--- /dev/null
+From 6dbe1a432ecd652ccb2165bce1e9b82c39ebb74a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Dec 2024 22:43:39 +0000
+Subject: arm64: dts: rockchip: add hevc power domain clock to rk3328
+
+From: Peter Geis <pgwipeout@gmail.com>
+
+[ Upstream commit 3699f2c43ea9984e00d70463f8c29baaf260ea97 ]
+
+There is a race condition at startup between disabling power domains not
+used and disabling clocks not used on the rk3328. When the clocks are
+disabled first, the hevc power domain fails to shut off leading to a
+splat of failures. Add the hevc core clock to the rk3328 power domain
+node to prevent this condition.
+
+rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 3-.... }
+1087 jiffies s: 89 root: 0x8/.
+rcu: blocking rcu_node structures (internal RCU debug):
+Sending NMI from CPU 0 to CPUs 3:
+NMI backtrace for cpu 3
+CPU: 3 UID: 0 PID: 86 Comm: kworker/3:3 Not tainted 6.12.0-rc5+ #53
+Hardware name: Firefly ROC-RK3328-CC (DT)
+Workqueue: pm genpd_power_off_work_fn
+pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : regmap_unlock_spinlock+0x18/0x30
+lr : regmap_read+0x60/0x88
+sp : ffff800081123c00
+x29: ffff800081123c00 x28: ffff2fa4c62cad80 x27: 0000000000000000
+x26: ffffd74e6e660eb8 x25: ffff2fa4c62cae00 x24: 0000000000000040
+x23: ffffd74e6d2f3ab8 x22: 0000000000000001 x21: ffff800081123c74
+x20: 0000000000000000 x19: ffff2fa4c0412000 x18: 0000000000000000
+x17: 77202c31203d2065 x16: 6c6469203a72656c x15: 6c6f72746e6f632d
+x14: 7265776f703a6e6f x13: 2063766568206e69 x12: 616d6f64202c3431
+x11: 347830206f742030 x10: 3430303034783020 x9 : ffffd74e6c7369e0
+x8 : 3030316666206e69 x7 : 205d383738353733 x6 : 332e31202020205b
+x5 : ffffd74e6c73fc88 x4 : ffffd74e6c73fcd4 x3 : ffffd74e6c740b40
+x2 : ffff800080015484 x1 : 0000000000000000 x0 : ffff2fa4c0412000
+Call trace:
+regmap_unlock_spinlock+0x18/0x30
+rockchip_pmu_set_idle_request+0xac/0x2c0
+rockchip_pd_power+0x144/0x5f8
+rockchip_pd_power_off+0x1c/0x30
+_genpd_power_off+0x9c/0x180
+genpd_power_off.part.0.isra.0+0x130/0x2a8
+genpd_power_off_work_fn+0x6c/0x98
+process_one_work+0x170/0x3f0
+worker_thread+0x290/0x4a8
+kthread+0xec/0xf8
+ret_from_fork+0x10/0x20
+rockchip-pm-domain ff100000.syscon:power-controller: failed to get ack on domain 'hevc', val=0x88220
+
+Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs")
+Signed-off-by: Peter Geis <pgwipeout@gmail.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Link: https://lore.kernel.org/r/20241214224339.24674-1-pgwipeout@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index 5a706b8ffc72..28c861ac20f7 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -320,6 +320,7 @@
+
+ power-domain@RK3328_PD_HEVC {
+ reg = <RK3328_PD_HEVC>;
++ clocks = <&cru SCLK_VENC_CORE>;
+ #power-domain-cells = <0>;
+ };
+ power-domain@RK3328_PD_VIDEO {
+--
+2.39.5
+
--- /dev/null
+From fdab29a4106ff733510140e1734422e20284dc79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Apr 2021 13:29:45 +0200
+Subject: arm64: dts: rockchip: add #power-domain-cells to power domain nodes
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 837188d49823230f47afdbbec7556740e89a8557 ]
+
+Add #power-domain-cells to power domain nodes, because they
+are required by power-domain.yaml
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/20210417112952.8516-9-jbx6244@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Stable-dep-of: 3699f2c43ea9 ("arm64: dts: rockchip: add hevc power domain clock to rk3328")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/px30.dtsi | 8 ++++++++
+ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 +++
+ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 20 ++++++++++++++++++++
+ 3 files changed, 31 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/px30.dtsi b/arch/arm64/boot/dts/rockchip/px30.dtsi
+index f241e7c318bc..91e4d92d2ab2 100644
+--- a/arch/arm64/boot/dts/rockchip/px30.dtsi
++++ b/arch/arm64/boot/dts/rockchip/px30.dtsi
+@@ -250,12 +250,14 @@
+ <&cru HCLK_OTG>,
+ <&cru SCLK_OTG_ADP>;
+ pm_qos = <&qos_usb_host>, <&qos_usb_otg>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@PX30_PD_SDCARD {
+ reg = <PX30_PD_SDCARD>;
+ clocks = <&cru HCLK_SDMMC>,
+ <&cru SCLK_SDMMC>;
+ pm_qos = <&qos_sdmmc>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@PX30_PD_GMAC {
+ reg = <PX30_PD_GMAC>;
+@@ -264,6 +266,7 @@
+ <&cru SCLK_MAC_REF>,
+ <&cru SCLK_GMAC_RX_TX>;
+ pm_qos = <&qos_gmac>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@PX30_PD_MMC_NAND {
+ reg = <PX30_PD_MMC_NAND>;
+@@ -277,6 +280,7 @@
+ <&cru SCLK_SFC>;
+ pm_qos = <&qos_emmc>, <&qos_nand>,
+ <&qos_sdio>, <&qos_sfc>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@PX30_PD_VPU {
+ reg = <PX30_PD_VPU>;
+@@ -284,6 +288,7 @@
+ <&cru HCLK_VPU>,
+ <&cru SCLK_CORE_VPU>;
+ pm_qos = <&qos_vpu>, <&qos_vpu_r128>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@PX30_PD_VO {
+ reg = <PX30_PD_VO>;
+@@ -300,6 +305,7 @@
+ <&cru SCLK_VOPB_PWM>;
+ pm_qos = <&qos_rga_rd>, <&qos_rga_wr>,
+ <&qos_vop_m0>, <&qos_vop_m1>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@PX30_PD_VI {
+ reg = <PX30_PD_VI>;
+@@ -311,11 +317,13 @@
+ pm_qos = <&qos_isp_128>, <&qos_isp_rd>,
+ <&qos_isp_wr>, <&qos_isp_m1>,
+ <&qos_vip>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@PX30_PD_GPU {
+ reg = <PX30_PD_GPU>;
+ clocks = <&cru SCLK_GPU>;
+ pm_qos = <&qos_gpu>;
++ #power-domain-cells = <0>;
+ };
+ };
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index 9e1701f42184..5a706b8ffc72 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -320,13 +320,16 @@
+
+ power-domain@RK3328_PD_HEVC {
+ reg = <RK3328_PD_HEVC>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3328_PD_VIDEO {
+ reg = <RK3328_PD_VIDEO>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3328_PD_VPU {
+ reg = <RK3328_PD_VPU>;
+ clocks = <&cru ACLK_VPU>, <&cru HCLK_VPU>;
++ #power-domain-cells = <0>;
+ };
+ };
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index e2515218ff73..bf71f390f8a6 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -1005,6 +1005,7 @@
+ clocks = <&cru ACLK_IEP>,
+ <&cru HCLK_IEP>;
+ pm_qos = <&qos_iep>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_RGA {
+ reg = <RK3399_PD_RGA>;
+@@ -1012,12 +1013,14 @@
+ <&cru HCLK_RGA>;
+ pm_qos = <&qos_rga_r>,
+ <&qos_rga_w>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_VCODEC {
+ reg = <RK3399_PD_VCODEC>;
+ clocks = <&cru ACLK_VCODEC>,
+ <&cru HCLK_VCODEC>;
+ pm_qos = <&qos_video_m0>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_VDU {
+ reg = <RK3399_PD_VDU>;
+@@ -1027,6 +1030,7 @@
+ <&cru SCLK_VDU_CORE>;
+ pm_qos = <&qos_video_m1_r>,
+ <&qos_video_m1_w>;
++ #power-domain-cells = <0>;
+ };
+
+ /* These power domains are grouped by VD_GPU */
+@@ -1034,53 +1038,63 @@
+ reg = <RK3399_PD_GPU>;
+ clocks = <&cru ACLK_GPU>;
+ pm_qos = <&qos_gpu>;
++ #power-domain-cells = <0>;
+ };
+
+ /* These power domains are grouped by VD_LOGIC */
+ power-domain@RK3399_PD_EDP {
+ reg = <RK3399_PD_EDP>;
+ clocks = <&cru PCLK_EDP_CTRL>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_EMMC {
+ reg = <RK3399_PD_EMMC>;
+ clocks = <&cru ACLK_EMMC>;
+ pm_qos = <&qos_emmc>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_GMAC {
+ reg = <RK3399_PD_GMAC>;
+ clocks = <&cru ACLK_GMAC>,
+ <&cru PCLK_GMAC>;
+ pm_qos = <&qos_gmac>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_SD {
+ reg = <RK3399_PD_SD>;
+ clocks = <&cru HCLK_SDMMC>,
+ <&cru SCLK_SDMMC>;
+ pm_qos = <&qos_sd>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_SDIOAUDIO {
+ reg = <RK3399_PD_SDIOAUDIO>;
+ clocks = <&cru HCLK_SDIO>;
+ pm_qos = <&qos_sdioaudio>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_TCPD0 {
+ reg = <RK3399_PD_TCPD0>;
+ clocks = <&cru SCLK_UPHY0_TCPDCORE>,
+ <&cru SCLK_UPHY0_TCPDPHY_REF>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_TCPD1 {
+ reg = <RK3399_PD_TCPD1>;
+ clocks = <&cru SCLK_UPHY1_TCPDCORE>,
+ <&cru SCLK_UPHY1_TCPDPHY_REF>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_USB3 {
+ reg = <RK3399_PD_USB3>;
+ clocks = <&cru ACLK_USB3>;
+ pm_qos = <&qos_usb_otg0>,
+ <&qos_usb_otg1>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_VIO {
+ reg = <RK3399_PD_VIO>;
++ #power-domain-cells = <1>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+@@ -1090,6 +1104,7 @@
+ <&cru HCLK_HDCP>,
+ <&cru PCLK_HDCP>;
+ pm_qos = <&qos_hdcp>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_ISP0 {
+ reg = <RK3399_PD_ISP0>;
+@@ -1097,6 +1112,7 @@
+ <&cru HCLK_ISP0>;
+ pm_qos = <&qos_isp0_m0>,
+ <&qos_isp0_m1>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_ISP1 {
+ reg = <RK3399_PD_ISP1>;
+@@ -1104,9 +1120,11 @@
+ <&cru HCLK_ISP1>;
+ pm_qos = <&qos_isp1_m0>,
+ <&qos_isp1_m1>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_VO {
+ reg = <RK3399_PD_VO>;
++ #power-domain-cells = <1>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+@@ -1116,12 +1134,14 @@
+ <&cru HCLK_VOP0>;
+ pm_qos = <&qos_vop_big_r>,
+ <&qos_vop_big_w>;
++ #power-domain-cells = <0>;
+ };
+ power-domain@RK3399_PD_VOPL {
+ reg = <RK3399_PD_VOPL>;
+ clocks = <&cru ACLK_VOP1>,
+ <&cru HCLK_VOP1>;
+ pm_qos = <&qos_vop_little>;
++ #power-domain-cells = <0>;
+ };
+ };
+ };
+--
+2.39.5
+
--- /dev/null
+From 5a9e9f8be62bf799aab85852ef31468566421e35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 15:56:56 +0100
+Subject: block: remove the update_bdev parameter to
+ set_capacity_revalidate_and_notify
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 449f4ec9892ebc2f37a7eae6d97db2cf7c65e09a ]
+
+The update_bdev argument is always set to true, so remove it. Also
+rename the function to the slighly less verbose set_capacity_and_notify,
+as propagating the disk size to the block device isn't really
+revalidation.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Petr Vorel <pvorel@suse.cz>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/genhd.c | 13 +++++--------
+ drivers/block/loop.c | 2 +-
+ drivers/block/virtio_blk.c | 2 +-
+ drivers/block/xen-blkfront.c | 2 +-
+ drivers/nvme/host/core.c | 2 +-
+ drivers/scsi/sd.c | 5 ++---
+ include/linux/genhd.h | 3 +--
+ 7 files changed, 12 insertions(+), 17 deletions(-)
+
+diff --git a/block/genhd.c b/block/genhd.c
+index 796baf761202..768a49460bf1 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -46,17 +46,15 @@ static void disk_del_events(struct gendisk *disk);
+ static void disk_release_events(struct gendisk *disk);
+
+ /*
+- * Set disk capacity and notify if the size is not currently
+- * zero and will not be set to zero
++ * Set disk capacity and notify if the size is not currently zero and will not
++ * be set to zero. Returns true if a uevent was sent, otherwise false.
+ */
+-bool set_capacity_revalidate_and_notify(struct gendisk *disk, sector_t size,
+- bool update_bdev)
++bool set_capacity_and_notify(struct gendisk *disk, sector_t size)
+ {
+ sector_t capacity = get_capacity(disk);
+
+ set_capacity(disk, size);
+- if (update_bdev)
+- revalidate_disk_size(disk, true);
++ revalidate_disk_size(disk, true);
+
+ if (capacity != size && capacity != 0 && size != 0) {
+ char *envp[] = { "RESIZE=1", NULL };
+@@ -67,8 +65,7 @@ bool set_capacity_revalidate_and_notify(struct gendisk *disk, sector_t size,
+
+ return false;
+ }
+-
+-EXPORT_SYMBOL_GPL(set_capacity_revalidate_and_notify);
++EXPORT_SYMBOL_GPL(set_capacity_and_notify);
+
+ /*
+ * Format the device name of the indicated disk into the supplied buffer and
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 198f7ce3234b..b30f4d525bc8 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -238,7 +238,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
+ */
+ static void loop_set_size(struct loop_device *lo, loff_t size)
+ {
+- if (!set_capacity_revalidate_and_notify(lo->lo_disk, size, true))
++ if (!set_capacity_and_notify(lo->lo_disk, size))
+ kobject_uevent(&disk_to_dev(lo->lo_disk)->kobj, KOBJ_CHANGE);
+ }
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 28ea9b511fd0..c87c6a4eb3b3 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -470,7 +470,7 @@ static void virtblk_update_capacity(struct virtio_blk *vblk, bool resize)
+ cap_str_10,
+ cap_str_2);
+
+- set_capacity_revalidate_and_notify(vblk->disk, capacity, true);
++ set_capacity_and_notify(vblk->disk, capacity);
+ }
+
+ static void virtblk_config_changed_work(struct work_struct *work)
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index d68a8ca2161f..19ddbf977d28 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -2443,7 +2443,7 @@ static void blkfront_connect(struct blkfront_info *info)
+ return;
+ printk(KERN_INFO "Setting capacity to %Lu\n",
+ sectors);
+- set_capacity_revalidate_and_notify(info->gd, sectors, true);
++ set_capacity_and_notify(info->gd, sectors);
+
+ return;
+ case BLKIF_STATE_SUSPENDED:
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index c8e64a1e2fc0..c739ac1761ba 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2132,7 +2132,7 @@ static void nvme_update_disk_info(struct gendisk *disk,
+ capacity = 0;
+ }
+
+- set_capacity_revalidate_and_notify(disk, capacity, true);
++ set_capacity_and_notify(disk, capacity);
+
+ nvme_config_discard(disk, ns);
+ nvme_config_write_zeroes(disk->queue, ns->ctrl);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 355d38cab862..da6df9809b0c 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3292,8 +3292,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
+
+ sdkp->first_scan = 0;
+
+- set_capacity_revalidate_and_notify(disk,
+- logical_to_sectors(sdp, sdkp->capacity), true);
++ set_capacity_and_notify(disk, logical_to_sectors(sdp, sdkp->capacity));
+ sd_config_write_same(sdkp);
+ kfree(buffer);
+
+@@ -3303,7 +3302,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ * capacity to 0.
+ */
+ if (sd_zbc_revalidate_zones(sdkp))
+- set_capacity_revalidate_and_notify(disk, 0, true);
++ set_capacity_and_notify(disk, 0);
+
+ out:
+ return 0;
+diff --git a/include/linux/genhd.h b/include/linux/genhd.h
+index 03da3f603d30..4b22bfd9336e 100644
+--- a/include/linux/genhd.h
++++ b/include/linux/genhd.h
+@@ -315,8 +315,7 @@ static inline int get_disk_ro(struct gendisk *disk)
+ extern void disk_block_events(struct gendisk *disk);
+ extern void disk_unblock_events(struct gendisk *disk);
+ extern void disk_flush_events(struct gendisk *disk, unsigned int mask);
+-bool set_capacity_revalidate_and_notify(struct gendisk *disk, sector_t size,
+- bool update_bdev);
++bool set_capacity_and_notify(struct gendisk *disk, sector_t size);
+
+ /* drivers/char/random.c */
+ extern void add_disk_randomness(struct gendisk *disk) __latent_entropy;
+--
+2.39.5
+
--- /dev/null
+From 08db8a0c5b9907a453d3fbffab435d7727daa8d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Aug 2022 12:51:00 +0900
+Subject: drivers/block/zram/zram_drv.c: do not keep dangling zcomp pointer
+ after zram reset
+
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+
+[ Upstream commit 6d2453c3dbc5f70eafc1c866289a90a1fc57ce18 ]
+
+We do all reset operations under write lock, so we don't need to save
+->disksize and ->comp to stack variables. Another thing is that ->comp is
+freed during zram reset, but comp pointer is not NULL-ed, so zram keeps
+the freed pointer value.
+
+Link: https://lkml.kernel.org/r/20220824035100.971816-1-senozhatsky@chromium.org
+Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: Nitin Gupta <ngupta@vflare.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/zram/zram_drv.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 8f38e5a1a63f..8e13586be8c9 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -1690,9 +1690,6 @@ static int zram_rw_page(struct block_device *bdev, sector_t sector,
+
+ static void zram_reset_device(struct zram *zram)
+ {
+- struct zcomp *comp;
+- u64 disksize;
+-
+ down_write(&zram->init_lock);
+
+ zram->limit_pages = 0;
+@@ -1702,18 +1699,16 @@ static void zram_reset_device(struct zram *zram)
+ return;
+ }
+
+- comp = zram->comp;
+- disksize = zram->disksize;
+- zram->disksize = 0;
+-
+ set_capacity_and_notify(zram->disk, 0);
+ part_stat_set_all(&zram->disk->part0, 0);
+
+ up_write(&zram->init_lock);
+ /* I/O operation under all of CPU are done so let's free */
+- zram_meta_free(zram, disksize);
++ zram_meta_free(zram, zram->disksize);
++ zram->disksize = 0;
+ memset(&zram->stats, 0, sizeof(zram->stats));
+- zcomp_destroy(comp);
++ zcomp_destroy(zram->comp);
++ zram->comp = NULL;
+ reset_bdev(zram);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 9c4845f9a6ca844378905e7999dbb3978c0fb7b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2024 19:20:29 +0000
+Subject: drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8 ]
+
+The host_node pointer was assigned and freed in adv7533_parse_dt(), and
+later, adv7533_attach_dsi() uses the same. Fix this use-after-free issue
+by dropping of_node_put() in adv7533_parse_dt() and calling of_node_put()
+in error path of probe() and also in the remove().
+
+Fixes: 1e4d58cd7f88 ("drm/bridge: adv7533: Create a MIPI DSI device")
+Cc: stable@vger.kernel.org
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241119192040.152657-2-biju.das.jz@bp.renesas.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 10 ++++++++--
+ drivers/gpu/drm/bridge/adv7511/adv7533.c | 2 --
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index 9255bce51753..46782f72564b 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -1220,8 +1220,10 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)
+ return ret;
+
+ ret = adv7511_init_regulators(adv7511);
+- if (ret)
+- return dev_err_probe(dev, ret, "failed to init regulators\n");
++ if (ret) {
++ dev_err_probe(dev, ret, "failed to init regulators\n");
++ goto err_of_node_put;
++ }
+
+ /*
+ * The power down GPIO is optional. If present, toggle it from active to
+@@ -1329,6 +1331,8 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)
+ i2c_unregister_device(adv7511->i2c_edid);
+ uninit_regulators:
+ adv7511_uninit_regulators(adv7511);
++err_of_node_put:
++ of_node_put(adv7511->host_node);
+
+ return ret;
+ }
+@@ -1337,6 +1341,8 @@ static int adv7511_remove(struct i2c_client *i2c)
+ {
+ struct adv7511 *adv7511 = i2c_get_clientdata(i2c);
+
++ of_node_put(adv7511->host_node);
++
+ adv7511_uninit_regulators(adv7511);
+
+ drm_bridge_remove(&adv7511->bridge);
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c
+index f8d5fa6652af..ee33e7a033ef 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7533.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c
+@@ -184,8 +184,6 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv)
+ if (!adv->host_node)
+ return -ENODEV;
+
+- of_node_put(adv->host_node);
+-
+ adv->use_timing_gen = !of_property_read_bool(np,
+ "adi,disable-timing-generator");
+
+--
+2.39.5
+
--- /dev/null
+From 328065832950870c2a46b5c471ce3df8f8be780a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 09:18:29 +0000
+Subject: drm: bridge: adv7511: Remove redundant null check before
+ clk_disable_unprepare
+
+From: Xu Wang <vulab@iscas.ac.cn>
+
+[ Upstream commit 3fc5a284213d5fca1c0807ea8725355d39808930 ]
+
+Because clk_disable_unprepare() already checked NULL clock parameter,
+so the additional check is unnecessary, just remove them.
+
+Signed-off-by: Xu Wang <vulab@iscas.ac.cn>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index e50c741cbfe7..60400efe1dd3 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -1324,8 +1324,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)
+ err_unregister_cec:
+ cec_unregister_adapter(adv7511->cec_adap);
+ i2c_unregister_device(adv7511->i2c_cec);
+- if (adv7511->cec_clk)
+- clk_disable_unprepare(adv7511->cec_clk);
++ clk_disable_unprepare(adv7511->cec_clk);
+ err_i2c_unregister_packet:
+ i2c_unregister_device(adv7511->i2c_packet);
+ err_i2c_unregister_edid:
+@@ -1343,8 +1342,7 @@ static int adv7511_remove(struct i2c_client *i2c)
+ if (adv7511->type == ADV7533 || adv7511->type == ADV7535)
+ adv7533_detach_dsi(adv7511);
+ i2c_unregister_device(adv7511->i2c_cec);
+- if (adv7511->cec_clk)
+- clk_disable_unprepare(adv7511->cec_clk);
++ clk_disable_unprepare(adv7511->cec_clk);
+
+ adv7511_uninit_regulators(adv7511);
+
+--
+2.39.5
+
--- /dev/null
+From ef19577ed3d00246dfa5a60e529ecfc489ae5b11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jun 2022 16:48:54 +0200
+Subject: drm: bridge: adv7511: unregister cec i2c device after cec adapter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alvin Šipraga <alsi@bang-olufsen.dk>
+
+[ Upstream commit 40cdb02cb9f965732eb543d47f15bef8d10f0f5f ]
+
+cec_unregister_adapter() assumes that the underlying adapter ops are
+callable. For example, if the CEC adapter currently has a valid physical
+address, then the unregistration procedure will invalidate the physical
+address by setting it to f.f.f.f. Whence the following kernel oops
+observed after removing the adv7511 module:
+
+ Unable to handle kernel execution of user memory at virtual address 0000000000000000
+ Internal error: Oops: 86000004 [#1] PREEMPT_RT SMP
+ Call trace:
+ 0x0
+ adv7511_cec_adap_log_addr+0x1ac/0x1c8 [adv7511]
+ cec_adap_unconfigure+0x44/0x90 [cec]
+ __cec_s_phys_addr.part.0+0x68/0x230 [cec]
+ __cec_s_phys_addr+0x40/0x50 [cec]
+ cec_unregister_adapter+0xb4/0x118 [cec]
+ adv7511_remove+0x60/0x90 [adv7511]
+ i2c_device_remove+0x34/0xe0
+ device_release_driver_internal+0x114/0x1f0
+ driver_detach+0x54/0xe0
+ bus_remove_driver+0x60/0xd8
+ driver_unregister+0x34/0x60
+ i2c_del_driver+0x2c/0x68
+ adv7511_exit+0x1c/0x67c [adv7511]
+ __arm64_sys_delete_module+0x154/0x288
+ invoke_syscall+0x48/0x100
+ el0_svc_common.constprop.0+0x48/0xe8
+ do_el0_svc+0x28/0x88
+ el0_svc+0x1c/0x50
+ el0t_64_sync_handler+0xa8/0xb0
+ el0t_64_sync+0x15c/0x160
+ Code: bad PC value
+ ---[ end trace 0000000000000000 ]---
+
+Protect against this scenario by unregistering i2c_cec after
+unregistering the CEC adapter. Duly disable the CEC clock afterwards
+too.
+
+Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support")
+Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220612144854.2223873-3-alvin@pqrs.dk
+Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index 42d93f314699..9e8f45fa5c5e 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -1339,9 +1339,6 @@ static int adv7511_remove(struct i2c_client *i2c)
+ {
+ struct adv7511 *adv7511 = i2c_get_clientdata(i2c);
+
+- i2c_unregister_device(adv7511->i2c_cec);
+- clk_disable_unprepare(adv7511->cec_clk);
+-
+ adv7511_uninit_regulators(adv7511);
+
+ drm_bridge_remove(&adv7511->bridge);
+@@ -1349,6 +1346,8 @@ static int adv7511_remove(struct i2c_client *i2c)
+ adv7511_audio_exit(adv7511);
+
+ cec_unregister_adapter(adv7511->cec_adap);
++ i2c_unregister_device(adv7511->i2c_cec);
++ clk_disable_unprepare(adv7511->cec_clk);
+
+ i2c_unregister_device(adv7511->i2c_packet);
+ i2c_unregister_device(adv7511->i2c_edid);
+--
+2.39.5
+
--- /dev/null
+From 3209aaab55597c082cba3b9057d854c9416fef97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Oct 2022 14:52:46 +0200
+Subject: drm: bridge: adv7511: use dev_err_probe in probe function
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+[ Upstream commit 2a865248399a13bb2b2bcc50297069a7521de258 ]
+
+adv7511 probe may need to be attempted multiple times before no
+-EPROBE_DEFER is returned. Currently, every such probe results in
+an error message:
+
+[ 4.534229] adv7511 1-003d: failed to find dsi host
+[ 4.580288] adv7511 1-003d: failed to find dsi host
+
+This is misleading, as there is no error and probe deferral is normal
+behavior. Fix this by using dev_err_probe that will suppress
+-EPROBE_DEFER errors. While at it, we touch all dev_err in the probe
+path. This makes the code more concise and included the error code
+everywhere to aid user in debugging.
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221026125246.3188260-1-a.fatoum@pengutronix.de
+Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 6 ++----
+ drivers/gpu/drm/bridge/adv7511/adv7533.c | 20 ++++++++------------
+ 2 files changed, 10 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index 9e8f45fa5c5e..9255bce51753 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -1220,10 +1220,8 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)
+ return ret;
+
+ ret = adv7511_init_regulators(adv7511);
+- if (ret) {
+- dev_err(dev, "failed to init regulators\n");
+- return ret;
+- }
++ if (ret)
++ return dev_err_probe(dev, ret, "failed to init regulators\n");
+
+ /*
+ * The power down GPIO is optional. If present, toggle it from active to
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c
+index ec624b9d5077..f8d5fa6652af 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7533.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c
+@@ -146,16 +146,14 @@ int adv7533_attach_dsi(struct adv7511 *adv)
+ };
+
+ host = of_find_mipi_dsi_host_by_node(adv->host_node);
+- if (!host) {
+- dev_err(dev, "failed to find dsi host\n");
+- return -EPROBE_DEFER;
+- }
++ if (!host)
++ return dev_err_probe(dev, -EPROBE_DEFER,
++ "failed to find dsi host\n");
+
+ dsi = devm_mipi_dsi_device_register_full(dev, host, &info);
+- if (IS_ERR(dsi)) {
+- dev_err(dev, "failed to create dsi device\n");
+- return PTR_ERR(dsi);
+- }
++ if (IS_ERR(dsi))
++ return dev_err_probe(dev, PTR_ERR(dsi),
++ "failed to create dsi device\n");
+
+ adv->dsi = dsi;
+
+@@ -165,10 +163,8 @@ int adv7533_attach_dsi(struct adv7511 *adv)
+ MIPI_DSI_MODE_EOT_PACKET | MIPI_DSI_MODE_VIDEO_HSE;
+
+ ret = devm_mipi_dsi_attach(dev, dsi);
+- if (ret < 0) {
+- dev_err(dev, "failed to attach dsi to host\n");
+- return ret;
+- }
++ if (ret < 0)
++ return dev_err_probe(dev, ret, "failed to attach dsi to host\n");
+
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From b92d9e67028223a1ee902943e7d5c607cf83509c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Oct 2021 17:15:16 +0200
+Subject: drm/bridge: adv7533: Switch to devm MIPI-DSI helpers
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit ee9418808bcce77e2c31dbbfc58621ea99a05597 ]
+
+Let's switch to the new devm MIPI-DSI function to register and attach
+our secondary device. This also avoids leaking the device when we detach
+the bridge.
+
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Tested-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211025151536.1048186-2-maxime@cerno.tech
+Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/adv7511/adv7511.h | 1 -
+ drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 2 --
+ drivers/gpu/drm/bridge/adv7511/adv7533.c | 20 ++++----------------
+ 3 files changed, 4 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511.h b/drivers/gpu/drm/bridge/adv7511/adv7511.h
+index e95abeb64b93..dcb792adc62c 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511.h
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511.h
+@@ -399,7 +399,6 @@ enum drm_mode_status adv7533_mode_valid(struct adv7511 *adv,
+ int adv7533_patch_registers(struct adv7511 *adv);
+ int adv7533_patch_cec_registers(struct adv7511 *adv);
+ int adv7533_attach_dsi(struct adv7511 *adv);
+-void adv7533_detach_dsi(struct adv7511 *adv);
+ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv);
+
+ #ifdef CONFIG_DRM_I2C_ADV7511_AUDIO
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index 60400efe1dd3..42d93f314699 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -1339,8 +1339,6 @@ static int adv7511_remove(struct i2c_client *i2c)
+ {
+ struct adv7511 *adv7511 = i2c_get_clientdata(i2c);
+
+- if (adv7511->type == ADV7533 || adv7511->type == ADV7535)
+- adv7533_detach_dsi(adv7511);
+ i2c_unregister_device(adv7511->i2c_cec);
+ clk_disable_unprepare(adv7511->cec_clk);
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c
+index 2cade7ae0c0d..ec624b9d5077 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7533.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c
+@@ -151,11 +151,10 @@ int adv7533_attach_dsi(struct adv7511 *adv)
+ return -EPROBE_DEFER;
+ }
+
+- dsi = mipi_dsi_device_register_full(host, &info);
++ dsi = devm_mipi_dsi_device_register_full(dev, host, &info);
+ if (IS_ERR(dsi)) {
+ dev_err(dev, "failed to create dsi device\n");
+- ret = PTR_ERR(dsi);
+- goto err_dsi_device;
++ return PTR_ERR(dsi);
+ }
+
+ adv->dsi = dsi;
+@@ -165,24 +164,13 @@ int adv7533_attach_dsi(struct adv7511 *adv)
+ dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_SYNC_PULSE |
+ MIPI_DSI_MODE_EOT_PACKET | MIPI_DSI_MODE_VIDEO_HSE;
+
+- ret = mipi_dsi_attach(dsi);
++ ret = devm_mipi_dsi_attach(dev, dsi);
+ if (ret < 0) {
+ dev_err(dev, "failed to attach dsi to host\n");
+- goto err_dsi_attach;
++ return ret;
+ }
+
+ return 0;
+-
+-err_dsi_attach:
+- mipi_dsi_device_unregister(dsi);
+-err_dsi_device:
+- return ret;
+-}
+-
+-void adv7533_detach_dsi(struct adv7511 *adv)
+-{
+- mipi_dsi_detach(adv->dsi);
+- mipi_dsi_device_unregister(adv->dsi);
+ }
+
+ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv)
+--
+2.39.5
+
--- /dev/null
+From be7bb753304b3f853db18f823d97ba4dbf671dcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Sep 2021 12:11:58 +0200
+Subject: drm/mipi-dsi: Create devm device attachment
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit db6568498b35a4d5d5a99420df27ed25fae31406 ]
+
+MIPI-DSI devices need to call mipi_dsi_attach() when their probe is done
+to attach against their host.
+
+However, at removal or when an error occurs, that attachment needs to be
+undone through a call to mipi_dsi_detach().
+
+Let's create a device-managed variant of the attachment function that
+will automatically detach the device at unbind.
+
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210910101218.1632297-5-maxime@cerno.tech
+Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_mipi_dsi.c | 35 ++++++++++++++++++++++++++++++++++
+ include/drm/drm_mipi_dsi.h | 1 +
+ 2 files changed, 36 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c
+index e53a5b14b47b..468a3a7cb6a5 100644
+--- a/drivers/gpu/drm/drm_mipi_dsi.c
++++ b/drivers/gpu/drm/drm_mipi_dsi.c
+@@ -405,6 +405,41 @@ int mipi_dsi_detach(struct mipi_dsi_device *dsi)
+ }
+ EXPORT_SYMBOL(mipi_dsi_detach);
+
++static void devm_mipi_dsi_detach(void *arg)
++{
++ struct mipi_dsi_device *dsi = arg;
++
++ mipi_dsi_detach(dsi);
++}
++
++/**
++ * devm_mipi_dsi_attach - Attach a MIPI-DSI device to its DSI Host
++ * @dev: device to tie the MIPI-DSI device attachment lifetime to
++ * @dsi: DSI peripheral
++ *
++ * This is the managed version of mipi_dsi_attach() which automatically
++ * calls mipi_dsi_detach() when @dev is unbound.
++ *
++ * Returns:
++ * 0 on success, a negative error code on failure.
++ */
++int devm_mipi_dsi_attach(struct device *dev,
++ struct mipi_dsi_device *dsi)
++{
++ int ret;
++
++ ret = mipi_dsi_attach(dsi);
++ if (ret)
++ return ret;
++
++ ret = devm_add_action_or_reset(dev, devm_mipi_dsi_detach, dsi);
++ if (ret)
++ return ret;
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(devm_mipi_dsi_attach);
++
+ static ssize_t mipi_dsi_device_transfer(struct mipi_dsi_device *dsi,
+ struct mipi_dsi_msg *msg)
+ {
+diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h
+index af8ed48749eb..75995f3f2099 100644
+--- a/include/drm/drm_mipi_dsi.h
++++ b/include/drm/drm_mipi_dsi.h
+@@ -230,6 +230,7 @@ devm_mipi_dsi_device_register_full(struct device *dev, struct mipi_dsi_host *hos
+ struct mipi_dsi_device *of_find_mipi_dsi_device_by_node(struct device_node *np);
+ int mipi_dsi_attach(struct mipi_dsi_device *dsi);
+ int mipi_dsi_detach(struct mipi_dsi_device *dsi);
++int devm_mipi_dsi_attach(struct device *dev, struct mipi_dsi_device *dsi);
+ int mipi_dsi_shutdown_peripheral(struct mipi_dsi_device *dsi);
+ int mipi_dsi_turn_on_peripheral(struct mipi_dsi_device *dsi);
+ int mipi_dsi_set_maximum_return_packet_size(struct mipi_dsi_device *dsi,
+--
+2.39.5
+
--- /dev/null
+From 84b277c887cf8b27a00523fd940f54d853cdec7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Sep 2021 12:11:57 +0200
+Subject: drm/mipi-dsi: Create devm device registration
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit a1419fb4a73e47f0eab2985dff594ed52397471b ]
+
+Devices that take their data through the MIPI-DSI bus but are controlled
+through a secondary bus like I2C have to register a secondary device on
+the MIPI-DSI bus through the mipi_dsi_device_register_full() function.
+
+At removal or when an error occurs, that device needs to be removed
+through a call to mipi_dsi_device_unregister().
+
+Let's create a device-managed variant of the registration function that
+will automatically unregister the device at unbind.
+
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210910101218.1632297-4-maxime@cerno.tech
+Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_mipi_dsi.c | 46 ++++++++++++++++++++++++++++++++++
+ include/drm/drm_mipi_dsi.h | 3 +++
+ 2 files changed, 49 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c
+index 107a98484f50..e53a5b14b47b 100644
+--- a/drivers/gpu/drm/drm_mipi_dsi.c
++++ b/drivers/gpu/drm/drm_mipi_dsi.c
+@@ -246,6 +246,52 @@ void mipi_dsi_device_unregister(struct mipi_dsi_device *dsi)
+ }
+ EXPORT_SYMBOL(mipi_dsi_device_unregister);
+
++static void devm_mipi_dsi_device_unregister(void *arg)
++{
++ struct mipi_dsi_device *dsi = arg;
++
++ mipi_dsi_device_unregister(dsi);
++}
++
++/**
++ * devm_mipi_dsi_device_register_full - create a managed MIPI DSI device
++ * @dev: device to tie the MIPI-DSI device lifetime to
++ * @host: DSI host to which this device is connected
++ * @info: pointer to template containing DSI device information
++ *
++ * Create a MIPI DSI device by using the device information provided by
++ * mipi_dsi_device_info template
++ *
++ * This is the managed version of mipi_dsi_device_register_full() which
++ * automatically calls mipi_dsi_device_unregister() when @dev is
++ * unbound.
++ *
++ * Returns:
++ * A pointer to the newly created MIPI DSI device, or, a pointer encoded
++ * with an error
++ */
++struct mipi_dsi_device *
++devm_mipi_dsi_device_register_full(struct device *dev,
++ struct mipi_dsi_host *host,
++ const struct mipi_dsi_device_info *info)
++{
++ struct mipi_dsi_device *dsi;
++ int ret;
++
++ dsi = mipi_dsi_device_register_full(host, info);
++ if (IS_ERR(dsi))
++ return dsi;
++
++ ret = devm_add_action_or_reset(dev,
++ devm_mipi_dsi_device_unregister,
++ dsi);
++ if (ret)
++ return ERR_PTR(ret);
++
++ return dsi;
++}
++EXPORT_SYMBOL_GPL(devm_mipi_dsi_device_register_full);
++
+ static DEFINE_MUTEX(host_lock);
+ static LIST_HEAD(host_list);
+
+diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h
+index 0dbed65c0ca5..af8ed48749eb 100644
+--- a/include/drm/drm_mipi_dsi.h
++++ b/include/drm/drm_mipi_dsi.h
+@@ -224,6 +224,9 @@ struct mipi_dsi_device *
+ mipi_dsi_device_register_full(struct mipi_dsi_host *host,
+ const struct mipi_dsi_device_info *info);
+ void mipi_dsi_device_unregister(struct mipi_dsi_device *dsi);
++struct mipi_dsi_device *
++devm_mipi_dsi_device_register_full(struct device *dev, struct mipi_dsi_host *host,
++ const struct mipi_dsi_device_info *info);
+ struct mipi_dsi_device *of_find_mipi_dsi_device_by_node(struct device_node *np);
+ int mipi_dsi_attach(struct mipi_dsi_device *dsi);
+ int mipi_dsi_detach(struct mipi_dsi_device *dsi);
+--
+2.39.5
+
--- /dev/null
+From 68e6f55c9201471439c85e81c5d3e51b85683eb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 15:56:53 +0100
+Subject: loop: let set_capacity_revalidate_and_notify update the bdev size
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 3b4f85d02a4bd85cbea999a064235a47694bbb7b ]
+
+There is no good reason to call revalidate_disk_size separately.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 7444cc2a6c86..198f7ce3234b 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -238,12 +238,8 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
+ */
+ static void loop_set_size(struct loop_device *lo, loff_t size)
+ {
+- struct block_device *bdev = lo->lo_device;
+-
+- bd_set_nr_sectors(bdev, size);
+-
+- if (!set_capacity_revalidate_and_notify(lo->lo_disk, size, false))
+- kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE);
++ if (!set_capacity_revalidate_and_notify(lo->lo_disk, size, true))
++ kobject_uevent(&disk_to_dev(lo->lo_disk)->kobj, KOBJ_CHANGE);
+ }
+
+ static inline int
+--
+2.39.5
+
--- /dev/null
+From 96fcae6735c1655f1c7a9588fa38609d3b8f8706 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 15:56:54 +0100
+Subject: nvme: let set_capacity_revalidate_and_notify update the bdev size
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 5dd55749b79cdf471ca0966ad91541daebac3e2f ]
+
+There is no good reason to call revalidate_disk_size separately.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index bee55902fe6c..c8e64a1e2fc0 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2132,7 +2132,7 @@ static void nvme_update_disk_info(struct gendisk *disk,
+ capacity = 0;
+ }
+
+- set_capacity_revalidate_and_notify(disk, capacity, false);
++ set_capacity_revalidate_and_notify(disk, capacity, true);
+
+ nvme_config_discard(disk, ns);
+ nvme_config_write_zeroes(disk->queue, ns->ctrl);
+@@ -2213,7 +2213,6 @@ static int nvme_update_ns_info(struct nvme_ns *ns, struct nvme_id_ns *id)
+ blk_stack_limits(&ns->head->disk->queue->limits,
+ &ns->queue->limits, 0);
+ blk_queue_update_readahead(ns->head->disk->queue);
+- nvme_update_bdev_size(ns->head->disk);
+ blk_mq_unfreeze_queue(ns->head->disk->queue);
+ }
+ #endif
+@@ -4095,8 +4094,6 @@ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids)
+ */
+ if (ret > 0 && (ret & NVME_SC_DNR))
+ nvme_ns_remove(ns);
+- else
+- revalidate_disk_size(ns->disk, true);
+ }
+
+ static void nvme_validate_or_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
+--
+2.39.5
+
--- /dev/null
+From e6fdf60a146d02ac17c09324b7a2a53b8dd82016 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 May 2023 21:20:32 +0800
+Subject: ocfs2: correct return value of ocfs2_local_free_info()
+
+From: Joseph Qi <joseph.qi@linux.alibaba.com>
+
+[ Upstream commit d32840ad4a111c6abd651fbf6b5996e6123913da ]
+
+Now in ocfs2_local_free_info(), it returns 0 even if it actually fails.
+Though it doesn't cause any real problem since the only caller
+dquot_disable() ignores the return value, we'd better return correct as it
+is.
+
+Link: https://lkml.kernel.org/r/20230528132033.217664-1-joseph.qi@linux.alibaba.com
+Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Stable-dep-of: 5f3fd772d152 ("ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/quota_local.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
+index 7a1c8da9e44b..fbab536741e2 100644
+--- a/fs/ocfs2/quota_local.c
++++ b/fs/ocfs2/quota_local.c
+@@ -815,7 +815,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type)
+ struct ocfs2_quota_chunk *chunk;
+ struct ocfs2_local_disk_chunk *dchunk;
+ int mark_clean = 1, len;
+- int status;
++ int status = 0;
+
+ iput(oinfo->dqi_gqinode);
+ ocfs2_simple_drop_lockres(OCFS2_SB(sb), &oinfo->dqi_gqlock);
+@@ -857,17 +857,14 @@ static int ocfs2_local_free_info(struct super_block *sb, int type)
+ oinfo->dqi_libh,
+ olq_update_info,
+ info);
+- if (status < 0) {
++ if (status < 0)
+ mlog_errno(status);
+- goto out;
+- }
+-
+ out:
+ ocfs2_inode_unlock(sb_dqopt(sb)->files[type], 1);
+ brelse(oinfo->dqi_libh);
+ brelse(oinfo->dqi_lqi_bh);
+ kfree(oinfo);
+- return 0;
++ return status;
+ }
+
+ static void olq_set_dquot(struct buffer_head *bh, void *private)
+--
+2.39.5
+
--- /dev/null
+From f1755a0e8fb7dc81f0b45ad804e8ce03229da454 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2024 21:39:25 -0500
+Subject: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
+
+From: Dennis Lam <dennis.lamerice@gmail.com>
+
+[ Upstream commit 5f3fd772d152229d94602bca243fbb658068a597 ]
+
+When mounting ocfs2 and then remounting it as read-only, a
+slab-use-after-free occurs after the user uses a syscall to
+quota_getnextquota. Specifically, sb_dqinfo(sb, type)->dqi_priv is the
+dangling pointer.
+
+During the remounting process, the pointer dqi_priv is freed but is never
+set as null leaving it to be accessed. Additionally, the read-only option
+for remounting sets the DQUOT_SUSPENDED flag instead of setting the
+DQUOT_USAGE_ENABLED flags. Moreover, later in the process of getting the
+next quota, the function ocfs2_get_next_id is called and only checks the
+quota usage flags and not the quota suspended flags.
+
+To fix this, I set dqi_priv to null when it is freed after remounting with
+read-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.
+
+[akpm@linux-foundation.org: coding-style cleanups]
+Link: https://lkml.kernel.org/r/20241218023924.22821-2-dennis.lamerice@gmail.com
+Fixes: 8f9e8f5fcc05 ("ocfs2: Fix Q_GETNEXTQUOTA for filesystem without quotas")
+Signed-off-by: Dennis Lam <dennis.lamerice@gmail.com>
+Reported-by: syzbot+d173bf8a5a7faeede34c@syzkaller.appspotmail.com
+Tested-by: syzbot+d173bf8a5a7faeede34c@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/6731d26f.050a0220.1fb99c.014b.GAE@google.com/T/
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/quota_global.c | 2 +-
+ fs/ocfs2/quota_local.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
+index eda83487c9ec..1ce3780e8b49 100644
+--- a/fs/ocfs2/quota_global.c
++++ b/fs/ocfs2/quota_global.c
+@@ -881,7 +881,7 @@ static int ocfs2_get_next_id(struct super_block *sb, struct kqid *qid)
+ int status = 0;
+
+ trace_ocfs2_get_next_id(from_kqid(&init_user_ns, *qid), type);
+- if (!sb_has_quota_loaded(sb, type)) {
++ if (!sb_has_quota_active(sb, type)) {
+ status = -ESRCH;
+ goto out;
+ }
+diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
+index fbab536741e2..77d5aa90338f 100644
+--- a/fs/ocfs2/quota_local.c
++++ b/fs/ocfs2/quota_local.c
+@@ -864,6 +864,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type)
+ brelse(oinfo->dqi_libh);
+ brelse(oinfo->dqi_lqi_bh);
+ kfree(oinfo);
++ info->dqi_priv = NULL;
+ return status;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 700240b95c9636d364dbc31d7ceb5adeedadc860 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 15:15:58 -0500
+Subject: of/address: Add support for 3 address cell bus
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 3d5089c4263d3594dc055e0f9c5cb990505cdd64 ]
+
+There's a few custom bus bindings (e.g. fsl,qoriq-mc) which use a
+3 cell format with custom flags in the high cell. We can match these
+buses as a fallback if we didn't match on PCI bus which is the only
+standard bus binding with 3 address cells.
+
+Link: https://lore.kernel.org/r/20230328-dt-address-helpers-v1-3-e2456c3e77ab@kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/address.c | 22 ++++++++
+ drivers/of/unittest-data/tests-address.dtsi | 9 +++-
+ drivers/of/unittest.c | 58 ++++++++++++++++++++-
+ 3 files changed, 87 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 068a134f6df7..2aebce8f4a76 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -97,11 +97,17 @@ static int of_bus_default_translate(__be32 *addr, u64 offset, int na)
+ return 0;
+ }
+
++static unsigned int of_bus_default_flags_get_flags(const __be32 *addr)
++{
++ return of_read_number(addr, 1);
++}
++
+ static unsigned int of_bus_default_get_flags(const __be32 *addr)
+ {
+ return IORESOURCE_MEM;
+ }
+
++
+ #ifdef CONFIG_PCI
+ static unsigned int of_bus_pci_get_flags(const __be32 *addr)
+ {
+@@ -328,6 +334,11 @@ static unsigned int of_bus_isa_get_flags(const __be32 *addr)
+ return flags;
+ }
+
++static int of_bus_default_flags_match(struct device_node *np)
++{
++ return of_bus_n_addr_cells(np) == 3;
++}
++
+ /*
+ * Array of bus specific translators
+ */
+@@ -357,6 +368,17 @@ static struct of_bus of_busses[] = {
+ .has_flags = true,
+ .get_flags = of_bus_isa_get_flags,
+ },
++ /* Default with flags cell */
++ {
++ .name = "default-flags",
++ .addresses = "reg",
++ .match = of_bus_default_flags_match,
++ .count_cells = of_bus_default_count_cells,
++ .map = of_bus_default_map,
++ .translate = of_bus_default_translate,
++ .has_flags = true,
++ .get_flags = of_bus_default_flags_get_flags,
++ },
+ /* Default */
+ {
+ .name = "default",
+diff --git a/drivers/of/unittest-data/tests-address.dtsi b/drivers/of/unittest-data/tests-address.dtsi
+index 6604a52bf6cb..bc0029cbf8ea 100644
+--- a/drivers/of/unittest-data/tests-address.dtsi
++++ b/drivers/of/unittest-data/tests-address.dtsi
+@@ -14,7 +14,7 @@
+ #size-cells = <1>;
+ /* ranges here is to make sure we don't use it for
+ * dma-ranges translation */
+- ranges = <0x70000000 0x70000000 0x40000000>,
++ ranges = <0x70000000 0x70000000 0x50000000>,
+ <0x00000000 0xd0000000 0x20000000>;
+ dma-ranges = <0x0 0x20000000 0x40000000>;
+
+@@ -43,6 +43,13 @@
+ <0x42000000 0x0 0xc0000000 0x20000000 0x0 0x10000000>;
+ };
+
++ bus@a0000000 {
++ #address-cells = <3>;
++ #size-cells = <2>;
++ ranges = <0xf00baa 0x0 0x0 0xa0000000 0x0 0x100000>,
++ <0xf00bee 0x1 0x0 0xb0000000 0x0 0x200000>;
++ };
++
+ };
+ };
+ };
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index cb199ace8681..1659d4dceded 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -1044,7 +1044,7 @@ static void __init of_unittest_bus_ranges(void)
+ "for_each_of_range wrong flags on node %pOF flags=%x (expected %x)\n",
+ np, range.flags, IORESOURCE_MEM);
+ if (!i) {
+- unittest(range.size == 0x40000000,
++ unittest(range.size == 0x50000000,
+ "for_each_of_range wrong size on node %pOF size=%llx\n",
+ np, range.size);
+ unittest(range.cpu_addr == 0x70000000,
+@@ -1070,6 +1070,61 @@ static void __init of_unittest_bus_ranges(void)
+ of_node_put(np);
+ }
+
++static void __init of_unittest_bus_3cell_ranges(void)
++{
++ struct device_node *np;
++ struct of_range range;
++ struct of_range_parser parser;
++ int i = 0;
++
++ np = of_find_node_by_path("/testcase-data/address-tests/bus@a0000000");
++ if (!np) {
++ pr_err("missing testcase data\n");
++ return;
++ }
++
++ if (of_range_parser_init(&parser, np)) {
++ pr_err("missing ranges property\n");
++ return;
++ }
++
++ /*
++ * Get the "ranges" from the device tree
++ */
++ for_each_of_range(&parser, &range) {
++ if (!i) {
++ unittest(range.flags == 0xf00baa,
++ "for_each_of_range wrong flags on node %pOF flags=%x\n",
++ np, range.flags);
++ unittest(range.size == 0x100000,
++ "for_each_of_range wrong size on node %pOF size=%llx\n",
++ np, range.size);
++ unittest(range.cpu_addr == 0xa0000000,
++ "for_each_of_range wrong CPU addr (%llx) on node %pOF",
++ range.cpu_addr, np);
++ unittest(range.bus_addr == 0x0,
++ "for_each_of_range wrong bus addr (%llx) on node %pOF",
++ range.pci_addr, np);
++ } else {
++ unittest(range.flags == 0xf00bee,
++ "for_each_of_range wrong flags on node %pOF flags=%x\n",
++ np, range.flags);
++ unittest(range.size == 0x200000,
++ "for_each_of_range wrong size on node %pOF size=%llx\n",
++ np, range.size);
++ unittest(range.cpu_addr == 0xb0000000,
++ "for_each_of_range wrong CPU addr (%llx) on node %pOF",
++ range.cpu_addr, np);
++ unittest(range.bus_addr == 0x100000000,
++ "for_each_of_range wrong bus addr (%llx) on node %pOF",
++ range.pci_addr, np);
++ }
++ i++;
++ }
++
++ of_node_put(np);
++}
++
+ static void __init of_unittest_parse_interrupts(void)
+ {
+ struct device_node *np;
+@@ -3371,6 +3426,7 @@ static int __init of_unittest(void)
+ of_unittest_parse_dma_ranges();
+ of_unittest_pci_dma_ranges();
+ of_unittest_bus_ranges();
++ of_unittest_bus_3cell_ranges();
+ of_unittest_match_node();
+ of_unittest_platform_populate();
+ of_unittest_overlay();
+--
+2.39.5
+
--- /dev/null
+From d3faf872f43180dfb978054e0c48e19a47708f8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2023 13:02:16 +0200
+Subject: of: address: Fix address translation when address-size is greater
+ than 2
+
+From: Herve Codina <herve.codina@bootlin.com>
+
+[ Upstream commit 42604f8eb7ba04b589375049cc76282dad4677d2 ]
+
+With the recent addition of of_pci_prop_ranges() in commit 407d1a51921e
+("PCI: Create device tree node for bridge"), the ranges property can
+have a 3 cells child address, a 3 cells parent address and a 2 cells
+child size.
+
+A range item property for a PCI device is filled as follow:
+ <BAR_nbr> 0 0 <phys.hi> <phys.mid> <phys.low> <BAR_sizeh> <BAR_sizel>
+ <-- Child --> <-- Parent (PCI definition) --> <- BAR size (64bit) -->
+
+This allow to translate BAR addresses from the DT. For instance:
+pci@0,0 {
+ #address-cells = <0x03>;
+ #size-cells = <0x02>;
+ device_type = "pci";
+ compatible = "pci11ab,100", "pciclass,060400", "pciclass,0604";
+ ranges = <0x82000000 0x00 0xe8000000
+ 0x82000000 0x00 0xe8000000
+ 0x00 0x4400000>;
+ ...
+ dev@0,0 {
+ #address-cells = <0x03>;
+ #size-cells = <0x02>;
+ compatible = "pci1055,9660", "pciclass,020000", "pciclass,0200";
+ /* Translations for BAR0 to BAR5 */
+ ranges = <0x00 0x00 0x00 0x82010000 0x00 0xe8000000 0x00 0x2000000
+ 0x01 0x00 0x00 0x82010000 0x00 0xea000000 0x00 0x1000000
+ 0x02 0x00 0x00 0x82010000 0x00 0xeb000000 0x00 0x800000
+ 0x03 0x00 0x00 0x82010000 0x00 0xeb800000 0x00 0x800000
+ 0x04 0x00 0x00 0x82010000 0x00 0xec000000 0x00 0x20000
+ 0x05 0x00 0x00 0x82010000 0x00 0xec020000 0x00 0x2000>;
+ ...
+ pci-ep-bus@0 {
+ #address-cells = <0x01>;
+ #size-cells = <0x01>;
+ compatible = "simple-bus";
+ /* Translate 0xe2000000 to BAR0 and 0xe0000000 to BAR1 */
+ ranges = <0xe2000000 0x00 0x00 0x00 0x2000000
+ 0xe0000000 0x01 0x00 0x00 0x1000000>;
+ ...
+ };
+ };
+};
+
+During the translation process, the "default-flags" map() function is
+used to select the matching item in the ranges table and determine the
+address offset from this matching item.
+This map() function simply calls of_read_number() and when address-size
+is greater than 2, the map() function skips the extra high address part
+(ie part over 64bit). This lead to a wrong matching item and a wrong
+offset computation.
+Also during the translation itself, the extra high part related to the
+parent address is not present in the translated address.
+
+Fix the "default-flags" map() and translate() in order to take into
+account the child extra high address part in map() and the parent extra
+high address part in translate() and so having a correct address
+translation for ranges patterns such as the one given in the example
+above.
+
+Signed-off-by: Herve Codina <herve.codina@bootlin.com>
+Link: https://lore.kernel.org/r/20231017110221.189299-2-herve.codina@bootlin.com
+Signed-off-by: Rob Herring <robh@kernel.org>
+Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/address.c | 30 ++++++++++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 2aebce8f4a76..f1c4f987ef95 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -107,6 +107,32 @@ static unsigned int of_bus_default_get_flags(const __be32 *addr)
+ return IORESOURCE_MEM;
+ }
+
++static u64 of_bus_default_flags_map(__be32 *addr, const __be32 *range, int na,
++ int ns, int pna)
++{
++ u64 cp, s, da;
++
++ /* Check that flags match */
++ if (*addr != *range)
++ return OF_BAD_ADDR;
++
++ /* Read address values, skipping high cell */
++ cp = of_read_number(range + 1, na - 1);
++ s = of_read_number(range + na + pna, ns);
++ da = of_read_number(addr + 1, na - 1);
++
++ pr_debug("default flags map, cp=%llx, s=%llx, da=%llx\n", cp, s, da);
++
++ if (da < cp || da >= (cp + s))
++ return OF_BAD_ADDR;
++ return da - cp;
++}
++
++static int of_bus_default_flags_translate(__be32 *addr, u64 offset, int na)
++{
++ /* Keep "flags" part (high cell) in translated address */
++ return of_bus_default_translate(addr + 1, offset, na - 1);
++}
+
+ #ifdef CONFIG_PCI
+ static unsigned int of_bus_pci_get_flags(const __be32 *addr)
+@@ -374,8 +400,8 @@ static struct of_bus of_busses[] = {
+ .addresses = "reg",
+ .match = of_bus_default_flags_match,
+ .count_cells = of_bus_default_count_cells,
+- .map = of_bus_default_map,
+- .translate = of_bus_default_translate,
++ .map = of_bus_default_flags_map,
++ .translate = of_bus_default_flags_translate,
+ .has_flags = true,
+ .get_flags = of_bus_default_flags_get_flags,
+ },
+--
+2.39.5
+
--- /dev/null
+From 390a61201e9816ab7f3b6191a6d9efe5f1158166 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Nov 2024 11:05:37 +0100
+Subject: of: address: Preserve the flags portion on 1:1 dma-ranges mapping
+
+From: Andrea della Porta <andrea.porta@suse.com>
+
+[ Upstream commit 7f05e20b989ac33c9c0f8c2028ec0a566493548f ]
+
+A missing or empty dma-ranges in a DT node implies a 1:1 mapping for dma
+translations. In this specific case, the current behaviour is to zero out
+the entire specifier so that the translation could be carried on as an
+offset from zero. This includes address specifier that has flags (e.g.
+PCI ranges).
+
+Once the flags portion has been zeroed, the translation chain is broken
+since the mapping functions will check the upcoming address specifier
+against mismatching flags, always failing the 1:1 mapping and its entire
+purpose of always succeeding.
+
+Set to zero only the address portion while passing the flags through.
+
+Fixes: dbbdee94734b ("of/address: Merge all of the bus translation code")
+Cc: stable@vger.kernel.org
+Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
+Tested-by: Herve Codina <herve.codina@bootlin.com>
+Link: https://lore.kernel.org/r/e51ae57874e58a9b349c35e2e877425ebc075d7a.1732441813.git.andrea.porta@suse.com
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/address.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 2bbbc4f5e196..d995033fb661 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -475,7 +475,8 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
+ }
+ if (ranges == NULL || rlen == 0) {
+ offset = of_read_number(addr, na);
+- memset(addr, 0, pna * 4);
++ /* set address to zero, pass flags through */
++ memset(addr + pbus->flag_cells, 0, (pna - pbus->flag_cells) * 4);
+ pr_debug("empty ranges; 1:1 translation\n");
+ goto finish;
+ }
+--
+2.39.5
+
--- /dev/null
+From 81e795c7ebfcf01f32c0f7bf1dfd8e23ba390ae9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2023 13:02:17 +0200
+Subject: of: address: Remove duplicated functions
+
+From: Herve Codina <herve.codina@bootlin.com>
+
+[ Upstream commit 3eb030c60835668997d5763b1a0c7938faf169f6 ]
+
+The recently added of_bus_default_flags_translate() performs the exact
+same operation as of_bus_pci_translate() and of_bus_isa_translate().
+
+Avoid duplicated code replacing both of_bus_pci_translate() and
+of_bus_isa_translate() with of_bus_default_flags_translate().
+
+Signed-off-by: Herve Codina <herve.codina@bootlin.com>
+Link: https://lore.kernel.org/r/20231017110221.189299-3-herve.codina@bootlin.com
+Signed-off-by: Rob Herring <robh@kernel.org>
+Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/address.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index f1c4f987ef95..6b03adec12a7 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -222,10 +222,6 @@ static u64 of_bus_pci_map(__be32 *addr, const __be32 *range, int na, int ns,
+ return da - cp;
+ }
+
+-static int of_bus_pci_translate(__be32 *addr, u64 offset, int na)
+-{
+- return of_bus_default_translate(addr + 1, offset, na - 1);
+-}
+ #endif /* CONFIG_PCI */
+
+ int of_pci_address_to_resource(struct device_node *dev, int bar,
+@@ -343,11 +339,6 @@ static u64 of_bus_isa_map(__be32 *addr, const __be32 *range, int na, int ns,
+ return da - cp;
+ }
+
+-static int of_bus_isa_translate(__be32 *addr, u64 offset, int na)
+-{
+- return of_bus_default_translate(addr + 1, offset, na - 1);
+-}
+-
+ static unsigned int of_bus_isa_get_flags(const __be32 *addr)
+ {
+ unsigned int flags = 0;
+@@ -378,7 +369,7 @@ static struct of_bus of_busses[] = {
+ .match = of_bus_pci_match,
+ .count_cells = of_bus_pci_count_cells,
+ .map = of_bus_pci_map,
+- .translate = of_bus_pci_translate,
++ .translate = of_bus_default_flags_translate,
+ .has_flags = true,
+ .get_flags = of_bus_pci_get_flags,
+ },
+@@ -390,7 +381,7 @@ static struct of_bus of_busses[] = {
+ .match = of_bus_isa_match,
+ .count_cells = of_bus_isa_count_cells,
+ .map = of_bus_isa_map,
+- .translate = of_bus_isa_translate,
++ .translate = of_bus_default_flags_translate,
+ .has_flags = true,
+ .get_flags = of_bus_isa_get_flags,
+ },
+--
+2.39.5
+
--- /dev/null
+From 6d2a462f7524d46f03edd94dcc037d6ba436b576 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Oct 2023 08:53:58 -0500
+Subject: of: address: Store number of bus flag cells rather than bool
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 88696db08b7efa3b6bb722014ea7429e78f6be32 ]
+
+It is more useful to know how many flags cells a bus has rather than
+whether a bus has flags or not as ultimately the number of cells is the
+information used. Replace 'has_flags' boolean with 'flag_cells' count.
+
+Acked-by: Herve Codina <herve.codina@bootlin.com>
+Link: https://lore.kernel.org/r/20231026135358.3564307-2-robh@kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/address.c | 14 +++++---------
+ 1 file changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 6b03adec12a7..2bbbc4f5e196 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -50,7 +50,7 @@ struct of_bus {
+ u64 (*map)(__be32 *addr, const __be32 *range,
+ int na, int ns, int pna);
+ int (*translate)(__be32 *addr, u64 offset, int na);
+- bool has_flags;
++ int flag_cells;
+ unsigned int (*get_flags)(const __be32 *addr);
+ };
+
+@@ -370,7 +370,7 @@ static struct of_bus of_busses[] = {
+ .count_cells = of_bus_pci_count_cells,
+ .map = of_bus_pci_map,
+ .translate = of_bus_default_flags_translate,
+- .has_flags = true,
++ .flag_cells = 1,
+ .get_flags = of_bus_pci_get_flags,
+ },
+ #endif /* CONFIG_PCI */
+@@ -382,7 +382,7 @@ static struct of_bus of_busses[] = {
+ .count_cells = of_bus_isa_count_cells,
+ .map = of_bus_isa_map,
+ .translate = of_bus_default_flags_translate,
+- .has_flags = true,
++ .flag_cells = 1,
+ .get_flags = of_bus_isa_get_flags,
+ },
+ /* Default with flags cell */
+@@ -393,7 +393,7 @@ static struct of_bus of_busses[] = {
+ .count_cells = of_bus_default_count_cells,
+ .map = of_bus_default_flags_map,
+ .translate = of_bus_default_flags_translate,
+- .has_flags = true,
++ .flag_cells = 1,
+ .get_flags = of_bus_default_flags_get_flags,
+ },
+ /* Default */
+@@ -760,7 +760,7 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser,
+ int na = parser->na;
+ int ns = parser->ns;
+ int np = parser->pna + na + ns;
+- int busflag_na = 0;
++ int busflag_na = parser->bus->flag_cells;
+
+ if (!range)
+ return NULL;
+@@ -770,10 +770,6 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser,
+
+ range->flags = parser->bus->get_flags(parser->range);
+
+- /* A extra cell for resource flags */
+- if (parser->bus->has_flags)
+- busflag_na = 1;
+-
+ range->bus_addr = of_read_number(parser->range + busflag_na, na - busflag_na);
+
+ if (parser->dma)
+--
+2.39.5
+
--- /dev/null
+From fae3d11e5b37adf684317c00baa2549606b90419 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 May 2021 14:45:46 -0500
+Subject: of: address: Use IS_ENABLED() for !CONFIG_PCI
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit c3c0dc75774b488770f33598109161040d291367 ]
+
+Convert address.c to use IS_ENABLED() instead of ifdefs for the
+public PCI functions. This simplifies the ifdefs in of_address.h.
+
+Cc: Frank Rowand <frowand.list@gmail.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20210527194547.1287934-4-robh@kernel.org
+Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/address.c | 8 +++++++-
+ include/linux/of_address.h | 39 ++++++++++++++++++--------------------
+ 2 files changed, 25 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 0455271a26ac..068a134f6df7 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -194,6 +194,7 @@ static int of_bus_pci_translate(__be32 *addr, u64 offset, int na)
+ {
+ return of_bus_default_translate(addr + 1, offset, na - 1);
+ }
++#endif /* CONFIG_PCI */
+
+ int of_pci_address_to_resource(struct device_node *dev, int bar,
+ struct resource *r)
+@@ -202,6 +203,9 @@ int of_pci_address_to_resource(struct device_node *dev, int bar,
+ u64 size;
+ unsigned int flags;
+
++ if (!IS_ENABLED(CONFIG_PCI))
++ return -ENOSYS;
++
+ addrp = of_get_pci_address(dev, bar, &size, &flags);
+ if (addrp == NULL)
+ return -EINVAL;
+@@ -232,6 +236,9 @@ int of_pci_range_to_resource(struct of_pci_range *range,
+ res->parent = res->child = res->sibling = NULL;
+ res->name = np->full_name;
+
++ if (!IS_ENABLED(CONFIG_PCI))
++ return -ENOSYS;
++
+ if (res->flags & IORESOURCE_IO) {
+ unsigned long port;
+ err = pci_register_io_range(&np->fwnode, range->cpu_addr,
+@@ -262,7 +269,6 @@ int of_pci_range_to_resource(struct of_pci_range *range,
+ return err;
+ }
+ EXPORT_SYMBOL(of_pci_range_to_resource);
+-#endif /* CONFIG_PCI */
+
+ /*
+ * ISA bus specific translator
+diff --git a/include/linux/of_address.h b/include/linux/of_address.h
+index b72807faf037..45598dbec269 100644
+--- a/include/linux/of_address.h
++++ b/include/linux/of_address.h
+@@ -61,6 +61,11 @@ extern int of_pci_dma_range_parser_init(struct of_pci_range_parser *parser,
+ extern struct of_pci_range *of_pci_range_parser_one(
+ struct of_pci_range_parser *parser,
+ struct of_pci_range *range);
++extern int of_pci_address_to_resource(struct device_node *dev, int bar,
++ struct resource *r);
++extern int of_pci_range_to_resource(struct of_pci_range *range,
++ struct device_node *np,
++ struct resource *res);
+ extern bool of_dma_is_coherent(struct device_node *np);
+ #else /* CONFIG_OF_ADDRESS */
+ static inline void __iomem *of_io_request_and_map(struct device_node *device,
+@@ -100,6 +105,19 @@ static inline struct of_pci_range *of_pci_range_parser_one(
+ return NULL;
+ }
+
++static inline int of_pci_address_to_resource(struct device_node *dev, int bar,
++ struct resource *r)
++{
++ return -ENOSYS;
++}
++
++static inline int of_pci_range_to_resource(struct of_pci_range *range,
++ struct device_node *np,
++ struct resource *res)
++{
++ return -ENOSYS;
++}
++
+ static inline bool of_dma_is_coherent(struct device_node *np)
+ {
+ return false;
+@@ -124,27 +142,6 @@ static inline void __iomem *of_iomap(struct device_node *device, int index)
+ #endif
+ #define of_range_parser_init of_pci_range_parser_init
+
+-#if defined(CONFIG_OF_ADDRESS) && defined(CONFIG_PCI)
+-extern int of_pci_address_to_resource(struct device_node *dev, int bar,
+- struct resource *r);
+-extern int of_pci_range_to_resource(struct of_pci_range *range,
+- struct device_node *np,
+- struct resource *res);
+-#else /* CONFIG_OF_ADDRESS && CONFIG_PCI */
+-static inline int of_pci_address_to_resource(struct device_node *dev, int bar,
+- struct resource *r)
+-{
+- return -ENOSYS;
+-}
+-
+-static inline int of_pci_range_to_resource(struct of_pci_range *range,
+- struct device_node *np,
+- struct resource *res)
+-{
+- return -ENOSYS;
+-}
+-#endif /* CONFIG_OF_ADDRESS && CONFIG_PCI */
+-
+ static inline const __be32 *of_get_address(struct device_node *dev, int index,
+ u64 *size, unsigned int *flags)
+ {
+--
+2.39.5
+
--- /dev/null
+From 83a68f7ded70bd823ff3b463647c3610d6b55722 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 May 2021 14:45:45 -0500
+Subject: of: Merge of_get_address() and of_get_pci_address() implementations
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 050a2c62dfc7d9ef457405f6ab4b715e9a2e32d7 ]
+
+of_get_address() and of_get_pci_address() are the same implementation
+except of_get_pci_address() takes the PCI BAR number rather than an
+index. Modify the of_get_address() implementation to work on either
+index or BAR and provide wrapper functions for the existing functions.
+
+Cc: Frank Rowand <frowand.list@gmail.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20210527194547.1287934-3-robh@kernel.org
+Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/address.c | 62 ++++++++------------------------------
+ include/linux/of_address.h | 27 ++++++++++-------
+ 2 files changed, 29 insertions(+), 60 deletions(-)
+
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 7e2bfbb22430..0455271a26ac 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -195,50 +195,6 @@ static int of_bus_pci_translate(__be32 *addr, u64 offset, int na)
+ return of_bus_default_translate(addr + 1, offset, na - 1);
+ }
+
+-const __be32 *of_get_pci_address(struct device_node *dev, int bar_no, u64 *size,
+- unsigned int *flags)
+-{
+- const __be32 *prop;
+- unsigned int psize;
+- struct device_node *parent;
+- struct of_bus *bus;
+- int onesize, i, na, ns;
+-
+- /* Get parent & match bus type */
+- parent = of_get_parent(dev);
+- if (parent == NULL)
+- return NULL;
+- bus = of_match_bus(parent);
+- if (strcmp(bus->name, "pci")) {
+- of_node_put(parent);
+- return NULL;
+- }
+- bus->count_cells(dev, &na, &ns);
+- of_node_put(parent);
+- if (!OF_CHECK_ADDR_COUNT(na))
+- return NULL;
+-
+- /* Get "reg" or "assigned-addresses" property */
+- prop = of_get_property(dev, bus->addresses, &psize);
+- if (prop == NULL)
+- return NULL;
+- psize /= 4;
+-
+- onesize = na + ns;
+- for (i = 0; psize >= onesize; psize -= onesize, prop += onesize, i++) {
+- u32 val = be32_to_cpu(prop[0]);
+- if ((val & 0xff) == ((bar_no * 4) + PCI_BASE_ADDRESS_0)) {
+- if (size)
+- *size = of_read_number(prop + na, ns);
+- if (flags)
+- *flags = bus->get_flags(prop);
+- return prop;
+- }
+- }
+- return NULL;
+-}
+-EXPORT_SYMBOL(of_get_pci_address);
+-
+ int of_pci_address_to_resource(struct device_node *dev, int bar,
+ struct resource *r)
+ {
+@@ -671,8 +627,8 @@ u64 of_translate_dma_address(struct device_node *dev, const __be32 *in_addr)
+ }
+ EXPORT_SYMBOL(of_translate_dma_address);
+
+-const __be32 *of_get_address(struct device_node *dev, int index, u64 *size,
+- unsigned int *flags)
++const __be32 *__of_get_address(struct device_node *dev, int index, int bar_no,
++ u64 *size, unsigned int *flags)
+ {
+ const __be32 *prop;
+ unsigned int psize;
+@@ -685,6 +641,10 @@ const __be32 *of_get_address(struct device_node *dev, int index, u64 *size,
+ if (parent == NULL)
+ return NULL;
+ bus = of_match_bus(parent);
++ if (strcmp(bus->name, "pci") && (bar_no >= 0)) {
++ of_node_put(parent);
++ return NULL;
++ }
+ bus->count_cells(dev, &na, &ns);
+ of_node_put(parent);
+ if (!OF_CHECK_ADDR_COUNT(na))
+@@ -697,17 +657,21 @@ const __be32 *of_get_address(struct device_node *dev, int index, u64 *size,
+ psize /= 4;
+
+ onesize = na + ns;
+- for (i = 0; psize >= onesize; psize -= onesize, prop += onesize, i++)
+- if (i == index) {
++ for (i = 0; psize >= onesize; psize -= onesize, prop += onesize, i++) {
++ u32 val = be32_to_cpu(prop[0]);
++ /* PCI bus matches on BAR number instead of index */
++ if (((bar_no >= 0) && ((val & 0xff) == ((bar_no * 4) + PCI_BASE_ADDRESS_0))) ||
++ ((index >= 0) && (i == index))) {
+ if (size)
+ *size = of_read_number(prop + na, ns);
+ if (flags)
+ *flags = bus->get_flags(prop);
+ return prop;
+ }
++ }
+ return NULL;
+ }
+-EXPORT_SYMBOL(of_get_address);
++EXPORT_SYMBOL(__of_get_address);
+
+ static int parser_init(struct of_pci_range_parser *parser,
+ struct device_node *node, const char *name)
+diff --git a/include/linux/of_address.h b/include/linux/of_address.h
+index 88bc943405cd..b72807faf037 100644
+--- a/include/linux/of_address.h
++++ b/include/linux/of_address.h
+@@ -51,8 +51,8 @@ void __iomem *of_io_request_and_map(struct device_node *device,
+ * the address space flags too. The PCI version uses a BAR number
+ * instead of an absolute index
+ */
+-extern const __be32 *of_get_address(struct device_node *dev, int index,
+- u64 *size, unsigned int *flags);
++extern const __be32 *__of_get_address(struct device_node *dev, int index, int bar_no,
++ u64 *size, unsigned int *flags);
+
+ extern int of_pci_range_parser_init(struct of_pci_range_parser *parser,
+ struct device_node *node);
+@@ -75,8 +75,8 @@ static inline u64 of_translate_address(struct device_node *np,
+ return OF_BAD_ADDR;
+ }
+
+-static inline const __be32 *of_get_address(struct device_node *dev, int index,
+- u64 *size, unsigned int *flags)
++static inline const __be32 *__of_get_address(struct device_node *dev, int index, int bar_no,
++ u64 *size, unsigned int *flags)
+ {
+ return NULL;
+ }
+@@ -125,8 +125,6 @@ static inline void __iomem *of_iomap(struct device_node *device, int index)
+ #define of_range_parser_init of_pci_range_parser_init
+
+ #if defined(CONFIG_OF_ADDRESS) && defined(CONFIG_PCI)
+-extern const __be32 *of_get_pci_address(struct device_node *dev, int bar_no,
+- u64 *size, unsigned int *flags);
+ extern int of_pci_address_to_resource(struct device_node *dev, int bar,
+ struct resource *r);
+ extern int of_pci_range_to_resource(struct of_pci_range *range,
+@@ -139,11 +137,6 @@ static inline int of_pci_address_to_resource(struct device_node *dev, int bar,
+ return -ENOSYS;
+ }
+
+-static inline const __be32 *of_get_pci_address(struct device_node *dev,
+- int bar_no, u64 *size, unsigned int *flags)
+-{
+- return NULL;
+-}
+ static inline int of_pci_range_to_resource(struct of_pci_range *range,
+ struct device_node *np,
+ struct resource *res)
+@@ -152,4 +145,16 @@ static inline int of_pci_range_to_resource(struct of_pci_range *range,
+ }
+ #endif /* CONFIG_OF_ADDRESS && CONFIG_PCI */
+
++static inline const __be32 *of_get_address(struct device_node *dev, int index,
++ u64 *size, unsigned int *flags)
++{
++ return __of_get_address(dev, index, -1, size, flags);
++}
++
++static inline const __be32 *of_get_pci_address(struct device_node *dev, int bar_no,
++ u64 *size, unsigned int *flags)
++{
++ return __of_get_address(dev, -1, bar_no, size, flags);
++}
++
+ #endif /* __OF_ADDRESS_H */
+--
+2.39.5
+
--- /dev/null
+From 29f2f3ced2ef45609c453f87d322c18589ce7c33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 15:15:56 -0500
+Subject: of: unittest: Add bus address range parsing tests
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 6d32dadb11a6480be62c6ada901bbdcbda1775c9 ]
+
+While there are tests for "dma-ranges" helpers, "ranges" is missing any
+tests. It's the same underlying code, but for completeness add a test
+for "ranges" parsing iterators. This is in preparation to add some
+additional "ranges" helpers.
+
+Link: https://lore.kernel.org/r/20230328-dt-address-helpers-v1-1-e2456c3e77ab@kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/unittest.c | 53 +++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 53 insertions(+)
+
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index a334c68db339..cb199ace8681 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -1018,6 +1018,58 @@ static void __init of_unittest_pci_dma_ranges(void)
+ of_node_put(np);
+ }
+
++static void __init of_unittest_bus_ranges(void)
++{
++ struct device_node *np;
++ struct of_range range;
++ struct of_range_parser parser;
++ int i = 0;
++
++ np = of_find_node_by_path("/testcase-data/address-tests");
++ if (!np) {
++ pr_err("missing testcase data\n");
++ return;
++ }
++
++ if (of_range_parser_init(&parser, np)) {
++ pr_err("missing ranges property\n");
++ return;
++ }
++
++ /*
++ * Get the "ranges" from the device tree
++ */
++ for_each_of_range(&parser, &range) {
++ unittest(range.flags == IORESOURCE_MEM,
++ "for_each_of_range wrong flags on node %pOF flags=%x (expected %x)\n",
++ np, range.flags, IORESOURCE_MEM);
++ if (!i) {
++ unittest(range.size == 0x40000000,
++ "for_each_of_range wrong size on node %pOF size=%llx\n",
++ np, range.size);
++ unittest(range.cpu_addr == 0x70000000,
++ "for_each_of_range wrong CPU addr (%llx) on node %pOF",
++ range.cpu_addr, np);
++ unittest(range.bus_addr == 0x70000000,
++ "for_each_of_range wrong bus addr (%llx) on node %pOF",
++ range.pci_addr, np);
++ } else {
++ unittest(range.size == 0x20000000,
++ "for_each_of_range wrong size on node %pOF size=%llx\n",
++ np, range.size);
++ unittest(range.cpu_addr == 0xd0000000,
++ "for_each_of_range wrong CPU addr (%llx) on node %pOF",
++ range.cpu_addr, np);
++ unittest(range.bus_addr == 0x00000000,
++ "for_each_of_range wrong bus addr (%llx) on node %pOF",
++ range.pci_addr, np);
++ }
++ i++;
++ }
++
++ of_node_put(np);
++}
++
+ static void __init of_unittest_parse_interrupts(void)
+ {
+ struct device_node *np;
+@@ -3318,6 +3370,7 @@ static int __init of_unittest(void)
+ of_unittest_dma_get_max_cpu_address();
+ of_unittest_parse_dma_ranges();
+ of_unittest_pci_dma_ranges();
++ of_unittest_bus_ranges();
+ of_unittest_match_node();
+ of_unittest_platform_populate();
+ of_unittest_overlay();
+--
+2.39.5
+
--- /dev/null
+From 5603ae0380bbf09228ca3361710dcb04d178cbfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Feb 2022 19:24:21 -0800
+Subject: phy: usb: Add "wake on" functionality for newer Synopsis XHCI
+ controllers
+
+From: Al Cooper <alcooperx@gmail.com>
+
+[ Upstream commit ae532b2b7aa5a3dad036aef4e0b177607172d276 ]
+
+Add "wake on" support for the newer Synopsis based XHCI only controller.
+This works on the 72165 and 72164 and newer chips and does not work
+on 7216 based systems. Also switch the USB sysclk to a slower clock
+on suspend to save additional power in S2. The clock switch will only
+save power on the 72165b0 and newer chips and is a nop on older chips.
+
+Signed-off-by: Al Cooper <alcooperx@gmail.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20220215032422.5179-1-f.fainelli@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Stable-dep-of: 0a92ea87bdd6 ("phy: usb: Toggle the PHY power during init")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../phy/broadcom/phy-brcm-usb-init-synopsys.c | 46 +++++++++++++++----
+ 1 file changed, 38 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
+index e63457e145c7..d2524b70ea16 100644
+--- a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
++++ b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
+@@ -47,6 +47,8 @@
+ #define USB_CTRL_USB_PM_SOFT_RESET_MASK 0x40000000
+ #define USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK 0x00800000
+ #define USB_CTRL_USB_PM_XHC_SOFT_RESETB_MASK 0x00400000
++#define USB_CTRL_USB_PM_XHC_PME_EN_MASK 0x00000010
++#define USB_CTRL_USB_PM_XHC_S2_CLK_SWITCH_EN_MASK 0x00000008
+ #define USB_CTRL_USB_PM_STATUS 0x08
+ #define USB_CTRL_USB_DEVICE_CTL1 0x10
+ #define USB_CTRL_USB_DEVICE_CTL1_PORT_MODE_MASK 0x00000003
+@@ -190,10 +192,6 @@ static void usb_init_common(struct brcm_usb_init_params *params)
+
+ pr_debug("%s\n", __func__);
+
+- USB_CTRL_UNSET(ctrl, USB_PM, USB_PWRDN);
+- /* 1 millisecond - for USB clocks to settle down */
+- usleep_range(1000, 2000);
+-
+ if (USB_CTRL_MASK(USB_DEVICE_CTL1, PORT_MODE)) {
+ reg = brcm_usb_readl(USB_CTRL_REG(ctrl, USB_DEVICE_CTL1));
+ reg &= ~USB_CTRL_MASK(USB_DEVICE_CTL1, PORT_MODE);
+@@ -222,6 +220,17 @@ static void usb_wake_enable_7211b0(struct brcm_usb_init_params *params,
+ USB_CTRL_UNSET(ctrl, CTLR_CSHCR, ctl_pme_en);
+ }
+
++static void usb_wake_enable_7216(struct brcm_usb_init_params *params,
++ bool enable)
++{
++ void __iomem *ctrl = params->regs[BRCM_REGS_CTRL];
++
++ if (enable)
++ USB_CTRL_SET(ctrl, USB_PM, XHC_PME_EN);
++ else
++ USB_CTRL_UNSET(ctrl, USB_PM, XHC_PME_EN);
++}
++
+ static void usb_init_common_7211b0(struct brcm_usb_init_params *params)
+ {
+ void __iomem *ctrl = params->regs[BRCM_REGS_CTRL];
+@@ -295,6 +304,20 @@ static void usb_init_common_7211b0(struct brcm_usb_init_params *params)
+ usb2_eye_fix_7211b0(params);
+ }
+
++static void usb_init_common_7216(struct brcm_usb_init_params *params)
++{
++ void __iomem *ctrl = params->regs[BRCM_REGS_CTRL];
++
++ USB_CTRL_UNSET(ctrl, USB_PM, XHC_S2_CLK_SWITCH_EN);
++ USB_CTRL_UNSET(ctrl, USB_PM, USB_PWRDN);
++
++ /* 1 millisecond - for USB clocks to settle down */
++ usleep_range(1000, 2000);
++
++ usb_wake_enable_7216(params, false);
++ usb_init_common(params);
++}
++
+ static void usb_init_xhci(struct brcm_usb_init_params *params)
+ {
+ pr_debug("%s\n", __func__);
+@@ -302,14 +325,20 @@ static void usb_init_xhci(struct brcm_usb_init_params *params)
+ xhci_soft_reset(params, 0);
+ }
+
+-static void usb_uninit_common(struct brcm_usb_init_params *params)
++static void usb_uninit_common_7216(struct brcm_usb_init_params *params)
+ {
+ void __iomem *ctrl = params->regs[BRCM_REGS_CTRL];
+
+ pr_debug("%s\n", __func__);
+
+- USB_CTRL_SET(ctrl, USB_PM, USB_PWRDN);
++ if (!params->wake_enabled) {
++ USB_CTRL_SET(ctrl, USB_PM, USB_PWRDN);
+
++ /* Switch to using slower clock during suspend to save power */
++ USB_CTRL_SET(ctrl, USB_PM, XHC_S2_CLK_SWITCH_EN);
++ } else {
++ usb_wake_enable_7216(params, true);
++ }
+ }
+
+ static void usb_uninit_common_7211b0(struct brcm_usb_init_params *params)
+@@ -371,9 +400,9 @@ static void usb_set_dual_select(struct brcm_usb_init_params *params, int mode)
+
+ static const struct brcm_usb_init_ops bcm7216_ops = {
+ .init_ipp = usb_init_ipp,
+- .init_common = usb_init_common,
++ .init_common = usb_init_common_7216,
+ .init_xhci = usb_init_xhci,
+- .uninit_common = usb_uninit_common,
++ .uninit_common = usb_uninit_common_7216,
+ .uninit_xhci = usb_uninit_xhci,
+ .get_dual_select = usb_get_dual_select,
+ .set_dual_select = usb_set_dual_select,
+@@ -396,6 +425,7 @@ void brcm_usb_dvr_init_7216(struct brcm_usb_init_params *params)
+
+ params->family_name = "7216";
+ params->ops = &bcm7216_ops;
++ params->suspend_with_clocks = true;
+ }
+
+ void brcm_usb_dvr_init_7211b0(struct brcm_usb_init_params *params)
+--
+2.39.5
+
--- /dev/null
+From cc2bf570b2deb1852288fd18cd739d97d495e579 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 14:35:40 -0700
+Subject: phy: usb: Toggle the PHY power during init
+
+From: Justin Chen <justin.chen@broadcom.com>
+
+[ Upstream commit 0a92ea87bdd6f77ca4e17fe19649882cf5209edd ]
+
+When bringing up the PHY, it might be in a bad state if left powered.
+One case is we lose the PLL lock if the PLL is gated while the PHY
+is powered. Toggle the PHY power so we can start from a known state.
+
+Fixes: 4e5b9c9a73b3 ("phy: usb: Add support for new Synopsys USB controller on the 7216")
+Signed-off-by: Justin Chen <justin.chen@broadcom.com>
+Acked-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://lore.kernel.org/r/20241024213540.1059412-1-justin.chen@broadcom.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
+index d2524b70ea16..fa54da35719f 100644
+--- a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
++++ b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
+@@ -309,6 +309,12 @@ static void usb_init_common_7216(struct brcm_usb_init_params *params)
+ void __iomem *ctrl = params->regs[BRCM_REGS_CTRL];
+
+ USB_CTRL_UNSET(ctrl, USB_PM, XHC_S2_CLK_SWITCH_EN);
++
++ /*
++ * The PHY might be in a bad state if it is already powered
++ * up. Toggle the power just in case.
++ */
++ USB_CTRL_SET(ctrl, USB_PM, USB_PWRDN);
+ USB_CTRL_UNSET(ctrl, USB_PM, USB_PWRDN);
+
+ /* 1 millisecond - for USB clocks to settle down */
+--
+2.39.5
+
--- /dev/null
+From c22d413bad9a7b906c475b929133687c2ff17d51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2025 16:34:33 +0100
+Subject: sctp: sysctl: rto_min/max: avoid using current->nsproxy
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+[ Upstream commit 9fc17b76fc70763780aa78b38fcf4742384044a5 ]
+
+As mentioned in a previous commit of this series, using the 'net'
+structure via 'current' is not recommended for different reasons:
+
+- Inconsistency: getting info from the reader's/writer's netns vs only
+ from the opener's netns.
+
+- current->nsproxy can be NULL in some cases, resulting in an 'Oops'
+ (null-ptr-deref), e.g. when the current task is exiting, as spotted by
+ syzbot [1] using acct(2).
+
+The 'net' structure can be obtained from the table->data using
+container_of().
+
+Note that table->data could also be used directly, as this is the only
+member needed from the 'net' structure, but that would increase the size
+of this fix, to use '*data' everywhere 'net->sctp.rto_min/max' is used.
+
+Fixes: 4f3fdf3bc59c ("sctp: add check rto_min and rto_max in sysctl")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/67769ecb.050a0220.3a8527.003f.GAE@google.com [1]
+Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250108-net-sysctl-current-nsproxy-v1-5-5df34b2083e8@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/sysctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
+index 8be80096fbb6..82b736843c9d 100644
+--- a/net/sctp/sysctl.c
++++ b/net/sctp/sysctl.c
+@@ -396,7 +396,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
+ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
+ void *buffer, size_t *lenp, loff_t *ppos)
+ {
+- struct net *net = current->nsproxy->net_ns;
++ struct net *net = container_of(ctl->data, struct net, sctp.rto_min);
+ unsigned int min = *(unsigned int *) ctl->extra1;
+ unsigned int max = *(unsigned int *) ctl->extra2;
+ struct ctl_table tbl;
+@@ -424,7 +424,7 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
+ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
+ void *buffer, size_t *lenp, loff_t *ppos)
+ {
+- struct net *net = current->nsproxy->net_ns;
++ struct net *net = container_of(ctl->data, struct net, sctp.rto_max);
+ unsigned int min = *(unsigned int *) ctl->extra1;
+ unsigned int max = *(unsigned int *) ctl->extra2;
+ struct ctl_table tbl;
+--
+2.39.5
+
--- /dev/null
+From 04f23ab1b09fc8d72a96882f1f1ac80958b58d5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 15:56:55 +0100
+Subject: sd: update the bdev size in sd_revalidate_disk
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit b200e38c493b2a5acff4f86d40a3e45d546c664c ]
+
+This avoids the extra call to revalidate_disk_size in sd_rescan and
+is otherwise a no-op because the size did not change, or we are in
+the probe path.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sd.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 2f2ca2878876..355d38cab862 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1767,10 +1767,8 @@ static int sd_sync_cache(struct scsi_disk *sdkp, struct scsi_sense_hdr *sshdr)
+ static void sd_rescan(struct device *dev)
+ {
+ struct scsi_disk *sdkp = dev_get_drvdata(dev);
+- int ret;
+
+- ret = sd_revalidate_disk(sdkp->disk);
+- revalidate_disk_size(sdkp->disk, ret == 0);
++ sd_revalidate_disk(sdkp->disk);
+ }
+
+ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
+@@ -3295,7 +3293,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ sdkp->first_scan = 0;
+
+ set_capacity_revalidate_and_notify(disk,
+- logical_to_sectors(sdp, sdkp->capacity), false);
++ logical_to_sectors(sdp, sdkp->capacity), true);
+ sd_config_write_same(sdkp);
+ kfree(buffer);
+
+@@ -3305,7 +3303,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ * capacity to 0.
+ */
+ if (sd_zbc_revalidate_zones(sdkp))
+- set_capacity_revalidate_and_notify(disk, 0, false);
++ set_capacity_revalidate_and_notify(disk, 0, true);
+
+ out:
+ return 0;
+--
+2.39.5
+
iio-adc-ti-ads124s08-use-gpiod_set_value_cansleep.patch
iio-adc-at91-call-input_free_device-on-allocated-iio_dev.patch
iio-inkern-call-iio_device_put-only-on-mapped-devices.patch
+arm64-dts-rockchip-add-power-domain-cells-to-power-d.patch
+arm64-dts-rockchip-add-hevc-power-domain-clock-to-rk.patch
+loop-let-set_capacity_revalidate_and_notify-update-t.patch
+nvme-let-set_capacity_revalidate_and_notify-update-t.patch
+sd-update-the-bdev-size-in-sd_revalidate_disk.patch
+block-remove-the-update_bdev-parameter-to-set_capaci.patch
+zram-use-set_capacity_and_notify.patch
+drivers-block-zram-zram_drv.c-do-not-keep-dangling-z.patch
+zram-fix-uninitialized-zram-not-releasing-backing-de.patch
+of-merge-of_get_address-and-of_get_pci_address-imple.patch
+of-address-use-is_enabled-for-config_pci.patch
+of-unittest-add-bus-address-range-parsing-tests.patch
+of-address-add-support-for-3-address-cell-bus.patch
+of-address-fix-address-translation-when-address-size.patch
+of-address-remove-duplicated-functions.patch
+of-address-store-number-of-bus-flag-cells-rather-tha.patch
+of-address-preserve-the-flags-portion-on-1-1-dma-ran.patch
+phy-usb-add-wake-on-functionality-for-newer-synopsis.patch
+phy-usb-toggle-the-phy-power-during-init.patch
+ocfs2-correct-return-value-of-ocfs2_local_free_info.patch
+ocfs2-fix-slab-use-after-free-due-to-dangling-pointe.patch
+drm-bridge-adv7511-remove-redundant-null-check-befor.patch
+drm-mipi-dsi-create-devm-device-registration.patch
+drm-mipi-dsi-create-devm-device-attachment.patch
+drm-bridge-adv7533-switch-to-devm-mipi-dsi-helpers.patch
+drm-bridge-adv7511-unregister-cec-i2c-device-after-c.patch
+drm-bridge-adv7511-use-dev_err_probe-in-probe-functi.patch
+drm-adv7511-fix-use-after-free-in-adv7533_attach_dsi.patch
+sctp-sysctl-rto_min-max-avoid-using-current-nsproxy.patch
--- /dev/null
+From 592137471373262c25f7e8773160c6e022b55c0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2024 00:57:16 +0800
+Subject: zram: fix uninitialized ZRAM not releasing backing device
+
+From: Kairui Song <kasong@tencent.com>
+
+[ Upstream commit 74363ec674cb172d8856de25776c8f3103f05e2f ]
+
+Setting backing device is done before ZRAM initialization. If we set the
+backing device, then remove the ZRAM module without initializing the
+device, the backing device reference will be leaked and the device will be
+hold forever.
+
+Fix this by always reset the ZRAM fully on rmmod or reset store.
+
+Link: https://lkml.kernel.org/r/20241209165717.94215-3-ryncsn@gmail.com
+Fixes: 013bf95a83ec ("zram: add interface to specif backing device")
+Signed-off-by: Kairui Song <kasong@tencent.com>
+Reported-by: Desheng Wu <deshengwu@tencent.com>
+Suggested-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/zram/zram_drv.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 8e13586be8c9..05a46fbe0ea9 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -1146,12 +1146,16 @@ static void zram_meta_free(struct zram *zram, u64 disksize)
+ size_t num_pages = disksize >> PAGE_SHIFT;
+ size_t index;
+
++ if (!zram->table)
++ return;
++
+ /* Free all pages that are still in this zram device */
+ for (index = 0; index < num_pages; index++)
+ zram_free_page(zram, index);
+
+ zs_destroy_pool(zram->mem_pool);
+ vfree(zram->table);
++ zram->table = NULL;
+ }
+
+ static bool zram_meta_alloc(struct zram *zram, u64 disksize)
+@@ -1694,11 +1698,6 @@ static void zram_reset_device(struct zram *zram)
+
+ zram->limit_pages = 0;
+
+- if (!init_done(zram)) {
+- up_write(&zram->init_lock);
+- return;
+- }
+-
+ set_capacity_and_notify(zram->disk, 0);
+ part_stat_set_all(&zram->disk->part0, 0);
+
+--
+2.39.5
+
--- /dev/null
+From 6e7bbd86b21ac8e554be9809d3db48dbe050ce4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 15:57:09 +0100
+Subject: zram: use set_capacity_and_notify
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 6e017a3931d7722260e3656a6fc9b02de5fb3c5d ]
+
+Use set_capacity_and_notify to set the size of both the disk and block
+device. This also gets the uevent notifications for the resize for free.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/zram/zram_drv.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 16db4fae5145..8f38e5a1a63f 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -1706,7 +1706,7 @@ static void zram_reset_device(struct zram *zram)
+ disksize = zram->disksize;
+ zram->disksize = 0;
+
+- set_capacity(zram->disk, 0);
++ set_capacity_and_notify(zram->disk, 0);
+ part_stat_set_all(&zram->disk->part0, 0);
+
+ up_write(&zram->init_lock);
+@@ -1752,9 +1752,7 @@ static ssize_t disksize_store(struct device *dev,
+
+ zram->comp = comp;
+ zram->disksize = disksize;
+- set_capacity(zram->disk, zram->disksize >> SECTOR_SHIFT);
+-
+- revalidate_disk_size(zram->disk, true);
++ set_capacity_and_notify(zram->disk, zram->disksize >> SECTOR_SHIFT);
+ up_write(&zram->init_lock);
+
+ return len;
+@@ -1801,7 +1799,6 @@ static ssize_t reset_store(struct device *dev,
+ /* Make sure all the pending I/O are finished */
+ fsync_bdev(bdev);
+ zram_reset_device(zram);
+- revalidate_disk_size(zram->disk, true);
+ bdput(bdev);
+
+ mutex_lock(&bdev->bd_mutex);
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
