss_remove);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 020/343] powerpc/kgdb: add kgdb_arch_set/remove_breakpoint()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 019/343] pwm: lpss: Release runtime-pm reference from the drivers remove callback Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 021/343] drm/sun4i: hdmi: Fix double flag assignation Greg Kroah-Hartman
                   ` (327 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman,
	Sasha Levin

From: Christophe Leroy <christophe.leroy@c-s.fr>

[ Upstream commit fb978ca207743badfe7efd9eebe68bcbb4969f79 ]

Generic implementation fails to remove breakpoints after init
when CONFIG_STRICT_KERNEL_RWX is selected:

[   13.251285] KGDB: BP remove failed: c001c338
[   13.259587] kgdbts: ERROR PUT: end of test buffer on 'do_fork_test' line 8 expected OK got $E14#aa
[   13.268969] KGDB: re-enter exception: ALL breakpoints killed
[   13.275099] CPU: 0 PID: 1 Comm: init Not tainted 4.18.0-g82bbb913ffd8 #860
[   13.282836] Call Trace:
[   13.285313] [c60e1ba0] [c0080ef0] kgdb_handle_exception+0x6f4/0x720 (unreliable)
[   13.292618] [c60e1c30] [c000e97c] kgdb_handle_breakpoint+0x3c/0x98
[   13.298709] [c60e1c40] [c000af54] program_check_exception+0x104/0x700
[   13.305083] [c60e1c60] [c000e45c] ret_from_except_full+0x0/0x4
[   13.310845] [c60e1d20] [c02a22ac] run_simple_test+0x2b4/0x2d4
[   13.316532] [c60e1d30] [c0081698] put_packet+0xb8/0x158
[   13.321694] [c60e1d60] [c00820b4] gdb_serial_stub+0x230/0xc4c
[   13.327374] [c60e1dc0] [c0080af8] kgdb_handle_exception+0x2fc/0x720
[   13.333573] [c60e1e50] [c000e928] kgdb_singlestep+0xb4/0xcc
[   13.339068] [c60e1e70] [c000ae1c] single_step_exception+0x90/0xac
[   13.345100] [c60e1e80] [c000e45c] ret_from_except_full+0x0/0x4
[   13.350865] [c60e1f40] [c000e11c] ret_from_syscall+0x0/0x38
[   13.356346] Kernel panic - not syncing: Recursive entry to debugger

This patch creates powerpc specific version of
kgdb_arch_set_breakpoint() and kgdb_arch_remove_breakpoint()
using patch_instruction()

Fixes: 1e0fc9d1eb2b ("powerpc/Kconfig: Enable STRICT_KERNEL_RWX for some configs")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/kgdb.h |  5 +++-
 arch/powerpc/kernel/kgdb.c      | 43 +++++++++++++++++++++++++++------
 2 files changed, 39 insertions(+), 9 deletions(-)

diff --git a/arch/powerpc/include/asm/kgdb.h b/arch/powerpc/include/asm/kgdb.h
index 9db24e77b9f4b..a9e098a3b881f 100644
--- a/arch/powerpc/include/asm/kgdb.h
+++ b/arch/powerpc/include/asm/kgdb.h
@@ -26,9 +26,12 @@
 #define BREAK_INSTR_SIZE	4
 #define BUFMAX			((NUMREGBYTES * 2) + 512)
 #define OUTBUFMAX		((NUMREGBYTES * 2) + 512)
+
+#define BREAK_INSTR		0x7d821008	/* twge r2, r2 */
+
 static inline void arch_kgdb_breakpoint(void)
 {
-	asm(".long 0x7d821008"); /* twge r2, r2 */
+	asm(stringify_in_c(.long BREAK_INSTR));
 }
 #define CACHE_FLUSH_IS_SAFE	1
 #define DBG_MAX_REG_NUM     70
diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c
index 35e240a0a4087..59c578f865aa6 100644
--- a/arch/powerpc/kernel/kgdb.c
+++ b/arch/powerpc/kernel/kgdb.c
@@ -24,6 +24,7 @@
 #include <asm/processor.h>
 #include <asm/machdep.h>
 #include <asm/debug.h>
+#include <asm/code-patching.h>
 #include <linux/slab.h>
 
 /*
@@ -144,7 +145,7 @@ static int kgdb_handle_breakpoint(struct pt_regs *regs)
 	if (kgdb_handle_exception(1, SIGTRAP, 0, regs) != 0)
 		return 0;
 
-	if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
+	if (*(u32 *)regs->nip == BREAK_INSTR)
 		regs->nip += BREAK_INSTR_SIZE;
 
 	return 1;
@@ -441,16 +442,42 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
 	return -1;
 }
 
+int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
+{
+	int err;
+	unsigned int instr;
+	unsigned int *addr = (unsigned int *)bpt->bpt_addr;
+
+	err = probe_kernel_address(addr, instr);
+	if (err)
+		return err;
+
+	err = patch_instruction(addr, BREAK_INSTR);
+	if (err)
+		return -EFAULT;
+
+	*(unsigned int *)bpt->saved_instr = instr;
+
+	return 0;
+}
+
+int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
+{
+	int err;
+	unsigned int instr = *(unsigned int *)bpt->saved_instr;
+	unsigned int *addr = (unsigned int *)bpt->bpt_addr;
+
+	err = patch_instruction(addr, instr);
+	if (err)
+		return -EFAULT;
+
+	return 0;
+}
+
 /*
  * Global data
  */
-struct kgdb_arch arch_kgdb_ops = {
-#ifdef __LITTLE_ENDIAN__
-	.gdb_bpt_instr = {0x08, 0x10, 0x82, 0x7d},
-#else
-	.gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
-#endif
-};
+struct kgdb_arch arch_kgdb_ops;
 
 static int kgdb_not_implemented(struct pt_regs *regs)
 {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 021/343] drm/sun4i: hdmi: Fix double flag assignation
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 020/343] powerpc/kgdb: add kgdb_arch_set/remove_breakpoint() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 022/343] mlxsw: reg: QEEC: Add minimum shaper fields Greg Kroah-Hartman
                   ` (326 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Maxime Ripard,
	Giulio Benetti, Sasha Levin

From: Maxime Ripard <maxime.ripard@bootlin.com>

[ Upstream commit 1e0ff648940e603cab6c52cf3723017d30d78f30 ]

The is_double flag is a boolean currently assigned to the value of the d
variable, that is either 1 or 2. It means that this is_double variable is
always set to true, even though the initial intent was to have it set to
true when d is 2.

Fix this.

Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Reviewed-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181021163446.29135-2-maxime.ripard@bootlin.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
index 5cf2527bffc86..d7a8fea945574 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
@@ -50,7 +50,7 @@ static unsigned long sun4i_tmds_calc_divider(unsigned long rate,
 			    (rate - tmp_rate) < (rate - best_rate)) {
 				best_rate = tmp_rate;
 				best_m = m;
-				is_double = d;
+				is_double = (d == 2) ? true : false;
 			}
 		}
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 022/343] mlxsw: reg: QEEC: Add minimum shaper fields
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 021/343] drm/sun4i: hdmi: Fix double flag assignation Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 023/343] NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks Greg Kroah-Hartman
                   ` (325 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Petr Machata, Ido Schimmel,
	David S. Miller, Sasha Levin

From: Petr Machata <petrm@mellanox.com>

[ Upstream commit 8b931821aa04823e2e5df0ae93937baabbd23286 ]

Add QEEC.mise (minimum shaper enable) and QEEC.min_shaper_rate to enable
configuration of minimum shaper.

Increase the QEEC length to 0x20 as well: that's the length that the
register has had for a long time now, but with the configurations that
mlxsw typically exercises, the firmware tolerated 0x1C-sized packets.
With mise=true however, FW rejects packets unless they have the full
required length.

Fixes: b9b7cee40579 ("mlxsw: reg: Add QoS ETS Element Configuration register")
Signed-off-by: Petr Machata <petrm@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlxsw/reg.h | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index 8ab7a4f98a07c..e7974ba064324 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -2452,7 +2452,7 @@ static inline void mlxsw_reg_qtct_pack(char *payload, u8 local_port,
  * Configures the ETS elements.
  */
 #define MLXSW_REG_QEEC_ID 0x400D
-#define MLXSW_REG_QEEC_LEN 0x1C
+#define MLXSW_REG_QEEC_LEN 0x20
 
 MLXSW_REG_DEFINE(qeec, MLXSW_REG_QEEC_ID, MLXSW_REG_QEEC_LEN);
 
@@ -2494,6 +2494,15 @@ MLXSW_ITEM32(reg, qeec, element_index, 0x04, 0, 8);
  */
 MLXSW_ITEM32(reg, qeec, next_element_index, 0x08, 0, 8);
 
+/* reg_qeec_mise
+ * Min shaper configuration enable. Enables configuration of the min
+ * shaper on this ETS element
+ * 0 - Disable
+ * 1 - Enable
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, qeec, mise, 0x0C, 31, 1);
+
 enum {
 	MLXSW_REG_QEEC_BYTES_MODE,
 	MLXSW_REG_QEEC_PACKETS_MODE,
@@ -2510,6 +2519,17 @@ enum {
  */
 MLXSW_ITEM32(reg, qeec, pb, 0x0C, 28, 1);
 
+/* The smallest permitted min shaper rate. */
+#define MLXSW_REG_QEEC_MIS_MIN	200000		/* Kbps */
+
+/* reg_qeec_min_shaper_rate
+ * Min shaper information rate.
+ * For CPU port, can only be configured for port hierarchy.
+ * When in bytes mode, value is specified in units of 1000bps.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, qeec, min_shaper_rate, 0x0C, 0, 28);
+
 /* reg_qeec_mase
  * Max shaper configuration enable. Enables configuration of the max
  * shaper on this ETS element.
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 023/343] NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 022/343] mlxsw: reg: QEEC: Add minimum shaper fields Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 024/343] pcrypt: use format specifier in kobject_add Greg Kroah-Hartman
                   ` (324 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gustavo A. R. Silva, Jon Mason, Sasha Levin

From: Gustavo A. R. Silva <gustavo@embeddedor.com>

[ Upstream commit 1b7619828d0c341612f58683e73f279c37e70bbc ]

Both devm_kcalloc() and devm_kzalloc() return NULL on error. They
never return error pointers.

The use of IS_ERR_OR_NULL is currently applied to the wrong
context.

Fix this by replacing IS_ERR_OR_NULL with regular NULL checks.

Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ntb/hw/idt/ntb_hw_idt.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
index d44d7ef38fe88..b68e2cad74cc7 100644
--- a/drivers/ntb/hw/idt/ntb_hw_idt.c
+++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
@@ -1105,9 +1105,9 @@ static struct idt_mw_cfg *idt_scan_mws(struct idt_ntb_dev *ndev, int port,
 	}
 
 	/* Allocate memory for memory window descriptors */
-	ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt,
-				sizeof(*ret_mws), GFP_KERNEL);
-	if (IS_ERR_OR_NULL(ret_mws))
+	ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt, sizeof(*ret_mws),
+			       GFP_KERNEL);
+	if (!ret_mws)
 		return ERR_PTR(-ENOMEM);
 
 	/* Copy the info of detected memory windows */
@@ -2393,7 +2393,7 @@ static struct idt_ntb_dev *idt_create_dev(struct pci_dev *pdev,
 
 	/* Allocate memory for the IDT PCIe-device descriptor */
 	ndev = devm_kzalloc(&pdev->dev, sizeof(*ndev), GFP_KERNEL);
-	if (IS_ERR_OR_NULL(ndev)) {
+	if (!ndev) {
 		dev_err(&pdev->dev, "Memory allocation failed for descriptor");
 		return ERR_PTR(-ENOMEM);
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 024/343] pcrypt: use format specifier in kobject_add
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 023/343] NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 025/343] exportfs: fix passing zero to ERR_PTR() warning Greg Kroah-Hartman
                   ` (323 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Herbert Xu, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit b1e3874c75ab15288f573b3532e507c37e8e7656 ]

Passing string 'name' as the format specifier is potentially hazardous
because name could (although very unlikely to) have a format specifier
embedded in it causing issues when parsing the non-existent arguments
to these.  Follow best practice by using the "%s" format string for
the string 'name'.

Cleans up clang warning:
crypto/pcrypt.c:397:40: warning: format string is not a string literal
(potentially insecure) [-Wformat-security]

Fixes: a3fb1e330dd2 ("pcrypt: Added sysfs interface to pcrypt")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/pcrypt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index f8ec3d4ba4a80..a5718c0a3dc4e 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -394,7 +394,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
 	int ret;
 
 	pinst->kobj.kset = pcrypt_kset;
-	ret = kobject_add(&pinst->kobj, NULL, name);
+	ret = kobject_add(&pinst->kobj, NULL, "%s", name);
 	if (!ret)
 		kobject_uevent(&pinst->kobj, KOBJ_ADD);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 025/343] exportfs: fix passing zero to ERR_PTR() warning
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 024/343] pcrypt: use format specifier in kobject_add Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 026/343] drm/dp_mst: Skip validating ports during destruction, just ref Greg Kroah-Hartman
                   ` (322 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, YueHaibing, Al Viro, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 909e22e05353a783c526829427e9a8de122fba9c ]

Fix a static code checker warning:
  fs/exportfs/expfs.c:171 reconnect_one() warn: passing zero to 'ERR_PTR'

The error path for lookup_one_len_unlocked failure
should set err to PTR_ERR.

Fixes: bbf7a8a3562f ("exportfs: move most of reconnect_path to helper function")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/exportfs/expfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index a561ae17cf435..c08960040dd05 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -147,6 +147,7 @@ static struct dentry *reconnect_one(struct vfsmount *mnt,
 	tmp = lookup_one_len_unlocked(nbuf, parent, strlen(nbuf));
 	if (IS_ERR(tmp)) {
 		dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp));
+		err = PTR_ERR(tmp);
 		goto out_err;
 	}
 	if (tmp != dentry) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 026/343] drm/dp_mst: Skip validating ports during destruction, just ref
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 025/343] exportfs: fix passing zero to ERR_PTR() warning Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 027/343] net: phy: Fix not to call phy_resume() if PHY is not attached Greg Kroah-Hartman
                   ` (321 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lyude Paul, Jerry Zuo,
	Harry Wentland, Dave Airlie, Sean Paul, Sasha Levin

From: Lyude Paul <lyude@redhat.com>

[ Upstream commit c54c7374ff44de5e609506aca7c0deae4703b6d1 ]

Jerry Zuo pointed out a rather obscure hotplugging issue that it seems I
accidentally introduced into DRM two years ago.

Pretend we have a topology like this:

|- DP-1: mst_primary
   |- DP-4: active display
   |- DP-5: disconnected
   |- DP-6: active hub
      |- DP-7: active display
      |- DP-8: disconnected
      |- DP-9: disconnected

If we unplug DP-6, the topology starting at DP-7 will be destroyed but
it's payloads will live on in DP-1's VCPI allocations and thus require
removal. However, this removal currently fails because
drm_dp_update_payload_part1() will (rightly so) try to validate the port
before accessing it, fail then abort. If we keep going, eventually we
run the MST hub out of bandwidth and all new allocations will start to
fail (or in my case; all new displays just start flickering a ton).

We could just teach drm_dp_update_payload_part1() not to drop the port
ref in this case, but then we also need to teach
drm_dp_destroy_payload_step1() to do the same thing, then hope no one
ever adds anything to the that requires a validated port reference in
drm_dp_destroy_connector_work(). Kind of sketchy.

So let's go with a more clever solution: any port that
drm_dp_destroy_connector_work() interacts with is guaranteed to still
exist in memory until we say so. While said port might not be valid we
don't really care: that's the whole reason we're destroying it in the
first place! So, teach drm_dp_get_validated_port_ref() to use the all
mighty current_work() function to avoid attempting to validate ports
from the context of mgr->destroy_connector_work. I can't see any
situation where this wouldn't be safe, and this avoids having to play
whack-a-mole in the future of trying to work around port validation.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Fixes: 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()")
Reported-by: Jerry Zuo <Jerry.Zuo@amd.com>
Cc: Jerry Zuo <Jerry.Zuo@amd.com>
Cc: Harry Wentland <Harry.Wentland@amd.com>
Cc: <stable@vger.kernel.org> # v4.6+
Reviewed-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181113224613.28809-1-lyude@redhat.com
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_dp_mst_topology.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index c8c83f84acedd..9d94c306c8ca1 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -982,9 +982,20 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
 static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
 {
 	struct drm_dp_mst_port *rport = NULL;
+
 	mutex_lock(&mgr->lock);
-	if (mgr->mst_primary)
-		rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
+	/*
+	 * Port may or may not be 'valid' but we don't care about that when
+	 * destroying the port and we are guaranteed that the port pointer
+	 * will be valid until we've finished
+	 */
+	if (current_work() == &mgr->destroy_connector_work) {
+		kref_get(&port->kref);
+		rport = port;
+	} else if (mgr->mst_primary) {
+		rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
+						       port);
+	}
 	mutex_unlock(&mgr->lock);
 	return rport;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 027/343] net: phy: Fix not to call phy_resume() if PHY is not attached
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 026/343] drm/dp_mst: Skip validating ports during destruction, just ref Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 028/343] IB/rxe: Fix incorrect cache cleanup in error flow Greg Kroah-Hartman
                   ` (320 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yoshihiro Shimoda, David S. Miller,
	Sasha Levin

From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>

[ Upstream commit ef1b5bf506b1f0ee3edc98533e1f3ecb105eb46a ]

This patch fixes an issue that mdio_bus_phy_resume() doesn't call
phy_resume() if the PHY is not attached.

Fixes: 803dd9c77ac3 ("net: phy: avoid suspending twice a PHY")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/phy_device.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index a98c227a4c2eb..99dae55cd334b 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -76,7 +76,7 @@ static LIST_HEAD(phy_fixup_list);
 static DEFINE_MUTEX(phy_fixup_lock);
 
 #ifdef CONFIG_PM
-static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
+static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend)
 {
 	struct device_driver *drv = phydev->mdio.dev.driver;
 	struct phy_driver *phydrv = to_phy_driver(drv);
@@ -88,10 +88,11 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
 	/* PHY not attached? May suspend if the PHY has not already been
 	 * suspended as part of a prior call to phy_disconnect() ->
 	 * phy_detach() -> phy_suspend() because the parent netdev might be the
-	 * MDIO bus driver and clock gated at this point.
+	 * MDIO bus driver and clock gated at this point. Also may resume if
+	 * PHY is not attached.
 	 */
 	if (!netdev)
-		return !phydev->suspended;
+		return suspend ? !phydev->suspended : phydev->suspended;
 
 	/* Don't suspend PHY if the attached netdev parent may wakeup.
 	 * The parent may point to a PCI device, as in tg3 driver.
@@ -121,7 +122,7 @@ static int mdio_bus_phy_suspend(struct device *dev)
 	if (phydev->attached_dev && phydev->adjust_link)
 		phy_stop_machine(phydev);
 
-	if (!mdio_bus_phy_may_suspend(phydev))
+	if (!mdio_bus_phy_may_suspend(phydev, true))
 		return 0;
 
 	return phy_suspend(phydev);
@@ -132,7 +133,7 @@ static int mdio_bus_phy_resume(struct device *dev)
 	struct phy_device *phydev = to_phy_device(dev);
 	int ret;
 
-	if (!mdio_bus_phy_may_suspend(phydev))
+	if (!mdio_bus_phy_may_suspend(phydev, false))
 		goto no_resume;
 
 	ret = phy_resume(phydev);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 028/343] IB/rxe: Fix incorrect cache cleanup in error flow
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 027/343] net: phy: Fix not to call phy_resume() if PHY is not attached Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 029/343] staging: bcm2835-camera: Abort probe if there is no camera Greg Kroah-Hartman
                   ` (319 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yuval Shaia, Bart Van Assche,
	Zhu Yanjun, Leon Romanovsky, Jason Gunthorpe, Sasha Levin

From: Yuval Shaia <yuval.shaia@oracle.com>

[ Upstream commit 6db21d8986e14e2e86573a3b055b05296188bd2c ]

Array iterator stays at the same slot, fix it.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Zhu Yanjun <yanjun.zhu@oracle.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_pool.c | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c
index b4a8acc7bb7d6..0e2425f282335 100644
--- a/drivers/infiniband/sw/rxe/rxe_pool.c
+++ b/drivers/infiniband/sw/rxe/rxe_pool.c
@@ -112,6 +112,18 @@ static inline struct kmem_cache *pool_cache(struct rxe_pool *pool)
 	return rxe_type_info[pool->type].cache;
 }
 
+static void rxe_cache_clean(size_t cnt)
+{
+	int i;
+	struct rxe_type_info *type;
+
+	for (i = 0; i < cnt; i++) {
+		type = &rxe_type_info[i];
+		kmem_cache_destroy(type->cache);
+		type->cache = NULL;
+	}
+}
+
 int rxe_cache_init(void)
 {
 	int err;
@@ -136,24 +148,14 @@ int rxe_cache_init(void)
 	return 0;
 
 err1:
-	while (--i >= 0) {
-		kmem_cache_destroy(type->cache);
-		type->cache = NULL;
-	}
+	rxe_cache_clean(i);
 
 	return err;
 }
 
 void rxe_cache_exit(void)
 {
-	int i;
-	struct rxe_type_info *type;
-
-	for (i = 0; i < RXE_NUM_TYPES; i++) {
-		type = &rxe_type_info[i];
-		kmem_cache_destroy(type->cache);
-		type->cache = NULL;
-	}
+	rxe_cache_clean(RXE_NUM_TYPES);
 }
 
 static int rxe_pool_init_index(struct rxe_pool *pool, u32 max, u32 min)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 029/343] staging: bcm2835-camera: Abort probe if there is no camera
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 028/343] IB/rxe: Fix incorrect cache cleanup in error flow Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 030/343] switchtec: Remove immediate status check after submitting MRPC command Greg Kroah-Hartman
                   ` (318 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren,
	Nicolas Saenz Julienne, Dan Carpenter, Sasha Levin

From: Stefan Wahren <stefan.wahren@i2se.com>

[ Upstream commit 7566f39dfdc11f8a97d5810c6e6295a88f97ef91 ]

Abort the probing of the camera driver in case there isn't a camera
actually connected to the Raspberry Pi. This solution also avoids a
NULL ptr dereference of mmal instance on driver unload.

Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../vc04_services/bcm2835-camera/bcm2835-camera.c        | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 377da037f31c3..b521752d9aa01 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -1849,6 +1849,12 @@ static int __init bm2835_mmal_init(void)
 	num_cameras = get_num_cameras(instance,
 				      resolutions,
 				      MAX_BCM2835_CAMERAS);
+
+	if (num_cameras < 1) {
+		ret = -ENODEV;
+		goto cleanup_mmal;
+	}
+
 	if (num_cameras > MAX_BCM2835_CAMERAS)
 		num_cameras = MAX_BCM2835_CAMERAS;
 
@@ -1948,6 +1954,9 @@ cleanup_gdev:
 	pr_info("%s: error %d while loading driver\n",
 		BM2835_MMAL_MODULE_NAME, ret);
 
+cleanup_mmal:
+	vchiq_mmal_finalise(instance);
+
 	return ret;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 030/343] switchtec: Remove immediate status check after submitting MRPC command
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 029/343] staging: bcm2835-camera: Abort probe if there is no camera Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 031/343] pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group Greg Kroah-Hartman
                   ` (317 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kelvin Cao, Wesley Sheng,
	Bjorn Helgaas, Logan Gunthorpe, Sasha Levin

From: Kelvin Cao <kelvin.cao@microchip.com>

[ Upstream commit 526180408b815aa7b96fd48bd23cdd33ef04e38e ]

After submitting a Firmware Download MRPC command, Switchtec firmware will
delay Management EP BAR MemRd TLP responses by more than 10ms.  This is a
firmware limitation.  Delayed MemRd completions are a problem for systems
with a low Completion Timeout (CTO).

The current driver checks the MRPC status immediately after submitting an
MRPC command, which results in a delayed MemRd completion that may cause a
Completion Timeout.

Remove the immediate status check and rely on the check after receiving an
interrupt or timing out.

This is only a software workaround to the READ issue and a proper fix of
this should be done in firmware.

Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver")
Signed-off-by: Kelvin Cao <kelvin.cao@microchip.com>
Signed-off-by: Wesley Sheng <wesley.sheng@microchip.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/switch/switchtec.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index 0941555b84a52..73dba2739849b 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -399,10 +399,6 @@ static void mrpc_cmd_submit(struct switchtec_dev *stdev)
 		    stuser->data, stuser->data_len);
 	iowrite32(stuser->cmd, &stdev->mmio_mrpc->cmd);
 
-	stuser->status = ioread32(&stdev->mmio_mrpc->status);
-	if (stuser->status != SWITCHTEC_MRPC_STATUS_INPROGRESS)
-		mrpc_complete_cmd(stdev);
-
 	schedule_delayed_work(&stdev->mrpc_timeout,
 			      msecs_to_jiffies(500));
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 031/343] pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 030/343] switchtec: Remove immediate status check after submitting MRPC command Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 032/343] pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group Greg Kroah-Hartman
                   ` (316 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 1ebc589a7786f17f97b9e87b44e0fb4d0290d8f8 ]

The gether_gmii_mux[] array contains the REF125CK pin mark, but the
gether_gmii_pins[] array lacks the corresponding pin number.

Fixes: bae11d30d0cafdc5 ("sh-pfc: r8a7740: Add GETHER pin groups and functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
index 35f436bcb8491..d8077065636e3 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
@@ -1982,7 +1982,7 @@ static const unsigned int gether_gmii_pins[] = {
 	 */
 	185, 186, 187, 188, 189, 190, 191, 192, 174, 161, 204,
 	171, 170, 169, 168, 167, 166, 173, 172, 176, 184, 183, 203,
-	205, 163, 206, 207,
+	205, 163, 206, 207, 158,
 };
 static const unsigned int gether_gmii_mux[] = {
 	ET_ERXD0_MARK, ET_ERXD1_MARK, ET_ERXD2_MARK, ET_ERXD3_MARK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 032/343] pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 031/343] pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 033/343] pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group Greg Kroah-Hartman
                   ` (315 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 96bb2a6ab4eca10e5b6490b3f0738e9f7ec22c2b ]

The lcd0_data24_1_pins[] array contains the LCD0 D1[2-5] pin numbers,
but the lcd0_data24_1_mux[] array lacks the corresponding pin marks.

Fixes: 06c7dd866da70f6c ("sh-pfc: r8a7740: Add LCDC0 and LCDC1 pin groups and functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
index d8077065636e3..e9739dbcb356e 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
@@ -2154,6 +2154,7 @@ static const unsigned int lcd0_data24_1_mux[] = {
 	LCD0_D0_MARK, LCD0_D1_MARK, LCD0_D2_MARK, LCD0_D3_MARK,
 	LCD0_D4_MARK, LCD0_D5_MARK, LCD0_D6_MARK, LCD0_D7_MARK,
 	LCD0_D8_MARK, LCD0_D9_MARK, LCD0_D10_MARK, LCD0_D11_MARK,
+	LCD0_D12_MARK, LCD0_D13_MARK, LCD0_D14_MARK, LCD0_D15_MARK,
 	LCD0_D16_MARK, LCD0_D17_MARK, LCD0_D18_PORT163_MARK,
 	LCD0_D19_PORT162_MARK, LCD0_D20_PORT161_MARK, LCD0_D21_PORT158_MARK,
 	LCD0_D22_PORT160_MARK, LCD0_D23_PORT159_MARK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 033/343] pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 032/343] pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 034/343] pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group Greg Kroah-Hartman
                   ` (314 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 884fa25fb6e5e63ab970d612a628313bb68f37cc ]

The qspi_data4_b_mux[] array contains pin marks for the clock and chip
select pins.  The qspi_data4_b_pins[] array rightfully does not contain
the corresponding pin numbers, as the control pins are provided by a
separate group (qspi_ctrl_b).

Fixes: 2d0c386f135e4186 ("pinctrl: sh-pfc: r8a7791: Add QSPI pin groups")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index c01ef02d326b7..8600ba82f59c3 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -3220,8 +3220,7 @@ static const unsigned int qspi_data4_b_pins[] = {
 	RCAR_GP_PIN(6, 4),
 };
 static const unsigned int qspi_data4_b_mux[] = {
-	SPCLK_B_MARK, MOSI_IO0_B_MARK, MISO_IO1_B_MARK,
-	IO2_B_MARK, IO3_B_MARK, SSL_B_MARK,
+	MOSI_IO0_B_MARK, MISO_IO1_B_MARK, IO2_B_MARK, IO3_B_MARK,
 };
 /* - SCIF0 ------------------------------------------------------------------ */
 static const unsigned int scif0_data_pins[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 034/343] pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 033/343] pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 035/343] pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group Greg Kroah-Hartman
                   ` (313 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 0d6256cb880166a4111bebce35790019e56b6e1b ]

The vin1_b_data18_mux[] arrays contains pin marks for the 2 LSB bits of
the color components.  The vin1_b_data18_pins[] array rightfully does
not include the corresponding pin numbers, as RGB18 is subset of RGB24,
containing only the 6 MSB bits of each component.

Fixes: 8e32c9671f84acd8 ("pinctrl: sh-pfc: r8a7791: Add VIN pins")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index 8600ba82f59c3..d34982ea66bf1 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -4348,17 +4348,14 @@ static const unsigned int vin1_b_data18_pins[] = {
 };
 static const unsigned int vin1_b_data18_mux[] = {
 	/* B */
-	VI1_DATA0_B_MARK, VI1_DATA1_B_MARK,
 	VI1_DATA2_B_MARK, VI1_DATA3_B_MARK,
 	VI1_DATA4_B_MARK, VI1_DATA5_B_MARK,
 	VI1_DATA6_B_MARK, VI1_DATA7_B_MARK,
 	/* G */
-	VI1_G0_B_MARK, VI1_G1_B_MARK,
 	VI1_G2_B_MARK, VI1_G3_B_MARK,
 	VI1_G4_B_MARK, VI1_G5_B_MARK,
 	VI1_G6_B_MARK, VI1_G7_B_MARK,
 	/* R */
-	VI1_R0_B_MARK, VI1_R1_B_MARK,
 	VI1_R2_B_MARK, VI1_R3_B_MARK,
 	VI1_R4_B_MARK, VI1_R5_B_MARK,
 	VI1_R6_B_MARK, VI1_R7_B_MARK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 035/343] pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 034/343] pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 036/343] pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field Greg Kroah-Hartman
                   ` (312 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 124cde98f856b6206b804acbdec3b7c80f8c3427 ]

The tpu4_to3_mux[] array contains the TPU4TO3 pin mark, but the
tpu4_to3_pins[] array lacks the corresponding pin number.

Add the missing pin number, for non-GPIO pin F26.

Fixes: 5da4eb049de803c7 ("sh-pfc: sh73a0: Add TPU pin groups and functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
index d25e6f674d0ab..f8fbedb46585d 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
@@ -3086,6 +3086,7 @@ static const unsigned int tpu4_to2_mux[] = {
 };
 static const unsigned int tpu4_to3_pins[] = {
 	/* TO */
+	PIN_NUMBER(6, 26),
 };
 static const unsigned int tpu4_to3_mux[] = {
 	TPU4TO3_MARK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 036/343] pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 035/343] pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 037/343] pinctrl: sh-pfc: sh7734: Add missing IPSR11 field Greg Kroah-Hartman
                   ` (311 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 6a6c195d98a1a5e70faa87f594d7564af1dd1bed ]

The Peripheral Function Select Register 9 contains 12 fields, but the
variable field descriptor contains a 13th bogus field of 3 bits.

Fixes: 43c4436e2f1890a7 ("pinctrl: sh-pfc: add R8A7794 PFC support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7794.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
index a0ed220071f5f..93bdd3e8fb670 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
@@ -4742,7 +4742,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 		FN_AVB_MDC, FN_SSI_SDATA6_B, 0, 0, }
 	},
 	{ PINMUX_CFG_REG_VAR("IPSR9", 0xE6060044, 32,
-			     1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3, 3) {
+			     1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3) {
 		/* IP9_31 [1] */
 		0, 0,
 		/* IP9_30_28 [3] */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 037/343] pinctrl: sh-pfc: sh7734: Add missing IPSR11 field
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 036/343] pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 038/343] pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations Greg Kroah-Hartman
                   ` (310 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 94482af7055e1ffa211c1135256b85590ebcac99 ]

The Peripheral Function Select Register 11 contains 3 reserved bits and
15 variable-width fields, but the variable field descriptor does not
contain the 3-bit field IP11[25:23].

Fixes: 856cb4bb337ee504 ("sh: Add support pinmux for SH7734")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
index 3eccc9b3ca84a..05ccb27f77818 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
@@ -2237,7 +2237,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 		FN_LCD_DATA15_B, 0, 0, 0 }
 	},
 	{ PINMUX_CFG_REG_VAR("IPSR11", 0xFFFC0048, 32,
-			3, 1, 2, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
+			3, 1, 2, 3, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
 	    /* IP11_31_29 [3] */
 	    0, 0, 0, 0, 0, 0, 0, 0,
 	    /* IP11_28 [1] */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 038/343] pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 037/343] pinctrl: sh-pfc: sh7734: Add missing IPSR11 field Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 039/343] pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field Greg Kroah-Hartman
                   ` (309 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit e28dc3f09c9d2555a9bd982f0847988591052226 ]

While the SEL_PWM[0-3] fields in the Module Select Register 0 support 4
possible configurations per PWM pin, only the first 3 are valid.

Replace the invalid and unused configurations for SEL_PWM[0-3]_3 by
dummies.

Fixes: 794a6711764658a1 ("pinctrl: sh-pfc: Initial R8A77995 PFC support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a77995.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77995.c b/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
index 4f5ee1d7317d3..36421df1b3260 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
@@ -391,10 +391,10 @@ FM(IP12_31_28)	IP12_31_28 \
 #define MOD_SEL0_27		FM(SEL_MSIOF3_0)	FM(SEL_MSIOF3_1)
 #define MOD_SEL0_26		FM(SEL_HSCIF3_0)	FM(SEL_HSCIF3_1)
 #define MOD_SEL0_25		FM(SEL_SCIF4_0)		FM(SEL_SCIF4_1)
-#define MOD_SEL0_24_23		FM(SEL_PWM0_0)		FM(SEL_PWM0_1)		FM(SEL_PWM0_2)		FM(SEL_PWM0_3)
-#define MOD_SEL0_22_21		FM(SEL_PWM1_0)		FM(SEL_PWM1_1)		FM(SEL_PWM1_2)		FM(SEL_PWM1_3)
-#define MOD_SEL0_20_19		FM(SEL_PWM2_0)		FM(SEL_PWM2_1)		FM(SEL_PWM2_2)		FM(SEL_PWM2_3)
-#define MOD_SEL0_18_17		FM(SEL_PWM3_0)		FM(SEL_PWM3_1)		FM(SEL_PWM3_2)		FM(SEL_PWM3_3)
+#define MOD_SEL0_24_23		FM(SEL_PWM0_0)		FM(SEL_PWM0_1)		FM(SEL_PWM0_2)		F_(0, 0)
+#define MOD_SEL0_22_21		FM(SEL_PWM1_0)		FM(SEL_PWM1_1)		FM(SEL_PWM1_2)		F_(0, 0)
+#define MOD_SEL0_20_19		FM(SEL_PWM2_0)		FM(SEL_PWM2_1)		FM(SEL_PWM2_2)		F_(0, 0)
+#define MOD_SEL0_18_17		FM(SEL_PWM3_0)		FM(SEL_PWM3_1)		FM(SEL_PWM3_2)		F_(0, 0)
 #define MOD_SEL0_15		FM(SEL_IRQ_0_0)		FM(SEL_IRQ_0_1)
 #define MOD_SEL0_14		FM(SEL_IRQ_1_0)		FM(SEL_IRQ_1_1)
 #define MOD_SEL0_13		FM(SEL_IRQ_2_0)		FM(SEL_IRQ_2_1)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 039/343] pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 038/343] pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 040/343] pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value Greg Kroah-Hartman
                   ` (308 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 9540cbdfcd861caf67a6f0e4bb7f46d41c4aad86 ]

The Port C I/O Register 0 contains 7 reserved bits, but the descriptor
contains only dummy configuration values for 6 reserved bits, thus
breaking the configuration of all subsequent fields in the register.

Fix this by adding the two missing configuration values.

Fixes: f5e811f2a43117b2 ("sh-pfc: Add sh7269 pinmux support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh7269.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
index a50d22bef1f44..cfdb4fc177c3e 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
@@ -2119,7 +2119,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 	},
 
 	{ PINMUX_CFG_REG("PCIOR0", 0xfffe3852, 16, 1) {
-		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 		PC8_IN, PC8_OUT,
 		PC7_IN, PC7_OUT,
 		PC6_IN, PC6_OUT,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 040/343] pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 039/343] pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 041/343] vxlan: changelink: Fix handling of default remotes Greg Kroah-Hartman
                   ` (307 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 4d374bacd7c9665179f9752a52d5d602c45d8190 ]

The IP10[5:3] field in Peripheral Function Select Register 10 has a
width of 3 bits, i.e. it allows programming one out of 8 different
configurations.
However, 9 values are provided instead of 8, overflowing into the
subsequent field in the register, and thus breaking the configuration of
the latter.

Fix this by dropping a bogus zero value.

Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
index 05ccb27f77818..c691e5e9d9dea 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
@@ -2231,7 +2231,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 		FN_LCD_CL1_B, 0, 0,
 	    /* IP10_5_3 [3] */
 		FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
-		FN_LCD_DON_B, 0, 0, 0,
+		FN_LCD_DON_B, 0, 0,
 	    /* IP10_2_0 [3] */
 		FN_SSI_SCK23, FN_VI1_4_B, FN_RX1_D, FN_FCLE_B,
 		FN_LCD_DATA15_B, 0, 0, 0 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 041/343] vxlan: changelink: Fix handling of default remotes
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 040/343] pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 042/343] Input: nomadik-ske-keypad - fix a loop timeout test Greg Kroah-Hartman
                   ` (306 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Petr Machata, Roopa Prabhu,
	David S. Miller, Sasha Levin

From: Petr Machata <petrm@mellanox.com>

[ Upstream commit ce5e098f7a10b4bf8e948c12fa350320c5c3afad ]

Default remotes are stored as FDB entries with an Ethernet address of
00:00:00:00:00:00. When a request is made to change a remote address of
a VXLAN device, vxlan_changelink() first deletes the existing default
remote, and then creates a new FDB entry.

This works well as long as the list of default remotes matches exactly
the configuration of a VXLAN remote address. Thus when the VXLAN device
has a remote of X, there should be exactly one default remote FDB entry
X. If the VXLAN device has no remote address, there should be no such
entry.

Besides using "ip link set", it is possible to manipulate the list of
default remotes by using the "bridge fdb". It is therefore easy to break
the above condition. Under such circumstances, the __vxlan_fdb_delete()
call doesn't delete the FDB entry itself, but just one remote. The
following vxlan_fdb_create() then creates a new FDB entry, leading to a
situation where two entries exist for the address 00:00:00:00:00:00,
each with a different subset of default remotes.

An even more obvious breakage rooted in the same cause can be observed
when a remote address is configured for a VXLAN device that did not have
one before. In that case vxlan_changelink() doesn't remove any remote,
and just creates a new FDB entry for the new address:

$ ip link add name vx up type vxlan id 2000 dstport 4789
$ bridge fdb ap dev vx 00:00:00:00:00:00 dst 192.0.2.20 self permanent
$ bridge fdb ap dev vx 00:00:00:00:00:00 dst 192.0.2.30 self permanent
$ ip link set dev vx type vxlan remote 192.0.2.30
$ bridge fdb sh dev vx | grep 00:00:00:00:00:00
00:00:00:00:00:00 dst 192.0.2.30 self permanent <- new entry, 1 rdst
00:00:00:00:00:00 dst 192.0.2.20 self permanent <- orig. entry, 2 rdsts
00:00:00:00:00:00 dst 192.0.2.30 self permanent

To fix this, instead of calling vxlan_fdb_create() directly, defer to
vxlan_fdb_update(). That has logic to handle the duplicates properly.
Additionally, it also handles notifications, so drop that call from
changelink as well.

Fixes: 0241b836732f ("vxlan: fix default fdb entry netlink notify ordering during netdev create")
Signed-off-by: Petr Machata <petrm@mellanox.com>
Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/vxlan.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 5aa7d5091f4d0..4d97a7b5fe3ca 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -3494,7 +3494,6 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
 	struct vxlan_rdst *dst = &vxlan->default_dst;
 	struct vxlan_rdst old_dst;
 	struct vxlan_config conf;
-	struct vxlan_fdb *f = NULL;
 	int err;
 
 	err = vxlan_nl2conf(tb, data,
@@ -3520,19 +3519,19 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
 					   old_dst.remote_ifindex, 0);
 
 		if (!vxlan_addr_any(&dst->remote_ip)) {
-			err = vxlan_fdb_create(vxlan, all_zeros_mac,
+			err = vxlan_fdb_update(vxlan, all_zeros_mac,
 					       &dst->remote_ip,
 					       NUD_REACHABLE | NUD_PERMANENT,
+					       NLM_F_APPEND | NLM_F_CREATE,
 					       vxlan->cfg.dst_port,
 					       dst->remote_vni,
 					       dst->remote_vni,
 					       dst->remote_ifindex,
-					       NTF_SELF, &f);
+					       NTF_SELF);
 			if (err) {
 				spin_unlock_bh(&vxlan->hash_lock);
 				return err;
 			}
-			vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH);
 		}
 		spin_unlock_bh(&vxlan->hash_lock);
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 042/343] Input: nomadik-ske-keypad - fix a loop timeout test
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 041/343] vxlan: changelink: Fix handling of default remotes Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 043/343] clk: highbank: fix refcount leak in hb_clk_init() Greg Kroah-Hartman
                   ` (305 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Dmitry Torokhov, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 4d8f727b83bcd6702c2d210330872c9122d2d360 ]

The loop exits with "timeout" set to -1 not to 0.

Fixes: 1158f0f16224 ("Input: add support for Nomadik SKE keypad controller")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/nomadik-ske-keypad.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/keyboard/nomadik-ske-keypad.c b/drivers/input/keyboard/nomadik-ske-keypad.c
index 8567ee47761e1..ae3b045570740 100644
--- a/drivers/input/keyboard/nomadik-ske-keypad.c
+++ b/drivers/input/keyboard/nomadik-ske-keypad.c
@@ -100,7 +100,7 @@ static int __init ske_keypad_chip_init(struct ske_keypad *keypad)
 	while ((readl(keypad->reg_base + SKE_RIS) != 0x00000000) && timeout--)
 		cpu_relax();
 
-	if (!timeout)
+	if (timeout == -1)
 		return -EINVAL;
 
 	/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 043/343] clk: highbank: fix refcount leak in hb_clk_init()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 042/343] Input: nomadik-ske-keypad - fix a loop timeout test Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 044/343] clk: qoriq: fix refcount leak in clockgen_init() Greg Kroah-Hartman
                   ` (304 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 5eb8ba90958de1285120dae5d3a5d2b1a360b3b4 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 26cae166cff9 ("ARM: highbank: remove custom .init_time hook")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-highbank.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/clk-highbank.c b/drivers/clk/clk-highbank.c
index 727ed8e1bb726..8e4581004695c 100644
--- a/drivers/clk/clk-highbank.c
+++ b/drivers/clk/clk-highbank.c
@@ -293,6 +293,7 @@ static __init struct clk *hb_clk_init(struct device_node *node, const struct clk
 	/* Map system registers */
 	srnp = of_find_compatible_node(NULL, NULL, "calxeda,hb-sregs");
 	hb_clk->reg = of_iomap(srnp, 0);
+	of_node_put(srnp);
 	BUG_ON(!hb_clk->reg);
 	hb_clk->reg += reg;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 044/343] clk: qoriq: fix refcount leak in clockgen_init()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 043/343] clk: highbank: fix refcount leak in hb_clk_init() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 045/343] clk: socfpga: fix refcount leak Greg Kroah-Hartman
                   ` (303 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 70af6c5b5270e8101f318c4b69cc98a726edfab9 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 0dfc86b3173f ("clk: qoriq: Move chip-specific knowledge into driver")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-qoriq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
index 1a292519d84f2..999a90a166092 100644
--- a/drivers/clk/clk-qoriq.c
+++ b/drivers/clk/clk-qoriq.c
@@ -1382,6 +1382,7 @@ static void __init clockgen_init(struct device_node *np)
 				pr_err("%s: Couldn't map %pOF regs\n", __func__,
 				       guts);
 			}
+			of_node_put(guts);
 		}
 
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 045/343] clk: socfpga: fix refcount leak
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 044/343] clk: qoriq: fix refcount leak in clockgen_init() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 046/343] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() Greg Kroah-Hartman
                   ` (302 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 7f9705beeb3759e69165e7aff588f6488ff6c1ac ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 5343325ff3dd ("clk: socfpga: add a clock driver for the Arria 10 platform")
Fixes: a30d27ed739b ("clk: socfpga: fix clock driver for 3.15")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/socfpga/clk-pll-a10.c | 1 +
 drivers/clk/socfpga/clk-pll.c     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/clk/socfpga/clk-pll-a10.c b/drivers/clk/socfpga/clk-pll-a10.c
index 35fabe1a32c30..269467e8e07e1 100644
--- a/drivers/clk/socfpga/clk-pll-a10.c
+++ b/drivers/clk/socfpga/clk-pll-a10.c
@@ -95,6 +95,7 @@ static struct clk * __init __socfpga_pll_init(struct device_node *node,
 
 	clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
 	clk_mgr_a10_base_addr = of_iomap(clkmgr_np, 0);
+	of_node_put(clkmgr_np);
 	BUG_ON(!clk_mgr_a10_base_addr);
 	pll_clk->hw.reg = clk_mgr_a10_base_addr + reg;
 
diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
index c7f463172e4b9..b4b44e9b59011 100644
--- a/drivers/clk/socfpga/clk-pll.c
+++ b/drivers/clk/socfpga/clk-pll.c
@@ -100,6 +100,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
 
 	clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
 	clk_mgr_base_addr = of_iomap(clkmgr_np, 0);
+	of_node_put(clkmgr_np);
 	BUG_ON(!clk_mgr_base_addr);
 	pll_clk->hw.reg = clk_mgr_base_addr + reg;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 046/343] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 045/343] clk: socfpga: fix refcount leak Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 047/343] clk: imx6q: fix refcount leak in imx6q_clocks_init() Greg Kroah-Hartman
                   ` (301 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit cee82eb9532090cd1dc953e845d71f9b1445c84e ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: e062b571777f ("clk: exynos4: register clocks using common clock framework")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/samsung/clk-exynos4.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index d8d3cb67b4029..3d30262219275 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -1240,6 +1240,7 @@ static unsigned long __init exynos4_get_xom(void)
 			xom = readl(chipid_base + 8);
 
 		iounmap(chipid_base);
+		of_node_put(np);
 	}
 
 	return xom;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 047/343] clk: imx6q: fix refcount leak in imx6q_clocks_init()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 046/343] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 048/343] clk: imx6sx: fix refcount leak in imx6sx_clocks_init() Greg Kroah-Hartman
                   ` (300 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit c9ec1d8fef31b5fc9e90e99f9bd685db5caa7c5e ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 2acd1b6f889c ("ARM: i.MX6: implement clocks using common clock framework")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx6q.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
index 8eb93eb2f8573..e0547654cb7bd 100644
--- a/drivers/clk/imx/clk-imx6q.c
+++ b/drivers/clk/imx/clk-imx6q.c
@@ -431,6 +431,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-anatop");
 	anatop_base = base = of_iomap(np, 0);
 	WARN_ON(!base);
+	of_node_put(np);
 
 	/* Audio/video PLL post dividers do not work on i.MX6q revision 1.0 */
 	if (clk_on_imx6q() && imx_get_soc_revision() == IMX_CHIP_REVISION_1_0) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 048/343] clk: imx6sx: fix refcount leak in imx6sx_clocks_init()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 047/343] clk: imx6q: fix refcount leak in imx6q_clocks_init() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 049/343] clk: imx7d: fix refcount leak in imx7d_clocks_init() Greg Kroah-Hartman
                   ` (299 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 1731e14fb30212dd8c1e9f8fc1af061e56498c55 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: d55135689019 ("ARM: imx: add clock driver for imx6sx")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx6sx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-imx6sx.c b/drivers/clk/imx/clk-imx6sx.c
index e6d389e333d7d..baa07553a0ddc 100644
--- a/drivers/clk/imx/clk-imx6sx.c
+++ b/drivers/clk/imx/clk-imx6sx.c
@@ -164,6 +164,7 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6sx-anatop");
 	base = of_iomap(np, 0);
 	WARN_ON(!base);
+	of_node_put(np);
 
 	clks[IMX6SX_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
 	clks[IMX6SX_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 049/343] clk: imx7d: fix refcount leak in imx7d_clocks_init()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 048/343] clk: imx6sx: fix refcount leak in imx6sx_clocks_init() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 050/343] clk: vf610: fix refcount leak in vf610_clocks_init() Greg Kroah-Hartman
                   ` (298 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 5f8c183a996b76bb09748073c856e4246fd4ce95 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 8f6d8094b215 ("ARM: imx: add imx7d clk tree support")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx7d.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c
index 0ac9b30c8b906..9f5e5b9d4a25a 100644
--- a/drivers/clk/imx/clk-imx7d.c
+++ b/drivers/clk/imx/clk-imx7d.c
@@ -416,6 +416,7 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node)
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx7d-anatop");
 	base = of_iomap(np, 0);
 	WARN_ON(!base);
+	of_node_put(np);
 
 	clks[IMX7D_PLL_ARM_MAIN_SRC]  = imx_clk_mux("pll_arm_main_src", base + 0x60, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
 	clks[IMX7D_PLL_DRAM_MAIN_SRC] = imx_clk_mux("pll_dram_main_src", base + 0x70, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 050/343] clk: vf610: fix refcount leak in vf610_clocks_init()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 049/343] clk: imx7d: fix refcount leak in imx7d_clocks_init() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 051/343] clk: armada-370: fix refcount leak in a370_clk_init() Greg Kroah-Hartman
                   ` (297 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 567177024e0313e4f0dcba7ba10c0732e50e655d ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 1f2c5fd5f048 ("ARM: imx: add VF610 clock support")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-vf610.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-vf610.c b/drivers/clk/imx/clk-vf610.c
index 6dae54325a91d..a334667c450a1 100644
--- a/drivers/clk/imx/clk-vf610.c
+++ b/drivers/clk/imx/clk-vf610.c
@@ -203,6 +203,7 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
 	np = of_find_compatible_node(NULL, NULL, "fsl,vf610-anatop");
 	anatop_base = of_iomap(np, 0);
 	BUG_ON(!anatop_base);
+	of_node_put(np);
 
 	np = ccm_node;
 	ccm_base = of_iomap(np, 0);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 051/343] clk: armada-370: fix refcount leak in a370_clk_init()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 050/343] clk: vf610: fix refcount leak in vf610_clocks_init() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 052/343] clk: kirkwood: fix refcount leak in kirkwood_clk_init() Greg Kroah-Hartman
                   ` (296 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit a3c24050bdf70c958a8d98c2823b66ea761e6a31 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 07ad6836fa21 ("clk: mvebu: armada-370: maintain clock init order")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/armada-370.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
index 2c7c1085f8830..8fdfa97900cd8 100644
--- a/drivers/clk/mvebu/armada-370.c
+++ b/drivers/clk/mvebu/armada-370.c
@@ -177,8 +177,10 @@ static void __init a370_clk_init(struct device_node *np)
 
 	mvebu_coreclk_setup(np, &a370_coreclks);
 
-	if (cgnp)
+	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, a370_gating_desc);
+		of_node_put(cgnp);
+	}
 }
 CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 052/343] clk: kirkwood: fix refcount leak in kirkwood_clk_init()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 051/343] clk: armada-370: fix refcount leak in a370_clk_init() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 053/343] clk: armada-xp: fix refcount leak in axp_clk_init() Greg Kroah-Hartman
                   ` (295 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit e7beeab9c61591cd0e690d8733d534c3f4278ff8 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 58d516ae95cb ("clk: mvebu: kirkwood: maintain clock init order")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/kirkwood.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
index a2a8d614039da..890ebf623261b 100644
--- a/drivers/clk/mvebu/kirkwood.c
+++ b/drivers/clk/mvebu/kirkwood.c
@@ -333,6 +333,8 @@ static void __init kirkwood_clk_init(struct device_node *np)
 	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc);
 		kirkwood_clk_muxing_setup(cgnp, kirkwood_mux_desc);
+
+		of_node_put(cgnp);
 	}
 }
 CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 053/343] clk: armada-xp: fix refcount leak in axp_clk_init()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 052/343] clk: kirkwood: fix refcount leak in kirkwood_clk_init() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 054/343] clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init() Greg Kroah-Hartman
                   ` (294 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit db20a90a4b6745dad62753f8bd2f66afdd5abc84 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 0a11a6ae9437 ("clk: mvebu: armada-xp: maintain clock init order")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/armada-xp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c
index 0ec44ae9a2a26..df529982adc97 100644
--- a/drivers/clk/mvebu/armada-xp.c
+++ b/drivers/clk/mvebu/armada-xp.c
@@ -228,7 +228,9 @@ static void __init axp_clk_init(struct device_node *np)
 
 	mvebu_coreclk_setup(np, &axp_coreclks);
 
-	if (cgnp)
+	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, axp_gating_desc);
+		of_node_put(cgnp);
+	}
 }
 CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 054/343] clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 053/343] clk: armada-xp: fix refcount leak in axp_clk_init() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 055/343] clk: dove: fix refcount leak in dove_clk_init() Greg Kroah-Hartman
                   ` (293 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 9b4eedf627045ae5ddcff60a484200cdd554c413 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 337072604224 ("clk: mvebu: Expand mv98dx3236-core-clock support")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/mv98dx3236.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/mvebu/mv98dx3236.c b/drivers/clk/mvebu/mv98dx3236.c
index 6e203af73cac1..c8a0d03d2cd60 100644
--- a/drivers/clk/mvebu/mv98dx3236.c
+++ b/drivers/clk/mvebu/mv98dx3236.c
@@ -174,7 +174,9 @@ static void __init mv98dx3236_clk_init(struct device_node *np)
 
 	mvebu_coreclk_setup(np, &mv98dx3236_core_clocks);
 
-	if (cgnp)
+	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, mv98dx3236_gating_desc);
+		of_node_put(cgnp);
+	}
 }
 CLK_OF_DECLARE(mv98dx3236_clk, "marvell,mv98dx3236-core-clock", mv98dx3236_clk_init);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 055/343] clk: dove: fix refcount leak in dove_clk_init()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 054/343] clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 056/343] MIPS: BCM63XX: drop unused and broken DSP platform device Greg Kroah-Hartman
                   ` (292 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 8d726c5128298386b907963033be93407b0c4275 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 8f7fc5450b64 ("clk: mvebu: dove: maintain clock init order")
Fixes: 63b8d92c793f ("clk: add Dove PLL divider support for GPU, VMeta and AXI clocks")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/dove.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/mvebu/dove.c b/drivers/clk/mvebu/dove.c
index 59fad9546c847..5f258c9bb68bf 100644
--- a/drivers/clk/mvebu/dove.c
+++ b/drivers/clk/mvebu/dove.c
@@ -190,10 +190,14 @@ static void __init dove_clk_init(struct device_node *np)
 
 	mvebu_coreclk_setup(np, &dove_coreclks);
 
-	if (ddnp)
+	if (ddnp) {
 		dove_divider_clk_init(ddnp);
+		of_node_put(ddnp);
+	}
 
-	if (cgnp)
+	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, dove_gating_desc);
+		of_node_put(cgnp);
+	}
 }
 CLK_OF_DECLARE(dove_clk, "marvell,dove-core-clock", dove_clk_init);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 056/343] MIPS: BCM63XX: drop unused and broken DSP platform device
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 055/343] clk: dove: fix refcount leak in dove_clk_init() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 057/343] IB/usnic: Fix out of bounds index check in query pkey Greg Kroah-Hartman
                   ` (291 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonas Gorski, Paul Burton,
	Florian Fainelli, linux-mips, Ralf Baechle, James Hogan,
	Sasha Levin

From: Jonas Gorski <jonas.gorski@gmail.com>

[ Upstream commit 682fee802843b332f9c51ffc8e062de5ff773f2e ]

Trying to register the DSP platform device results in a null pointer
access:

[    0.124184] CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 804e305c, ra == 804e6f20
[    0.135208] Oops[#1]:
[    0.137514] CPU: 0 PID: 1 Comm: swapper Not tainted 4.14.87
...
[    0.197117] epc   : 804e305c bcm63xx_dsp_register+0x80/0xa4
[    0.202838] ra    : 804e6f20 board_register_devices+0x258/0x390
...

This happens because it tries to copy the passed platform data over the
platform_device's unpopulated platform_data.

Since this code has been broken since its submission, no driver was ever
submitted for it, and apparently nobody was using it, just remove it
instead of trying to fix it.

Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs.")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: James Hogan <jhogan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/bcm63xx/Makefile                    |  6 +-
 arch/mips/bcm63xx/boards/board_bcm963xx.c     | 20 -------
 arch/mips/bcm63xx/dev-dsp.c                   | 56 -------------------
 .../asm/mach-bcm63xx/bcm63xx_dev_dsp.h        | 14 -----
 .../include/asm/mach-bcm63xx/board_bcm963xx.h |  5 --
 5 files changed, 3 insertions(+), 98 deletions(-)
 delete mode 100644 arch/mips/bcm63xx/dev-dsp.c
 delete mode 100644 arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h

diff --git a/arch/mips/bcm63xx/Makefile b/arch/mips/bcm63xx/Makefile
index c69f297fc1df3..d89651e538f64 100644
--- a/arch/mips/bcm63xx/Makefile
+++ b/arch/mips/bcm63xx/Makefile
@@ -1,8 +1,8 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
-		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
-		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
-		   dev-wdt.o dev-usb-usbd.o
+		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
+		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
+		   dev-usb-usbd.o
 obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
 
 obj-y		+= boards/
diff --git a/arch/mips/bcm63xx/boards/board_bcm963xx.c b/arch/mips/bcm63xx/boards/board_bcm963xx.c
index b2097c0d2ed78..36ec3dc2c999a 100644
--- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
+++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
@@ -23,7 +23,6 @@
 #include <bcm63xx_nvram.h>
 #include <bcm63xx_dev_pci.h>
 #include <bcm63xx_dev_enet.h>
-#include <bcm63xx_dev_dsp.h>
 #include <bcm63xx_dev_flash.h>
 #include <bcm63xx_dev_hsspi.h>
 #include <bcm63xx_dev_pcmcia.h>
@@ -289,14 +288,6 @@ static struct board_info __initdata board_96348gw_10 = {
 	.has_pccard			= 1,
 	.has_ehci0			= 1,
 
-	.has_dsp			= 1,
-	.dsp = {
-		.gpio_rst		= 6,
-		.gpio_int		= 34,
-		.cs			= 2,
-		.ext_irq		= 2,
-	},
-
 	.leds = {
 		{
 			.name		= "adsl-fail",
@@ -401,14 +392,6 @@ static struct board_info __initdata board_96348gw = {
 
 	.has_ohci0 = 1,
 
-	.has_dsp			= 1,
-	.dsp = {
-		.gpio_rst		= 6,
-		.gpio_int		= 34,
-		.ext_irq		= 2,
-		.cs			= 2,
-	},
-
 	.leds = {
 		{
 			.name		= "adsl-fail",
@@ -898,9 +881,6 @@ int __init board_register_devices(void)
 	if (board.has_usbd)
 		bcm63xx_usbd_register(&board.usbd);
 
-	if (board.has_dsp)
-		bcm63xx_dsp_register(&board.dsp);
-
 	/* Generate MAC address for WLAN and register our SPROM,
 	 * do this after registering enet devices
 	 */
diff --git a/arch/mips/bcm63xx/dev-dsp.c b/arch/mips/bcm63xx/dev-dsp.c
deleted file mode 100644
index 5bb5b154c9bd3..0000000000000
--- a/arch/mips/bcm63xx/dev-dsp.c
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Broadcom BCM63xx VoIP DSP registration
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 2009 Florian Fainelli <florian@openwrt.org>
- */
-
-#include <linux/init.h>
-#include <linux/kernel.h>
-#include <linux/platform_device.h>
-
-#include <bcm63xx_cpu.h>
-#include <bcm63xx_dev_dsp.h>
-#include <bcm63xx_regs.h>
-#include <bcm63xx_io.h>
-
-static struct resource voip_dsp_resources[] = {
-	{
-		.start		= -1, /* filled at runtime */
-		.end		= -1, /* filled at runtime */
-		.flags		= IORESOURCE_MEM,
-	},
-	{
-		.start		= -1, /* filled at runtime */
-		.flags		= IORESOURCE_IRQ,
-	},
-};
-
-static struct platform_device bcm63xx_voip_dsp_device = {
-	.name		= "bcm63xx-voip-dsp",
-	.id		= -1,
-	.num_resources	= ARRAY_SIZE(voip_dsp_resources),
-	.resource	= voip_dsp_resources,
-};
-
-int __init bcm63xx_dsp_register(const struct bcm63xx_dsp_platform_data *pd)
-{
-	struct bcm63xx_dsp_platform_data *dpd;
-	u32 val;
-
-	/* Get the memory window */
-	val = bcm_mpi_readl(MPI_CSBASE_REG(pd->cs - 1));
-	val &= MPI_CSBASE_BASE_MASK;
-	voip_dsp_resources[0].start = val;
-	voip_dsp_resources[0].end = val + 0xFFFFFFF;
-	voip_dsp_resources[1].start = pd->ext_irq;
-
-	/* copy given platform data */
-	dpd = bcm63xx_voip_dsp_device.dev.platform_data;
-	memcpy(dpd, pd, sizeof (*pd));
-
-	return platform_device_register(&bcm63xx_voip_dsp_device);
-}
diff --git a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h
deleted file mode 100644
index 4e4970787371a..0000000000000
--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h
+++ /dev/null
@@ -1,14 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef __BCM63XX_DSP_H
-#define __BCM63XX_DSP_H
-
-struct bcm63xx_dsp_platform_data {
-	unsigned gpio_rst;
-	unsigned gpio_int;
-	unsigned cs;
-	unsigned ext_irq;
-};
-
-int __init bcm63xx_dsp_register(const struct bcm63xx_dsp_platform_data *pd);
-
-#endif /* __BCM63XX_DSP_H */
diff --git a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
index 5e5b1bc4a3247..830f53f28e3f7 100644
--- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
+++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
@@ -7,7 +7,6 @@
 #include <linux/leds.h>
 #include <bcm63xx_dev_enet.h>
 #include <bcm63xx_dev_usb_usbd.h>
-#include <bcm63xx_dev_dsp.h>
 
 /*
  * flash mapping
@@ -31,7 +30,6 @@ struct board_info {
 	unsigned int	has_ohci0:1;
 	unsigned int	has_ehci0:1;
 	unsigned int	has_usbd:1;
-	unsigned int	has_dsp:1;
 	unsigned int	has_uart0:1;
 	unsigned int	has_uart1:1;
 
@@ -43,9 +41,6 @@ struct board_info {
 	/* USB config */
 	struct bcm63xx_usbd_platform_data usbd;
 
-	/* DSP config */
-	struct bcm63xx_dsp_platform_data dsp;
-
 	/* GPIO LEDs */
 	struct gpio_led leds[5];
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 057/343] IB/usnic: Fix out of bounds index check in query pkey
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 056/343] MIPS: BCM63XX: drop unused and broken DSP platform device Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 058/343] RDMA/ocrdma: " Greg Kroah-Hartman
                   ` (290 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gal Pressman, Parvi Kaustubhi,
	Jason Gunthorpe, Sasha Levin

From: Gal Pressman <galpress@amazon.com>

[ Upstream commit 4959d5da5737dd804255c75b8cea0a2929ce279a ]

The pkey table size is one element, index should be tested for > 0 instead
of > 1.

Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver")
Signed-off-by: Gal Pressman <galpress@amazon.com>
Acked-by: Parvi Kaustubhi <pkaustub@cisco.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
index fdfa25059723d..2602c7375d585 100644
--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
@@ -423,7 +423,7 @@ struct net_device *usnic_get_netdev(struct ib_device *device, u8 port_num)
 int usnic_ib_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
 				u16 *pkey)
 {
-	if (index > 1)
+	if (index > 0)
 		return -EINVAL;
 
 	*pkey = 0xffff;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 058/343] RDMA/ocrdma: Fix out of bounds index check in query pkey
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 057/343] IB/usnic: Fix out of bounds index check in query pkey Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 059/343] RDMA/qedr: " Greg Kroah-Hartman
                   ` (289 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gal Pressman, Jason Gunthorpe, Sasha Levin

From: Gal Pressman <galpress@amazon.com>

[ Upstream commit b188940796c7be31c1b8c25a9a0e0842c2e7a49e ]

The pkey table size is one element, index should be tested for > 0 instead
of > 1.

Fixes: fe2caefcdf58 ("RDMA/ocrdma: Add driver for Emulex OneConnect IBoE RDMA adapter")
Signed-off-by: Gal Pressman <galpress@amazon.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 27d5e8d9f08d3..7683d13dad3d5 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -55,7 +55,7 @@
 
 int ocrdma_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
 {
-	if (index > 1)
+	if (index > 0)
 		return -EINVAL;
 
 	*pkey = 0xffff;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 059/343] RDMA/qedr: Fix out of bounds index check in query pkey
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 058/343] RDMA/ocrdma: " Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 060/343] drm/shmob: Fix return value check in shmob_drm_probe Greg Kroah-Hartman
                   ` (288 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gal Pressman, Michal Kalderon,
	Jason Gunthorpe, Sasha Levin

From: Gal Pressman <galpress@amazon.com>

[ Upstream commit dbe30dae487e1a232158c24b432d45281c2805b7 ]

The pkey table size is QEDR_ROCE_PKEY_TABLE_LEN, index should be tested
for >= QEDR_ROCE_PKEY_TABLE_LEN instead of > QEDR_ROCE_PKEY_TABLE_LEN.

Fixes: a7efd7773e31 ("qedr: Add support for PD,PKEY and CQ verbs")
Signed-off-by: Gal Pressman <galpress@amazon.com>
Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/qedr/verbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 656e7c1a4449f..8bfe9073da78c 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -63,7 +63,7 @@ static inline int qedr_ib_copy_to_udata(struct ib_udata *udata, void *src,
 
 int qedr_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
 {
-	if (index > QEDR_ROCE_PKEY_TABLE_LEN)
+	if (index >= QEDR_ROCE_PKEY_TABLE_LEN)
 		return -EINVAL;
 
 	*pkey = QEDR_ROCE_PKEY_DEFAULT;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 060/343] drm/shmob: Fix return value check in shmob_drm_probe
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 059/343] RDMA/qedr: " Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.14 061/343] arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD Greg Kroah-Hartman
                   ` (287 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Simon Horman,
	Kieran Bingham, Laurent Pinchart, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 06c3bbd3c12737a50c2e981821b5585e1786e73d ]

In case of error, the function devm_ioremap_resource() returns ERR_PTR()
and never returns NULL. The NULL test in the return value check should
be replaced with IS_ERR().

Fixes: 8f1597c8f1a5 ("drm: shmobile: Perform initialization/cleanup at probe/remove time")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/shmobile/shmob_drm_drv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/shmobile/shmob_drm_drv.c b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
index 592572554eb0e..58d8a98c749b4 100644
--- a/drivers/gpu/drm/shmobile/shmob_drm_drv.c
+++ b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
@@ -233,8 +233,8 @@ static int shmob_drm_probe(struct platform_device *pdev)
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	sdev->mmio = devm_ioremap_resource(&pdev->dev, res);
-	if (sdev->mmio == NULL)
-		return -ENOMEM;
+	if (IS_ERR(sdev->mmio))
+		return PTR_ERR(sdev->mmio);
 
 	ret = shmob_drm_setup_clocks(sdev, pdata->clk_source);
 	if (ret < 0)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 061/343] arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 060/343] drm/shmob: Fix return value check in shmob_drm_probe Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 062/343] spi: cadence: Correct initialisation of runtime PM Greg Kroah-Hartman
                   ` (286 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Manabu Igusa, Loic Poulain,
	Bjorn Andersson, Andy Gross, Sasha Levin

From: Loic Poulain <loic.poulain@linaro.org>

[ Upstream commit af61bef513ba179559e56908b8c465e587bc3890 ]

In the same way as for msm8974-hammerhead, l11 load, used for SDCARD
VMMC, needs to be increased in order to prevent any voltage drop issues
(due to limited current) happening with some SDCARDS or during specific
operations (e.g. write).

Tested on Dragonboard-410c and DART-SD410 boards.

Fixes: 4c7d53d16d77 (arm64: dts: apq8016-sbc: add regulators support)
Reported-by: Manabu Igusa <migusa@arrowjapan.com>
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
index b6b44fdf7face..c1028b47edde9 100644
--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
@@ -458,6 +458,8 @@
 	l11 {
 		regulator-min-microvolt = <1750000>;
 		regulator-max-microvolt = <3337000>;
+		regulator-allow-set-load;
+		regulator-system-load = <200000>;
 	};
 
 	l12 {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 062/343] spi: cadence: Correct initialisation of runtime PM
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.14 061/343] arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 063/343] RDMA/iw_cxgb4: Fix the unchecked ep dereference Greg Kroah-Hartman
                   ` (285 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Charles Keepax, Mark Brown, Sasha Levin

From: Charles Keepax <ckeepax@opensource.cirrus.com>

[ Upstream commit 734882a8bf984c2ac8a57d8ac3ee53230bd0bed8 ]

Currently the driver calls pm_runtime_put_autosuspend but without ever
having done a pm_runtime_get, this causes the reference count in the pm
runtime core to become -1. The bad reference count causes the core to
sometimes suspend whilst an active SPI transfer is in progress.

arizona spi0.1: SPI transfer timed out
spi_master spi0: failed to transfer one message from queue

The correct proceedure is to do all the initialisation that requires the
hardware to be powered up before enabling the PM runtime, then enable
the PM runtime having called pm_runtime_set_active to inform it that the
hardware is currently powered up. The core will then power it down at
it's leisure and no explicit pm_runtime_put is required.

Fixes: d36ccd9f7ea4 ("spi: cadence: Runtime pm adaptation")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-cadence.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
index 02bd1eba045b8..d08ad93d97a15 100644
--- a/drivers/spi/spi-cadence.c
+++ b/drivers/spi/spi-cadence.c
@@ -584,11 +584,6 @@ static int cdns_spi_probe(struct platform_device *pdev)
 		goto clk_dis_apb;
 	}
 
-	pm_runtime_use_autosuspend(&pdev->dev);
-	pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
-	pm_runtime_set_active(&pdev->dev);
-	pm_runtime_enable(&pdev->dev);
-
 	ret = of_property_read_u32(pdev->dev.of_node, "num-cs", &num_cs);
 	if (ret < 0)
 		master->num_chipselect = CDNS_SPI_DEFAULT_NUM_CS;
@@ -603,8 +598,10 @@ static int cdns_spi_probe(struct platform_device *pdev)
 	/* SPI controller initializations */
 	cdns_spi_init_hw(xspi);
 
-	pm_runtime_mark_last_busy(&pdev->dev);
-	pm_runtime_put_autosuspend(&pdev->dev);
+	pm_runtime_set_active(&pdev->dev);
+	pm_runtime_enable(&pdev->dev);
+	pm_runtime_use_autosuspend(&pdev->dev);
+	pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
 
 	irq = platform_get_irq(pdev, 0);
 	if (irq <= 0) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 063/343] RDMA/iw_cxgb4: Fix the unchecked ep dereference
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 062/343] spi: cadence: Correct initialisation of runtime PM Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 064/343] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() Greg Kroah-Hartman
                   ` (284 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Raju Rangoju,
	Jason Gunthorpe, Sasha Levin

From: Raju Rangoju <rajur@chelsio.com>

[ Upstream commit 3352976c892301fd576a2e9ff0ac7337b2e2ca48 ]

The patch 944661dd97f4: "RDMA/iw_cxgb4: atomically lookup ep and get a
reference" from May 6, 2016, leads to the following Smatch complaint:

    drivers/infiniband/hw/cxgb4/cm.c:2953 terminate()
    error: we previously assumed 'ep' could be null (see line 2945)

Fixes: 944661dd97f4 ("RDMA/iw_cxgb4: atomically lookup ep and get a reference")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Raju Rangoju <rajur@chelsio.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cm.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index bb36cdf82a8d6..3668cc71b47e2 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2923,15 +2923,18 @@ static int terminate(struct c4iw_dev *dev, struct sk_buff *skb)
 	ep = get_ep_from_tid(dev, tid);
 	BUG_ON(!ep);
 
-	if (ep && ep->com.qp) {
-		pr_warn("TERM received tid %u qpid %u\n",
-			tid, ep->com.qp->wq.sq.qid);
-		attrs.next_state = C4IW_QP_STATE_TERMINATE;
-		c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
-			       C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+	if (ep) {
+		if (ep->com.qp) {
+			pr_warn("TERM received tid %u qpid %u\n", tid,
+				ep->com.qp->wq.sq.qid);
+			attrs.next_state = C4IW_QP_STATE_TERMINATE;
+			c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+				       C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+		}
+
+		c4iw_put_ep(&ep->com);
 	} else
 		pr_warn("TERM received tid %u no ep/qp\n", tid);
-	c4iw_put_ep(&ep->com);
 
 	return 0;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 064/343] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 063/343] RDMA/iw_cxgb4: Fix the unchecked ep dereference Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 065/343] media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL Greg Kroah-Hartman
                   ` (283 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Lucas Stach, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f8261c376e7f8cb9024af5a6c54be540c7f9108e ]

The etnaviv_gem_get_pages() never returns NULL.  It returns error
pointers on error.

Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_dump.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
index 2d955d7d7b6d8..e154e6fb64dac 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
@@ -207,7 +207,7 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu)
 		mutex_lock(&obj->lock);
 		pages = etnaviv_gem_get_pages(obj);
 		mutex_unlock(&obj->lock);
-		if (pages) {
+		if (!IS_ERR(pages)) {
 			int j;
 
 			iter.hdr->data[0] = bomap - bomap_start;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 065/343] media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 064/343] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 066/343] kbuild: mark prepare0 as PHONY to fix external module build Greg Kroah-Hartman
                   ` (282 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pawe? Chmiel, Jacek Anaszewski,
	Sylwester Nawrocki, Hans Verkuil, Mauro Carvalho Chehab,
	Sasha Levin

From: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>

[ Upstream commit 19c624c6b29e244c418f8b44a711cbf5e82e3cd4 ]

This commit corrects max and step values for v4l2 control for
V4L2_CID_JPEG_RESTART_INTERVAL. Max should be 0xffff and step should be 1.
It was found by using v4l2-compliance tool and checking result of
VIDIOC_QUERY_EXT_CTRL/QUERYMENU test.
Previously it was complaining that step was bigger than difference
between max and min.

Fixes: 15f4bc3b1f42 ("[media] s5p-jpeg: Add JPEG controls support")

Signed-off-by: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
Reviewed-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/s5p-jpeg/jpeg-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index 4568e68e15fa6..85a5e33600c03 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -2005,7 +2005,7 @@ static int s5p_jpeg_controls_create(struct s5p_jpeg_ctx *ctx)
 
 		v4l2_ctrl_new_std(&ctx->ctrl_handler, &s5p_jpeg_ctrl_ops,
 				  V4L2_CID_JPEG_RESTART_INTERVAL,
-				  0, 3, 0xffff, 0);
+				  0, 0xffff, 1, 0);
 		if (ctx->jpeg->variant->version == SJPEG_S5P)
 			mask = ~0x06; /* 422, 420 */
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 066/343] kbuild: mark prepare0 as PHONY to fix external module build
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 065/343] media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 067/343] crypto: brcm - Fix some set-but-not-used warning Greg Kroah-Hartman
                   ` (281 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Samuel Holland, Alexey Kardashevskiy,
	Masahiro Yamada, Ard Biesheuvel, Sasha Levin

From: Masahiro Yamada <yamada.masahiro@socionext.com>

[ Upstream commit e00d8880481497474792d28c14479a9fb6752046 ]

Commit c3ff2a5193fa ("powerpc/32: add stack protector support")
caused kernel panic on PowerPC when an external module is used with
CONFIG_STACKPROTECTOR because the 'prepare' target was not executed
for the external module build.

Commit e07db28eea38 ("kbuild: fix single target build for external
module") turned it into a build error because the 'prepare' target is
now executed but the 'prepare0' target is missing for the external
module build.

External module on arm/arm64 with CONFIG_STACKPROTECTOR_PER_TASK is
also broken in the same way.

Move 'PHONY += prepare0' to the common place. GNU Make is fine with
missing rule for phony targets. I also removed the comment which is
wrong irrespective of this commit.

I minimize the change so it can be easily backported to 4.20.x

To fix v4.20, please backport e07db28eea38 ("kbuild: fix single target
build for external module"), and then this commit.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=201891
Fixes: e07db28eea38 ("kbuild: fix single target build for external module")
Fixes: c3ff2a5193fa ("powerpc/32: add stack protector support")
Fixes: 189af4657186 ("ARM: smp: add support for per-task stack canaries")
Fixes: 0a1213fa7432 ("arm64: enable per-task stack canaries")
Cc: linux-stable <stable@vger.kernel.org> # v4.20
Reported-by: Samuel Holland <samuel@sholland.org>
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 3e8eaabf2bcbd..b538e6170f730 100644
--- a/Makefile
+++ b/Makefile
@@ -971,6 +971,7 @@ ifdef CONFIG_STACK_VALIDATION
   endif
 endif
 
+PHONY += prepare0
 
 ifeq ($(KBUILD_EXTMOD),)
 core-y		+= kernel/ certs/ mm/ fs/ ipc/ security/ crypto/ block/
@@ -1065,8 +1066,7 @@ include/config/kernel.release: include/config/auto.conf FORCE
 # archprepare is used in arch Makefiles and when processed asm symlink,
 # version.h and scripts_basic is processed / created.
 
-# Listed in dependency order
-PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3
+PHONY += prepare archprepare prepare1 prepare2 prepare3
 
 # prepare3 is used to check if we are building in a separate output directory,
 # and if so do:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 067/343] crypto: brcm - Fix some set-but-not-used warning
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 066/343] kbuild: mark prepare0 as PHONY to fix external module build Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 068/343] crypto: tgr192 - fix unaligned memory access Greg Kroah-Hartman
                   ` (280 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Raveendra Padasalagi,
	Herbert Xu, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 707d0cf8f7cff6dfee9197002859912310532c4f ]

Fixes gcc '-Wunused-but-set-variable' warning:

drivers/crypto/bcm/cipher.c: In function 'handle_ahash_req':
drivers/crypto/bcm/cipher.c:720:15: warning:
 variable 'chunk_start' set but not used [-Wunused-but-set-variable]

drivers/crypto/bcm/cipher.c: In function 'spu_rx_callback':
drivers/crypto/bcm/cipher.c:1679:31: warning:
 variable 'areq' set but not used [-Wunused-but-set-variable]

drivers/crypto/bcm/cipher.c:1678:22: warning:
 variable 'ctx' set but not used [-Wunused-but-set-variable]

Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/bcm/cipher.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
index 84422435f39b4..279e907590e98 100644
--- a/drivers/crypto/bcm/cipher.c
+++ b/drivers/crypto/bcm/cipher.c
@@ -718,7 +718,7 @@ static int handle_ahash_req(struct iproc_reqctx_s *rctx)
 	 */
 	unsigned int new_data_len;
 
-	unsigned int chunk_start = 0;
+	unsigned int __maybe_unused chunk_start = 0;
 	u32 db_size;	 /* Length of data field, incl gcm and hash padding */
 	int pad_len = 0; /* total pad len, including gcm, hash, stat padding */
 	u32 data_pad_len = 0;	/* length of GCM/CCM padding */
@@ -1676,8 +1676,6 @@ static void spu_rx_callback(struct mbox_client *cl, void *msg)
 	struct spu_hw *spu = &iproc_priv.spu;
 	struct brcm_message *mssg = msg;
 	struct iproc_reqctx_s *rctx;
-	struct iproc_ctx_s *ctx;
-	struct crypto_async_request *areq;
 	int err = 0;
 
 	rctx = mssg->ctx;
@@ -1687,8 +1685,6 @@ static void spu_rx_callback(struct mbox_client *cl, void *msg)
 		err = -EFAULT;
 		goto cb_finish;
 	}
-	areq = rctx->parent;
-	ctx = rctx->ctx;
 
 	/* process the SPU status */
 	err = spu->spu_status_process(rctx->msg_buf.rx_stat);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 068/343] crypto: tgr192 - fix unaligned memory access
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 067/343] crypto: brcm - Fix some set-but-not-used warning Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 069/343] ASoC: imx-sgtl5000: put of nodes if finding codec fails Greg Kroah-Hartman
                   ` (279 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Biggers, Herbert Xu, Sasha Levin

From: Eric Biggers <ebiggers@google.com>

[ Upstream commit f990f7fb58ac8ac9a43316f09a48cff1a49dda42 ]

Fix an unaligned memory access in tgr192_transform() by using the
unaligned access helpers.

Fixes: 06ace7a9bafe ("[CRYPTO] Use standard byte order macros wherever possible")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/tgr192.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/crypto/tgr192.c b/crypto/tgr192.c
index 321bc6ff2a9d1..904c8444aa0a2 100644
--- a/crypto/tgr192.c
+++ b/crypto/tgr192.c
@@ -25,8 +25,9 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/mm.h>
-#include <asm/byteorder.h>
 #include <linux/types.h>
+#include <asm/byteorder.h>
+#include <asm/unaligned.h>
 
 #define TGR192_DIGEST_SIZE 24
 #define TGR160_DIGEST_SIZE 20
@@ -468,10 +469,9 @@ static void tgr192_transform(struct tgr192_ctx *tctx, const u8 * data)
 	u64 a, b, c, aa, bb, cc;
 	u64 x[8];
 	int i;
-	const __le64 *ptr = (const __le64 *)data;
 
 	for (i = 0; i < 8; i++)
-		x[i] = le64_to_cpu(ptr[i]);
+		x[i] = get_unaligned_le64(data + i * sizeof(__le64));
 
 	/* save */
 	a = aa = tctx->a;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 069/343] ASoC: imx-sgtl5000: put of nodes if finding codec fails
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 068/343] crypto: tgr192 - fix unaligned memory access Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 070/343] IB/iser: Pass the correct number of entries for dma mapped SGL Greg Kroah-Hartman
                   ` (278 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Agner, Daniel Baluta,
	Nicolin Chen, Fabio Estevam, Mark Brown, Sasha Levin

From: Stefan Agner <stefan@agner.ch>

[ Upstream commit d9866572486802bc598a3e8576a5231378d190de ]

Make sure to properly put the of node in case finding the codec
fails.

Fixes: 81e8e4926167 ("ASoC: fsl: add sgtl5000 clock support for imx-sgtl5000")
Signed-off-by: Stefan Agner <stefan@agner.ch>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/fsl/imx-sgtl5000.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
index 8e525f7ac08d1..3d99a8579c99f 100644
--- a/sound/soc/fsl/imx-sgtl5000.c
+++ b/sound/soc/fsl/imx-sgtl5000.c
@@ -119,7 +119,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
 	codec_dev = of_find_i2c_device_by_node(codec_np);
 	if (!codec_dev) {
 		dev_err(&pdev->dev, "failed to find codec platform device\n");
-		return -EPROBE_DEFER;
+		ret = -EPROBE_DEFER;
+		goto fail;
 	}
 
 	data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 070/343] IB/iser: Pass the correct number of entries for dma mapped SGL
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 069/343] ASoC: imx-sgtl5000: put of nodes if finding codec fails Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 071/343] rtc: cmos: ignore bogus century byte Greg Kroah-Hartman
                   ` (277 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Israel Rukshin, Max Gurtovoy,
	Sagi Grimberg, Jason Gunthorpe, Sasha Levin

From: Israel Rukshin <israelr@mellanox.com>

[ Upstream commit 57b26497fabe1b9379b59fbc7e35e608e114df16 ]

ib_dma_map_sg() augments the SGL into a 'dma mapped SGL'. This process may
change the number of entries and the lengths of each entry.

Code that touches dma_address is iterating over the 'dma mapped SGL' and
must use dma_nents which returned from ib_dma_map_sg().

ib_sg_to_pages() and ib_map_mr_sg() are using dma_address so they must use
dma_nents.

Fixes: 39405885005a ("IB/iser: Port to new fast registration API")
Fixes: bfe066e256d5 ("IB/iser: Reuse ib_sg_to_pages")
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Acked-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/iser/iser_memory.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
index 322209d5ff582..19883169e7b76 100644
--- a/drivers/infiniband/ulp/iser/iser_memory.c
+++ b/drivers/infiniband/ulp/iser/iser_memory.c
@@ -240,8 +240,8 @@ int iser_fast_reg_fmr(struct iscsi_iser_task *iser_task,
 	page_vec->npages = 0;
 	page_vec->fake_mr.page_size = SIZE_4K;
 	plen = ib_sg_to_pages(&page_vec->fake_mr, mem->sg,
-			      mem->size, NULL, iser_set_page);
-	if (unlikely(plen < mem->size)) {
+			      mem->dma_nents, NULL, iser_set_page);
+	if (unlikely(plen < mem->dma_nents)) {
 		iser_err("page vec too short to hold this SG\n");
 		iser_data_buf_dump(mem, device->ib_device);
 		iser_dump_page_vec(page_vec);
@@ -450,10 +450,10 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
 
 	ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
 
-	n = ib_map_mr_sg(mr, mem->sg, mem->size, NULL, SIZE_4K);
-	if (unlikely(n != mem->size)) {
+	n = ib_map_mr_sg(mr, mem->sg, mem->dma_nents, NULL, SIZE_4K);
+	if (unlikely(n != mem->dma_nents)) {
 		iser_err("failed to map sg (%d/%d)\n",
-			 n, mem->size);
+			 n, mem->dma_nents);
 		return n < 0 ? n : -EINVAL;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 071/343] rtc: cmos: ignore bogus century byte
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 070/343] IB/iser: Pass the correct number of entries for dma mapped SGL Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 072/343] spi/topcliff_pch: Fix potential NULL dereference on allocation error Greg Kroah-Hartman
                   ` (276 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Alessandro Zummo,
	Sylvain Chouleur, Patrick McDermott, linux-rtc, Eric Wong,
	Sasha Levin

From: Eric Wong <e@80x24.org>

[ Upstream commit 2a4daadd4d3e507138f8937926e6a4df49c6bfdc ]

Older versions of Libreboot and Coreboot had an invalid value
(`3' in my case) in the century byte affecting the GM45 in
the Thinkpad X200.  Not everybody's updated their firmwares,
and Linux <= 4.2 was able to read the RTC without problems,
so workaround this by ignoring invalid values.

Fixes: 3c217e51d8a272b9 ("rtc: cmos: century support")

Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Sylvain Chouleur <sylvain.chouleur@intel.com>
Cc: Patrick McDermott <patrick.mcdermott@libiquity.com>
Cc: linux-rtc@vger.kernel.org
Signed-off-by: Eric Wong <e@80x24.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-mc146818-lib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c
index 2f1772a358ca5..18a6f15e313d8 100644
--- a/drivers/rtc/rtc-mc146818-lib.c
+++ b/drivers/rtc/rtc-mc146818-lib.c
@@ -82,7 +82,7 @@ unsigned int mc146818_get_time(struct rtc_time *time)
 	time->tm_year += real_year - 72;
 #endif
 
-	if (century)
+	if (century > 20)
 		time->tm_year += (century - 19) * 100;
 
 	/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 072/343] spi/topcliff_pch: Fix potential NULL dereference on allocation error
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 071/343] rtc: cmos: ignore bogus century byte Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 073/343] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it Greg Kroah-Hartman
                   ` (275 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Mark Brown, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit e902cdcb5112b89ee445588147964723fd69ffb4 ]

In pch_spi_handle_dma, it doesn't check for NULL returns of kcalloc
so it would result in an Oops.

Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-topcliff-pch.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index 4389ab80c23e6..fa730a871d252 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -1008,6 +1008,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
 
 	/* RX */
 	dma->sg_rx_p = kcalloc(num, sizeof(*dma->sg_rx_p), GFP_ATOMIC);
+	if (!dma->sg_rx_p)
+		return;
+
 	sg_init_table(dma->sg_rx_p, num); /* Initialize SG table */
 	/* offset, length setting */
 	sg = dma->sg_rx_p;
@@ -1068,6 +1071,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
 	}
 
 	dma->sg_tx_p = kcalloc(num, sizeof(*dma->sg_tx_p), GFP_ATOMIC);
+	if (!dma->sg_tx_p)
+		return;
+
 	sg_init_table(dma->sg_tx_p, num); /* Initialize SG table */
 	/* offset, length setting */
 	sg = dma->sg_tx_p;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 073/343] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 072/343] spi/topcliff_pch: Fix potential NULL dereference on allocation error Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 074/343] iwlwifi: mvm: avoid possible access out of array Greg Kroah-Hartman
                   ` (274 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 108a459ef4cd17a28711d81092044e597b5c7618 ]

The PLL-MIPI clock is somewhat special as it has its own LDOs which
need to be turned on for this PLL to actually work and output a clock
signal.

Add the 2 LDO enable bits to the gate bits.

Fixes: 5690879d93e8 ("clk: sunxi-ng: Add A23 CCU")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sunxi-ng/ccu-sun8i-a23.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
index d93b452f0df97..1cef040ebe829 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
@@ -132,7 +132,7 @@ static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_mipi_clk, "pll-mipi",
 				    8, 4,		/* N */
 				    4, 2,		/* K */
 				    0, 4,		/* M */
-				    BIT(31),		/* gate */
+				    BIT(31) | BIT(23) | BIT(22), /* gate */
 				    BIT(28),		/* lock */
 				    CLK_SET_RATE_UNGATE);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 074/343] iwlwifi: mvm: avoid possible access out of array.
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 073/343] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 075/343] net/mlx5: Take lock with IRQs disabled to avoid deadlock Greg Kroah-Hartman
                   ` (273 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mordechay Goodstein, Luca Coelho,
	Sasha Levin

From: Mordechay Goodstein <mordechay.goodstein@intel.com>

[ Upstream commit b0d795a9ae558209656b18930c2b4def5f8fdfb8 ]

The value in txq_id can be out of array scope,
validate it before accessing the array.

Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: cf961e16620f ("iwlwifi: mvm: support dqa-mode agg on non-shared queue")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 0cfdbaa2af3a7..684c0f65a0528 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2417,7 +2417,7 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 	struct iwl_mvm_tid_data *tid_data;
 	u16 normalized_ssn;
-	int txq_id;
+	u16 txq_id;
 	int ret;
 
 	if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
@@ -2452,17 +2452,24 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 	 */
 	txq_id = mvmsta->tid_data[tid].txq_id;
 	if (txq_id == IWL_MVM_INVALID_QUEUE) {
-		txq_id = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
-						 IWL_MVM_DQA_MIN_DATA_QUEUE,
-						 IWL_MVM_DQA_MAX_DATA_QUEUE);
-		if (txq_id < 0) {
-			ret = txq_id;
+		ret = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
+					      IWL_MVM_DQA_MIN_DATA_QUEUE,
+					      IWL_MVM_DQA_MAX_DATA_QUEUE);
+		if (ret < 0) {
 			IWL_ERR(mvm, "Failed to allocate agg queue\n");
 			goto release_locks;
 		}
 
+		txq_id = ret;
+
 		/* TXQ hasn't yet been enabled, so mark it only as reserved */
 		mvm->queue_info[txq_id].status = IWL_MVM_QUEUE_RESERVED;
+	} else if (WARN_ON(txq_id >= IWL_MAX_HW_QUEUES)) {
+		ret = -ENXIO;
+		IWL_ERR(mvm, "tid_id %d out of range (0, %d)!\n",
+			tid, IWL_MAX_HW_QUEUES - 1);
+		goto out;
+
 	} else if (unlikely(mvm->queue_info[txq_id].status ==
 			    IWL_MVM_QUEUE_SHARED)) {
 		ret = -ENXIO;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 075/343] net/mlx5: Take lock with IRQs disabled to avoid deadlock
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 074/343] iwlwifi: mvm: avoid possible access out of array Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 076/343] iwlwifi: mvm: fix A-MPDU reference assignment Greg Kroah-Hartman
                   ` (272 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Moni Shoua, Leon Romanovsky,
	Saeed Mahameed, Sasha Levin

From: Moni Shoua <monis@mellanox.com>

[ Upstream commit 33814e5d127e21f53b52e17b0722c1b57d4f4d29 ]

The lock in qp_table might be taken from process context or from
interrupt context. This may lead to a deadlock unless it is taken with
IRQs disabled.

Discovered by lockdep

================================
WARNING: inconsistent lock state
4.20.0-rc6
--------------------------------
inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W}

python/12572 [HC1[1]:SC0[0]:HE0:SE1] takes:
00000000052a4df4 (&(&table->lock)->rlock#2){?.+.}, /0x50 [mlx5_core]
{HARDIRQ-ON-W} state was registered at:
  _raw_spin_lock+0x33/0x70
  mlx5_get_rsc+0x1a/0x50 [mlx5_core]
  mlx5_ib_eqe_pf_action+0x493/0x1be0 [mlx5_ib]
  process_one_work+0x90c/0x1820
  worker_thread+0x87/0xbb0
  kthread+0x320/0x3e0
  ret_from_fork+0x24/0x30
irq event stamp: 103928
hardirqs last  enabled at (103927): [] nk+0x1a/0x1c
hardirqs last disabled at (103928): [] unk+0x1a/0x1c
softirqs last  enabled at (103924): [] tcp_sendmsg+0x31/0x40
softirqs last disabled at (103922): [] 80

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&(&table->lock)->rlock#2);

    lock(&(&table->lock)->rlock#2);

 *** DEADLOCK ***

Fixes: 032080ab43ac ("IB/mlx5: Lock QP during page fault handling")
Signed-off-by: Moni Shoua <monis@mellanox.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/qp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
index 5f091c6ea049d..b92d5690287b5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -44,14 +44,15 @@ static struct mlx5_core_rsc_common *mlx5_get_rsc(struct mlx5_core_dev *dev,
 {
 	struct mlx5_qp_table *table = &dev->priv.qp_table;
 	struct mlx5_core_rsc_common *common;
+	unsigned long flags;
 
-	spin_lock(&table->lock);
+	spin_lock_irqsave(&table->lock, flags);
 
 	common = radix_tree_lookup(&table->tree, rsn);
 	if (common)
 		atomic_inc(&common->refcount);
 
-	spin_unlock(&table->lock);
+	spin_unlock_irqrestore(&table->lock, flags);
 
 	if (!common) {
 		mlx5_core_warn(dev, "Async event for bogus resource 0x%x\n",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 076/343] iwlwifi: mvm: fix A-MPDU reference assignment
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 075/343] net/mlx5: Take lock with IRQs disabled to avoid deadlock Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 077/343] tty: ipwireless: Fix potential NULL pointer dereference Greg Kroah-Hartman
                   ` (271 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Danny Alexander, Johannes Berg,
	Luca Coelho, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit 1f7698abedeeb3fef3cbcf78e16f925df675a179 ]

The current code assigns the reference, and then goes to increment
it if the toggle bit has changed. That way, we get

Toggle  0  0  0  0  1  1  1  1
ID      1  1  1  1  1  2  2  2

Fix that by assigning the post-toggle ID to get

Toggle  0  0  0  0  1  1  1  1
ID      1  1  1  1  2  2  2  2

Reported-by: Danny Alexander <danny.alexander@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Fixes: fbe4112791b8 ("iwlwifi: mvm: update mpdu metadata API")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 7fb8bbaf21420..1a12e829e98b0 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -871,12 +871,12 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
 		bool toggle_bit = phy_info & IWL_RX_MPDU_PHY_AMPDU_TOGGLE;
 
 		rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
-		rx_status->ampdu_reference = mvm->ampdu_ref;
 		/* toggle is switched whenever new aggregation starts */
 		if (toggle_bit != mvm->ampdu_toggle) {
 			mvm->ampdu_ref++;
 			mvm->ampdu_toggle = toggle_bit;
 		}
+		rx_status->ampdu_reference = mvm->ampdu_ref;
 	}
 
 	rcu_read_lock();
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 077/343] tty: ipwireless: Fix potential NULL pointer dereference
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 076/343] iwlwifi: mvm: fix A-MPDU reference assignment Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 078/343] driver: uio: fix possible memory leak in __uio_register_device Greg Kroah-Hartman
                   ` (270 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, YueHaibing, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 7dd50e205b3348dc7784efbdf85723551de64a25 ]

There is a potential NULL pointer dereference in case
alloc_ctrl_packet() fails and returns NULL.

Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/ipwireless/hardware.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
index a6b8240af6cdd..960e9375a1a9e 100644
--- a/drivers/tty/ipwireless/hardware.c
+++ b/drivers/tty/ipwireless/hardware.c
@@ -1516,6 +1516,8 @@ static void ipw_send_setup_packet(struct ipw_hardware *hw)
 			sizeof(struct ipw_setup_get_version_query_packet),
 			ADDR_SETUP_PROT, TL_PROTOCOLID_SETUP,
 			TL_SETUP_SIGNO_GET_VERSION_QRY);
+	if (!ver_packet)
+		return;
 	ver_packet->header.length = sizeof(struct tl_setup_get_version_qry);
 
 	/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 078/343] driver: uio: fix possible memory leak in __uio_register_device
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 077/343] tty: ipwireless: Fix potential NULL pointer dereference Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 079/343] driver: uio: fix possible use-after-free " Greg Kroah-Hartman
                   ` (269 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Liu Jian, Hamish Martin, Sasha Levin

From: Liu Jian <liujian56@huawei.com>

[ Upstream commit 1a392b3de7c5747506b38fc14b2e79977d3c7770 ]

'idev' is malloced in __uio_register_device() and leak free it before
leaving from the uio_get_minor() error handing case, it will cause
memory leak.

Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Reviewed-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/uio/uio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index fb5c9701b1fbd..4e9b0ff79b131 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -939,8 +939,10 @@ int __uio_register_device(struct module *owner,
 	atomic_set(&idev->event, 0);
 
 	ret = uio_get_minor(idev);
-	if (ret)
+	if (ret) {
+		kfree(idev);
 		return ret;
+	}
 
 	idev->dev.devt = MKDEV(uio_major, idev->minor);
 	idev->dev.class = &uio_class;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 079/343] driver: uio: fix possible use-after-free in __uio_register_device
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 078/343] driver: uio: fix possible memory leak in __uio_register_device Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 080/343] crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments Greg Kroah-Hartman
                   ` (268 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Liu Jian, Hamish Martin, Sasha Levin

From: Liu Jian <liujian56@huawei.com>

[ Upstream commit 221a1f4ac12d2ab46246c160b2e00d1b1160d5d9 ]

In uio_dev_add_attributes() error handing case, idev is used after
device_unregister(), in which 'idev' has been released, touch idev cause
use-after-free.

Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Reviewed-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/uio/uio.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 4e9b0ff79b131..7c18536a3742a 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -944,6 +944,7 @@ int __uio_register_device(struct module *owner,
 		return ret;
 	}
 
+	device_initialize(&idev->dev);
 	idev->dev.devt = MKDEV(uio_major, idev->minor);
 	idev->dev.class = &uio_class;
 	idev->dev.parent = parent;
@@ -954,7 +955,7 @@ int __uio_register_device(struct module *owner,
 	if (ret)
 		goto err_device_create;
 
-	ret = device_register(&idev->dev);
+	ret = device_add(&idev->dev);
 	if (ret)
 		goto err_device_create;
 
@@ -986,9 +987,10 @@ int __uio_register_device(struct module *owner,
 err_request_irq:
 	uio_dev_del_attributes(idev);
 err_uio_dev_add_attributes:
-	device_unregister(&idev->dev);
+	device_del(&idev->dev);
 err_device_create:
 	uio_free_minor(idev);
+	put_device(&idev->dev);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(__uio_register_device);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 080/343] crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 079/343] driver: uio: fix possible use-after-free " Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 081/343] driver core: Do not resume suppliers under device_links_write_lock() Greg Kroah-Hartman
                   ` (267 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Corentin Labbe, Herbert Xu, Sasha Levin

From: Corentin Labbe <clabbe@baylibre.com>

[ Upstream commit 6e88098ca43a3d80ae86908f7badba683c8a0d84 ]

When building without CONFIG_HW_RANDOM_PPC4XX, I hit the following build failure:
drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_probe':
drivers/crypto/amcc/crypto4xx_core.c:1407:20: error: passing argument 1 of 'ppc4xx_trng_probe' from incompatible pointer type [-Werror=incompatible-pointer-types]
In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
drivers/crypto/amcc/crypto4xx_trng.h:28:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_remove':
drivers/crypto/amcc/crypto4xx_core.c:1434:21: error: passing argument 1 of 'ppc4xx_trng_remove' from incompatible pointer type [-Werror=incompatible-pointer-types]
In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
drivers/crypto/amcc/crypto4xx_trng.h:30:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'

This patch fix the needed argument of ppc4xx_trng_probe()/ppc4xx_trng_remove() in that case.

Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx")
Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/amcc/crypto4xx_trng.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/amcc/crypto4xx_trng.h b/drivers/crypto/amcc/crypto4xx_trng.h
index 931d22531f515..7bbda51b7337c 100644
--- a/drivers/crypto/amcc/crypto4xx_trng.h
+++ b/drivers/crypto/amcc/crypto4xx_trng.h
@@ -26,9 +26,9 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev);
 void ppc4xx_trng_remove(struct crypto4xx_core_device *core_dev);
 #else
 static inline void ppc4xx_trng_probe(
-	struct crypto4xx_device *dev __maybe_unused) { }
+	struct crypto4xx_core_device *dev __maybe_unused) { }
 static inline void ppc4xx_trng_remove(
-	struct crypto4xx_device *dev __maybe_unused) { }
+	struct crypto4xx_core_device *dev __maybe_unused) { }
 #endif
 
 #endif
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 081/343] driver core: Do not resume suppliers under device_links_write_lock()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 080/343] crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 082/343] ARM: dts: lpc32xx: add required clocks property to keypad device node Greg Kroah-Hartman
                   ` (266 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit 5db25c9eb893df8f6b93c1d97b8006d768e1b6f5 ]

It is incorrect to call pm_runtime_get_sync() under
device_links_write_lock(), because it may end up trying to take
device_links_read_lock() while resuming the target device and that
will deadlock in the non-SRCU case, so avoid that by resuming the
supplier device in device_link_add() before calling
device_links_write_lock().

Fixes: 21d5c57b3726 ("PM / runtime: Use device links")
Fixes: baa8809f6097 ("PM / runtime: Optimize the use of device links")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/core.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 2b0a1054535ce..93c2fc58013ed 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -180,11 +180,20 @@ struct device_link *device_link_add(struct device *consumer,
 				    struct device *supplier, u32 flags)
 {
 	struct device_link *link;
+	bool rpm_put_supplier = false;
 
 	if (!consumer || !supplier ||
 	    ((flags & DL_FLAG_STATELESS) && (flags & DL_FLAG_AUTOREMOVE)))
 		return NULL;
 
+	if (flags & DL_FLAG_PM_RUNTIME && flags & DL_FLAG_RPM_ACTIVE) {
+		if (pm_runtime_get_sync(supplier) < 0) {
+			pm_runtime_put_noidle(supplier);
+			return NULL;
+		}
+		rpm_put_supplier = true;
+	}
+
 	device_links_write_lock();
 	device_pm_lock();
 
@@ -209,13 +218,8 @@ struct device_link *device_link_add(struct device *consumer,
 
 	if (flags & DL_FLAG_PM_RUNTIME) {
 		if (flags & DL_FLAG_RPM_ACTIVE) {
-			if (pm_runtime_get_sync(supplier) < 0) {
-				pm_runtime_put_noidle(supplier);
-				kfree(link);
-				link = NULL;
-				goto out;
-			}
 			link->rpm_active = true;
+			rpm_put_supplier = false;
 		}
 		pm_runtime_new_link(consumer);
 		/*
@@ -286,6 +290,10 @@ struct device_link *device_link_add(struct device *consumer,
  out:
 	device_pm_unlock();
 	device_links_write_unlock();
+
+	if (rpm_put_supplier)
+		pm_runtime_put(supplier);
+
 	return link;
 }
 EXPORT_SYMBOL_GPL(device_link_add);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 082/343] ARM: dts: lpc32xx: add required clocks property to keypad device node
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 081/343] driver core: Do not resume suppliers under device_links_write_lock() Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 083/343] ARM: dts: lpc32xx: reparent keypad controller to SIC1 Greg Kroah-Hartman
                   ` (265 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit 3e88bc38b9f6fe4b69cecf81badd3c19fde97f97 ]

NXP LPC32xx keypad controller requires a clock property to be defined.

The change fixes the driver initialization problem:

  lpc32xx_keys 40050000.key: failed to get clock
  lpc32xx_keys: probe of 40050000.key failed with error -2

Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc32xx.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index d077bd2b9583e..2ca881055ef0e 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -462,6 +462,7 @@
 			key: key@40050000 {
 				compatible = "nxp,lpc3220-key";
 				reg = <0x40050000 0x1000>;
+				clocks = <&clk LPC32XX_CLK_KEY>;
 				interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
 				status = "disabled";
 			};
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 083/343] ARM: dts: lpc32xx: reparent keypad controller to SIC1
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 082/343] ARM: dts: lpc32xx: add required clocks property to keypad device node Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 084/343] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant Greg Kroah-Hartman
                   ` (264 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit 489261c45f0ebbc1c2813f337bbdf858267f5033 ]

After switching to a new interrupt controller scheme by separating SIC1
and SIC2 from MIC interrupt controller just one SoC keypad controller
was not taken into account, fix it now:

  WARNING: CPU: 0 PID: 1 at kernel/irq/irqdomain.c:524 irq_domain_associate+0x50/0x1b0
  error: hwirq 0x36 is too large for interrupt-controller@40008000
  ...
  lpc32xx_keys 40050000.key: failed to get platform irq
  lpc32xx_keys: probe of 40050000.key failed with error -22

Fixes: 9b8ad3fb81ae ("ARM: dts: lpc32xx: reparent SIC1 and SIC2 interrupts from MIC")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc32xx.dtsi | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index 2ca881055ef0e..9f9386c926d1e 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -463,7 +463,8 @@
 				compatible = "nxp,lpc3220-key";
 				reg = <0x40050000 0x1000>;
 				clocks = <&clk LPC32XX_CLK_KEY>;
-				interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
+				interrupt-parent = <&sic1>;
+				interrupts = <22 IRQ_TYPE_LEVEL_HIGH>;
 				status = "disabled";
 			};
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 084/343] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 083/343] ARM: dts: lpc32xx: reparent keypad controller to SIC1 Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 085/343] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property Greg Kroah-Hartman
                   ` (263 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit 7a0790a4121cbcd111cc537cdc801c46ccb789ee ]

ARM PrimeCell PL111 LCD controller is found on On NXP LPC3230
and LPC3250 SoCs variants, the original reference in compatible
property to an older one ARM PrimeCell PL110 is invalid.

Fixes: e04920d9efcb3 ("ARM: LPC32xx: DTS files for device tree conversion")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc32xx.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index 9f9386c926d1e..a08ebc9509234 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -139,7 +139,7 @@
 		};
 
 		clcd: clcd@31040000 {
-			compatible = "arm,pl110", "arm,primecell";
+			compatible = "arm,pl111", "arm,primecell";
 			reg = <0x31040000 0x1000>;
 			interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&clk LPC32XX_CLK_LCD>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 085/343] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 084/343] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 086/343] ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage Greg Kroah-Hartman
                   ` (262 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit 30fc01bae3cda747e7d9c352b1aa51ca113c8a9d ]

The originally added ARM PrimeCell PL111 clocks property misses
the required "clcdclk" clock, which is the same as a clock to enable
the LCD controller on NXP LPC3230 and NXP LPC3250 SoCs.

Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc32xx.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index a08ebc9509234..c5b119ddb70b8 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -142,8 +142,8 @@
 			compatible = "arm,pl111", "arm,primecell";
 			reg = <0x31040000 0x1000>;
 			interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&clk LPC32XX_CLK_LCD>;
-			clock-names = "apb_pclk";
+			clocks = <&clk LPC32XX_CLK_LCD>, <&clk LPC32XX_CLK_LCD>;
+			clock-names = "clcdclk", "apb_pclk";
 			status = "disabled";
 		};
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 086/343] ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 085/343] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 087/343] iwlwifi: mvm: fix RSS config command Greg Kroah-Hartman
                   ` (261 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit dc141b99fc36cf910a1d8d5ee30f43f2442fd1bd ]

The fixed voltage regulator on Phytec phyCORE-LPC3250 board, which
supplies SD/MMC card's power, has a constant output voltage level
of either 3.15V or 3.3V, the actual value depends on JP4 position,
the power rail is referenced as VCC_SDIO in the board hardware manual.

Fixes: d06670e96267 ("arm: dts: phy3250: add SD fixed regulator")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc3250-phy3250.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/lpc3250-phy3250.dts b/arch/arm/boot/dts/lpc3250-phy3250.dts
index b7bd3a110a8dd..dd0bdf765599d 100644
--- a/arch/arm/boot/dts/lpc3250-phy3250.dts
+++ b/arch/arm/boot/dts/lpc3250-phy3250.dts
@@ -49,8 +49,8 @@
 		sd_reg: regulator@2 {
 			compatible = "regulator-fixed";
 			regulator-name = "sd_reg";
-			regulator-min-microvolt = <1800000>;
-			regulator-max-microvolt = <1800000>;
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3300000>;
 			gpio = <&gpio 5 5 0>;
 			enable-active-high;
 		};
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 087/343] iwlwifi: mvm: fix RSS config command
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 086/343] ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 088/343] staging: most: cdev: add missing check for cdev_add failure Greg Kroah-Hartman
                   ` (260 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sara Sharon, Luca Coelho, Sasha Levin

From: Sara Sharon <sara.sharon@intel.com>

[ Upstream commit 608dce95db10b8ee1a26dbce3f60204bb69812a5 ]

The hash mask is a bitmap, so we should use BIT() on
the enum values.

Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Fixes: 43413a975d06 ("iwlwifi: mvm: support rss queues configuration command")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 78228f870f8f5..754dcc1c1f400 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -107,12 +107,12 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
 	int i;
 	struct iwl_rss_config_cmd cmd = {
 		.flags = cpu_to_le32(IWL_RSS_ENABLE),
-		.hash_mask = IWL_RSS_HASH_TYPE_IPV4_TCP |
-			     IWL_RSS_HASH_TYPE_IPV4_UDP |
-			     IWL_RSS_HASH_TYPE_IPV4_PAYLOAD |
-			     IWL_RSS_HASH_TYPE_IPV6_TCP |
-			     IWL_RSS_HASH_TYPE_IPV6_UDP |
-			     IWL_RSS_HASH_TYPE_IPV6_PAYLOAD,
+		.hash_mask = BIT(IWL_RSS_HASH_TYPE_IPV4_TCP) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV4_UDP) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV4_PAYLOAD) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV6_TCP) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV6_UDP) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV6_PAYLOAD),
 	};
 
 	if (mvm->trans->num_rx_queues == 1)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 088/343] staging: most: cdev: add missing check for cdev_add failure
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 087/343] iwlwifi: mvm: fix RSS config command Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 089/343] rtc: ds1672: fix unintended sign extension Greg Kroah-Hartman
                   ` (259 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Colin Ian King, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 5ae890780e1b4d08f2c0c5d4ea96fc3928fc0ee9 ]

Currently the call to cdev_add is missing a check for failure. Fix this by
checking for failure and exiting via a new error path that ensures the
allocated comp_channel struct is kfree'd.

Detected by CoverityScan, CID#1462359 ("Unchecked return value")

Fixes: 9bc79bbcd0c5 ("Staging: most: add MOST driver's aim-cdev module")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/most/aim-cdev/cdev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/most/aim-cdev/cdev.c b/drivers/staging/most/aim-cdev/cdev.c
index 1e5cbc893496a..d000b6ff8a7d2 100644
--- a/drivers/staging/most/aim-cdev/cdev.c
+++ b/drivers/staging/most/aim-cdev/cdev.c
@@ -455,7 +455,9 @@ static int aim_probe(struct most_interface *iface, int channel_id,
 	c->devno = MKDEV(major, current_minor);
 	cdev_init(&c->cdev, &channel_fops);
 	c->cdev.owner = THIS_MODULE;
-	cdev_add(&c->cdev, c->devno, 1);
+	retval = cdev_add(&c->cdev, c->devno, 1);
+	if (retval < 0)
+		goto err_free_c;
 	c->iface = iface;
 	c->cfg = cfg;
 	c->channel_id = channel_id;
@@ -491,6 +493,7 @@ error_create_device:
 	list_del(&c->list);
 error_alloc_kfifo:
 	cdev_del(&c->cdev);
+err_free_c:
 	kfree(c);
 error_alloc_channel:
 	ida_simple_remove(&minor_id, current_minor);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 089/343] rtc: ds1672: fix unintended sign extension
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 088/343] staging: most: cdev: add missing check for cdev_add failure Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 090/343] thermal: mediatek: fix register index error Greg Kroah-Hartman
                   ` (258 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandre Belloni,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit f0c04c276739ed8acbb41b4868e942a55b128dca ]

Shifting a u8 by 24 will cause the value to be promoted to an integer. If
the top bit of the u8 is set then the following conversion to an unsigned
long will sign extend the value causing the upper 32 bits to be set in
the result.

Fix this by casting the u8 value to an unsigned long before the shift.

Detected by CoverityScan, CID#138801 ("Unintended sign extension")

Fixes: edf1aaa31fc5 ("[PATCH] RTC subsystem: DS1672 driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-ds1672.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
index 9caaccccaa575..b1ebca099b0df 100644
--- a/drivers/rtc/rtc-ds1672.c
+++ b/drivers/rtc/rtc-ds1672.c
@@ -58,7 +58,8 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
 		"%s: raw read data - counters=%02x,%02x,%02x,%02x\n",
 		__func__, buf[0], buf[1], buf[2], buf[3]);
 
-	time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	time = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+	       (buf[1] << 8) | buf[0];
 
 	rtc_time_to_tm(time, tm);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 090/343] thermal: mediatek: fix register index error
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 089/343] rtc: ds1672: fix unintended sign extension Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 091/343] net: phy: fixed_phy: Fix fixed_phy not checking GPIO Greg Kroah-Hartman
                   ` (257 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Kao, Eduardo Valentin, Sasha Levin

From: Michael Kao <michael.kao@mediatek.com>

[ Upstream commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6 ]

The index of msr and adcpnp should match the sensor
which belongs to the selected bank in the for loop.

Fixes: b7cf0053738c ("thermal: Add Mediatek thermal driver for mt2701.")
Signed-off-by: Michael Kao <michael.kao@mediatek.com>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/mtk_thermal.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
index 1e61c09153c9a..76b92083744c9 100644
--- a/drivers/thermal/mtk_thermal.c
+++ b/drivers/thermal/mtk_thermal.c
@@ -407,7 +407,8 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank)
 	u32 raw;
 
 	for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) {
-		raw = readl(mt->thermal_base + conf->msr[i]);
+		raw = readl(mt->thermal_base +
+			    conf->msr[conf->bank_data[bank->id].sensors[i]]);
 
 		temp = raw_to_mcelsius(mt,
 				       conf->bank_data[bank->id].sensors[i],
@@ -544,7 +545,8 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num,
 
 	for (i = 0; i < conf->bank_data[num].num_sensors; i++)
 		writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]],
-		       mt->thermal_base + conf->adcpnp[i]);
+		       mt->thermal_base +
+		       conf->adcpnp[conf->bank_data[num].sensors[i]]);
 
 	writel((1 << conf->bank_data[num].num_sensors) - 1,
 	       mt->thermal_base + TEMP_MONCTL0);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 091/343] net: phy: fixed_phy: Fix fixed_phy not checking GPIO
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 090/343] thermal: mediatek: fix register index error Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 092/343] rtc: ds1307: rx8130: Fix alarm handling Greg Kroah-Hartman
                   ` (256 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Moritz Fischer,
	David S. Miller, Sasha Levin

From: Moritz Fischer <mdf@kernel.org>

[ Upstream commit 8f289805616e81f7c1690931aa8a586c76f4fa88 ]

Fix fixed_phy not checking GPIO if no link_update callback
is registered.

In the original version all users registered a link_update
callback so the issue was masked.

Fixes: a5597008dbc2 ("phy: fixed_phy: Add gpio to determine link up/down.")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Moritz Fischer <mdf@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/fixed_phy.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index eb51672106811..3ab2eb677a599 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -67,11 +67,11 @@ static int fixed_mdio_read(struct mii_bus *bus, int phy_addr, int reg_num)
 			do {
 				s = read_seqcount_begin(&fp->seqcount);
 				/* Issue callback if user registered it. */
-				if (fp->link_update) {
+				if (fp->link_update)
 					fp->link_update(fp->phydev->attached_dev,
 							&fp->status);
-					fixed_phy_update(fp);
-				}
+				/* Check the GPIO for change in status */
+				fixed_phy_update(fp);
 				state = fp->status;
 			} while (read_seqcount_retry(&fp->seqcount, s));
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 092/343] rtc: ds1307: rx8130: Fix alarm handling
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 091/343] net: phy: fixed_phy: Fix fixed_phy not checking GPIO Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 093/343] rtc: 88pm860x: fix unintended sign extension Greg Kroah-Hartman
                   ` (255 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König,
	Alexandre Belloni, Sasha Levin

From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

[ Upstream commit 3f929cad943380370b6db31fcb7a38d898d91089 ]

When the EXTENSION.WADA bit is set, register 0x19 contains a bitmap of
week days, not a day of month. As Linux only handles a single alarm
without repetition using day of month is more flexible, so clear this
bit. (Otherwise a value depending on time.tm_wday would have to be
written to register 0x19.)

Also optimize setting the AIE bit to use a single register write instead
of a bulk write of three registers.

Fixes: ee0981be7704 ("rtc: ds1307: Add support for Epson RX8130CE")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-ds1307.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index e7d9215c9201b..8d45d93b1db67 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -733,8 +733,8 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
 	if (ret < 0)
 		return ret;
 
-	ctl[0] &= ~RX8130_REG_EXTENSION_WADA;
-	ctl[1] |= RX8130_REG_FLAG_AF;
+	ctl[0] &= RX8130_REG_EXTENSION_WADA;
+	ctl[1] &= ~RX8130_REG_FLAG_AF;
 	ctl[2] &= ~RX8130_REG_CONTROL0_AIE;
 
 	ret = regmap_bulk_write(ds1307->regmap, RX8130_REG_EXTENSION, ctl,
@@ -757,8 +757,7 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
 
 	ctl[2] |= RX8130_REG_CONTROL0_AIE;
 
-	return regmap_bulk_write(ds1307->regmap, RX8130_REG_EXTENSION, ctl,
-				 sizeof(ctl));
+	return regmap_write(ds1307->regmap, RX8130_REG_CONTROL0, ctl[2]);
 }
 
 static int rx8130_alarm_irq_enable(struct device *dev, unsigned int enabled)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 093/343] rtc: 88pm860x: fix unintended sign extension
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 092/343] rtc: ds1307: rx8130: Fix alarm handling Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 094/343] rtc: 88pm80x: " Greg Kroah-Hartman
                   ` (254 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandre Belloni,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit dc9e47160626cdb58d5c39a4f43dcfdb27a5c004 ]

Shifting a u8 by 24 will cause the value to be promoted to an integer. If
the top bit of the u8 is set then the following conversion to an unsigned
long will sign extend the value causing the upper 32 bits to be set in
the result.

Fix this by casting the u8 value to an unsigned long before the shift.

Detected by CoverityScan, CID#144925-144928 ("Unintended sign extension")

Fixes: 008b30408c40 ("mfd: Add rtc support to 88pm860x")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-88pm860x.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
index 166faae3a59cd..7d3e5168fcefc 100644
--- a/drivers/rtc/rtc-88pm860x.c
+++ b/drivers/rtc/rtc-88pm860x.c
@@ -115,11 +115,13 @@ static int pm860x_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
+	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
+		(buf[5] << 8) | buf[7];
 
 	/* load 32-bit read-only counter */
 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -145,7 +147,8 @@ static int pm860x_rtc_set_time(struct device *dev, struct rtc_time *tm)
 
 	/* load 32-bit read-only counter */
 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	base = ticks - data;
 	dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -170,10 +173,12 @@ static int pm860x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
+	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
+		(buf[5] << 8) | buf[7];
 
 	pm860x_bulk_read(info->i2c, PM8607_RTC_EXPIRE1, 4, buf);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -198,11 +203,13 @@ static int pm860x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
+	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
+		(buf[5] << 8) | buf[7];
 
 	/* load 32-bit read-only counter */
 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 094/343] rtc: 88pm80x: fix unintended sign extension
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 093/343] rtc: 88pm860x: fix unintended sign extension Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 095/343] rtc: pm8xxx: " Greg Kroah-Hartman
                   ` (253 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandre Belloni,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit fb0b322537a831b5b0cb948c56f8f958ce493d3a ]

Shifting a u8 by 24 will cause the value to be promoted to an integer. If
the top bit of the u8 is set then the following conversion to an unsigned
long will sign extend the value causing the upper 32 bits to be set in
the result.

Fix this by casting the u8 value to an unsigned long before the shift.

Detected by CoverityScan, CID#714646-714649 ("Unintended sign extension")

Fixes: 2985c29c1964 ("rtc: Add rtc support to 88PM80X PMIC")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-88pm80x.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/rtc/rtc-88pm80x.c b/drivers/rtc/rtc-88pm80x.c
index 466bf7f9a285a..7da2a1fb50f89 100644
--- a/drivers/rtc/rtc-88pm80x.c
+++ b/drivers/rtc/rtc-88pm80x.c
@@ -116,12 +116,14 @@ static int pm80x_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	unsigned char buf[4];
 	unsigned long ticks, base, data;
 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
 
 	/* load 32-bit read-only counter */
 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -144,7 +146,8 @@ static int pm80x_rtc_set_time(struct device *dev, struct rtc_time *tm)
 
 	/* load 32-bit read-only counter */
 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	base = ticks - data;
 	dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -165,11 +168,13 @@ static int pm80x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	int ret;
 
 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
 
 	regmap_raw_read(info->map, PM800_RTC_EXPIRE1_1, buf, 4);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -192,12 +197,14 @@ static int pm80x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	regmap_update_bits(info->map, PM800_RTC_CONTROL, PM800_ALARM1_EN, 0);
 
 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
 
 	/* load 32-bit read-only counter */
 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 095/343] rtc: pm8xxx: fix unintended sign extension
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 094/343] rtc: 88pm80x: " Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 096/343] fbdev: chipsfb: remove set but not used variable size Greg Kroah-Hartman
                   ` (252 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandre Belloni,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit e42280886018c6f77f0a90190f7cba344b0df3e0 ]

Shifting a u8 by 24 will cause the value to be promoted to an integer. If
the top bit of the u8 is set then the following conversion to an unsigned
long will sign extend the value causing the upper 32 bits to be set in
the result.

Fix this by casting the u8 value to an unsigned long before the shift.

Detected by CoverityScan, CID#1309693 ("Unintended sign extension")

Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-pm8xxx.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
index fac835530671f..a1b4b0ed1f196 100644
--- a/drivers/rtc/rtc-pm8xxx.c
+++ b/drivers/rtc/rtc-pm8xxx.c
@@ -186,7 +186,8 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
 		}
 	}
 
-	secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
+	secs = value[0] | (value[1] << 8) | (value[2] << 16) |
+	       ((unsigned long)value[3] << 24);
 
 	rtc_time_to_tm(secs, tm);
 
@@ -267,7 +268,8 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
 		return rc;
 	}
 
-	secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
+	secs = value[0] | (value[1] << 8) | (value[2] << 16) |
+	       ((unsigned long)value[3] << 24);
 
 	rtc_time_to_tm(secs, &alarm->time);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 096/343] fbdev: chipsfb: remove set but not used variable size
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 095/343] rtc: pm8xxx: " Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 097/343] iw_cxgb4: use tos when importing the endpoint Greg Kroah-Hartman
                   ` (251 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Michael Ellerman,
	Daniel Vetter, Christophe Leroy, Bartlomiej Zolnierkiewicz,
	Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 8e71fa5e4d86bedfd26df85381d65d6b4c860020 ]

Fixes gcc '-Wunused-but-set-variable' warning:

drivers/video/fbdev/chipsfb.c: In function 'chipsfb_pci_init':
drivers/video/fbdev/chipsfb.c:352:22: warning:
 variable 'size' set but not used [-Wunused-but-set-variable]

Fixes: 8c8709334cec ("[PATCH] ppc32: Remove CONFIG_PMAC_PBOOK").
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Christophe Leroy <christophe.leroy@c-s.fr>
[b.zolnierkie: minor commit summary and description fixups]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/chipsfb.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
index f103665cad431..f9b366d175875 100644
--- a/drivers/video/fbdev/chipsfb.c
+++ b/drivers/video/fbdev/chipsfb.c
@@ -350,7 +350,7 @@ static void init_chips(struct fb_info *p, unsigned long addr)
 static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
 {
 	struct fb_info *p;
-	unsigned long addr, size;
+	unsigned long addr;
 	unsigned short cmd;
 	int rc = -ENODEV;
 
@@ -362,7 +362,6 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
 	if ((dp->resource[0].flags & IORESOURCE_MEM) == 0)
 		goto err_disable;
 	addr = pci_resource_start(dp, 0);
-	size = pci_resource_len(dp, 0);
 	if (addr == 0)
 		goto err_disable;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 097/343] iw_cxgb4: use tos when importing the endpoint
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 096/343] fbdev: chipsfb: remove set but not used variable size Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 098/343] iw_cxgb4: use tos when finding ipv6 routes Greg Kroah-Hartman
                   ` (250 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve Wise, Jason Gunthorpe, Sasha Levin

From: Steve Wise <swise@opengridcomputing.com>

[ Upstream commit cb3ba0bde881f0cb7e3945d2a266901e2bd18c92 ]

import_ep() is passed the correct tos, but doesn't use it correctly.

Fixes: ac8e4c69a021 ("cxgb4/iw_cxgb4: TOS support")
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 3668cc71b47e2..942403e42dd0f 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2056,7 +2056,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
 	} else {
 		pdev = get_real_dev(n->dev);
 		ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
-					n, pdev, 0);
+					n, pdev, rt_tos2priority(tos));
 		if (!ep->l2t)
 			goto out;
 		ep->mtu = dst_mtu(dst);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 098/343] iw_cxgb4: use tos when finding ipv6 routes
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 097/343] iw_cxgb4: use tos when importing the endpoint Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 099/343] drm/etnaviv: potential NULL dereference Greg Kroah-Hartman
                   ` (249 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve Wise, Jason Gunthorpe, Sasha Levin

From: Steve Wise <swise@opengridcomputing.com>

[ Upstream commit c8a7eb554a83214c3d8ee5cb322da8c72810d2dc ]

When IPv6 support was added, the correct tos was not passed to
cxgb_find_route6(). This potentially results in the wrong route entry.

Fixes: 830662f6f032 ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address")
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 942403e42dd0f..7eb1cc1b1aa04 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2147,7 +2147,8 @@ static int c4iw_reconnect(struct c4iw_ep *ep)
 					   laddr6->sin6_addr.s6_addr,
 					   raddr6->sin6_addr.s6_addr,
 					   laddr6->sin6_port,
-					   raddr6->sin6_port, 0,
+					   raddr6->sin6_port,
+					   ep->com.cm_id->tos,
 					   raddr6->sin6_scope_id);
 		iptype = 6;
 		ra = (__u8 *)&raddr6->sin6_addr;
@@ -3298,7 +3299,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
 					   laddr6->sin6_addr.s6_addr,
 					   raddr6->sin6_addr.s6_addr,
 					   laddr6->sin6_port,
-					   raddr6->sin6_port, 0,
+					   raddr6->sin6_port, cm_id->tos,
 					   raddr6->sin6_scope_id);
 	}
 	if (!ep->dst) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 099/343] drm/etnaviv: potential NULL dereference
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 098/343] iw_cxgb4: use tos when finding ipv6 routes Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 100/343] pinctrl: sh-pfc: emev2: Add missing pinmux functions Greg Kroah-Hartman
                   ` (248 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Christian Gmeiner,
	Lucas Stach, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 9e05352340d3a3e68c144136db9810b26ebb88c3 ]

The etnaviv_gem_prime_get_sg_table() is supposed to return error
pointers.  Otherwise it can lead to a NULL dereference when it's called
from drm_gem_map_dma_buf().

Fixes: 5f4a4a73f437 ("drm/etnaviv: fix gem_prime_get_sg_table to return new SG table")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
index ae884723e9b1b..880b95511b987 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
@@ -26,7 +26,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj)
 	int npages = obj->size >> PAGE_SHIFT;
 
 	if (WARN_ON(!etnaviv_obj->pages))  /* should have already pinned! */
-		return NULL;
+		return ERR_PTR(-EINVAL);
 
 	return drm_prime_pages_to_sg(etnaviv_obj->pages, npages);
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 100/343] pinctrl: sh-pfc: emev2: Add missing pinmux functions
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 099/343] drm/etnaviv: potential NULL dereference Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 101/343] pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group Greg Kroah-Hartman
                   ` (247 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 1ecd8c9cb899ae277e6986ae134635cb1a50f5de ]

The err_rst_reqb, ext_clki, lowpwr, and ref_clko pin groups are present,
but no pinmux functions refer to them, hence they can not be selected.

Fixes: 1e7d5d849cf4f0c5 ("sh-pfc: Add emev2 pinmux support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-emev2.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/drivers/pinctrl/sh-pfc/pfc-emev2.c b/drivers/pinctrl/sh-pfc/pfc-emev2.c
index 1cbbe04d7df65..eafd8edbcbe95 100644
--- a/drivers/pinctrl/sh-pfc/pfc-emev2.c
+++ b/drivers/pinctrl/sh-pfc/pfc-emev2.c
@@ -1263,6 +1263,14 @@ static const char * const dtv_groups[] = {
 	"dtv_b",
 };
 
+static const char * const err_rst_reqb_groups[] = {
+	"err_rst_reqb",
+};
+
+static const char * const ext_clki_groups[] = {
+	"ext_clki",
+};
+
 static const char * const iic0_groups[] = {
 	"iic0",
 };
@@ -1285,6 +1293,10 @@ static const char * const lcd_groups[] = {
 	"yuv3",
 };
 
+static const char * const lowpwr_groups[] = {
+	"lowpwr",
+};
+
 static const char * const ntsc_groups[] = {
 	"ntsc_clk",
 	"ntsc_data",
@@ -1298,6 +1310,10 @@ static const char * const pwm1_groups[] = {
 	"pwm1",
 };
 
+static const char * const ref_clko_groups[] = {
+	"ref_clko",
+};
+
 static const char * const sd_groups[] = {
 	"sd_cki",
 };
@@ -1391,13 +1407,17 @@ static const struct sh_pfc_function pinmux_functions[] = {
 	SH_PFC_FUNCTION(cam),
 	SH_PFC_FUNCTION(cf),
 	SH_PFC_FUNCTION(dtv),
+	SH_PFC_FUNCTION(err_rst_reqb),
+	SH_PFC_FUNCTION(ext_clki),
 	SH_PFC_FUNCTION(iic0),
 	SH_PFC_FUNCTION(iic1),
 	SH_PFC_FUNCTION(jtag),
 	SH_PFC_FUNCTION(lcd),
+	SH_PFC_FUNCTION(lowpwr),
 	SH_PFC_FUNCTION(ntsc),
 	SH_PFC_FUNCTION(pwm0),
 	SH_PFC_FUNCTION(pwm1),
+	SH_PFC_FUNCTION(ref_clko),
 	SH_PFC_FUNCTION(sd),
 	SH_PFC_FUNCTION(sdi0),
 	SH_PFC_FUNCTION(sdi1),
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 101/343] pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 100/343] pinctrl: sh-pfc: emev2: Add missing pinmux functions Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 102/343] pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b " Greg Kroah-Hartman
                   ` (246 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit a4b0350047f1b10207e25e72d7cd3f7826e93769 ]

The entry for "scifb2_data_c" in the SCIFB2 pin group array contains a
typo, thus the group cannot be selected.

Fixes: 5088451962389924 ("pinctrl: sh-pfc: r8a7791 PFC support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index d34982ea66bf1..e4774b2200405 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -5209,7 +5209,7 @@ static const char * const scifb2_groups[] = {
 	"scifb2_data_b",
 	"scifb2_clk_b",
 	"scifb2_ctrl_b",
-	"scifb0_data_c",
+	"scifb2_data_c",
 	"scifb2_clk_c",
 	"scifb2_data_d",
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 102/343] pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 101/343] pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 103/343] pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups Greg Kroah-Hartman
                   ` (245 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit b9fd50488b4939ce5b3a026d29e752e17c2d1800 ]

The vin1_data18_b pin group itself is present, but it is not listed in
the VIN1 pin group array, and thus cannot be selected.

Fixes: 7dd74bb1f058786e ("pinctrl: sh-pfc: r8a7792: Add VIN pin groups")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7792.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
index cc3597f66605a..46c41ca6ea38b 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
@@ -1916,6 +1916,7 @@ static const char * const vin1_groups[] = {
 	"vin1_data8",
 	"vin1_data24_b",
 	"vin1_data20_b",
+	"vin1_data18_b",
 	"vin1_data16_b",
 	"vin1_sync",
 	"vin1_field",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 103/343] pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 102/343] pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b " Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 104/343] PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio() Greg Kroah-Hartman
                   ` (244 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 0e6e448bdcf896d001a289a6112a704542d51516 ]

There are two pin groups for the FSIC SPDIF signal, but the FSIC pin
group array lists only one, and it refers to a nonexistent group.

Fixes: 2ecd4154c906b7d6 ("sh-pfc: sh73a0: Add FSI pin groups and functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
index f8fbedb46585d..6dca760f9f280 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
@@ -3367,7 +3367,8 @@ static const char * const fsic_groups[] = {
 	"fsic_sclk_out",
 	"fsic_data_in",
 	"fsic_data_out",
-	"fsic_spdif",
+	"fsic_spdif_0",
+	"fsic_spdif_1",
 };
 
 static const char * const fsid_groups[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 104/343] PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 103/343] pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 105/343] usb: phy: twl6030-usb: fix possible use-after-free on remove Greg Kroah-Hartman
                   ` (243 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kishon Vijay Abraham I, Wen Yang,
	Lorenzo Pieralisi, Bjorn Helgaas, Gustavo Pimentel,
	Niklas Cassel, Cyrille Pitchen, linux-pci, Sasha Levin

From: Wen Yang <wen.yang99@zte.com.cn>

[ Upstream commit 726dabfde6aa35a4f1508e235ae37edbbf9fbc65 ]

Functions copying from/to IO addresses should use the
memcpy_fromio()/memcpy_toio() API rather than plain memcpy().

Fix the issue detected through the sparse tool.

Fixes: 349e7a85b25f ("PCI: endpoint: functions: Add an EP function to test PCI")
Suggested-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
[lorenzo.pieralisi@arm.com: updated log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
CC: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
CC: Bjorn Helgaas <bhelgaas@google.com>
CC: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
CC: Niklas Cassel <niklas.cassel@axis.com>
CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CC: Cyrille Pitchen <cyrille.pitchen@free-electrons.com>
CC: linux-pci@vger.kernel.org
CC: linux-kernel@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/endpoint/functions/pci-epf-test.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
index f9308c2f22e67..c2541a772abc8 100644
--- a/drivers/pci/endpoint/functions/pci-epf-test.c
+++ b/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -177,7 +177,7 @@ static int pci_epf_test_read(struct pci_epf_test *epf_test)
 		goto err_map_addr;
 	}
 
-	memcpy(buf, src_addr, reg->size);
+	memcpy_fromio(buf, src_addr, reg->size);
 
 	crc32 = crc32_le(~0, buf, reg->size);
 	if (crc32 != reg->checksum)
@@ -231,7 +231,7 @@ static int pci_epf_test_write(struct pci_epf_test *epf_test)
 	get_random_bytes(buf, reg->size);
 	reg->checksum = crc32_le(~0, buf, reg->size);
 
-	memcpy(dst_addr, buf, reg->size);
+	memcpy_toio(dst_addr, buf, reg->size);
 
 	/*
 	 * wait 1ms inorder for the write to complete. Without this delay L3
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 105/343] usb: phy: twl6030-usb: fix possible use-after-free on remove
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 104/343] PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio() Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 106/343] block: dont use bio->bi_vcnt to figure out segment number Greg Kroah-Hartman
                   ` (242 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Bin Liu,
	Sven Van Asbroeck, Felipe Balbi, Sasha Levin

From: Sven Van Asbroeck <thesven73@gmail.com>

[ Upstream commit 5895d311d28f2605e2f71c1a3e043ed38f3ac9d2 ]

In remove(), use cancel_delayed_work_sync() to cancel the
delayed work. Otherwise there's a chance that this work
will continue to run until after the device has been removed.

This issue was detected with the help of Coccinelle.

Cc: Tony Lindgren <tony@atomide.com>
Cc: Bin Liu <b-liu@ti.com>
Fixes: b6a619a883c3 ("usb: phy: Check initial state for twl6030")
Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/phy/phy-twl6030-usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index b5dc077ed7d3c..8e14fa2211912 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -413,7 +413,7 @@ static int twl6030_usb_remove(struct platform_device *pdev)
 {
 	struct twl6030_usb *twl = platform_get_drvdata(pdev);
 
-	cancel_delayed_work(&twl->get_status_work);
+	cancel_delayed_work_sync(&twl->get_status_work);
 	twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
 		REG_INT_MSK_LINE_C);
 	twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 106/343] block: dont use bio->bi_vcnt to figure out segment number
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 105/343] usb: phy: twl6030-usb: fix possible use-after-free on remove Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 107/343] keys: Timestamp new keys Greg Kroah-Hartman
                   ` (241 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Omar Sandoval, Christoph Hellwig,
	Ming Lei, Jens Axboe, Sasha Levin

From: Ming Lei <ming.lei@redhat.com>

[ Upstream commit 1a67356e9a4829da2935dd338630a550c59c8489 ]

It is wrong to use bio->bi_vcnt to figure out how many segments
there are in the bio even though CLONED flag isn't set on this bio,
because this bio may be splitted or advanced.

So always use bio_segments() in blk_recount_segments(), and it shouldn't
cause any performance loss now because the physical segment number is figured
out in blk_queue_split() and BIO_SEG_VALID is set meantime since
bdced438acd83ad83a6c ("block: setup bi_phys_segments after splitting").

Reviewed-by: Omar Sandoval <osandov@fb.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Fixes: 76d8137a3113 ("blk-merge: recaculate segment if it isn't less than max segments")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-merge.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/block/blk-merge.c b/block/blk-merge.c
index f61b50a01bc7a..415b5dafd9e6e 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -299,13 +299,7 @@ void blk_recalc_rq_segments(struct request *rq)
 
 void blk_recount_segments(struct request_queue *q, struct bio *bio)
 {
-	unsigned short seg_cnt;
-
-	/* estimate segment number by bi_vcnt for non-cloned bio */
-	if (bio_flagged(bio, BIO_CLONED))
-		seg_cnt = bio_segments(bio);
-	else
-		seg_cnt = bio->bi_vcnt;
+	unsigned short seg_cnt = bio_segments(bio);
 
 	if (test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags) &&
 			(seg_cnt < queue_max_segments(q)))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 107/343] keys: Timestamp new keys
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 106/343] block: dont use bio->bi_vcnt to figure out segment number Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 108/343] vfio_pci: Enable memory accesses before calling pci_map_rom Greg Kroah-Hartman
                   ` (240 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Howells, James Morris, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit 7c1857bdbdf1e4c541e45eab477ee23ed4333ea4 ]

Set the timestamp on new keys rather than leaving it unset.

Fixes: 31d5a79d7f3d ("KEYS: Do LRU discard in full keyrings")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/keys/key.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/security/keys/key.c b/security/keys/key.c
index 87172f99f73e0..17244f5f54c69 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -297,6 +297,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
 	key->gid = gid;
 	key->perm = perm;
 	key->restrict_link = restrict_link;
+	key->last_used_at = ktime_get_real_seconds();
 
 	if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
 		key->flags |= 1 << KEY_FLAG_IN_QUOTA;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 108/343] vfio_pci: Enable memory accesses before calling pci_map_rom
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 107/343] keys: Timestamp new keys Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 109/343] hwmon: (pmbus/tps53679) Fix driver info initialization in probe routine Greg Kroah-Hartman
                   ` (239 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Auger, Alex Williamson, Sasha Levin

From: Eric Auger <eric.auger@redhat.com>

[ Upstream commit 0cfd027be1d6def4a462cdc180c055143af24069 ]

pci_map_rom/pci_get_rom_size() performs memory access in the ROM.
In case the Memory Space accesses were disabled, readw() is likely
to trigger a synchronous external abort on some platforms.

In case memory accesses were disabled, re-enable them before the
call and disable them back again just after.

Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Suggested-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 9bd3e7911af2b..550ab7707b57f 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -717,6 +717,7 @@ static long vfio_pci_ioctl(void *device_data,
 		{
 			void __iomem *io;
 			size_t size;
+			u16 orig_cmd;
 
 			info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
 			info.flags = 0;
@@ -732,15 +733,23 @@ static long vfio_pci_ioctl(void *device_data,
 					break;
 			}
 
-			/* Is it really there? */
+			/*
+			 * Is it really there?  Enable memory decode for
+			 * implicit access in pci_map_rom().
+			 */
+			pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd);
+			pci_write_config_word(pdev, PCI_COMMAND,
+					      orig_cmd | PCI_COMMAND_MEMORY);
+
 			io = pci_map_rom(pdev, &size);
-			if (!io || !size) {
+			if (io) {
+				info.flags = VFIO_REGION_INFO_FLAG_READ;
+				pci_unmap_rom(pdev, io);
+			} else {
 				info.size = 0;
-				break;
 			}
-			pci_unmap_rom(pdev, io);
 
-			info.flags = VFIO_REGION_INFO_FLAG_READ;
+			pci_write_config_word(pdev, PCI_COMMAND, orig_cmd);
 			break;
 		}
 		case VFIO_PCI_VGA_REGION_INDEX:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 109/343] hwmon: (pmbus/tps53679) Fix driver info initialization in probe routine
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 108/343] vfio_pci: Enable memory accesses before calling pci_map_rom Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 110/343] KVM: PPC: Release all hardware TCE tables attached to a group Greg Kroah-Hartman
                   ` (238 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vadim Pasternak, Guenter Roeck, Sasha Levin

From: Vadim Pasternak <vadimp@mellanox.com>

[ Upstream commit ff066653aeed8ee2d4dadb1e35774dd91ecbb19f ]

Fix tps53679_probe() by using dynamically allocated "pmbus_driver_info"
structure instead of static. Usage of static structures causes
overwritten of the field "vrm_version", in case the system is equipped
with several tps53679 devices with the different "vrm_version".
In such case the last probed device overwrites this field for all
others.

Fixes: 610526527a13 ("hwmon: (pmbus) Add support for Texas Instruments tps53679 device")
Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/pmbus/tps53679.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
index 85b515cd9df0e..2bc352c5357f4 100644
--- a/drivers/hwmon/pmbus/tps53679.c
+++ b/drivers/hwmon/pmbus/tps53679.c
@@ -80,7 +80,14 @@ static struct pmbus_driver_info tps53679_info = {
 static int tps53679_probe(struct i2c_client *client,
 			  const struct i2c_device_id *id)
 {
-	return pmbus_do_probe(client, id, &tps53679_info);
+	struct pmbus_driver_info *info;
+
+	info = devm_kmemdup(&client->dev, &tps53679_info, sizeof(*info),
+			    GFP_KERNEL);
+	if (!info)
+		return -ENOMEM;
+
+	return pmbus_do_probe(client, id, info);
 }
 
 static const struct i2c_device_id tps53679_id[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 110/343] KVM: PPC: Release all hardware TCE tables attached to a group
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 109/343] hwmon: (pmbus/tps53679) Fix driver info initialization in probe routine Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 111/343] staging: r8822be: check kzalloc return or bail Greg Kroah-Hartman
                   ` (237 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy, Paul Mackerras,
	Sasha Levin

From: Alexey Kardashevskiy <aik@ozlabs.ru>

[ Upstream commit a67614cc05a5052b265ea48196dab2fce11f5f2e ]

The SPAPR TCE KVM device references all hardware IOMMU tables assigned to
some IOMMU group to ensure that in-kernel KVM acceleration of H_PUT_TCE
can work. The tables are references when an IOMMU group gets registered
with the VFIO KVM device by the KVM_DEV_VFIO_GROUP_ADD ioctl;
KVM_DEV_VFIO_GROUP_DEL calls into the dereferencing code
in kvm_spapr_tce_release_iommu_group() which walks through the list of
LIOBNs, finds a matching IOMMU table and calls kref_put() when found.

However that code stops after the very first successful derefencing
leaving other tables referenced till the SPAPR TCE KVM device is destroyed
which normally happens on guest reboot or termination so if we do hotplug
and unplug in a loop, we are leaking IOMMU tables here.

This removes a premature return to let kvm_spapr_tce_release_iommu_group()
find and dereference all attached tables.

Fixes: 121f80ba68f ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO")
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kvm/book3s_64_vio.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index 5e44462960213..ef6a58838e7ce 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -134,7 +134,6 @@ extern void kvm_spapr_tce_release_iommu_group(struct kvm *kvm,
 					continue;
 
 				kref_put(&stit->kref, kvm_spapr_tce_liobn_put);
-				return;
 			}
 		}
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 111/343] staging: r8822be: check kzalloc return or bail
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 110/343] KVM: PPC: Release all hardware TCE tables attached to a group Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 112/343] dmaengine: mv_xor: Use correct device for DMA API Greg Kroah-Hartman
                   ` (236 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Sasha Levin

From: Nicholas Mc Guire <hofrat@osadl.org>

[ Upstream commit e4b08e16b7d9d030b6475ef48f94d734a39f3c81 ]

The kzalloc() in halmac_parse_psd_data_88xx() can fail and return NULL
so check the psd_set->data after allocation and if allocation failed
return HALMAC_CMD_PROCESS_ERROR.

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Fixes: 938a0447f094 ("staging: r8822be: Add code for halmac sub-drive")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c    | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
index 544f638ed3efb..15091ee587dbf 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
@@ -2492,8 +2492,11 @@ halmac_parse_psd_data_88xx(struct halmac_adapter *halmac_adapter, u8 *c2h_buf,
 	segment_size = (u8)PSD_DATA_GET_SEGMENT_SIZE(c2h_buf);
 	psd_set->data_size = total_size;
 
-	if (!psd_set->data)
+	if (!psd_set->data) {
 		psd_set->data = kzalloc(psd_set->data_size, GFP_KERNEL);
+		if (!psd_set->data)
+			return HALMAC_CMD_PROCESS_ERROR;
+	}
 
 	if (segment_id == 0)
 		psd_set->segment_size = segment_size;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 112/343] dmaengine: mv_xor: Use correct device for DMA API
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 111/343] staging: r8822be: check kzalloc return or bail Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 113/343] cdc-wdm: pass return value of recover_from_urb_loss Greg Kroah-Hartman
                   ` (235 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John David Anglin, Robin Murphy,
	Thomas Petazzoni, Vinod Koul, Sasha Levin

From: Robin Murphy <robin.murphy@arm.com>

[ Upstream commit 3e5daee5ecf314da33a890fabaa2404244cd2a36 ]

Using dma_dev->dev for mappings before it's assigned with the correct
device is unlikely to work as expected, and with future dma-direct
changes, passing a NULL device may end up crashing entirely. I don't
know enough about this hardware or the mv_xor_prep_dma_interrupt()
operation to implement the appropriate error-handling logic that would
have revealed those dma_map_single() calls failing on arm64 for as long
as the driver has been enabled there, but moving the assignment earlier
will at least make the current code operate as intended.

Fixes: 22843545b200 ("dma: mv_xor: Add support for DMA_INTERRUPT")
Reported-by: John David Anglin <dave.anglin@bell.net>
Tested-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Acked-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Tested-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/mv_xor.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 1993889003fd1..1c57577f49fea 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -1059,6 +1059,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
 		mv_chan->op_in_desc = XOR_MODE_IN_DESC;
 
 	dma_dev = &mv_chan->dmadev;
+	dma_dev->dev = &pdev->dev;
 	mv_chan->xordev = xordev;
 
 	/*
@@ -1091,7 +1092,6 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
 	dma_dev->device_free_chan_resources = mv_xor_free_chan_resources;
 	dma_dev->device_tx_status = mv_xor_status;
 	dma_dev->device_issue_pending = mv_xor_issue_pending;
-	dma_dev->dev = &pdev->dev;
 
 	/* set prep routines based on capability */
 	if (dma_has_cap(DMA_INTERRUPT, dma_dev->cap_mask))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 113/343] cdc-wdm: pass return value of recover_from_urb_loss
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 112/343] dmaengine: mv_xor: Use correct device for DMA API Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 114/343] regulator: pv88060: Fix array out-of-bounds access Greg Kroah-Hartman
                   ` (234 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, YueHaibing, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 0742a338f5b3446a26de551ad8273fb41b2787f2 ]

'rv' is the correct return value, pass it upstream instead of 0

Fixes: 17d80d562fd7 ("USB: autosuspend for cdc-wdm")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/class/cdc-wdm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index a593cdfc897fd..d5d42dccda10a 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -1085,7 +1085,7 @@ static int wdm_post_reset(struct usb_interface *intf)
 	rv = recover_from_urb_loss(desc);
 	mutex_unlock(&desc->wlock);
 	mutex_unlock(&desc->rlock);
-	return 0;
+	return rv;
 }
 
 static struct usb_driver wdm_driver = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 114/343] regulator: pv88060: Fix array out-of-bounds access
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 113/343] cdc-wdm: pass return value of recover_from_urb_loss Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 115/343] regulator: pv88080: " Greg Kroah-Hartman
                   ` (233 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit 7cd415f875591bc66c5ecb49bf84ef97e80d7b0e ]

Fix off-by-one while iterating current_limits array.
The valid index should be 0 ~ n_current_limits -1.

Fixes: f307a7e9b7af ("regulator: pv88060: new regulator driver")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/pv88060-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/pv88060-regulator.c b/drivers/regulator/pv88060-regulator.c
index a9446056435f9..1f2d8180506bc 100644
--- a/drivers/regulator/pv88060-regulator.c
+++ b/drivers/regulator/pv88060-regulator.c
@@ -135,7 +135,7 @@ static int pv88060_set_current_limit(struct regulator_dev *rdev, int min,
 	int i;
 
 	/* search for closest to maximum */
-	for (i = info->n_current_limits; i >= 0; i--) {
+	for (i = info->n_current_limits - 1; i >= 0; i--) {
 		if (min <= info->current_limits[i]
 			&& max >= info->current_limits[i]) {
 			return regmap_update_bits(rdev->regmap,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 115/343] regulator: pv88080: Fix array out-of-bounds access
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 114/343] regulator: pv88060: Fix array out-of-bounds access Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 116/343] regulator: pv88090: " Greg Kroah-Hartman
                   ` (232 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit 3c413f594c4f9df40061445667ca11a12bc8ee34 ]

Fix off-by-one while iterating current_limits array.
The valid index should be 0 ~ n_current_limits -1.

Fixes: 99cf3af5e2d5 ("regulator: pv88080: new regulator driver")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/pv88080-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/pv88080-regulator.c b/drivers/regulator/pv88080-regulator.c
index 9a08cb2de501e..6770e4de20978 100644
--- a/drivers/regulator/pv88080-regulator.c
+++ b/drivers/regulator/pv88080-regulator.c
@@ -279,7 +279,7 @@ static int pv88080_set_current_limit(struct regulator_dev *rdev, int min,
 	int i;
 
 	/* search for closest to maximum */
-	for (i = info->n_current_limits; i >= 0; i--) {
+	for (i = info->n_current_limits - 1; i >= 0; i--) {
 		if (min <= info->current_limits[i]
 			&& max >= info->current_limits[i]) {
 				return regmap_update_bits(rdev->regmap,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 116/343] regulator: pv88090: Fix array out-of-bounds access
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 115/343] regulator: pv88080: " Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 117/343] net: dsa: qca8k: Enable delay for RGMII_ID mode Greg Kroah-Hartman
                   ` (231 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit a5455c9159414748bed4678184bf69989a4f7ba3 ]

Fix off-by-one while iterating current_limits array.
The valid index should be 0 ~ n_current_limits -1.

Fixes: c90456e36d9c ("regulator: pv88090: new regulator driver")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/pv88090-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/pv88090-regulator.c b/drivers/regulator/pv88090-regulator.c
index 7a0c15957bd0b..2302b0df7630f 100644
--- a/drivers/regulator/pv88090-regulator.c
+++ b/drivers/regulator/pv88090-regulator.c
@@ -157,7 +157,7 @@ static int pv88090_set_current_limit(struct regulator_dev *rdev, int min,
 	int i;
 
 	/* search for closest to maximum */
-	for (i = info->n_current_limits; i >= 0; i--) {
+	for (i = info->n_current_limits - 1; i >= 0; i--) {
 		if (min <= info->current_limits[i]
 			&& max >= info->current_limits[i]) {
 			return regmap_update_bits(rdev->regmap,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 117/343] net: dsa: qca8k: Enable delay for RGMII_ID mode
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 116/343] regulator: pv88090: " Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 118/343] drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON Greg Kroah-Hartman
                   ` (230 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michal Vokáč,
	Vinod Koul, Andrew Lunn, David S. Miller, Sasha Levin

From: Vinod Koul <vkoul@kernel.org>

[ Upstream commit a968b5e9d5879f9535d6099505f9e14abcafb623 ]

RGMII_ID specifies that we should have internal delay, so resurrect the
delay addition routine but under the RGMII_ID mode.

Fixes: 40269aa9f40a ("net: dsa: qca8k: disable delay for RGMII mode")
Tested-by: Michal Vokáč <michal.vokac@ysoft.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/qca8k.c | 12 ++++++++++++
 drivers/net/dsa/qca8k.h |  1 +
 2 files changed, 13 insertions(+)

diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
index 8e49974ffa0ed..8ee59b20b47a3 100644
--- a/drivers/net/dsa/qca8k.c
+++ b/drivers/net/dsa/qca8k.c
@@ -459,6 +459,18 @@ qca8k_set_pad_ctrl(struct qca8k_priv *priv, int port, int mode)
 		qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
 			    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
 		break;
+	case PHY_INTERFACE_MODE_RGMII_ID:
+		/* RGMII_ID needs internal delay. This is enabled through
+		 * PORT5_PAD_CTRL for all ports, rather than individual port
+		 * registers
+		 */
+		qca8k_write(priv, reg,
+			    QCA8K_PORT_PAD_RGMII_EN |
+			    QCA8K_PORT_PAD_RGMII_TX_DELAY(QCA8K_MAX_DELAY) |
+			    QCA8K_PORT_PAD_RGMII_RX_DELAY(QCA8K_MAX_DELAY));
+		qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
+			    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
+		break;
 	case PHY_INTERFACE_MODE_SGMII:
 		qca8k_write(priv, reg, QCA8K_PORT_PAD_SGMII_EN);
 		break;
diff --git a/drivers/net/dsa/qca8k.h b/drivers/net/dsa/qca8k.h
index 613fe5c50236c..d146e54c8a6c6 100644
--- a/drivers/net/dsa/qca8k.h
+++ b/drivers/net/dsa/qca8k.h
@@ -40,6 +40,7 @@
 						((0x8 + (x & 0x3)) << 22)
 #define   QCA8K_PORT_PAD_RGMII_RX_DELAY(x)		\
 						((0x10 + (x & 0x3)) << 20)
+#define   QCA8K_MAX_DELAY				3
 #define   QCA8K_PORT_PAD_RGMII_RX_DELAY_EN		BIT(24)
 #define   QCA8K_PORT_PAD_SGMII_EN			BIT(7)
 #define QCA8K_REG_MODULE_EN				0x030
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 118/343] drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 117/343] net: dsa: qca8k: Enable delay for RGMII_ID mode Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 119/343] drm/nouveau/pmu: dont print reply values if exec is false Greg Kroah-Hartman
                   ` (229 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Ben Skeggs, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 13649101a25c53c87f4ab98a076dfe61f3636ab1 ]

Currently, the expression for calculating RON is always going to result
in zero no matter the value of ram->mr[1] because the ! operator has
higher precedence than the shift >> operator.  I believe the missing
parentheses around the expression before appying the ! operator will
result in the desired result.

[ Note, not tested ]

Detected by CoveritScan, CID#1324005 ("Operands don't affect result")

Fixes: c25bf7b6155c ("drm/nouveau/bios/ramcfg: Separate out RON pull value")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
index 60ece0a8a2e1b..1d2d6bae73cd1 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
@@ -87,7 +87,7 @@ nvkm_gddr3_calc(struct nvkm_ram *ram)
 		WR  = (ram->next->bios.timing[2] & 0x007f0000) >> 16;
 		/* XXX: Get these values from the VBIOS instead */
 		DLL = !(ram->mr[1] & 0x1);
-		RON = !(ram->mr[1] & 0x300) >> 8;
+		RON = !((ram->mr[1] & 0x300) >> 8);
 		break;
 	default:
 		return -ENOSYS;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 119/343] drm/nouveau/pmu: dont print reply values if exec is false
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 118/343] drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 120/343] ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of() Greg Kroah-Hartman
                   ` (228 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Ben Skeggs, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit b1d03fc36ec9834465a08c275c8d563e07f6f6bf ]

Currently the uninitialized values in the array reply are printed out
when exec is false and nvkm_pmu_send has not updated the array. Avoid
confusion by only dumping out these values if they have been actually
updated.

Detected by CoverityScan, CID#1271291 ("Uninitialized scaler variable")
Fixes: ebb58dc2ef8c ("drm/nouveau/pmu: rename from pwr (no binary change)")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
index 11b28b086a062..7b052879af728 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
@@ -88,10 +88,10 @@ nvkm_memx_fini(struct nvkm_memx **pmemx, bool exec)
 	if (exec) {
 		nvkm_pmu_send(pmu, reply, PROC_MEMX, MEMX_MSG_EXEC,
 			      memx->base, finish);
+		nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
+			   reply[0], reply[1]);
 	}
 
-	nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
-		   reply[0], reply[1]);
 	kfree(memx);
 	return 0;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 120/343] ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 119/343] drm/nouveau/pmu: dont print reply values if exec is false Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.14 121/343] fs/nfs: Fix nfs_parse_devname to not modify its argument Greg Kroah-Hartman
                   ` (227 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Patrick Lai, Banajit Goswami,
	Takashi Iwai, Mark Brown, Sasha Levin

From: Takashi Iwai <tiwai@suse.de>

[ Upstream commit 8d1667200850f8753c0265fa4bd25c9a6e5f94ce ]

The apq8016 driver leaves the of-node refcount at aborting from the
loop of for_each_child_of_node() in the error path.  Not only the
iterator node of for_each_child_of_node(), the children nodes referred
from it for codec and cpu have to be properly unreferenced.

Fixes: bdb052e81f62 ("ASoC: qcom: add apq8016 sound card support")
Cc: Patrick Lai <plai@codeaurora.org>
Cc: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/apq8016_sbc.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c
index d49adc822a110..8e6b88d68ca6c 100644
--- a/sound/soc/qcom/apq8016_sbc.c
+++ b/sound/soc/qcom/apq8016_sbc.c
@@ -163,41 +163,52 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
 
 		if (!cpu || !codec) {
 			dev_err(dev, "Can't find cpu/codec DT node\n");
-			return ERR_PTR(-EINVAL);
+			ret = -EINVAL;
+			goto error;
 		}
 
 		link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
 		if (!link->cpu_of_node) {
 			dev_err(card->dev, "error getting cpu phandle\n");
-			return ERR_PTR(-EINVAL);
+			ret = -EINVAL;
+			goto error;
 		}
 
 		ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name);
 		if (ret) {
 			dev_err(card->dev, "error getting cpu dai name\n");
-			return ERR_PTR(ret);
+			goto error;
 		}
 
 		ret = snd_soc_of_get_dai_link_codecs(dev, codec, link);
 
 		if (ret < 0) {
 			dev_err(card->dev, "error getting codec dai name\n");
-			return ERR_PTR(ret);
+			goto error;
 		}
 
 		link->platform_of_node = link->cpu_of_node;
 		ret = of_property_read_string(np, "link-name", &link->name);
 		if (ret) {
 			dev_err(card->dev, "error getting codec dai_link name\n");
-			return ERR_PTR(ret);
+			goto error;
 		}
 
 		link->stream_name = link->name;
 		link->init = apq8016_sbc_dai_init;
 		link++;
+
+		of_node_put(cpu);
+		of_node_put(codec);
 	}
 
 	return data;
+
+ error:
+	of_node_put(np);
+	of_node_put(cpu);
+	of_node_put(codec);
+	return ERR_PTR(ret);
 }
 
 static const struct snd_soc_dapm_widget apq8016_sbc_dapm_widgets[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 121/343] fs/nfs: Fix nfs_parse_devname to not modify its argument
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 120/343] ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of() Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 122/343] staging: rtlwifi: Use proper enum for return in halmac_parse_psd_data_88xx Greg Kroah-Hartman
                   ` (226 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric W. Biederman, Trond Myklebust,
	Sasha Levin

From: Eric W. Biederman <ebiederm@xmission.com>

[ Upstream commit 40cc394be1aa18848b8757e03bd8ed23281f572e ]

In the rare and unsupported case of a hostname list nfs_parse_devname
will modify dev_name.  There is no need to modify dev_name as the all
that is being computed is the length of the hostname, so the computed
length can just be shorted.

Fixes: dc04589827f7 ("NFS: Use common device name parsing logic for NFSv4 and NFSv2/v3")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index f464f8d9060c0..470b761839a51 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1925,7 +1925,7 @@ static int nfs_parse_devname(const char *dev_name,
 		/* kill possible hostname list: not supported */
 		comma = strchr(dev_name, ',');
 		if (comma != NULL && comma < end)
-			*comma = 0;
+			len = comma - dev_name;
 	}
 
 	if (len > maxnamlen)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 122/343] staging: rtlwifi: Use proper enum for return in halmac_parse_psd_data_88xx
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.14 121/343] fs/nfs: Fix nfs_parse_devname to not modify its argument Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 123/343] powerpc/64s: Fix logic when handling unknown CPU features Greg Kroah-Hartman
                   ` (225 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Nicholas Mc Guire,
	Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit e8edc32d70a4e09160835792eb5d1af71a0eec14 ]

Clang warns:

drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c:2472:11:
warning: implicit conversion from enumeration type 'enum
halmac_cmd_process_status' to different enumeration type 'enum
halmac_ret_status' [-Wenum-conversion]
                        return HALMAC_CMD_PROCESS_ERROR;
                        ~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.

Fix this by using the proper enum for allocation failures,
HALMAC_RET_MALLOC_FAIL, which is used in the rest of this file.

Fixes: e4b08e16b7d9 ("staging: r8822be: check kzalloc return or bail")
Link: https://github.com/ClangBuiltLinux/linux/issues/375
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Nicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
index 15091ee587dbf..65edd14a1147a 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
@@ -2495,7 +2495,7 @@ halmac_parse_psd_data_88xx(struct halmac_adapter *halmac_adapter, u8 *c2h_buf,
 	if (!psd_set->data) {
 		psd_set->data = kzalloc(psd_set->data_size, GFP_KERNEL);
 		if (!psd_set->data)
-			return HALMAC_CMD_PROCESS_ERROR;
+			return HALMAC_RET_MALLOC_FAIL;
 	}
 
 	if (segment_id == 0)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 123/343] powerpc/64s: Fix logic when handling unknown CPU features
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 122/343] staging: rtlwifi: Use proper enum for return in halmac_parse_psd_data_88xx Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 124/343] NFS: Fix a soft lockup in the delegation recovery code Greg Kroah-Hartman
                   ` (224 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Segher Boessenkool, Michael Ellerman,
	Andrew Donnellan, Sasha Levin

From: Michael Ellerman <mpe@ellerman.id.au>

[ Upstream commit 8cfaf106918a8c13abb24c641556172afbb9545c ]

In cpufeatures_process_feature(), if a provided CPU feature is unknown and
enable_unknown is false, we erroneously print that the feature is being
enabled and return true, even though no feature has been enabled, and
may also set feature bits based on the last entry in the match table.

Fix this so that we only set feature bits from the match table if we have
actually enabled a feature from that table, and when failing to enable an
unknown feature, always print the "not enabling" message and return false.

Coincidentally, some older gccs (<GCC 7), when invoked with
-fsanitize-coverage=trace-pc, cause a spurious uninitialised variable
warning in this function:

  arch/powerpc/kernel/dt_cpu_ftrs.c: In function ‘cpufeatures_process_feature’:
  arch/powerpc/kernel/dt_cpu_ftrs.c:686:7: warning: ‘m’ may be used uninitialized in this function [-Wmaybe-uninitialized]
    if (m->cpu_ftr_bit_mask)

An upcoming patch will enable support for kcov, which requires this option.
This patch avoids the warning.

Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")
Reported-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
[ajd: add commit message]
Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/dt_cpu_ftrs.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
index 2357df60de952..7ed2b1b6643cc 100644
--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
+++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
@@ -705,8 +705,10 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
 		m = &dt_cpu_feature_match_table[i];
 		if (!strcmp(f->name, m->name)) {
 			known = true;
-			if (m->enable(f))
+			if (m->enable(f)) {
+				cur_cpu_spec->cpu_features |= m->cpu_ftr_bit_mask;
 				break;
+			}
 
 			pr_info("not enabling: %s (disabled or unsupported by kernel)\n",
 				f->name);
@@ -714,17 +716,12 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
 		}
 	}
 
-	if (!known && enable_unknown) {
-		if (!feat_try_enable_unknown(f)) {
-			pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
-				f->name);
-			return false;
-		}
+	if (!known && (!enable_unknown || !feat_try_enable_unknown(f))) {
+		pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
+			f->name);
+		return false;
 	}
 
-	if (m->cpu_ftr_bit_mask)
-		cur_cpu_spec->cpu_features |= m->cpu_ftr_bit_mask;
-
 	if (known)
 		pr_debug("enabling: %s\n", f->name);
 	else
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 124/343] NFS: Fix a soft lockup in the delegation recovery code
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 123/343] powerpc/64s: Fix logic when handling unknown CPU features Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 125/343] clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable Greg Kroah-Hartman
                   ` (223 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit 6f9449be53f3ce383caed797708b332ede8d952c ]

Fix a soft lockup when NFS client delegation recovery is attempted
but the inode is in the process of being freed. When the
igrab(inode) call fails, and we have to restart the recovery process,
we need to ensure that we won't attempt to recover the same delegation
again.

Fixes: 45870d6909d5a ("NFSv4.1: Test delegation stateids when server...")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/delegation.c | 20 ++++++++++++--------
 fs/nfs/delegation.h |  1 +
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 04d57e11577e0..09b3bcb86d328 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -234,6 +234,8 @@ static struct inode *nfs_delegation_grab_inode(struct nfs_delegation *delegation
 	spin_lock(&delegation->lock);
 	if (delegation->inode != NULL)
 		inode = igrab(delegation->inode);
+	if (!inode)
+		set_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags);
 	spin_unlock(&delegation->lock);
 	return inode;
 }
@@ -863,10 +865,11 @@ restart:
 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
 		list_for_each_entry_rcu(delegation, &server->delegations,
 								super_list) {
-			if (test_bit(NFS_DELEGATION_RETURNING,
-						&delegation->flags))
-				continue;
-			if (test_bit(NFS_DELEGATION_NEED_RECLAIM,
+			if (test_bit(NFS_DELEGATION_INODE_FREEING,
+						&delegation->flags) ||
+			    test_bit(NFS_DELEGATION_RETURNING,
+						&delegation->flags) ||
+			    test_bit(NFS_DELEGATION_NEED_RECLAIM,
 						&delegation->flags) == 0)
 				continue;
 			if (!nfs_sb_active(server->super))
@@ -971,10 +974,11 @@ restart:
 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
 		list_for_each_entry_rcu(delegation, &server->delegations,
 								super_list) {
-			if (test_bit(NFS_DELEGATION_RETURNING,
-						&delegation->flags))
-				continue;
-			if (test_bit(NFS_DELEGATION_TEST_EXPIRED,
+			if (test_bit(NFS_DELEGATION_INODE_FREEING,
+						&delegation->flags) ||
+			    test_bit(NFS_DELEGATION_RETURNING,
+						&delegation->flags) ||
+			    test_bit(NFS_DELEGATION_TEST_EXPIRED,
 						&delegation->flags) == 0)
 				continue;
 			if (!nfs_sb_active(server->super))
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index df41d16dc6ab4..510c9edcc712d 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -34,6 +34,7 @@ enum {
 	NFS_DELEGATION_RETURNING,
 	NFS_DELEGATION_REVOKED,
 	NFS_DELEGATION_TEST_EXPIRED,
+	NFS_DELEGATION_INODE_FREEING,
 };
 
 int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 125/343] clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 124/343] NFS: Fix a soft lockup in the delegation recovery code Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 126/343] clocksource/drivers/exynos_mct: Fix error path in timer resources initialization Greg Kroah-Hartman
                   ` (222 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Daniel Lezcano, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit e7e7e0d7beafebd11b0c065cd5fbc1e5759c5aab ]

If the clock tree is not fully populated when the timer-sun5i init code
is called, attempts to get the clock rate for the timer would fail and
return 0.

Make the init code for both clock events and clocksource check the
returned clock rate and fail gracefully if the result is 0, instead of
causing a divide by 0 exception later on.

Fixes: 4a59058f0b09 ("clocksource/drivers/sun5i: Refactor the current code")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/timer-sun5i.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 2a3fe83ec3377..6f4a9a8faccc2 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -202,6 +202,11 @@ static int __init sun5i_setup_clocksource(struct device_node *node,
 	}
 
 	rate = clk_get_rate(clk);
+	if (!rate) {
+		pr_err("Couldn't get parent clock rate\n");
+		ret = -EINVAL;
+		goto err_disable_clk;
+	}
 
 	cs->timer.base = base;
 	cs->timer.clk = clk;
@@ -275,6 +280,11 @@ static int __init sun5i_setup_clockevent(struct device_node *node, void __iomem
 	}
 
 	rate = clk_get_rate(clk);
+	if (!rate) {
+		pr_err("Couldn't get parent clock rate\n");
+		ret = -EINVAL;
+		goto err_disable_clk;
+	}
 
 	ce->timer.base = base;
 	ce->timer.ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 126/343] clocksource/drivers/exynos_mct: Fix error path in timer resources initialization
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 125/343] clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 127/343] platform/x86: wmi: fix potential null pointer dereference Greg Kroah-Hartman
                   ` (221 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
	Marek Szyprowski, Chanwoo Choi, Daniel Lezcano, Sasha Levin

From: Marek Szyprowski <m.szyprowski@samsung.com>

[ Upstream commit b9307420196009cdf18bad55e762ac49fb9a80f4 ]

While freeing interrupt handlers in error path, don't assume that all
requested interrupts are per-processor interrupts and properly release
standard interrupts too.

Reported-by: Krzysztof Kozlowski <krzk@kernel.org>
Fixes: 56a94f13919c ("clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/exynos_mct.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index aaf5bfa9bd9c9..e3ae041ac30e1 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -563,7 +563,19 @@ static int __init exynos4_timer_resources(struct device_node *np, void __iomem *
 	return 0;
 
 out_irq:
-	free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
+	if (mct_int_type == MCT_INT_PPI) {
+		free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
+	} else {
+		for_each_possible_cpu(cpu) {
+			struct mct_clock_event_device *pcpu_mevt =
+				per_cpu_ptr(&percpu_mct_tick, cpu);
+
+			if (pcpu_mevt->evt.irq != -1) {
+				free_irq(pcpu_mevt->evt.irq, pcpu_mevt);
+				pcpu_mevt->evt.irq = -1;
+			}
+		}
+	}
 	return err;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 127/343] platform/x86: wmi: fix potential null pointer dereference
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 126/343] clocksource/drivers/exynos_mct: Fix error path in timer resources initialization Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 128/343] NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount Greg Kroah-Hartman
                   ` (220 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mattias Jacobsson,
	Darren Hart (VMware),
	Sasha Levin

From: Mattias Jacobsson <2pi@mok.nu>

[ Upstream commit c355ec651a8941864549f2586f969d0eb7bf499a ]

In the function wmi_dev_match() the variable id is dereferenced without
first performing a NULL check. The variable can for example be NULL if
a WMI driver is registered without specifying the id_table field in
struct wmi_driver.

Add a NULL check and return that the driver can't handle the device if
the variable is NULL.

Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
Signed-off-by: Mattias Jacobsson <2pi@mok.nu>
Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/wmi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 7f8fa42a10840..a56e997816b23 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -748,6 +748,9 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
 	struct wmi_block *wblock = dev_to_wblock(dev);
 	const struct wmi_device_id *id = wmi_driver->id_table;
 
+	if (id == NULL)
+		return 0;
+
 	while (id->guid_string) {
 		uuid_le driver_guid;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 128/343] NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 127/343] platform/x86: wmi: fix potential null pointer dereference Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 129/343] mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe Greg Kroah-Hartman
                   ` (219 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit 5085607d209102b37b169bc94d0aa39566a9842a ]

If a bulk layout recall or a metadata server reboot coincides with a
umount, then holding a reference to an inode is unsafe unless we
also hold a reference to the super block.

Fixes: fd9a8d7160937 ("NFSv4.1: Fix bulk recall and destroy of layouts")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/pnfs.c | 33 +++++++++++++++++++++++----------
 fs/nfs/pnfs.h |  1 +
 2 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index ec04cce31814b..83abf3dd73511 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -725,22 +725,35 @@ static int
 pnfs_layout_bulk_destroy_byserver_locked(struct nfs_client *clp,
 		struct nfs_server *server,
 		struct list_head *layout_list)
+	__must_hold(&clp->cl_lock)
+	__must_hold(RCU)
 {
 	struct pnfs_layout_hdr *lo, *next;
 	struct inode *inode;
 
 	list_for_each_entry_safe(lo, next, &server->layouts, plh_layouts) {
-		if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags))
+		if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) ||
+		    test_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags) ||
+		    !list_empty(&lo->plh_bulk_destroy))
 			continue;
+		/* If the sb is being destroyed, just bail */
+		if (!nfs_sb_active(server->super))
+			break;
 		inode = igrab(lo->plh_inode);
-		if (inode == NULL)
-			continue;
-		list_del_init(&lo->plh_layouts);
-		if (pnfs_layout_add_bulk_destroy_list(inode, layout_list))
-			continue;
-		rcu_read_unlock();
-		spin_unlock(&clp->cl_lock);
-		iput(inode);
+		if (inode != NULL) {
+			list_del_init(&lo->plh_layouts);
+			if (pnfs_layout_add_bulk_destroy_list(inode,
+						layout_list))
+				continue;
+			rcu_read_unlock();
+			spin_unlock(&clp->cl_lock);
+			iput(inode);
+		} else {
+			rcu_read_unlock();
+			spin_unlock(&clp->cl_lock);
+			set_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags);
+		}
+		nfs_sb_deactive(server->super);
 		spin_lock(&clp->cl_lock);
 		rcu_read_lock();
 		return -EAGAIN;
@@ -778,7 +791,7 @@ pnfs_layout_free_bulk_destroy_list(struct list_head *layout_list,
 		/* Free all lsegs that are attached to commit buckets */
 		nfs_commit_inode(inode, 0);
 		pnfs_put_layout_hdr(lo);
-		iput(inode);
+		nfs_iput_and_deactive(inode);
 	}
 	return ret;
 }
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 87f144f14d1e0..965d657086c8b 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -99,6 +99,7 @@ enum {
 	NFS_LAYOUT_RETURN_REQUESTED,	/* Return this layout ASAP */
 	NFS_LAYOUT_INVALID_STID,	/* layout stateid id is invalid */
 	NFS_LAYOUT_FIRST_LAYOUTGET,	/* Serialize first layoutget */
+	NFS_LAYOUT_INODE_FREEING,	/* The inode is being freed */
 };
 
 enum layoutdriver_policy_flags {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 129/343] mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 128/343] NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 130/343] ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used Greg Kroah-Hartman
                   ` (218 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Ulf Hansson, Sasha Levin

From: Stefan Wahren <stefan.wahren@i2se.com>

[ Upstream commit 1e20186e706da8446f9435f2924cd65ab1397e73 ]

We need to handle mmc_of_parse() errors during probe otherwise the
MMC driver could start without proper initialization (e.g. power sequence).

Fixes: 476bf3d62d5c ("mmc: sdhci-brcmstb: Add driver for Broadcom BRCMSTB SoCs")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-brcmstb.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c
index 552bddc5096ce..1cd10356fc14f 100644
--- a/drivers/mmc/host/sdhci-brcmstb.c
+++ b/drivers/mmc/host/sdhci-brcmstb.c
@@ -55,7 +55,9 @@ static int sdhci_brcmstb_probe(struct platform_device *pdev)
 	}
 
 	sdhci_get_of_property(pdev);
-	mmc_of_parse(host->mmc);
+	res = mmc_of_parse(host->mmc);
+	if (res)
+		goto err;
 
 	/*
 	 * Supply the existing CAPS, but clear the UHS modes. This
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 130/343] ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 129/343] mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 131/343] ARM: 8848/1: virt: Align GIC version check with arm64 counterpart Greg Kroah-Hartman
                   ` (217 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Nicolas Pitre,
	Anand Moon, Russell King, Sasha Levin

From: Marek Szyprowski <m.szyprowski@samsung.com>

[ Upstream commit ca70ea43f80c98582f5ffbbd1e6f4da2742da0c4 ]

MCPM does a soft reset of the CPUs and uses common cpu_resume() routine to
perform low-level platform initialization. This results in a try to install
HYP stubs for the second time for each CPU and results in false HYP/SVC
mode mismatch detection. The HYP stubs are already installed at the
beginning of the kernel initialization on the boot CPU (head.S) or in the
secondary_startup() for other CPUs. To fix this issue MCPM code should use
a cpu_resume() routine without HYP stubs installation.

This change fixes HYP/SVC mode mismatch on Samsung Exynos5422-based Odroid
XU3/XU4/HC1 boards.

Fixes: 3721924c8154 ("ARM: 8081/1: MCPM: provide infrastructure to allow for MCPM loopback")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Nicolas Pitre <nico@linaro.org>
Tested-by: Anand Moon <linux.amoon@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/common/mcpm_entry.c   |  2 +-
 arch/arm/include/asm/suspend.h |  1 +
 arch/arm/kernel/sleep.S        | 12 ++++++++++++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
index 2b913f17d50f5..c24a55b0deac7 100644
--- a/arch/arm/common/mcpm_entry.c
+++ b/arch/arm/common/mcpm_entry.c
@@ -379,7 +379,7 @@ static int __init nocache_trampoline(unsigned long _arg)
 	unsigned int cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
 	phys_reset_t phys_reset;
 
-	mcpm_set_entry_vector(cpu, cluster, cpu_resume);
+	mcpm_set_entry_vector(cpu, cluster, cpu_resume_no_hyp);
 	setup_mm_for_reboot();
 
 	__mcpm_cpu_going_down(cpu, cluster);
diff --git a/arch/arm/include/asm/suspend.h b/arch/arm/include/asm/suspend.h
index 452bbdcbcc835..506314265c6f1 100644
--- a/arch/arm/include/asm/suspend.h
+++ b/arch/arm/include/asm/suspend.h
@@ -10,6 +10,7 @@ struct sleep_save_sp {
 };
 
 extern void cpu_resume(void);
+extern void cpu_resume_no_hyp(void);
 extern void cpu_resume_arm(void);
 extern int cpu_suspend(unsigned long, int (*)(unsigned long));
 
diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S
index a8257fc9cf2a9..5dc8b80bb6938 100644
--- a/arch/arm/kernel/sleep.S
+++ b/arch/arm/kernel/sleep.S
@@ -120,6 +120,14 @@ ENDPROC(cpu_resume_after_mmu)
 	.text
 	.align
 
+#ifdef CONFIG_MCPM
+	.arm
+THUMB(	.thumb			)
+ENTRY(cpu_resume_no_hyp)
+ARM_BE8(setend be)			@ ensure we are in BE mode
+	b	no_hyp
+#endif
+
 #ifdef CONFIG_MMU
 	.arm
 ENTRY(cpu_resume_arm)
@@ -135,6 +143,7 @@ ARM_BE8(setend be)			@ ensure we are in BE mode
 	bl	__hyp_stub_install_secondary
 #endif
 	safe_svcmode_maskall r1
+no_hyp:
 	mov	r1, #0
 	ALT_SMP(mrc p15, 0, r0, c0, c0, 5)
 	ALT_UP_B(1f)
@@ -163,6 +172,9 @@ ENDPROC(cpu_resume)
 
 #ifdef CONFIG_MMU
 ENDPROC(cpu_resume_arm)
+#endif
+#ifdef CONFIG_MCPM
+ENDPROC(cpu_resume_no_hyp)
 #endif
 
 	.align 2
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 131/343] ARM: 8848/1: virt: Align GIC version check with arm64 counterpart
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 130/343] ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 132/343] regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA Greg Kroah-Hartman
                   ` (216 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Murzin, Marc Zyngier,
	Russell King, Sasha Levin

From: Vladimir Murzin <vladimir.murzin@arm.com>

[ Upstream commit 9db043d36bd379f4cc99054c079de0dabfc38d03 ]

arm64 has got relaxation on GIC version check at early boot stage due
to update of the GIC architecture let's align ARM with that.

To help backports (even though the code was correct at the time of writing)
Fixes: e59941b9b381 ("ARM: 8527/1: virt: enable GICv3 system registers")
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/hyp-stub.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
index 60146e32619a5..82a942894fc04 100644
--- a/arch/arm/kernel/hyp-stub.S
+++ b/arch/arm/kernel/hyp-stub.S
@@ -180,8 +180,8 @@ ARM_BE8(orr	r7, r7, #(1 << 25))     @ HSCTLR.EE
 	@ Check whether GICv3 system registers are available
 	mrc	p15, 0, r7, c0, c1, 1	@ ID_PFR1
 	ubfx	r7, r7, #28, #4
-	cmp	r7, #1
-	bne	2f
+	teq	r7, #0
+	beq	2f
 
 	@ Enable system register accesses
 	mrc	p15, 4, r7, c12, c9, 5	@ ICC_HSRE
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 132/343] regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 131/343] ARM: 8848/1: virt: Align GIC version check with arm64 counterpart Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 133/343] netfilter: nft_set_hash: fix lookups with fixed size hash on big endian Greg Kroah-Hartman
                   ` (215 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Charles Keepax, Mark Brown,
	Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit c25d47888f0fb3d836d68322d4aea2caf31a75a6 ]

The wm831x_dcdc_ilim entries needs to be uA because it is used to compare
with min_uA and max_uA.
While at it also make the array const and change to use unsigned int.

Fixes: e4ee831f949a ("regulator: Add WM831x DC-DC buck convertor support")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/wm831x-dcdc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
index 5a5bc4bb08d26..df591435d12a3 100644
--- a/drivers/regulator/wm831x-dcdc.c
+++ b/drivers/regulator/wm831x-dcdc.c
@@ -327,8 +327,8 @@ static int wm831x_buckv_get_voltage_sel(struct regulator_dev *rdev)
 }
 
 /* Current limit options */
-static u16 wm831x_dcdc_ilim[] = {
-	125, 250, 375, 500, 625, 750, 875, 1000
+static const unsigned int wm831x_dcdc_ilim[] = {
+	125000, 250000, 375000, 500000, 625000, 750000, 875000, 1000000
 };
 
 static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 133/343] netfilter: nft_set_hash: fix lookups with fixed size hash on big endian
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 132/343] regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 134/343] NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE() Greg Kroah-Hartman
                   ` (214 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Westphal, Pablo Neira Ayuso,
	Sasha Levin

From: Pablo Neira Ayuso <pablo@netfilter.org>

[ Upstream commit 3b02b0adc242a72b5e46019b6a9e4f84823592f6 ]

Call jhash_1word() for the 4-bytes key case from the insertion and
deactivation path, otherwise big endian arch set lookups fail.

Fixes: 446a8268b7f5 ("netfilter: nft_set_hash: add lookup variant for fixed size hashtable")
Reported-by: Florian Westphal <fw@strlen.de>
Tested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_set_hash.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 33aa2ac3a62ef..73f8f99b1193b 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -442,6 +442,23 @@ static bool nft_hash_lookup_fast(const struct net *net,
 	return false;
 }
 
+static u32 nft_jhash(const struct nft_set *set, const struct nft_hash *priv,
+		     const struct nft_set_ext *ext)
+{
+	const struct nft_data *key = nft_set_ext_key(ext);
+	u32 hash, k1;
+
+	if (set->klen == 4) {
+		k1 = *(u32 *)key;
+		hash = jhash_1word(k1, priv->seed);
+	} else {
+		hash = jhash(key, set->klen, priv->seed);
+	}
+	hash = reciprocal_scale(hash, priv->buckets);
+
+	return hash;
+}
+
 static int nft_hash_insert(const struct net *net, const struct nft_set *set,
 			   const struct nft_set_elem *elem,
 			   struct nft_set_ext **ext)
@@ -451,8 +468,7 @@ static int nft_hash_insert(const struct net *net, const struct nft_set *set,
 	u8 genmask = nft_genmask_next(net);
 	u32 hash;
 
-	hash = jhash(nft_set_ext_key(&this->ext), set->klen, priv->seed);
-	hash = reciprocal_scale(hash, priv->buckets);
+	hash = nft_jhash(set, priv, &this->ext);
 	hlist_for_each_entry(he, &priv->table[hash], node) {
 		if (!memcmp(nft_set_ext_key(&this->ext),
 			    nft_set_ext_key(&he->ext), set->klen) &&
@@ -491,8 +507,7 @@ static void *nft_hash_deactivate(const struct net *net,
 	u8 genmask = nft_genmask_next(net);
 	u32 hash;
 
-	hash = jhash(nft_set_ext_key(&this->ext), set->klen, priv->seed);
-	hash = reciprocal_scale(hash, priv->buckets);
+	hash = nft_jhash(set, priv, &this->ext);
 	hlist_for_each_entry(he, &priv->table[hash], node) {
 		if (!memcmp(nft_set_ext_key(&this->ext), &elem->key.val,
 			    set->klen) ||
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 134/343] NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 133/343] netfilter: nft_set_hash: fix lookups with fixed size hash on big endian Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 135/343] net: aquantia: fixed instack structure overflow Greg Kroah-Hartman
                   ` (213 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit 108bb4afd351d65826648a47f11fa3104e250d9b ]

If the attempt to instantiate the mirror's layout DS pointer failed,
then that pointer may hold a value of type ERR_PTR(), so we need
to check that before we dereference it.

Fixes: 65990d1afbd2d ("pNFS/flexfiles: Fix a deadlock on LAYOUTGET")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/flexfilelayout/flexfilelayout.h | 32 +++++++++++++++-----------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index d6515f1584f3c..d78ec99b6c4ca 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -131,16 +131,6 @@ FF_LAYOUT_LSEG(struct pnfs_layout_segment *lseg)
 			    generic_hdr);
 }
 
-static inline struct nfs4_deviceid_node *
-FF_LAYOUT_DEVID_NODE(struct pnfs_layout_segment *lseg, u32 idx)
-{
-	if (idx >= FF_LAYOUT_LSEG(lseg)->mirror_array_cnt ||
-	    FF_LAYOUT_LSEG(lseg)->mirror_array[idx] == NULL ||
-	    FF_LAYOUT_LSEG(lseg)->mirror_array[idx]->mirror_ds == NULL)
-		return NULL;
-	return &FF_LAYOUT_LSEG(lseg)->mirror_array[idx]->mirror_ds->id_node;
-}
-
 static inline struct nfs4_ff_layout_ds *
 FF_LAYOUT_MIRROR_DS(struct nfs4_deviceid_node *node)
 {
@@ -150,9 +140,25 @@ FF_LAYOUT_MIRROR_DS(struct nfs4_deviceid_node *node)
 static inline struct nfs4_ff_layout_mirror *
 FF_LAYOUT_COMP(struct pnfs_layout_segment *lseg, u32 idx)
 {
-	if (idx >= FF_LAYOUT_LSEG(lseg)->mirror_array_cnt)
-		return NULL;
-	return FF_LAYOUT_LSEG(lseg)->mirror_array[idx];
+	struct nfs4_ff_layout_segment *fls = FF_LAYOUT_LSEG(lseg);
+
+	if (idx < fls->mirror_array_cnt)
+		return fls->mirror_array[idx];
+	return NULL;
+}
+
+static inline struct nfs4_deviceid_node *
+FF_LAYOUT_DEVID_NODE(struct pnfs_layout_segment *lseg, u32 idx)
+{
+	struct nfs4_ff_layout_mirror *mirror = FF_LAYOUT_COMP(lseg, idx);
+
+	if (mirror != NULL) {
+		struct nfs4_ff_layout_ds *mirror_ds = mirror->mirror_ds;
+
+		if (!IS_ERR_OR_NULL(mirror_ds))
+			return &mirror_ds->id_node;
+	}
+	return NULL;
 }
 
 static inline u32
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 135/343] net: aquantia: fixed instack structure overflow
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 134/343] NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 136/343] powerpc/mm: Check secondary hash page table Greg Kroah-Hartman
                   ` (212 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nikita Danilov, Igor Russkikh,
	David S. Miller, Sasha Levin

From: Igor Russkikh <Igor.Russkikh@aquantia.com>

[ Upstream commit 8006e3730b6e900319411e35cee85b4513d298df ]

This is a real stack undercorruption found by kasan build.

The issue did no harm normally because it only overflowed
2 bytes after `bitary` array which on most architectures
were mapped into `err` local.

Fixes: bab6de8fd180 ("net: ethernet: aquantia: Atlantic A0 and B0 specific functions.")
Signed-off-by: Nikita Danilov <nikita.danilov@aquantia.com>
Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c | 4 ++--
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index b0abd187cead9..b83ee74d28391 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -182,8 +182,8 @@ static int hw_atl_a0_hw_rss_set(struct aq_hw_s *self,
 	u32 i = 0U;
 	u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues);
 	int err = 0;
-	u16 bitary[(HW_ATL_A0_RSS_REDIRECTION_MAX *
-					HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)];
+	u16 bitary[1 + (HW_ATL_A0_RSS_REDIRECTION_MAX *
+		   HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)];
 
 	memset(bitary, 0, sizeof(bitary));
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 236325f48ec9b..1c1bb074f6645 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -183,8 +183,8 @@ static int hw_atl_b0_hw_rss_set(struct aq_hw_s *self,
 	u32 i = 0U;
 	u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues);
 	int err = 0;
-	u16 bitary[(HW_ATL_B0_RSS_REDIRECTION_MAX *
-					HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)];
+	u16 bitary[1 + (HW_ATL_B0_RSS_REDIRECTION_MAX *
+		   HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)];
 
 	memset(bitary, 0, sizeof(bitary));
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 136/343] powerpc/mm: Check secondary hash page table
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 135/343] net: aquantia: fixed instack structure overflow Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 137/343] nios2: ksyms: Add missing symbol exports Greg Kroah-Hartman
                   ` (211 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rashmica Gupta, Michael Ellerman,
	Sasha Levin

From: Rashmica Gupta <rashmica.g@gmail.com>

[ Upstream commit 790845e2f12709d273d08ea7a2af7c2593689519 ]

We were always calling base_hpte_find() with primary = true,
even when we wanted to check the secondary table.

mpe: I broke this when refactoring Rashmica's original patch.

Fixes: 1515ab932156 ("powerpc/mm: Dump hash table")
Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/mm/dump_hashpagetable.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/mm/dump_hashpagetable.c b/arch/powerpc/mm/dump_hashpagetable.c
index 5c4c93dcff190..f666d74f05f51 100644
--- a/arch/powerpc/mm/dump_hashpagetable.c
+++ b/arch/powerpc/mm/dump_hashpagetable.c
@@ -343,7 +343,7 @@ static unsigned long hpte_find(struct pg_state *st, unsigned long ea, int psize)
 
 	/* Look in secondary table */
 	if (slot == -1)
-		slot = base_hpte_find(ea, psize, true, &v, &r);
+		slot = base_hpte_find(ea, psize, false, &v, &r);
 
 	/* No entry found */
 	if (slot == -1)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 137/343] nios2: ksyms: Add missing symbol exports
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 136/343] powerpc/mm: Check secondary hash page table Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 138/343] x86/mm: Remove unused variable cpu Greg Kroah-Hartman
                   ` (210 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guenter Roeck, Ley Foon Tan, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 0f8ed994575429d6042cf5d7ef70081c94091587 ]

Building nios2:allmodconfig fails as follows (each symbol is only listed
once).

ERROR: "__ashldi3" [drivers/md/dm-writecache.ko] undefined!
ERROR: "__ashrdi3" [fs/xfs/xfs.ko] undefined!
ERROR: "__ucmpdi2" [drivers/media/i2c/adv7842.ko] undefined!
ERROR: "__lshrdi3" [drivers/md/dm-zoned.ko] undefined!
ERROR: "flush_icache_range" [drivers/misc/lkdtm/lkdtm.ko] undefined!
ERROR: "empty_zero_page" [drivers/md/dm-mod.ko] undefined!

The problem is seen with gcc 7.3.0.

Export the missing symbols.

Fixes: 2fc8483fdcde ("nios2: Build infrastructure")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/nios2/kernel/nios2_ksyms.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/arch/nios2/kernel/nios2_ksyms.c b/arch/nios2/kernel/nios2_ksyms.c
index bf2f55d10a4d8..4e704046a150c 100644
--- a/arch/nios2/kernel/nios2_ksyms.c
+++ b/arch/nios2/kernel/nios2_ksyms.c
@@ -9,12 +9,20 @@
 #include <linux/export.h>
 #include <linux/string.h>
 
+#include <asm/cacheflush.h>
+#include <asm/pgtable.h>
+
 /* string functions */
 
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memmove);
 
+/* memory management */
+
+EXPORT_SYMBOL(empty_zero_page);
+EXPORT_SYMBOL(flush_icache_range);
+
 /*
  * libgcc functions - functions that are used internally by the
  * compiler...  (prototypes are not correct though, but that
@@ -31,3 +39,7 @@ DECLARE_EXPORT(__udivsi3);
 DECLARE_EXPORT(__umoddi3);
 DECLARE_EXPORT(__umodsi3);
 DECLARE_EXPORT(__muldi3);
+DECLARE_EXPORT(__ucmpdi2);
+DECLARE_EXPORT(__lshrdi3);
+DECLARE_EXPORT(__ashldi3);
+DECLARE_EXPORT(__ashrdi3);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 138/343] x86/mm: Remove unused variable cpu
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 137/343] nios2: ksyms: Add missing symbol exports Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 139/343] scsi: megaraid_sas: reduce module load time Greg Kroah-Hartman
                   ` (209 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qian Cai, Thomas Gleixner,
	Andyt Lutomirski, dave.hansen, peterz, bp, hpa, Sasha Levin

From: Qian Cai <cai@lca.pw>

[ Upstream commit 3609e31bc8dc03b701390f79c74fc7fe92b95039 ]

The commit a2055abe9c67 ("x86/mm: Pass flush_tlb_info to
flush_tlb_others() etc") removed the unnecessary cpu parameter from
uv_flush_tlb_others() but left an unused variable.

arch/x86/mm/tlb.c: In function 'native_flush_tlb_others':
arch/x86/mm/tlb.c:688:16: warning: variable 'cpu' set but not used
[-Wunused-but-set-variable]
   unsigned int cpu;
                ^~~

Fixes: a2055abe9c67 ("x86/mm: Pass flush_tlb_info to flush_tlb_others() etc")
Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Andyt Lutomirski <luto@kernel.org>
Cc: dave.hansen@linux.intel.com
Cc: peterz@infradead.org
Cc: bp@alien8.de
Cc: hpa@zytor.com
Link: https://lkml.kernel.org/r/20190228220155.88124-1-cai@lca.pw
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/mm/tlb.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 5400a24e1a8c0..c5d7b4ae17cab 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -651,9 +651,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask,
 		 * that UV should be updated so that smp_call_function_many(),
 		 * etc, are optimal on UV.
 		 */
-		unsigned int cpu;
-
-		cpu = smp_processor_id();
 		cpumask = uv_flush_tlb_others(cpumask, info);
 		if (cpumask)
 			smp_call_function_many(cpumask, flush_tlb_func_remote,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 139/343] scsi: megaraid_sas: reduce module load time
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 138/343] x86/mm: Remove unused variable cpu Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 140/343] drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen() Greg Kroah-Hartman
                   ` (208 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve Sistare, Sumit Saxena,
	Martin K. Petersen, Sasha Levin

From: Steve Sistare <steven.sistare@oracle.com>

[ Upstream commit 31b6a05f86e690e1818116fd23c3be915cc9d9ed ]

megaraid_sas takes 1+ seconds to load while waiting for firmware:

[2.822603] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
[3.871003] megaraid_sas 0000:03:00.0: FW now in Ready state

This is due to the following loop in megasas_transition_to_ready(), which
waits a minimum of 1 second, even though the FW becomes ready in tens of
millisecs:

        /*
         * The cur_state should not last for more than max_wait secs
         */
        for (i = 0; i < max_wait; i++) {
                ...
                msleep(1000);
        ...
        dev_info(&instance->pdev->dev, "FW now in Ready state\n");

This is a regression, caused by a change of the msleep granularity from 1
to 1000 due to concern about waiting too long on systems with coarse
jiffies.

To fix, increase iterations and use msleep(20), which results in:

[2.670627] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
[2.739386] megaraid_sas 0000:03:00.0: FW now in Ready state

Fixes: fb2f3e96d80f ("scsi: megaraid_sas: Fix msleep granularity")
Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/megaraid/megaraid_sas_base.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 577513649afbe..6abad63b127af 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -3823,12 +3823,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
 		/*
 		 * The cur_state should not last for more than max_wait secs
 		 */
-		for (i = 0; i < max_wait; i++) {
+		for (i = 0; i < max_wait * 50; i++) {
 			curr_abs_state = instance->instancet->
 				read_fw_status_reg(instance->reg_set);
 
 			if (abs_state == curr_abs_state) {
-				msleep(1000);
+				msleep(20);
 			} else
 				break;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 140/343] drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 139/343] scsi: megaraid_sas: reduce module load time Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 141/343] xen, cpu_hotplug: Prevent an out of bounds access Greg Kroah-Hartman
                   ` (207 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Andrew Morton,
	Matt Porter, Alexandre Bounine, Linus Torvalds, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 5ac188b12e7cbdd92dee60877d1fac913fc1d074 ]

If riocm_get_channel() fails, then we should just return -EINVAL.
Calling riocm_put_channel() will trigger a NULL dereference and
generally we should call put() if the get() didn't succeed.

Link: http://lkml.kernel.org/r/20190110130230.GB27017@kadam
Fixes: b6e8d4aa1110 ("rapidio: add RapidIO channelized messaging driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Alexandre Bounine <alexandre.bounine@idt.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rapidio/rio_cm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
index ef989a15aefc4..b29fc258eeba4 100644
--- a/drivers/rapidio/rio_cm.c
+++ b/drivers/rapidio/rio_cm.c
@@ -1215,7 +1215,9 @@ static int riocm_ch_listen(u16 ch_id)
 	riocm_debug(CHOP, "(ch_%d)", ch_id);
 
 	ch = riocm_get_channel(ch_id);
-	if (!ch || !riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
+	if (!ch)
+		return -EINVAL;
+	if (!riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
 		ret = -EINVAL;
 	riocm_put_channel(ch);
 	return ret;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 141/343] xen, cpu_hotplug: Prevent an out of bounds access
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 140/343] drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 142/343] net: sh_eth: fix a missing check of of_get_phy_mode Greg Kroah-Hartman
                   ` (206 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Juergen Gross, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 201676095dda7e5b31a5e1d116d10fc22985075e ]

The "cpu" variable comes from the sscanf() so Smatch marks it as
untrusted data.  We can't pass a higher value than "nr_cpu_ids" to
cpu_possible() or it results in an out of bounds access.

Fixes: d68d82afd4c8 ("xen: implement CPU hotplugging")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/cpu_hotplug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
index b1357aa4bc552..f192b6f42da9f 100644
--- a/drivers/xen/cpu_hotplug.c
+++ b/drivers/xen/cpu_hotplug.c
@@ -54,7 +54,7 @@ static int vcpu_online(unsigned int cpu)
 }
 static void vcpu_hotplug(unsigned int cpu)
 {
-	if (!cpu_possible(cpu))
+	if (cpu >= nr_cpu_ids || !cpu_possible(cpu))
 		return;
 
 	switch (vcpu_online(cpu)) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 142/343] net: sh_eth: fix a missing check of of_get_phy_mode
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 141/343] xen, cpu_hotplug: Prevent an out of bounds access Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 143/343] regulator: lp87565: Fix missing register for LP87565_BUCK_0 Greg Kroah-Hartman
                   ` (205 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kangjie Lu, Sergei Shtylyov,
	Geert Uytterhoeven, David S. Miller, Sasha Levin

From: Kangjie Lu <kjlu@umn.edu>

[ Upstream commit 035a14e71f27eefa50087963b94cbdb3580d08bf ]

of_get_phy_mode may fail and return a negative error code;
the fix checks the return value of of_get_phy_mode and
returns NULL of it fails.

Fixes: b356e978e92f ("sh_eth: add device tree support")
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/renesas/sh_eth.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 9b1906a65e113..25f3b2ad26e9c 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -3046,12 +3046,16 @@ static struct sh_eth_plat_data *sh_eth_parse_dt(struct device *dev)
 	struct device_node *np = dev->of_node;
 	struct sh_eth_plat_data *pdata;
 	const char *mac_addr;
+	int ret;
 
 	pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
 	if (!pdata)
 		return NULL;
 
-	pdata->phy_interface = of_get_phy_mode(np);
+	ret = of_get_phy_mode(np);
+	if (ret < 0)
+		return NULL;
+	pdata->phy_interface = ret;
 
 	mac_addr = of_get_mac_address(np);
 	if (mac_addr)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 143/343] regulator: lp87565: Fix missing register for LP87565_BUCK_0
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 142/343] net: sh_eth: fix a missing check of of_get_phy_mode Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 144/343] media: ivtv: update *pos correctly in ivtv_read_pos() Greg Kroah-Hartman
                   ` (204 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Keerthy, Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit d1a6cbdf1e597917cb642c655512d91b71a35d22 ]

LP87565_BUCK_0 is missed, fix it.

Fixes: f0168a9bf ("regulator: lp87565: Add support for lp87565 PMIC regulators")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Reviewed-by: Keerthy <j-keerthy@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/lp87565-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/lp87565-regulator.c b/drivers/regulator/lp87565-regulator.c
index cfdbe294fb6af..32d4e6ec2e198 100644
--- a/drivers/regulator/lp87565-regulator.c
+++ b/drivers/regulator/lp87565-regulator.c
@@ -188,7 +188,7 @@ static int lp87565_regulator_probe(struct platform_device *pdev)
 	struct lp87565 *lp87565 = dev_get_drvdata(pdev->dev.parent);
 	struct regulator_config config = { };
 	struct regulator_dev *rdev;
-	int i, min_idx = LP87565_BUCK_1, max_idx = LP87565_BUCK_3;
+	int i, min_idx = LP87565_BUCK_0, max_idx = LP87565_BUCK_3;
 
 	platform_set_drvdata(pdev, lp87565);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 144/343] media: ivtv: update *pos correctly in ivtv_read_pos()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 143/343] regulator: lp87565: Fix missing register for LP87565_BUCK_0 Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 145/343] media: cx18: update *pos correctly in cx18_read_pos() Greg Kroah-Hartman
                   ` (203 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f8e579f3ca0973daef263f513da5edff520a6c0d ]

We had intended to update *pos, but the current code is a no-op.

Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/ivtv/ivtv-fileops.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
index c9bd018e53de6..e2b19c3eaa876 100644
--- a/drivers/media/pci/ivtv/ivtv-fileops.c
+++ b/drivers/media/pci/ivtv/ivtv-fileops.c
@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co
 
 	IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
 	if (rc > 0)
-		pos += rc;
+		*pos += rc;
 	return rc;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 145/343] media: cx18: update *pos correctly in cx18_read_pos()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 144/343] media: ivtv: update *pos correctly in ivtv_read_pos() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 146/343] media: wl128x: Fix an error code in fm_download_firmware() Greg Kroah-Hartman
                   ` (202 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 7afb0df554292dca7568446f619965fb8153085d ]

We should be updating *pos.  The current code is a no-op.

Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cx18/cx18-fileops.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c
index 98467b2089fa8..099d59b992c1b 100644
--- a/drivers/media/pci/cx18/cx18-fileops.c
+++ b/drivers/media/pci/cx18/cx18-fileops.c
@@ -484,7 +484,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf,
 
 	CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
 	if (rc > 0)
-		pos += rc;
+		*pos += rc;
 	return rc;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 146/343] media: wl128x: Fix an error code in fm_download_firmware()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 145/343] media: cx18: update *pos correctly in cx18_read_pos() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 147/343] media: cx23885: check allocation return Greg Kroah-Hartman
                   ` (201 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3 ]

We forgot to set "ret" on this error path.

Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/radio/wl128x/fmdrv_common.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
index 26895ae42fcf4..2d20d908e2803 100644
--- a/drivers/media/radio/wl128x/fmdrv_common.c
+++ b/drivers/media/radio/wl128x/fmdrv_common.c
@@ -1271,8 +1271,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
 
 		switch (action->type) {
 		case ACTION_SEND_COMMAND:	/* Send */
-			if (fmc_send_cmd(fmdev, 0, 0, action->data,
-						action->size, NULL, NULL))
+			ret = fmc_send_cmd(fmdev, 0, 0, action->data,
+					   action->size, NULL, NULL);
+			if (ret)
 				goto rel_fw;
 
 			cmd_cnt++;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 147/343] media: cx23885: check allocation return
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 146/343] media: wl128x: Fix an error code in fm_download_firmware() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 148/343] regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB Greg Kroah-Hartman
                   ` (200 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Sean Young,
	Mauro Carvalho Chehab, Sasha Levin

From: Nicholas Mc Guire <hofrat@osadl.org>

[ Upstream commit a3d7f22ef34ec4206b50ee121384d5c8bebd5591 ]

Checking of kmalloc() seems to have been committed - as
cx23885_dvb_register() is checking for != 0 return, returning
-ENOMEM should be fine here.  While at it address the coccicheck
suggestion to move to kmemdup rather than using kmalloc+memcpy.

Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2")

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cx23885/cx23885-dvb.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
index e795ddeb7fe28..60f122edaefb3 100644
--- a/drivers/media/pci/cx23885/cx23885-dvb.c
+++ b/drivers/media/pci/cx23885/cx23885-dvb.c
@@ -1460,8 +1460,9 @@ static int dvb_register(struct cx23885_tsport *port)
 		if (fe0->dvb.frontend != NULL) {
 			struct i2c_adapter *tun_i2c;
 
-			fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
-			memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
+			fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL);
+			if (!fe0->dvb.frontend->sec_priv)
+				return -ENOMEM;
 			tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1);
 			if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config))
 				return -ENODEV;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 148/343] regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 147/343] media: cx23885: check allocation return Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 149/343] jfs: fix bogus variable self-initialization Greg Kroah-Hartman
                   ` (199 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Andrew F. Davis,
	Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit e69b394703e032e56a140172440ec4f9890b536d ]

selector 0xB (1011) should be 2.6V rather than 2.7V, fit ix.

Table 5-4. LDOA1 Output Voltage Options
VID Bits VOUT VID Bits VOUT VID Bits VOUT VID Bits VOUT
0000     1.35 0100     1.8  1000     2.3  1100     2.85
0001     1.5  0101     1.9  1001     2.4  1101     3.0
0010     1.6  0110     2.0  1010     2.5  1110     3.3
0011     1.7  0111     2.1  1011     2.6  1111     Not Used

Fixes: d2a2e729a666 ("regulator: tps65086: Add regulator driver for the TPS65086 PMIC")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/tps65086-regulator.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/regulator/tps65086-regulator.c b/drivers/regulator/tps65086-regulator.c
index 45e96e1546900..5a5e9b5bf4bea 100644
--- a/drivers/regulator/tps65086-regulator.c
+++ b/drivers/regulator/tps65086-regulator.c
@@ -90,8 +90,8 @@ static const struct regulator_linear_range tps65086_buck345_25mv_ranges[] = {
 static const struct regulator_linear_range tps65086_ldoa1_ranges[] = {
 	REGULATOR_LINEAR_RANGE(1350000, 0x0, 0x0, 0),
 	REGULATOR_LINEAR_RANGE(1500000, 0x1, 0x7, 100000),
-	REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xA, 100000),
-	REGULATOR_LINEAR_RANGE(2700000, 0xB, 0xD, 150000),
+	REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xB, 100000),
+	REGULATOR_LINEAR_RANGE(2850000, 0xC, 0xD, 150000),
 	REGULATOR_LINEAR_RANGE(3300000, 0xE, 0xE, 0),
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 149/343] jfs: fix bogus variable self-initialization
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 148/343] regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 150/343] tipc: tipc clang warning Greg Kroah-Hartman
                   ` (198 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Dave Kleikamp, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit a5fdd713d256887b5f012608701149fa939e5645 ]

A statement was originally added in 2006 to shut up a gcc warning,
now but now clang warns about it:

fs/jfs/jfs_txnmgr.c:1932:15: error: variable 'pxd' is uninitialized when used within its own initialization
      [-Werror,-Wuninitialized]
                pxd_t pxd = pxd;        /* truncated extent of xad */
                      ~~~   ^~~

Modern versions of gcc are fine without the silly assignment, so just
drop it. Tested with gcc-4.6 (released 2011), 4.7, 4.8, and 4.9.

Fixes: c9e3ad6021e5 ("JFS: Get rid of "may be used uninitialized" warnings")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/jfs_txnmgr.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index 4d973524c8879..224ef034004b7 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -1928,8 +1928,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
 	 * header ?
 	 */
 	if (tlck->type & tlckTRUNCATE) {
-		/* This odd declaration suppresses a bogus gcc warning */
-		pxd_t pxd = pxd;	/* truncated extent of xad */
+		pxd_t pxd;	/* truncated extent of xad */
 		int twm;
 
 		/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 150/343] tipc: tipc clang warning
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 149/343] jfs: fix bogus variable self-initialization Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 151/343] m68k: mac: Fix VIA timer counter accesses Greg Kroah-Hartman
                   ` (197 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Jon Maloy,
	David S. Miller, Sasha Levin

From: Jon Maloy <jon.maloy@ericsson.com>

[ Upstream commit 737889efe9713a0f20a75fd0de952841d9275e6b ]

When checking the code with clang -Wsometimes-uninitialized we get the
following warning:

if (!tipc_link_is_establishing(l)) {
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
net/tipc/node.c:847:46: note: uninitialized use occurs here
      tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);

net/tipc/node.c:831:2: note: remove the 'if' if its condition is always
true
if (!tipc_link_is_establishing(l)) {
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
net/tipc/node.c:821:31: note: initialize the variable 'maddr' to silence
this warning
struct tipc_media_addr *maddr;

We fix this by initializing 'maddr' to NULL. For the matter of clarity,
we also test if 'xmitq' is non-empty before we use it and 'maddr'
further down in the  function. It will never happen that 'xmitq' is non-
empty at the same time as 'maddr' is NULL, so this is a sufficient test.

Fixes: 598411d70f85 ("tipc: make resetting of links non-atomic")
Reported-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/node.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/tipc/node.c b/net/tipc/node.c
index 42e9bdcc4bb6e..82f8f69f4d6b0 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -688,10 +688,10 @@ static void __tipc_node_link_down(struct tipc_node *n, int *bearer_id,
 static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
 {
 	struct tipc_link_entry *le = &n->links[bearer_id];
+	struct tipc_media_addr *maddr = NULL;
 	struct tipc_link *l = le->link;
-	struct tipc_media_addr *maddr;
-	struct sk_buff_head xmitq;
 	int old_bearer_id = bearer_id;
+	struct sk_buff_head xmitq;
 
 	if (!l)
 		return;
@@ -713,7 +713,8 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
 	tipc_node_write_unlock(n);
 	if (delete)
 		tipc_mon_remove_peer(n->net, n->addr, old_bearer_id);
-	tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
+	if (!skb_queue_empty(&xmitq))
+		tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
 	tipc_sk_rcv(n->net, &le->inputq);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 151/343] m68k: mac: Fix VIA timer counter accesses
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 150/343] tipc: tipc clang warning Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 152/343] arm64: dts: allwinner: a64: Add missing PIO clocks Greg Kroah-Hartman
                   ` (196 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Finn Thain, Geert Uytterhoeven, Sasha Levin

From: Finn Thain <fthain@telegraphics.com.au>

[ Upstream commit 0ca7ce7db771580433bf24454f7a1542bd326078 ]

This resolves some bugs that affect VIA timer counter accesses.
Avoid lost interrupts caused by reading the counter low byte register.
Make allowance for the fact that the counter will be decremented to
0xFFFF before being reloaded.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/mac/via.c | 102 +++++++++++++++++++++++---------------------
 1 file changed, 53 insertions(+), 49 deletions(-)

diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
index 9f59a662ace57..7334245abf26f 100644
--- a/arch/m68k/mac/via.c
+++ b/arch/m68k/mac/via.c
@@ -54,16 +54,6 @@ static __u8 rbv_clear;
 
 static int gIER,gIFR,gBufA,gBufB;
 
-/*
- * Timer defs.
- */
-
-#define TICK_SIZE		10000
-#define MAC_CLOCK_TICK		(783300/HZ)		/* ticks per HZ */
-#define MAC_CLOCK_LOW		(MAC_CLOCK_TICK&0xFF)
-#define MAC_CLOCK_HIGH		(MAC_CLOCK_TICK>>8)
-
-
 /*
  * On Macs with a genuine VIA chip there is no way to mask an individual slot
  * interrupt. This limitation also seems to apply to VIA clone logic cores in
@@ -278,22 +268,6 @@ void __init via_init(void)
 	}
 }
 
-/*
- * Start the 100 Hz clock
- */
-
-void __init via_init_clock(irq_handler_t func)
-{
-	via1[vACR] |= 0x40;
-	via1[vT1LL] = MAC_CLOCK_LOW;
-	via1[vT1LH] = MAC_CLOCK_HIGH;
-	via1[vT1CL] = MAC_CLOCK_LOW;
-	via1[vT1CH] = MAC_CLOCK_HIGH;
-
-	if (request_irq(IRQ_MAC_TIMER_1, func, 0, "timer", func))
-		pr_err("Couldn't register %s interrupt\n", "timer");
-}
-
 /*
  * Debugging dump, used in various places to see what's going on.
  */
@@ -321,29 +295,6 @@ void via_debug_dump(void)
 	}
 }
 
-/*
- * This is always executed with interrupts disabled.
- *
- * TBI: get time offset between scheduling timer ticks
- */
-
-u32 mac_gettimeoffset(void)
-{
-	unsigned long ticks, offset = 0;
-
-	/* read VIA1 timer 2 current value */
-	ticks = via1[vT1CL] | (via1[vT1CH] << 8);
-	/* The probability of underflow is less than 2% */
-	if (ticks > MAC_CLOCK_TICK - MAC_CLOCK_TICK / 50)
-		/* Check for pending timer interrupt in VIA1 IFR */
-		if (via1[vIFR] & 0x40) offset = TICK_SIZE;
-
-	ticks = MAC_CLOCK_TICK - ticks;
-	ticks = ticks * 10000L / MAC_CLOCK_TICK;
-
-	return (ticks + offset) * 1000;
-}
-
 /*
  * Flush the L2 cache on Macs that have it by flipping
  * the system into 24-bit mode for an instant.
@@ -612,3 +563,56 @@ int via2_scsi_drq_pending(void)
 	return via2[gIFR] & (1 << IRQ_IDX(IRQ_MAC_SCSIDRQ));
 }
 EXPORT_SYMBOL(via2_scsi_drq_pending);
+
+/* timer and clock source */
+
+#define VIA_CLOCK_FREQ     783360                /* VIA "phase 2" clock in Hz */
+#define VIA_TIMER_INTERVAL (1000000 / HZ)        /* microseconds per jiffy */
+#define VIA_TIMER_CYCLES   (VIA_CLOCK_FREQ / HZ) /* clock cycles per jiffy */
+
+#define VIA_TC             (VIA_TIMER_CYCLES - 2) /* including 0 and -1 */
+#define VIA_TC_LOW         (VIA_TC & 0xFF)
+#define VIA_TC_HIGH        (VIA_TC >> 8)
+
+void __init via_init_clock(irq_handler_t timer_routine)
+{
+	if (request_irq(IRQ_MAC_TIMER_1, timer_routine, 0, "timer", NULL)) {
+		pr_err("Couldn't register %s interrupt\n", "timer");
+		return;
+	}
+
+	via1[vT1LL] = VIA_TC_LOW;
+	via1[vT1LH] = VIA_TC_HIGH;
+	via1[vT1CL] = VIA_TC_LOW;
+	via1[vT1CH] = VIA_TC_HIGH;
+	via1[vACR] |= 0x40;
+}
+
+u32 mac_gettimeoffset(void)
+{
+	unsigned long flags;
+	u8 count_high;
+	u16 count, offset = 0;
+
+	/*
+	 * Timer counter wrap-around is detected with the timer interrupt flag
+	 * but reading the counter low byte (vT1CL) would reset the flag.
+	 * Also, accessing both counter registers is essentially a data race.
+	 * These problems are avoided by ignoring the low byte. Clock accuracy
+	 * is 256 times worse (error can reach 0.327 ms) but CPU overhead is
+	 * reduced by avoiding slow VIA register accesses.
+	 */
+
+	local_irq_save(flags);
+	count_high = via1[vT1CH];
+	if (count_high == 0xFF)
+		count_high = 0;
+	if (count_high > 0 && (via1[vIFR] & VIA_TIMER_1_INT))
+		offset = VIA_TIMER_CYCLES;
+	local_irq_restore(flags);
+
+	count = count_high << 8;
+	count = VIA_TIMER_CYCLES - count + offset;
+
+	return ((count * VIA_TIMER_INTERVAL) / VIA_TIMER_CYCLES) * 1000;
+}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 152/343] arm64: dts: allwinner: a64: Add missing PIO clocks
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 151/343] m68k: mac: Fix VIA timer counter accesses Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 153/343] ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset() Greg Kroah-Hartman
                   ` (195 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

From: Maxime Ripard <maxime.ripard@bootlin.com>

[ Upstream commit 562bf19611c000cb7219431c3cc78aa60c2b371e ]

The pinctrl binding mandates that we have the three clocks fed into the PIO
described.

Even though the old case is still supported for backward compatibility, we
should update our DTs to fix this.

Fixes: 6bc37fac30cf ("arm64: dts: add Allwinner A64 SoC .dtsi")
Acked-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
index 8c8db1b057dfc..788a6f8c5994e 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
@@ -274,7 +274,8 @@
 			interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&ccu 58>;
+			clocks = <&ccu 58>, <&osc24M>, <&rtc 0>;
+			clock-names = "apb", "hosc", "losc";
 			gpio-controller;
 			#gpio-cells = <3>;
 			interrupt-controller;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 153/343] ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 152/343] arm64: dts: allwinner: a64: Add missing PIO clocks Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 154/343] media: davinci-isif: avoid uninitialized variable use Greg Kroah-Hartman
                   ` (194 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Walmsley, Tero Kristo,
	Tony Lindgren, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 7f0d078667a494466991aa7133f49594f32ff6a2 ]

Commit 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior") made
the call to _enable() conditional based on no oh->rst_lines_cnt. This
caused the return value to be potentially uninitialized. Curiously we see
no compiler warnings for this, probably as this gets inlined.

We call _setup_reset() from _setup() and only _setup_postsetup() if the
return value is zero. Currently the return value can be uninitialized for
cases where oh->rst_lines_cnt is set and HWMOD_INIT_NO_RESET is not set.

Fixes: 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior")
Cc: Paul Walmsley <paul@pwsan.com>
Cc: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-omap2/omap_hwmod.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 45c8f2ef4e23c..9274a484c6a39 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2530,7 +2530,7 @@ static void _setup_iclk_autoidle(struct omap_hwmod *oh)
  */
 static int _setup_reset(struct omap_hwmod *oh)
 {
-	int r;
+	int r = 0;
 
 	if (oh->_state != _HWMOD_STATE_INITIALIZED)
 		return -EINVAL;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 154/343] media: davinci-isif: avoid uninitialized variable use
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 153/343] ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 155/343] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame Greg Kroah-Hartman
                   ` (193 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Nathan Chancellor,
	Lad, Prabhakar, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 0e633f97162c1c74c68e2eb20bbd9259dce87cd9 ]

clang warns about a possible variable use that gcc never
complained about:

drivers/media/platform/davinci/isif.c:982:32: error: variable 'frame_size' is uninitialized when used here
      [-Werror,-Wuninitialized]
                dm365_vpss_set_pg_frame_size(frame_size);
                                             ^~~~~~~~~~
drivers/media/platform/davinci/isif.c:887:2: note: variable 'frame_size' is declared here
        struct vpss_pg_frame_size frame_size;
        ^
1 error generated.

There is no initialization for this variable at all, and there
has never been one in the mainline kernel, so we really should
not put that stack data into an mmio register.

On the other hand, I suspect that gcc checks the condition
more closely and notices that the global
isif_cfg.bayer.config_params.test_pat_gen flag is initialized
to zero and never written to from any code path, so anything
depending on it can be eliminated.

To shut up the clang warning, just remove the dead code manually,
it has probably never been used because any attempt to do so
would have resulted in undefined behavior.

Fixes: 63e3ab142fa3 ("V4L/DVB: V4L - vpfe capture - source for ISIF driver on DM365")

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/davinci/isif.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
index 90d0f13283ae9..12065ad1ac457 100644
--- a/drivers/media/platform/davinci/isif.c
+++ b/drivers/media/platform/davinci/isif.c
@@ -886,9 +886,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params)
 static int isif_config_ycbcr(void)
 {
 	struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
-	struct vpss_pg_frame_size frame_size;
 	u32 modeset = 0, ccdcfg = 0;
-	struct vpss_sync_pol sync;
 
 	dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
 
@@ -976,13 +974,6 @@ static int isif_config_ycbcr(void)
 		/* two fields are interleaved in memory */
 		regw(0x00000249, SDOFST);
 
-	/* Setup test pattern if enabled */
-	if (isif_cfg.bayer.config_params.test_pat_gen) {
-		sync.ccdpg_hdpol = params->hd_pol;
-		sync.ccdpg_vdpol = params->vd_pol;
-		dm365_vpss_set_sync_pol(sync);
-		dm365_vpss_set_pg_frame_size(frame_size);
-	}
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 155/343] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 154/343] media: davinci-isif: avoid uninitialized variable use Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 156/343] spi: tegra114: clear packed bit for unpacked mode Greg Kroah-Hartman
                   ` (192 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 2e7682ebfc750177a4944eeb56e97a3f05734528 ]

'vb' null check should be done before dereferencing it in
tw5864_handle_frame, otherwise a NULL pointer dereference
may occur.

Fixes: 34d1324edd31 ("[media] pci: Add tw5864 driver")

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/tw5864/tw5864-video.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
index e7bd2b8484e3d..ee1230440b397 100644
--- a/drivers/media/pci/tw5864/tw5864-video.c
+++ b/drivers/media/pci/tw5864/tw5864-video.c
@@ -1395,13 +1395,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame)
 	input->vb = NULL;
 	spin_unlock_irqrestore(&input->slock, flags);
 
-	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
-
 	if (!vb) { /* Gone because of disabling */
 		dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n");
 		return;
 	}
 
+	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
+
 	/*
 	 * Check for space.
 	 * Mind the overhead of startcode emulation prevention.
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 156/343] spi: tegra114: clear packed bit for unpacked mode
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 155/343] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 157/343] spi: tegra114: fix for unpacked mode transfers Greg Kroah-Hartman
                   ` (191 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowjanya Komatineni, Mark Brown, Sasha Levin

From: Sowjanya Komatineni <skomatineni@nvidia.com>

[ Upstream commit 7b3d10cdf54b8bc1dc0da21faed9789ac4da3684 ]

Fixes: Clear packed bit when not using packed mode.

Packed bit is not cleared when not using packed mode. This results
in transfer timeouts for the unpacked mode transfers followed by the
packed mode transfers.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index 2ad04796ef298..3a6b202dfffe0 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -730,6 +730,8 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
 
 	if (tspi->is_packed)
 		command1 |= SPI_PACKED;
+	else
+		command1 &= ~SPI_PACKED;
 
 	command1 &= ~(SPI_CS_SEL_MASK | SPI_TX_EN | SPI_RX_EN);
 	tspi->cur_direction = 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 157/343] spi: tegra114: fix for unpacked mode transfers
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 156/343] spi: tegra114: clear packed bit for unpacked mode Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 158/343] spi: tegra114: terminate dma and reset on transfer timeout Greg Kroah-Hartman
                   ` (190 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowjanya Komatineni, Mark Brown, Sasha Levin

From: Sowjanya Komatineni <skomatineni@nvidia.com>

[ Upstream commit 1a89ac5b91895127f7c586ec5075c3753ca25501 ]

Fixes: computation of actual bytes to fill/receive in/from FIFO in unpacked
mode when transfer length is not a multiple of requested bits per word.

unpacked mode transfers fails when the transfer includes partial bytes in
the last word.

Total words to be written/read to/from FIFO is computed based on transfer
length and bits per word. Unpacked mode includes 0 padding bytes for partial
words to align with bits per word and these extra bytes are also accounted
for calculating bytes left to transfer in the current driver.

This causes extra bytes access of tx/rx buffers along with buffer index
position crossing actual length where remain_len becomes negative and due to
unsigned type, negative value is a 32 bit representation of signed value
and transferred bytes never meets the actual transfer length resulting in
transfer timeout and a hang.

This patch fixes this with proper computation of the actual bytes to fill in
FIFO during transmit and the actual bytes to read from FIFO during receive
ignoring 0 padded bytes.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 43 +++++++++++++++++++++++++++++++-------
 1 file changed, 36 insertions(+), 7 deletions(-)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index 3a6b202dfffe0..c6674b01e0fd6 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -307,10 +307,16 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
 				x |= (u32)(*tx_buf++) << (i * 8);
 			tegra_spi_writel(tspi, x, SPI_TX_FIFO);
 		}
+
+		tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
 	} else {
+		unsigned int write_bytes;
 		max_n_32bit = min(tspi->curr_dma_words,  tx_empty_count);
 		written_words = max_n_32bit;
 		nbytes = written_words * tspi->bytes_per_word;
+		if (nbytes > t->len - tspi->cur_pos)
+			nbytes = t->len - tspi->cur_pos;
+		write_bytes = nbytes;
 		for (count = 0; count < max_n_32bit; count++) {
 			u32 x = 0;
 
@@ -319,8 +325,10 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
 				x |= (u32)(*tx_buf++) << (i * 8);
 			tegra_spi_writel(tspi, x, SPI_TX_FIFO);
 		}
+
+		tspi->cur_tx_pos += write_bytes;
 	}
-	tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
+
 	return written_words;
 }
 
@@ -344,20 +352,27 @@ static unsigned int tegra_spi_read_rx_fifo_to_client_rxbuf(
 			for (i = 0; len && (i < 4); i++, len--)
 				*rx_buf++ = (x >> i*8) & 0xFF;
 		}
-		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 		read_words += tspi->curr_dma_words;
+		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 	} else {
 		u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
+		u8 bytes_per_word = tspi->bytes_per_word;
+		unsigned int read_bytes;
 
+		len = rx_full_count * bytes_per_word;
+		if (len > t->len - tspi->cur_pos)
+			len = t->len - tspi->cur_pos;
+		read_bytes = len;
 		for (count = 0; count < rx_full_count; count++) {
 			u32 x = tegra_spi_readl(tspi, SPI_RX_FIFO) & rx_mask;
 
-			for (i = 0; (i < tspi->bytes_per_word); i++)
+			for (i = 0; len && (i < bytes_per_word); i++, len--)
 				*rx_buf++ = (x >> (i*8)) & 0xFF;
 		}
-		tspi->cur_rx_pos += rx_full_count * tspi->bytes_per_word;
 		read_words += rx_full_count;
+		tspi->cur_rx_pos += read_bytes;
 	}
+
 	return read_words;
 }
 
@@ -372,12 +387,17 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
 		unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
 
 		memcpy(tspi->tx_dma_buf, t->tx_buf + tspi->cur_pos, len);
+		tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 	} else {
 		unsigned int i;
 		unsigned int count;
 		u8 *tx_buf = (u8 *)t->tx_buf + tspi->cur_tx_pos;
 		unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
+		unsigned int write_bytes;
 
+		if (consume > t->len - tspi->cur_pos)
+			consume = t->len - tspi->cur_pos;
+		write_bytes = consume;
 		for (count = 0; count < tspi->curr_dma_words; count++) {
 			u32 x = 0;
 
@@ -386,8 +406,9 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
 				x |= (u32)(*tx_buf++) << (i * 8);
 			tspi->tx_dma_buf[count] = x;
 		}
+
+		tspi->cur_tx_pos += write_bytes;
 	}
-	tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 
 	/* Make the dma buffer to read by dma */
 	dma_sync_single_for_device(tspi->dev, tspi->tx_dma_phys,
@@ -405,20 +426,28 @@ static void tegra_spi_copy_spi_rxbuf_to_client_rxbuf(
 		unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
 
 		memcpy(t->rx_buf + tspi->cur_rx_pos, tspi->rx_dma_buf, len);
+		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 	} else {
 		unsigned int i;
 		unsigned int count;
 		unsigned char *rx_buf = t->rx_buf + tspi->cur_rx_pos;
 		u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
+		unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
+		unsigned int read_bytes;
 
+		if (consume > t->len - tspi->cur_pos)
+			consume = t->len - tspi->cur_pos;
+		read_bytes = consume;
 		for (count = 0; count < tspi->curr_dma_words; count++) {
 			u32 x = tspi->rx_dma_buf[count] & rx_mask;
 
-			for (i = 0; (i < tspi->bytes_per_word); i++)
+			for (i = 0; consume && (i < tspi->bytes_per_word);
+							i++, consume--)
 				*rx_buf++ = (x >> (i*8)) & 0xFF;
 		}
+
+		tspi->cur_rx_pos += read_bytes;
 	}
-	tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 
 	/* Make the dma buffer to read by dma */
 	dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 158/343] spi: tegra114: terminate dma and reset on transfer timeout
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 157/343] spi: tegra114: fix for unpacked mode transfers Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 159/343] spi: tegra114: flush fifos Greg Kroah-Hartman
                   ` (189 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowjanya Komatineni, Mark Brown, Sasha Levin

From: Sowjanya Komatineni <skomatineni@nvidia.com>

[ Upstream commit 32bd1a9551cae34e6889afa235c7afdfede9aeac ]

Fixes: terminate DMA and perform controller reset on transfer timeout
to clear the FIFO's and errors.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index c6674b01e0fd6..4878d5e00c669 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -869,7 +869,16 @@ static int tegra_spi_transfer_one_message(struct spi_master *master,
 		if (WARN_ON(ret == 0)) {
 			dev_err(tspi->dev,
 				"spi transfer timeout, err %d\n", ret);
+			if (tspi->is_curr_dma_xfer &&
+			    (tspi->cur_direction & DATA_DIR_TX))
+				dmaengine_terminate_all(tspi->tx_dma_chan);
+			if (tspi->is_curr_dma_xfer &&
+			    (tspi->cur_direction & DATA_DIR_RX))
+				dmaengine_terminate_all(tspi->rx_dma_chan);
 			ret = -EIO;
+			reset_control_assert(tspi->rst);
+			udelay(2);
+			reset_control_deassert(tspi->rst);
 			goto complete_xfer;
 		}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 159/343] spi: tegra114: flush fifos
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 158/343] spi: tegra114: terminate dma and reset on transfer timeout Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 160/343] spi: tegra114: configure dma burst size to fifo trig level Greg Kroah-Hartman
                   ` (188 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowjanya Komatineni, Mark Brown, Sasha Levin

From: Sowjanya Komatineni <skomatineni@nvidia.com>

[ Upstream commit c4fc9e5b28ff787e35137c2cc13316bb11d7657b ]

Fixes: Flush TX and RX FIFOs before start of new transfer and on FIFO
overflow or underrun errors.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 39 +++++++++++++++++++++++++++++---------
 1 file changed, 30 insertions(+), 9 deletions(-)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index 4878d5e00c669..18dfbd57c61f2 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -499,22 +499,37 @@ static int tegra_spi_start_rx_dma(struct tegra_spi_data *tspi, int len)
 	return 0;
 }
 
-static int tegra_spi_start_dma_based_transfer(
-		struct tegra_spi_data *tspi, struct spi_transfer *t)
+static int tegra_spi_flush_fifos(struct tegra_spi_data *tspi)
 {
-	u32 val;
-	unsigned int len;
-	int ret = 0;
+	unsigned long timeout = jiffies + HZ;
 	u32 status;
 
-	/* Make sure that Rx and Tx fifo are empty */
 	status = tegra_spi_readl(tspi, SPI_FIFO_STATUS);
 	if ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) {
-		dev_err(tspi->dev, "Rx/Tx fifo are not empty status 0x%08x\n",
-			(unsigned)status);
-		return -EIO;
+		status |= SPI_RX_FIFO_FLUSH | SPI_TX_FIFO_FLUSH;
+		tegra_spi_writel(tspi, status, SPI_FIFO_STATUS);
+		while ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) {
+			status = tegra_spi_readl(tspi, SPI_FIFO_STATUS);
+			if (time_after(jiffies, timeout)) {
+				dev_err(tspi->dev,
+					"timeout waiting for fifo flush\n");
+				return -EIO;
+			}
+
+			udelay(1);
+		}
 	}
 
+	return 0;
+}
+
+static int tegra_spi_start_dma_based_transfer(
+		struct tegra_spi_data *tspi, struct spi_transfer *t)
+{
+	u32 val;
+	unsigned int len;
+	int ret = 0;
+
 	val = SPI_DMA_BLK_SET(tspi->curr_dma_words - 1);
 	tegra_spi_writel(tspi, val, SPI_DMA_BLK);
 
@@ -779,6 +794,9 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
 	dev_dbg(tspi->dev, "The def 0x%x and written 0x%x\n",
 		tspi->def_command1_reg, (unsigned)command1);
 
+	ret = tegra_spi_flush_fifos(tspi);
+	if (ret < 0)
+		return ret;
 	if (total_fifo_words > SPI_FIFO_DEPTH)
 		ret = tegra_spi_start_dma_based_transfer(tspi, t);
 	else
@@ -876,6 +894,7 @@ static int tegra_spi_transfer_one_message(struct spi_master *master,
 			    (tspi->cur_direction & DATA_DIR_RX))
 				dmaengine_terminate_all(tspi->rx_dma_chan);
 			ret = -EIO;
+			tegra_spi_flush_fifos(tspi);
 			reset_control_assert(tspi->rst);
 			udelay(2);
 			reset_control_deassert(tspi->rst);
@@ -929,6 +948,7 @@ static irqreturn_t handle_cpu_based_xfer(struct tegra_spi_data *tspi)
 			tspi->status_reg);
 		dev_err(tspi->dev, "CpuXfer 0x%08x:0x%08x\n",
 			tspi->command1_reg, tspi->dma_control_reg);
+		tegra_spi_flush_fifos(tspi);
 		reset_control_assert(tspi->rst);
 		udelay(2);
 		reset_control_deassert(tspi->rst);
@@ -1001,6 +1021,7 @@ static irqreturn_t handle_dma_based_xfer(struct tegra_spi_data *tspi)
 			tspi->status_reg);
 		dev_err(tspi->dev, "DmaXfer 0x%08x:0x%08x\n",
 			tspi->command1_reg, tspi->dma_control_reg);
+		tegra_spi_flush_fifos(tspi);
 		reset_control_assert(tspi->rst);
 		udelay(2);
 		reset_control_deassert(tspi->rst);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 160/343] spi: tegra114: configure dma burst size to fifo trig level
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 159/343] spi: tegra114: flush fifos Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 161/343] soc/fsl/qe: Fix an error code in qe_pin_request() Greg Kroah-Hartman
                   ` (187 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowjanya Komatineni, Mark Brown, Sasha Levin

From: Sowjanya Komatineni <skomatineni@nvidia.com>

[ Upstream commit f4ce428c41fb22e3ed55496dded94df44cb920fa ]

Fixes: Configure DMA burst size to be same as SPI TX/RX trigger levels
to avoid mismatch.

SPI FIFO trigger levels are calculated based on the transfer length.
So this patch moves DMA slave configuration to happen before start
of DMAs.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 52 ++++++++++++++++++++++----------------
 1 file changed, 30 insertions(+), 22 deletions(-)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index 18dfbd57c61f2..84ff0c507f0b6 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -529,6 +529,8 @@ static int tegra_spi_start_dma_based_transfer(
 	u32 val;
 	unsigned int len;
 	int ret = 0;
+	u8 dma_burst;
+	struct dma_slave_config dma_sconfig = {0};
 
 	val = SPI_DMA_BLK_SET(tspi->curr_dma_words - 1);
 	tegra_spi_writel(tspi, val, SPI_DMA_BLK);
@@ -540,12 +542,16 @@ static int tegra_spi_start_dma_based_transfer(
 		len = tspi->curr_dma_words * 4;
 
 	/* Set attention level based on length of transfer */
-	if (len & 0xF)
+	if (len & 0xF) {
 		val |= SPI_TX_TRIG_1 | SPI_RX_TRIG_1;
-	else if (((len) >> 4) & 0x1)
+		dma_burst = 1;
+	} else if (((len) >> 4) & 0x1) {
 		val |= SPI_TX_TRIG_4 | SPI_RX_TRIG_4;
-	else
+		dma_burst = 4;
+	} else {
 		val |= SPI_TX_TRIG_8 | SPI_RX_TRIG_8;
+		dma_burst = 8;
+	}
 
 	if (tspi->cur_direction & DATA_DIR_TX)
 		val |= SPI_IE_TX;
@@ -556,7 +562,18 @@ static int tegra_spi_start_dma_based_transfer(
 	tegra_spi_writel(tspi, val, SPI_DMA_CTL);
 	tspi->dma_control_reg = val;
 
+	dma_sconfig.device_fc = true;
 	if (tspi->cur_direction & DATA_DIR_TX) {
+		dma_sconfig.dst_addr = tspi->phys + SPI_TX_FIFO;
+		dma_sconfig.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+		dma_sconfig.dst_maxburst = dma_burst;
+		ret = dmaengine_slave_config(tspi->tx_dma_chan, &dma_sconfig);
+		if (ret < 0) {
+			dev_err(tspi->dev,
+				"DMA slave config failed: %d\n", ret);
+			return ret;
+		}
+
 		tegra_spi_copy_client_txbuf_to_spi_txbuf(tspi, t);
 		ret = tegra_spi_start_tx_dma(tspi, len);
 		if (ret < 0) {
@@ -567,6 +584,16 @@ static int tegra_spi_start_dma_based_transfer(
 	}
 
 	if (tspi->cur_direction & DATA_DIR_RX) {
+		dma_sconfig.src_addr = tspi->phys + SPI_RX_FIFO;
+		dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+		dma_sconfig.src_maxburst = dma_burst;
+		ret = dmaengine_slave_config(tspi->rx_dma_chan, &dma_sconfig);
+		if (ret < 0) {
+			dev_err(tspi->dev,
+				"DMA slave config failed: %d\n", ret);
+			return ret;
+		}
+
 		/* Make the dma buffer to read by dma */
 		dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
 				tspi->dma_buf_size, DMA_FROM_DEVICE);
@@ -626,7 +653,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
 	u32 *dma_buf;
 	dma_addr_t dma_phys;
 	int ret;
-	struct dma_slave_config dma_sconfig;
 
 	dma_chan = dma_request_slave_channel_reason(tspi->dev,
 					dma_to_memory ? "rx" : "tx");
@@ -646,19 +672,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
 		return -ENOMEM;
 	}
 
-	if (dma_to_memory) {
-		dma_sconfig.src_addr = tspi->phys + SPI_RX_FIFO;
-		dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-		dma_sconfig.src_maxburst = 0;
-	} else {
-		dma_sconfig.dst_addr = tspi->phys + SPI_TX_FIFO;
-		dma_sconfig.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-		dma_sconfig.dst_maxburst = 0;
-	}
-
-	ret = dmaengine_slave_config(dma_chan, &dma_sconfig);
-	if (ret)
-		goto scrub;
 	if (dma_to_memory) {
 		tspi->rx_dma_chan = dma_chan;
 		tspi->rx_dma_buf = dma_buf;
@@ -669,11 +682,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
 		tspi->tx_dma_phys = dma_phys;
 	}
 	return 0;
-
-scrub:
-	dma_free_coherent(tspi->dev, tspi->dma_buf_size, dma_buf, dma_phys);
-	dma_release_channel(dma_chan);
-	return ret;
 }
 
 static void tegra_spi_deinit_dma_param(struct tegra_spi_data *tspi,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 161/343] soc/fsl/qe: Fix an error code in qe_pin_request()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 160/343] spi: tegra114: configure dma burst size to fifo trig level Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 162/343] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios Greg Kroah-Hartman
                   ` (186 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Li Yang, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 5674a92ca4b7e5a6a19231edd10298d30324cd27 ]

We forgot to set "err" on this error path.

Fixes: 1a2d397a6eb5 ("gpio/powerpc: Eliminate duplication of of_get_named_gpio_flags()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/fsl/qe/gpio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/fsl/qe/gpio.c b/drivers/soc/fsl/qe/gpio.c
index 3b27075c21a7f..5cbc5ce5ac159 100644
--- a/drivers/soc/fsl/qe/gpio.c
+++ b/drivers/soc/fsl/qe/gpio.c
@@ -152,8 +152,10 @@ struct qe_pin *qe_pin_request(struct device_node *np, int index)
 	if (err < 0)
 		goto err0;
 	gc = gpio_to_chip(err);
-	if (WARN_ON(!gc))
+	if (WARN_ON(!gc)) {
+		err = -ENODEV;
 		goto err0;
+	}
 
 	if (!of_device_is_compatible(gc->of_node, "fsl,mpc8323-qe-pario-bank")) {
 		pr_debug("%s: tried to get a non-qe pin\n", __func__);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 162/343] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 161/343] soc/fsl/qe: Fix an error code in qe_pin_request() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 163/343] ehea: Fix a copy-paste err in ehea_init_port_res Greg Kroah-Hartman
                   ` (185 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Sperl, Stefan Wahren,
	Mark Brown, Sasha Levin

From: Martin Sperl <kernel@martin.sperl.org>

[ Upstream commit 509c583620e9053e43d611bf1614fc3d3abafa96 ]

The original driver by default defines num_chipselects as -1.
This actually allicates an array of 65535 entries in
of_spi_register_master.

There is a side-effect for buggy device trees that (contrary to
dt-binding documentation) have no cs-gpio defined.

This mode was never supported by the driver due to limitations
of native cs and additional code complexity and is explicitly
not stated to be implemented.

To keep backwards compatibility with such buggy DTs we limit
the number of chip_selects to 1, as for all practical purposes
it is only ever realistic to use a single chip select in
native cs mode without negative side-effects.

Fixes: 1ea29b39f4c812ec ("spi: bcm2835aux: add bcm2835 auxiliary spi device...")
Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm2835aux.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 5c89bbb05441b..e075712c501e8 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -416,7 +416,18 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, master);
 	master->mode_bits = (SPI_CPOL | SPI_CS_HIGH | SPI_NO_CS);
 	master->bits_per_word_mask = SPI_BPW_MASK(8);
-	master->num_chipselect = -1;
+	/* even though the driver never officially supported native CS
+	 * allow a single native CS for legacy DT support purposes when
+	 * no cs-gpio is configured.
+	 * Known limitations for native cs are:
+	 * * multiple chip-selects: cs0-cs2 are all simultaniously asserted
+	 *     whenever there is a transfer -  this even includes SPI_NO_CS
+	 * * SPI_CS_HIGH: is ignores - cs are always asserted low
+	 * * cs_change: cs is deasserted after each spi_transfer
+	 * * cs_delay_usec: cs is always deasserted one SCK cycle after
+	 *     a spi_transfer
+	 */
+	master->num_chipselect = 1;
 	master->transfer_one = bcm2835aux_spi_transfer_one;
 	master->handle_err = bcm2835aux_spi_handle_err;
 	master->prepare_message = bcm2835aux_spi_prepare_message;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 163/343] ehea: Fix a copy-paste err in ehea_init_port_res
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 162/343] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 164/343] scsi: qla2xxx: Unregister chrdev if module initialization fails Greg Kroah-Hartman
                   ` (184 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, YueHaibing, Mukesh Ojha,
	David S. Miller, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit c8f191282f819ab4e9b47b22a65c6c29734cefce ]

pr->tx_bytes should be assigned to tx_bytes other than
rx_bytes.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: ce45b873028f ("ehea: Fixing statistics")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ibm/ehea/ehea_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 30cbdf0fed595..373deb247ac01 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -1475,7 +1475,7 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr,
 
 	memset(pr, 0, sizeof(struct ehea_port_res));
 
-	pr->tx_bytes = rx_bytes;
+	pr->tx_bytes = tx_bytes;
 	pr->tx_packets = tx_packets;
 	pr->rx_bytes = rx_bytes;
 	pr->rx_packets = rx_packets;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 164/343] scsi: qla2xxx: Unregister chrdev if module initialization fails
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 163/343] ehea: Fix a copy-paste err in ehea_init_port_res Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 165/343] scsi: target/core: Fix a race condition in the LUN lookup code Greg Kroah-Hartman
                   ` (183 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Giridhar Malavali,
	Bart Van Assche, Martin K. Petersen, Sasha Levin

From: Bart Van Assche <bvanassche@acm.org>

[ Upstream commit c794d24ec9eb6658909955772e70f34bef5b5b91 ]

If module initialization fails after the character device has been
registered, unregister the character device. Additionally, avoid
duplicating error path code.

Cc: Himanshu Madhani <hmadhani@marvell.com>
Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
Fixes: 6a03b4cd78f3 ("[SCSI] qla2xxx: Add char device to increase driver use count") # v2.6.35.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_os.c | 34 +++++++++++++++++++++-------------
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 5617bb18c2335..5f9d4dbc4a98e 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -6714,8 +6714,7 @@ qla2x00_module_init(void)
 	/* Initialize target kmem_cache and mem_pools */
 	ret = qlt_init();
 	if (ret < 0) {
-		kmem_cache_destroy(srb_cachep);
-		return ret;
+		goto destroy_cache;
 	} else if (ret > 0) {
 		/*
 		 * If initiator mode is explictly disabled by qlt_init(),
@@ -6736,11 +6735,10 @@ qla2x00_module_init(void)
 	qla2xxx_transport_template =
 	    fc_attach_transport(&qla2xxx_transport_functions);
 	if (!qla2xxx_transport_template) {
-		kmem_cache_destroy(srb_cachep);
 		ql_log(ql_log_fatal, NULL, 0x0002,
 		    "fc_attach_transport failed...Failing load!.\n");
-		qlt_exit();
-		return -ENODEV;
+		ret = -ENODEV;
+		goto qlt_exit;
 	}
 
 	apidev_major = register_chrdev(0, QLA2XXX_APIDEV, &apidev_fops);
@@ -6752,27 +6750,37 @@ qla2x00_module_init(void)
 	qla2xxx_transport_vport_template =
 	    fc_attach_transport(&qla2xxx_transport_vport_functions);
 	if (!qla2xxx_transport_vport_template) {
-		kmem_cache_destroy(srb_cachep);
-		qlt_exit();
-		fc_release_transport(qla2xxx_transport_template);
 		ql_log(ql_log_fatal, NULL, 0x0004,
 		    "fc_attach_transport vport failed...Failing load!.\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto unreg_chrdev;
 	}
 	ql_log(ql_log_info, NULL, 0x0005,
 	    "QLogic Fibre Channel HBA Driver: %s.\n",
 	    qla2x00_version_str);
 	ret = pci_register_driver(&qla2xxx_pci_driver);
 	if (ret) {
-		kmem_cache_destroy(srb_cachep);
-		qlt_exit();
-		fc_release_transport(qla2xxx_transport_template);
-		fc_release_transport(qla2xxx_transport_vport_template);
 		ql_log(ql_log_fatal, NULL, 0x0006,
 		    "pci_register_driver failed...ret=%d Failing load!.\n",
 		    ret);
+		goto release_vport_transport;
 	}
 	return ret;
+
+release_vport_transport:
+	fc_release_transport(qla2xxx_transport_vport_template);
+
+unreg_chrdev:
+	if (apidev_major >= 0)
+		unregister_chrdev(apidev_major, QLA2XXX_APIDEV);
+	fc_release_transport(qla2xxx_transport_template);
+
+qlt_exit:
+	qlt_exit();
+
+destroy_cache:
+	kmem_cache_destroy(srb_cachep);
+	return ret;
 }
 
 /**
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 165/343] scsi: target/core: Fix a race condition in the LUN lookup code
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 164/343] scsi: qla2xxx: Unregister chrdev if module initialization fails Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 166/343] ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data" Greg Kroah-Hartman
                   ` (182 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mike Christie, Christoph Hellwig,
	Hannes Reinecke, Nicholas Bellinger, Bart Van Assche,
	Martin K. Petersen, Sasha Levin

From: Bart Van Assche <bvanassche@acm.org>

[ Upstream commit 63f7479439c95bcd49b7dd4af809862c316c71a3 ]

The rcu_dereference(deve->se_lun) expression occurs twice in the LUN lookup
functions. Since these expressions are not serialized against deve->se_lun
assignments each of these expressions may yield a different result. Avoid
that the wrong LUN pointer is stored in se_cmd by reading deve->se_lun only
once.

Cc: Mike Christie <mchristi@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Fixes: 29a05deebf6c ("target: Convert se_node_acl->device_list[] to RCU hlist") # v4.10
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_device.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 92b52d2314b53..cebef8e5a43d1 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -85,7 +85,7 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
 			goto out_unlock;
 		}
 
-		se_cmd->se_lun = rcu_dereference(deve->se_lun);
+		se_cmd->se_lun = se_lun;
 		se_cmd->pr_res_key = deve->pr_res_key;
 		se_cmd->orig_fe_lun = unpacked_lun;
 		se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
@@ -176,7 +176,7 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
 			goto out_unlock;
 		}
 
-		se_cmd->se_lun = rcu_dereference(deve->se_lun);
+		se_cmd->se_lun = se_lun;
 		se_cmd->pr_res_key = deve->pr_res_key;
 		se_cmd->orig_fe_lun = unpacked_lun;
 		se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 166/343] ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 165/343] scsi: target/core: Fix a race condition in the LUN lookup code Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 167/343] net: hns3: fix for vport->bw_limit overflow problem Greg Kroah-Hartman
                   ` (181 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Robert Jarzmik, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 9ee8578d953023cc57e7e736ae48502c707c0210 ]

Since commit 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
kfree, iounmap, clk_put etc are not needed anymore in remove path.

Fixes: 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
[ commit message spelling fix ]
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/plat-pxa/ssp.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
index b92673efffffb..97bd43c16cd87 100644
--- a/arch/arm/plat-pxa/ssp.c
+++ b/arch/arm/plat-pxa/ssp.c
@@ -230,18 +230,12 @@ static int pxa_ssp_probe(struct platform_device *pdev)
 
 static int pxa_ssp_remove(struct platform_device *pdev)
 {
-	struct resource *res;
 	struct ssp_device *ssp;
 
 	ssp = platform_get_drvdata(pdev);
 	if (ssp == NULL)
 		return -ENODEV;
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	release_mem_region(res->start, resource_size(res));
-
-	clk_put(ssp->clk);
-
 	mutex_lock(&ssp_lock);
 	list_del(&ssp->node);
 	mutex_unlock(&ssp_lock);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 167/343] net: hns3: fix for vport->bw_limit overflow problem
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 166/343] ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data" Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 168/343] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses Greg Kroah-Hartman
                   ` (180 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Yunsheng Lin,
	Huazhong Tan, David S. Miller, Sasha Levin

From: Yunsheng Lin <linyunsheng@huawei.com>

[ Upstream commit 2566f10676ba996b745e138f54f3e2f974311692 ]

When setting vport->bw_limit to hdev->tm_info.pg_info[0].bw_limit
in hclge_tm_vport_tc_info_update, vport->bw_limit can be as big as
HCLGE_ETHER_MAX_RATE (100000), which can not fit into u16 (65535).

So this patch fixes it by using u32 for vport->bw_limit.

Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
index 9fcfd93954245..a4c5e72d6012a 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
@@ -480,7 +480,7 @@ struct hclge_vport {
 	u16 alloc_rss_size;
 
 	u16 qs_offset;
-	u16 bw_limit;		/* VSI BW Limit (0 = disabled) */
+	u32 bw_limit;		/* VSI BW Limit (0 = disabled) */
 	u8  dwrr;
 
 	int vport_id;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 168/343] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 167/343] net: hns3: fix for vport->bw_limit overflow problem Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 169/343] platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer Greg Kroah-Hartman
                   ` (179 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Guenter Roeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit e95fd518d05bfc087da6fcdea4900a57cfb083bd ]

Super-IO accesses may fail on a system with no or unmapped LPC bus.

Also, other drivers may attempt to access the LPC bus at the same time,
resulting in undefined behavior.

Use request_muxed_region() to ensure that IO access on the requested
address space is supported, and to ensure that access by multiple drivers
is synchronized.

Fixes: b72656dbc491 ("hwmon: (w83627hf) Stop using globals for I/O port numbers")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/w83627hf.c | 42 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 37 insertions(+), 5 deletions(-)

diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
index 8ac89d0781ccc..a575e1cdb81a8 100644
--- a/drivers/hwmon/w83627hf.c
+++ b/drivers/hwmon/w83627hf.c
@@ -130,17 +130,23 @@ superio_select(struct w83627hf_sio_data *sio, int ld)
 	outb(ld,  sio->sioaddr + 1);
 }
 
-static inline void
+static inline int
 superio_enter(struct w83627hf_sio_data *sio)
 {
+	if (!request_muxed_region(sio->sioaddr, 2, DRVNAME))
+		return -EBUSY;
+
 	outb(0x87, sio->sioaddr);
 	outb(0x87, sio->sioaddr);
+
+	return 0;
 }
 
 static inline void
 superio_exit(struct w83627hf_sio_data *sio)
 {
 	outb(0xAA, sio->sioaddr);
+	release_region(sio->sioaddr, 2);
 }
 
 #define W627_DEVID 0x52
@@ -1278,7 +1284,7 @@ static DEVICE_ATTR_RO(name);
 static int __init w83627hf_find(int sioaddr, unsigned short *addr,
 				struct w83627hf_sio_data *sio_data)
 {
-	int err = -ENODEV;
+	int err;
 	u16 val;
 
 	static __initconst char *const names[] = {
@@ -1290,7 +1296,11 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
 	};
 
 	sio_data->sioaddr = sioaddr;
-	superio_enter(sio_data);
+	err = superio_enter(sio_data);
+	if (err)
+		return err;
+
+	err = -ENODEV;
 	val = force_id ? force_id : superio_inb(sio_data, DEVID);
 	switch (val) {
 	case W627_DEVID:
@@ -1644,9 +1654,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev)
 	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
 	int res = 0xff, sel;
 
-	superio_enter(sio_data);
+	if (superio_enter(sio_data)) {
+		/*
+		 * Some other driver reserved the address space for itself.
+		 * We don't want to fail driver instantiation because of that,
+		 * so display a warning and keep going.
+		 */
+		dev_warn(&pdev->dev,
+			 "Can not read VID data: Failed to enable SuperIO access\n");
+		return res;
+	}
+
 	superio_select(sio_data, W83627HF_LD_GPIO5);
 
+	res = 0xff;
+
 	/* Make sure these GPIO pins are enabled */
 	if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) {
 		dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n");
@@ -1677,7 +1699,17 @@ static int w83687thf_read_vid(struct platform_device *pdev)
 	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
 	int res = 0xff;
 
-	superio_enter(sio_data);
+	if (superio_enter(sio_data)) {
+		/*
+		 * Some other driver reserved the address space for itself.
+		 * We don't want to fail driver instantiation because of that,
+		 * so display a warning and keep going.
+		 */
+		dev_warn(&pdev->dev,
+			 "Can not read VID data: Failed to enable SuperIO access\n");
+		return res;
+	}
+
 	superio_select(sio_data, W83627HF_LD_HWM);
 
 	/* Make sure these GPIO pins are enabled */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 169/343] platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 168/343] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 170/343] tipc: set sysctl_tipc_rmem and named_timeout right range Greg Kroah-Hartman
                   ` (178 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Darren Hart (VMware),
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 98e2630284ab741804bd0713e932e725466f2f84 ]

Currently the kfree of output.pointer can be potentially freeing
an uninitalized pointer in the case where out_data is NULL. Fix this
by reworking the case where out_data is not-null to perform the
ACPI status check and also the kfree of outpoint.pointer in one block
and hence ensuring the pointer is only freed when it has been used.

Also replace the if (ptr != NULL) idiom with just if (ptr).

Fixes: ff0e9f26288d ("platform/x86: alienware-wmi: Correct a memory leak")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/alienware-wmi.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
index e335b18da20fc..cbd84e2e3bd47 100644
--- a/drivers/platform/x86/alienware-wmi.c
+++ b/drivers/platform/x86/alienware-wmi.c
@@ -505,23 +505,22 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
 
 	input.length = (acpi_size) sizeof(*in_args);
 	input.pointer = in_args;
-	if (out_data != NULL) {
+	if (out_data) {
 		output.length = ACPI_ALLOCATE_BUFFER;
 		output.pointer = NULL;
 		status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0,
 					     command, &input, &output);
-	} else
+		if (ACPI_SUCCESS(status)) {
+			obj = (union acpi_object *)output.pointer;
+			if (obj && obj->type == ACPI_TYPE_INTEGER)
+				*out_data = (u32)obj->integer.value;
+		}
+		kfree(output.pointer);
+	} else {
 		status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0,
 					     command, &input, NULL);
-
-	if (ACPI_SUCCESS(status) && out_data != NULL) {
-		obj = (union acpi_object *)output.pointer;
-		if (obj && obj->type == ACPI_TYPE_INTEGER)
-			*out_data = (u32) obj->integer.value;
 	}
-	kfree(output.pointer);
 	return status;
-
 }
 
 /*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 170/343] tipc: set sysctl_tipc_rmem and named_timeout right range
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 169/343] platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 171/343] selftests/ipc: Fix msgque compiler warnings Greg Kroah-Hartman
                   ` (177 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jie Liu, Qiang Ning, Zhiqiang Liu,
	Miaohe Lin, David S. Miller, Sasha Levin

From: Jie Liu <liujie165@huawei.com>

[ Upstream commit 4bcd4ec1017205644a2697bccbc3b5143f522f5f ]

We find that sysctl_tipc_rmem and named_timeout do not have the right minimum
setting. sysctl_tipc_rmem should be larger than zero, like sysctl_tcp_rmem.
And named_timeout as a timeout setting should be not less than zero.

Fixes: cc79dd1ba9c10 ("tipc: change socket buffer overflow control to respect sk_rcvbuf")
Fixes: a5325ae5b8bff ("tipc: add name distributor resiliency queue")
Signed-off-by: Jie Liu <liujie165@huawei.com>
Reported-by: Qiang Ning <ningqiang1@huawei.com>
Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/sysctl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
index 1a779b1e85100..40f6d82083d7b 100644
--- a/net/tipc/sysctl.c
+++ b/net/tipc/sysctl.c
@@ -37,6 +37,8 @@
 
 #include <linux/sysctl.h>
 
+static int zero;
+static int one = 1;
 static struct ctl_table_header *tipc_ctl_hdr;
 
 static struct ctl_table tipc_table[] = {
@@ -45,14 +47,16 @@ static struct ctl_table tipc_table[] = {
 		.data		= &sysctl_tipc_rmem,
 		.maxlen		= sizeof(sysctl_tipc_rmem),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1         = &one,
 	},
 	{
 		.procname	= "named_timeout",
 		.data		= &sysctl_tipc_named_timeout,
 		.maxlen		= sizeof(sysctl_tipc_named_timeout),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1         = &zero,
 	},
 	{}
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 171/343] selftests/ipc: Fix msgque compiler warnings
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 170/343] tipc: set sysctl_tipc_rmem and named_timeout right range Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 172/343] powerpc: vdso: Make vdso32 installation conditional in vdso_install Greg Kroah-Hartman
                   ` (176 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kees Cook, Shuah Khan, Sasha Levin

From: Kees Cook <keescook@chromium.org>

[ Upstream commit a147faa96f832f76e772b1e448e94ea84c774081 ]

This fixes the various compiler warnings when building the msgque
selftest. The primary change is using sys/msg.h instead of linux/msg.h
directly to gain the API declarations.

Fixes: 3a665531a3b7 ("selftests: IPC message queue copy feature test")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/ipc/msgque.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
index ee9382bdfadc8..c5587844fbb8c 100644
--- a/tools/testing/selftests/ipc/msgque.c
+++ b/tools/testing/selftests/ipc/msgque.c
@@ -1,9 +1,10 @@
 // SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
 #include <errno.h>
-#include <linux/msg.h>
+#include <sys/msg.h>
 #include <fcntl.h>
 
 #include "../kselftest.h"
@@ -73,7 +74,7 @@ int restore_queue(struct msgque_data *msgque)
 	return 0;
 
 destroy:
-	if (msgctl(id, IPC_RMID, 0))
+	if (msgctl(id, IPC_RMID, NULL))
 		printf("Failed to destroy queue: %d\n", -errno);
 	return ret;
 }
@@ -120,7 +121,7 @@ int check_and_destroy_queue(struct msgque_data *msgque)
 
 	ret = 0;
 err:
-	if (msgctl(msgque->msq_id, IPC_RMID, 0)) {
+	if (msgctl(msgque->msq_id, IPC_RMID, NULL)) {
 		printf("Failed to destroy queue: %d\n", -errno);
 		return -errno;
 	}
@@ -129,7 +130,7 @@ err:
 
 int dump_queue(struct msgque_data *msgque)
 {
-	struct msqid64_ds ds;
+	struct msqid_ds ds;
 	int kern_id;
 	int i, ret;
 
@@ -246,7 +247,7 @@ int main(int argc, char **argv)
 	return ksft_exit_pass();
 
 err_destroy:
-	if (msgctl(msgque.msq_id, IPC_RMID, 0)) {
+	if (msgctl(msgque.msq_id, IPC_RMID, NULL)) {
 		printf("Failed to destroy queue: %d\n", -errno);
 		return ksft_exit_fail();
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 172/343] powerpc: vdso: Make vdso32 installation conditional in vdso_install
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 171/343] selftests/ipc: Fix msgque compiler warnings Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 173/343] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect Greg Kroah-Hartman
                   ` (175 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Michael Ellerman, Sasha Levin

From: Ben Hutchings <ben@decadent.org.uk>

[ Upstream commit ff6d27823f619892ab96f7461764840e0d786b15 ]

The 32-bit vDSO is not needed and not normally built for 64-bit
little-endian configurations.  However, the vdso_install target still
builds and installs it.  Add the same config condition as is normally
used for the build.

Fixes: e0d005916994 ("powerpc/vdso: Disable building the 32-bit VDSO ...")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 0f04c878113ef..9c78ef2982572 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -385,7 +385,9 @@ vdso_install:
 ifeq ($(CONFIG_PPC64),y)
 	$(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso64 $@
 endif
+ifdef CONFIG_VDSO32
 	$(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso32 $@
+endif
 
 archclean:
 	$(Q)$(MAKE) $(clean)=$(boot)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 173/343] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 172/343] powerpc: vdso: Make vdso32 installation conditional in vdso_install Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 174/343] media: ov2659: fix unbalanced mutex_lock/unlock Greg Kroah-Hartman
                   ` (174 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, Claudiu Manoil,
	Li Yang, Shawn Guo, Sasha Levin

From: Vladimir Oltean <olteanv@gmail.com>

[ Upstream commit c7861adbe37f576931650ad8ef805e0c47564b9a ]

Each eTSEC MAC has its own TBI (SGMII) PCS and private MDIO bus.
But due to a DTS oversight, both SGMII-compatible MACs of the LS1021 SoC
are pointing towards the same internal PCS. Therefore nobody is
controlling the internal PCS of eTSEC0.

Upon initial ndo_open, the SGMII link is ok by virtue of U-boot
initialization. But upon an ifdown/ifup sequence, the code path from
ndo_open -> init_phy -> gfar_configure_serdes does not get executed for
the PCS of eTSEC0 (and is executed twice for MAC eTSEC1). So the SGMII
link remains down for eTSEC0. On the LS1021A-TWR board, to signal this
failure condition, the PHY driver keeps printing
'803x_aneg_done: SGMII link is not ok'.

Also, it changes compatible of mdio0 to "fsl,etsec2-mdio" to match
mdio1 device.

Fixes: 055223d4d22d ("ARM: dts: ls1021a: Enable the eTSEC ports on QDS and TWR")
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Acked-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/ls1021a-twr.dts |  9 ++++++++-
 arch/arm/boot/dts/ls1021a.dtsi    | 11 ++++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts
index 44715c8ef756b..72a3fc63d0ece 100644
--- a/arch/arm/boot/dts/ls1021a-twr.dts
+++ b/arch/arm/boot/dts/ls1021a-twr.dts
@@ -143,7 +143,7 @@
 };
 
 &enet0 {
-	tbi-handle = <&tbi1>;
+	tbi-handle = <&tbi0>;
 	phy-handle = <&sgmii_phy2>;
 	phy-connection-type = "sgmii";
 	status = "okay";
@@ -222,6 +222,13 @@
 	sgmii_phy2: ethernet-phy@2 {
 		reg = <0x2>;
 	};
+	tbi0: tbi-phy@1f {
+		reg = <0x1f>;
+		device_type = "tbi-phy";
+	};
+};
+
+&mdio1 {
 	tbi1: tbi-phy@1f {
 		reg = <0x1f>;
 		device_type = "tbi-phy";
diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
index 2d20f60947b95..1343c86988c54 100644
--- a/arch/arm/boot/dts/ls1021a.dtsi
+++ b/arch/arm/boot/dts/ls1021a.dtsi
@@ -562,13 +562,22 @@
 		};
 
 		mdio0: mdio@2d24000 {
-			compatible = "gianfar";
+			compatible = "fsl,etsec2-mdio";
 			device_type = "mdio";
 			#address-cells = <1>;
 			#size-cells = <0>;
 			reg = <0x0 0x2d24000 0x0 0x4000>;
 		};
 
+		mdio1: mdio@2d64000 {
+			compatible = "fsl,etsec2-mdio";
+			device_type = "mdio";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <0x0 0x2d64000 0x0 0x4000>,
+			      <0x0 0x2d50030 0x0 0x4>;
+		};
+
 		ptp_clock@2d10e00 {
 			compatible = "fsl,etsec-ptp";
 			reg = <0x0 0x2d10e00 0x0 0xb0>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 174/343] media: ov2659: fix unbalanced mutex_lock/unlock
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 173/343] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 175/343] 6lowpan: Off by one handling ->nexthdr Greg Kroah-Hartman
                   ` (173 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lad, Prabhakar, Akinobu Mita,
	Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Akinobu Mita <akinobu.mita@gmail.com>

[ Upstream commit 384538bda10913e5c94ec5b5d34bd3075931bcf4 ]

Avoid returning with mutex locked.

Fixes: fa8cb6444c32 ("[media] ov2659: Don't depend on subdev API")

Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov2659.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
index 44b0584eb8a6c..e7768ed1ff9c2 100644
--- a/drivers/media/i2c/ov2659.c
+++ b/drivers/media/i2c/ov2659.c
@@ -1136,7 +1136,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
 		mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
 		*mf = fmt->format;
 #else
-		return -ENOTTY;
+		ret = -ENOTTY;
 #endif
 	} else {
 		s64 val;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 175/343] 6lowpan: Off by one handling ->nexthdr
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 174/343] media: ov2659: fix unbalanced mutex_lock/unlock Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 176/343] dmaengine: axi-dmac: Dont check the number of frames for alignment Greg Kroah-Hartman
                   ` (172 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jukka Rissanen,
	Alexander Aring, Marcel Holtmann, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f57c4bbf34439531adccd7d3a4ecc14f409c1399 ]

NEXTHDR_MAX is 255.  What happens here is that we take a u8 value
"hdr->nexthdr" from the network and then look it up in
lowpan_nexthdr_nhcs[].  The problem is that if hdr->nexthdr is 0xff then
we read one element beyond the end of the array so the array needs to
be one element larger.

Fixes: 92aa7c65d295 ("6lowpan: add generic nhc layer interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Acked-by: Alexander Aring <aring@mojatatu.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/6lowpan/nhc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/6lowpan/nhc.c b/net/6lowpan/nhc.c
index 4fa2fdda174d0..9e56fb98f33cf 100644
--- a/net/6lowpan/nhc.c
+++ b/net/6lowpan/nhc.c
@@ -18,7 +18,7 @@
 #include "nhc.h"
 
 static struct rb_root rb_root = RB_ROOT;
-static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX];
+static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX + 1];
 static DEFINE_SPINLOCK(lowpan_nhc_lock);
 
 static int lowpan_nhc_insert(struct lowpan_nhc *nhc)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 176/343] dmaengine: axi-dmac: Dont check the number of frames for alignment
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 175/343] 6lowpan: Off by one handling ->nexthdr Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 177/343] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk() Greg Kroah-Hartman
                   ` (171 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexandru Ardelean, Vinod Koul, Sasha Levin

From: Alexandru Ardelean <alexandru.ardelean@analog.com>

[ Upstream commit 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9 ]

In 2D transfers (for the AXI DMAC), the number of frames (numf) represents
Y_LENGTH, and the length of a frame is X_LENGTH. 2D transfers are useful
for video transfers where screen resolutions ( X * Y ) are typically
aligned for X, but not for Y.

There is no requirement for Y_LENGTH to be aligned to the bus-width (or
anything), and this is also true for AXI DMAC.

Checking the Y_LENGTH for alignment causes false errors when initiating DMA
transfers. This change fixes this by checking only that the Y_LENGTH is
non-zero.

Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller")
Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/dma-axi-dmac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
index 7f0b9aa158679..9887f2a14aa98 100644
--- a/drivers/dma/dma-axi-dmac.c
+++ b/drivers/dma/dma-axi-dmac.c
@@ -451,7 +451,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved(
 
 	if (chan->hw_2d) {
 		if (!axi_dmac_check_len(chan, xt->sgl[0].size) ||
-		    !axi_dmac_check_len(chan, xt->numf))
+		    xt->numf == 0)
 			return NULL;
 		if (xt->sgl[0].size + dst_icg > chan->max_length ||
 		    xt->sgl[0].size + src_icg > chan->max_length)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 177/343] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 176/343] dmaengine: axi-dmac: Dont check the number of frames for alignment Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 178/343] NFS: Dont interrupt file writeout due to fatal errors Greg Kroah-Hartman
                   ` (170 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Sasha Levin

From: Takashi Iwai <tiwai@suse.de>

[ Upstream commit 328e9f6973be2ee67862cb17bf6c0c5c5918cd72 ]

The error from snd_usb_mixer_apply_create_quirk() is ignored in the
current usb-audio driver code, which will continue the probing even
after the error.  Let's take it more serious.

Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/mixer.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 044193b2364d0..e6e4c3b9d9d3f 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2632,7 +2632,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
 	    (err = snd_usb_mixer_status_create(mixer)) < 0)
 		goto _error;
 
-	snd_usb_mixer_apply_create_quirk(mixer);
+	err = snd_usb_mixer_apply_create_quirk(mixer);
+	if (err < 0)
+		goto _error;
 
 	err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
 	if (err < 0)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 178/343] NFS: Dont interrupt file writeout due to fatal errors
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 177/343] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 179/343] irqchip/gic-v3-its: fix some definitions of inner cacheability attributes Greg Kroah-Hartman
                   ` (169 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Anna Schumaker, Sasha Levin

From: Trond Myklebust <trondmy@gmail.com>

[ Upstream commit 14bebe3c90b326d2a0df78aed5e9de090c71d878 ]

When flushing out dirty pages, the fact that we may hit fatal errors
is not a reason to stop writeback. Those errors are reported through
fsync(), not through the flush mechanism.

Fixes: a6598813a4c5b ("NFS: Don't write back further requests if there...")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/write.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 01b9d9341b541..ed3f5afc4ff7f 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -643,7 +643,7 @@ out:
 	return ret;
 out_launder:
 	nfs_write_error_remove_page(req);
-	return ret;
+	return 0;
 }
 
 static int nfs_do_writepage(struct page *page, struct writeback_control *wbc,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 179/343] irqchip/gic-v3-its: fix some definitions of inner cacheability attributes
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 178/343] NFS: Dont interrupt file writeout due to fatal errors Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 180/343] scsi: qla2xxx: Fix a format specifier Greg Kroah-Hartman
                   ` (168 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hongbo Yao, Marc Zyngier, Sasha Levin

From: Hongbo Yao <yaohongbo@huawei.com>

[ Upstream commit 0f29456d08042134aff6e562d07a6365c841c4ad ]

Some definitions of Inner Cacheability attibutes need to be corrected.

Fixes: 8c828a535e29f ("irqchip/gicv3-its: Restore all cacheability attributes")
Signed-off-by: Hongbo Yao <yaohongbo@huawei.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/irqchip/arm-gic-v3.h | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index 845ff8c51564c..0fe1fdedb8a19 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -152,7 +152,7 @@
 #define GICR_PROPBASER_nCnB	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, nCnB)
 #define GICR_PROPBASER_nC 	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, nC)
 #define GICR_PROPBASER_RaWt	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWt)
-#define GICR_PROPBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWt)
+#define GICR_PROPBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWb)
 #define GICR_PROPBASER_WaWt	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, WaWt)
 #define GICR_PROPBASER_WaWb	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, WaWb)
 #define GICR_PROPBASER_RaWaWt	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWaWt)
@@ -179,7 +179,7 @@
 #define GICR_PENDBASER_nCnB	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, nCnB)
 #define GICR_PENDBASER_nC 	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, nC)
 #define GICR_PENDBASER_RaWt	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWt)
-#define GICR_PENDBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWt)
+#define GICR_PENDBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWb)
 #define GICR_PENDBASER_WaWt	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, WaWt)
 #define GICR_PENDBASER_WaWb	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, WaWb)
 #define GICR_PENDBASER_RaWaWt	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWaWt)
@@ -238,7 +238,7 @@
 #define GICR_VPROPBASER_nCnB	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, nCnB)
 #define GICR_VPROPBASER_nC 	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, nC)
 #define GICR_VPROPBASER_RaWt	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWt)
-#define GICR_VPROPBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWt)
+#define GICR_VPROPBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWb)
 #define GICR_VPROPBASER_WaWt	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, WaWt)
 #define GICR_VPROPBASER_WaWb	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, WaWb)
 #define GICR_VPROPBASER_RaWaWt	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWaWt)
@@ -264,7 +264,7 @@
 #define GICR_VPENDBASER_nCnB	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, nCnB)
 #define GICR_VPENDBASER_nC 	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, nC)
 #define GICR_VPENDBASER_RaWt	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWt)
-#define GICR_VPENDBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWt)
+#define GICR_VPENDBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWb)
 #define GICR_VPENDBASER_WaWt	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, WaWt)
 #define GICR_VPENDBASER_WaWb	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, WaWb)
 #define GICR_VPENDBASER_RaWaWt	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWaWt)
@@ -337,7 +337,7 @@
 #define GITS_CBASER_nCnB	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, nCnB)
 #define GITS_CBASER_nC		GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, nC)
 #define GITS_CBASER_RaWt	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWt)
-#define GITS_CBASER_RaWb	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWt)
+#define GITS_CBASER_RaWb	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWb)
 #define GITS_CBASER_WaWt	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, WaWt)
 #define GITS_CBASER_WaWb	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, WaWb)
 #define GITS_CBASER_RaWaWt	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWaWt)
@@ -361,7 +361,7 @@
 #define GITS_BASER_nCnB		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, nCnB)
 #define GITS_BASER_nC		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, nC)
 #define GITS_BASER_RaWt		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWt)
-#define GITS_BASER_RaWb		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWt)
+#define GITS_BASER_RaWb		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWb)
 #define GITS_BASER_WaWt		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, WaWt)
 #define GITS_BASER_WaWb		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, WaWb)
 #define GITS_BASER_RaWaWt	GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWaWt)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 180/343] scsi: qla2xxx: Fix a format specifier
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 179/343] irqchip/gic-v3-its: fix some definitions of inner cacheability attributes Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.14 181/343] scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory Greg Kroah-Hartman
                   ` (167 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Giridhar Malavali,
	Bart Van Assche, Martin K. Petersen, Sasha Levin

From: Bart Van Assche <bvanassche@acm.org>

[ Upstream commit 19ce192cd718e02f880197c0983404ca48236807 ]

Since mcmd->sess->port_name is eight bytes long, use %8phC to format that
port name instead of %phC.

Cc: Himanshu Madhani <hmadhani@marvell.com>
Cc: Giridhar Malavali <gmalavali@marvell.com>
Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery") # v4.11.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_target.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 55227d20496a0..1000422ef4f8a 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -2179,7 +2179,7 @@ void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd)
 		    mcmd->orig_iocb.imm_ntfy.u.isp24.status_subcode ==
 		    ELS_TPRLO) {
 			ql_dbg(ql_dbg_disc, vha, 0x2106,
-			    "TM response logo %phC status %#x state %#x",
+			    "TM response logo %8phC status %#x state %#x",
 			    mcmd->sess->port_name, mcmd->fc_tm_rsp,
 			    mcmd->flags);
 			qlt_schedule_sess_for_deletion_lock(mcmd->sess);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 181/343] scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 180/343] scsi: qla2xxx: Fix a format specifier Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 182/343] packet: in recvmsg msg_name return at least sizeof sockaddr_ll Greg Kroah-Hartman
                   ` (166 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Giridhar Malavali,
	Bart Van Assche, Martin K. Petersen, Sasha Levin

From: Bart Van Assche <bvanassche@acm.org>

[ Upstream commit a861b49273578e255426a499842cf7f465456351 ]

The "(&ctio->u.status1.sense_data)[i]" where i >= 0 expressions in
qlt_send_resp_ctio() are probably typos and should have been
"(&ctio->u.status1.sense_data[4 * i])" instead. Instead of only fixing
these typos, modify the code for storing sense data such that it becomes
easy to read. This patch fixes a Coverity complaint about accessing an
array outside its bounds.

Cc: Himanshu Madhani <hmadhani@marvell.com>
Cc: Giridhar Malavali <gmalavali@marvell.com>
Fixes: be25152c0d9e ("qla2xxx: Improve T10-DIF/PI handling in driver.") # v4.11.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_target.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 1000422ef4f8a..21011c5fddebe 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -2122,14 +2122,14 @@ void qlt_send_resp_ctio(struct qla_qpair *qpair, struct qla_tgt_cmd *cmd,
 		ctio->u.status1.scsi_status |=
 		    cpu_to_le16(SS_RESIDUAL_UNDER);
 
-	/* Response code and sense key */
-	put_unaligned_le32(((0x70 << 24) | (sense_key << 8)),
-	    (&ctio->u.status1.sense_data)[0]);
+	/* Fixed format sense data. */
+	ctio->u.status1.sense_data[0] = 0x70;
+	ctio->u.status1.sense_data[2] = sense_key;
 	/* Additional sense length */
-	put_unaligned_le32(0x0a, (&ctio->u.status1.sense_data)[1]);
+	ctio->u.status1.sense_data[7] = 0xa;
 	/* ASC and ASCQ */
-	put_unaligned_le32(((asc << 24) | (ascq << 16)),
-	    (&ctio->u.status1.sense_data)[3]);
+	ctio->u.status1.sense_data[12] = asc;
+	ctio->u.status1.sense_data[13] = ascq;
 
 	/* Memory Barrier */
 	wmb();
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 182/343] packet: in recvmsg msg_name return at least sizeof sockaddr_ll
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.14 181/343] scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 183/343] ASoC: fix valid stream condition Greg Kroah-Hartman
                   ` (165 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Laight, Willem de Bruijn,
	David S. Miller, Sasha Levin

From: Willem de Bruijn <willemb@google.com>

[ Upstream commit b2cf86e1563e33a14a1c69b3e508d15dc12f804c ]

Packet send checks that msg_name is at least sizeof sockaddr_ll.
Packet recv must return at least this length, so that its output
can be passed unmodified to packet send.

This ceased to be true since adding support for lladdr longer than
sll_addr. Since, the return value uses true address length.

Always return at least sizeof sockaddr_ll, even if address length
is shorter. Zero the padding bytes.

Change v1->v2: do not overwrite zeroed padding again. use copy_len.

Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.")
Suggested-by: David Laight <David.Laight@aculab.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/packet/af_packet.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 4e1058159b082..e788f9c7c3984 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3407,20 +3407,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 	sock_recv_ts_and_drops(msg, sk, skb);
 
 	if (msg->msg_name) {
+		int copy_len;
+
 		/* If the address length field is there to be filled
 		 * in, we fill it in now.
 		 */
 		if (sock->type == SOCK_PACKET) {
 			__sockaddr_check_size(sizeof(struct sockaddr_pkt));
 			msg->msg_namelen = sizeof(struct sockaddr_pkt);
+			copy_len = msg->msg_namelen;
 		} else {
 			struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
 
 			msg->msg_namelen = sll->sll_halen +
 				offsetof(struct sockaddr_ll, sll_addr);
+			copy_len = msg->msg_namelen;
+			if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
+				memset(msg->msg_name +
+				       offsetof(struct sockaddr_ll, sll_addr),
+				       0, sizeof(sll->sll_addr));
+				msg->msg_namelen = sizeof(struct sockaddr_ll);
+			}
 		}
-		memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
-		       msg->msg_namelen);
+		memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
 	}
 
 	if (pkt_sk(sk)->auxdata) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 183/343] ASoC: fix valid stream condition
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 182/343] packet: in recvmsg msg_name return at least sizeof sockaddr_ll Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 184/343] usb: gadget: fsl: fix link error against usb-gadget module Greg Kroah-Hartman
                   ` (164 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jerome Brunet, Mark Brown, Sasha Levin

From: Jerome Brunet <jbrunet@baylibre.com>

[ Upstream commit 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce ]

A stream may specify a rate range using 'rate_min' and 'rate_max', so a
stream may be valid and not specify any rates. However, as stream cannot
be valid and not have any channel. Let's use this condition instead to
determine if a stream is valid or not.

Fixes: cde79035c6cf ("ASoC: Handle multiple codecs with split playback / capture")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/soc-pcm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 24047375c2fbb..70e1a60a2e980 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -48,8 +48,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream)
 	else
 		codec_stream = &dai->driver->capture;
 
-	/* If the codec specifies any rate at all, it supports the stream. */
-	return codec_stream->rates;
+	/* If the codec specifies any channels at all, it supports the stream */
+	return codec_stream->channels_min;
 }
 
 /**
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 184/343] usb: gadget: fsl: fix link error against usb-gadget module
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 183/343] ASoC: fix valid stream condition Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 185/343] dwc2: gadget: Fix completed transfer size calculation in DDMA Greg Kroah-Hartman
                   ` (163 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Felipe Balbi, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 2100e3ca3676e894fa48b8f6f01d01733387fe81 ]

The dependency to ensure this driver links correctly fails since
it can not be a loadable module:

drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_set_peripheral':
phy-fsl-usb.c:(.text+0x2224): undefined reference to `usb_gadget_vbus_disconnect'

Make the option 'tristate' so it can work correctly.

Fixes: 5a8d651a2bde ("usb: gadget: move gadget API functions to udc-core")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/phy/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 85a92d0813dd0..440238061eddf 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -20,7 +20,7 @@ config AB8500_USB
 	  in host mode, low speed.
 
 config FSL_USB2_OTG
-	bool "Freescale USB OTG Transceiver Driver"
+	tristate "Freescale USB OTG Transceiver Driver"
 	depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
 	depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
 	select USB_PHY
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 185/343] dwc2: gadget: Fix completed transfer size calculation in DDMA
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 184/343] usb: gadget: fsl: fix link error against usb-gadget module Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 186/343] IB/mlx5: Add missing XRC options to QP optional params mask Greg Kroah-Hartman
                   ` (162 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Minas Harutyunyan, Felipe Balbi, Sasha Levin

From: Minas Harutyunyan <minas.harutyunyan@synopsys.com>

[ Upstream commit 5acb4b970184d189d901192d075997c933b82260 ]

Fix calculation of transfer size on completion in function
dwc2_gadget_get_xfersize_ddma().

Added increment of descriptor pointer to move to next descriptor in
the loop.

Fixes: aa3e8bc81311 ("usb: dwc2: gadget: DDMA transfer start and complete")

Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/gadget.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index e164439b21542..4af9a1c652edb 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -2276,6 +2276,7 @@ static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep)
 		if (status & DEV_DMA_STS_MASK)
 			dev_err(hsotg->dev, "descriptor %d closed with %x\n",
 				i, status & DEV_DMA_STS_MASK);
+		desc++;
 	}
 
 	return bytes_rem;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 186/343] IB/mlx5: Add missing XRC options to QP optional params mask
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 185/343] dwc2: gadget: Fix completed transfer size calculation in DDMA Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 187/343] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU Greg Kroah-Hartman
                   ` (161 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Morgenstein, Leon Romanovsky,
	Jason Gunthorpe, Sasha Levin

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

[ Upstream commit 8f4426aa19fcdb9326ac44154a117b1a3a5ae126 ]

The QP transition optional parameters for the various transition for XRC
QPs are identical to those for RC QPs.

Many of the XRC QP transition optional parameter bits are missing from the
QP optional mask table.  These omissions caused failures when doing XRC QP
state transitions.

For example, when trying to change the response timer of an XRC receive QP
via the RTS2RTS transition, the new timer value was ignored because
MLX5_QP_OPTPAR_RNR_TIMEOUT bit was missing from the optional params mask
for XRC qps for the RTS2RTS transition.

Fix this by adding the missing XRC optional parameters for all QP
transitions to the opt_mask table.

Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Fixes: a4774e9095de ("IB/mlx5: Fix opt param mask according to firmware spec")
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx5/qp.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 5a7dcb5afe6e3..84c962820aa2a 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -2357,6 +2357,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_PKEY_INDEX	|
 					  MLX5_QP_OPTPAR_Q_KEY		|
 					  MLX5_QP_OPTPAR_PRI_PORT,
+			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE		|
+					  MLX5_QP_OPTPAR_RAE		|
+					  MLX5_QP_OPTPAR_RWE		|
+					  MLX5_QP_OPTPAR_PKEY_INDEX	|
+					  MLX5_QP_OPTPAR_PRI_PORT,
 		},
 		[MLX5_QP_STATE_RTR] = {
 			[MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH  |
@@ -2390,6 +2395,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
 					  MLX5_QP_OPTPAR_RWE		|
 					  MLX5_QP_OPTPAR_PM_STATE,
 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY,
+			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH	|
+					  MLX5_QP_OPTPAR_RRE		|
+					  MLX5_QP_OPTPAR_RAE		|
+					  MLX5_QP_OPTPAR_RWE		|
+					  MLX5_QP_OPTPAR_PM_STATE	|
+					  MLX5_QP_OPTPAR_RNR_TIMEOUT,
 		},
 	},
 	[MLX5_QP_STATE_RTS] = {
@@ -2406,6 +2417,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY		|
 					  MLX5_QP_OPTPAR_SRQN		|
 					  MLX5_QP_OPTPAR_CQN_RCV,
+			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE		|
+					  MLX5_QP_OPTPAR_RAE		|
+					  MLX5_QP_OPTPAR_RWE		|
+					  MLX5_QP_OPTPAR_RNR_TIMEOUT	|
+					  MLX5_QP_OPTPAR_PM_STATE	|
+					  MLX5_QP_OPTPAR_ALT_ADDR_PATH,
 		},
 	},
 	[MLX5_QP_STATE_SQER] = {
@@ -2417,6 +2434,10 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
 					   MLX5_QP_OPTPAR_RWE		|
 					   MLX5_QP_OPTPAR_RAE		|
 					   MLX5_QP_OPTPAR_RRE,
+			[MLX5_QP_ST_XRC]  = MLX5_QP_OPTPAR_RNR_TIMEOUT	|
+					   MLX5_QP_OPTPAR_RWE		|
+					   MLX5_QP_OPTPAR_RAE		|
+					   MLX5_QP_OPTPAR_RRE,
 		},
 	},
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 187/343] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 186/343] IB/mlx5: Add missing XRC options to QP optional params mask Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 188/343] net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ashok Raj, Jacob Pan, Kevin Tian,
	Lu Baolu, Zhenyu Wang, Joerg Roedel, Sasha Levin

From: Lu Baolu <baolu.lu@linux.intel.com>

[ Upstream commit 5daab58043ee2bca861068e2595564828f3bc663 ]

The kernel parameter igfx_off is used by users to disable
DMA remapping for the Intel integrated graphic device. It
was designed for bare metal cases where a dedicated IOMMU
is used for graphic. This doesn't apply to virtual IOMMU
case where an include-all IOMMU is used.  This makes the
kernel parameter work with virtual IOMMU as well.

Cc: Ashok Raj <ashok.raj@intel.com>
Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
Suggested-by: Kevin Tian <kevin.tian@intel.com>
Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Tested-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/intel-iommu.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 523d0889c2a4e..4fbd183d973ab 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3361,9 +3361,12 @@ static int __init init_dmars(void)
 		iommu_identity_mapping |= IDENTMAP_ALL;
 
 #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
-	iommu_identity_mapping |= IDENTMAP_GFX;
+	dmar_map_gfx = 0;
 #endif
 
+	if (!dmar_map_gfx)
+		iommu_identity_mapping |= IDENTMAP_GFX;
+
 	check_tylersburg_isoch();
 
 	if (iommu_identity_mapping) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 188/343] net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 187/343] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 189/343] net: ena: fix: Free napi resources when ena_up() fails Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Saeed Bshara, Sameeh Jubran,
	David S. Miller, Sasha Levin

From: Sameeh Jubran <sameehj@amazon.com>

[ Upstream commit 3c6eeff295f01bdf1c6c3addcb0a04c0c6c029e9 ]

second parameter should be the index of the table rather than the value.

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Saeed Bshara <saeedb@amazon.com>
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_ethtool.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index 967020fb26ee1..a2f02c23fe141 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -694,8 +694,8 @@ static int ena_set_rxfh(struct net_device *netdev, const u32 *indir,
 	if (indir) {
 		for (i = 0; i < ENA_RX_RSS_TABLE_SIZE; i++) {
 			rc = ena_com_indirect_table_fill_entry(ena_dev,
-							       ENA_IO_RXQ_IDX(indir[i]),
-							       i);
+							       i,
+							       ENA_IO_RXQ_IDX(indir[i]));
 			if (unlikely(rc)) {
 				netif_err(adapter, drv, netdev,
 					  "Cannot fill indirect table (index is too large)\n");
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 189/343] net: ena: fix: Free napi resources when ena_up() fails
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 188/343] net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 190/343] net: ena: fix incorrect test of supported hash function Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arthur Kiyanovski, Sameeh Jubran,
	David S. Miller, Sasha Levin

From: Sameeh Jubran <sameehj@amazon.com>

[ Upstream commit b287cdbd1cedfc9606682c6e02b58d00ff3a33ae ]

ena_up() calls ena_init_napi() but does not call ena_del_napi() in
case of failure. This causes a segmentation fault upon rmmod when
netif_napi_del() is called. Fix this bug by calling ena_del_napi()
before returning error from ena_up().

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index d22b138c2b096..518ff393a026b 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -1796,6 +1796,7 @@ err_setup_rx:
 err_setup_tx:
 	ena_free_io_irq(adapter);
 err_req_irq:
+	ena_del_napi(adapter);
 
 	return rc;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 190/343] net: ena: fix incorrect test of supported hash function
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 189/343] net: ena: fix: Free napi resources when ena_up() fails Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 191/343] net: ena: fix ena_com_fill_hash_function() implementation Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arthur Kiyanovski, Sameeh Jubran,
	David S. Miller, Sasha Levin

From: Sameeh Jubran <sameehj@amazon.com>

[ Upstream commit d3cfe7ddbc3dfbb9b201615b7fef8fd66d1b5fe8 ]

ena_com_set_hash_function() tests if a hash function is supported
by the device before setting it.
The test returns the opposite result than needed.
Reverse the condition to return the correct value.
Also use the BIT macro instead of inline shift.

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_com.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 1a4ffc5d3da4e..011b54c541aae 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -2002,7 +2002,7 @@ int ena_com_set_hash_function(struct ena_com_dev *ena_dev)
 	if (unlikely(ret))
 		return ret;
 
-	if (get_resp.u.flow_hash_func.supported_func & (1 << rss->hash_func)) {
+	if (!(get_resp.u.flow_hash_func.supported_func & BIT(rss->hash_func))) {
 		pr_err("Func hash %d isn't supported by device, abort\n",
 		       rss->hash_func);
 		return -EOPNOTSUPP;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 191/343] net: ena: fix ena_com_fill_hash_function() implementation
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 190/343] net: ena: fix incorrect test of supported hash function Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 192/343] dmaengine: tegra210-adma: restore channel status Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Netanel Belgazal, Sameeh Jubran,
	David S. Miller, Sasha Levin

From: Sameeh Jubran <sameehj@amazon.com>

[ Upstream commit 11bd7a00c0d8ffe33d1e926f8e789b4aea787186 ]

ena_com_fill_hash_function() didn't configure the rss->hash_func.

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Netanel Belgazal <netanel@amazon.com>
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_com.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 011b54c541aae..10e6053f66712 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -2087,6 +2087,7 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev,
 		return -EINVAL;
 	}
 
+	rss->hash_func = func;
 	rc = ena_com_set_hash_function(ena_dev);
 
 	/* Restore the old function */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 192/343] dmaengine: tegra210-adma: restore channel status
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 191/343] net: ena: fix ena_com_fill_hash_function() implementation Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 193/343] mmc: core: fix possible use after free of host Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sameer Pujar, Jon Hunter, Vinod Koul,
	Sasha Levin

From: Sameer Pujar <spujar@nvidia.com>

[ Upstream commit f33e7bb3eb922618612a90f0a828c790e8880773 ]

Status of ADMA channel registers is not saved and restored during system
suspend. During active playback if system enters suspend, this results in
wrong state of channel registers during system resume and playback fails
to resume properly. Fix this by saving following channel registers in
runtime suspend and restore during runtime resume.
 * ADMA_CH_LOWER_SRC_ADDR
 * ADMA_CH_LOWER_TRG_ADDR
 * ADMA_CH_FIFO_CTRL
 * ADMA_CH_CONFIG
 * ADMA_CH_CTRL
 * ADMA_CH_CMD
 * ADMA_CH_TC
Runtime PM calls will be inovked during system resume path if a playback
or capture needs to be resumed. Hence above changes work fine for system
suspend case.

Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA")
Signed-off-by: Sameer Pujar <spujar@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/tegra210-adma.c | 46 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
index 09b6756366c30..ac2a6b800db3e 100644
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -98,6 +98,7 @@ struct tegra_adma_chan_regs {
 	unsigned int src_addr;
 	unsigned int trg_addr;
 	unsigned int fifo_ctrl;
+	unsigned int cmd;
 	unsigned int tc;
 };
 
@@ -127,6 +128,7 @@ struct tegra_adma_chan {
 	enum dma_transfer_direction	sreq_dir;
 	unsigned int			sreq_index;
 	bool				sreq_reserved;
+	struct tegra_adma_chan_regs	ch_regs;
 
 	/* Transfer count and position info */
 	unsigned int			tx_buf_count;
@@ -635,8 +637,30 @@ static struct dma_chan *tegra_dma_of_xlate(struct of_phandle_args *dma_spec,
 static int tegra_adma_runtime_suspend(struct device *dev)
 {
 	struct tegra_adma *tdma = dev_get_drvdata(dev);
+	struct tegra_adma_chan_regs *ch_reg;
+	struct tegra_adma_chan *tdc;
+	int i;
 
 	tdma->global_cmd = tdma_read(tdma, ADMA_GLOBAL_CMD);
+	if (!tdma->global_cmd)
+		goto clk_disable;
+
+	for (i = 0; i < tdma->nr_channels; i++) {
+		tdc = &tdma->channels[i];
+		ch_reg = &tdc->ch_regs;
+		ch_reg->cmd = tdma_ch_read(tdc, ADMA_CH_CMD);
+		/* skip if channel is not active */
+		if (!ch_reg->cmd)
+			continue;
+		ch_reg->tc = tdma_ch_read(tdc, ADMA_CH_TC);
+		ch_reg->src_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_SRC_ADDR);
+		ch_reg->trg_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_TRG_ADDR);
+		ch_reg->ctrl = tdma_ch_read(tdc, ADMA_CH_CTRL);
+		ch_reg->fifo_ctrl = tdma_ch_read(tdc, ADMA_CH_FIFO_CTRL);
+		ch_reg->config = tdma_ch_read(tdc, ADMA_CH_CONFIG);
+	}
+
+clk_disable:
 	clk_disable_unprepare(tdma->ahub_clk);
 
 	return 0;
@@ -645,7 +669,9 @@ static int tegra_adma_runtime_suspend(struct device *dev)
 static int tegra_adma_runtime_resume(struct device *dev)
 {
 	struct tegra_adma *tdma = dev_get_drvdata(dev);
-	int ret;
+	struct tegra_adma_chan_regs *ch_reg;
+	struct tegra_adma_chan *tdc;
+	int ret, i;
 
 	ret = clk_prepare_enable(tdma->ahub_clk);
 	if (ret) {
@@ -654,6 +680,24 @@ static int tegra_adma_runtime_resume(struct device *dev)
 	}
 	tdma_write(tdma, ADMA_GLOBAL_CMD, tdma->global_cmd);
 
+	if (!tdma->global_cmd)
+		return 0;
+
+	for (i = 0; i < tdma->nr_channels; i++) {
+		tdc = &tdma->channels[i];
+		ch_reg = &tdc->ch_regs;
+		/* skip if channel was not active earlier */
+		if (!ch_reg->cmd)
+			continue;
+		tdma_ch_write(tdc, ADMA_CH_TC, ch_reg->tc);
+		tdma_ch_write(tdc, ADMA_CH_LOWER_SRC_ADDR, ch_reg->src_addr);
+		tdma_ch_write(tdc, ADMA_CH_LOWER_TRG_ADDR, ch_reg->trg_addr);
+		tdma_ch_write(tdc, ADMA_CH_CTRL, ch_reg->ctrl);
+		tdma_ch_write(tdc, ADMA_CH_FIFO_CTRL, ch_reg->fifo_ctrl);
+		tdma_ch_write(tdc, ADMA_CH_CONFIG, ch_reg->config);
+		tdma_ch_write(tdc, ADMA_CH_CMD, ch_reg->cmd);
+	}
+
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 193/343] mmc: core: fix possible use after free of host
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 192/343] dmaengine: tegra210-adma: restore channel status Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 194/343] lightnvm: pblk: fix lock order in pblk_rb_tear_down_check Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pan Bian, Ulf Hansson, Sasha Levin

From: Pan Bian <bianpan2016@163.com>

[ Upstream commit 8e1943af2986db42bee2b8dddf49a36cdb2e9219 ]

In the function mmc_alloc_host, the function put_device is called to
release allocated resources when mmc_gpio_alloc fails. Finally, the
function pointed by host->class_dev.class->dev_release (i.e.,
mmc_host_classdev_release) is used to release resources including the
host structure. However, after put_device, host is used and released
again. Resulting in a use-after-free bug.

Fixes: 1ed217194488 ("mmc: core: fix error path in mmc_host_alloc")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/core/host.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index ad88deb2e8f3b..3740fb0052a49 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -376,8 +376,6 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
 
 	if (mmc_gpio_alloc(host)) {
 		put_device(&host->class_dev);
-		ida_simple_remove(&mmc_host_ida, host->index);
-		kfree(host);
 		return NULL;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 194/343] lightnvm: pblk: fix lock order in pblk_rb_tear_down_check
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 193/343] mmc: core: fix possible use after free of host Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 195/343] afs: Fix the afs.cell and afs.volume xattr handlers Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Igor Konopko, Javier González,
	Hans Holmberg, Matias Bjørling, Jens Axboe, Sasha Levin

From: Igor Konopko <igor.j.konopko@intel.com>

[ Upstream commit 486b5aac85f6ec0b2df3e82a6a629d5eb7804db5 ]

In pblk_rb_tear_down_check() the spinlock functions are not
called in proper order.

Fixes: a4bd217 ("lightnvm: physical block device (pblk) target")
Signed-off-by: Igor Konopko <igor.j.konopko@intel.com>
Reviewed-by: Javier González <javier@javigon.com>
Reviewed-by: Hans Holmberg <hans.holmberg@cnexlabs.com>
Signed-off-by: Matias Bjørling <mb@lightnvm.io>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/lightnvm/pblk-rb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/lightnvm/pblk-rb.c b/drivers/lightnvm/pblk-rb.c
index c0dd17a821709..73de2deaba673 100644
--- a/drivers/lightnvm/pblk-rb.c
+++ b/drivers/lightnvm/pblk-rb.c
@@ -825,8 +825,8 @@ int pblk_rb_tear_down_check(struct pblk_rb *rb)
 	}
 
 out:
-	spin_unlock(&rb->w_lock);
 	spin_unlock_irq(&rb->s_lock);
+	spin_unlock(&rb->w_lock);
 
 	return ret;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 195/343] afs: Fix the afs.cell and afs.volume xattr handlers
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 194/343] lightnvm: pblk: fix lock order in pblk_rb_tear_down_check Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 196/343] vfio/mdev: Avoid release parent reference during error path Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Howells, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit c73aa4102f5b9f261a907c3b3df94cd2c478504d ]

Fix the ->get handlers for the afs.cell and afs.volume xattrs to pass the
source data size to memcpy() rather than target buffer size.

Overcopying the source data occasionally causes the kernel to oops.

Fixes: d3e3b7eac886 ("afs: Add metadata xattrs")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/xattr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/afs/xattr.c b/fs/afs/xattr.c
index 2830e4f48d854..7c6b62a94e7e7 100644
--- a/fs/afs/xattr.c
+++ b/fs/afs/xattr.c
@@ -50,7 +50,7 @@ static int afs_xattr_get_cell(const struct xattr_handler *handler,
 		return namelen;
 	if (namelen > size)
 		return -ERANGE;
-	memcpy(buffer, cell->name, size);
+	memcpy(buffer, cell->name, namelen);
 	return namelen;
 }
 
@@ -104,7 +104,7 @@ static int afs_xattr_get_volume(const struct xattr_handler *handler,
 		return namelen;
 	if (namelen > size)
 		return -ERANGE;
-	memcpy(buffer, volname, size);
+	memcpy(buffer, volname, namelen);
 	return namelen;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 196/343] vfio/mdev: Avoid release parent reference during error path
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 195/343] afs: Fix the afs.cell and afs.volume xattr handlers Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 197/343] vfio/mdev: Fix aborting mdev child device removal if one fails Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cornelia Huck, Kirti Wankhede,
	Maxim Levitsky, Parav Pandit, Alex Williamson, Sasha Levin

From: Parav Pandit <parav@mellanox.com>

[ Upstream commit 60e7f2c3fe9919cee9534b422865eed49f4efb15 ]

During mdev parent registration in mdev_register_device(),
if parent device is duplicate, it releases the reference of existing
parent device.
This is incorrect. Existing parent device should not be touched.

Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Kirti Wankhede <kwankhede@nvidia.com>
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: Parav Pandit <parav@mellanox.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/mdev/mdev_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
index 0212f0ee8aea7..8cfa712308773 100644
--- a/drivers/vfio/mdev/mdev_core.c
+++ b/drivers/vfio/mdev/mdev_core.c
@@ -182,6 +182,7 @@ int mdev_register_device(struct device *dev, const struct mdev_parent_ops *ops)
 	/* Check for duplicate */
 	parent = __find_parent_device(dev);
 	if (parent) {
+		parent = NULL;
 		ret = -EEXIST;
 		goto add_dev_err;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 197/343] vfio/mdev: Fix aborting mdev child device removal if one fails
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 196/343] vfio/mdev: Avoid release parent reference during error path Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 198/343] l2tp: Fix possible NULL pointer dereference Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxim Levitsky, Parav Pandit,
	Alex Williamson, Sasha Levin

From: Parav Pandit <parav@mellanox.com>

[ Upstream commit 6093e348a5e2475c5bb2e571346460f939998670 ]

device_for_each_child() stops executing callback function for remaining
child devices, if callback hits an error.
Each child mdev device is independent of each other.
While unregistering parent device, mdev core must remove all child mdev
devices.
Therefore, mdev_device_remove_cb() always returns success so that
device_for_each_child doesn't abort if one child removal hits error.

While at it, improve remove and unregister functions for below simplicity.

There isn't need to pass forced flag pointer during mdev parent
removal which invokes mdev_device_remove(). So simplify the flow.

mdev_device_remove() is called from two paths.
1. mdev_unregister_driver()
     mdev_device_remove_cb()
       mdev_device_remove()
2. remove_store()
     mdev_device_remove()

Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: Parav Pandit <parav@mellanox.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/mdev/mdev_core.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
index 8cfa712308773..e052f62fdea7e 100644
--- a/drivers/vfio/mdev/mdev_core.c
+++ b/drivers/vfio/mdev/mdev_core.c
@@ -150,10 +150,10 @@ static int mdev_device_remove_ops(struct mdev_device *mdev, bool force_remove)
 
 static int mdev_device_remove_cb(struct device *dev, void *data)
 {
-	if (!dev_is_mdev(dev))
-		return 0;
+	if (dev_is_mdev(dev))
+		mdev_device_remove(dev, true);
 
-	return mdev_device_remove(dev, data ? *(bool *)data : true);
+	return 0;
 }
 
 /*
@@ -241,7 +241,6 @@ EXPORT_SYMBOL(mdev_register_device);
 void mdev_unregister_device(struct device *dev)
 {
 	struct mdev_parent *parent;
-	bool force_remove = true;
 
 	mutex_lock(&parent_list_lock);
 	parent = __find_parent_device(dev);
@@ -255,8 +254,7 @@ void mdev_unregister_device(struct device *dev)
 	list_del(&parent->next);
 	class_compat_remove_link(mdev_bus_compat_class, dev, NULL);
 
-	device_for_each_child(dev, (void *)&force_remove,
-			      mdev_device_remove_cb);
+	device_for_each_child(dev, NULL, mdev_device_remove_cb);
 
 	parent_remove_sysfs_files(parent);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 198/343] l2tp: Fix possible NULL pointer dereference
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 197/343] vfio/mdev: Fix aborting mdev child device removal if one fails Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 199/343] media: omap_vout: potential buffer overflow in vidioc_dqbuf() Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Guillaume Nault,
	David S. Miller, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 638a3a1e349ddf5b82f222ff5cb3b4f266e7c278 ]

BUG: unable to handle kernel NULL pointer dereference at 0000000000000128
PGD 0 P4D 0
Oops: 0000 [#1
CPU: 0 PID: 5697 Comm: modprobe Tainted: G        W         5.1.0-rc7+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
RIP: 0010:__lock_acquire+0x53/0x10b0
Code: 8b 1c 25 40 5e 01 00 4c 8b 6d 10 45 85 e4 0f 84 bd 06 00 00 44 8b 1d 7c d2 09 02 49 89 fe 41 89 d2 45 85 db 0f 84 47 02 00 00 <48> 81 3f a0 05 70 83 b8 00 00 00 00 44 0f 44 c0 83 fe 01 0f 86 3a
RSP: 0018:ffffc90001c07a28 EFLAGS: 00010002
RAX: 0000000000000000 RBX: ffff88822f038440 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000128
RBP: ffffc90001c07a88 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000128 R15: 0000000000000000
FS:  00007fead0811540(0000) GS:ffff888237a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000128 CR3: 00000002310da000 CR4: 00000000000006f0
Call Trace:
 ? __lock_acquire+0x24e/0x10b0
 lock_acquire+0xdf/0x230
 ? flush_workqueue+0x71/0x530
 flush_workqueue+0x97/0x530
 ? flush_workqueue+0x71/0x530
 l2tp_exit_net+0x170/0x2b0 [l2tp_core
 ? l2tp_exit_net+0x93/0x2b0 [l2tp_core
 ops_exit_list.isra.6+0x36/0x60
 unregister_pernet_operations+0xb8/0x110
 unregister_pernet_device+0x25/0x40
 l2tp_init+0x55/0x1000 [l2tp_core
 ? 0xffffffffa018d000
 do_one_initcall+0x6c/0x3cc
 ? do_init_module+0x22/0x1f1
 ? rcu_read_lock_sched_held+0x97/0xb0
 ? kmem_cache_alloc_trace+0x325/0x3b0
 do_init_module+0x5b/0x1f1
 load_module+0x1db1/0x2690
 ? m_show+0x1d0/0x1d0
 __do_sys_finit_module+0xc5/0xd0
 __x64_sys_finit_module+0x15/0x20
 do_syscall_64+0x6b/0x1d0
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fead031a839
Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f6 2c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffe8d9acca8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 0000560078398b80 RCX: 00007fead031a839
RDX: 0000000000000000 RSI: 000056007659dc2e RDI: 0000000000000003
RBP: 000056007659dc2e R08: 0000000000000000 R09: 0000560078398b80
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
R13: 00005600783a04a0 R14: 0000000000040000 R15: 0000560078398b80
Modules linked in: l2tp_core(+) e1000 ip_tables ipv6 [last unloaded: l2tp_core
CR2: 0000000000000128
---[ end trace 8322b2b8bf83f8e1

If alloc_workqueue fails in l2tp_init, l2tp_net_ops
is unregistered on failure path. Then l2tp_exit_net
is called which will flush NULL workqueue, this patch
add a NULL check to fix it.

Fixes: 67e04c29ec0d ("l2tp: unregister l2tp_net_ops on failure path")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/l2tp/l2tp_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index e494f04819e9c..b9be0360ab94b 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1892,7 +1892,8 @@ static __net_exit void l2tp_exit_net(struct net *net)
 	}
 	rcu_read_unlock_bh();
 
-	flush_workqueue(l2tp_wq);
+	if (l2tp_wq)
+		flush_workqueue(l2tp_wq);
 	rcu_barrier();
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 199/343] media: omap_vout: potential buffer overflow in vidioc_dqbuf()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 198/343] l2tp: Fix possible NULL pointer dereference Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 200/343] media: davinci/vpbe: array underflow in vpbe_enum_outputs() Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit dd6e2a981bfe83aa4a493143fd8cf1edcda6c091 ]

The "b->index" is a u32 the comes from the user in the ioctl.  It hasn't
been checked.  We aren't supposed to use it but we're instead supposed
to use the value that gets written to it when we call videobuf_dqbuf().

The videobuf_dqbuf() first memsets it to zero and then re-initializes it
inside the videobuf_status() function.  It's this final value which we
want.

Hans Verkuil pointed out that we need to check the return from
videobuf_dqbuf().  I ended up doing a little cleanup related to that as
well.

Fixes: 72915e851da9 ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers in qbuf and dqbuf")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/omap/omap_vout.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
index 4d29860d27b42..18604b608ab2e 100644
--- a/drivers/media/platform/omap/omap_vout.c
+++ b/drivers/media/platform/omap/omap_vout.c
@@ -1527,23 +1527,20 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b)
 	unsigned long size;
 	struct videobuf_buffer *vb;
 
-	vb = q->bufs[b->index];
-
 	if (!vout->streaming)
 		return -EINVAL;
 
-	if (file->f_flags & O_NONBLOCK)
-		/* Call videobuf_dqbuf for non blocking mode */
-		ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 1);
-	else
-		/* Call videobuf_dqbuf for  blocking mode */
-		ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0);
+	ret = videobuf_dqbuf(q, b, !!(file->f_flags & O_NONBLOCK));
+	if (ret)
+		return ret;
+
+	vb = q->bufs[b->index];
 
 	addr = (unsigned long) vout->buf_phy_addr[vb->i];
 	size = (unsigned long) vb->size;
 	dma_unmap_single(vout->vid_dev->v4l2_dev.dev,  addr,
 				size, DMA_TO_DEVICE);
-	return ret;
+	return 0;
 }
 
 static int vidioc_streamon(struct file *file, void *fh, enum v4l2_buf_type i)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 200/343] media: davinci/vpbe: array underflow in vpbe_enum_outputs()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 199/343] media: omap_vout: potential buffer overflow in vidioc_dqbuf() Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 201/343] platform/x86: alienware-wmi: printing the wrong error code Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Lad, Prabhakar,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit b72845ee5577b227131b1fef23f9d9a296621d7b ]

In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but
the problem is that "temp_index" can be negative.  This patch changes
the types to unsigned to address this array underflow bug.

Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/davinci/vpbe.c | 2 +-
 include/media/davinci/vpbe.h          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
index 1d3c13e369044..915af9ca47111 100644
--- a/drivers/media/platform/davinci/vpbe.c
+++ b/drivers/media/platform/davinci/vpbe.c
@@ -126,7 +126,7 @@ static int vpbe_enum_outputs(struct vpbe_device *vpbe_dev,
 			     struct v4l2_output *output)
 {
 	struct vpbe_config *cfg = vpbe_dev->cfg;
-	int temp_index = output->index;
+	unsigned int temp_index = output->index;
 
 	if (temp_index >= cfg->num_outputs)
 		return -EINVAL;
diff --git a/include/media/davinci/vpbe.h b/include/media/davinci/vpbe.h
index 79a566d7defd0..180a05e914979 100644
--- a/include/media/davinci/vpbe.h
+++ b/include/media/davinci/vpbe.h
@@ -92,7 +92,7 @@ struct vpbe_config {
 	struct encoder_config_info *ext_encoders;
 	/* amplifier information goes here */
 	struct amp_config_info *amp;
-	int num_outputs;
+	unsigned int num_outputs;
 	/* Order is venc outputs followed by LCD and then external encoders */
 	struct vpbe_output *outputs;
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 201/343] platform/x86: alienware-wmi: printing the wrong error code
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 200/343] media: davinci/vpbe: array underflow in vpbe_enum_outputs() Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 202/343] crypto: caam - fix caam_dump_sg that iterates through scatterlist Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mario Limonciello,
	Andy Shevchenko, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 6d1f8b3d75419a8659ac916a1e9543bb3513a882 ]

The "out_data" variable is uninitialized at the point.  Originally, this
used to print "status" instead and that seems like the correct thing to
print.

Fixes: bc2ef884320b ("alienware-wmi: For WMAX HDMI method, introduce a way to query HDMI cable status")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/alienware-wmi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
index cbd84e2e3bd47..2c82188f8486c 100644
--- a/drivers/platform/x86/alienware-wmi.c
+++ b/drivers/platform/x86/alienware-wmi.c
@@ -570,7 +570,7 @@ static ssize_t show_hdmi_source(struct device *dev,
 			return scnprintf(buf, PAGE_SIZE,
 					 "input [gpu] unknown\n");
 	}
-	pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
+	pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
 	return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 202/343] crypto: caam - fix caam_dump_sg that iterates through scatterlist
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 201/343] platform/x86: alienware-wmi: printing the wrong error code Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 203/343] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Iuliana Prodan, Horia Geantă,
	Herbert Xu, Sasha Levin

From: Iuliana Prodan <iuliana.prodan@nxp.com>

[ Upstream commit 8c65d35435e8cbfdf953cafe5ebe3648ee9276a2 ]

Fix caam_dump_sg by correctly determining the next scatterlist
entry in the list.

Fixes: 5ecf8ef9103c ("crypto: caam - fix sg dump")
Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/caam/error.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
index 8da88beb1abbe..832ba2afdcd57 100644
--- a/drivers/crypto/caam/error.c
+++ b/drivers/crypto/caam/error.c
@@ -22,7 +22,7 @@ void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
 	size_t len;
 	void *buf;
 
-	for (it = sg; it && tlen > 0 ; it = sg_next(sg)) {
+	for (it = sg; it && tlen > 0 ; it = sg_next(it)) {
 		/*
 		 * make sure the scatterlist's page
 		 * has a valid virtual memory mapping
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 203/343] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 202/343] crypto: caam - fix caam_dump_sg that iterates through scatterlist Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 204/343] pwm: meson: Consider 128 a valid pre-divider Greg Kroah-Hartman
                   ` (144 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, Florian Westphal,
	Pablo Neira Ayuso, Sasha Levin

From: Florian Westphal <fw@strlen.de>

[ Upstream commit 680f6af5337c98d116e4f127cea7845339dba8da ]

If userspace provides a rule blob with trailing data after last target,
we trigger a splat, then convert ruleset to 64bit format (with trailing
data), then pass that to do_replace_finish() which then returns -EINVAL.

Erroring out right away avoids the splat plus unneeded translation and
error unwind.

Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bridge/netfilter/ebtables.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 35a670ec90775..a1834ad7422ce 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2164,7 +2164,9 @@ static int compat_copy_entries(unsigned char *data, unsigned int size_user,
 	if (ret < 0)
 		return ret;
 
-	WARN_ON(size_remaining);
+	if (size_remaining)
+		return -EINVAL;
+
 	return state->buf_kern_offset;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 204/343] pwm: meson: Consider 128 a valid pre-divider
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 203/343] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 205/343] pwm: meson: Dont disable PWM when setting duty repeatedly Greg Kroah-Hartman
                   ` (143 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl,
	Uwe Kleine-König, Neil Armstrong, Thierry Reding,
	Sasha Levin

From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>

[ Upstream commit 51496e4446875726d50a5617a6e0e0dabbc2e6da ]

The pre-divider allows configuring longer PWM periods compared to using
the input clock directly. The pre-divider is 7 bit wide, meaning it's
maximum value is 128 (the register value is off-by-one: 0x7f or 127).

Change the loop to also allow for the maximum possible value to be
considered valid.

Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-meson.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
index 9b79cbc7a7152..9551f896dd6f3 100644
--- a/drivers/pwm/pwm-meson.c
+++ b/drivers/pwm/pwm-meson.c
@@ -188,7 +188,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
 	do_div(fin_ps, fin_freq);
 
 	/* Calc pre_div with the period */
-	for (pre_div = 0; pre_div < MISC_CLK_DIV_MASK; pre_div++) {
+	for (pre_div = 0; pre_div <= MISC_CLK_DIV_MASK; pre_div++) {
 		cnt = DIV_ROUND_CLOSEST_ULL((u64)period * 1000,
 					    fin_ps * (pre_div + 1));
 		dev_dbg(meson->chip.dev, "fin_ps=%llu pre_div=%u cnt=%u\n",
@@ -197,7 +197,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
 			break;
 	}
 
-	if (pre_div == MISC_CLK_DIV_MASK) {
+	if (pre_div > MISC_CLK_DIV_MASK) {
 		dev_err(meson->chip.dev, "unable to get period pre_div\n");
 		return -EINVAL;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 205/343] pwm: meson: Dont disable PWM when setting duty repeatedly
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (203 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 204/343] pwm: meson: Consider 128 a valid pre-divider Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 206/343] ARM: riscpc: fix lack of keyboard interrupts after irq conversion Greg Kroah-Hartman
                   ` (142 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bichao Zheng, Martin Blumenstingl,
	Neil Armstrong, Thierry Reding, Sasha Levin

From: Bichao Zheng <bichao.zheng@amlogic.com>

[ Upstream commit a279345807e1e0ae79567a52cfdd9d30c9174a3c ]

There is an abnormally low about 20ms,when setting duty repeatedly.
Because setting the duty will disable PWM and then enable. Delete
this operation now.

Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
Signed-off-by: Bichao Zheng <bichao.zheng@amlogic.com>
[ Dropped code instead of hiding it behind a comment ]
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-meson.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
index 9551f896dd6f3..3d2c36963a4fc 100644
--- a/drivers/pwm/pwm-meson.c
+++ b/drivers/pwm/pwm-meson.c
@@ -325,11 +325,6 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
 	if (state->period != channel->state.period ||
 	    state->duty_cycle != channel->state.duty_cycle ||
 	    state->polarity != channel->state.polarity) {
-		if (channel->state.enabled) {
-			meson_pwm_disable(meson, pwm->hwpwm);
-			channel->state.enabled = false;
-		}
-
 		if (state->polarity != channel->state.polarity) {
 			if (state->polarity == PWM_POLARITY_NORMAL)
 				meson->inverter_mask |= BIT(pwm->hwpwm);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 206/343] ARM: riscpc: fix lack of keyboard interrupts after irq conversion
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (204 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 205/343] pwm: meson: Dont disable PWM when setting duty repeatedly Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 207/343] kdb: do a sanity check on the cpu in kdb_per_cpu() Greg Kroah-Hartman
                   ` (141 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Russell King, Sasha Levin

From: Russell King <rmk+kernel@armlinux.org.uk>

[ Upstream commit 63a0666bca9311f35017be454587f3ba903644b8 ]

Fix lack of keyboard interrupts for RiscPC due to incorrect conversion.

Fixes: e8d36d5dbb6a ("ARM: kill off set_irq_flags usage")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-rpc/irq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mach-rpc/irq.c b/arch/arm/mach-rpc/irq.c
index b8a61cb112073..7f0f401786344 100644
--- a/arch/arm/mach-rpc/irq.c
+++ b/arch/arm/mach-rpc/irq.c
@@ -118,7 +118,7 @@ extern unsigned char rpc_default_fiq_start, rpc_default_fiq_end;
 
 void __init rpc_init_irq(void)
 {
-	unsigned int irq, clr, set = 0;
+	unsigned int irq, clr, set;
 
 	iomd_writeb(0, IOMD_IRQMASKA);
 	iomd_writeb(0, IOMD_IRQMASKB);
@@ -130,6 +130,7 @@ void __init rpc_init_irq(void)
 
 	for (irq = 0; irq < NR_IRQS; irq++) {
 		clr = IRQ_NOREQUEST;
+		set = 0;
 
 		if (irq <= 6 || (irq >= 9 && irq <= 15))
 			clr |= IRQ_NOPROBE;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 207/343] kdb: do a sanity check on the cpu in kdb_per_cpu()
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (205 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 206/343] ARM: riscpc: fix lack of keyboard interrupts after irq conversion Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 208/343] backlight: lm3630a: Return 0 on success in update_status functions Greg Kroah-Hartman
                   ` (140 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Douglas Anderson,
	Daniel Thompson, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit b586627e10f57ee3aa8f0cfab0d6f7dc4ae63760 ]

The "whichcpu" comes from argv[3].  The cpu_online() macro looks up the
cpu in a bitmap of online cpus, but if the value is too high then it
could read beyond the end of the bitmap and possibly Oops.

Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/debug/kdb/kdb_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 993db6b2348e7..15d902daeef6c 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -2634,7 +2634,7 @@ static int kdb_per_cpu(int argc, const char **argv)
 		diag = kdbgetularg(argv[3], &whichcpu);
 		if (diag)
 			return diag;
-		if (!cpu_online(whichcpu)) {
+		if (whichcpu >= nr_cpu_ids || !cpu_online(whichcpu)) {
 			kdb_printf("cpu %ld is not online\n", whichcpu);
 			return KDB_BADCPUNUM;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 208/343] backlight: lm3630a: Return 0 on success in update_status functions
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (206 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 207/343] kdb: do a sanity check on the cpu in kdb_per_cpu() Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 209/343] thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power Greg Kroah-Hartman
                   ` (139 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Masney, Pavel Machek,
	Daniel Thompson, Lee Jones, Sasha Levin

From: Brian Masney <masneyb@onstation.org>

[ Upstream commit d3f48ec0954c6aac736ab21c34a35d7554409112 ]

lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status()
both return the brightness value if the brightness was successfully
updated. Writing to these attributes via sysfs would cause a 'Bad
address' error to be returned. These functions should return 0 on
success, so let's change it to correct that error.

Fixes: 28e64a68a2ef ("backlight: lm3630: apply chip revision")
Signed-off-by: Brian Masney <masneyb@onstation.org>
Acked-by: Pavel Machek <pavel@ucw.cz>
Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/backlight/lm3630a_bl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
index 2030a6b77a097..ef2553f452ca9 100644
--- a/drivers/video/backlight/lm3630a_bl.c
+++ b/drivers/video/backlight/lm3630a_bl.c
@@ -201,7 +201,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
 				      LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE);
 	if (ret < 0)
 		goto out_i2c_err;
-	return bl->props.brightness;
+	return 0;
 
 out_i2c_err:
 	dev_err(pchip->dev, "i2c failed to access\n");
@@ -278,7 +278,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
 				      LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE);
 	if (ret < 0)
 		goto out_i2c_err;
-	return bl->props.brightness;
+	return 0;
 
 out_i2c_err:
 	dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 209/343] thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (207 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 208/343] backlight: lm3630a: Return 0 on success in update_status functions Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 210/343] EDAC/mc: Fix edac_mc_find() in case no device is found Greg Kroah-Hartman
                   ` (138 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthias Kaehlcke, Daniel Lezcano,
	Javi Merino, Viresh Kumar, Eduardo Valentin, Sasha Levin

From: Matthias Kaehlcke <mka@chromium.org>

[ Upstream commit bf45ac18b78038e43af3c1a273cae4ab5704d2ce ]

The CPU load values passed to the thermal_power_cpu_get_power
tracepoint are zero for all CPUs, unless, unless the
thermal_power_cpu_limit tracepoint is enabled too:

  irq/41-rockchip-98    [000] ....   290.972410: thermal_power_cpu_get_power:
  cpus=0000000f freq=1800000 load={{0x0,0x0,0x0,0x0}} dynamic_power=4815

vs

  irq/41-rockchip-96    [000] ....    95.773585: thermal_power_cpu_get_power:
  cpus=0000000f freq=1800000 load={{0x56,0x64,0x64,0x5e}} dynamic_power=4959
  irq/41-rockchip-96    [000] ....    95.773596: thermal_power_cpu_limit:
  cpus=0000000f freq=408000 cdev_state=10 power=416

There seems to be no good reason for omitting the CPU load information
depending on another tracepoint. My guess is that the intention was to
check whether thermal_power_cpu_get_power is (still) enabled, however
'load_cpu != NULL' already indicates that it was at least enabled when
cpufreq_get_requested_power() was entered, there seems little gain
from omitting the assignment if the tracepoint was just disabled, so
just remove the check.

Fixes: 6828a4711f99 ("thermal: add trace events to the power allocator governor")
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Acked-by: Javi Merino <javi.merino@kernel.org>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/cpu_cooling.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 908a8014cf767..aed995ec2c909 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -514,7 +514,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev,
 			load = 0;
 
 		total_load += load;
-		if (trace_thermal_power_cpu_limit_enabled() && load_cpu)
+		if (load_cpu)
 			load_cpu[i] = load;
 
 		i++;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 210/343] EDAC/mc: Fix edac_mc_find() in case no device is found
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (208 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 209/343] thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 211/343] ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert Richter, Borislav Petkov,
	linux-edac, James Morse, Mauro Carvalho Chehab, Sasha Levin

From: Robert Richter <rrichter@marvell.com>

[ Upstream commit 29a0c843973bc385918158c6976e4dbe891df969 ]

The function should return NULL in case no device is found, but it
always returns the last checked mc device from the list even if the
index did not match. Fix that.

I did some analysis why this did not raise any issues for about 3 years
and the reason is that edac_mc_find() is mostly used to search for
existing devices. Thus, the bug is not triggered.

 [ bp: Drop the if (mci->mc_idx > idx) test in favor of readability. ]

Fixes: c73e8833bec5 ("EDAC, mc: Fix locking around mc_devices list")
Signed-off-by: Robert Richter <rrichter@marvell.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
Cc: James Morse <james.morse@arm.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Link: https://lkml.kernel.org/r/20190514104838.15065-1-rrichter@marvell.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/edac_mc.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index f7fa05fee45a1..329021189c38b 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -680,22 +680,18 @@ static int del_mc_from_global_list(struct mem_ctl_info *mci)
 
 struct mem_ctl_info *edac_mc_find(int idx)
 {
-	struct mem_ctl_info *mci = NULL;
+	struct mem_ctl_info *mci;
 	struct list_head *item;
 
 	mutex_lock(&mem_ctls_mutex);
 
 	list_for_each(item, &mc_devices) {
 		mci = list_entry(item, struct mem_ctl_info, link);
-
-		if (mci->mc_idx >= idx) {
-			if (mci->mc_idx == idx) {
-				goto unlock;
-			}
-			break;
-		}
+		if (mci->mc_idx == idx)
+			goto unlock;
 	}
 
+	mci = NULL;
 unlock:
 	mutex_unlock(&mem_ctls_mutex);
 	return mci;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 211/343] ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (209 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 210/343] EDAC/mc: Fix edac_mc_find() in case no device is found Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 212/343] dmaengine: tegra210-adma: Fix crash during probe Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jernej Skrabec, Maxime Ripard, Sasha Levin

From: Jernej Skrabec <jernej.skrabec@siol.net>

[ Upstream commit ca0961011db57e39880df0b5708df8aa3339dc6f ]

mmc1 node where wifi module is connected doesn't have properly defined
power supplies so wifi module is never powered up. Fix that by
specifying additional power supplies.

Additionally, this STB may have either Realtek or Broadcom based wifi
module. One based on Broadcom module also needs external clock to work
properly. Fix that by adding clock property to wifi_pwrseq node.

Fixes: e582b47a9252 ("ARM: dts: sun8i-h3: Add dts for the Beelink X2 STB")
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-h3-beelink-x2.dts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
index 10da56e86ab80..21b38c386f1b3 100644
--- a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
+++ b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
@@ -79,6 +79,8 @@
 	wifi_pwrseq: wifi_pwrseq {
 		compatible = "mmc-pwrseq-simple";
 		reset-gpios = <&r_pio 0 7 GPIO_ACTIVE_LOW>; /* PL7 */
+		clocks = <&rtc 1>;
+		clock-names = "ext_clock";
 	};
 
 	sound_spdif {
@@ -128,6 +130,8 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&mmc1_pins_a>;
 	vmmc-supply = <&reg_vcc3v3>;
+	vqmmc-supply = <&reg_vcc3v3>;
+	mmc-pwrseq = <&wifi_pwrseq>;
 	bus-width = <4>;
 	non-removable;
 	status = "okay";
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 212/343] dmaengine: tegra210-adma: Fix crash during probe
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (210 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 211/343] ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 213/343] arm64: dts: meson: libretech-cc: set eMMC as removable Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jon Hunter, Vinod Koul, Sasha Levin

From: Jon Hunter <jonathanh@nvidia.com>

[ Upstream commit b53611fb1ce9b1786bd18205473e0c1d6bfa8934 ]

Commit f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status")
added support to save and restore the DMA channel registers when runtime
suspending the ADMA. This change is causing the kernel to crash when
probing the ADMA, if the device is probed deferred when looking up the
channel interrupts. The crash occurs because not all of the channel base
addresses have been setup at this point and in the clean-up path of the
probe, pm_runtime_suspend() is called invoking its callback which
expects all the channel base addresses to be initialised.

Although this could be fixed by simply checking for a NULL address, on
further review of the driver it seems more appropriate that we only call
pm_runtime_get_sync() after all the channel interrupts and base
addresses have been configured. Therefore, fix this crash by moving the
calls to pm_runtime_enable(), pm_runtime_get_sync() and
tegra_adma_init() after the DMA channels have been initialised.

Fixes: f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status")

Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/tegra210-adma.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
index ac2a6b800db3e..4f4733d831a1a 100644
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -744,16 +744,6 @@ static int tegra_adma_probe(struct platform_device *pdev)
 		return PTR_ERR(tdma->ahub_clk);
 	}
 
-	pm_runtime_enable(&pdev->dev);
-
-	ret = pm_runtime_get_sync(&pdev->dev);
-	if (ret < 0)
-		goto rpm_disable;
-
-	ret = tegra_adma_init(tdma);
-	if (ret)
-		goto rpm_put;
-
 	INIT_LIST_HEAD(&tdma->dma_dev.channels);
 	for (i = 0; i < tdma->nr_channels; i++) {
 		struct tegra_adma_chan *tdc = &tdma->channels[i];
@@ -771,6 +761,16 @@ static int tegra_adma_probe(struct platform_device *pdev)
 		tdc->tdma = tdma;
 	}
 
+	pm_runtime_enable(&pdev->dev);
+
+	ret = pm_runtime_get_sync(&pdev->dev);
+	if (ret < 0)
+		goto rpm_disable;
+
+	ret = tegra_adma_init(tdma);
+	if (ret)
+		goto rpm_put;
+
 	dma_cap_set(DMA_SLAVE, tdma->dma_dev.cap_mask);
 	dma_cap_set(DMA_PRIVATE, tdma->dma_dev.cap_mask);
 	dma_cap_set(DMA_CYCLIC, tdma->dma_dev.cap_mask);
@@ -812,13 +812,13 @@ static int tegra_adma_probe(struct platform_device *pdev)
 
 dma_remove:
 	dma_async_device_unregister(&tdma->dma_dev);
-irq_dispose:
-	while (--i >= 0)
-		irq_dispose_mapping(tdma->channels[i].irq);
 rpm_put:
 	pm_runtime_put_sync(&pdev->dev);
 rpm_disable:
 	pm_runtime_disable(&pdev->dev);
+irq_dispose:
+	while (--i >= 0)
+		irq_dispose_mapping(tdma->channels[i].irq);
 
 	return ret;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 213/343] arm64: dts: meson: libretech-cc: set eMMC as removable
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (211 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 212/343] dmaengine: tegra210-adma: Fix crash during probe Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 214/343] RDMA/qedr: Fix incorrect device rate Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jerome Brunet, Martin Blumenstingl,
	Kevin Hilman, Sasha Levin

From: Jerome Brunet <jbrunet@baylibre.com>

[ Upstream commit 9f72e321d5506fe3e162a6308a4a295d7f10bb5d ]

The eMMC on this board is add-on module which is not mandatory. Removing
'non-removable' property should prevent some errors when booting a board
w/o an eMMC module present.

Fixes: 72fb2c852188 ("ARM64: dts: meson-gxl-s905x-libretech-cc: fixup board definition")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Reviewed-by: Martin Blumenstingl<martin.blumenstingl@googlemail.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
index e2c71753e3278..407d32f4fe734 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
@@ -226,7 +226,6 @@
 	cap-mmc-highspeed;
 	mmc-ddr-3_3v;
 	max-frequency = <50000000>;
-	non-removable;
 	disable-wp;
 
 	mmc-pwrseq = <&emmc_pwrseq>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 214/343] RDMA/qedr: Fix incorrect device rate.
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (212 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 213/343] arm64: dts: meson: libretech-cc: set eMMC as removable Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 215/343] spi: spi-fsl-spi: call spi_finalize_current_message() at the end Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sagiv Ozeri, Michal Kalderon,
	Jason Gunthorpe, Sasha Levin

From: Sagiv Ozeri <sagiv.ozeri@marvell.com>

[ Upstream commit 69054666df0a9b4e8331319f98b6b9a88bc3fcc4 ]

Use the correct enum value introduced in commit 12113a35ada6 ("IB/core:
Add HDR speed enum") Prior to this change a 50Gbps port would show 40Gbps.

This patch also cleaned up the redundant redefiniton of ib speeds for
qedr.

Fixes: 12113a35ada6 ("IB/core: Add HDR speed enum")
Signed-off-by: Sagiv Ozeri <sagiv.ozeri@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/qedr/verbs.c | 25 +++++++++----------------
 1 file changed, 9 insertions(+), 16 deletions(-)

diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 8bfe9073da78c..6ae72accae3db 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -178,54 +178,47 @@ int qedr_query_device(struct ib_device *ibdev,
 	return 0;
 }
 
-#define QEDR_SPEED_SDR		(1)
-#define QEDR_SPEED_DDR		(2)
-#define QEDR_SPEED_QDR		(4)
-#define QEDR_SPEED_FDR10	(8)
-#define QEDR_SPEED_FDR		(16)
-#define QEDR_SPEED_EDR		(32)
-
 static inline void get_link_speed_and_width(int speed, u8 *ib_speed,
 					    u8 *ib_width)
 {
 	switch (speed) {
 	case 1000:
-		*ib_speed = QEDR_SPEED_SDR;
+		*ib_speed = IB_SPEED_SDR;
 		*ib_width = IB_WIDTH_1X;
 		break;
 	case 10000:
-		*ib_speed = QEDR_SPEED_QDR;
+		*ib_speed = IB_SPEED_QDR;
 		*ib_width = IB_WIDTH_1X;
 		break;
 
 	case 20000:
-		*ib_speed = QEDR_SPEED_DDR;
+		*ib_speed = IB_SPEED_DDR;
 		*ib_width = IB_WIDTH_4X;
 		break;
 
 	case 25000:
-		*ib_speed = QEDR_SPEED_EDR;
+		*ib_speed = IB_SPEED_EDR;
 		*ib_width = IB_WIDTH_1X;
 		break;
 
 	case 40000:
-		*ib_speed = QEDR_SPEED_QDR;
+		*ib_speed = IB_SPEED_QDR;
 		*ib_width = IB_WIDTH_4X;
 		break;
 
 	case 50000:
-		*ib_speed = QEDR_SPEED_QDR;
-		*ib_width = IB_WIDTH_4X;
+		*ib_speed = IB_SPEED_HDR;
+		*ib_width = IB_WIDTH_1X;
 		break;
 
 	case 100000:
-		*ib_speed = QEDR_SPEED_EDR;
+		*ib_speed = IB_SPEED_EDR;
 		*ib_width = IB_WIDTH_4X;
 		break;
 
 	default:
 		/* Unsupported */
-		*ib_speed = QEDR_SPEED_SDR;
+		*ib_speed = IB_SPEED_SDR;
 		*ib_width = IB_WIDTH_1X;
 	}
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 215/343] spi: spi-fsl-spi: call spi_finalize_current_message() at the end
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (213 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 214/343] RDMA/qedr: Fix incorrect device rate Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 216/343] crypto: ccp - fix AES CFB error exposed by new test vectors Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Mark Brown, Sasha Levin

From: Christophe Leroy <christophe.leroy@c-s.fr>

[ Upstream commit 44a042182cb1e9f7916e015c836967bf638b33c4 ]

spi_finalize_current_message() shall be called once all
actions are finished, otherwise the last actions might
step over a newly started transfer.

Fixes: c592becbe704 ("spi: fsl-(e)spi: migrate to generic master queueing")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-fsl-spi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
index 8b79e36fab21c..cd784552de7f1 100644
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -407,7 +407,6 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
 	}
 
 	m->status = status;
-	spi_finalize_current_message(master);
 
 	if (status || !cs_change) {
 		ndelay(nsecs);
@@ -415,6 +414,7 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
 	}
 
 	fsl_spi_setup_transfer(spi, NULL);
+	spi_finalize_current_message(master);
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 216/343] crypto: ccp - fix AES CFB error exposed by new test vectors
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (214 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 215/343] spi: spi-fsl-spi: call spi_finalize_current_message() at the end Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 217/343] crypto: ccp - Fix 3DES complaint from ccp-crypto module Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gary R Hook, Herbert Xu, Sasha Levin

From: Hook, Gary <Gary.Hook@amd.com>

[ Upstream commit c3b359d6567c0b8f413e924feb37cf025067d55a ]

Updated testmgr will exhibit this error message when loading the
ccp-crypto module:

alg: skcipher: cfb-aes-ccp encryption failed with err -22 on test vector 3, cfg="in-place"

Update the CCP crypto driver to correctly treat CFB as a streaming mode
cipher (instead of block mode). Update the configuration for CFB to
specify the block size as a single byte;

Fixes: 2b789435d7f3 ('crypto: ccp - CCP AES crypto API support')

Signed-off-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ccp/ccp-crypto-aes.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/crypto/ccp/ccp-crypto-aes.c b/drivers/crypto/ccp/ccp-crypto-aes.c
index 89291c15015cd..3f768699332ba 100644
--- a/drivers/crypto/ccp/ccp-crypto-aes.c
+++ b/drivers/crypto/ccp/ccp-crypto-aes.c
@@ -1,7 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * AMD Cryptographic Coprocessor (CCP) AES crypto API support
  *
- * Copyright (C) 2013,2016 Advanced Micro Devices, Inc.
+ * Copyright (C) 2013-2019 Advanced Micro Devices, Inc.
  *
  * Author: Tom Lendacky <thomas.lendacky@amd.com>
  *
@@ -79,8 +80,7 @@ static int ccp_aes_crypt(struct ablkcipher_request *req, bool encrypt)
 		return -EINVAL;
 
 	if (((ctx->u.aes.mode == CCP_AES_MODE_ECB) ||
-	     (ctx->u.aes.mode == CCP_AES_MODE_CBC) ||
-	     (ctx->u.aes.mode == CCP_AES_MODE_CFB)) &&
+	     (ctx->u.aes.mode == CCP_AES_MODE_CBC)) &&
 	    (req->nbytes & (AES_BLOCK_SIZE - 1)))
 		return -EINVAL;
 
@@ -291,7 +291,7 @@ static struct ccp_aes_def aes_algs[] = {
 		.version	= CCP_VERSION(3, 0),
 		.name		= "cfb(aes)",
 		.driver_name	= "cfb-aes-ccp",
-		.blocksize	= AES_BLOCK_SIZE,
+		.blocksize	= 1,
 		.ivsize		= AES_BLOCK_SIZE,
 		.alg_defaults	= &ccp_aes_defaults,
 	},
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 217/343] crypto: ccp - Fix 3DES complaint from ccp-crypto module
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (215 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 216/343] crypto: ccp - fix AES CFB error exposed by new test vectors Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 218/343] serial: stm32: fix rx error handling Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gary R Hook, Herbert Xu, Sasha Levin

From: Hook, Gary <Gary.Hook@amd.com>

[ Upstream commit 89646fdda4cae203185444ac7988835f36a21ee1 ]

Crypto self-tests reveal an error:

alg: skcipher: cbc-des3-ccp encryption test failed (wrong output IV) on test vector 0, cfg="in-place"

The offset value should not be recomputed when retrieving the context.
Also, a code path exists which makes decisions based on older (version 3)
hardware; a v3 device deosn't support 3DES so remove this check.

Fixes: 990672d48515 ('crypto: ccp - Enable 3DES function on v5 CCPs')

Signed-off-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ccp/ccp-ops.c | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index 1e2e42106dee0..4b48b8523a40c 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -1293,6 +1293,9 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 	int ret;
 
 	/* Error checks */
+	if (cmd_q->ccp->vdata->version < CCP_VERSION(5, 0))
+		return -EINVAL;
+
 	if (!cmd_q->ccp->vdata->perform->des3)
 		return -EINVAL;
 
@@ -1375,8 +1378,6 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 	 * passthru option to convert from big endian to little endian.
 	 */
 	if (des3->mode != CCP_DES3_MODE_ECB) {
-		u32 load_mode;
-
 		op.sb_ctx = cmd_q->sb_ctx;
 
 		ret = ccp_init_dm_workarea(&ctx, cmd_q,
@@ -1392,12 +1393,8 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 		if (ret)
 			goto e_ctx;
 
-		if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
-			load_mode = CCP_PASSTHRU_BYTESWAP_NOOP;
-		else
-			load_mode = CCP_PASSTHRU_BYTESWAP_256BIT;
 		ret = ccp_copy_to_sb(cmd_q, &ctx, op.jobid, op.sb_ctx,
-				     load_mode);
+				     CCP_PASSTHRU_BYTESWAP_256BIT);
 		if (ret) {
 			cmd->engine_error = cmd_q->cmd_error;
 			goto e_ctx;
@@ -1459,10 +1456,6 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 		}
 
 		/* ...but we only need the last DES3_EDE_BLOCK_SIZE bytes */
-		if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
-			dm_offset = CCP_SB_BYTES - des3->iv_len;
-		else
-			dm_offset = 0;
 		ccp_get_dm_area(&ctx, dm_offset, des3->iv, 0,
 				DES3_EDE_BLOCK_SIZE);
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 218/343] serial: stm32: fix rx error handling
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (216 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 217/343] crypto: ccp - Fix 3DES complaint from ccp-crypto module Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 219/343] serial: stm32: fix transmit_chars when tx is stopped Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@st.com>

[ Upstream commit 4f01d833fdcdd6f9b85d9e5d5d7568eb683626a7 ]

- Fixes parity and framing error bit by clearing parity and framing error
  flag. The current implementation doesn't clear the error bits when an
  error is detected.
- Fixes the incorrect name of framing error clearing flag in header file.
- Fixes misalignement between data frame and errors status. The status
  read for "n" frame was the status of "n+1" frame".
- Fixes break detection was not triggered by the expected register.

Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 54 +++++++++++++++++++++-----------
 drivers/tty/serial/stm32-usart.h | 10 ++----
 2 files changed, 37 insertions(+), 27 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 03a583264d9ec..c435900773723 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -118,35 +118,51 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded)
 
 	while (stm32_pending_rx(port, &sr, &stm32_port->last_res, threaded)) {
 		sr |= USART_SR_DUMMY_RX;
-		c = stm32_get_char(port, &sr, &stm32_port->last_res);
 		flag = TTY_NORMAL;
-		port->icount.rx++;
 
+		/*
+		 * Status bits has to be cleared before reading the RDR:
+		 * In FIFO mode, reading the RDR will pop the next data
+		 * (if any) along with its status bits into the SR.
+		 * Not doing so leads to misalignement between RDR and SR,
+		 * and clear status bits of the next rx data.
+		 *
+		 * Clear errors flags for stm32f7 and stm32h7 compatible
+		 * devices. On stm32f4 compatible devices, the error bit is
+		 * cleared by the sequence [read SR - read DR].
+		 */
+		if ((sr & USART_SR_ERR_MASK) && ofs->icr != UNDEF_REG)
+			stm32_clr_bits(port, ofs->icr, USART_ICR_ORECF |
+				       USART_ICR_PECF | USART_ICR_FECF);
+
+		c = stm32_get_char(port, &sr, &stm32_port->last_res);
+		port->icount.rx++;
 		if (sr & USART_SR_ERR_MASK) {
-			if (sr & USART_SR_LBD) {
-				port->icount.brk++;
-				if (uart_handle_break(port))
-					continue;
-			} else if (sr & USART_SR_ORE) {
-				if (ofs->icr != UNDEF_REG)
-					writel_relaxed(USART_ICR_ORECF,
-						       port->membase +
-						       ofs->icr);
+			if (sr & USART_SR_ORE) {
 				port->icount.overrun++;
 			} else if (sr & USART_SR_PE) {
 				port->icount.parity++;
 			} else if (sr & USART_SR_FE) {
-				port->icount.frame++;
+				/* Break detection if character is null */
+				if (!c) {
+					port->icount.brk++;
+					if (uart_handle_break(port))
+						continue;
+				} else {
+					port->icount.frame++;
+				}
 			}
 
 			sr &= port->read_status_mask;
 
-			if (sr & USART_SR_LBD)
-				flag = TTY_BREAK;
-			else if (sr & USART_SR_PE)
+			if (sr & USART_SR_PE) {
 				flag = TTY_PARITY;
-			else if (sr & USART_SR_FE)
-				flag = TTY_FRAME;
+			} else if (sr & USART_SR_FE) {
+				if (!c)
+					flag = TTY_BREAK;
+				else
+					flag = TTY_FRAME;
+			}
 		}
 
 		if (uart_handle_sysrq_char(port, c))
@@ -569,14 +585,14 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
 	if (termios->c_iflag & INPCK)
 		port->read_status_mask |= USART_SR_PE | USART_SR_FE;
 	if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
-		port->read_status_mask |= USART_SR_LBD;
+		port->read_status_mask |= USART_SR_FE;
 
 	/* Characters to ignore */
 	port->ignore_status_mask = 0;
 	if (termios->c_iflag & IGNPAR)
 		port->ignore_status_mask = USART_SR_PE | USART_SR_FE;
 	if (termios->c_iflag & IGNBRK) {
-		port->ignore_status_mask |= USART_SR_LBD;
+		port->ignore_status_mask |= USART_SR_FE;
 		/*
 		 * If we're ignoring parity and break indicators,
 		 * ignore overruns too (for real raw support).
diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
index ffc0c5285e511..9d087881913aa 100644
--- a/drivers/tty/serial/stm32-usart.h
+++ b/drivers/tty/serial/stm32-usart.h
@@ -108,7 +108,6 @@ struct stm32_usart_info stm32h7_info = {
 #define USART_SR_RXNE		BIT(5)
 #define USART_SR_TC		BIT(6)
 #define USART_SR_TXE		BIT(7)
-#define USART_SR_LBD		BIT(8)
 #define USART_SR_CTSIF		BIT(9)
 #define USART_SR_CTS		BIT(10)		/* F7 */
 #define USART_SR_RTOF		BIT(11)		/* F7 */
@@ -120,8 +119,7 @@ struct stm32_usart_info stm32h7_info = {
 #define USART_SR_SBKF		BIT(18)		/* F7 */
 #define USART_SR_WUF		BIT(20)		/* H7 */
 #define USART_SR_TEACK		BIT(21)		/* F7 */
-#define USART_SR_ERR_MASK	(USART_SR_LBD | USART_SR_ORE | \
-				 USART_SR_FE | USART_SR_PE)
+#define USART_SR_ERR_MASK	(USART_SR_ORE | USART_SR_FE | USART_SR_PE)
 /* Dummy bits */
 #define USART_SR_DUMMY_RX	BIT(16)
 
@@ -166,8 +164,6 @@ struct stm32_usart_info stm32h7_info = {
 /* USART_CR2 */
 #define USART_CR2_ADD_MASK	GENMASK(3, 0)	/* F4 */
 #define USART_CR2_ADDM7		BIT(4)		/* F7 */
-#define USART_CR2_LBDL		BIT(5)
-#define USART_CR2_LBDIE		BIT(6)
 #define USART_CR2_LBCL		BIT(8)
 #define USART_CR2_CPHA		BIT(9)
 #define USART_CR2_CPOL		BIT(10)
@@ -224,12 +220,10 @@ struct stm32_usart_info stm32h7_info = {
 
 /* USART_ICR */
 #define USART_ICR_PECF		BIT(0)		/* F7 */
-#define USART_ICR_FFECF		BIT(1)		/* F7 */
-#define USART_ICR_NCF		BIT(2)		/* F7 */
+#define USART_ICR_FECF		BIT(1)		/* F7 */
 #define USART_ICR_ORECF		BIT(3)		/* F7 */
 #define USART_ICR_IDLECF	BIT(4)		/* F7 */
 #define USART_ICR_TCCF		BIT(6)		/* F7 */
-#define USART_ICR_LBDCF		BIT(8)		/* F7 */
 #define USART_ICR_CTSCF		BIT(9)		/* F7 */
 #define USART_ICR_RTOCF		BIT(11)		/* F7 */
 #define USART_ICR_EOBCF		BIT(12)		/* F7 */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 219/343] serial: stm32: fix transmit_chars when tx is stopped
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (217 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 218/343] serial: stm32: fix rx error handling Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 220/343] serial: stm32: Add support of TC bit status check Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@st.com>

[ Upstream commit b83b957c91f68e53f0dc596e129e8305761f2a32 ]

Disables the tx irq  when the transmission is ended and updates stop_tx
conditions for code cleanup.

Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index c435900773723..a1e31913bcf9a 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -310,13 +310,8 @@ static void stm32_transmit_chars(struct uart_port *port)
 		return;
 	}
 
-	if (uart_tx_stopped(port)) {
-		stm32_stop_tx(port);
-		return;
-	}
-
-	if (uart_circ_empty(xmit)) {
-		stm32_stop_tx(port);
+	if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
+		stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
 		return;
 	}
 
@@ -329,7 +324,7 @@ static void stm32_transmit_chars(struct uart_port *port)
 		uart_write_wakeup(port);
 
 	if (uart_circ_empty(xmit))
-		stm32_stop_tx(port);
+		stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
 }
 
 static irqreturn_t stm32_interrupt(int irq, void *ptr)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 220/343] serial: stm32: Add support of TC bit status check
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (218 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 219/343] serial: stm32: fix transmit_chars when tx is stopped Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 221/343] serial: stm32: fix wakeup source initialization Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@st.com>

[ Upstream commit 64c32eab660386f9904bb295a104c9c425e9f8b2 ]

Adds a check on the Transmission Complete bit status before closing the
com port. Prevents the port closure before the end of the transmission.
TC poll loop is moved from stm32_tx_dma_complete to stm32_shutdown
routine, in order to check TC before shutdown in both dma and
PIO tx modes.
TC clear is added in stm32_transmit_char routine, in order to be cleared
before transmitting in both dma and PIO tx modes.

Fixes: 3489187204eb ("serial: stm32: adding dma support")
Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 32 +++++++++++++++-----------------
 1 file changed, 15 insertions(+), 17 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index a1e31913bcf9a..2384f786b76d1 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -180,21 +180,6 @@ static void stm32_tx_dma_complete(void *arg)
 	struct uart_port *port = arg;
 	struct stm32_port *stm32port = to_stm32_port(port);
 	struct stm32_usart_offsets *ofs = &stm32port->info->ofs;
-	unsigned int isr;
-	int ret;
-
-	ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr,
-						isr,
-						(isr & USART_SR_TC),
-						10, 100000);
-
-	if (ret)
-		dev_err(port->dev, "terminal count not set\n");
-
-	if (ofs->icr == UNDEF_REG)
-		stm32_clr_bits(port, ofs->isr, USART_SR_TC);
-	else
-		stm32_set_bits(port, ofs->icr, USART_CR_TC);
 
 	stm32_clr_bits(port, ofs->cr3, USART_CR3_DMAT);
 	stm32port->tx_dma_busy = false;
@@ -286,7 +271,6 @@ static void stm32_transmit_chars_dma(struct uart_port *port)
 	/* Issue pending DMA TX requests */
 	dma_async_issue_pending(stm32port->tx_ch);
 
-	stm32_clr_bits(port, ofs->isr, USART_SR_TC);
 	stm32_set_bits(port, ofs->cr3, USART_CR3_DMAT);
 
 	xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1);
@@ -315,6 +299,11 @@ static void stm32_transmit_chars(struct uart_port *port)
 		return;
 	}
 
+	if (ofs->icr == UNDEF_REG)
+		stm32_clr_bits(port, ofs->isr, USART_SR_TC);
+	else
+		stm32_set_bits(port, ofs->icr, USART_ICR_TCCF);
+
 	if (stm32_port->tx_ch)
 		stm32_transmit_chars_dma(port);
 	else
@@ -491,12 +480,21 @@ static void stm32_shutdown(struct uart_port *port)
 	struct stm32_port *stm32_port = to_stm32_port(port);
 	struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
 	struct stm32_usart_config *cfg = &stm32_port->info->cfg;
-	u32 val;
+	u32 val, isr;
+	int ret;
 
 	val = USART_CR1_TXEIE | USART_CR1_RXNEIE | USART_CR1_TE | USART_CR1_RE;
 	val |= BIT(cfg->uart_enable_bit);
 	if (stm32_port->fifoen)
 		val |= USART_CR1_FIFOEN;
+
+	ret = readl_relaxed_poll_timeout(port->membase + ofs->isr,
+					 isr, (isr & USART_SR_TC),
+					 10, 100000);
+
+	if (ret)
+		dev_err(port->dev, "transmission complete not set\n");
+
 	stm32_clr_bits(port, ofs->cr1, val);
 
 	dev_pm_clear_wake_irq(port->dev);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 221/343] serial: stm32: fix wakeup source initialization
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (219 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 220/343] serial: stm32: Add support of TC bit status check Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 222/343] misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@st.com>

[ Upstream commit 5297f274e8b61ceb9676cba6649d3de9d03387ad ]

Fixes dedicated_irq_wakeup issue and deactivated uart as wakeup source by
default.

Fixes: 270e5a74fe4c ("serial: stm32: add wakeup mechanism")
Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 2384f786b76d1..f8f3f8fafd9f0 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -447,7 +447,6 @@ static int stm32_startup(struct uart_port *port)
 {
 	struct stm32_port *stm32_port = to_stm32_port(port);
 	struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
-	struct stm32_usart_config *cfg = &stm32_port->info->cfg;
 	const char *name = to_platform_device(port->dev)->name;
 	u32 val;
 	int ret;
@@ -458,15 +457,6 @@ static int stm32_startup(struct uart_port *port)
 	if (ret)
 		return ret;
 
-	if (cfg->has_wakeup && stm32_port->wakeirq >= 0) {
-		ret = dev_pm_set_dedicated_wake_irq(port->dev,
-						    stm32_port->wakeirq);
-		if (ret) {
-			free_irq(port->irq, port);
-			return ret;
-		}
-	}
-
 	val = USART_CR1_RXNEIE | USART_CR1_TE | USART_CR1_RE;
 	if (stm32_port->fifoen)
 		val |= USART_CR1_FIFOEN;
@@ -497,7 +487,6 @@ static void stm32_shutdown(struct uart_port *port)
 
 	stm32_clr_bits(port, ofs->cr1, val);
 
-	dev_pm_clear_wake_irq(port->dev);
 	free_irq(port->irq, port);
 }
 
@@ -904,11 +893,18 @@ static int stm32_serial_probe(struct platform_device *pdev)
 		ret = device_init_wakeup(&pdev->dev, true);
 		if (ret)
 			goto err_uninit;
+
+		ret = dev_pm_set_dedicated_wake_irq(&pdev->dev,
+						    stm32port->wakeirq);
+		if (ret)
+			goto err_nowup;
+
+		device_set_wakeup_enable(&pdev->dev, false);
 	}
 
 	ret = uart_add_one_port(&stm32_usart_driver, &stm32port->port);
 	if (ret)
-		goto err_nowup;
+		goto err_wirq;
 
 	ret = stm32_of_dma_rx_probe(stm32port, pdev);
 	if (ret)
@@ -922,6 +918,10 @@ static int stm32_serial_probe(struct platform_device *pdev)
 
 	return 0;
 
+err_wirq:
+	if (stm32port->info->cfg.has_wakeup && stm32port->wakeirq >= 0)
+		dev_pm_clear_wake_irq(&pdev->dev);
+
 err_nowup:
 	if (stm32port->info->cfg.has_wakeup && stm32port->wakeirq >= 0)
 		device_init_wakeup(&pdev->dev, false);
@@ -959,8 +959,10 @@ static int stm32_serial_remove(struct platform_device *pdev)
 				  TX_BUF_L, stm32_port->tx_buf,
 				  stm32_port->tx_dma_buf);
 
-	if (cfg->has_wakeup && stm32_port->wakeirq >= 0)
+	if (cfg->has_wakeup && stm32_port->wakeirq >= 0) {
+		dev_pm_clear_wake_irq(&pdev->dev);
 		device_init_wakeup(&pdev->dev, false);
+	}
 
 	clk_disable_unprepare(stm32_port->clk);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 352+ messages in thread

* [PATCH 4.14 222/343] misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa
  2020-01-24  9:26 [PATCH 4.14 000/343] 4.14.168-stable review Greg Kroah-Hartman
                   ` (220 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.14 221/343] serial: stm32: fix wakeup source initialization Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.14 223/343] PCI: PM: Avoid possible suspend-to-idle issue Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  347 siblings, 0 replies; 352+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Hines, Arnd Bergmann,
	Nick Desaulniers, Nathan Chancellor, Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit b0576f9ecb5c51e9932531d23c447b2739261841 ]

Clang warns:

drivers/mis