--- /dev/null
+From 9cc8f7ae81fdde1f0203936a81947333749c2c58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 10:54:14 +0530
+Subject: ALSA: hda: Fix 2 channel swapping for Tegra
+
+From: Mohan Kumar <mkumard@nvidia.com>
+
+[ Upstream commit 216116eae43963c662eb84729507bad95214ca6b ]
+
+The Tegra HDA codec HW implementation has an issue related to not
+swapping the 2 channel Audio Sample Packet(ASP) channel mapping.
+Whatever the FL and FR mapping specified the left channel always
+comes out of left speaker and right channel on right speaker. So
+add condition to disallow the swapping of FL,FR during the playback.
+
+Signed-off-by: Mohan Kumar <mkumard@nvidia.com>
+Acked-by: Sameer Pujar <spujar@nvidia.com>
+Link: https://lore.kernel.org/r/20200825052415.20626-2-mkumard@nvidia.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 2def4ad579ccf..4f8dd558af48f 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3224,6 +3224,7 @@ static int tegra_hdmi_build_pcms(struct hda_codec *codec)
+
+ static int patch_tegra_hdmi(struct hda_codec *codec)
+ {
++ struct hdmi_spec *spec;
+ int err;
+
+ err = patch_generic_hdmi(codec);
+@@ -3231,6 +3232,10 @@ static int patch_tegra_hdmi(struct hda_codec *codec)
+ return err;
+
+ codec->patch_ops.build_pcms = tegra_hdmi_build_pcms;
++ spec = codec->spec;
++ spec->chmap.ops.chmap_cea_alloc_validate_get_type =
++ nvhdmi_chmap_cea_alloc_validate_get_type;
++ spec->chmap.ops.chmap_validate = nvhdmi_chmap_validate;
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From 1114d6ac68d8b6066e0fa38c7524ef4ef3aa1acc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 18:42:18 +0300
+Subject: ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is
+ disabled
+
+From: Rander Wang <rander.wang@intel.com>
+
+[ Upstream commit 13774d81f38538c5fa2924bdcdfa509155480fa6 ]
+
+In snd_hdac_device_init pm_runtime_set_active is called to
+increase child_count in parent device. But when it is failed
+to build connection with GPU for one case that integrated
+graphic gpu is disabled, snd_hdac_ext_bus_device_exit will be
+invoked to clean up a HD-audio extended codec base device. At
+this time the child_count of parent is not decreased, which
+makes parent device can't get suspended.
+
+This patch calls pm_runtime_set_suspended to decrease child_count
+in parent device in snd_hdac_device_exit to match with
+snd_hdac_device_init. pm_runtime_set_suspended can make sure that
+it will not decrease child_count if the device is already suspended.
+
+Signed-off-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200902154218.1440441-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/hdac_device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c
+index 03c9872c31cfe..73264d5f58f81 100644
+--- a/sound/hda/hdac_device.c
++++ b/sound/hda/hdac_device.c
+@@ -123,6 +123,8 @@ EXPORT_SYMBOL_GPL(snd_hdac_device_init);
+ void snd_hdac_device_exit(struct hdac_device *codec)
+ {
+ pm_runtime_put_noidle(&codec->dev);
++ /* keep balance of runtime PM child_count in parent device */
++ pm_runtime_set_suspended(&codec->dev);
+ snd_hdac_bus_remove_device(codec->bus, codec);
+ kfree(codec->vendor_name);
+ kfree(codec->chip_name);
+--
+2.25.1
+
--- /dev/null
+From acbafd1762fd4d0cace7f2430949ef3ebcc0c18b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 10:26:40 -0500
+Subject: ARM: dts: socfpga: fix register entry for timer3 on Arria10
+
+From: Dinh Nguyen <dinguyen@kernel.org>
+
+[ Upstream commit 0ff5a4812be4ebd4782bbb555d369636eea164f7 ]
+
+Fixes the register address for the timer3 entry on Arria10.
+
+Fixes: 475dc86d08de4 ("arm: dts: socfpga: Add a base DTSI for Altera's Arria10 SOC")
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
+index 4d496479e1353..342ae7ef9f08c 100644
+--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
+@@ -710,7 +710,7 @@
+ timer3: timer3@ffd00100 {
+ compatible = "snps,dw-apb-timer";
+ interrupts = <0 118 IRQ_TYPE_LEVEL_HIGH>;
+- reg = <0xffd01000 0x100>;
++ reg = <0xffd00100 0x100>;
+ clocks = <&l4_sys_free_clk>;
+ clock-names = "timer";
+ };
+--
+2.25.1
+
--- /dev/null
+From 953a6094985139353a4220c4f1c82e0991412e21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 00:07:52 -0700
+Subject: drivers/net/wan/hdlc_cisco: Add hard_header_len
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 1a545ebe380bf4c1433e3c136e35a77764fda5ad ]
+
+This driver didn't set hard_header_len. This patch sets hard_header_len
+for it according to its header_ops->create function.
+
+This driver's header_ops->create function (cisco_hard_header) creates
+a header of (struct hdlc_header), so hard_header_len should be set to
+sizeof(struct hdlc_header).
+
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Acked-by: Krzysztof Halasa <khc@pm.waw.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/hdlc_cisco.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
+index a408abc25512a..7f99fb666f196 100644
+--- a/drivers/net/wan/hdlc_cisco.c
++++ b/drivers/net/wan/hdlc_cisco.c
+@@ -377,6 +377,7 @@ static int cisco_ioctl(struct net_device *dev, struct ifreq *ifr)
+ memcpy(&state(hdlc)->settings, &new_settings, size);
+ spin_lock_init(&state(hdlc)->lock);
+ dev->header_ops = &cisco_header_ops;
++ dev->hard_header_len = sizeof(struct hdlc_header);
+ dev->type = ARPHRD_CISCO;
+ call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev);
+ netif_dormant_on(dev);
+--
+2.25.1
+
--- /dev/null
+From 3e7653da3c43c0d006c1d7941b0fe78de7ab1c4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Aug 2020 14:26:59 -0700
+Subject: drivers/net/wan/lapbether: Added needed_tailroom
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 1ee39c1448c4e0d480c5b390e2db1987561fb5c2 ]
+
+The underlying Ethernet device may request necessary tailroom to be
+allocated by setting needed_tailroom. This driver should also set
+needed_tailroom to request the tailroom needed by the underlying
+Ethernet device to be allocated.
+
+Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/lapbether.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 6eb0f7a85e531..5befc7f3f0e7a 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -343,6 +343,7 @@ static int lapbeth_new_device(struct net_device *dev)
+ */
+ ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len
+ + dev->needed_headroom;
++ ndev->needed_tailroom = dev->needed_tailroom;
+
+ lapbeth = netdev_priv(ndev);
+ lapbeth->axdev = ndev;
+--
+2.25.1
+
--- /dev/null
+From e6c838ba37bb7b67b0634c76a284b411553a47ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 20:03:53 -0700
+Subject: drivers/net/wan/lapbether: Set network_header before transmitting
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 91244d108441013b7367b3b4dcc6869998676473 ]
+
+Set the skb's network_header before it is passed to the underlying
+Ethernet device for transmission.
+
+This patch fixes the following issue:
+
+When we use this driver with AF_PACKET sockets, there would be error
+messages of:
+ protocol 0805 is buggy, dev (Ethernet interface name)
+printed in the system "dmesg" log.
+
+This is because skbs passed down to the Ethernet device for transmission
+don't have their network_header properly set, and the dev_queue_xmit_nit
+function in net/core/dev.c complains about this.
+
+Reason of setting the network_header to this place (at the end of the
+Ethernet header, and at the beginning of the Ethernet payload):
+
+Because when this driver receives an skb from the Ethernet device, the
+network_header is also set at this place.
+
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/lapbether.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 5befc7f3f0e7a..c6db9a4e7c457 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -213,6 +213,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb)
+
+ skb->dev = dev = lapbeth->ethdev;
+
++ skb_reset_network_header(skb);
++
+ dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0);
+
+ dev_queue_xmit(skb);
+--
+2.25.1
+
--- /dev/null
+From 1c2ecb2f3509ab09859284348ebbd354bcf93d10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Aug 2020 19:29:35 +0800
+Subject: firestream: Fix memleak in fs_open
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 15ac5cdafb9202424206dc5bd376437a358963f9 ]
+
+When make_rate() fails, vcc should be freed just
+like other error paths in fs_open().
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/firestream.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
+index 82296fe2ba3bd..7cb2b863e653e 100644
+--- a/drivers/atm/firestream.c
++++ b/drivers/atm/firestream.c
+@@ -1013,6 +1013,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
+ error = make_rate (pcr, r, &tmc0, NULL);
+ if (error) {
+ kfree(tc);
++ kfree(vcc);
+ return error;
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From 191b2e94cc39949fa020914ae51171ad5d26d40f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Sep 2020 18:58:08 +0300
+Subject: gcov: Disable gcov build with GCC 10
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit cfc905f158eaa099d6258031614d11869e7ef71c ]
+
+GCOV built with GCC 10 doesn't initialize n_function variable. This
+produces different kernel panics as was seen by Colin in Ubuntu and me
+in FC 32.
+
+As a workaround, let's disable GCOV build for broken GCC 10 version.
+
+Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1891288
+Link: https://lore.kernel.org/lkml/20200827133932.3338519-1-leon@kernel.org
+Link: https://lore.kernel.org/lkml/CAHk-=whbijeSdSvx-Xcr0DPMj0BiwhJ+uiNnDSVZcr_h_kg7UA@mail.gmail.com/
+Cc: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/gcov/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/gcov/Kconfig b/kernel/gcov/Kconfig
+index 1276aabaab550..1d78ed19a3512 100644
+--- a/kernel/gcov/Kconfig
++++ b/kernel/gcov/Kconfig
+@@ -3,6 +3,7 @@ menu "GCOV-based kernel profiling"
+ config GCOV_KERNEL
+ bool "Enable gcov-based kernel profiling"
+ depends on DEBUG_FS
++ depends on !CC_IS_GCC || GCC_VERSION < 100000
+ select CONSTRUCTORS if !UML
+ default n
+ ---help---
+--
+2.25.1
+
--- /dev/null
+From 3d0aab142e4f9168c3026a42109311ed5d127227 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 11:32:18 +0200
+Subject: iio: adc: mcp3422: fix locking on error path
+
+From: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+
+[ Upstream commit a139ffa40f0c24b753838b8ef3dcf6ad10eb7854 ]
+
+Reading from the chip should be unlocked on error path else the lock
+could never being released.
+
+Fixes: 07914c84ba30 ("iio: adc: Add driver for Microchip MCP3422/3/4 high resolution ADC")
+Fixes: 3f1093d83d71 ("iio: adc: mcp3422: fix locking scope")
+Acked-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+Link: https://lore.kernel.org/r/20200901093218.1500845-1-angelo.compagnucci@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/mcp3422.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
+index 254135e077922..25f3e58cd4d05 100644
+--- a/drivers/iio/adc/mcp3422.c
++++ b/drivers/iio/adc/mcp3422.c
+@@ -148,8 +148,10 @@ static int mcp3422_read_channel(struct mcp3422 *adc,
+ config &= ~MCP3422_PGA_MASK;
+ config |= MCP3422_PGA_VALUE(adc->pga[req_channel]);
+ ret = mcp3422_update_config(adc, config);
+- if (ret < 0)
++ if (ret < 0) {
++ mutex_unlock(&adc->lock);
+ return ret;
++ }
+ msleep(mcp3422_read_times[MCP3422_SAMPLE_RATE(adc->config)]);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From ac9d35d536c1c176849e7844bd555ba3dc974a96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 12:10:33 -0700
+Subject: irqchip/eznps: Fix build error for !ARC700 builds
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+[ Upstream commit 89d29997f103d08264b0685796b420d911658b96 ]
+
+eznps driver is supposed to be platform independent however it ends up
+including stuff from inside arch/arc headers leading to rand config
+build errors.
+
+The quick hack to fix this (proper fix is too much chrun for non active
+user-base) is to add following to nps platform agnostic header.
+ - copy AUX_IENABLE from arch/arc header
+ - move CTOP_AUX_IACK from arch/arc/plat-eznps/*/**
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lkml.kernel.org/r/20200824095831.5lpkmkafelnvlpi2@linutronix.de
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/plat-eznps/include/plat/ctop.h | 1 -
+ include/soc/nps/common.h | 6 ++++++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arc/plat-eznps/include/plat/ctop.h b/arch/arc/plat-eznps/include/plat/ctop.h
+index 3c401ce0351ef..fb959828630ce 100644
+--- a/arch/arc/plat-eznps/include/plat/ctop.h
++++ b/arch/arc/plat-eznps/include/plat/ctop.h
+@@ -42,7 +42,6 @@
+ #define CTOP_AUX_HW_COMPLY (CTOP_AUX_BASE + 0x024)
+ #define CTOP_AUX_LPC (CTOP_AUX_BASE + 0x030)
+ #define CTOP_AUX_EFLAGS (CTOP_AUX_BASE + 0x080)
+-#define CTOP_AUX_IACK (CTOP_AUX_BASE + 0x088)
+ #define CTOP_AUX_GPA1 (CTOP_AUX_BASE + 0x08C)
+ #define CTOP_AUX_UDMC (CTOP_AUX_BASE + 0x300)
+
+diff --git a/include/soc/nps/common.h b/include/soc/nps/common.h
+index 9b1d43d671a3f..8c18dc6d3fde5 100644
+--- a/include/soc/nps/common.h
++++ b/include/soc/nps/common.h
+@@ -45,6 +45,12 @@
+ #define CTOP_INST_MOV2B_FLIP_R3_B1_B2_INST 0x5B60
+ #define CTOP_INST_MOV2B_FLIP_R3_B1_B2_LIMM 0x00010422
+
++#ifndef AUX_IENABLE
++#define AUX_IENABLE 0x40c
++#endif
++
++#define CTOP_AUX_IACK (0xFFFFF800 + 0x088)
++
+ #ifndef __ASSEMBLY__
+
+ /* In order to increase compilation test coverage */
+--
+2.25.1
+
--- /dev/null
+From d32680140b48f6562900656040c1250de0f2e7c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Aug 2020 15:23:43 +0800
+Subject: NFC: st95hf: Fix memleak in st95hf_in_send_cmd
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit f97c04c316d8fea16dca449fdfbe101fbdfee6a2 ]
+
+When down_killable() fails, skb_resp should be freed
+just like when st95hf_spi_send() fails.
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/st95hf/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c
+index 850e75571c8ee..bb1e878913f3a 100644
+--- a/drivers/nfc/st95hf/core.c
++++ b/drivers/nfc/st95hf/core.c
+@@ -981,7 +981,7 @@ static int st95hf_in_send_cmd(struct nfc_digital_dev *ddev,
+ rc = down_killable(&stcontext->exchange_lock);
+ if (rc) {
+ WARN(1, "Semaphore is not found up in st95hf_in_send_cmd\n");
+- return rc;
++ goto free_skb_resp;
+ }
+
+ rc = st95hf_spi_send(&stcontext->spicontext, skb->data,
+--
+2.25.1
+
--- /dev/null
+From 7227f9d5107d44ccd2ab3d7a3c042ed63a35797f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2020 13:43:10 +0300
+Subject: RDMA/rxe: Drop pointless checks in rxe_init_ports
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 6112ef62826e91afbae5446d5d47b38e25f47e3f ]
+
+Both pkey_tbl_len and gid_tbl_len are set in rxe_init_port_param() - so no
+need to check if they aren't set.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20200705104313.283034-2-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index ab6c3c25d7ff9..c11d33a30183c 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -168,9 +168,6 @@ static int rxe_init_ports(struct rxe_dev *rxe)
+
+ rxe_init_port_param(port);
+
+- if (!port->attr.pkey_tbl_len || !port->attr.gid_tbl_len)
+- return -EINVAL;
+-
+ port->pkey_tbl = kcalloc(port->attr.pkey_tbl_len,
+ sizeof(*port->pkey_tbl), GFP_KERNEL);
+
+--
+2.25.1
+
--- /dev/null
+From cb284a0be5db84c5b5f0e54aa80cc445dfcdf2e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Aug 2020 15:56:32 +0800
+Subject: RDMA/rxe: Fix memleak in rxe_mem_init_user
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit e3ddd6067ee62f6e76ebcf61ff08b2c729ae412b ]
+
+When page_address() fails, umem should be freed just like when
+rxe_mem_alloc() fails.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20200819075632.22285-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_mr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index 9b732c5f89e16..6d1ba75398a1a 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -205,6 +205,7 @@ int rxe_mem_init_user(struct rxe_dev *rxe, struct rxe_pd *pd, u64 start,
+ vaddr = page_address(sg_page(sg));
+ if (!vaddr) {
+ pr_warn("null vaddr\n");
++ ib_umem_release(umem);
+ err = -ENOMEM;
+ goto err1;
+ }
+--
+2.25.1
+
--- /dev/null
+From d27f1d67ccb5703d1d2ca75ccc7c9a732bc303d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 15:24:26 +0800
+Subject: scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA
+
+From: Luo Jiaxing <luojiaxing@huawei.com>
+
+[ Upstream commit 53de092f47ff40e8d4d78d590d95819d391bf2e0 ]
+
+It was discovered that sdparm will fail when attempting to disable write
+cache on a SATA disk connected via libsas.
+
+In the ATA command set the write cache state is controlled through the SET
+FEATURES operation. This is roughly corresponds to MODE SELECT in SCSI and
+the latter command is what is used in the SCSI-ATA translation layer. A
+subtle difference is that a MODE SELECT carries data whereas SET FEATURES
+is defined as a non-data command in ATA.
+
+Set the DMA data direction to DMA_NONE if the requested ATA command is
+identified as non-data.
+
+[mkp: commit desc]
+
+Fixes: fa1c1e8f1ece ("[SCSI] Add SATA support to libsas")
+Link: https://lore.kernel.org/r/1598426666-54544-1-git-send-email-luojiaxing@huawei.com
+Reviewed-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Signed-off-by: Luo Jiaxing <luojiaxing@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_ata.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
+index 87f5e694dbedd..b820c3a022eac 100644
+--- a/drivers/scsi/libsas/sas_ata.c
++++ b/drivers/scsi/libsas/sas_ata.c
+@@ -227,7 +227,10 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
+ task->num_scatter = si;
+ }
+
+- task->data_dir = qc->dma_dir;
++ if (qc->tf.protocol == ATA_PROT_NODATA)
++ task->data_dir = DMA_NONE;
++ else
++ task->data_dir = qc->dma_dir;
+ task->scatter = qc->sg;
+ task->ata_task.retry_count = 1;
+ task->task_state_flags = SAS_TASK_STATE_PENDING;
+--
+2.25.1
+
--- /dev/null
+arm-dts-socfpga-fix-register-entry-for-timer3-on-arr.patch
+rdma-rxe-fix-memleak-in-rxe_mem_init_user.patch
+rdma-rxe-drop-pointless-checks-in-rxe_init_ports.patch
+iio-adc-mcp3422-fix-locking-on-error-path.patch
+scsi-libsas-set-data_dir-as-dma_none-if-libata-marks.patch
+drivers-net-wan-lapbether-added-needed_tailroom.patch
+nfc-st95hf-fix-memleak-in-st95hf_in_send_cmd.patch
+firestream-fix-memleak-in-fs_open.patch
+alsa-hda-fix-2-channel-swapping-for-tegra.patch
+drivers-net-wan-lapbether-set-network_header-before-.patch
+xfs-initialize-the-shortform-attr-header-padding-ent.patch
+irqchip-eznps-fix-build-error-for-arc700-builds.patch
+drivers-net-wan-hdlc_cisco-add-hard_header_len.patch
+alsa-hda-fix-a-runtime-pm-issue-in-sof-when-integrat.patch
+gcov-disable-gcov-build-with-gcc-10.patch
--- /dev/null
+From 34354a6e2072d1cbff08645927d6b786b07ad276 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 14:12:18 -0700
+Subject: xfs: initialize the shortform attr header padding entry
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 125eac243806e021f33a1fdea3687eccbb9f7636 ]
+
+Don't leak kernel memory contents into the shortform attr fork.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_attr_leaf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index 70da4113c2baf..7b9dd76403bfd 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -520,8 +520,8 @@ xfs_attr_shortform_create(xfs_da_args_t *args)
+ ASSERT(ifp->if_flags & XFS_IFINLINE);
+ }
+ xfs_idata_realloc(dp, sizeof(*hdr), XFS_ATTR_FORK);
+- hdr = (xfs_attr_sf_hdr_t *)ifp->if_u1.if_data;
+- hdr->count = 0;
++ hdr = (struct xfs_attr_sf_hdr *)ifp->if_u1.if_data;
++ memset(hdr, 0, sizeof(*hdr));
+ hdr->totsize = cpu_to_be16(sizeof(*hdr));
+ xfs_trans_log_inode(args->trans, dp, XFS_ILOG_CORE | XFS_ILOG_ADATA);
+ }
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
