--- /dev/null
+From 650c0e6becd814d7d2c11082e681138ccdeda643 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 14:48:27 -0600
+Subject: hwmon: (ltc2991) Fix mixed signed/unsigned in DIV_ROUND_CLOSEST
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit e9b24deb84863c5a77dda5be57b6cb5bf4127b85 ]
+
+Fix use of DIV_ROUND_CLOSEST where a possibly negative value is divided
+by an unsigned type by casting the unsigned type to the signed type of
+the same size (st->r_sense_uohm[channel] has type of u32).
+
+The docs on the DIV_ROUND_CLOSEST macro explain that dividing a negative
+value by an unsigned type is undefined behavior. The actual behavior is
+that it converts both values to unsigned before doing the division, for
+example:
+
+ int ret = DIV_ROUND_CLOSEST(-100, 3U);
+
+results in ret == 1431655732 instead of -33.
+
+Fixes: 2b9ea4262ae9 ("hwmon: Add driver for ltc2991")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://lore.kernel.org/r/20250115-hwmon-ltc2991-fix-div-round-closest-v1-1-b4929667e457@baylibre.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/ltc2991.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/ltc2991.c b/drivers/hwmon/ltc2991.c
+index 7ca139e4b6aff..6d5d4cb846daf 100644
+--- a/drivers/hwmon/ltc2991.c
++++ b/drivers/hwmon/ltc2991.c
+@@ -125,7 +125,7 @@ static int ltc2991_get_curr(struct ltc2991_state *st, u32 reg, int channel,
+
+ /* Vx-Vy, 19.075uV/LSB */
+ *val = DIV_ROUND_CLOSEST(sign_extend32(reg_val, 14) * 19075,
+- st->r_sense_uohm[channel]);
++ (s32)st->r_sense_uohm[channel]);
+
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From f1030d95aaa5805613c9d8ed77166f6a2c9f07fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 15:45:52 -0600
+Subject: hwmon: (tmp513) Fix division of negative numbers
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit e2c68cea431d65292b592c9f8446c918d45fcf78 ]
+
+Fix several issues with division of negative numbers in the tmp513
+driver.
+
+The docs on the DIV_ROUND_CLOSEST macro explain that dividing a negative
+value by an unsigned type is undefined behavior. The driver was doing
+this in several places, i.e. data->shunt_uohms has type of u32. The
+actual "undefined" behavior is that it converts both values to unsigned
+before doing the division, for example:
+
+ int ret = DIV_ROUND_CLOSEST(-100, 3U);
+
+results in ret == 1431655732 instead of -33.
+
+Furthermore the MILLI macro has a type of unsigned long. Multiplying a
+signed long by an unsigned long results in an unsigned long.
+
+So, we need to cast both MILLI and data data->shunt_uohms to long when
+using the DIV_ROUND_CLOSEST macro.
+
+Fixes: f07f9d2467f4 ("hwmon: (tmp513) Use SI constants from units.h")
+Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://lore.kernel.org/r/20250114-fix-si-prefix-macro-sign-bugs-v1-1-696fd8d10f00@baylibre.com
+[groeck: Drop some continuation lines]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/tmp513.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c
+index 1c2cb12071b80..5acbfd7d088dd 100644
+--- a/drivers/hwmon/tmp513.c
++++ b/drivers/hwmon/tmp513.c
+@@ -207,7 +207,8 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos,
+ *val = sign_extend32(regval,
+ reg == TMP51X_SHUNT_CURRENT_RESULT ?
+ 16 - tmp51x_get_pga_shift(data) : 15);
+- *val = DIV_ROUND_CLOSEST(*val * 10 * MILLI, data->shunt_uohms);
++ *val = DIV_ROUND_CLOSEST(*val * 10 * (long)MILLI, (long)data->shunt_uohms);
++
+ break;
+ case TMP51X_BUS_VOLTAGE_RESULT:
+ case TMP51X_BUS_VOLTAGE_H_LIMIT:
+@@ -223,7 +224,7 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos,
+ case TMP51X_BUS_CURRENT_RESULT:
+ // Current = (ShuntVoltage * CalibrationRegister) / 4096
+ *val = sign_extend32(regval, 15) * (long)data->curr_lsb_ua;
+- *val = DIV_ROUND_CLOSEST(*val, MILLI);
++ *val = DIV_ROUND_CLOSEST(*val, (long)MILLI);
+ break;
+ case TMP51X_LOCAL_TEMP_RESULT:
+ case TMP51X_REMOTE_TEMP_RESULT_1:
+@@ -263,7 +264,7 @@ static int tmp51x_set_value(struct tmp51x_data *data, u8 reg, long val)
+ * The user enter current value and we convert it to
+ * voltage. 1lsb = 10uV
+ */
+- val = DIV_ROUND_CLOSEST(val * data->shunt_uohms, 10 * MILLI);
++ val = DIV_ROUND_CLOSEST(val * (long)data->shunt_uohms, 10 * (long)MILLI);
+ max_val = U16_MAX >> tmp51x_get_pga_shift(data);
+ regval = clamp_val(val, -max_val, max_val);
+ break;
+--
+2.39.5
+
--- /dev/null
+From d7fdea33e0475afe2ceb58c44f8c289259868438 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2024 12:08:03 +0900
+Subject: i2c: core: fix reference leak in i2c_register_adapter()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit 3f8c4f5e9a57868fa107016c81165686d23325f2 ]
+
+The reference count of the device incremented in device_initialize() is
+not decremented when device_add() fails. Add a put_device() call before
+returning from the function.
+
+This bug was found by an experimental static analysis tool that I am
+developing.
+
+Fixes: 60f68597024d ("i2c: core: Setup i2c_adapter runtime-pm before calling device_add()")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-core-base.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 7c810893bfa33..75d30861ffe21 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -1562,6 +1562,7 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
+ res = device_add(&adap->dev);
+ if (res) {
+ pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
++ put_device(&adap->dev);
+ goto out_list;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 911f7d44960a391f9bfa346c7b4f3ea49667d368 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 08:29:45 +0100
+Subject: i2c: mux: demux-pinctrl: check initial mux selection, too
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit ca89f73394daf92779ddaa37b42956f4953f3941 ]
+
+When misconfigured, the initial setup of the current mux channel can
+fail, too. It must be checked as well.
+
+Fixes: 50a5ba876908 ("i2c: mux: demux-pinctrl: add driver")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+index 7e2686b606c04..cec7f3447e193 100644
+--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+@@ -261,7 +261,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+ pm_runtime_no_callbacks(&pdev->dev);
+
+ /* switch to first parent as active master */
+- i2c_demux_activate_master(priv, 0);
++ err = i2c_demux_activate_master(priv, 0);
++ if (err)
++ goto err_rollback;
+
+ err = device_create_file(&pdev->dev, &dev_attr_available_masters);
+ if (err)
+--
+2.39.5
+
--- /dev/null
+From 18bfbf6b328c4eaf74190790710a030033fdb86f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 13:36:23 +0100
+Subject: i2c: rcar: fix NACK handling when being a target
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 093f70c134f70e4632b295240f07d2b50b74e247 ]
+
+When this controller is a target, the NACK handling had two issues.
+First, the return value from the backend was not checked on the initial
+WRITE_REQUESTED. So, the driver missed to send a NACK in this case.
+Also, the NACK always arrives one byte late on the bus, even in the
+WRITE_RECEIVED case. This seems to be a HW issue. We should then not
+rely on the backend to correctly NACK the superfluous byte as well. Fix
+both issues by introducing a flag which gets set whenever the backend
+requests a NACK and keep sending it until we get a STOP condition.
+
+Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 9267df38c2d0a..3991224148214 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -130,6 +130,8 @@
+ #define ID_P_PM_BLOCKED BIT(31)
+ #define ID_P_MASK GENMASK(31, 27)
+
++#define ID_SLAVE_NACK BIT(0)
++
+ enum rcar_i2c_type {
+ I2C_RCAR_GEN1,
+ I2C_RCAR_GEN2,
+@@ -166,6 +168,7 @@ struct rcar_i2c_priv {
+ int irq;
+
+ struct i2c_client *host_notify_client;
++ u8 slave_flags;
+ };
+
+ #define rcar_i2c_priv_to_dev(p) ((p)->adap.dev.parent)
+@@ -655,6 +658,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ {
+ u32 ssr_raw, ssr_filtered;
+ u8 value;
++ int ret;
+
+ ssr_raw = rcar_i2c_read(priv, ICSSR) & 0xff;
+ ssr_filtered = ssr_raw & rcar_i2c_read(priv, ICSIER);
+@@ -670,7 +674,10 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ rcar_i2c_write(priv, ICRXTX, value);
+ rcar_i2c_write(priv, ICSIER, SDE | SSR | SAR);
+ } else {
+- i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value);
++ ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value);
++ if (ret)
++ priv->slave_flags |= ID_SLAVE_NACK;
++
+ rcar_i2c_read(priv, ICRXTX); /* dummy read */
+ rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR);
+ }
+@@ -683,18 +690,21 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ if (ssr_filtered & SSR) {
+ i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
+ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */
++ priv->slave_flags &= ~ID_SLAVE_NACK;
+ rcar_i2c_write(priv, ICSIER, SAR);
+ rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
+ }
+
+ /* master wants to write to us */
+ if (ssr_filtered & SDR) {
+- int ret;
+-
+ value = rcar_i2c_read(priv, ICRXTX);
+ ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_RECEIVED, &value);
+- /* Send NACK in case of error */
+- rcar_i2c_write(priv, ICSCR, SIE | SDBS | (ret < 0 ? FNA : 0));
++ if (ret)
++ priv->slave_flags |= ID_SLAVE_NACK;
++
++ /* Send NACK in case of error, but it will come 1 byte late :( */
++ rcar_i2c_write(priv, ICSCR, SIE | SDBS |
++ (priv->slave_flags & ID_SLAVE_NACK ? FNA : 0));
+ rcar_i2c_write(priv, ICSSR, ~SDR & 0xff);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From b21d0350d84581fa3c9c80f84bffb8a2bfe634f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 17:23:47 +0100
+Subject: i2c: testunit: on errors, repeat NACK until STOP
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 6ad30f7890423341f4b79329af1f9b9bb3cdec03 ]
+
+This backend requests a NACK from the controller driver when it detects
+an error. If that request gets ignored from some reason, subsequent
+accesses will wrongly be handled OK. To fix this, an error now changes
+the state machine, so the backend will report NACK until a STOP
+condition has been detected. This make the driver more robust against
+controllers which will sadly apply the NACK not to the current byte but
+the next one.
+
+Fixes: a8335c64c5f0 ("i2c: add slave testunit driver")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-slave-testunit.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/i2c-slave-testunit.c b/drivers/i2c/i2c-slave-testunit.c
+index 9fe3150378e86..7ae0c7902f670 100644
+--- a/drivers/i2c/i2c-slave-testunit.c
++++ b/drivers/i2c/i2c-slave-testunit.c
+@@ -38,6 +38,7 @@ enum testunit_regs {
+
+ enum testunit_flags {
+ TU_FLAG_IN_PROCESS,
++ TU_FLAG_NACK,
+ };
+
+ struct testunit_data {
+@@ -90,8 +91,10 @@ static int i2c_slave_testunit_slave_cb(struct i2c_client *client,
+
+ switch (event) {
+ case I2C_SLAVE_WRITE_REQUESTED:
+- if (test_bit(TU_FLAG_IN_PROCESS, &tu->flags))
+- return -EBUSY;
++ if (test_bit(TU_FLAG_IN_PROCESS | TU_FLAG_NACK, &tu->flags)) {
++ ret = -EBUSY;
++ break;
++ }
+
+ memset(tu->regs, 0, TU_NUM_REGS);
+ tu->reg_idx = 0;
+@@ -99,8 +102,10 @@ static int i2c_slave_testunit_slave_cb(struct i2c_client *client,
+ break;
+
+ case I2C_SLAVE_WRITE_RECEIVED:
+- if (test_bit(TU_FLAG_IN_PROCESS, &tu->flags))
+- return -EBUSY;
++ if (test_bit(TU_FLAG_IN_PROCESS | TU_FLAG_NACK, &tu->flags)) {
++ ret = -EBUSY;
++ break;
++ }
+
+ if (tu->reg_idx < TU_NUM_REGS)
+ tu->regs[tu->reg_idx] = *val;
+@@ -129,6 +134,8 @@ static int i2c_slave_testunit_slave_cb(struct i2c_client *client,
+ * here because we still need them in the workqueue!
+ */
+ tu->reg_idx = 0;
++
++ clear_bit(TU_FLAG_NACK, &tu->flags);
+ break;
+
+ case I2C_SLAVE_READ_PROCESSED:
+@@ -151,6 +158,10 @@ static int i2c_slave_testunit_slave_cb(struct i2c_client *client,
+ break;
+ }
+
++ /* If an error occurred somewhen, we NACK everything until next STOP */
++ if (ret)
++ set_bit(TU_FLAG_NACK, &tu->flags);
++
+ return ret;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 1f22e49e1424ddd96e75340f800cfc03e5cbeabb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2025 12:01:18 -0600
+Subject: platform/x86: dell-uart-backlight: fix serdev race
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chenyuan Yang <chenyuan0y@gmail.com>
+
+[ Upstream commit 1b2128aa2d45ab20b22548dcf4b48906298ca7fd ]
+
+The dell_uart_bl_serdev_probe() function calls devm_serdev_device_open()
+before setting the client ops via serdev_device_set_client_ops(). This
+ordering can trigger a NULL pointer dereference in the serdev controller's
+receive_buf handler, as it assumes serdev->ops is valid when
+SERPORT_ACTIVE is set.
+
+This is similar to the issue fixed in commit 5e700b384ec1
+("platform/chrome: cros_ec_uart: properly fix race condition") where
+devm_serdev_device_open() was called before fully initializing the
+device.
+
+Fix the race by ensuring client ops are set before enabling the port via
+devm_serdev_device_open().
+
+Note, serdev_device_set_baudrate() and serdev_device_set_flow_control()
+calls should be after the devm_serdev_device_open() call.
+
+Fixes: 484bae9e4d6a ("platform/x86: Add new Dell UART backlight driver")
+Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20250111180118.2274516-1-chenyuan0y@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/dell/dell-uart-backlight.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/dell/dell-uart-backlight.c b/drivers/platform/x86/dell/dell-uart-backlight.c
+index 3995f90add456..c45bc332af7a0 100644
+--- a/drivers/platform/x86/dell/dell-uart-backlight.c
++++ b/drivers/platform/x86/dell/dell-uart-backlight.c
+@@ -283,6 +283,9 @@ static int dell_uart_bl_serdev_probe(struct serdev_device *serdev)
+ init_waitqueue_head(&dell_bl->wait_queue);
+ dell_bl->dev = dev;
+
++ serdev_device_set_drvdata(serdev, dell_bl);
++ serdev_device_set_client_ops(serdev, &dell_uart_bl_serdev_ops);
++
+ ret = devm_serdev_device_open(dev, serdev);
+ if (ret)
+ return dev_err_probe(dev, ret, "opening UART device\n");
+@@ -290,8 +293,6 @@ static int dell_uart_bl_serdev_probe(struct serdev_device *serdev)
+ /* 9600 bps, no flow control, these are the default but set them to be sure */
+ serdev_device_set_baudrate(serdev, 9600);
+ serdev_device_set_flow_control(serdev, false);
+- serdev_device_set_drvdata(serdev, dell_bl);
+- serdev_device_set_client_ops(serdev, &dell_uart_bl_serdev_ops);
+
+ get_version[0] = DELL_SOF(GET_CMD_LEN);
+ get_version[1] = CMD_GET_VERSION;
+--
+2.39.5
+
--- /dev/null
+From 12834b0c4f900d665235a6cfd15e1b8a6b6b058d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2025 12:09:51 -0600
+Subject: platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chenyuan Yang <chenyuan0y@gmail.com>
+
+[ Upstream commit 59616a91e5e74833b2008b56c66879857c616006 ]
+
+The yt2_1380_fc_serdev_probe() function calls devm_serdev_device_open()
+before setting the client ops via serdev_device_set_client_ops(). This
+ordering can trigger a NULL pointer dereference in the serdev controller's
+receive_buf handler, as it assumes serdev->ops is valid when
+SERPORT_ACTIVE is set.
+
+This is similar to the issue fixed in commit 5e700b384ec1
+("platform/chrome: cros_ec_uart: properly fix race condition") where
+devm_serdev_device_open() was called before fully initializing the
+device.
+
+Fix the race by ensuring client ops are set before enabling the port via
+devm_serdev_device_open().
+
+Note, serdev_device_set_baudrate() and serdev_device_set_flow_control()
+calls should be after the devm_serdev_device_open() call.
+
+Fixes: b2ed33e8d486 ("platform/x86: Add lenovo-yoga-tab2-pro-1380-fastcharger driver")
+Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20250111180951.2277757-1-chenyuan0y@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c b/drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c
+index d525bdc8ca9b3..32d9b6009c422 100644
+--- a/drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c
++++ b/drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c
+@@ -199,14 +199,15 @@ static int yt2_1380_fc_serdev_probe(struct serdev_device *serdev)
+ if (ret)
+ return ret;
+
++ serdev_device_set_drvdata(serdev, fc);
++ serdev_device_set_client_ops(serdev, &yt2_1380_fc_serdev_ops);
++
+ ret = devm_serdev_device_open(dev, serdev);
+ if (ret)
+ return dev_err_probe(dev, ret, "opening UART device\n");
+
+ serdev_device_set_baudrate(serdev, 600);
+ serdev_device_set_flow_control(serdev, false);
+- serdev_device_set_drvdata(serdev, fc);
+- serdev_device_set_client_ops(serdev, &yt2_1380_fc_serdev_ops);
+
+ ret = devm_extcon_register_notifier_all(dev, fc->extcon, &fc->nb);
+ if (ret)
+--
+2.39.5
+
--- /dev/null
+From 1b856e2073bfd274d6e9592713c2e082451b1da9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2024 10:55:54 +0200
+Subject: reset: rzg2l-usbphy-ctrl: Assign proper of node to the allocated
+ device
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit 1f8af9712413f456849fdf3f3a782cbe099476d7 ]
+
+The platform device named "rzg2l-usb-vbus-regulator", allocated by
+the rzg2l-usbphy-ctrl driver, is used to instantiate a regulator driver.
+This regulator driver is associated with a device tree (DT) node, which
+is a child of the rzg2l-usbphy-ctrl DT node. The regulator's DT node allows
+consumer nodes to reference the regulator and configure the regulator as
+needed.
+
+Starting with commit cd7a38c40b23 ("regulator: core: do not silently ignore
+provided init_data") the struct regulator_dev::dev::of_node is no longer
+populated using of_node_get(config->of_node) if the regulator does not
+provide init_data. Since the rzg2l-usb-vbus-regulator does not provide
+init_data, this behaviour causes the of_find_regulator_by_node() function
+to fails, resulting in errors when attempting to request the regulator.
+
+To fix this issue, call device_set_of_node_from_dev() for the
+"rzg2l-usb-vbus-regulator" platform device.
+
+Fixes: 84fbd6198766 ("regulator: Add Renesas RZ/G2L USB VBUS regulator driver")
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20241119085554.1035881-1-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/reset-rzg2l-usbphy-ctrl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/reset/reset-rzg2l-usbphy-ctrl.c b/drivers/reset/reset-rzg2l-usbphy-ctrl.c
+index 1cd157f4f03b4..4e2ac1f0060c0 100644
+--- a/drivers/reset/reset-rzg2l-usbphy-ctrl.c
++++ b/drivers/reset/reset-rzg2l-usbphy-ctrl.c
+@@ -176,6 +176,7 @@ static int rzg2l_usbphy_ctrl_probe(struct platform_device *pdev)
+ vdev->dev.parent = dev;
+ priv->vdev = vdev;
+
++ device_set_of_node_from_dev(&vdev->dev, dev);
+ error = platform_device_add(vdev);
+ if (error)
+ goto err_device_put;
+--
+2.39.5
+
--- /dev/null
+From 58a291eeacdf39ff055b4e62f9607643dd6fc6f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 13:41:56 +0000
+Subject: Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
+
+From: Pratyush Yadav <pratyush@kernel.org>
+
+[ Upstream commit d15638bf76ad47874ecb5dc386f0945fc0b2a875 ]
+
+This reverts commit 98d1fb94ce75f39febd456d6d3cbbe58b6678795.
+
+The commit uses data nbits instead of addr nbits for dummy phase. This
+causes a regression for all boards where spi-tx-bus-width is smaller
+than spi-rx-bus-width. It is a common pattern for boards to have
+spi-tx-bus-width == 1 and spi-rx-bus-width > 1. The regression causes
+all reads with a dummy phase to become unavailable for such boards,
+leading to a usually slower 0-dummy-cycle read being selected.
+
+Most controllers' supports_op hooks call spi_mem_default_supports_op().
+In spi_mem_default_supports_op(), spi_mem_check_buswidth() is called to
+check if the buswidths for the op can actually be supported by the
+board's wiring. This wiring information comes from (among other things)
+the spi-{tx,rx}-bus-width DT properties. Based on these properties,
+SPI_TX_* or SPI_RX_* flags are set by of_spi_parse_dt().
+spi_mem_check_buswidth() then uses these flags to make the decision
+whether an op can be supported by the board's wiring (in a way,
+indirectly checking against spi-{rx,tx}-bus-width).
+
+Now the tricky bit here is that spi_mem_check_buswidth() does:
+
+ if (op->dummy.nbytes &&
+ spi_check_buswidth_req(mem, op->dummy.buswidth, true))
+ return false;
+
+The true argument to spi_check_buswidth_req() means the op is treated as
+a TX op. For a board that has say 1-bit TX and 4-bit RX, a 4-bit dummy
+TX is considered as unsupported, and the op gets rejected.
+
+The commit being reverted uses the data buswidth for dummy buswidth. So
+for reads, the RX buswidth gets used for the dummy phase, uncovering
+this issue. In reality, a dummy phase is neither RX nor TX. As the name
+suggests, these are just dummy cycles that send or receive no data, and
+thus don't really need to have any buswidth at all.
+
+Ideally, dummy phases should not be checked against the board's wiring
+capabilities at all, and should only be sanity-checked for having a sane
+buswidth value. Since we are now at rc7 and such a change might
+introduce many unexpected bugs, revert the commit for now. It can be
+sent out later along with the spi_mem_check_buswidth() fix.
+
+Fixes: 98d1fb94ce75 ("mtd: spi-nor: core: replace dummy buswidth from addr to data")
+Reported-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Closes: https://lore.kernel.org/linux-mtd/3342163.44csPzL39Z@steina-w/
+Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
+index 8c57df44c40fe..9d6e85bf227b9 100644
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -89,7 +89,7 @@ void spi_nor_spimem_setup_op(const struct spi_nor *nor,
+ op->addr.buswidth = spi_nor_get_protocol_addr_nbits(proto);
+
+ if (op->dummy.nbytes)
+- op->dummy.buswidth = spi_nor_get_protocol_data_nbits(proto);
++ op->dummy.buswidth = spi_nor_get_protocol_addr_nbits(proto);
+
+ if (op->data.nbytes)
+ op->data.buswidth = spi_nor_get_protocol_data_nbits(proto);
+--
+2.39.5
+
drm-vmwgfx-unreserve-bo-on-error.patch
drm-vmwgfx-add-new-keep_resv-bo-param.patch
drm-v3d-ensure-job-pointer-is-set-to-null-after-job-.patch
+reset-rzg2l-usbphy-ctrl-assign-proper-of-node-to-the.patch
+soc-ti-pruss-fix-pruss-apis.patch
+i2c-core-fix-reference-leak-in-i2c_register_adapter.patch
+platform-x86-dell-uart-backlight-fix-serdev-race.patch
+platform-x86-lenovo-yoga-tab2-pro-1380-fastcharger-f.patch
+hwmon-tmp513-fix-division-of-negative-numbers.patch
+revert-mtd-spi-nor-core-replace-dummy-buswidth-from-.patch
+i2c-mux-demux-pinctrl-check-initial-mux-selection-to.patch
+i2c-rcar-fix-nack-handling-when-being-a-target.patch
+i2c-testunit-on-errors-repeat-nack-until-stop.patch
+hwmon-ltc2991-fix-mixed-signed-unsigned-in-div_round.patch
+smb-client-fix-double-free-of-tcp_server_info-hostna.patch
--- /dev/null
+From 0fb7e0bf660bbb840e9db6401da518164c9ff0f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 12:48:48 -0300
+Subject: smb: client: fix double free of TCP_Server_Info::hostname
+
+From: Paulo Alcantara <pc@manguebit.com>
+
+[ Upstream commit fa2f9906a7b333ba757a7dbae0713d8a5396186e ]
+
+When shutting down the server in cifs_put_tcp_session(), cifsd thread
+might be reconnecting to multiple DFS targets before it realizes it
+should exit the loop, so @server->hostname can't be freed as long as
+cifsd thread isn't done. Otherwise the following can happen:
+
+ RIP: 0010:__slab_free+0x223/0x3c0
+ Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89
+ 1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f>
+ 0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80
+ RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246
+ RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068
+ RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400
+ RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000
+ R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500
+ R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068
+ FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000)
+ 000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4:
+ PKRU: 55555554
+ Call Trace:
+ <TASK>
+ ? show_trace_log_lvl+0x1c4/0x2df
+ ? show_trace_log_lvl+0x1c4/0x2df
+ ? __reconnect_target_unlocked+0x3e/0x160 [cifs]
+ ? __die_body.cold+0x8/0xd
+ ? die+0x2b/0x50
+ ? do_trap+0xce/0x120
+ ? __slab_free+0x223/0x3c0
+ ? do_error_trap+0x65/0x80
+ ? __slab_free+0x223/0x3c0
+ ? exc_invalid_op+0x4e/0x70
+ ? __slab_free+0x223/0x3c0
+ ? asm_exc_invalid_op+0x16/0x20
+ ? __slab_free+0x223/0x3c0
+ ? extract_hostname+0x5c/0xa0 [cifs]
+ ? extract_hostname+0x5c/0xa0 [cifs]
+ ? __kmalloc+0x4b/0x140
+ __reconnect_target_unlocked+0x3e/0x160 [cifs]
+ reconnect_dfs_server+0x145/0x430 [cifs]
+ cifs_handle_standard+0x1ad/0x1d0 [cifs]
+ cifs_demultiplex_thread+0x592/0x730 [cifs]
+ ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
+ kthread+0xdd/0x100
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x29/0x50
+ </TASK>
+
+Fixes: 7be3248f3139 ("cifs: To match file servers, make sure the server hostname matches")
+Reported-by: Jay Shin <jaeshin@redhat.com>
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/connect.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
+index fe40152b915d8..fb51cdf552061 100644
+--- a/fs/smb/client/connect.c
++++ b/fs/smb/client/connect.c
+@@ -1044,6 +1044,7 @@ clean_demultiplex_info(struct TCP_Server_Info *server)
+ /* Release netns reference for this server. */
+ put_net(cifs_net_ns(server));
+ kfree(server->leaf_fullpath);
++ kfree(server->hostname);
+ kfree(server);
+
+ length = atomic_dec_return(&tcpSesAllocCount);
+@@ -1670,8 +1671,6 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
+ kfree_sensitive(server->session_key.response);
+ server->session_key.response = NULL;
+ server->session_key.len = 0;
+- kfree(server->hostname);
+- server->hostname = NULL;
+
+ task = xchg(&server->tsk, NULL);
+ if (task)
+--
+2.39.5
+
--- /dev/null
+From bff7fa016a263f89cbaf1f3b50733da0295b8d76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2024 15:35:07 +0530
+Subject: soc: ti: pruss: Fix pruss APIs
+
+From: MD Danish Anwar <danishanwar@ti.com>
+
+[ Upstream commit 202580b60229345dc2637099f10c8a8857c1fdc2 ]
+
+PRUSS APIs in pruss_driver.h produce lots of compilation errors when
+CONFIG_TI_PRUSS is not set.
+
+The errors and warnings,
+warning: returning 'void *' from a function with return type 'int' makes
+ integer from pointer without a cast [-Wint-conversion]
+error: expected identifier or '(' before '{' token
+
+Fix these warnings and errors by fixing the return type of pruss APIs as
+well as removing the misplaced semicolon from pruss_cfg_xfr_enable()
+
+Fixes: 0211cc1e4fbb ("soc: ti: pruss: Add helper functions to set GPI mode, MII_RT_event and XFR")
+Signed-off-by: MD Danish Anwar <danishanwar@ti.com>
+Reviewed-by: Roger Quadros <rogerq@kernel.org>
+Link: https://lore.kernel.org/r/20241220100508.1554309-2-danishanwar@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pruss_driver.h | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/pruss_driver.h b/include/linux/pruss_driver.h
+index c9a31c567e85b..2e18fef1a2e10 100644
+--- a/include/linux/pruss_driver.h
++++ b/include/linux/pruss_driver.h
+@@ -144,32 +144,32 @@ static inline int pruss_release_mem_region(struct pruss *pruss,
+ static inline int pruss_cfg_get_gpmux(struct pruss *pruss,
+ enum pruss_pru_id pru_id, u8 *mux)
+ {
+- return ERR_PTR(-EOPNOTSUPP);
++ return -EOPNOTSUPP;
+ }
+
+ static inline int pruss_cfg_set_gpmux(struct pruss *pruss,
+ enum pruss_pru_id pru_id, u8 mux)
+ {
+- return ERR_PTR(-EOPNOTSUPP);
++ return -EOPNOTSUPP;
+ }
+
+ static inline int pruss_cfg_gpimode(struct pruss *pruss,
+ enum pruss_pru_id pru_id,
+ enum pruss_gpi_mode mode)
+ {
+- return ERR_PTR(-EOPNOTSUPP);
++ return -EOPNOTSUPP;
+ }
+
+ static inline int pruss_cfg_miirt_enable(struct pruss *pruss, bool enable)
+ {
+- return ERR_PTR(-EOPNOTSUPP);
++ return -EOPNOTSUPP;
+ }
+
+ static inline int pruss_cfg_xfr_enable(struct pruss *pruss,
+ enum pru_type pru_type,
+- bool enable);
++ bool enable)
+ {
+- return ERR_PTR(-EOPNOTSUPP);
++ return -EOPNOTSUPP;
+ }
+
+ #endif /* CONFIG_TI_PRUSS */
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
