--- /dev/null
+From e2118b3c3d94289852417f70ec128c25f4833aad Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <damien.lemoal@wdc.com>
+Date: Wed, 26 May 2021 06:24:59 +0900
+Subject: dm: rearrange core declarations for extended use from dm-zone.c
+
+From: Damien Le Moal <damien.lemoal@wdc.com>
+
+commit e2118b3c3d94289852417f70ec128c25f4833aad upstream.
+
+Move the definitions of struct dm_target_io, struct dm_io and the bits
+of the flags field of struct mapped_device from dm.c to dm-core.h to
+make them usable from dm-zone.c. For the same reason, declare
+dec_pending() in dm-core.h after renaming it to dm_io_dec_pending().
+And for symmetry of the function names, introduce the inline helper
+dm_io_inc_pending() instead of directly using atomic_inc() calls.
+
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+[Shivani: Modified to apply on 5.10.y]
+Signed-off-by: Shivani Agarwal <shivani.agarwal@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-core.h | 52 ++++++++++++++++++++++++++++++++++++++++++++
+ drivers/md/dm.c | 59 ++++++---------------------------------------------
+ 2 files changed, 59 insertions(+), 52 deletions(-)
+
+--- a/drivers/md/dm-core.h
++++ b/drivers/md/dm-core.h
+@@ -124,6 +124,19 @@ struct mapped_device {
+ struct srcu_struct io_barrier;
+ };
+
++/*
++ * Bits for the flags field of struct mapped_device.
++ */
++#define DMF_BLOCK_IO_FOR_SUSPEND 0
++#define DMF_SUSPENDED 1
++#define DMF_FROZEN 2
++#define DMF_FREEING 3
++#define DMF_DELETING 4
++#define DMF_NOFLUSH_SUSPENDING 5
++#define DMF_DEFERRED_REMOVE 6
++#define DMF_SUSPENDED_INTERNALLY 7
++#define DMF_POST_SUSPENDING 8
++
+ void disable_discard(struct mapped_device *md);
+ void disable_write_same(struct mapped_device *md);
+ void disable_write_zeroes(struct mapped_device *md);
+@@ -177,6 +190,45 @@ struct dm_table {
+ struct dm_md_mempools *mempools;
+ };
+
++/*
++ * One of these is allocated per clone bio.
++ */
++#define DM_TIO_MAGIC 7282014
++struct dm_target_io {
++ unsigned int magic;
++ struct dm_io *io;
++ struct dm_target *ti;
++ unsigned int target_bio_nr;
++ unsigned int *len_ptr;
++ bool inside_dm_io;
++ struct bio clone;
++};
++
++/*
++ * One of these is allocated per original bio.
++ * It contains the first clone used for that original.
++ */
++#define DM_IO_MAGIC 5191977
++struct dm_io {
++ unsigned int magic;
++ struct mapped_device *md;
++ blk_status_t status;
++ atomic_t io_count;
++ struct bio *orig_bio;
++ unsigned long start_time;
++ spinlock_t endio_lock;
++ struct dm_stats_aux stats_aux;
++ /* last member of dm_target_io is 'struct bio' */
++ struct dm_target_io tio;
++};
++
++static inline void dm_io_inc_pending(struct dm_io *io)
++{
++ atomic_inc(&io->io_count);
++}
++
++void dm_io_dec_pending(struct dm_io *io, blk_status_t error);
++
+ static inline struct completion *dm_get_completion_from_kobject(struct kobject *kobj)
+ {
+ return &container_of(kobj, struct dm_kobject_holder, kobj)->completion;
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -73,38 +73,6 @@ struct clone_info {
+ unsigned sector_count;
+ };
+
+-/*
+- * One of these is allocated per clone bio.
+- */
+-#define DM_TIO_MAGIC 7282014
+-struct dm_target_io {
+- unsigned magic;
+- struct dm_io *io;
+- struct dm_target *ti;
+- unsigned target_bio_nr;
+- unsigned *len_ptr;
+- bool inside_dm_io;
+- struct bio clone;
+-};
+-
+-/*
+- * One of these is allocated per original bio.
+- * It contains the first clone used for that original.
+- */
+-#define DM_IO_MAGIC 5191977
+-struct dm_io {
+- unsigned magic;
+- struct mapped_device *md;
+- blk_status_t status;
+- atomic_t io_count;
+- struct bio *orig_bio;
+- unsigned long start_time;
+- spinlock_t endio_lock;
+- struct dm_stats_aux stats_aux;
+- /* last member of dm_target_io is 'struct bio' */
+- struct dm_target_io tio;
+-};
+-
+ void *dm_per_bio_data(struct bio *bio, size_t data_size)
+ {
+ struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone);
+@@ -132,19 +100,6 @@ EXPORT_SYMBOL_GPL(dm_bio_get_target_bio_
+
+ #define MINOR_ALLOCED ((void *)-1)
+
+-/*
+- * Bits for the md->flags field.
+- */
+-#define DMF_BLOCK_IO_FOR_SUSPEND 0
+-#define DMF_SUSPENDED 1
+-#define DMF_FROZEN 2
+-#define DMF_FREEING 3
+-#define DMF_DELETING 4
+-#define DMF_NOFLUSH_SUSPENDING 5
+-#define DMF_DEFERRED_REMOVE 6
+-#define DMF_SUSPENDED_INTERNALLY 7
+-#define DMF_POST_SUSPENDING 8
+-
+ #define DM_NUMA_NODE NUMA_NO_NODE
+ static int dm_numa_node = DM_NUMA_NODE;
+
+@@ -897,7 +852,7 @@ static int __noflush_suspending(struct m
+ * Decrements the number of outstanding ios that a bio has been
+ * cloned into, completing the original io if necc.
+ */
+-static void dec_pending(struct dm_io *io, blk_status_t error)
++void dm_io_dec_pending(struct dm_io *io, blk_status_t error)
+ {
+ unsigned long flags;
+ blk_status_t io_error;
+@@ -1041,7 +996,7 @@ static void clone_endio(struct bio *bio)
+ }
+
+ free_tio(tio);
+- dec_pending(io, error);
++ dm_io_dec_pending(io, error);
+ }
+
+ /*
+@@ -1309,7 +1264,7 @@ static blk_qc_t __map_bio(struct dm_targ
+ * anything, the target has assumed ownership of
+ * this io.
+ */
+- atomic_inc(&io->io_count);
++ dm_io_inc_pending(io);
+ sector = clone->bi_iter.bi_sector;
+
+ if (unlikely(swap_bios_limit(ti, clone))) {
+@@ -1336,7 +1291,7 @@ static blk_qc_t __map_bio(struct dm_targ
+ up(&md->swap_bios_semaphore);
+ }
+ free_tio(tio);
+- dec_pending(io, BLK_STS_IOERR);
++ dm_io_dec_pending(io, BLK_STS_IOERR);
+ break;
+ case DM_MAPIO_REQUEUE:
+ if (unlikely(swap_bios_limit(ti, clone))) {
+@@ -1344,7 +1299,7 @@ static blk_qc_t __map_bio(struct dm_targ
+ up(&md->swap_bios_semaphore);
+ }
+ free_tio(tio);
+- dec_pending(io, BLK_STS_DM_REQUEUE);
++ dm_io_dec_pending(io, BLK_STS_DM_REQUEUE);
+ break;
+ default:
+ DMWARN("unimplemented target map return value: %d", r);
+@@ -1640,7 +1595,7 @@ static blk_qc_t __split_and_process_bio(
+
+ if (bio->bi_opf & REQ_PREFLUSH) {
+ error = __send_empty_flush(&ci);
+- /* dec_pending submits any data associated with flush */
++ /* dm_io_dec_pending submits any data associated with flush */
+ } else if (op_is_zone_mgmt(bio_op(bio))) {
+ ci.bio = bio;
+ ci.sector_count = 0;
+@@ -1684,7 +1639,7 @@ static blk_qc_t __split_and_process_bio(
+ }
+
+ /* drop the extra reference count */
+- dec_pending(ci.io, errno_to_blk_status(error));
++ dm_io_dec_pending(ci.io, errno_to_blk_status(error));
+ return ret;
+ }
+
--- /dev/null
+From b4459b11e84092658fa195a2587aff3b9637f0e7 Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@redhat.com>
+Date: Thu, 23 Sep 2021 17:11:31 +0800
+Subject: dm rq: don't queue request to blk-mq during DM suspend
+
+From: Ming Lei <ming.lei@redhat.com>
+
+commit b4459b11e84092658fa195a2587aff3b9637f0e7 upstream.
+
+DM uses blk-mq's quiesce/unquiesce to stop/start device mapper queue.
+
+But blk-mq's unquiesce may come from outside events, such as elevator
+switch, updating nr_requests or others, and request may come during
+suspend, so simply ask for blk-mq to requeue it.
+
+Fixes one kernel panic issue when running updating nr_requests and
+dm-mpath suspend/resume stress test.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+[Shivani: Modified to apply on 5.10.y]
+Signed-off-by: Shivani Agarwal <shivani.agarwal@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-rq.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -490,6 +490,14 @@ static blk_status_t dm_mq_queue_rq(struc
+ struct mapped_device *md = tio->md;
+ struct dm_target *ti = md->immutable_target;
+
++ /*
++ * blk-mq's unquiesce may come from outside events, such as
++ * elevator switch, updating nr_requests or others, and request may
++ * come during suspend, so simply ask for blk-mq to requeue it.
++ */
++ if (unlikely(test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags)))
++ return BLK_STS_RESOURCE;
++
+ if (unlikely(!ti)) {
+ int srcu_idx;
+ struct dm_table *map;
--- /dev/null
+From f02c41f87cfe61440c18bf77d1ef0a884b9ee2b5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Niklas=20S=C3=B6derlund?=
+ <niklas.soderlund+renesas@ragnatech.se>
+Date: Tue, 21 Jan 2025 14:58:33 +0100
+Subject: gpio: rcar: Use raw_spinlock to protect register access
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+commit f02c41f87cfe61440c18bf77d1ef0a884b9ee2b5 upstream.
+
+Use raw_spinlock in order to fix spurious messages about invalid context
+when spinlock debugging is enabled. The lock is only used to serialize
+register access.
+
+ [ 4.239592] =============================
+ [ 4.239595] [ BUG: Invalid wait context ]
+ [ 4.239599] 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35 Not tainted
+ [ 4.239603] -----------------------------
+ [ 4.239606] kworker/u8:5/76 is trying to lock:
+ [ 4.239609] ffff0000091898a0 (&p->lock){....}-{3:3}, at: gpio_rcar_config_interrupt_input_mode+0x34/0x164
+ [ 4.239641] other info that might help us debug this:
+ [ 4.239643] context-{5:5}
+ [ 4.239646] 5 locks held by kworker/u8:5/76:
+ [ 4.239651] #0: ffff0000080fb148 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x190/0x62c
+ [ 4.250180] OF: /soc/sound@ec500000/ports/port@0/endpoint: Read of boolean property 'frame-master' with a value.
+ [ 4.254094] #1: ffff80008299bd80 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x1b8/0x62c
+ [ 4.254109] #2: ffff00000920c8f8
+ [ 4.258345] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'bitclock-master' with a value.
+ [ 4.264803] (&dev->mutex){....}-{4:4}, at: __device_attach_async_helper+0x3c/0xdc
+ [ 4.264820] #3: ffff00000a50ca40 (request_class#2){+.+.}-{4:4}, at: __setup_irq+0xa0/0x690
+ [ 4.264840] #4:
+ [ 4.268872] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'frame-master' with a value.
+ [ 4.273275] ffff00000a50c8c8 (lock_class){....}-{2:2}, at: __setup_irq+0xc4/0x690
+ [ 4.296130] renesas_sdhi_internal_dmac ee100000.mmc: mmc1 base at 0x00000000ee100000, max clock rate 200 MHz
+ [ 4.304082] stack backtrace:
+ [ 4.304086] CPU: 1 UID: 0 PID: 76 Comm: kworker/u8:5 Not tainted 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35
+ [ 4.304092] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
+ [ 4.304097] Workqueue: async async_run_entry_fn
+ [ 4.304106] Call trace:
+ [ 4.304110] show_stack+0x14/0x20 (C)
+ [ 4.304122] dump_stack_lvl+0x6c/0x90
+ [ 4.304131] dump_stack+0x14/0x1c
+ [ 4.304138] __lock_acquire+0xdfc/0x1584
+ [ 4.426274] lock_acquire+0x1c4/0x33c
+ [ 4.429942] _raw_spin_lock_irqsave+0x5c/0x80
+ [ 4.434307] gpio_rcar_config_interrupt_input_mode+0x34/0x164
+ [ 4.440061] gpio_rcar_irq_set_type+0xd4/0xd8
+ [ 4.444422] __irq_set_trigger+0x5c/0x178
+ [ 4.448435] __setup_irq+0x2e4/0x690
+ [ 4.452012] request_threaded_irq+0xc4/0x190
+ [ 4.456285] devm_request_threaded_irq+0x7c/0xf4
+ [ 4.459398] ata1: link resume succeeded after 1 retries
+ [ 4.460902] mmc_gpiod_request_cd_irq+0x68/0xe0
+ [ 4.470660] mmc_start_host+0x50/0xac
+ [ 4.474327] mmc_add_host+0x80/0xe4
+ [ 4.477817] tmio_mmc_host_probe+0x2b0/0x440
+ [ 4.482094] renesas_sdhi_probe+0x488/0x6f4
+ [ 4.486281] renesas_sdhi_internal_dmac_probe+0x60/0x78
+ [ 4.491509] platform_probe+0x64/0xd8
+ [ 4.495178] really_probe+0xb8/0x2a8
+ [ 4.498756] __driver_probe_device+0x74/0x118
+ [ 4.503116] driver_probe_device+0x3c/0x154
+ [ 4.507303] __device_attach_driver+0xd4/0x160
+ [ 4.511750] bus_for_each_drv+0x84/0xe0
+ [ 4.515588] __device_attach_async_helper+0xb0/0xdc
+ [ 4.520470] async_run_entry_fn+0x30/0xd8
+ [ 4.524481] process_one_work+0x210/0x62c
+ [ 4.528494] worker_thread+0x1ac/0x340
+ [ 4.532245] kthread+0x10c/0x110
+ [ 4.535476] ret_from_fork+0x10/0x20
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20250121135833.3769310-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+[PL: manullay applied the changes]
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Pavel Machek <pavel@denx.de> # for 5.10-stable
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-rcar.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpio/gpio-rcar.c
++++ b/drivers/gpio/gpio-rcar.c
+@@ -34,7 +34,7 @@ struct gpio_rcar_bank_info {
+
+ struct gpio_rcar_priv {
+ void __iomem *base;
+- spinlock_t lock;
++ raw_spinlock_t lock;
+ struct device *dev;
+ struct gpio_chip gpio_chip;
+ struct irq_chip irq_chip;
+@@ -114,7 +114,7 @@ static void gpio_rcar_config_interrupt_i
+ * "Setting Level-Sensitive Interrupt Input Mode"
+ */
+
+- spin_lock_irqsave(&p->lock, flags);
++ raw_spin_lock_irqsave(&p->lock, flags);
+
+ /* Configure positive or negative logic in POSNEG */
+ gpio_rcar_modify_bit(p, POSNEG, hwirq, !active_high_rising_edge);
+@@ -133,7 +133,7 @@ static void gpio_rcar_config_interrupt_i
+ if (!level_trigger)
+ gpio_rcar_write(p, INTCLR, BIT(hwirq));
+
+- spin_unlock_irqrestore(&p->lock, flags);
++ raw_spin_unlock_irqrestore(&p->lock, flags);
+ }
+
+ static int gpio_rcar_irq_set_type(struct irq_data *d, unsigned int type)
+@@ -226,7 +226,7 @@ static void gpio_rcar_config_general_inp
+ * "Setting General Input Mode"
+ */
+
+- spin_lock_irqsave(&p->lock, flags);
++ raw_spin_lock_irqsave(&p->lock, flags);
+
+ /* Configure positive logic in POSNEG */
+ gpio_rcar_modify_bit(p, POSNEG, gpio, false);
+@@ -241,7 +241,7 @@ static void gpio_rcar_config_general_inp
+ if (p->has_outdtsel && output)
+ gpio_rcar_modify_bit(p, OUTDTSEL, gpio, false);
+
+- spin_unlock_irqrestore(&p->lock, flags);
++ raw_spin_unlock_irqrestore(&p->lock, flags);
+ }
+
+ static int gpio_rcar_request(struct gpio_chip *chip, unsigned offset)
+@@ -310,9 +310,9 @@ static void gpio_rcar_set(struct gpio_ch
+ struct gpio_rcar_priv *p = gpiochip_get_data(chip);
+ unsigned long flags;
+
+- spin_lock_irqsave(&p->lock, flags);
++ raw_spin_lock_irqsave(&p->lock, flags);
+ gpio_rcar_modify_bit(p, OUTDT, offset, value);
+- spin_unlock_irqrestore(&p->lock, flags);
++ raw_spin_unlock_irqrestore(&p->lock, flags);
+ }
+
+ static void gpio_rcar_set_multiple(struct gpio_chip *chip, unsigned long *mask,
+@@ -329,12 +329,12 @@ static void gpio_rcar_set_multiple(struc
+ if (!bankmask)
+ return;
+
+- spin_lock_irqsave(&p->lock, flags);
++ raw_spin_lock_irqsave(&p->lock, flags);
+ val = gpio_rcar_read(p, OUTDT);
+ val &= ~bankmask;
+ val |= (bankmask & bits[0]);
+ gpio_rcar_write(p, OUTDT, val);
+- spin_unlock_irqrestore(&p->lock, flags);
++ raw_spin_unlock_irqrestore(&p->lock, flags);
+ }
+
+ static int gpio_rcar_direction_output(struct gpio_chip *chip, unsigned offset,
+@@ -454,7 +454,7 @@ static int gpio_rcar_probe(struct platfo
+ return -ENOMEM;
+
+ p->dev = dev;
+- spin_lock_init(&p->lock);
++ raw_spin_lock_init(&p->lock);
+
+ /* Get device configuration from DT node */
+ ret = gpio_rcar_parse_dt(p, &npins);
--- /dev/null
+From 452690be7de2f91cc0de68cb9e95252875b33503 Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Fri, 15 Aug 2025 19:28:21 +0200
+Subject: selftests: mptcp: pm: check flush doesn't reset limits
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit 452690be7de2f91cc0de68cb9e95252875b33503 upstream.
+
+This modification is linked to the parent commit where the received
+ADD_ADDR limit was accidentally reset when the endpoints were flushed.
+
+To validate that, the test is now flushing endpoints after having set
+new limits, and before checking them.
+
+The 'Fixes' tag here below is the same as the one from the previous
+commit: this patch here is not fixing anything wrong in the selftests,
+but it validates the previous fix for an issue introduced by this commit
+ID.
+
+Fixes: 01cacb00b35c ("mptcp: add netlink-based PM")
+Cc: stable@vger.kernel.org
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-3-521fe9957892@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ Conflicts in pm_netlink.sh, because some refactoring have been done
+ later on: commit 3188309c8ceb ("selftests: mptcp: netlink:
+ add 'limits' helpers") and commit c99d57d0007a ("selftests: mptcp: use
+ pm_nl endpoint ops") are not in this version. The same operation can
+ still be done at the same place, without using the new helper. ]
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/pm_netlink.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/testing/selftests/net/mptcp/pm_netlink.sh
++++ b/tools/testing/selftests/net/mptcp/pm_netlink.sh
+@@ -130,6 +130,7 @@ ip netns exec $ns1 ./pm_nl_ctl limits 1
+ check "ip netns exec $ns1 ./pm_nl_ctl limits" "$default_limits" "subflows above hard limit"
+
+ ip netns exec $ns1 ./pm_nl_ctl limits 8 8
++ip netns exec $ns1 ./pm_nl_ctl flush
+ check "ip netns exec $ns1 ./pm_nl_ctl limits" "accept 8
+ subflows 8" "set limits"
+
media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch
f2fs-fix-to-avoid-out-of-boundary-access-in-dnode-page.patch
media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch
+uio_hv_generic-fix-another-memory-leak-in-error-handling-paths.patch
+dm-rearrange-core-declarations-for-extended-use-from-dm-zone.c.patch
+dm-rq-don-t-queue-request-to-blk-mq-during-dm-suspend.patch
+usb-dwc3-remove-dwc3-locking-during-gadget-suspend-resume.patch
+usb-dwc3-core-remove-lock-of-otg-mode-during-gadget-suspend-resume-to-avoid-deadlock.patch
+gpio-rcar-use-raw_spinlock-to-protect-register-access.patch
+selftests-mptcp-pm-check-flush-doesn-t-reset-limits.patch
--- /dev/null
+From 0b0226be3a52dadd965644bc52a807961c2c26df Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 9 May 2021 09:13:12 +0200
+Subject: uio_hv_generic: Fix another memory leak in error handling paths
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 0b0226be3a52dadd965644bc52a807961c2c26df upstream.
+
+Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe
+function is never freed in the error handling path.
+
+Add the missing 'vmbus_free_ring()' call.
+
+Note that it is already freed in the .remove function.
+
+Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/0d86027b8eeed8e6360bc3d52bcdb328ff9bdca1.1620544055.git.christophe.jaillet@wanadoo.fr
+[Shivani: Modified to apply on 5.10.y]
+Signed-off-by: Shivani Agarwal <shivani.agarwal@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/uio/uio_hv_generic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+--- a/drivers/uio/uio_hv_generic.c
++++ b/drivers/uio/uio_hv_generic.c
+@@ -306,7 +306,7 @@ hv_uio_probe(struct hv_device *dev,
+ pdata->recv_buf = vzalloc(RECV_BUFFER_SIZE);
+ if (pdata->recv_buf == NULL) {
+ ret = -ENOMEM;
+- goto fail_close;
++ goto fail_free_ring;
+ }
+
+ ret = vmbus_establish_gpadl(channel, pdata->recv_buf,
+@@ -366,6 +366,8 @@ hv_uio_probe(struct hv_device *dev,
+
+ fail_close:
+ hv_uio_cleanup(dev, pdata);
++fail_free_ring:
++ vmbus_free_ring(dev->channel);
+
+ return ret;
+ }
--- /dev/null
+From 7838de15bb700c2898a7d741db9b1f3cbc86c136 Mon Sep 17 00:00:00 2001
+From: Meng Li <Meng.Li@windriver.com>
+Date: Tue, 18 Jun 2024 11:19:18 +0800
+Subject: usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock
+
+From: Meng Li <Meng.Li@windriver.com>
+
+commit 7838de15bb700c2898a7d741db9b1f3cbc86c136 upstream.
+
+When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger system
+to enter suspend status with below command:
+echo mem > /sys/power/state
+There will be a deadlock issue occurring. Detailed invoking path as
+below:
+dwc3_suspend_common()
+ spin_lock_irqsave(&dwc->lock, flags); <-- 1st
+ dwc3_gadget_suspend(dwc);
+ dwc3_gadget_soft_disconnect(dwc);
+ spin_lock_irqsave(&dwc->lock, flags); <-- 2nd
+This issue is exposed by commit c7ebd8149ee5 ("usb: dwc3: gadget: Fix
+NULL pointer dereference in dwc3_gadget_suspend") that removes the code
+of checking whether dwc->gadget_driver is NULL or not. It causes the
+following code is executed and deadlock occurs when trying to get the
+spinlock. In fact, the root cause is the commit 5265397f9442("usb: dwc3:
+Remove DWC3 locking during gadget suspend/resume") that forgot to remove
+the lock of otg mode. So, remove the redundant lock of otg mode during
+gadget suspend/resume.
+
+Fixes: 5265397f9442 ("usb: dwc3: Remove DWC3 locking during gadget suspend/resume")
+Cc: Xu Yang <xu.yang_2@nxp.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Meng Li <Meng.Li@windriver.com>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/20240618031918.2585799-1-Meng.Li@windriver.com
+Signed-off-by: Selvarasu Ganesan <selvarasu.g@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1735,7 +1735,6 @@ assert_reset:
+
+ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
+ {
+- unsigned long flags;
+ u32 reg;
+
+ switch (dwc->current_dr_role) {
+@@ -1773,9 +1772,7 @@ static int dwc3_suspend_common(struct dw
+ break;
+
+ if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
+- spin_lock_irqsave(&dwc->lock, flags);
+ dwc3_gadget_suspend(dwc);
+- spin_unlock_irqrestore(&dwc->lock, flags);
+ synchronize_irq(dwc->irq_gadget);
+ }
+
+@@ -1792,7 +1789,6 @@ static int dwc3_suspend_common(struct dw
+
+ static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)
+ {
+- unsigned long flags;
+ int ret;
+ u32 reg;
+
+@@ -1841,9 +1837,7 @@ static int dwc3_resume_common(struct dwc
+ if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST) {
+ dwc3_otg_host_init(dwc);
+ } else if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
+- spin_lock_irqsave(&dwc->lock, flags);
+ dwc3_gadget_resume(dwc);
+- spin_unlock_irqrestore(&dwc->lock, flags);
+ }
+
+ break;
--- /dev/null
+From 5265397f94424eaea596026fd34dc7acf474dcec Mon Sep 17 00:00:00 2001
+From: Wesley Cheng <quic_wcheng@quicinc.com>
+Date: Thu, 1 Sep 2022 12:36:22 -0700
+Subject: usb: dwc3: Remove DWC3 locking during gadget suspend/resume
+
+From: Wesley Cheng <quic_wcheng@quicinc.com>
+
+commit 5265397f94424eaea596026fd34dc7acf474dcec upstream.
+
+Remove the need for making dwc3_gadget_suspend() and dwc3_gadget_resume()
+to be called in a spinlock, as dwc3_gadget_run_stop() could potentially
+take some time to complete.
+
+Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>
+Link: https://lore.kernel.org/r/20220901193625.8727-3-quic_wcheng@quicinc.com
+Signed-off-by: Selvarasu Ganesan <selvarasu.g@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 4 ----
+ drivers/usb/dwc3/gadget.c | 5 +++++
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1742,9 +1742,7 @@ static int dwc3_suspend_common(struct dw
+ case DWC3_GCTL_PRTCAP_DEVICE:
+ if (pm_runtime_suspended(dwc->dev))
+ break;
+- spin_lock_irqsave(&dwc->lock, flags);
+ dwc3_gadget_suspend(dwc);
+- spin_unlock_irqrestore(&dwc->lock, flags);
+ synchronize_irq(dwc->irq_gadget);
+ dwc3_core_exit(dwc);
+ break;
+@@ -1805,9 +1803,7 @@ static int dwc3_resume_common(struct dwc
+ return ret;
+
+ dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE);
+- spin_lock_irqsave(&dwc->lock, flags);
+ dwc3_gadget_resume(dwc);
+- spin_unlock_irqrestore(&dwc->lock, flags);
+ break;
+ case DWC3_GCTL_PRTCAP_HOST:
+ if (!PMSG_IS_AUTO(msg)) {
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -4115,12 +4115,17 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
+
+ int dwc3_gadget_suspend(struct dwc3 *dwc)
+ {
++ unsigned long flags;
++
+ if (!dwc->gadget_driver)
+ return 0;
+
+ dwc3_gadget_run_stop(dwc, false, false);
++
++ spin_lock_irqsave(&dwc->lock, flags);
+ dwc3_disconnect_gadget(dwc);
+ __dwc3_gadget_stop(dwc);
++ spin_unlock_irqrestore(&dwc->lock, flags);
+
+ return 0;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
