--- /dev/null
+From b95dc06af3e683d6b7ddbbae178b2b2a21ee8b2b Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 22 Dec 2021 22:57:16 -0500
+Subject: drm/amdgpu: disable runpm if we are the primary adapter
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b95dc06af3e683d6b7ddbbae178b2b2a21ee8b2b upstream.
+
+If we are the primary adapter (i.e., the one used by the firwmare
+framebuffer), disable runtime pm. This fixes a regression caused
+by commit 55285e21f045 which results in the displays waking up
+shortly after they go to sleep due to the device coming out of
+runtime suspend and sending a hotplug uevent.
+
+v2: squash in reworked fix from Evan
+
+Fixes: 55285e21f045 ("fbdev/efifb: Release PCI device's runtime PM ref during FB destroy")
+Bug: https://bugzilla.kernel.org/show_bug.cgi?id=215203
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1840
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 +
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 28 ++++++++++++++++++++++++++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 6 ++++++
+ 3 files changed, 35 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -1069,6 +1069,7 @@ struct amdgpu_device {
+ bool runpm;
+ bool in_runpm;
+ bool has_pr3;
++ bool is_fw_fb;
+
+ bool pm_sysfs_en;
+ bool ucode_sysfs_en;
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -38,6 +38,7 @@
+ #include <drm/drm_probe_helper.h>
+ #include <linux/mmu_notifier.h>
+ #include <linux/suspend.h>
++#include <linux/fb.h>
+
+ #include "amdgpu.h"
+ #include "amdgpu_irq.h"
+@@ -1246,6 +1247,26 @@ MODULE_DEVICE_TABLE(pci, pciidlist);
+
+ static const struct drm_driver amdgpu_kms_driver;
+
++static bool amdgpu_is_fw_framebuffer(resource_size_t base,
++ resource_size_t size)
++{
++ bool found = false;
++#if IS_REACHABLE(CONFIG_FB)
++ struct apertures_struct *a;
++
++ a = alloc_apertures(1);
++ if (!a)
++ return false;
++
++ a->ranges[0].base = base;
++ a->ranges[0].size = size;
++
++ found = is_firmware_framebuffer(a);
++ kfree(a);
++#endif
++ return found;
++}
++
+ static int amdgpu_pci_probe(struct pci_dev *pdev,
+ const struct pci_device_id *ent)
+ {
+@@ -1254,6 +1275,8 @@ static int amdgpu_pci_probe(struct pci_d
+ unsigned long flags = ent->driver_data;
+ int ret, retry = 0;
+ bool supports_atomic = false;
++ bool is_fw_fb;
++ resource_size_t base, size;
+
+ if (amdgpu_virtual_display ||
+ amdgpu_device_asic_has_dc_support(flags & AMD_ASIC_MASK))
+@@ -1310,6 +1333,10 @@ static int amdgpu_pci_probe(struct pci_d
+ }
+ #endif
+
++ base = pci_resource_start(pdev, 0);
++ size = pci_resource_len(pdev, 0);
++ is_fw_fb = amdgpu_is_fw_framebuffer(base, size);
++
+ /* Get rid of things like offb */
+ ret = drm_aperture_remove_conflicting_pci_framebuffers(pdev, &amdgpu_kms_driver);
+ if (ret)
+@@ -1322,6 +1349,7 @@ static int amdgpu_pci_probe(struct pci_d
+ adev->dev = &pdev->dev;
+ adev->pdev = pdev;
+ ddev = adev_to_drm(adev);
++ adev->is_fw_fb = is_fw_fb;
+
+ if (!supports_atomic)
+ ddev->driver_features &= ~DRIVER_ATOMIC;
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -206,6 +206,12 @@ int amdgpu_driver_load_kms(struct amdgpu
+ adev->runpm = true;
+ break;
+ }
++ /* XXX: disable runtime pm if we are the primary adapter
++ * to avoid displays being re-enabled after DPMS.
++ * This needs to be sorted out and fixed properly.
++ */
++ if (adev->is_fw_fb)
++ adev->runpm = false;
+ if (adev->runpm)
+ dev_info(adev->dev, "Using BACO for runtime pm\n");
+ }
--- /dev/null
+From 9a45ac2320d0a6ae01880a30d4b86025fce4061b Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 22 Dec 2021 22:41:18 -0500
+Subject: fbdev: fbmem: add a helper to determine if an aperture is used by a fw fb
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 9a45ac2320d0a6ae01880a30d4b86025fce4061b upstream.
+
+Add a function for drivers to check if the a firmware initialized
+fb is corresponds to their aperture. This allows drivers to check if the
+device corresponds to what the firmware set up as the display device.
+
+Bug: https://bugzilla.kernel.org/show_bug.cgi?id=215203
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1840
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/core/fbmem.c | 47 +++++++++++++++++++++++++++++++++++++++
+ include/linux/fb.h | 1
+ 2 files changed, 48 insertions(+)
+
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -1760,6 +1760,53 @@ int remove_conflicting_framebuffers(stru
+ EXPORT_SYMBOL(remove_conflicting_framebuffers);
+
+ /**
++ * is_firmware_framebuffer - detect if firmware-configured framebuffer matches
++ * @a: memory range, users of which are to be checked
++ *
++ * This function checks framebuffer devices (initialized by firmware/bootloader)
++ * which use memory range described by @a. If @a matchesm the function returns
++ * true, otherwise false.
++ */
++bool is_firmware_framebuffer(struct apertures_struct *a)
++{
++ bool do_free = false;
++ bool found = false;
++ int i;
++
++ if (!a) {
++ a = alloc_apertures(1);
++ if (!a)
++ return false;
++
++ a->ranges[0].base = 0;
++ a->ranges[0].size = ~0;
++ do_free = true;
++ }
++
++ mutex_lock(®istration_lock);
++ /* check all firmware fbs and kick off if the base addr overlaps */
++ for_each_registered_fb(i) {
++ struct apertures_struct *gen_aper;
++
++ if (!(registered_fb[i]->flags & FBINFO_MISC_FIRMWARE))
++ continue;
++
++ gen_aper = registered_fb[i]->apertures;
++ if (fb_do_apertures_overlap(gen_aper, a)) {
++ found = true;
++ break;
++ }
++ }
++ mutex_unlock(®istration_lock);
++
++ if (do_free)
++ kfree(a);
++
++ return found;
++}
++EXPORT_SYMBOL(is_firmware_framebuffer);
++
++/**
+ * remove_conflicting_pci_framebuffers - remove firmware-configured framebuffers for PCI devices
+ * @pdev: PCI device
+ * @name: requesting driver name
+--- a/include/linux/fb.h
++++ b/include/linux/fb.h
+@@ -610,6 +610,7 @@ extern int remove_conflicting_pci_frameb
+ const char *name);
+ extern int remove_conflicting_framebuffers(struct apertures_struct *a,
+ const char *name, bool primary);
++extern bool is_firmware_framebuffer(struct apertures_struct *a);
+ extern int fb_prepare_logo(struct fb_info *fb_info, int rotate);
+ extern int fb_show_logo(struct fb_info *fb_info, int rotate);
+ extern char* fb_get_buffer_offset(struct fb_info *info, struct fb_pixmap *buf, u32 size);
--- /dev/null
+From e5a7431f5a2d6dcff7d516ee9d178a3254b17b87 Mon Sep 17 00:00:00 2001
+From: Steven Lee <steven_lee@aspeedtech.com>
+Date: Tue, 14 Dec 2021 12:02:38 +0800
+Subject: gpio: gpio-aspeed-sgpio: Fix wrong hwirq base in irq handler
+
+From: Steven Lee <steven_lee@aspeedtech.com>
+
+commit e5a7431f5a2d6dcff7d516ee9d178a3254b17b87 upstream.
+
+Each aspeed sgpio bank has 64 gpio pins(32 input pins and 32 output pins).
+The hwirq base for each sgpio bank should be multiples of 64 rather than
+multiples of 32.
+
+Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-aspeed-sgpio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpio-aspeed-sgpio.c
++++ b/drivers/gpio/gpio-aspeed-sgpio.c
+@@ -395,7 +395,7 @@ static void aspeed_sgpio_irq_handler(str
+ reg = ioread32(bank_reg(data, bank, reg_irq_status));
+
+ for_each_set_bit(p, ®, 32)
+- generic_handle_domain_irq(gc->irq.domain, i * 32 + p * 2);
++ generic_handle_domain_irq(gc->irq.domain, (i * 32 + p) * 2);
+ }
+
+ chained_irq_exit(ic, desc);
--- /dev/null
+From 72a4a87da8f7bcf868b338615a814b6542f277f3 Mon Sep 17 00:00:00 2001
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Date: Wed, 5 Jan 2022 14:53:04 +1300
+Subject: i2c: mpc: Avoid out of bounds memory access
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+commit 72a4a87da8f7bcf868b338615a814b6542f277f3 upstream.
+
+When performing an I2C transfer where the last message was a write KASAN
+would complain:
+
+ BUG: KASAN: slab-out-of-bounds in mpc_i2c_do_action+0x154/0x630
+ Read of size 2 at addr c814e310 by task swapper/2/0
+
+ CPU: 2 PID: 0 Comm: swapper/2 Tainted: G B 5.16.0-rc8 #1
+ Call Trace:
+ [e5ee9d50] [c08418e8] dump_stack_lvl+0x4c/0x6c (unreliable)
+ [e5ee9d70] [c02f8a14] print_address_description.constprop.13+0x64/0x3b0
+ [e5ee9da0] [c02f9030] kasan_report+0x1f0/0x204
+ [e5ee9de0] [c0c76ee4] mpc_i2c_do_action+0x154/0x630
+ [e5ee9e30] [c0c782c4] mpc_i2c_isr+0x164/0x240
+ [e5ee9e60] [c00f3a04] __handle_irq_event_percpu+0xf4/0x3b0
+ [e5ee9ec0] [c00f3d40] handle_irq_event_percpu+0x80/0x110
+ [e5ee9f40] [c00f3e48] handle_irq_event+0x78/0xd0
+ [e5ee9f60] [c00fcfec] handle_fasteoi_irq+0x19c/0x370
+ [e5ee9fa0] [c00f1d84] generic_handle_irq+0x54/0x80
+ [e5ee9fc0] [c0006b54] __do_irq+0x64/0x200
+ [e5ee9ff0] [c0007958] __do_IRQ+0xe8/0x1c0
+ [c812dd50] [e3eaab20] 0xe3eaab20
+ [c812dd90] [c0007a4c] do_IRQ+0x1c/0x30
+ [c812dda0] [c0000c04] ExternalInput+0x144/0x160
+ --- interrupt: 500 at arch_cpu_idle+0x34/0x60
+ NIP: c000b684 LR: c000b684 CTR: c0019688
+ REGS: c812ddb0 TRAP: 0500 Tainted: G B (5.16.0-rc8)
+ MSR: 00029002 <CE,EE,ME> CR: 22000488 XER: 20000000
+
+ GPR00: c10ef7fc c812de90 c80ff200 c2394718 00000001 00000001 c10e3f90 00000003
+ GPR08: 00000000 c0019688 c2394718 fc7d625b 22000484 00000000 21e17000 c208228c
+ GPR16: e3e99284 00000000 ffffffff c2390000 c001bac0 c2082288 c812df60 c001ba60
+ GPR24: c23949c0 00000018 00080000 00000004 c80ff200 00000002 c2348ee4 c2394718
+ NIP [c000b684] arch_cpu_idle+0x34/0x60
+ LR [c000b684] arch_cpu_idle+0x34/0x60
+ --- interrupt: 500
+ [c812de90] [c10e3f90] rcu_eqs_enter.isra.60+0xc0/0x110 (unreliable)
+ [c812deb0] [c10ef7fc] default_idle_call+0xbc/0x230
+ [c812dee0] [c00af0e8] do_idle+0x1c8/0x200
+ [c812df10] [c00af3c0] cpu_startup_entry+0x20/0x30
+ [c812df20] [c001e010] start_secondary+0x5d0/0xba0
+ [c812dff0] [c00028a0] __secondary_start+0x90/0xdc
+
+This happened because we would overrun the i2c->msgs array on the final
+interrupt for the I2C STOP. This didn't happen if the last message was a
+read because there is no interrupt in that case. Ensure that we only
+access the current message if we are not processing a I2C STOP
+condition.
+
+Fixes: 1538d82f4647 ("i2c: mpc: Interrupt driven transfer")
+Reported-by: Maxime Bizon <mbizon@freebox.fr>
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-mpc.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-mpc.c
++++ b/drivers/i2c/busses/i2c-mpc.c
+@@ -492,7 +492,7 @@ static void mpc_i2c_finish(struct mpc_i2
+
+ static void mpc_i2c_do_action(struct mpc_i2c *i2c)
+ {
+- struct i2c_msg *msg = &i2c->msgs[i2c->curr_msg];
++ struct i2c_msg *msg = NULL;
+ int dir = 0;
+ int recv_len = 0;
+ u8 byte;
+@@ -501,10 +501,13 @@ static void mpc_i2c_do_action(struct mpc
+
+ i2c->cntl_bits &= ~(CCR_RSTA | CCR_MTX | CCR_TXAK);
+
+- if (msg->flags & I2C_M_RD)
+- dir = 1;
+- if (msg->flags & I2C_M_RECV_LEN)
+- recv_len = 1;
++ if (i2c->action != MPC_I2C_ACTION_STOP) {
++ msg = &i2c->msgs[i2c->curr_msg];
++ if (msg->flags & I2C_M_RD)
++ dir = 1;
++ if (msg->flags & I2C_M_RECV_LEN)
++ recv_len = 1;
++ }
+
+ switch (i2c->action) {
+ case MPC_I2C_ACTION_RESTART:
+@@ -581,7 +584,7 @@ static void mpc_i2c_do_action(struct mpc
+ break;
+ }
+
+- if (msg->len == i2c->byte_posn) {
++ if (msg && msg->len == i2c->byte_posn) {
+ i2c->curr_msg++;
+ i2c->byte_posn = 0;
+
--- /dev/null
+From d6d86830705f173fca6087a3e67ceaf68db80523 Mon Sep 17 00:00:00 2001
+From: Haimin Zhang <tcs_kernel@tencent.com>
+Date: Fri, 31 Dec 2021 10:35:23 +0800
+Subject: net ticp:fix a kernel-infoleak in __tipc_sendmsg()
+
+From: Haimin Zhang <tcs_kernel@tencent.com>
+
+commit d6d86830705f173fca6087a3e67ceaf68db80523 upstream.
+
+struct tipc_socket_addr.ref has a 4-byte hole,and __tipc_getname() currently
+copying it to user space,causing kernel-infoleak.
+
+BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline]
+BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/usercopy.c:33
+BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33
+ instrument_copy_to_user include/linux/instrumented.h:121 [inline]
+ instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/usercopy.c:33
+ _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33
+ copy_to_user include/linux/uaccess.h:209 [inline]
+ copy_to_user include/linux/uaccess.h:209 [inline] net/socket.c:287
+ move_addr_to_user+0x3f6/0x600 net/socket.c:287 net/socket.c:287
+ __sys_getpeername+0x470/0x6b0 net/socket.c:1987 net/socket.c:1987
+ __do_sys_getpeername net/socket.c:1997 [inline]
+ __se_sys_getpeername net/socket.c:1994 [inline]
+ __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994
+ __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994
+ __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82
+ do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Uninit was stored to memory at:
+ tipc_getname+0x575/0x5e0 net/tipc/socket.c:757 net/tipc/socket.c:757
+ __sys_getpeername+0x3b3/0x6b0 net/socket.c:1984 net/socket.c:1984
+ __do_sys_getpeername net/socket.c:1997 [inline]
+ __se_sys_getpeername net/socket.c:1994 [inline]
+ __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994
+ __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994
+ __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82
+ do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Uninit was stored to memory at:
+ msg_set_word net/tipc/msg.h:212 [inline]
+ msg_set_destport net/tipc/msg.h:619 [inline]
+ msg_set_word net/tipc/msg.h:212 [inline] net/tipc/socket.c:1486
+ msg_set_destport net/tipc/msg.h:619 [inline] net/tipc/socket.c:1486
+ __tipc_sendmsg+0x44fa/0x5890 net/tipc/socket.c:1486 net/tipc/socket.c:1486
+ tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402
+ sock_sendmsg_nosec net/socket.c:704 [inline]
+ sock_sendmsg net/socket.c:724 [inline]
+ sock_sendmsg_nosec net/socket.c:704 [inline] net/socket.c:2409
+ sock_sendmsg net/socket.c:724 [inline] net/socket.c:2409
+ ____sys_sendmsg+0xe11/0x12c0 net/socket.c:2409 net/socket.c:2409
+ ___sys_sendmsg net/socket.c:2463 [inline]
+ ___sys_sendmsg net/socket.c:2463 [inline] net/socket.c:2492
+ __sys_sendmsg+0x704/0x840 net/socket.c:2492 net/socket.c:2492
+ __do_sys_sendmsg net/socket.c:2501 [inline]
+ __se_sys_sendmsg net/socket.c:2499 [inline]
+ __do_sys_sendmsg net/socket.c:2501 [inline] net/socket.c:2499
+ __se_sys_sendmsg net/socket.c:2499 [inline] net/socket.c:2499
+ __x64_sys_sendmsg+0xe2/0x120 net/socket.c:2499 net/socket.c:2499
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82
+ do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Local variable skaddr created at:
+ __tipc_sendmsg+0x2d0/0x5890 net/tipc/socket.c:1419 net/tipc/socket.c:1419
+ tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402
+
+Bytes 4-7 of 16 are uninitialized
+Memory access of size 16 starts at ffff888113753e00
+Data copied to user address 0000000020000280
+
+Reported-by: syzbot+cdbd40e0c3ca02cae3b7@syzkaller.appspotmail.com
+Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
+Acked-by: Jon Maloy <jmaloy@redhat.com>
+Link: https://lore.kernel.org/r/1640918123-14547-1-git-send-email-tcs.kernel@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/socket.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -1461,6 +1461,8 @@ static int __tipc_sendmsg(struct socket
+ msg_set_syn(hdr, 1);
+ }
+
++ memset(&skaddr, 0, sizeof(skaddr));
++
+ /* Determine destination */
+ if (atype == TIPC_SERVICE_RANGE) {
+ return tipc_sendmcast(sock, ua, m, dlen, timeout);
--- /dev/null
+From bcd0f93353326954817a4f9fa55ec57fb38acbb0 Mon Sep 17 00:00:00 2001
+From: Hangyu Hua <hbh25y@gmail.com>
+Date: Thu, 9 Dec 2021 16:28:39 +0800
+Subject: phonet: refcount leak in pep_sock_accep
+
+From: Hangyu Hua <hbh25y@gmail.com>
+
+commit bcd0f93353326954817a4f9fa55ec57fb38acbb0 upstream.
+
+sock_hold(sk) is invoked in pep_sock_accept(), but __sock_put(sk) is not
+invoked in subsequent failure branches(pep_accept_conn() != 0).
+
+Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
+Link: https://lore.kernel.org/r/20211209082839.33985-1-hbh25y@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Aayush Agarwal <aayush.a.agarwal@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/phonet/pep.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/phonet/pep.c
++++ b/net/phonet/pep.c
+@@ -868,6 +868,7 @@ static struct sock *pep_sock_accept(stru
+
+ err = pep_accept_conn(newsk, skb);
+ if (err) {
++ __sock_put(sk);
+ sock_put(newsk);
+ newsk = NULL;
+ goto drop;
--- /dev/null
+From 80211be1b9dec04cc2805d3d81e2091ecac289a1 Mon Sep 17 00:00:00 2001
+From: Yauhen Kharuzhy <jekhor@gmail.com>
+Date: Sun, 7 Nov 2021 23:20:01 +0300
+Subject: power: bq25890: Enable continuous conversion for ADC at charging
+
+From: Yauhen Kharuzhy <jekhor@gmail.com>
+
+commit 80211be1b9dec04cc2805d3d81e2091ecac289a1 upstream.
+
+Instead of one shot run of ADC at beginning of charging, run continuous
+conversion to ensure that all charging-related values are monitored
+properly (input voltage, input current, themperature etc.).
+
+Signed-off-by: Yauhen Kharuzhy <jekhor@gmail.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/supply/bq25890_charger.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/power/supply/bq25890_charger.c
++++ b/drivers/power/supply/bq25890_charger.c
+@@ -581,12 +581,12 @@ static irqreturn_t __bq25890_handle_irq(
+
+ if (!new_state.online && bq->state.online) { /* power removed */
+ /* disable ADC */
+- ret = bq25890_field_write(bq, F_CONV_START, 0);
++ ret = bq25890_field_write(bq, F_CONV_RATE, 0);
+ if (ret < 0)
+ goto error;
+ } else if (new_state.online && !bq->state.online) { /* power inserted */
+ /* enable ADC, to have control of charge current/voltage */
+- ret = bq25890_field_write(bq, F_CONV_START, 1);
++ ret = bq25890_field_write(bq, F_CONV_RATE, 1);
+ if (ret < 0)
+ goto error;
+ }
--- /dev/null
+From 644106cdb89844be2496b21175b7c0c2e0fab381 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Fri, 5 Nov 2021 08:20:50 -0700
+Subject: power: reset: ltc2952: Fix use of floating point literals
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 644106cdb89844be2496b21175b7c0c2e0fab381 upstream.
+
+A new commit in LLVM causes an error on the use of 'long double' when
+'-mno-x87' is used, which the kernel does through an alias,
+'-mno-80387' (see the LLVM commit below for more details around why it
+does this).
+
+drivers/power/reset/ltc2952-poweroff.c:162:28: error: expression requires 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not support it
+ data->wde_interval = 300L * 1E6L;
+ ^
+drivers/power/reset/ltc2952-poweroff.c:162:21: error: expression requires 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not support it
+ data->wde_interval = 300L * 1E6L;
+ ^
+drivers/power/reset/ltc2952-poweroff.c:163:41: error: expression requires 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not support it
+ data->trigger_delay = ktime_set(2, 500L*1E6L);
+ ^
+3 errors generated.
+
+This happens due to the use of a 'long double' literal. The 'E6' part of
+'1E6L' causes the literal to be a 'double' then the 'L' suffix promotes
+it to 'long double'.
+
+There is no visible reason for floating point values in this driver, as
+the values are only assigned to integer types. Use NSEC_PER_MSEC, which
+is the same integer value as '1E6L', to avoid changing functionality but
+fix the error.
+
+Fixes: 6647156c00cc ("power: reset: add LTC2952 poweroff driver")
+Link: https://github.com/ClangBuiltLinux/linux/issues/1497
+Link: https://github.com/llvm/llvm-project/commit/a8083d42b1c346e21623a1d36d1f0cadd7801d83
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/reset/ltc2952-poweroff.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/power/reset/ltc2952-poweroff.c
++++ b/drivers/power/reset/ltc2952-poweroff.c
+@@ -161,8 +161,8 @@ static void ltc2952_poweroff_kill(void)
+
+ static void ltc2952_poweroff_default(struct ltc2952_poweroff *data)
+ {
+- data->wde_interval = 300L * 1E6L;
+- data->trigger_delay = ktime_set(2, 500L*1E6L);
++ data->wde_interval = 300L * NSEC_PER_MSEC;
++ data->trigger_delay = ktime_set(2, 500L * NSEC_PER_MSEC);
+
+ hrtimer_init(&data->timer_trigger, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ data->timer_trigger.function = ltc2952_poweroff_timer_trigger;
--- /dev/null
+From 51c7b6a0398f54b9120795796a4cff4fc9634f7d Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 15 Nov 2021 00:12:07 +0100
+Subject: power: supply: core: Break capacity loop
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 51c7b6a0398f54b9120795796a4cff4fc9634f7d upstream.
+
+We should not go on looking for more capacity tables after
+we realize we have looked at the last one in
+power_supply_find_ocv2cap_table().
+
+Fixes: 3afb50d7125b ("power: supply: core: Add some helpers to use the battery OCV capacity table")
+Cc: Chunyan Zhang <chunyan.zhang@unisoc.com>
+Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/supply/power_supply_core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -853,6 +853,10 @@ power_supply_find_ocv2cap_table(struct p
+ return NULL;
+
+ for (i = 0; i < POWER_SUPPLY_OCV_TEMP_MAX; i++) {
++ /* Out of capacity tables */
++ if (!info->ocv_table[i])
++ break;
++
+ temp_diff = abs(info->ocv_temp[i] - temp);
+
+ if (temp_diff < best_temp_diff) {
--- /dev/null
+From 92c959bae2e54ba1e2540ba5f813f7752bd76be1 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 15 Dec 2021 11:14:23 +0100
+Subject: reset: renesas: Fix Runtime PM usage
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+commit 92c959bae2e54ba1e2540ba5f813f7752bd76be1 upstream.
+
+If pm_runtime_resume_and_get() fails then it returns w/o the RPM usage
+counter being incremented. In this case call pm_runtime_put() in
+remove() will result in a usage counter imbalance. Therefore check the
+return code of pm_runtime_resume_and_get() and bail out in case of error.
+
+Fixes: bee08559701f ("reset: renesas: Add RZ/G2L usbphy control driver")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/ec24e13f-0530-b091-7a08-864577b9b3be@gmail.com
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/reset/reset-rzg2l-usbphy-ctrl.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/reset/reset-rzg2l-usbphy-ctrl.c
++++ b/drivers/reset/reset-rzg2l-usbphy-ctrl.c
+@@ -137,7 +137,12 @@ static int rzg2l_usbphy_ctrl_probe(struc
+ dev_set_drvdata(dev, priv);
+
+ pm_runtime_enable(&pdev->dev);
+- pm_runtime_resume_and_get(&pdev->dev);
++ error = pm_runtime_resume_and_get(&pdev->dev);
++ if (error < 0) {
++ pm_runtime_disable(&pdev->dev);
++ reset_control_assert(priv->rstc);
++ return dev_err_probe(&pdev->dev, error, "pm_runtime_resume_and_get failed");
++ }
+
+ /* put pll and phy into reset state */
+ spin_lock_irqsave(&priv->lock, flags);
--- /dev/null
+From a19f75de73c220b4496d2aefb7a605dd032f7c01 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa@kernel.org>
+Date: Thu, 6 Jan 2022 13:24:52 +0100
+Subject: Revert "i2c: core: support bus regulator controlling in adapter"
+
+From: Wolfram Sang <wsa@kernel.org>
+
+commit a19f75de73c220b4496d2aefb7a605dd032f7c01 upstream.
+
+This largely reverts commit 5a7b95fb993ec399c8a685552aa6a8fc995c40bd. It
+breaks suspend with AMD GPUs, and we couldn't incrementally fix it. So,
+let's remove the code and go back to the drawing board. We keep the
+header extension to not break drivers already populating the regulator.
+We expect to re-add the code handling it soon.
+
+Fixes: 5a7b95fb993e ("i2c: core: support bus regulator controlling in adapter")
+Reported-by: "Tareque Md.Hanif" <tarequemd.hanif@yahoo.com>
+Link: https://lore.kernel.org/r/1295184560.182511.1639075777725@mail.yahoo.com
+Reported-by: Konstantin Kharlamov <hi-angel@yandex.ru>
+Link: https://lore.kernel.org/r/7143a7147978f4104171072d9f5225d2ce355ec1.camel@yandex.ru
+BugLink: https://gitlab.freedesktop.org/drm/amd/-/issues/1850
+Tested-by: "Tareque Md.Hanif" <tarequemd.hanif@yahoo.com>
+Tested-by: Konstantin Kharlamov <hi-angel@yandex.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Cc: <stable@vger.kernel.org> # 5.14+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/i2c-core-base.c | 95 --------------------------------------------
+ 1 file changed, 95 deletions(-)
+
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -466,14 +466,12 @@ static int i2c_smbus_host_notify_to_irq(
+ static int i2c_device_probe(struct device *dev)
+ {
+ struct i2c_client *client = i2c_verify_client(dev);
+- struct i2c_adapter *adap;
+ struct i2c_driver *driver;
+ int status;
+
+ if (!client)
+ return 0;
+
+- adap = client->adapter;
+ client->irq = client->init_irq;
+
+ if (!client->irq) {
+@@ -539,14 +537,6 @@ static int i2c_device_probe(struct devic
+
+ dev_dbg(dev, "probe\n");
+
+- if (adap->bus_regulator) {
+- status = regulator_enable(adap->bus_regulator);
+- if (status < 0) {
+- dev_err(&adap->dev, "Failed to enable bus regulator\n");
+- goto err_clear_wakeup_irq;
+- }
+- }
+-
+ status = of_clk_set_defaults(dev->of_node, false);
+ if (status < 0)
+ goto err_clear_wakeup_irq;
+@@ -604,10 +594,8 @@ put_sync_adapter:
+ static void i2c_device_remove(struct device *dev)
+ {
+ struct i2c_client *client = to_i2c_client(dev);
+- struct i2c_adapter *adap;
+ struct i2c_driver *driver;
+
+- adap = client->adapter;
+ driver = to_i2c_driver(dev->driver);
+ if (driver->remove) {
+ int status;
+@@ -622,8 +610,6 @@ static void i2c_device_remove(struct dev
+ devres_release_group(&client->dev, client->devres_group_id);
+
+ dev_pm_domain_detach(&client->dev, true);
+- if (!pm_runtime_status_suspended(&client->dev) && adap->bus_regulator)
+- regulator_disable(adap->bus_regulator);
+
+ dev_pm_clear_wake_irq(&client->dev);
+ device_init_wakeup(&client->dev, false);
+@@ -633,86 +619,6 @@ static void i2c_device_remove(struct dev
+ pm_runtime_put(&client->adapter->dev);
+ }
+
+-#ifdef CONFIG_PM_SLEEP
+-static int i2c_resume_early(struct device *dev)
+-{
+- struct i2c_client *client = i2c_verify_client(dev);
+- int err;
+-
+- if (!client)
+- return 0;
+-
+- if (pm_runtime_status_suspended(&client->dev) &&
+- client->adapter->bus_regulator) {
+- err = regulator_enable(client->adapter->bus_regulator);
+- if (err)
+- return err;
+- }
+-
+- return pm_generic_resume_early(&client->dev);
+-}
+-
+-static int i2c_suspend_late(struct device *dev)
+-{
+- struct i2c_client *client = i2c_verify_client(dev);
+- int err;
+-
+- if (!client)
+- return 0;
+-
+- err = pm_generic_suspend_late(&client->dev);
+- if (err)
+- return err;
+-
+- if (!pm_runtime_status_suspended(&client->dev) &&
+- client->adapter->bus_regulator)
+- return regulator_disable(client->adapter->bus_regulator);
+-
+- return 0;
+-}
+-#endif
+-
+-#ifdef CONFIG_PM
+-static int i2c_runtime_resume(struct device *dev)
+-{
+- struct i2c_client *client = i2c_verify_client(dev);
+- int err;
+-
+- if (!client)
+- return 0;
+-
+- if (client->adapter->bus_regulator) {
+- err = regulator_enable(client->adapter->bus_regulator);
+- if (err)
+- return err;
+- }
+-
+- return pm_generic_runtime_resume(&client->dev);
+-}
+-
+-static int i2c_runtime_suspend(struct device *dev)
+-{
+- struct i2c_client *client = i2c_verify_client(dev);
+- int err;
+-
+- if (!client)
+- return 0;
+-
+- err = pm_generic_runtime_suspend(&client->dev);
+- if (err)
+- return err;
+-
+- if (client->adapter->bus_regulator)
+- return regulator_disable(client->adapter->bus_regulator);
+- return 0;
+-}
+-#endif
+-
+-static const struct dev_pm_ops i2c_device_pm = {
+- SET_LATE_SYSTEM_SLEEP_PM_OPS(i2c_suspend_late, i2c_resume_early)
+- SET_RUNTIME_PM_OPS(i2c_runtime_suspend, i2c_runtime_resume, NULL)
+-};
+-
+ static void i2c_device_shutdown(struct device *dev)
+ {
+ struct i2c_client *client = i2c_verify_client(dev);
+@@ -772,7 +678,6 @@ struct bus_type i2c_bus_type = {
+ .probe = i2c_device_probe,
+ .remove = i2c_device_remove,
+ .shutdown = i2c_device_shutdown,
+- .pm = &i2c_device_pm,
+ };
+ EXPORT_SYMBOL_GPL(i2c_bus_type);
+
--- /dev/null
+From 29262e1f773b4b6a43711120be564c57fca07cfb Mon Sep 17 00:00:00 2001
+From: Thomas Toye <thomas@toye.io>
+Date: Sat, 1 Jan 2022 18:22:07 +0100
+Subject: rndis_host: support Hytera digital radios
+
+From: Thomas Toye <thomas@toye.io>
+
+commit 29262e1f773b4b6a43711120be564c57fca07cfb upstream.
+
+Hytera makes a range of digital (DMR) radios. These radios can be
+programmed to a allow a computer to control them over Ethernet over USB,
+either using NCM or RNDIS.
+
+This commit adds support for RNDIS for Hytera radios. I tested with a
+Hytera PD785 and a Hytera MD785G. When these radios are programmed to
+set up a Radio to PC Network using RNDIS, an USB interface will be added
+with class 2 (Communications), subclass 2 (Abstract Modem Control) and
+an interface protocol of 255 ("vendor specific" - lsusb even hints "MSFT
+RNDIS?").
+
+This patch is similar to the solution of this StackOverflow user, but
+that only works for the Hytera MD785:
+https://stackoverflow.com/a/53550858
+
+To use the "Radio to PC Network" functionality of Hytera DMR radios, the
+radios need to be programmed correctly in CPS (Hytera's Customer
+Programming Software). "Forward to PC" should be checked in "Network"
+(under "General Setting" in "Conventional") and the "USB Network
+Communication Protocol" should be set to RNDIS.
+
+Signed-off-by: Thomas Toye <thomas@toye.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/rndis_host.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/usb/rndis_host.c
++++ b/drivers/net/usb/rndis_host.c
+@@ -609,6 +609,11 @@ static const struct usb_device_id produc
+ USB_CLASS_COMM, 2 /* ACM */, 0x0ff),
+ .driver_info = (unsigned long) &rndis_poll_status_info,
+ }, {
++ /* Hytera Communications DMR radios' "Radio to PC Network" */
++ USB_VENDOR_AND_INTERFACE_INFO(0x238b,
++ USB_CLASS_COMM, 2 /* ACM */, 0x0ff),
++ .driver_info = (unsigned long)&rndis_info,
++}, {
+ /* RNDIS is MSFT's un-official variant of CDC ACM */
+ USB_INTERFACE_INFO(USB_CLASS_COMM, 2 /* ACM */, 0x0ff),
+ .driver_info = (unsigned long) &rndis_info,
cgroup-use-open-time-credentials-for-process-migraton-perm-checks.patch
cgroup-allocate-cgroup_file_ctx-for-kernfs_open_file-priv.patch
cgroup-use-open-time-cgroup-namespace-for-process-migration-perm-checks.patch
+revert-i2c-core-support-bus-regulator-controlling-in-adapter.patch
+i2c-mpc-avoid-out-of-bounds-memory-access.patch
+xfs-map-unwritten-blocks-in-xfs_ioc_-alloc-free-sp-just-like-fallocate.patch
+power-supply-core-break-capacity-loop.patch
+power-reset-ltc2952-fix-use-of-floating-point-literals.patch
+reset-renesas-fix-runtime-pm-usage.patch
+rndis_host-support-hytera-digital-radios.patch
+gpio-gpio-aspeed-sgpio-fix-wrong-hwirq-base-in-irq-handler.patch
+net-ticp-fix-a-kernel-infoleak-in-__tipc_sendmsg.patch
+phonet-refcount-leak-in-pep_sock_accep.patch
+fbdev-fbmem-add-a-helper-to-determine-if-an-aperture-is-used-by-a-fw-fb.patch
+drm-amdgpu-disable-runpm-if-we-are-the-primary-adapter.patch
+power-bq25890-enable-continuous-conversion-for-adc-at-charging.patch
--- /dev/null
+From 983d8e60f50806f90534cc5373d0ce867e5aaf79 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <djwong@kernel.org>
+Date: Wed, 22 Dec 2021 14:19:18 -0800
+Subject: xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
+
+From: Darrick J. Wong <djwong@kernel.org>
+
+commit 983d8e60f50806f90534cc5373d0ce867e5aaf79 upstream.
+
+The old ALLOCSP/FREESP ioctls in XFS can be used to preallocate space at
+the end of files, just like fallocate and RESVSP. Make the behavior
+consistent with the other ioctls.
+
+Reported-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Signed-off-by: Darrick J. Wong <djwong@kernel.org>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_ioctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/xfs/xfs_ioctl.c
++++ b/fs/xfs/xfs_ioctl.c
+@@ -687,7 +687,8 @@ xfs_ioc_space(
+
+ if (bf->l_start > XFS_ISIZE(ip)) {
+ error = xfs_alloc_file_space(ip, XFS_ISIZE(ip),
+- bf->l_start - XFS_ISIZE(ip), 0);
++ bf->l_start - XFS_ISIZE(ip),
++ XFS_BMAPI_PREALLOC);
+ if (error)
+ goto out_unlock;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
