]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.19-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 10 Dec 2020 12:53:40 +0000 (13:53 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 10 Dec 2020 12:53:40 +0000 (13:53 +0100)
added patches:
iommu-amd-set-dte-to-represent-512-irtes.patch
spi-bcm-qspi-fix-use-after-free-on-unbind.patch
spi-bcm2835-fix-use-after-free-on-unbind.patch
spi-bcm2835-release-the-dma-channel-if-probe-fails-after-dma_init.patch
spi-introduce-device-managed-spi-controller-allocation.patch
tracing-fix-userstacktrace-option-for-instances.patch

queue-4.19/iommu-amd-set-dte-to-represent-512-irtes.patch [new file with mode: 0644]
queue-4.19/series
queue-4.19/spi-bcm-qspi-fix-use-after-free-on-unbind.patch [new file with mode: 0644]
queue-4.19/spi-bcm2835-fix-use-after-free-on-unbind.patch [new file with mode: 0644]
queue-4.19/spi-bcm2835-release-the-dma-channel-if-probe-fails-after-dma_init.patch [new file with mode: 0644]
queue-4.19/spi-introduce-device-managed-spi-controller-allocation.patch [new file with mode: 0644]
queue-4.19/tracing-fix-userstacktrace-option-for-instances.patch [new file with mode: 0644]

diff --git a/queue-4.19/iommu-amd-set-dte-to-represent-512-irtes.patch b/queue-4.19/iommu-amd-set-dte-to-represent-512-irtes.patch
new file mode 100644 (file)
index 0000000..e697cad
--- /dev/null
@@ -0,0 +1,37 @@
+From 4165bf015ba9454f45beaad621d16c516d5c5afe Mon Sep 17 00:00:00 2001
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Date: Mon, 7 Dec 2020 03:19:20 -0600
+Subject: iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+commit 4165bf015ba9454f45beaad621d16c516d5c5afe upstream.
+
+According to the AMD IOMMU spec, the commit 73db2fc595f3
+("iommu/amd: Increase interrupt remapping table limit to 512 entries")
+also requires the interrupt table length (IntTabLen) to be set to 9
+(power of 2) in the device table mapping entry (DTE).
+
+Fixes: 73db2fc595f3 ("iommu/amd: Increase interrupt remapping table limit to 512 entries")
+Reported-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Link: https://lore.kernel.org/r/20201207091920.3052-1-suravee.suthikulpanit@amd.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu_types.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -259,7 +259,7 @@
+ #define DTE_IRQ_REMAP_INTCTL_MASK     (0x3ULL << 60)
+ #define DTE_IRQ_TABLE_LEN_MASK        (0xfULL << 1)
+ #define DTE_IRQ_REMAP_INTCTL    (2ULL << 60)
+-#define DTE_IRQ_TABLE_LEN       (8ULL << 1)
++#define DTE_IRQ_TABLE_LEN       (9ULL << 1)
+ #define DTE_IRQ_REMAP_ENABLE    1ULL
+ #define PAGE_MODE_NONE    0x00
index dbb8b94d295d43f94f0303d61e91597ada449fb9..cbe316c72e693c7a7350b1c61cb5cafc96053fe2 100644 (file)
@@ -25,3 +25,9 @@ x86-uprobes-do-not-use-prefixes.nbytes-when-looping-over-prefixes.bytes.patch
 i2c-imx-fix-reset-of-i2sr_ial-flag.patch
 i2c-imx-check-for-i2sr_ial-after-every-byte.patch
 speakup-reject-setting-the-speakup-line-discipline-outside-of-speakup.patch
+iommu-amd-set-dte-to-represent-512-irtes.patch
+spi-introduce-device-managed-spi-controller-allocation.patch
+spi-bcm-qspi-fix-use-after-free-on-unbind.patch
+spi-bcm2835-fix-use-after-free-on-unbind.patch
+spi-bcm2835-release-the-dma-channel-if-probe-fails-after-dma_init.patch
+tracing-fix-userstacktrace-option-for-instances.patch
diff --git a/queue-4.19/spi-bcm-qspi-fix-use-after-free-on-unbind.patch b/queue-4.19/spi-bcm-qspi-fix-use-after-free-on-unbind.patch
new file mode 100644 (file)
index 0000000..bcf789d
--- /dev/null
@@ -0,0 +1,137 @@
+From foo@baz Thu Dec 10 01:39:18 PM CET 2020
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sun, 6 Dec 2020 13:31:01 +0100
+Subject: spi: bcm-qspi: Fix use-after-free on unbind
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.com>
+Cc: Mark Brown <broonie@kernel.org>, Sudip Mukherjee <sudipm.mukherjee@gmail.com>, stable@vger.kernel.org
+Message-ID: <980533a3cb6b69f015f0fbed90c2d2c41d1b1a17.1607257456.git.lukas@wunner.de>
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 63c5395bb7a9777a33f0e7b5906f2c0170a23692 upstream
+
+bcm_qspi_remove() calls spi_unregister_master() even though
+bcm_qspi_probe() calls devm_spi_register_master().  The spi_master is
+therefore unregistered and freed twice on unbind.
+
+Moreover, since commit 0392727c261b ("spi: bcm-qspi: Handle clock probe
+deferral"), bcm_qspi_probe() leaks the spi_master allocation if the call
+to devm_clk_get_optional() fails.
+
+Fix by switching over to the new devm_spi_alloc_master() helper which
+keeps the private data accessible until the driver has unbound and also
+avoids the spi_master leak on probe.
+
+While at it, fix an ordering issue in bcm_qspi_remove() wherein
+spi_unregister_master() is called after uninitializing the hardware,
+disabling the clock and freeing an IRQ data structure.  The correct
+order is to call spi_unregister_master() *before* those teardown steps
+because bus accesses may still be ongoing until that function returns.
+
+Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: <stable@vger.kernel.org> # v4.9+: 123456789abc: spi: Introduce device-managed SPI controller allocation
+Cc: <stable@vger.kernel.org> # v4.9+
+Cc: Kamal Dasu <kdasu.kdev@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Tested-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/5e31a9a59fd1c0d0b795b2fe219f25e5ee855f9d.1605121038.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+[sudip: adjust context]
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-bcm-qspi.c |   34 ++++++++++++----------------------
+ 1 file changed, 12 insertions(+), 22 deletions(-)
+
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -1223,7 +1223,7 @@ int bcm_qspi_probe(struct platform_devic
+       if (!of_match_node(bcm_qspi_of_match, dev->of_node))
+               return -ENODEV;
+-      master = spi_alloc_master(dev, sizeof(struct bcm_qspi));
++      master = devm_spi_alloc_master(dev, sizeof(struct bcm_qspi));
+       if (!master) {
+               dev_err(dev, "error allocating spi_master\n");
+               return -ENOMEM;
+@@ -1257,21 +1257,17 @@ int bcm_qspi_probe(struct platform_devic
+       if (res) {
+               qspi->base[MSPI]  = devm_ioremap_resource(dev, res);
+-              if (IS_ERR(qspi->base[MSPI])) {
+-                      ret = PTR_ERR(qspi->base[MSPI]);
+-                      goto qspi_resource_err;
+-              }
++              if (IS_ERR(qspi->base[MSPI]))
++                      return PTR_ERR(qspi->base[MSPI]);
+       } else {
+-              goto qspi_resource_err;
++              return 0;
+       }
+       res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi");
+       if (res) {
+               qspi->base[BSPI]  = devm_ioremap_resource(dev, res);
+-              if (IS_ERR(qspi->base[BSPI])) {
+-                      ret = PTR_ERR(qspi->base[BSPI]);
+-                      goto qspi_resource_err;
+-              }
++              if (IS_ERR(qspi->base[BSPI]))
++                      return PTR_ERR(qspi->base[BSPI]);
+               qspi->bspi_mode = true;
+       } else {
+               qspi->bspi_mode = false;
+@@ -1282,18 +1278,14 @@ int bcm_qspi_probe(struct platform_devic
+       res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "cs_reg");
+       if (res) {
+               qspi->base[CHIP_SELECT]  = devm_ioremap_resource(dev, res);
+-              if (IS_ERR(qspi->base[CHIP_SELECT])) {
+-                      ret = PTR_ERR(qspi->base[CHIP_SELECT]);
+-                      goto qspi_resource_err;
+-              }
++              if (IS_ERR(qspi->base[CHIP_SELECT]))
++                      return PTR_ERR(qspi->base[CHIP_SELECT]);
+       }
+       qspi->dev_ids = kcalloc(num_irqs, sizeof(struct bcm_qspi_dev_id),
+                               GFP_KERNEL);
+-      if (!qspi->dev_ids) {
+-              ret = -ENOMEM;
+-              goto qspi_resource_err;
+-      }
++      if (!qspi->dev_ids)
++              return -ENOMEM;
+       for (val = 0; val < num_irqs; val++) {
+               irq = -1;
+@@ -1369,7 +1361,7 @@ int bcm_qspi_probe(struct platform_devic
+       qspi->xfer_mode.addrlen = -1;
+       qspi->xfer_mode.hp = -1;
+-      ret = devm_spi_register_master(&pdev->dev, master);
++      ret = spi_register_master(master);
+       if (ret < 0) {
+               dev_err(dev, "can't register master\n");
+               goto qspi_reg_err;
+@@ -1382,8 +1374,6 @@ qspi_reg_err:
+       clk_disable_unprepare(qspi->clk);
+ qspi_probe_err:
+       kfree(qspi->dev_ids);
+-qspi_resource_err:
+-      spi_master_put(master);
+       return ret;
+ }
+ /* probe function to be called by SoC specific platform driver probe */
+@@ -1393,10 +1383,10 @@ int bcm_qspi_remove(struct platform_devi
+ {
+       struct bcm_qspi *qspi = platform_get_drvdata(pdev);
++      spi_unregister_master(qspi->master);
+       bcm_qspi_hw_uninit(qspi);
+       clk_disable_unprepare(qspi->clk);
+       kfree(qspi->dev_ids);
+-      spi_unregister_master(qspi->master);
+       return 0;
+ }
diff --git a/queue-4.19/spi-bcm2835-fix-use-after-free-on-unbind.patch b/queue-4.19/spi-bcm2835-fix-use-after-free-on-unbind.patch
new file mode 100644 (file)
index 0000000..5ec4a0a
--- /dev/null
@@ -0,0 +1,83 @@
+From foo@baz Thu Dec 10 01:39:18 PM CET 2020
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sun, 6 Dec 2020 13:31:02 +0100
+Subject: spi: bcm2835: Fix use-after-free on unbind
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.com>
+Cc: Mark Brown <broonie@kernel.org>, Sudip Mukherjee <sudipm.mukherjee@gmail.com>, stable@vger.kernel.org
+Message-ID: <f6c34667a758bd6f4096b37936958dc0c9faa47a.1607257456.git.lukas@wunner.de>
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit e1483ac030fb4c57734289742f1c1d38dca61e22 ]
+
+bcm2835_spi_remove() accesses the driver's private data after calling
+spi_unregister_controller() even though that function releases the last
+reference on the spi_controller and thereby frees the private data.
+
+Fix by switching over to the new devm_spi_alloc_master() helper which
+keeps the private data accessible until the driver has unbound.
+
+Fixes: f8043872e796 ("spi: add driver for BCM2835")
+Reported-by: Sascha Hauer <s.hauer@pengutronix.de>
+Reported-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: <stable@vger.kernel.org> # v3.10+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
+Cc: <stable@vger.kernel.org> # v3.10+
+Cc: Vladimir Oltean <olteanv@gmail.com>
+Tested-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/ad66e0a0ad96feb848814842ecf5b6a4539ef35c.1605121038.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-bcm2835.c |   15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -737,7 +737,7 @@ static int bcm2835_spi_probe(struct plat
+       struct resource *res;
+       int err;
+-      master = spi_alloc_master(&pdev->dev, sizeof(*bs));
++      master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
+       if (!master) {
+               dev_err(&pdev->dev, "spi_alloc_master() failed\n");
+               return -ENOMEM;
+@@ -759,23 +759,20 @@ static int bcm2835_spi_probe(struct plat
+       res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+       bs->regs = devm_ioremap_resource(&pdev->dev, res);
+-      if (IS_ERR(bs->regs)) {
+-              err = PTR_ERR(bs->regs);
+-              goto out_master_put;
+-      }
++      if (IS_ERR(bs->regs))
++              return PTR_ERR(bs->regs);
+       bs->clk = devm_clk_get(&pdev->dev, NULL);
+       if (IS_ERR(bs->clk)) {
+               err = PTR_ERR(bs->clk);
+               dev_err(&pdev->dev, "could not get clk: %d\n", err);
+-              goto out_master_put;
++              return err;
+       }
+       bs->irq = platform_get_irq(pdev, 0);
+       if (bs->irq <= 0) {
+               dev_err(&pdev->dev, "could not get IRQ: %d\n", bs->irq);
+-              err = bs->irq ? bs->irq : -ENODEV;
+-              goto out_master_put;
++              return bs->irq ? bs->irq : -ENODEV;
+       }
+       clk_prepare_enable(bs->clk);
+@@ -803,8 +800,6 @@ static int bcm2835_spi_probe(struct plat
+ out_clk_disable:
+       clk_disable_unprepare(bs->clk);
+-out_master_put:
+-      spi_master_put(master);
+       return err;
+ }
diff --git a/queue-4.19/spi-bcm2835-release-the-dma-channel-if-probe-fails-after-dma_init.patch b/queue-4.19/spi-bcm2835-release-the-dma-channel-if-probe-fails-after-dma_init.patch
new file mode 100644 (file)
index 0000000..546021c
--- /dev/null
@@ -0,0 +1,51 @@
+From foo@baz Thu Dec 10 01:39:18 PM CET 2020
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sun, 6 Dec 2020 13:31:04 +0100
+Subject: spi: bcm2835: Release the DMA channel if probe fails after dma_init
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.com>
+Cc: Mark Brown <broonie@kernel.org>, Sudip Mukherjee <sudipm.mukherjee@gmail.com>, stable@vger.kernel.org
+Message-ID: <a8bee87930a86d39aded59970c4d808692df4f45.1607257456.git.lukas@wunner.de>
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit 666224b43b4bd4612ce3b758c038f9bc5c5e3fcb ]
+
+The DMA channel was not released if either devm_request_irq() or
+devm_spi_register_controller() failed.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Link: https://lore.kernel.org/r/20191212135550.4634-3-peter.ujfalusi@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+[lukas: backport to 4.19-stable]
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-bcm2835.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -787,18 +787,19 @@ static int bcm2835_spi_probe(struct plat
+                              dev_name(&pdev->dev), master);
+       if (err) {
+               dev_err(&pdev->dev, "could not request IRQ: %d\n", err);
+-              goto out_clk_disable;
++              goto out_dma_release;
+       }
+       err = spi_register_master(master);
+       if (err) {
+               dev_err(&pdev->dev, "could not register SPI master: %d\n", err);
+-              goto out_clk_disable;
++              goto out_dma_release;
+       }
+       return 0;
+-out_clk_disable:
++out_dma_release:
++      bcm2835_dma_release(master);
+       clk_disable_unprepare(bs->clk);
+       return err;
+ }
diff --git a/queue-4.19/spi-introduce-device-managed-spi-controller-allocation.patch b/queue-4.19/spi-introduce-device-managed-spi-controller-allocation.patch
new file mode 100644 (file)
index 0000000..1669244
--- /dev/null
@@ -0,0 +1,170 @@
+From foo@baz Thu Dec 10 01:39:18 PM CET 2020
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sun, 6 Dec 2020 13:31:00 +0100
+Subject: spi: Introduce device-managed SPI controller allocation
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.com>
+Cc: Mark Brown <broonie@kernel.org>, Sudip Mukherjee <sudipm.mukherjee@gmail.com>, stable@vger.kernel.org
+Message-ID: <70e63c9a7ed172e15b9d1fe82d44603ea9c76288.1607257456.git.lukas@wunner.de>
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit 5e844cc37a5cbaa460e68f9a989d321d63088a89 ]
+
+SPI driver probing currently comprises two steps, whereas removal
+comprises only one step:
+
+    spi_alloc_master()
+    spi_register_controller()
+
+    spi_unregister_controller()
+
+That's because spi_unregister_controller() calls device_unregister()
+instead of device_del(), thereby releasing the reference on the
+spi_controller which was obtained by spi_alloc_master().
+
+An SPI driver's private data is contained in the same memory allocation
+as the spi_controller struct.  Thus, once spi_unregister_controller()
+has been called, the private data is inaccessible.  But some drivers
+need to access it after spi_unregister_controller() to perform further
+teardown steps.
+
+Introduce devm_spi_alloc_master() and devm_spi_alloc_slave(), which
+release a reference on the spi_controller struct only after the driver
+has unbound, thereby keeping the memory allocation accessible.  Change
+spi_unregister_controller() to not release a reference if the
+spi_controller was allocated by one of these new devm functions.
+
+The present commit is small enough to be backportable to stable.
+It allows fixing drivers which use the private data in their ->remove()
+hook after it's been freed.  It also allows fixing drivers which neglect
+to release a reference on the spi_controller in the probe error path.
+
+Long-term, most SPI drivers shall be moved over to the devm functions
+introduced herein.  The few that can't shall be changed in a treewide
+commit to explicitly release the last reference on the controller.
+That commit shall amend spi_unregister_controller() to no longer release
+a reference, thereby completing the migration.
+
+As a result, the behaviour will be less surprising and more consistent
+with subsystems such as IIO, which also includes the private data in the
+allocation of the generic iio_dev struct, but calls device_del() in
+iio_device_unregister().
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Link: https://lore.kernel.org/r/272bae2ef08abd21388c98e23729886663d19192.1605121038.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi.c       |   58 +++++++++++++++++++++++++++++++++++++++++++++++-
+ include/linux/spi/spi.h |   19 +++++++++++++++
+ 2 files changed, 76 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2050,6 +2050,49 @@ struct spi_controller *__spi_alloc_contr
+ }
+ EXPORT_SYMBOL_GPL(__spi_alloc_controller);
++static void devm_spi_release_controller(struct device *dev, void *ctlr)
++{
++      spi_controller_put(*(struct spi_controller **)ctlr);
++}
++
++/**
++ * __devm_spi_alloc_controller - resource-managed __spi_alloc_controller()
++ * @dev: physical device of SPI controller
++ * @size: how much zeroed driver-private data to allocate
++ * @slave: whether to allocate an SPI master (false) or SPI slave (true)
++ * Context: can sleep
++ *
++ * Allocate an SPI controller and automatically release a reference on it
++ * when @dev is unbound from its driver.  Drivers are thus relieved from
++ * having to call spi_controller_put().
++ *
++ * The arguments to this function are identical to __spi_alloc_controller().
++ *
++ * Return: the SPI controller structure on success, else NULL.
++ */
++struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
++                                                 unsigned int size,
++                                                 bool slave)
++{
++      struct spi_controller **ptr, *ctlr;
++
++      ptr = devres_alloc(devm_spi_release_controller, sizeof(*ptr),
++                         GFP_KERNEL);
++      if (!ptr)
++              return NULL;
++
++      ctlr = __spi_alloc_controller(dev, size, slave);
++      if (ctlr) {
++              *ptr = ctlr;
++              devres_add(dev, ptr);
++      } else {
++              devres_free(ptr);
++      }
++
++      return ctlr;
++}
++EXPORT_SYMBOL_GPL(__devm_spi_alloc_controller);
++
+ #ifdef CONFIG_OF
+ static int of_spi_register_master(struct spi_controller *ctlr)
+ {
+@@ -2300,6 +2343,11 @@ int devm_spi_register_controller(struct
+ }
+ EXPORT_SYMBOL_GPL(devm_spi_register_controller);
++static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr)
++{
++      return *(struct spi_controller **)res == ctlr;
++}
++
+ static int __unregister(struct device *dev, void *null)
+ {
+       spi_unregister_device(to_spi_device(dev));
+@@ -2341,7 +2389,15 @@ void spi_unregister_controller(struct sp
+       list_del(&ctlr->list);
+       mutex_unlock(&board_lock);
+-      device_unregister(&ctlr->dev);
++      device_del(&ctlr->dev);
++
++      /* Release the last reference on the controller if its driver
++       * has not yet been converted to devm_spi_alloc_master/slave().
++       */
++      if (!devres_find(ctlr->dev.parent, devm_spi_release_controller,
++                       devm_spi_match_controller, ctlr))
++              put_device(&ctlr->dev);
++
+       /* free bus id */
+       mutex_lock(&board_lock);
+       if (found == ctlr)
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -634,6 +634,25 @@ static inline struct spi_controller *spi
+       return __spi_alloc_controller(host, size, true);
+ }
++struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
++                                                 unsigned int size,
++                                                 bool slave);
++
++static inline struct spi_controller *devm_spi_alloc_master(struct device *dev,
++                                                         unsigned int size)
++{
++      return __devm_spi_alloc_controller(dev, size, false);
++}
++
++static inline struct spi_controller *devm_spi_alloc_slave(struct device *dev,
++                                                        unsigned int size)
++{
++      if (!IS_ENABLED(CONFIG_SPI_SLAVE))
++              return NULL;
++
++      return __devm_spi_alloc_controller(dev, size, true);
++}
++
+ extern int spi_register_controller(struct spi_controller *ctlr);
+ extern int devm_spi_register_controller(struct device *dev,
+                                       struct spi_controller *ctlr);
diff --git a/queue-4.19/tracing-fix-userstacktrace-option-for-instances.patch b/queue-4.19/tracing-fix-userstacktrace-option-for-instances.patch
new file mode 100644 (file)
index 0000000..2e53ed0
--- /dev/null
@@ -0,0 +1,73 @@
+From bcee5278958802b40ee8b26679155a6d9231783e Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Fri, 4 Dec 2020 16:36:16 -0500
+Subject: tracing: Fix userstacktrace option for instances
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+commit bcee5278958802b40ee8b26679155a6d9231783e upstream.
+
+When the instances were able to use their own options, the userstacktrace
+option was left hardcoded for the top level. This made the instance
+userstacktrace option bascially into a nop, and will confuse users that set
+it, but nothing happens (I was confused when it happened to me!)
+
+Cc: stable@vger.kernel.org
+Fixes: 16270145ce6b ("tracing: Add trace options for core options to instances")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace.c |    7 ++++---
+ kernel/trace/trace.h |    6 ++++--
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2416,7 +2416,7 @@ void trace_buffer_unlock_commit_regs(str
+        * two. They are not that meaningful.
+        */
+       ftrace_trace_stack(tr, buffer, flags, regs ? 0 : STACK_SKIP, pc, regs);
+-      ftrace_trace_userstack(buffer, flags, pc);
++      ftrace_trace_userstack(tr, buffer, flags, pc);
+ }
+ /*
+@@ -2736,14 +2736,15 @@ void trace_dump_stack(int skip)
+ static DEFINE_PER_CPU(int, user_stack_count);
+ void
+-ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
++ftrace_trace_userstack(struct trace_array *tr,
++                     struct ring_buffer *buffer, unsigned long flags, int pc)
+ {
+       struct trace_event_call *call = &event_user_stack;
+       struct ring_buffer_event *event;
+       struct userstack_entry *entry;
+       struct stack_trace trace;
+-      if (!(global_trace.trace_flags & TRACE_ITER_USERSTACKTRACE))
++      if (!(tr->trace_flags & TRACE_ITER_USERSTACKTRACE))
+               return;
+       /*
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -745,13 +745,15 @@ void update_max_tr_single(struct trace_a
+ #endif /* CONFIG_TRACER_MAX_TRACE */
+ #ifdef CONFIG_STACKTRACE
+-void ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags,
++void ftrace_trace_userstack(struct trace_array *tr,
++                          struct ring_buffer *buffer, unsigned long flags,
+                           int pc);
+ void __trace_stack(struct trace_array *tr, unsigned long flags, int skip,
+                  int pc);
+ #else
+-static inline void ftrace_trace_userstack(struct ring_buffer *buffer,
++static inline void ftrace_trace_userstack(struct trace_array *tr,
++                                        struct ring_buffer *buffer,
+                                         unsigned long flags, int pc)
+ {
+ }