--- /dev/null
+From 8efebd93b0da791aafeaf31148bc699c7352531c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 20:42:44 -0700
+Subject: net: dsa: bcm_sf2: Fix node reference count
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 8dbe4c5d5e40fe140221024f7b16bec9f310bf70 ]
+
+of_find_node_by_name() will do an of_node_put() on the "from" argument.
+With CONFIG_OF_DYNAMIC enabled which checks for device_node reference
+counts, we would be getting a warning like this:
+
+[ 6.347230] refcount_t: increment on 0; use-after-free.
+[ 6.352498] WARNING: CPU: 3 PID: 77 at lib/refcount.c:156
+refcount_inc_checked+0x38/0x44
+[ 6.360601] Modules linked in:
+[ 6.363661] CPU: 3 PID: 77 Comm: kworker/3:1 Tainted: G W
+5.4.46-gb78b3e9956e6 #13
+[ 6.372546] Hardware name: BCM97278SV (DT)
+[ 6.376649] Workqueue: events deferred_probe_work_func
+[ 6.381796] pstate: 60000005 (nZCv daif -PAN -UAO)
+[ 6.386595] pc : refcount_inc_checked+0x38/0x44
+[ 6.391133] lr : refcount_inc_checked+0x38/0x44
+...
+[ 6.478791] Call trace:
+[ 6.481243] refcount_inc_checked+0x38/0x44
+[ 6.485433] kobject_get+0x3c/0x4c
+[ 6.488840] of_node_get+0x24/0x34
+[ 6.492247] of_irq_find_parent+0x3c/0xe0
+[ 6.496263] of_irq_parse_one+0xe4/0x1d0
+[ 6.500191] irq_of_parse_and_map+0x44/0x84
+[ 6.504381] bcm_sf2_sw_probe+0x22c/0x844
+[ 6.508397] platform_drv_probe+0x58/0xa8
+[ 6.512413] really_probe+0x238/0x3fc
+[ 6.516081] driver_probe_device+0x11c/0x12c
+[ 6.520358] __device_attach_driver+0xa8/0x100
+[ 6.524808] bus_for_each_drv+0xb4/0xd0
+[ 6.528650] __device_attach+0xd0/0x164
+[ 6.532493] device_initial_probe+0x24/0x30
+[ 6.536682] bus_probe_device+0x38/0x98
+[ 6.540524] deferred_probe_work_func+0xa8/0xd4
+[ 6.545061] process_one_work+0x178/0x288
+[ 6.549078] process_scheduled_works+0x44/0x48
+[ 6.553529] worker_thread+0x218/0x270
+[ 6.557285] kthread+0xdc/0xe4
+[ 6.560344] ret_from_fork+0x10/0x18
+[ 6.563925] ---[ end trace 68f65caf69bb152a ]---
+
+Fix this by adding a of_node_get() to increment the reference count
+prior to the call.
+
+Fixes: afa3b592953b ("net: dsa: bcm_sf2: Ensure correct sub-node is parsed")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index ccba648452c42..c0bba680d4a88 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -1078,6 +1078,8 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev)
+ set_bit(0, priv->cfp.used);
+ set_bit(0, priv->cfp.unique);
+
++ /* Balance of_node_put() done by of_find_node_by_name() */
++ of_node_get(dn);
+ ports = of_find_node_by_name(dn, "ports");
+ if (ports) {
+ bcm_sf2_identify_ports(priv, ports);
+--
+2.25.1
+
--- /dev/null
+From f4edf75fcc0eea0340cede54b98f58023a3a8a0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 11:47:46 -0700
+Subject: of: of_mdio: Correct loop scanning logic
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 5a8d7f126c97d04d893f5e5be2b286437a0d01b0 ]
+
+Commit 209c65b61d94 ("drivers/of/of_mdio.c:fix of_mdiobus_register()")
+introduced a break of the loop on the premise that a successful
+registration should exit the loop. The premise is correct but not to
+code, because rc && rc != -ENODEV is just a special error condition,
+that means we would exit the loop even with rc == -ENODEV which is
+absolutely not correct since this is the error code to indicate to the
+MDIO bus layer that scanning should continue.
+
+Fix this by explicitly checking for rc = 0 as the only valid condition
+to break out of the loop.
+
+Fixes: 209c65b61d94 ("drivers/of/of_mdio.c:fix of_mdiobus_register()")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/of_mdio.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
+index af7572fe090fd..100adacfdca94 100644
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -267,10 +267,15 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
+ child, addr);
+
+ if (of_mdiobus_child_is_phy(child)) {
++ /* -ENODEV is the return code that PHYLIB has
++ * standardized on to indicate that bus
++ * scanning should continue.
++ */
+ rc = of_mdiobus_register_phy(mdio, child, addr);
+- if (rc && rc != -ENODEV)
++ if (!rc)
++ break;
++ if (rc != -ENODEV)
+ goto unregister;
+- break;
+ }
+ }
+ }
+--
+2.25.1
+
iio-humidity-hts221-fix-alignment-and-data-leak-issues.patch
iio-pressure-ms5611-fix-buffer-element-alignment.patch
iio-health-afe4403-fix-timestamp-alignment-and-prevent-data-leak.patch
+spi-fix-initial-spi_sr-value-in-spi-fsl-dspi.patch
+spi-spi-fsl-dspi-fix-lockup-if-device-is-shutdown-du.patch
+net-dsa-bcm_sf2-fix-node-reference-count.patch
+of-of_mdio-correct-loop-scanning-logic.patch
--- /dev/null
+From e2785760185d9867d7a05635e47f062d9b2fd187 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 22:45:06 +0100
+Subject: spi: fix initial SPI_SR value in spi-fsl-dspi
+
+From: Angelo Dureghello <angelo@sysam.it>
+
+[ Upstream commit aa54c1c9d90e6db75190813907190fadcce1bf45 ]
+
+On ColdFire mcf54418, using DSPI_DMA_MODE mode, spi transfers
+at first boot stage are not succeding:
+
+m25p80 spi0.1: unrecognized JEDEC id bytes: 00, 00, 00
+
+The reason is the SPI_SR initial value set by the driver, that
+is not clearing (not setting to 1) the RF_DF flag. After a tour
+on the dspi hw modules that use this driver(Vybrid, ColdFire and
+ls1021a) a better init value for SR register has been set.
+
+Signed-off-by: Angelo Dureghello <angelo@sysam.it>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 2844c9a72a980..1144d022cc582 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -71,7 +71,7 @@
+ #define SPI_SR 0x2c
+ #define SPI_SR_EOQF 0x10000000
+ #define SPI_SR_TCFQF 0x80000000
+-#define SPI_SR_CLEAR 0xdaad0000
++#define SPI_SR_CLEAR 0x9aaf0000
+
+ #define SPI_RSER_TFFFE BIT(25)
+ #define SPI_RSER_TFFFD BIT(24)
+--
+2.25.1
+
--- /dev/null
+From ef822cca591d73d332caa82238a1c69d9b92f3a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jun 2020 13:05:41 +0200
+Subject: spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI
+ transfer
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 3c525b69e8c1a9a6944e976603c7a1a713e728f9 ]
+
+During shutdown, the driver should unregister the SPI controller
+and stop the hardware. Otherwise the dspi_transfer_one_message() could
+wait on completion infinitely.
+
+Additionally, calling spi_unregister_controller() first in device
+shutdown reverse-matches the probe function, where SPI controller is
+registered at the end.
+
+Fixes: dc234825997e ("spi: spi-fsl-dspi: Adding shutdown hook")
+Reported-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200622110543.5035-2-krzk@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 15 +--------------
+ 1 file changed, 1 insertion(+), 14 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 1144d022cc582..43809fad250b6 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -1164,20 +1164,7 @@ static int dspi_remove(struct platform_device *pdev)
+
+ static void dspi_shutdown(struct platform_device *pdev)
+ {
+- struct spi_controller *ctlr = platform_get_drvdata(pdev);
+- struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr);
+-
+- /* Disable RX and TX */
+- regmap_update_bits(dspi->regmap, SPI_MCR,
+- SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF,
+- SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF);
+-
+- /* Stop Running */
+- regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_HALT, SPI_MCR_HALT);
+-
+- dspi_release_dma(dspi);
+- clk_disable_unprepare(dspi->clk);
+- spi_unregister_controller(dspi->master);
++ dspi_remove(pdev);
+ }
+
+ static struct platform_driver fsl_dspi_driver = {
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
