--- /dev/null
+From 1e782b29e8e6c7d15b87c32209c9a59824198a5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Oct 2022 16:32:53 +0000
+Subject: ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+[ Upstream commit 43d2748394c3feb86c0c771466f5847e274fc043 ]
+
+Change num_ghes from int to unsigned int, preventing an overflow
+and causing subsequent vmalloc() to fail.
+
+The overflow happens in ghes_estatus_pool_init() when calculating
+len during execution of the statement below as both multiplication
+operands here are signed int:
+
+len += (num_ghes * GHES_ESOURCE_PREALLOC_MAX_SIZE);
+
+The following call trace is observed because of this bug:
+
+[ 9.317108] swapper/0: vmalloc error: size 18446744071562596352, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1
+[ 9.317131] Call Trace:
+[ 9.317134] <TASK>
+[ 9.317137] dump_stack_lvl+0x49/0x5f
+[ 9.317145] dump_stack+0x10/0x12
+[ 9.317146] warn_alloc.cold+0x7b/0xdf
+[ 9.317150] ? __device_attach+0x16a/0x1b0
+[ 9.317155] __vmalloc_node_range+0x702/0x740
+[ 9.317160] ? device_add+0x17f/0x920
+[ 9.317164] ? dev_set_name+0x53/0x70
+[ 9.317166] ? platform_device_add+0xf9/0x240
+[ 9.317168] __vmalloc_node+0x49/0x50
+[ 9.317170] ? ghes_estatus_pool_init+0x43/0xa0
+[ 9.317176] vmalloc+0x21/0x30
+[ 9.317177] ghes_estatus_pool_init+0x43/0xa0
+[ 9.317179] acpi_hest_init+0x129/0x19c
+[ 9.317185] acpi_init+0x434/0x4a4
+[ 9.317188] ? acpi_sleep_proc_init+0x2a/0x2a
+[ 9.317190] do_one_initcall+0x48/0x200
+[ 9.317195] kernel_init_freeable+0x221/0x284
+[ 9.317200] ? rest_init+0xe0/0xe0
+[ 9.317204] kernel_init+0x1a/0x130
+[ 9.317205] ret_from_fork+0x22/0x30
+[ 9.317208] </TASK>
+
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 2 +-
+ include/acpi/ghes.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 5206fd3b7867..9bdb5bd5fda6 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -163,7 +163,7 @@ static void ghes_unmap(void __iomem *vaddr, enum fixed_addresses fixmap_idx)
+ clear_fixmap(fixmap_idx);
+ }
+
+-int ghes_estatus_pool_init(int num_ghes)
++int ghes_estatus_pool_init(unsigned int num_ghes)
+ {
+ unsigned long addr, len;
+ int rc;
+diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h
+index 34fb3431a8f3..292a5c40bd0c 100644
+--- a/include/acpi/ghes.h
++++ b/include/acpi/ghes.h
+@@ -71,7 +71,7 @@ int ghes_register_vendor_record_notifier(struct notifier_block *nb);
+ void ghes_unregister_vendor_record_notifier(struct notifier_block *nb);
+ #endif
+
+-int ghes_estatus_pool_init(int num_ghes);
++int ghes_estatus_pool_init(unsigned int num_ghes);
+
+ /* From drivers/edac/ghes_edac.c */
+
+--
+2.35.1
+
--- /dev/null
+From f007f7e261b5417d9fc6f1b56299704d88d7bd75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Sep 2022 12:52:22 -0700
+Subject: ARM: dts: imx6qdl-gw59{10,13}: fix user pushbutton GPIO offset
+
+From: Tim Harvey <tharvey@gateworks.com>
+
+[ Upstream commit bb5ad73941dc3f4e3c2241348f385da6501d50ea ]
+
+The GW5910 and GW5913 have a user pushbutton that is tied to the
+Gateworks System Controller GPIO offset 2. Fix the invalid offset of 0.
+
+Fixes: 64bf0a0af18d ("ARM: dts: imx6qdl-gw: add Gateworks System Controller support")
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-gw5910.dtsi | 2 +-
+ arch/arm/boot/dts/imx6qdl-gw5913.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-gw5910.dtsi b/arch/arm/boot/dts/imx6qdl-gw5910.dtsi
+index ed4e22259959..852601d5ab6b 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw5910.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw5910.dtsi
+@@ -31,7 +31,7 @@ gpio-keys {
+
+ user-pb {
+ label = "user_pb";
+- gpios = <&gsc_gpio 0 GPIO_ACTIVE_LOW>;
++ gpios = <&gsc_gpio 2 GPIO_ACTIVE_LOW>;
+ linux,code = <BTN_0>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6qdl-gw5913.dtsi b/arch/arm/boot/dts/imx6qdl-gw5913.dtsi
+index 4cd7d290f5b2..7a2628fdd142 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw5913.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw5913.dtsi
+@@ -28,7 +28,7 @@ gpio-keys {
+
+ user-pb {
+ label = "user_pb";
+- gpios = <&gsc_gpio 0 GPIO_ACTIVE_LOW>;
++ gpios = <&gsc_gpio 2 GPIO_ACTIVE_LOW>;
+ linux,code = <BTN_0>;
+ };
+
+--
+2.35.1
+
--- /dev/null
+From 5f9ae7caddf90dae190bdf6faff6305939413917 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Oct 2022 15:08:33 +0100
+Subject: arm64: dts: juno: Add thermal critical trip points
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit c4a7b9b587ca1bb4678d48d8be7132492b23a81c ]
+
+When thermnal zones are defined, trip points definitions are mandatory.
+Define a couple of critical trip points for monitoring of existing
+PMIC and SOC thermal zones.
+
+This was lost between txt to yaml conversion and was re-enforced recently
+via the commit 8c596324232d ("dt-bindings: thermal: Fix missing required property")
+
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Krzysztof Kozlowski <krzysztof.kozlowski+dt@linaro.org>
+Cc: devicetree@vger.kernel.org
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Fixes: f7b636a8d83c ("arm64: dts: juno: add thermal zones for scpi sensors")
+Link: https://lore.kernel.org/r/20221028140833.280091-8-cristian.marussi@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/arm/juno-base.dtsi | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/arm/juno-base.dtsi b/arch/arm64/boot/dts/arm/juno-base.dtsi
+index 2c0161125ece..cb45a2f0537a 100644
+--- a/arch/arm64/boot/dts/arm/juno-base.dtsi
++++ b/arch/arm64/boot/dts/arm/juno-base.dtsi
+@@ -595,12 +595,26 @@ pmic {
+ polling-delay = <1000>;
+ polling-delay-passive = <100>;
+ thermal-sensors = <&scpi_sensors0 0>;
++ trips {
++ pmic_crit0: trip0 {
++ temperature = <90000>;
++ hysteresis = <2000>;
++ type = "critical";
++ };
++ };
+ };
+
+ soc {
+ polling-delay = <1000>;
+ polling-delay-passive = <100>;
+ thermal-sensors = <&scpi_sensors0 3>;
++ trips {
++ soc_crit0: trip0 {
++ temperature = <80000>;
++ hysteresis = <2000>;
++ type = "critical";
++ };
++ };
+ };
+
+ big_cluster_thermal_zone: big-cluster {
+--
+2.35.1
+
--- /dev/null
+From 0319b99ce2c4ad8c04f8f36edf800e55c3f40952 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Oct 2022 17:41:15 +0300
+Subject: arm64: dts: lx2160a: specify clock frequencies for the MDIO
+ controllers
+
+From: Ioana Ciornei <ioana.ciornei@nxp.com>
+
+[ Upstream commit c126a0abc5dadd7df236f20aae6d8c3d103f095c ]
+
+Up until now, the external MDIO controller frequency values relied
+either on the default ones out of reset or on those setup by u-boot.
+Let's just properly specify the MDC frequency in the DTS so that even
+without u-boot's intervention Linux can drive the MDIO bus.
+
+Fixes: 6e1b8fae892d ("arm64: dts: lx2160a: add emdio1 node")
+Fixes: 5705b9dcda57 ("arm64: dts: lx2160a: add emdio2 node")
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi b/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi
+index 83072da6f6c6..8115cdcb4574 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi
+@@ -1292,6 +1292,9 @@ emdio1: mdio@8b96000 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ little-endian;
++ clock-frequency = <2500000>;
++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL
++ QORIQ_CLK_PLL_DIV(2)>;
+ status = "disabled";
+ };
+
+@@ -1302,6 +1305,9 @@ emdio2: mdio@8b97000 {
+ little-endian;
+ #address-cells = <1>;
+ #size-cells = <0>;
++ clock-frequency = <2500000>;
++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL
++ QORIQ_CLK_PLL_DIV(2)>;
+ status = "disabled";
+ };
+
+--
+2.35.1
+
--- /dev/null
+From f3c7a52e9ac5033c18268e6f79a953ddd5223cd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Oct 2022 15:39:44 +0200
+Subject: drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in
+ SRIOV case
+
+From: Danijel Slivka <danijel.slivka@amd.com>
+
+[ Upstream commit 65f8682b9aaae20c2cdee993e6fe52374ad513c9 ]
+
+For asic with VF MMIO access protection avoid using CPU for VM table updates.
+CPU pagetable updates have issues with HDP flush as VF MMIO access protection
+blocks write to mmBIF_BX_DEV0_EPF0_VF0_HDP_MEM_COHERENCY_FLUSH_CNTL register
+during sriov runtime.
+
+v3: introduce virtualization capability flag AMDGPU_VF_MMIO_ACCESS_PROTECT
+which indicates that VF MMIO write access is not allowed in sriov runtime
+
+Signed-off-by: Danijel Slivka <danijel.slivka@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 6 ++++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 4 ++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +++++-
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+index 16bfb36c27e4..d6f295103595 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+@@ -670,6 +670,12 @@ void amdgpu_detect_virtualization(struct amdgpu_device *adev)
+ adev->virt.caps |= AMDGPU_PASSTHROUGH_MODE;
+ }
+
++ if (amdgpu_sriov_vf(adev) && adev->asic_type == CHIP_SIENNA_CICHLID)
++ /* VF MMIO access (except mailbox range) from CPU
++ * will be blocked during sriov runtime
++ */
++ adev->virt.caps |= AMDGPU_VF_MMIO_ACCESS_PROTECT;
++
+ /* we have the ability to check now */
+ if (amdgpu_sriov_vf(adev)) {
+ switch (adev->asic_type) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
+index 77b9d37bfa1b..aea49bad914f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
+@@ -31,6 +31,7 @@
+ #define AMDGPU_SRIOV_CAPS_IS_VF (1 << 2) /* this GPU is a virtual function */
+ #define AMDGPU_PASSTHROUGH_MODE (1 << 3) /* thw whole GPU is pass through for VM */
+ #define AMDGPU_SRIOV_CAPS_RUNTIME (1 << 4) /* is out of full access mode */
++#define AMDGPU_VF_MMIO_ACCESS_PROTECT (1 << 5) /* MMIO write access is not allowed in sriov runtime */
+
+ /* all asic after AI use this offset */
+ #define mmRCC_IOV_FUNC_IDENTIFIER 0xDE5
+@@ -241,6 +242,9 @@ struct amdgpu_virt {
+ #define amdgpu_passthrough(adev) \
+ ((adev)->virt.caps & AMDGPU_PASSTHROUGH_MODE)
+
++#define amdgpu_sriov_vf_mmio_access_protection(adev) \
++((adev)->virt.caps & AMDGPU_VF_MMIO_ACCESS_PROTECT)
++
+ static inline bool is_virtual_machine(void)
+ {
+ #ifdef CONFIG_X86
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+index 635601d8b131..45b1f00c5968 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -3200,7 +3200,11 @@ void amdgpu_vm_manager_init(struct amdgpu_device *adev)
+ */
+ #ifdef CONFIG_X86_64
+ if (amdgpu_vm_update_mode == -1) {
+- if (amdgpu_gmc_vram_full_visible(&adev->gmc))
++ /* For asic with VF MMIO access protection
++ * avoid using CPU for VM table updates
++ */
++ if (amdgpu_gmc_vram_full_visible(&adev->gmc) &&
++ !amdgpu_sriov_vf_mmio_access_protection(adev))
+ adev->vm_manager.vm_update_mode =
+ AMDGPU_VM_USE_CPU_FOR_COMPUTE;
+ else
+--
+2.35.1
+
--- /dev/null
+From 496e09fc2437a7273fb6c821374f30cb67f4d435 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Oct 2022 08:23:52 -0700
+Subject: efi/tpm: Pass correct address to memblock_reserve
+
+From: Jerry Snitselaar <jsnitsel@redhat.com>
+
+[ Upstream commit f4cd18c5b2000df0c382f6530eeca9141ea41faf ]
+
+memblock_reserve() expects a physical address, but the address being
+passed for the TPM final events log is what was returned from
+early_memremap(). This results in something like the following:
+
+[ 0.000000] memblock_reserve: [0xffffffffff2c0000-0xffffffffff2c00e4] efi_tpm_eventlog_init+0x324/0x370
+
+Pass the address from efi like what is done for the TPM events log.
+
+Fixes: c46f3405692d ("tpm: Reserve the TPM final events table")
+Cc: Matthew Garrett <mjg59@google.com>
+Cc: Jarkko Sakkinen <jarkko@kernel.org>
+Cc: Bartosz Szczepanek <bsz@semihalf.com>
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/tpm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
+index 8f665678e9e3..e8d69bd548f3 100644
+--- a/drivers/firmware/efi/tpm.c
++++ b/drivers/firmware/efi/tpm.c
+@@ -97,7 +97,7 @@ int __init efi_tpm_eventlog_init(void)
+ goto out_calc;
+ }
+
+- memblock_reserve((unsigned long)final_tbl,
++ memblock_reserve(efi.tpm_final_log,
+ tbl_size + sizeof(*final_tbl));
+ efi_tpm_final_log_size = tbl_size;
+
+--
+2.35.1
+
--- /dev/null
+From c27b2be7804d237042c4ad2282b597e8ca9e2a57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Oct 2022 15:08:29 +0100
+Subject: firmware: arm_scmi: Make Rx chan_setup fail on memory errors
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit be9ba1f7f9e0b565b19f4294f5871da9d654bc6d ]
+
+SCMI Rx channels are optional and they can fail to be setup when not
+present but anyway channels setup routines must bail-out on memory errors.
+
+Make channels setup, and related probing, fail when memory errors are
+reported on Rx channels.
+
+Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Link: https://lore.kernel.org/r/20221028140833.280091-4-cristian.marussi@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/driver.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
+index 4bc974ead02b..8d24082848a8 100644
+--- a/drivers/firmware/arm_scmi/driver.c
++++ b/drivers/firmware/arm_scmi/driver.c
+@@ -711,8 +711,12 @@ scmi_txrx_setup(struct scmi_info *info, struct device *dev, int prot_id)
+ {
+ int ret = scmi_chan_setup(info, dev, prot_id, true);
+
+- if (!ret) /* Rx is optional, hence no error check */
+- scmi_chan_setup(info, dev, prot_id, false);
++ if (!ret) {
++ /* Rx is optional, report only memory errors */
++ ret = scmi_chan_setup(info, dev, prot_id, false);
++ if (ret && ret != -ENOMEM)
++ ret = 0;
++ }
+
+ return ret;
+ }
+--
+2.35.1
+
--- /dev/null
+From b5f9577b20fe735c24c5a1e1f7b2e8c8c64ea70f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Oct 2022 15:08:27 +0100
+Subject: firmware: arm_scmi: Suppress the driver's bind attributes
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit fd96fbc8fad35d6b1872c90df8a2f5d721f14d91 ]
+
+Suppress the capability to unbind the core SCMI driver since all the
+SCMI stack protocol drivers depend on it.
+
+Fixes: aa4f886f3893 ("firmware: arm_scmi: add basic driver infrastructure for SCMI")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Link: https://lore.kernel.org/r/20221028140833.280091-2-cristian.marussi@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/driver.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
+index 745b7f9eb335..4bc974ead02b 100644
+--- a/drivers/firmware/arm_scmi/driver.c
++++ b/drivers/firmware/arm_scmi/driver.c
+@@ -942,6 +942,7 @@ MODULE_DEVICE_TABLE(of, scmi_of_match);
+ static struct platform_driver scmi_driver = {
+ .driver = {
+ .name = "arm-scmi",
++ .suppress_bind_attrs = true,
+ .of_match_table = scmi_of_match,
+ .dev_groups = versions_groups,
+ },
+--
+2.35.1
+
--- /dev/null
+From 5c37acb059c2a9fc72d67c1a1fa3b1c142aee9fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Oct 2022 19:51:23 +0100
+Subject: HID: saitek: add madcatz variant of MMO7 mouse device ID
+
+From: Samuel Bailey <samuel.bailey1@gmail.com>
+
+[ Upstream commit 79425b297f56bd481c6e97700a9a4e44c7bcfa35 ]
+
+The MadCatz variant of the MMO7 mouse has the ID 0738:1713 and the same
+quirks as the Saitek variant.
+
+Signed-off-by: Samuel Bailey <samuel.bailey1@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-quirks.c | 1 +
+ drivers/hid/hid-saitek.c | 2 ++
+ 3 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index bb096dfb7b36..3350a41d7dce 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -827,6 +827,7 @@
+ #define USB_DEVICE_ID_MADCATZ_BEATPAD 0x4540
+ #define USB_DEVICE_ID_MADCATZ_RAT5 0x1705
+ #define USB_DEVICE_ID_MADCATZ_RAT9 0x1709
++#define USB_DEVICE_ID_MADCATZ_MMO7 0x1713
+
+ #define USB_VENDOR_ID_MCC 0x09db
+ #define USB_DEVICE_ID_MCC_PMD1024LS 0x0076
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 2ab71d717bb0..4a8014e9a511 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -609,6 +609,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT5) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_MMO7) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_SAMSUNG)
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) },
+diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c
+index c7bf14c01960..b84e975977c4 100644
+--- a/drivers/hid/hid-saitek.c
++++ b/drivers/hid/hid-saitek.c
+@@ -187,6 +187,8 @@ static const struct hid_device_id saitek_devices[] = {
+ .driver_data = SAITEK_RELEASE_MODE_RAT7 },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7),
+ .driver_data = SAITEK_RELEASE_MODE_MMO7 },
++ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_MMO7),
++ .driver_data = SAITEK_RELEASE_MODE_MMO7 },
+ { }
+ };
+
+--
+2.35.1
+
--- /dev/null
+From 2eb32f247077fb7a4f3bddbb25d9fe3bac09d390 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 20:13:53 +0800
+Subject: i2c: piix4: Fix adapter not be removed in piix4_remove()
+
+From: Chen Zhongjin <chenzhongjin@huawei.com>
+
+[ Upstream commit 569bea74c94d37785682b11bab76f557520477cd ]
+
+In piix4_probe(), the piix4 adapter will be registered in:
+
+ piix4_probe()
+ piix4_add_adapters_sb800() / piix4_add_adapter()
+ i2c_add_adapter()
+
+Based on the probed device type, piix4_add_adapters_sb800() or single
+piix4_add_adapter() will be called.
+For the former case, piix4_adapter_count is set as the number of adapters,
+while for antoher case it is not set and kept default *zero*.
+
+When piix4 is removed, piix4_remove() removes the adapters added in
+piix4_probe(), basing on the piix4_adapter_count value.
+Because the count is zero for the single adapter case, the adapter won't
+be removed and makes the sources allocated for adapter leaked, such as
+the i2c client and device.
+
+These sources can still be accessed by i2c or bus and cause problems.
+An easily reproduced case is that if a new adapter is registered, i2c
+will get the leaked adapter and try to call smbus_algorithm, which was
+already freed:
+
+Triggered by: rmmod i2c_piix4 && modprobe max31730
+
+ BUG: unable to handle page fault for address: ffffffffc053d860
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ Oops: 0000 [#1] PREEMPT SMP KASAN
+ CPU: 0 PID: 3752 Comm: modprobe Tainted: G
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
+ RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core
+ RSP: 0018:ffff888107477710 EFLAGS: 00000246
+ ...
+ <TASK>
+ i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core
+ __process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core
+ bus_for_each_dev (drivers/base/bus.c:301)
+ i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core
+ i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core
+ do_one_initcall (init/main.c:1296)
+ do_init_module (kernel/module/main.c:2455)
+ ...
+ </TASK>
+ ---[ end trace 0000000000000000 ]---
+
+Fix this problem by correctly set piix4_adapter_count as 1 for the
+single adapter so it can be normally removed.
+
+Fixes: 528d53a1592b ("i2c: piix4: Fix probing of reserved ports on AMD Family 16h Model 30h")
+Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-piix4.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
+index 8c1b31ed0c42..aa1d3657ab4e 100644
+--- a/drivers/i2c/busses/i2c-piix4.c
++++ b/drivers/i2c/busses/i2c-piix4.c
+@@ -961,6 +961,7 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ "", &piix4_main_adapters[0]);
+ if (retval < 0)
+ return retval;
++ piix4_adapter_count = 1;
+ }
+
+ /* Check for auxiliary SMBus on some AMD chipsets */
+--
+2.35.1
+
--- /dev/null
+From 36fa18e51d80695a8e039c12ca9473655318580d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 16:03:37 +0200
+Subject: i2c: xiic: Add platform module alias
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Tůma <martin.tuma@digiteqautomotive.com>
+
+[ Upstream commit b8caf0a0e04583fb71e21495bef84509182227ea ]
+
+The missing "platform" alias is required for the mgb4 v4l2 driver to load
+the i2c controller driver when probing the HW.
+
+Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 8dabb6ffb1a4..3b564e68130b 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -935,6 +935,7 @@ static struct platform_driver xiic_i2c_driver = {
+
+ module_platform_driver(xiic_i2c_driver);
+
++MODULE_ALIAS("platform:" DRIVER_NAME);
+ MODULE_AUTHOR("info@mocean-labs.com");
+ MODULE_DESCRIPTION("Xilinx I2C bus driver");
+ MODULE_LICENSE("GPL v2");
+--
+2.35.1
+
--- /dev/null
+From 6ed79248497fd2585712d169a360997ece5b94bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Aug 2022 20:29:06 +0200
+Subject: media: atomisp: Ensure that USERPTR pointers are page aligned
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 6e6c4ae0f0ba295dbf6cbd48d93bec169d6ce431 ]
+
+The atomisp code needs USERPTR pointers to be page aligned,
+otherwise bad things (scribbling over other parts of the
+process' RAM) happen.
+
+Add a check to ensure this and exit VIDIOC_QBUF calls with
+unaligned pointers with -EINVAL.
+
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
+index 8a0648fd7c81..317db11703e6 100644
+--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
+@@ -1290,6 +1290,12 @@ static int atomisp_qbuf(struct file *file, void *fh, struct v4l2_buffer *buf)
+ * address and reprograme out page table properly
+ */
+ if (buf->memory == V4L2_MEMORY_USERPTR) {
++ if (offset_in_page(buf->m.userptr)) {
++ dev_err(isp->dev, "Error userptr is not page aligned.\n");
++ ret = -EINVAL;
++ goto error;
++ }
++
+ vb = pipe->capq.bufs[buf->index];
+ vm_mem = vb->priv;
+ if (!vm_mem) {
+--
+2.35.1
+
--- /dev/null
+From e8eacb206e0e57145765dda1a9e0e13af20af27a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Aug 2022 12:35:43 +0200
+Subject: media: atomisp: Fix v4l2_fh resource leak on open errors
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 5b9853ad1329be49343a608d574eb232ff1273d0 ]
+
+When atomisp_open() fails then it must call v4l2_fh_release() to undo
+the results of v4l2_fh_open().
+
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/atomisp_fops.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/media/atomisp/pci/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp_fops.c
+index b751df31cc24..ccf398b42520 100644
+--- a/drivers/staging/media/atomisp/pci/atomisp_fops.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_fops.c
+@@ -890,6 +890,7 @@ static int atomisp_open(struct file *file)
+ hmm_pool_unregister(HMM_POOL_TYPE_DYNAMIC);
+ pm_runtime_put(vdev->v4l2_dev->dev);
+ rt_mutex_unlock(&isp->mutex);
++ v4l2_fh_release(file);
+ return ret;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 42eef91a946bdf06c1a62d5786783525c9b30a33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Aug 2022 09:06:19 +0200
+Subject: media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 2dc73b48665411a08c4e5f0f823dea8510761603 ]
+
+I expect that the hardware will have limited this to 16, but just in
+case it hasn't, check for this corner case.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/platform/cros-ec/cros-ec-cec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/cec/platform/cros-ec/cros-ec-cec.c b/drivers/media/cec/platform/cros-ec/cros-ec-cec.c
+index 2d95e16cd248..f66699d5dc66 100644
+--- a/drivers/media/cec/platform/cros-ec/cros-ec-cec.c
++++ b/drivers/media/cec/platform/cros-ec/cros-ec-cec.c
+@@ -44,6 +44,8 @@ static void handle_cec_message(struct cros_ec_cec *cros_ec_cec)
+ uint8_t *cec_message = cros_ec->event_data.data.cec_message;
+ unsigned int len = cros_ec->event_size;
+
++ if (len > CEC_MAX_MSG_SIZE)
++ len = CEC_MAX_MSG_SIZE;
+ cros_ec_cec->rx_msg.len = len;
+ memcpy(cros_ec_cec->rx_msg.msg, cec_message, len);
+
+--
+2.35.1
+
--- /dev/null
+From a7036dd963285b2a7b56c1c310581526c5c046de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Aug 2022 07:59:24 +0200
+Subject: media: dvb-frontends/drxk: initialize err to 0
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 20694e96ca089ce6693c2348f8f628ee621e4e74 ]
+
+Fix a compiler warning:
+
+drivers/media/dvb-frontends/drxk_hard.c: In function 'drxk_read_ucblocks':
+drivers/media/dvb-frontends/drxk_hard.c:6673:21: warning: 'err' may be used uninitialized [-Wmaybe-uninitialized]
+ 6673 | *ucblocks = (u32) err;
+ | ^~~~~~~~~
+drivers/media/dvb-frontends/drxk_hard.c:6663:13: note: 'err' was declared here
+ 6663 | u16 err;
+ | ^~~
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/drxk_hard.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/dvb-frontends/drxk_hard.c b/drivers/media/dvb-frontends/drxk_hard.c
+index a57470bf71bf..2134e25096aa 100644
+--- a/drivers/media/dvb-frontends/drxk_hard.c
++++ b/drivers/media/dvb-frontends/drxk_hard.c
+@@ -6672,7 +6672,7 @@ static int drxk_read_snr(struct dvb_frontend *fe, u16 *snr)
+ static int drxk_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
+ {
+ struct drxk_state *state = fe->demodulator_priv;
+- u16 err;
++ u16 err = 0;
+
+ dprintk(1, "\n");
+
+--
+2.35.1
+
--- /dev/null
+From 2a109029c6ca94c1a2acfdb3aae1dfd07ccdda1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Sep 2022 09:46:30 +0200
+Subject: media: meson: vdec: fix possible refcount leak in vdec_probe()
+
+From: Hangyu Hua <hbh25y@gmail.com>
+
+[ Upstream commit 7718999356234d9cc6a11b4641bb773928f1390f ]
+
+v4l2_device_unregister need to be called to put the refcount got by
+v4l2_device_register when vdec_probe fails or vdec_remove is called.
+
+Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/meson/vdec/vdec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
+index 5ccb3846c879..7a818ca15b37 100644
+--- a/drivers/staging/media/meson/vdec/vdec.c
++++ b/drivers/staging/media/meson/vdec/vdec.c
+@@ -1109,6 +1109,7 @@ static int vdec_probe(struct platform_device *pdev)
+
+ err_vdev_release:
+ video_device_release(vdev);
++ v4l2_device_unregister(&core->v4l2_dev);
+ return ret;
+ }
+
+@@ -1117,6 +1118,7 @@ static int vdec_remove(struct platform_device *pdev)
+ struct amvdec_core *core = platform_get_drvdata(pdev);
+
+ video_unregister_device(core->vdev_dec);
++ v4l2_device_unregister(&core->v4l2_dev);
+
+ return 0;
+ }
+--
+2.35.1
+
--- /dev/null
+From e92473e385f0fdb65f73cf07d52976bb449575c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Aug 2022 00:44:14 +0200
+Subject: media: rkisp1: Initialize color space on resizer sink and source pads
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 83b9296e399367862845d3b19984444fc756bd61 ]
+
+Initialize the four color space fields on the sink and source video pads
+of the resizer in the .init_cfg() operation. The resizer can't perform
+any color space conversion, so set the sink and source color spaces to
+the same defaults, which match the ISP source video pad default.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
+Reviewed-by: Dafna Hirschfeld <dafna@fastmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkisp1/rkisp1-resizer.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/staging/media/rkisp1/rkisp1-resizer.c b/drivers/staging/media/rkisp1/rkisp1-resizer.c
+index 4dcc342ac2b2..76f17dd7670f 100644
+--- a/drivers/staging/media/rkisp1/rkisp1-resizer.c
++++ b/drivers/staging/media/rkisp1/rkisp1-resizer.c
+@@ -500,6 +500,10 @@ static int rkisp1_rsz_init_config(struct v4l2_subdev *sd,
+ sink_fmt->height = RKISP1_DEFAULT_HEIGHT;
+ sink_fmt->field = V4L2_FIELD_NONE;
+ sink_fmt->code = RKISP1_DEF_FMT;
++ sink_fmt->colorspace = V4L2_COLORSPACE_SRGB;
++ sink_fmt->xfer_func = V4L2_XFER_FUNC_SRGB;
++ sink_fmt->ycbcr_enc = V4L2_YCBCR_ENC_601;
++ sink_fmt->quantization = V4L2_QUANTIZATION_LIM_RANGE;
+
+ sink_crop = v4l2_subdev_get_try_crop(sd, cfg, RKISP1_RSZ_PAD_SINK);
+ sink_crop->width = RKISP1_DEFAULT_WIDTH;
+--
+2.35.1
+
--- /dev/null
+From f2be4bd6c3ecac2f58709ad7c324dc793aeb0f42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Aug 2022 17:11:36 +0200
+Subject: media: rkisp1: Zero v4l2_subdev_format fields in when validating
+ links
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit c53e3a049f35978a150526671587fd46b1ae7ca1 ]
+
+The local sd_fmt variable in rkisp1_capture_link_validate() has
+uninitialized fields, which causes random failures when calling the
+subdev .get_fmt() operation. Fix it by initializing the variable when
+declaring it, which zeros all other fields.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
+Reviewed-by: Dafna Hirschfeld <dafna@fastmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkisp1/rkisp1-capture.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/staging/media/rkisp1/rkisp1-capture.c b/drivers/staging/media/rkisp1/rkisp1-capture.c
+index 0c934ca5adaa..8936f5a81680 100644
+--- a/drivers/staging/media/rkisp1/rkisp1-capture.c
++++ b/drivers/staging/media/rkisp1/rkisp1-capture.c
+@@ -1258,11 +1258,12 @@ static int rkisp1_capture_link_validate(struct media_link *link)
+ struct rkisp1_capture *cap = video_get_drvdata(vdev);
+ const struct rkisp1_capture_fmt_cfg *fmt =
+ rkisp1_find_fmt_cfg(cap, cap->pix.fmt.pixelformat);
+- struct v4l2_subdev_format sd_fmt;
++ struct v4l2_subdev_format sd_fmt = {
++ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
++ .pad = link->source->index,
++ };
+ int ret;
+
+- sd_fmt.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+- sd_fmt.pad = link->source->index;
+ ret = v4l2_subdev_call(sd, pad, get_fmt, NULL, &sd_fmt);
+ if (ret)
+ return ret;
+--
+2.35.1
+
--- /dev/null
+From 5cab4c67aa1e9ade9cdca144278712829c09527b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Aug 2022 09:02:42 +0200
+Subject: media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 93f65ce036863893c164ca410938e0968964b26c ]
+
+I expect that the hardware will have limited this to 16, but just in
+case it hasn't, check for this corner case.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/platform/s5p/s5p_cec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/cec/platform/s5p/s5p_cec.c b/drivers/media/cec/platform/s5p/s5p_cec.c
+index 028a09a7531e..102f1af01000 100644
+--- a/drivers/media/cec/platform/s5p/s5p_cec.c
++++ b/drivers/media/cec/platform/s5p/s5p_cec.c
+@@ -115,6 +115,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv)
+ dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n");
+ cec->rx = STATE_BUSY;
+ cec->msg.len = status >> 24;
++ if (cec->msg.len > CEC_MAX_MSG_SIZE)
++ cec->msg.len = CEC_MAX_MSG_SIZE;
+ cec->msg.rx_status = CEC_RX_STATUS_OK;
+ s5p_cec_get_rx_buf(cec, cec->msg.len,
+ cec->msg.msg);
+--
+2.35.1
+
--- /dev/null
+From ac47cdde3fbfdb051444255ea70cc625153cf341 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Sep 2022 18:02:42 -0600
+Subject: scsi: core: Restrict legal sdev_state transitions via sysfs
+
+From: Uday Shankar <ushankar@purestorage.com>
+
+[ Upstream commit 2331ce6126be8864b39490e705286b66e2344aac ]
+
+Userspace can currently write to sysfs to transition sdev_state to RUNNING
+or OFFLINE from any source state. This causes issues because proper
+transitioning out of some states involves steps besides just changing
+sdev_state, so allowing userspace to change sdev_state regardless of the
+source state can result in inconsistencies; e.g. with ISCSI we can end up
+with sdev_state == SDEV_RUNNING while the device queue is quiesced. Any
+task attempting I/O on the device will then hang, and in more recent
+kernels, iscsid will hang as well.
+
+More detail about this bug is provided in my first attempt:
+
+https://groups.google.com/g/open-iscsi/c/PNKca4HgPDs/m/CXaDkntOAQAJ
+
+Link: https://lore.kernel.org/r/20220924000241.2967323-1-ushankar@purestorage.com
+Signed-off-by: Uday Shankar <ushankar@purestorage.com>
+Suggested-by: Mike Christie <michael.christie@oracle.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_sysfs.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 42db9c52208e..6cc4d0792e3d 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -815,6 +815,14 @@ store_state_field(struct device *dev, struct device_attribute *attr,
+ }
+
+ mutex_lock(&sdev->state_mutex);
++ switch (sdev->sdev_state) {
++ case SDEV_RUNNING:
++ case SDEV_OFFLINE:
++ break;
++ default:
++ mutex_unlock(&sdev->state_mutex);
++ return -EINVAL;
++ }
+ if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) {
+ ret = 0;
+ } else {
+--
+2.35.1
+
coresight-cti-fix-hang-in-cti_disable_hw.patch
xhci-pci-set-runtime-pm-as-default-policy-on-all-xhc.patch
s390-boot-add-secure-boot-trailer.patch
+media-rkisp1-initialize-color-space-on-resizer-sink-.patch
+media-rkisp1-zero-v4l2_subdev_format-fields-in-when-.patch
+media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch
+media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch
+media-dvb-frontends-drxk-initialize-err-to-0.patch
+media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch
+media-atomisp-ensure-that-userptr-pointers-are-page-.patch
+media-atomisp-fix-v4l2_fh-resource-leak-on-open-erro.patch
+acpi-apei-fix-integer-overflow-in-ghes_estatus_pool_.patch
+scsi-core-restrict-legal-sdev_state-transitions-via-.patch
+hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch
+drm-amdgpu-set-vm_update_mode-0-as-default-for-sienn.patch
+i2c-xiic-add-platform-module-alias.patch
+efi-tpm-pass-correct-address-to-memblock_reserve.patch
+arm-dts-imx6qdl-gw59-10-13-fix-user-pushbutton-gpio-.patch
+arm64-dts-lx2160a-specify-clock-frequencies-for-the-.patch
+firmware-arm_scmi-suppress-the-driver-s-bind-attribu.patch
+firmware-arm_scmi-make-rx-chan_setup-fail-on-memory-.patch
+arm64-dts-juno-add-thermal-critical-trip-points.patch
+i2c-piix4-fix-adapter-not-be-removed-in-piix4_remove.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
