--- /dev/null
+From 76b72065d7489c1e7f1d2839ac603005c9ba75ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2020 12:12:26 +0000
+Subject: arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit 5afc78551bf5d53279036e0bf63314e35631d79f ]
+
+Rather than open-code test_tsk_thread_flag() at each callsite, simply
+replace the couple of offenders with calls to test_tsk_thread_flag()
+directly.
+
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/debug-monitors.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index db7ed460a5476..2ccd0a99d8b35 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -389,14 +389,14 @@ void user_rewind_single_step(struct task_struct *task)
+ * If single step is active for this thread, then set SPSR.SS
+ * to 1 to avoid returning to the active-pending state.
+ */
+- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
+ set_regs_spsr_ss(task_pt_regs(task));
+ }
+ NOKPROBE_SYMBOL(user_rewind_single_step);
+
+ void user_fastforward_single_step(struct task_struct *task)
+ {
+- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
+ clear_regs_spsr_ss(task_pt_regs(task));
+ }
+
+--
+2.25.1
+
--- /dev/null
+From e11bb9b76ebd117b110f5e969e1207333bef2627 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jul 2020 09:59:31 -0400
+Subject: ax88172a: fix ax88172a_unbind() failures
+
+From: George Kennedy <george.kennedy@oracle.com>
+
+[ Upstream commit c28d9a285668c799eeae2f7f93e929a6028a4d6d ]
+
+If ax88172a_unbind() fails, make sure that the return code is
+less than zero so that cleanup is done properly and avoid UAF.
+
+Fixes: a9a51bd727d1 ("ax88172a: fix information leak on short answers")
+Signed-off-by: George Kennedy <george.kennedy@oracle.com>
+Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/ax88172a.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
+index 914cac55a7ae7..909755ef71ac3 100644
+--- a/drivers/net/usb/ax88172a.c
++++ b/drivers/net/usb/ax88172a.c
+@@ -210,6 +210,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
+ ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);
+ if (ret < ETH_ALEN) {
+ netdev_err(dev->net, "Failed to read MAC address: %d\n", ret);
++ ret = -EIO;
+ goto free;
+ }
+ memcpy(dev->net->dev_addr, buf, ETH_ALEN);
+--
+2.25.1
+
--- /dev/null
+From bae4225b671e4192edef0e3b0cee8483e45f6bed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jul 2020 20:48:23 -0400
+Subject: bnxt_en: Fix race when modifying pause settings.
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit 163e9ef63641a02de4c95cd921577265c52e1ce2 ]
+
+The driver was modified to not rely on rtnl lock to protect link
+settings about 2 years ago. The pause setting was missed when
+making that change. Fix it by acquiring link_lock mutex before
+calling bnxt_hwrm_set_pause().
+
+Fixes: e2dc9b6e38fa ("bnxt_en: Don't use rtnl lock to protect link change logic in workqueue.")
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 3c78cd1cdd6fb..6edbbfc1709a2 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1287,8 +1287,11 @@ static int bnxt_set_pauseparam(struct net_device *dev,
+ if (epause->tx_pause)
+ link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX;
+
+- if (netif_running(dev))
++ if (netif_running(dev)) {
++ mutex_lock(&bp->link_lock);
+ rc = bnxt_hwrm_set_pause(bp);
++ mutex_unlock(&bp->link_lock);
++ }
+ return rc;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From f1dfe7c4b3262b8413d28b7833679f638e0cdbad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Jul 2020 12:11:24 +0000
+Subject: bonding: check error value of register_netdevice() immediately
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit 544f287b84959203367cd29e16e772717612fab4 ]
+
+If register_netdevice() is failed, net_device should not be used
+because variables are uninitialized or freed.
+So, the routine should be stopped immediately.
+But, bond_create() doesn't check return value of register_netdevice()
+immediately. That will result in a panic because of using uninitialized
+or freed memory.
+
+Test commands:
+ modprobe netdev-notifier-error-inject
+ echo -22 > /sys/kernel/debug/notifier-error-inject/netdev/\
+actions/NETDEV_REGISTER/error
+ modprobe bonding max_bonds=3
+
+Splat looks like:
+[ 375.028492][ T193] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
+[ 375.033207][ T193] CPU: 2 PID: 193 Comm: kworker/2:2 Not tainted 5.8.0-rc4+ #645
+[ 375.036068][ T193] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+[ 375.039673][ T193] Workqueue: events linkwatch_event
+[ 375.041557][ T193] RIP: 0010:dev_activate+0x4a/0x340
+[ 375.043381][ T193] Code: 40 a8 04 0f 85 db 00 00 00 8b 83 08 04 00 00 85 c0 0f 84 0d 01 00 00 31 d2 89 d0 48 8d 04 40 48 c1 e0 07 48 03 83 00 04 00 00 <48> 8b 48 10 f6 41 10 01 75 08 f0 80 a1 a0 01 00 00 fd 48 89 48 08
+[ 375.050267][ T193] RSP: 0018:ffff9f8facfcfdd8 EFLAGS: 00010202
+[ 375.052410][ T193] RAX: 6b6b6b6b6b6b6b6b RBX: ffff9f8fae6ea000 RCX: 0000000000000006
+[ 375.055178][ T193] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f8fae6ea000
+[ 375.057762][ T193] RBP: ffff9f8fae6ea000 R08: 0000000000000000 R09: 0000000000000000
+[ 375.059810][ T193] R10: 0000000000000001 R11: 0000000000000000 R12: ffff9f8facfcfe08
+[ 375.061892][ T193] R13: ffffffff883587e0 R14: 0000000000000000 R15: ffff9f8fae6ea580
+[ 375.063931][ T193] FS: 0000000000000000(0000) GS:ffff9f8fbae00000(0000) knlGS:0000000000000000
+[ 375.066239][ T193] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 375.067841][ T193] CR2: 00007f2f542167a0 CR3: 000000012cee6002 CR4: 00000000003606e0
+[ 375.069657][ T193] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 375.071471][ T193] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 375.073269][ T193] Call Trace:
+[ 375.074005][ T193] linkwatch_do_dev+0x4d/0x50
+[ 375.075052][ T193] __linkwatch_run_queue+0x10b/0x200
+[ 375.076244][ T193] linkwatch_event+0x21/0x30
+[ 375.077274][ T193] process_one_work+0x252/0x600
+[ 375.078379][ T193] ? process_one_work+0x600/0x600
+[ 375.079518][ T193] worker_thread+0x3c/0x380
+[ 375.080534][ T193] ? process_one_work+0x600/0x600
+[ 375.081668][ T193] kthread+0x139/0x150
+[ 375.082567][ T193] ? kthread_park+0x90/0x90
+[ 375.083567][ T193] ret_from_fork+0x22/0x30
+
+Fixes: e826eafa65c6 ("bonding: Call netif_carrier_off after register_netdevice")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_main.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index fef599eb822b6..1f867e275408e 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4773,15 +4773,19 @@ int bond_create(struct net *net, const char *name)
+ bond_dev->rtnl_link_ops = &bond_link_ops;
+
+ res = register_netdevice(bond_dev);
++ if (res < 0) {
++ free_netdev(bond_dev);
++ rtnl_unlock();
++
++ return res;
++ }
+
+ netif_carrier_off(bond_dev);
+
+ bond_work_init_all(bond);
+
+ rtnl_unlock();
+- if (res < 0)
+- free_netdev(bond_dev);
+- return res;
++ return 0;
+ }
+
+ static int __net_init bond_net_init(struct net *net)
+--
+2.25.1
+
--- /dev/null
+From a1342080f993690d62ef57779dee821c8ad4b40e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 16:31:54 -0700
+Subject: bonding: check return value of register_netdevice() in bond_newlink()
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+[ Upstream commit c75d1d5248c0c97996051809ad0e9f154ba5d76e ]
+
+Very similar to commit 544f287b8495
+("bonding: check error value of register_netdevice() immediately"),
+we should immediately check the return value of register_netdevice()
+before doing anything else.
+
+Fixes: 005db31d5f5f ("bonding: set carrier off for devices created through netlink")
+Reported-and-tested-by: syzbot+bbc3a11c4da63c1b74d6@syzkaller.appspotmail.com
+Cc: Beniamino Galvani <bgalvani@redhat.com>
+Cc: Taehee Yoo <ap420073@gmail.com>
+Cc: Jay Vosburgh <j.vosburgh@gmail.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_netlink.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
+index 77babf1417a7e..0e95eeb822ea5 100644
+--- a/drivers/net/bonding/bond_netlink.c
++++ b/drivers/net/bonding/bond_netlink.c
+@@ -451,11 +451,10 @@ static int bond_newlink(struct net *src_net, struct net_device *bond_dev,
+ return err;
+
+ err = register_netdevice(bond_dev);
+-
+- netif_carrier_off(bond_dev);
+ if (!err) {
+ struct bonding *bond = netdev_priv(bond_dev);
+
++ netif_carrier_off(bond_dev);
+ bond_work_init_all(bond);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From cbbb54f52702acff48e52214259d40ec3a6d58e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jul 2020 21:48:12 +0300
+Subject: dmaengine: ioat setting ioat timeout as module parameter
+
+From: Leonid Ravich <Leonid.Ravich@emc.com>
+
+[ Upstream commit 87730ccbddcb48478b1b88e88b14e73424130764 ]
+
+DMA transaction time to completion is a function of PCI bandwidth,
+transaction size and a queue depth. So hard coded value for timeouts
+might be wrong for some scenarios.
+
+Signed-off-by: Leonid Ravich <Leonid.Ravich@emc.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/20200701184816.29138-1-leonid.ravich@dell.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ioat/dma.c | 12 ++++++++++++
+ drivers/dma/ioat/dma.h | 2 --
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
+index e3899ae429e0f..4c2b41beaf638 100644
+--- a/drivers/dma/ioat/dma.c
++++ b/drivers/dma/ioat/dma.c
+@@ -38,6 +38,18 @@
+
+ #include "../dmaengine.h"
+
++int completion_timeout = 200;
++module_param(completion_timeout, int, 0644);
++MODULE_PARM_DESC(completion_timeout,
++ "set ioat completion timeout [msec] (default 200 [msec])");
++int idle_timeout = 2000;
++module_param(idle_timeout, int, 0644);
++MODULE_PARM_DESC(idle_timeout,
++ "set ioat idel timeout [msec] (default 2000 [msec])");
++
++#define IDLE_TIMEOUT msecs_to_jiffies(idle_timeout)
++#define COMPLETION_TIMEOUT msecs_to_jiffies(completion_timeout)
++
+ static char *chanerr_str[] = {
+ "DMA Transfer Source Address Error",
+ "DMA Transfer Destination Address Error",
+diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
+index 56200eefcf5ee..01f9299572303 100644
+--- a/drivers/dma/ioat/dma.h
++++ b/drivers/dma/ioat/dma.h
+@@ -111,8 +111,6 @@ struct ioatdma_chan {
+ #define IOAT_RUN 5
+ #define IOAT_CHAN_ACTIVE 6
+ struct timer_list timer;
+- #define COMPLETION_TIMEOUT msecs_to_jiffies(100)
+- #define IDLE_TIMEOUT msecs_to_jiffies(2000)
+ #define RESET_DELAY msecs_to_jiffies(100)
+ struct ioatdma_device *ioat_dma;
+ dma_addr_t completion_dma;
+--
+2.25.1
+
--- /dev/null
+From 877b52dda83751e3d7c4fc2a333169341e6cb4be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 14:46:26 +0800
+Subject: dmaengine: tegra210-adma: Fix runtime PM imbalance on error
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 5b78fac4b1ba731cf4177fdbc1e3a4661521bcd0 ]
+
+pm_runtime_get_sync() increments the runtime PM usage counter even
+when it returns an error code. Thus a pairing decrement is needed on
+the error handling path to keep the counter balanced.
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20200624064626.19855-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/tegra210-adma.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index 045351f3549c1..86b45198fb962 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -583,6 +583,7 @@ static int tegra_adma_alloc_chan_resources(struct dma_chan *dc)
+
+ ret = pm_runtime_get_sync(tdc2dev(tdc));
+ if (ret < 0) {
++ pm_runtime_put_noidle(tdc2dev(tdc));
+ free_irq(tdc->irq, tdc);
+ return ret;
+ }
+@@ -764,8 +765,10 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ pm_runtime_enable(&pdev->dev);
+
+ ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(&pdev->dev);
+ goto rpm_disable;
++ }
+
+ ret = tegra_adma_init(tdma);
+ if (ret)
+--
+2.25.1
+
--- /dev/null
+From 70e6eab2a0cf10c6842d36dc340d741b317cc67d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jul 2020 09:10:30 +0800
+Subject: drm: sun4i: hdmi: Fix inverted HPD result
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit baa1841eb797eadce6c907bdaed7cd6f01815404 ]
+
+When the extra HPD polling in sun4i_hdmi was removed, the result of
+HPD was accidentally inverted.
+
+Fix this by inverting the check.
+
+Fixes: bda8eaa6dee7 ("drm: sun4i: hdmi: Remove extra HPD polling")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Mans Rullgard <mans@mansr.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200711011030.21997-1-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+index 82cb939351889..c9f1a8cd5f2ac 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+@@ -215,7 +215,7 @@ sun4i_hdmi_connector_detect(struct drm_connector *connector, bool force)
+ unsigned long reg;
+
+ reg = readl(hdmi->base + SUN4I_HDMI_HPD_REG);
+- if (reg & SUN4I_HDMI_HPD_HIGH) {
++ if (!(reg & SUN4I_HDMI_HPD_HIGH)) {
+ cec_phys_addr_invalidate(hdmi->cec_adap);
+ return connector_status_disconnected;
+ }
+--
+2.25.1
+
--- /dev/null
+From 5cb2efd010ee091af70132ee0e4aba4f948adeb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Jun 2020 14:32:29 +0200
+Subject: HID: apple: Disable Fn-key key-re-mapping on clone keyboards
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a5d81646fa294eed57786a9310b06ca48902adf8 ]
+
+The Maxxter KB-BT-001 Bluetooth keyboard, which looks somewhat like the
+Apple Wireless Keyboard, is using the vendor and product IDs (05AC:0239)
+of the Apple Wireless Keyboard (2009 ANSI version) <sigh>.
+
+But its F1 - F10 keys are marked as sending F1 - F10, not the special
+functions hid-apple.c maps them too; and since its descriptors do not
+contain the HID_UP_CUSTOM | 0x0003 usage apple-hid looks for for the
+Fn-key, apple_setup_input() never gets called, so F1 - F6 are mapped
+to key-codes which have not been set in the keybit array causing them
+to not send any events at all.
+
+The lack of a usage code matching the Fn key in the clone is actually
+useful as this allows solving this problem in a generic way.
+
+This commits adds a fn_found flag and it adds a input_configured
+callback which checks if this flag is set once all usages have been
+mapped. If it is not set, then assume this is a clone and clear the
+quirks bitmap so that the hid-apple code does not add any special
+handling to this keyboard.
+
+This fixes F1 - F6 not sending anything at all and F7 - F12 sending
+the wrong codes on the Maxxter KB-BT-001 Bluetooth keyboard and on
+similar clones.
+
+Cc: Joao Moreno <mail@joaomoreno.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 8ab8f2350bbcd..b58ab769aa7b3 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -57,6 +57,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\")
+ struct apple_sc {
+ unsigned long quirks;
+ unsigned int fn_on;
++ unsigned int fn_found;
+ DECLARE_BITMAP(pressed_numlock, KEY_CNT);
+ };
+
+@@ -342,12 +343,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ struct hid_field *field, struct hid_usage *usage,
+ unsigned long **bit, int *max)
+ {
++ struct apple_sc *asc = hid_get_drvdata(hdev);
++
+ if (usage->hid == (HID_UP_CUSTOM | 0x0003) ||
+ usage->hid == (HID_UP_MSVENDOR | 0x0003) ||
+ usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) {
+ /* The fn key on Apple USB keyboards */
+ set_bit(EV_REP, hi->input->evbit);
+ hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN);
++ asc->fn_found = true;
+ apple_setup_input(hi->input);
+ return 1;
+ }
+@@ -374,6 +378,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ return 0;
+ }
+
++static int apple_input_configured(struct hid_device *hdev,
++ struct hid_input *hidinput)
++{
++ struct apple_sc *asc = hid_get_drvdata(hdev);
++
++ if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) {
++ hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n");
++ asc->quirks = 0;
++ }
++
++ return 0;
++}
++
+ static int apple_probe(struct hid_device *hdev,
+ const struct hid_device_id *id)
+ {
+@@ -588,6 +605,7 @@ static struct hid_driver apple_driver = {
+ .event = apple_event,
+ .input_mapping = apple_input_mapping,
+ .input_mapped = apple_input_mapped,
++ .input_configured = apple_input_configured,
+ };
+ module_hid_driver(apple_driver);
+
+--
+2.25.1
+
--- /dev/null
+From 1bc407c6a82bae1e22455ebfc199736ffc131035 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 22:49:11 +0200
+Subject: HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override
+
+From: Federico Ricchiuto <fed.ricchiuto@gmail.com>
+
+[ Upstream commit 43e666acb79f3d355dd89bf20f4d25d3b15da13e ]
+
+The Mediacom FlexBook edge13 uses the SIPODEV SP1064 touchpad, which does not
+supply descriptors, so it has to be added to the override list.
+
+Signed-off-by: Federico Ricchiuto <fed.ricchiuto@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index 681ac9bc68b3d..f98c1e1b1dbdc 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -373,6 +373,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
++ {
++ .ident = "Mediacom FlexBook edge 13",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MEDIACOM"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook_edge13-M-FBE13"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
+ {
+ .ident = "Odys Winbook 13",
+ .matches = {
+--
+2.25.1
+
--- /dev/null
+From 666a4e445c75d88f799b64408d631b6186634c83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 13:00:27 +0200
+Subject: hippi: Fix a size used in a 'pci_free_consistent()' in an error
+ handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3195c4706b00106aa82c73acd28340fa8fc2bfc1 ]
+
+The size used when calling 'pci_alloc_consistent()' and
+'pci_free_consistent()' should match.
+
+Fix it and have it consistent with the corresponding call in 'rr_close()'.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hippi/rrunner.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
+index d7ba2b813effc..40ef4aeb0ef04 100644
+--- a/drivers/net/hippi/rrunner.c
++++ b/drivers/net/hippi/rrunner.c
+@@ -1250,7 +1250,7 @@ static int rr_open(struct net_device *dev)
+ rrpriv->info = NULL;
+ }
+ if (rrpriv->rx_ctrl) {
+- pci_free_consistent(pdev, sizeof(struct ring_ctrl),
++ pci_free_consistent(pdev, 256 * sizeof(struct ring_ctrl),
+ rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma);
+ rrpriv->rx_ctrl = NULL;
+ }
+--
+2.25.1
+
--- /dev/null
+From 7189d91cd64b4aade6afbc8704a8a23dde10df8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 14:15:18 +0300
+Subject: hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit bc4071aafcf4d0535ee423b69167696d6c03207d ]
+
+aspeed_create_fan() reads a pwm_port value using of_property_read_u32().
+If pwm_port will be more than ARRAY_SIZE(pwm_port_params), there will be
+a buffer overflow in
+aspeed_create_pwm_port()->aspeed_set_pwm_port_enable(). The patch fixes
+the potential buffer overflow.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Link: https://lore.kernel.org/r/20200703111518.9644-1-novikov@ispras.ru
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/aspeed-pwm-tacho.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c
+index 69b97d45e3cbb..e4337e9dda444 100644
+--- a/drivers/hwmon/aspeed-pwm-tacho.c
++++ b/drivers/hwmon/aspeed-pwm-tacho.c
+@@ -878,6 +878,8 @@ static int aspeed_create_fan(struct device *dev,
+ ret = of_property_read_u32(child, "reg", &pwm_port);
+ if (ret)
+ return ret;
++ if (pwm_port >= ARRAY_SIZE(pwm_port_params))
++ return -EINVAL;
+ aspeed_create_pwm_port(priv, (u8)pwm_port);
+
+ ret = of_property_count_u8_elems(child, "cooling-levels");
+--
+2.25.1
+
--- /dev/null
+From f67ad03d244c5ce8e318af824d98f889dcb60e6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jul 2020 15:38:29 +0200
+Subject: i2c: rcar: always clear ICSAR to avoid side effects
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit eb01597158ffb1853a7a7fc2c57d4c844640f75e ]
+
+On R-Car Gen2, we get a timeout when reading from the address set in
+ICSAR, even though the slave interface is disabled. Clearing it fixes
+this situation. Note that Gen3 is not affected.
+
+To reproduce: bind and undbind an I2C slave on some bus, run
+'i2cdetect' on that bus.
+
+Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 132c4a405bf83..db9ca8e926ca7 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -817,6 +817,7 @@ static int rcar_unreg_slave(struct i2c_client *slave)
+ /* disable irqs and ensure none is running before clearing ptr */
+ rcar_i2c_write(priv, ICSIER, 0);
+ rcar_i2c_write(priv, ICSCR, 0);
++ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
+
+ synchronize_irq(priv->irq);
+ priv->slave = NULL;
+@@ -914,6 +915,8 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ if (ret < 0)
+ goto out_pm_put;
+
++ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
++
+ if (priv->devtype == I2C_RCAR_GEN3) {
+ priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+ if (!IS_ERR(priv->rstc)) {
+--
+2.25.1
+
--- /dev/null
+From 56fea67f8e3dfbc7d98d366e2062c10c769d9551 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 11:47:04 -0700
+Subject: Input: add `SW_MACHINE_COVER`
+
+From: Merlijn Wajer <merlijn@wizzup.org>
+
+[ Upstream commit c463bb2a8f8d7d97aa414bf7714fc77e9d3b10df ]
+
+This event code represents the state of a removable cover of a device.
+Value 0 means that the cover is open or removed, value 1 means that the
+cover is closed.
+
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Merlijn Wajer <merlijn@wizzup.org>
+Link: https://lore.kernel.org/r/20200612125402.18393-2-merlijn@wizzup.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mod_devicetable.h | 2 +-
+ include/uapi/linux/input-event-codes.h | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
+index eba777807fc04..6f8eb1238235f 100644
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -293,7 +293,7 @@ struct pcmcia_device_id {
+ #define INPUT_DEVICE_ID_LED_MAX 0x0f
+ #define INPUT_DEVICE_ID_SND_MAX 0x07
+ #define INPUT_DEVICE_ID_FF_MAX 0x7f
+-#define INPUT_DEVICE_ID_SW_MAX 0x0f
++#define INPUT_DEVICE_ID_SW_MAX 0x10
+ #define INPUT_DEVICE_ID_PROP_MAX 0x1f
+
+ #define INPUT_DEVICE_ID_MATCH_BUS 1
+diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
+index 61769d4b7dbac..bce76e55a3c82 100644
+--- a/include/uapi/linux/input-event-codes.h
++++ b/include/uapi/linux/input-event-codes.h
+@@ -793,7 +793,8 @@
+ #define SW_LINEIN_INSERT 0x0d /* set = inserted */
+ #define SW_MUTE_DEVICE 0x0e /* set = device disabled */
+ #define SW_PEN_INSERTED 0x0f /* set = pen inserted */
+-#define SW_MAX 0x0f
++#define SW_MACHINE_COVER 0x10 /* set = cover closed */
++#define SW_MAX 0x10
+ #define SW_CNT (SW_MAX+1)
+
+ /*
+--
+2.25.1
+
--- /dev/null
+From a8dbf1e982acb2eaf70dfc385dd2644232c2dbc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jul 2020 15:27:43 -0700
+Subject: Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen
+
+From: Ilya Katsnelson <me@0upti.me>
+
+[ Upstream commit dcb00fc799dc03fd320e123e4c81b3278c763ea5 ]
+
+Tested on my own laptop, touchpad feels slightly more responsive with
+this on, though it might just be placebo.
+
+Signed-off-by: Ilya Katsnelson <me@0upti.me>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://lore.kernel.org/r/20200703143457.132373-1-me@0upti.me
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 85db184321f78..0714d572e49a3 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -182,6 +182,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0093", /* T480 */
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
++ "LEN0099", /* X1 Extreme 1st */
+ "LEN009b", /* T580 */
+ "LEN200f", /* T450s */
+ "LEN2044", /* L470 */
+--
+2.25.1
+
--- /dev/null
+From dcdc228cde57621fc0757a7376c9499e1a841511 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 16:12:08 +0800
+Subject: ipvs: fix the connection sync failed in some cases
+
+From: guodeqing <geffrey.guo@huawei.com>
+
+[ Upstream commit 8210e344ccb798c672ab237b1a4f241bda08909b ]
+
+The sync_thread_backup only checks sk_receive_queue is empty or not,
+there is a situation which cannot sync the connection entries when
+sk_receive_queue is empty and sk_rmem_alloc is larger than sk_rcvbuf,
+the sync packets are dropped in __udp_enqueue_schedule_skb, this is
+because the packets in reader_queue is not read, so the rmem is
+not reclaimed.
+
+Here I add the check of whether the reader_queue of the udp sock is
+empty or not to solve this problem.
+
+Fixes: 2276f58ac589 ("udp: use a separate rx queue for packet reception")
+Reported-by: zhouxudong <zhouxudong8@huawei.com>
+Signed-off-by: guodeqing <geffrey.guo@huawei.com>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_sync.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
+index b373e053ff9a3..90261055062ed 100644
+--- a/net/netfilter/ipvs/ip_vs_sync.c
++++ b/net/netfilter/ipvs/ip_vs_sync.c
+@@ -1726,6 +1726,8 @@ static int sync_thread_backup(void *data)
+ {
+ struct ip_vs_sync_thread_data *tinfo = data;
+ struct netns_ipvs *ipvs = tinfo->ipvs;
++ struct sock *sk = tinfo->sock->sk;
++ struct udp_sock *up = udp_sk(sk);
+ int len;
+
+ pr_info("sync thread started: state = BACKUP, mcast_ifn = %s, "
+@@ -1733,12 +1735,14 @@ static int sync_thread_backup(void *data)
+ ipvs->bcfg.mcast_ifn, ipvs->bcfg.syncid, tinfo->id);
+
+ while (!kthread_should_stop()) {
+- wait_event_interruptible(*sk_sleep(tinfo->sock->sk),
+- !skb_queue_empty(&tinfo->sock->sk->sk_receive_queue)
+- || kthread_should_stop());
++ wait_event_interruptible(*sk_sleep(sk),
++ !skb_queue_empty_lockless(&sk->sk_receive_queue) ||
++ !skb_queue_empty_lockless(&up->reader_queue) ||
++ kthread_should_stop());
+
+ /* do we have data now? */
+- while (!skb_queue_empty(&(tinfo->sock->sk->sk_receive_queue))) {
++ while (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
++ !skb_queue_empty_lockless(&up->reader_queue)) {
+ len = ip_vs_receive(tinfo->sock, tinfo->buf,
+ ipvs->bcfg.sync_maxlen);
+ if (len <= 0) {
+--
+2.25.1
+
--- /dev/null
+From c0e4ebafc76414f4bd3136bbd9a262ea12719048 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 22:31:49 +0800
+Subject: mlxsw: destroy workqueue when trap_register in mlxsw_emad_init
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit 5dbaeb87f2b309936be0aeae00cbc9e7f20ab296 ]
+
+When mlxsw_core_trap_register fails in mlxsw_emad_init,
+destroy_workqueue() shouled be called to destroy mlxsw_core->emad_wq.
+
+Fixes: d965465b60ba ("mlxsw: core: Fix possible deadlock")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Reviewed-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index fad26046e1595..96f9f267d16d4 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -619,7 +619,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
+ err = mlxsw_core_trap_register(mlxsw_core, &mlxsw_emad_rx_listener,
+ mlxsw_core);
+ if (err)
+- return err;
++ goto err_trap_register;
+
+ err = mlxsw_core->driver->basic_trap_groups_set(mlxsw_core);
+ if (err)
+@@ -631,6 +631,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
+ err_emad_trap_set:
+ mlxsw_core_trap_unregister(mlxsw_core, &mlxsw_emad_rx_listener,
+ mlxsw_core);
++err_trap_register:
+ destroy_workqueue(mlxsw_core->emad_wq);
+ return err;
+ }
+--
+2.25.1
+
--- /dev/null
+From 6127e61717160f8d9ebcbd8af66ce304ba817e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jul 2020 19:10:00 +0300
+Subject: net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual
+ configuration
+
+From: Sergey Organov <sorganov@gmail.com>
+
+[ Upstream commit 473309fb8372365ad211f425bca760af800e10a7 ]
+
+From Documentation/networking/timestamping.txt:
+
+ A driver which supports hardware time stamping shall update the
+ struct with the actual, possibly more permissive configuration.
+
+Do update the struct passed when we upscale the requested time
+stamping mode.
+
+Fixes: cb646e2b02b2 ("ptp: Added a clock driver for the National Semiconductor PHYTER.")
+Signed-off-by: Sergey Organov <sorganov@gmail.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83640.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index c52c016676af3..5752280fdb408 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -1339,6 +1339,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ dp83640->hwts_rx_en = 1;
+ dp83640->layer = PTP_CLASS_L4;
+ dp83640->version = PTP_CLASS_V1;
++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
+ break;
+ case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
+ case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
+@@ -1346,6 +1347,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ dp83640->hwts_rx_en = 1;
+ dp83640->layer = PTP_CLASS_L4;
+ dp83640->version = PTP_CLASS_V2;
++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
+ break;
+ case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
+ case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
+@@ -1353,6 +1355,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ dp83640->hwts_rx_en = 1;
+ dp83640->layer = PTP_CLASS_L2;
+ dp83640->version = PTP_CLASS_V2;
++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+ break;
+ case HWTSTAMP_FILTER_PTP_V2_EVENT:
+ case HWTSTAMP_FILTER_PTP_V2_SYNC:
+@@ -1360,6 +1363,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ dp83640->hwts_rx_en = 1;
+ dp83640->layer = PTP_CLASS_L4 | PTP_CLASS_L2;
+ dp83640->version = PTP_CLASS_V2;
++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+ break;
+ default:
+ return -ERANGE;
+--
+2.25.1
+
--- /dev/null
+From e9d7ca05867a4711e3ffe13fbb0052c92abc2045 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 11:50:38 +0800
+Subject: net: smc91x: Fix possible memory leak in smc_drv_probe()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit bca9749b1aa23d964d3ab930938af66dbf887f15 ]
+
+If try_toggle_control_gpio() failed in smc_drv_probe(), free_netdev(ndev)
+should be called to free the ndev created earlier. Otherwise, a memleak
+will occur.
+
+Fixes: 7d2911c43815 ("net: smc91x: Fix gpios for device tree based booting")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/smsc/smc91x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
+index 96ac0d3af6f5b..f570a37c68c23 100644
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -2294,7 +2294,7 @@ static int smc_drv_probe(struct platform_device *pdev)
+ ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio,
+ "power", 0, 0, 100);
+ if (ret)
+- return ret;
++ goto out_free_netdev;
+
+ /*
+ * Optional reset GPIO configured? Minimum 100 ns reset needed
+@@ -2303,7 +2303,7 @@ static int smc_drv_probe(struct platform_device *pdev)
+ ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio,
+ "reset", 0, 0, 100);
+ if (ret)
+- return ret;
++ goto out_free_netdev;
+
+ /*
+ * Need to wait for optional EEPROM to load, max 750 us according
+--
+2.25.1
+
--- /dev/null
+From 293fb0523b75cdb5aa1688f7755e2954f85b6bf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 12:33:15 +0200
+Subject: regmap: dev_get_regmap_match(): fix string comparison
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit e84861fec32dee8a2e62bbaa52cded6b05a2a456 ]
+
+This function is used by dev_get_regmap() to retrieve a regmap for the
+specified device. If the device has more than one regmap, the name parameter
+can be used to specify one.
+
+The code here uses a pointer comparison to check for equal strings. This
+however will probably always fail, as the regmap->name is allocated via
+kstrdup_const() from the regmap's config->name.
+
+Fix this by using strcmp() instead.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Link: https://lore.kernel.org/r/20200703103315.267996-1-mkl@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 013d0a2b3ba0a..4e0cc40ad9ceb 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1242,7 +1242,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data)
+
+ /* If the user didn't specify a name match any */
+ if (data)
+- return (*r)->name == data;
++ return !strcmp((*r)->name, data);
+ else
+ return 1;
+ }
+--
+2.25.1
+
--- /dev/null
+From 4eaa461e64797621992b82e97b637cbfe5b3bfb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 21:15:43 -0700
+Subject: scripts/decode_stacktrace: strip basepath from all paths
+
+From: Pi-Hsun Shih <pihsun@chromium.org>
+
+[ Upstream commit d178770d8d21489abf5bafefcbb6d5243b482e9a ]
+
+Currently the basepath is removed only from the beginning of the string.
+When the symbol is inlined and there's multiple line outputs of
+addr2line, only the first line would have basepath removed.
+
+Change to remove the basepath prefix from all lines.
+
+Fixes: 31013836a71e ("scripts/decode_stacktrace: match basepath using shell prefix operator, not regex")
+Co-developed-by: Shik Chen <shik@chromium.org>
+Signed-off-by: Pi-Hsun Shih <pihsun@chromium.org>
+Signed-off-by: Shik Chen <shik@chromium.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Cc: Sasha Levin <sashal@kernel.org>
+Cc: Nicolas Boichat <drinkcat@chromium.org>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Link: http://lkml.kernel.org/r/20200720082709.252805-1-pihsun@chromium.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/decode_stacktrace.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
+index 5aa75a0a1cede..946735bd5a252 100755
+--- a/scripts/decode_stacktrace.sh
++++ b/scripts/decode_stacktrace.sh
+@@ -77,8 +77,8 @@ parse_symbol() {
+ return
+ fi
+
+- # Strip out the base of the path
+- code=${code#$basepath/}
++ # Strip out the base of the path on each line
++ code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code")
+
+ # In the case of inlines, move everything to same line
+ code=${code//$'\n'/' '}
+--
+2.25.1
+
--- /dev/null
+From d6098aed6cc1e2bcf76e9e66a763548a182fdefa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 16:11:24 -0400
+Subject: serial: exar: Fix GPIO configuration for Sealevel cards based on
+ XR17V35X
+
+From: Matthew Howell <matthew.howell@sealevel.com>
+
+[ Upstream commit 5fdbe136ae19ab751daaa4d08d9a42f3e30d17f9 ]
+
+Sealevel XR17V35X based devices are inoperable on kernel versions
+4.11 and above due to a change in the GPIO preconfiguration introduced in
+commit
+7dea8165f1d. This patch fixes this by preconfiguring the GPIO on Sealevel
+cards to the value (0x00) used prior to commit 7dea8165f1d
+
+With GPIOs preconfigured as per commit 7dea8165f1d all ports on
+Sealevel XR17V35X based devices become stuck in high impedance
+mode, regardless of dip-switch or software configuration. This
+causes the device to become effectively unusable. This patch (in
+various forms) has been distributed to our customers and no issues
+related to it have been reported.
+
+Fixes: 7dea8165f1d6 ("serial: exar: Preconfigure xr17v35x MPIOs as output")
+Signed-off-by: Matthew Howell <matthew.howell@sealevel.com>
+Link: https://lore.kernel.org/r/alpine.DEB.2.21.2007221605270.13247@tstest-VirtualBox
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_exar.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
+index 899f36b59af79..ed81128bb42e0 100644
+--- a/drivers/tty/serial/8250/8250_exar.c
++++ b/drivers/tty/serial/8250/8250_exar.c
+@@ -229,7 +229,17 @@ static void setup_gpio(struct pci_dev *pcidev, u8 __iomem *p)
+ * devices will export them as GPIOs, so we pre-configure them safely
+ * as inputs.
+ */
+- u8 dir = pcidev->vendor == PCI_VENDOR_ID_EXAR ? 0xff : 0x00;
++
++ u8 dir = 0x00;
++
++ if ((pcidev->vendor == PCI_VENDOR_ID_EXAR) &&
++ (pcidev->subsystem_vendor != PCI_VENDOR_ID_SEALEVEL)) {
++ // Configure GPIO as inputs for Commtech adapters
++ dir = 0xff;
++ } else {
++ // Configure GPIO as outputs for SeaLevel adapters
++ dir = 0x00;
++ }
+
+ writeb(0x00, p + UART_EXAR_MPIOINT_7_0);
+ writeb(0x00, p + UART_EXAR_MPIOLVL_7_0);
+--
+2.25.1
+
btrfs-fix-double-free-on-ulist-after-backref-resolution-failure.patch
btrfs-fix-mount-failure-caused-by-race-with-umount.patch
btrfs-fix-page-leaks-after-failure-to-lock-page-for-delalloc.patch
+bnxt_en-fix-race-when-modifying-pause-settings.patch
+hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch
+ax88172a-fix-ax88172a_unbind-failures.patch
+net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch
+drm-sun4i-hdmi-fix-inverted-hpd-result.patch
+net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch
+bonding-check-error-value-of-register_netdevice-imme.patch
+mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch
+ipvs-fix-the-connection-sync-failed-in-some-cases.patch
+i2c-rcar-always-clear-icsar-to-avoid-side-effects.patch
+bonding-check-return-value-of-register_netdevice-in-.patch
+serial-exar-fix-gpio-configuration-for-sealevel-card.patch
+scripts-decode_stacktrace-strip-basepath-from-all-pa.patch
+hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch
+hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch
+dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch
+input-add-sw_machine_cover.patch
+spi-mediatek-use-correct-spi_cfg2_reg-macro.patch
+regmap-dev_get_regmap_match-fix-string-comparison.patch
+hwmon-aspeed-pwm-tacho-avoid-possible-buffer-overflo.patch
+dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch
+input-synaptics-enable-intertouch-for-thinkpad-x1e-1.patch
+usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch
+arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch
+x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch
--- /dev/null
+From dfd9fa49223c5e1f76163d01d88cad9acbd6f96a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jul 2020 17:00:20 +0800
+Subject: spi: mediatek: use correct SPI_CFG2_REG MACRO
+
+From: leilk.liu <leilk.liu@mediatek.com>
+
+[ Upstream commit 44b37eb79e16a56cb30ba55b2da452396b941e7a ]
+
+this patch use correct SPI_CFG2_REG offset.
+
+Signed-off-by: leilk.liu <leilk.liu@mediatek.com>
+Link: https://lore.kernel.org/r/20200701090020.7935-1-leilk.liu@mediatek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mt65xx.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index 0c2867deb36fc..da28c52c9da19 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -41,7 +41,6 @@
+ #define SPI_CFG0_SCK_LOW_OFFSET 8
+ #define SPI_CFG0_CS_HOLD_OFFSET 16
+ #define SPI_CFG0_CS_SETUP_OFFSET 24
+-#define SPI_ADJUST_CFG0_SCK_LOW_OFFSET 16
+ #define SPI_ADJUST_CFG0_CS_HOLD_OFFSET 0
+ #define SPI_ADJUST_CFG0_CS_SETUP_OFFSET 16
+
+@@ -53,6 +52,8 @@
+ #define SPI_CFG1_CS_IDLE_MASK 0xff
+ #define SPI_CFG1_PACKET_LOOP_MASK 0xff00
+ #define SPI_CFG1_PACKET_LENGTH_MASK 0x3ff0000
++#define SPI_CFG2_SCK_HIGH_OFFSET 0
++#define SPI_CFG2_SCK_LOW_OFFSET 16
+
+ #define SPI_CMD_ACT BIT(0)
+ #define SPI_CMD_RESUME BIT(1)
+@@ -259,7 +260,7 @@ static void mtk_spi_set_cs(struct spi_device *spi, bool enable)
+ static void mtk_spi_prepare_transfer(struct spi_master *master,
+ struct spi_transfer *xfer)
+ {
+- u32 spi_clk_hz, div, sck_time, cs_time, reg_val = 0;
++ u32 spi_clk_hz, div, sck_time, cs_time, reg_val;
+ struct mtk_spi *mdata = spi_master_get_devdata(master);
+
+ spi_clk_hz = clk_get_rate(mdata->spi_clk);
+@@ -272,18 +273,18 @@ static void mtk_spi_prepare_transfer(struct spi_master *master,
+ cs_time = sck_time * 2;
+
+ if (mdata->dev_comp->enhance_timing) {
++ reg_val = (((sck_time - 1) & 0xffff)
++ << SPI_CFG2_SCK_HIGH_OFFSET);
+ reg_val |= (((sck_time - 1) & 0xffff)
+- << SPI_CFG0_SCK_HIGH_OFFSET);
+- reg_val |= (((sck_time - 1) & 0xffff)
+- << SPI_ADJUST_CFG0_SCK_LOW_OFFSET);
++ << SPI_CFG2_SCK_LOW_OFFSET);
+ writel(reg_val, mdata->base + SPI_CFG2_REG);
+- reg_val |= (((cs_time - 1) & 0xffff)
++ reg_val = (((cs_time - 1) & 0xffff)
+ << SPI_ADJUST_CFG0_CS_HOLD_OFFSET);
+ reg_val |= (((cs_time - 1) & 0xffff)
+ << SPI_ADJUST_CFG0_CS_SETUP_OFFSET);
+ writel(reg_val, mdata->base + SPI_CFG0_REG);
+ } else {
+- reg_val |= (((sck_time - 1) & 0xff)
++ reg_val = (((sck_time - 1) & 0xff)
+ << SPI_CFG0_SCK_HIGH_OFFSET);
+ reg_val |= (((sck_time - 1) & 0xff) << SPI_CFG0_SCK_LOW_OFFSET);
+ reg_val |= (((cs_time - 1) & 0xff) << SPI_CFG0_CS_HOLD_OFFSET);
+--
+2.25.1
+
--- /dev/null
+From 95a753292d7233bfd9aee08e0242ea65f683935b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 16:17:47 +0300
+Subject: usb: gadget: udc: gr_udc: fix memleak on error handling path in
+ gr_ep_init()
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit c8f8529e2c4141afa2ebb487ad48e8a6ec3e8c99 ]
+
+gr_ep_init() does not assign the allocated request anywhere if allocation
+of memory for the buffer fails. This is a memory leak fixed by the given
+patch.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/gr_udc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c
+index feb73a1c42ef9..be094f4e116b1 100644
+--- a/drivers/usb/gadget/udc/gr_udc.c
++++ b/drivers/usb/gadget/udc/gr_udc.c
+@@ -2000,9 +2000,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit)
+
+ if (num == 0) {
+ _req = gr_alloc_request(&ep->ep, GFP_ATOMIC);
++ if (!_req)
++ return -ENOMEM;
++
+ buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC);
+- if (!_req || !buf) {
+- /* possible _req freed by gr_probe via gr_remove */
++ if (!buf) {
++ gr_free_request(&ep->ep, _req);
+ return -ENOMEM;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From e67532b07df2256ef25f0f99e9c08555b003f028 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 15:53:46 +0200
+Subject: x86: math-emu: Fix up 'cmp' insn for clang ias
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 81e96851ea32deb2c921c870eecabf335f598aeb ]
+
+The clang integrated assembler requires the 'cmp' instruction to
+have a length prefix here:
+
+arch/x86/math-emu/wm_sqrt.S:212:2: error: ambiguous instructions require an explicit suffix (could be 'cmpb', 'cmpw', or 'cmpl')
+ cmp $0xffffffff,-24(%ebp)
+ ^
+
+Make this a 32-bit comparison, which it was clearly meant to be.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://lkml.kernel.org/r/20200527135352.1198078-1-arnd@arndb.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/math-emu/wm_sqrt.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/math-emu/wm_sqrt.S b/arch/x86/math-emu/wm_sqrt.S
+index f031c0e193565..515cdee90df72 100644
+--- a/arch/x86/math-emu/wm_sqrt.S
++++ b/arch/x86/math-emu/wm_sqrt.S
+@@ -209,7 +209,7 @@ sqrt_stage_2_finish:
+
+ #ifdef PARANOID
+ /* It should be possible to get here only if the arg is ffff....ffff */
+- cmp $0xffffffff,FPU_fsqrt_arg_1
++ cmpl $0xffffffff,FPU_fsqrt_arg_1
+ jnz sqrt_stage_2_error
+ #endif /* PARANOID */
+
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
