--- /dev/null
+From a45ea48e2bcd92c1f678b794f488ca0bda9835b8 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Sun, 26 Jan 2020 01:02:53 +0000
+Subject: afs: Fix characters allowed into cell names
+
+From: David Howells <dhowells@redhat.com>
+
+commit a45ea48e2bcd92c1f678b794f488ca0bda9835b8 upstream.
+
+The afs filesystem needs to prohibit certain characters from cell names,
+such as '/', as these are used to form filenames in procfs, leading to
+the following warning being generated:
+
+ WARNING: CPU: 0 PID: 3489 at fs/proc/generic.c:178
+
+Fix afs_alloc_cell() to disallow nonprintable characters, '/', '@' and
+names that begin with a dot.
+
+Remove the check for "@cell" as that is then redundant.
+
+This can be tested by running:
+
+ echo add foo/.bar 1.2.3.4 >/proc/fs/afs/cells
+
+Note that we will also need to deal with:
+
+ - Names ending in ".invalid" shouldn't be passed to the DNS.
+
+ - Names that contain non-valid domainname chars shouldn't be passed to
+ the DNS.
+
+ - DNS replies that say "your-dns-needs-immediate-attention.<gTLD>" and
+ replies containing A records that say 127.0.53.53 should be
+ considered invalid.
+ [https://www.icann.org/en/system/files/files/name-collision-mitigation-01aug14-en.pdf]
+
+but these need to be dealt with by the kafs-client DNS program rather
+than the kernel.
+
+Reported-by: syzbot+b904ba7c947a37b4b291@syzkaller.appspotmail.com
+Cc: stable@kernel.org
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/afs/cell.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/fs/afs/cell.c
++++ b/fs/afs/cell.c
+@@ -135,8 +135,17 @@ static struct afs_cell *afs_alloc_cell(s
+ _leave(" = -ENAMETOOLONG");
+ return ERR_PTR(-ENAMETOOLONG);
+ }
+- if (namelen == 5 && memcmp(name, "@cell", 5) == 0)
++
++ /* Prohibit cell names that contain unprintable chars, '/' and '@' or
++ * that begin with a dot. This also precludes "@cell".
++ */
++ if (name[0] == '.')
+ return ERR_PTR(-EINVAL);
++ for (i = 0; i < namelen; i++) {
++ char ch = name[i];
++ if (!isprint(ch) || ch == '/' || ch == '@')
++ return ERR_PTR(-EINVAL);
++ }
+
+ _enter("%*.*s,%s", namelen, namelen, name, vllist);
+
--- /dev/null
+From 927d780ee371d7e121cea4fc7812f6ef2cea461c Mon Sep 17 00:00:00 2001
+From: Alex Sverdlin <alexander.sverdlin@nokia.com>
+Date: Wed, 8 Jan 2020 15:57:47 +0100
+Subject: ARM: 8950/1: ftrace/recordmcount: filter relocation types
+
+From: Alex Sverdlin <alexander.sverdlin@nokia.com>
+
+commit 927d780ee371d7e121cea4fc7812f6ef2cea461c upstream.
+
+Scenario 1, ARMv7
+=================
+
+If code in arch/arm/kernel/ftrace.c would operate on mcount() pointer
+the following may be generated:
+
+00000230 <prealloc_fixed_plts>:
+ 230: b5f8 push {r3, r4, r5, r6, r7, lr}
+ 232: b500 push {lr}
+ 234: f7ff fffe bl 0 <__gnu_mcount_nc>
+ 234: R_ARM_THM_CALL __gnu_mcount_nc
+ 238: f240 0600 movw r6, #0
+ 238: R_ARM_THM_MOVW_ABS_NC __gnu_mcount_nc
+ 23c: f8d0 1180 ldr.w r1, [r0, #384] ; 0x180
+
+FTRACE currently is not able to deal with it:
+
+WARNING: CPU: 0 PID: 0 at .../kernel/trace/ftrace.c:1979 ftrace_bug+0x1ad/0x230()
+...
+CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.116-... #1
+...
+[<c0314e3d>] (unwind_backtrace) from [<c03115e9>] (show_stack+0x11/0x14)
+[<c03115e9>] (show_stack) from [<c051a7f1>] (dump_stack+0x81/0xa8)
+[<c051a7f1>] (dump_stack) from [<c0321c5d>] (warn_slowpath_common+0x69/0x90)
+[<c0321c5d>] (warn_slowpath_common) from [<c0321cf3>] (warn_slowpath_null+0x17/0x1c)
+[<c0321cf3>] (warn_slowpath_null) from [<c038ee9d>] (ftrace_bug+0x1ad/0x230)
+[<c038ee9d>] (ftrace_bug) from [<c038f1f9>] (ftrace_process_locs+0x27d/0x444)
+[<c038f1f9>] (ftrace_process_locs) from [<c08915bd>] (ftrace_init+0x91/0xe8)
+[<c08915bd>] (ftrace_init) from [<c0885a67>] (start_kernel+0x34b/0x358)
+[<c0885a67>] (start_kernel) from [<00308095>] (0x308095)
+---[ end trace cb88537fdc8fa200 ]---
+ftrace failed to modify [<c031266c>] prealloc_fixed_plts+0x8/0x60
+ actual: 44:f2:e1:36
+ftrace record flags: 0
+ (0) expected tramp: c03143e9
+
+Scenario 2, ARMv4T
+==================
+
+ftrace: allocating 14435 entries in 43 pages
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:2029 ftrace_bug+0x204/0x310
+CPU: 0 PID: 0 Comm: swapper Not tainted 4.19.5 #1
+Hardware name: Cirrus Logic EDB9302 Evaluation Board
+[<c0010a24>] (unwind_backtrace) from [<c000ecb0>] (show_stack+0x20/0x2c)
+[<c000ecb0>] (show_stack) from [<c03c72e8>] (dump_stack+0x20/0x30)
+[<c03c72e8>] (dump_stack) from [<c0021c18>] (__warn+0xdc/0x104)
+[<c0021c18>] (__warn) from [<c0021d7c>] (warn_slowpath_null+0x4c/0x5c)
+[<c0021d7c>] (warn_slowpath_null) from [<c0095360>] (ftrace_bug+0x204/0x310)
+[<c0095360>] (ftrace_bug) from [<c04dabac>] (ftrace_init+0x3b4/0x4d4)
+[<c04dabac>] (ftrace_init) from [<c04cef4c>] (start_kernel+0x20c/0x410)
+[<c04cef4c>] (start_kernel) from [<00000000>] ( (null))
+---[ end trace 0506a2f5dae6b341 ]---
+ftrace failed to modify
+[<c000c350>] perf_trace_sys_exit+0x5c/0xe8
+ actual: 1e:ff:2f:e1
+Initializing ftrace call sites
+ftrace record flags: 0
+ (0)
+ expected tramp: c000fb24
+
+The analysis for this problem has been already performed previously,
+refer to the link below.
+
+Fix the above problems by allowing only selected reloc types in
+__mcount_loc. The list itself comes from the legacy recordmcount.pl
+script.
+
+Link: https://lore.kernel.org/lkml/56961010.6000806@pengutronix.de/
+Cc: stable@vger.kernel.org
+Fixes: ed60453fa8f8 ("ARM: 6511/1: ftrace: add ARM support for C version of recordmcount")
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/recordmcount.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -39,6 +39,10 @@
+ #define R_AARCH64_ABS64 257
+ #endif
+
++#define R_ARM_PC24 1
++#define R_ARM_THM_CALL 10
++#define R_ARM_CALL 28
++
+ static int fd_map; /* File descriptor for file being modified. */
+ static int mmap_failed; /* Boolean flag. */
+ static char gpfx; /* prefix for global symbol name (sometimes '_') */
+@@ -414,6 +418,18 @@ is_mcounted_section_name(char const *con
+ #define RECORD_MCOUNT_64
+ #include "recordmcount.h"
+
++static int arm_is_fake_mcount(Elf32_Rel const *rp)
++{
++ switch (ELF32_R_TYPE(w(rp->r_info))) {
++ case R_ARM_THM_CALL:
++ case R_ARM_CALL:
++ case R_ARM_PC24:
++ return 0;
++ }
++
++ return 1;
++}
++
+ /* 64-bit EM_MIPS has weird ELF64_Rela.r_info.
+ * http://techpubs.sgi.com/library/manuals/4000/007-4658-001/pdf/007-4658-001.pdf
+ * We interpret Table 29 Relocation Operation (Elf64_Rel, Elf64_Rela) [p.40]
+@@ -515,6 +531,7 @@ do_file(char const *const fname)
+ altmcount = "__gnu_mcount_nc";
+ make_nop = make_nop_arm;
+ rel_type_nop = R_ARM_NONE;
++ is_fake_mcount32 = arm_is_fake_mcount;
+ break;
+ case EM_AARCH64:
+ reltype = R_AARCH64_ABS64;
--- /dev/null
+From de19055564c8f8f9d366f8db3395836da0b2176c Mon Sep 17 00:00:00 2001
+From: Jeremy Linton <jeremy.linton@arm.com>
+Date: Fri, 25 Jan 2019 12:07:00 -0600
+Subject: Documentation: Document arm64 kpti control
+
+From: Jeremy Linton <jeremy.linton@arm.com>
+
+commit de19055564c8f8f9d366f8db3395836da0b2176c upstream.
+
+For a while Arm64 has been capable of force enabling
+or disabling the kpti mitigations. Lets make sure the
+documentation reflects that.
+
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Reviewed-by: Andre Przywara <andre.przywara@arm.com>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/admin-guide/kernel-parameters.txt | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1946,6 +1946,12 @@
+ Built with CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF=y,
+ the default is off.
+
++ kpti= [ARM64] Control page table isolation of user
++ and kernel address spaces.
++ Default: enabled on cores which need mitigation.
++ 0: force disabled
++ 1: force enabled
++
+ kvm.ignore_msrs=[KVM] Ignore guest accesses to unhandled MSRs.
+ Default is 0 (don't ignore, but inject #GP)
+
--- /dev/null
+From cf3ca1877574a306c0207cbf7fdf25419d9229df Mon Sep 17 00:00:00 2001
+From: Luuk Paulussen <luuk.paulussen@alliedtelesis.co.nz>
+Date: Fri, 6 Dec 2019 12:16:59 +1300
+Subject: hwmon: (adt7475) Make volt2reg return same reg as reg2volt input
+
+From: Luuk Paulussen <luuk.paulussen@alliedtelesis.co.nz>
+
+commit cf3ca1877574a306c0207cbf7fdf25419d9229df upstream.
+
+reg2volt returns the voltage that matches a given register value.
+Converting this back the other way with volt2reg didn't return the same
+register value because it used truncation instead of rounding.
+
+This meant that values read from sysfs could not be written back to sysfs
+to set back the same register value.
+
+With this change, volt2reg will return the same value for every voltage
+previously returned by reg2volt (for the set of possible input values)
+
+Signed-off-by: Luuk Paulussen <luuk.paulussen@alliedtelesis.co.nz>
+Link: https://lore.kernel.org/r/20191205231659.1301-1-luuk.paulussen@alliedtelesis.co.nz
+cc: stable@vger.kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/adt7475.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/adt7475.c
++++ b/drivers/hwmon/adt7475.c
+@@ -296,9 +296,10 @@ static inline u16 volt2reg(int channel,
+ long reg;
+
+ if (bypass_attn & (1 << channel))
+- reg = (volt * 1024) / 2250;
++ reg = DIV_ROUND_CLOSEST(volt * 1024, 2250);
+ else
+- reg = (volt * r[1] * 1024) / ((r[0] + r[1]) * 2250);
++ reg = DIV_ROUND_CLOSEST(volt * r[1] * 1024,
++ (r[0] + r[1]) * 2250);
+ return clamp_val(reg, 0, 1023) & (0xff << 2);
+ }
+
--- /dev/null
+From 3bf8bdcf3bada771eb12b57f2a30caee69e8ab8d Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 16 Jan 2020 10:44:17 -0800
+Subject: hwmon: (core) Do not use device managed functions for memory allocations
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 3bf8bdcf3bada771eb12b57f2a30caee69e8ab8d upstream.
+
+The hwmon core uses device managed functions, tied to the hwmon parent
+device, for various internal memory allocations. This is problematic
+since hwmon device lifetime does not necessarily match its parent's
+device lifetime. If there is a mismatch, memory leaks will accumulate
+until the parent device is released.
+
+Fix the problem by managing all memory allocations internally. The only
+exception is memory allocation for thermal device registration, which
+can be tied to the hwmon device, along with thermal device registration
+itself.
+
+Fixes: d560168b5d0f ("hwmon: (core) New hwmon registration API")
+Cc: stable@vger.kernel.org # v4.14.x: 47c332deb8e8: hwmon: Deal with errors from the thermal subsystem
+Cc: stable@vger.kernel.org # v4.14.x: 74e3512731bd: hwmon: (core) Fix double-free in __hwmon_device_register()
+Cc: stable@vger.kernel.org # v4.9.x: 3a412d5e4a1c: hwmon: (core) Simplify sysfs attribute name allocation
+Cc: stable@vger.kernel.org # v4.9.x: 47c332deb8e8: hwmon: Deal with errors from the thermal subsystem
+Cc: stable@vger.kernel.org # v4.9.x: 74e3512731bd: hwmon: (core) Fix double-free in __hwmon_device_register()
+Cc: stable@vger.kernel.org # v4.9+
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/hwmon.c | 68 ++++++++++++++++++++++++++++++--------------------
+ 1 file changed, 41 insertions(+), 27 deletions(-)
+
+--- a/drivers/hwmon/hwmon.c
++++ b/drivers/hwmon/hwmon.c
+@@ -51,6 +51,7 @@ struct hwmon_device_attribute {
+
+ #define to_hwmon_attr(d) \
+ container_of(d, struct hwmon_device_attribute, dev_attr)
++#define to_dev_attr(a) container_of(a, struct device_attribute, attr)
+
+ /*
+ * Thermal zone information
+@@ -58,7 +59,7 @@ struct hwmon_device_attribute {
+ * also provides the sensor index.
+ */
+ struct hwmon_thermal_data {
+- struct hwmon_device *hwdev; /* Reference to hwmon device */
++ struct device *dev; /* Reference to hwmon device */
+ int index; /* sensor index */
+ };
+
+@@ -95,9 +96,27 @@ static const struct attribute_group *hwm
+ NULL
+ };
+
++static void hwmon_free_attrs(struct attribute **attrs)
++{
++ int i;
++
++ for (i = 0; attrs[i]; i++) {
++ struct device_attribute *dattr = to_dev_attr(attrs[i]);
++ struct hwmon_device_attribute *hattr = to_hwmon_attr(dattr);
++
++ kfree(hattr);
++ }
++ kfree(attrs);
++}
++
+ static void hwmon_dev_release(struct device *dev)
+ {
+- kfree(to_hwmon_device(dev));
++ struct hwmon_device *hwdev = to_hwmon_device(dev);
++
++ if (hwdev->group.attrs)
++ hwmon_free_attrs(hwdev->group.attrs);
++ kfree(hwdev->groups);
++ kfree(hwdev);
+ }
+
+ static struct class hwmon_class = {
+@@ -121,11 +140,11 @@ static DEFINE_IDA(hwmon_ida);
+ static int hwmon_thermal_get_temp(void *data, int *temp)
+ {
+ struct hwmon_thermal_data *tdata = data;
+- struct hwmon_device *hwdev = tdata->hwdev;
++ struct hwmon_device *hwdev = to_hwmon_device(tdata->dev);
+ int ret;
+ long t;
+
+- ret = hwdev->chip->ops->read(&hwdev->dev, hwmon_temp, hwmon_temp_input,
++ ret = hwdev->chip->ops->read(tdata->dev, hwmon_temp, hwmon_temp_input,
+ tdata->index, &t);
+ if (ret < 0)
+ return ret;
+@@ -139,8 +158,7 @@ static const struct thermal_zone_of_devi
+ .get_temp = hwmon_thermal_get_temp,
+ };
+
+-static int hwmon_thermal_add_sensor(struct device *dev,
+- struct hwmon_device *hwdev, int index)
++static int hwmon_thermal_add_sensor(struct device *dev, int index)
+ {
+ struct hwmon_thermal_data *tdata;
+ struct thermal_zone_device *tzd;
+@@ -149,10 +167,10 @@ static int hwmon_thermal_add_sensor(stru
+ if (!tdata)
+ return -ENOMEM;
+
+- tdata->hwdev = hwdev;
++ tdata->dev = dev;
+ tdata->index = index;
+
+- tzd = devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata,
++ tzd = devm_thermal_zone_of_sensor_register(dev, index, tdata,
+ &hwmon_thermal_ops);
+ /*
+ * If CONFIG_THERMAL_OF is disabled, this returns -ENODEV,
+@@ -164,8 +182,7 @@ static int hwmon_thermal_add_sensor(stru
+ return 0;
+ }
+ #else
+-static int hwmon_thermal_add_sensor(struct device *dev,
+- struct hwmon_device *hwdev, int index)
++static int hwmon_thermal_add_sensor(struct device *dev, int index)
+ {
+ return 0;
+ }
+@@ -242,8 +259,7 @@ static bool is_string_attr(enum hwmon_se
+ (type == hwmon_fan && attr == hwmon_fan_label);
+ }
+
+-static struct attribute *hwmon_genattr(struct device *dev,
+- const void *drvdata,
++static struct attribute *hwmon_genattr(const void *drvdata,
+ enum hwmon_sensor_types type,
+ u32 attr,
+ int index,
+@@ -271,7 +287,7 @@ static struct attribute *hwmon_genattr(s
+ if ((mode & S_IWUGO) && !ops->write)
+ return ERR_PTR(-EINVAL);
+
+- hattr = devm_kzalloc(dev, sizeof(*hattr), GFP_KERNEL);
++ hattr = kzalloc(sizeof(*hattr), GFP_KERNEL);
+ if (!hattr)
+ return ERR_PTR(-ENOMEM);
+
+@@ -478,8 +494,7 @@ static int hwmon_num_channel_attrs(const
+ return n;
+ }
+
+-static int hwmon_genattrs(struct device *dev,
+- const void *drvdata,
++static int hwmon_genattrs(const void *drvdata,
+ struct attribute **attrs,
+ const struct hwmon_ops *ops,
+ const struct hwmon_channel_info *info)
+@@ -505,7 +520,7 @@ static int hwmon_genattrs(struct device
+ attr_mask &= ~BIT(attr);
+ if (attr >= template_size)
+ return -EINVAL;
+- a = hwmon_genattr(dev, drvdata, info->type, attr, i,
++ a = hwmon_genattr(drvdata, info->type, attr, i,
+ templates[attr], ops);
+ if (IS_ERR(a)) {
+ if (PTR_ERR(a) != -ENOENT)
+@@ -519,8 +534,7 @@ static int hwmon_genattrs(struct device
+ }
+
+ static struct attribute **
+-__hwmon_create_attrs(struct device *dev, const void *drvdata,
+- const struct hwmon_chip_info *chip)
++__hwmon_create_attrs(const void *drvdata, const struct hwmon_chip_info *chip)
+ {
+ int ret, i, aindex = 0, nattrs = 0;
+ struct attribute **attrs;
+@@ -531,15 +545,17 @@ __hwmon_create_attrs(struct device *dev,
+ if (nattrs == 0)
+ return ERR_PTR(-EINVAL);
+
+- attrs = devm_kcalloc(dev, nattrs + 1, sizeof(*attrs), GFP_KERNEL);
++ attrs = kcalloc(nattrs + 1, sizeof(*attrs), GFP_KERNEL);
+ if (!attrs)
+ return ERR_PTR(-ENOMEM);
+
+ for (i = 0; chip->info[i]; i++) {
+- ret = hwmon_genattrs(dev, drvdata, &attrs[aindex], chip->ops,
++ ret = hwmon_genattrs(drvdata, &attrs[aindex], chip->ops,
+ chip->info[i]);
+- if (ret < 0)
++ if (ret < 0) {
++ hwmon_free_attrs(attrs);
+ return ERR_PTR(ret);
++ }
+ aindex += ret;
+ }
+
+@@ -581,14 +597,13 @@ __hwmon_device_register(struct device *d
+ for (i = 0; groups[i]; i++)
+ ngroups++;
+
+- hwdev->groups = devm_kcalloc(dev, ngroups, sizeof(*groups),
+- GFP_KERNEL);
++ hwdev->groups = kcalloc(ngroups, sizeof(*groups), GFP_KERNEL);
+ if (!hwdev->groups) {
+ err = -ENOMEM;
+ goto free_hwmon;
+ }
+
+- attrs = __hwmon_create_attrs(dev, drvdata, chip);
++ attrs = __hwmon_create_attrs(drvdata, chip);
+ if (IS_ERR(attrs)) {
+ err = PTR_ERR(attrs);
+ goto free_hwmon;
+@@ -633,8 +648,7 @@ __hwmon_device_register(struct device *d
+ hwmon_temp_input, j))
+ continue;
+ if (info[i]->config[j] & HWMON_T_INPUT) {
+- err = hwmon_thermal_add_sensor(dev,
+- hwdev, j);
++ err = hwmon_thermal_add_sensor(hdev, j);
+ if (err) {
+ device_unregister(hdev);
+ goto ida_remove;
+@@ -647,7 +661,7 @@ __hwmon_device_register(struct device *d
+ return hdev;
+
+ free_hwmon:
+- kfree(hwdev);
++ hwmon_dev_release(hdev);
+ ida_remove:
+ ida_simple_remove(&hwmon_ida, id);
+ return ERR_PTR(err);
--- /dev/null
+From ba9a103f40fc4a3ec7558ec9b0b97d4f92034249 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 13 Jan 2020 10:38:57 -0800
+Subject: Input: keyspan-remote - fix control-message timeouts
+
+From: Johan Hovold <johan@kernel.org>
+
+commit ba9a103f40fc4a3ec7558ec9b0b97d4f92034249 upstream.
+
+The driver was issuing synchronous uninterruptible control requests
+without using a timeout. This could lead to the driver hanging on probe
+due to a malfunctioning (or malicious) device until the device is
+physically disconnected. While sleeping in probe the driver prevents
+other devices connected to the same hub from being added to (or removed
+from) the bus.
+
+The USB upper limit of five seconds per request should be more than
+enough.
+
+Fixes: 99f83c9c9ac9 ("[PATCH] USB: add driver for Keyspan Digital Remote")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: stable <stable@vger.kernel.org> # 2.6.13
+Link: https://lore.kernel.org/r/20200113171715.30621-1-johan@kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/misc/keyspan_remote.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/input/misc/keyspan_remote.c
++++ b/drivers/input/misc/keyspan_remote.c
+@@ -339,7 +339,8 @@ static int keyspan_setup(struct usb_devi
+ int retval = 0;
+
+ retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+- 0x11, 0x40, 0x5601, 0x0, NULL, 0, 0);
++ 0x11, 0x40, 0x5601, 0x0, NULL, 0,
++ USB_CTRL_SET_TIMEOUT);
+ if (retval) {
+ dev_dbg(&dev->dev, "%s - failed to set bit rate due to error: %d\n",
+ __func__, retval);
+@@ -347,7 +348,8 @@ static int keyspan_setup(struct usb_devi
+ }
+
+ retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+- 0x44, 0x40, 0x0, 0x0, NULL, 0, 0);
++ 0x44, 0x40, 0x0, 0x0, NULL, 0,
++ USB_CTRL_SET_TIMEOUT);
+ if (retval) {
+ dev_dbg(&dev->dev, "%s - failed to set resume sensitivity due to error: %d\n",
+ __func__, retval);
+@@ -355,7 +357,8 @@ static int keyspan_setup(struct usb_devi
+ }
+
+ retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+- 0x22, 0x40, 0x0, 0x0, NULL, 0, 0);
++ 0x22, 0x40, 0x0, 0x0, NULL, 0,
++ USB_CTRL_SET_TIMEOUT);
+ if (retval) {
+ dev_dbg(&dev->dev, "%s - failed to turn receive on due to error: %d\n",
+ __func__, retval);
--- /dev/null
+From 2a187d03352086e300daa2044051db00044cd171 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Wed, 15 Jan 2020 10:54:35 +0100
+Subject: mmc: sdhci: fix minimum clock rate for v3 controller
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit 2a187d03352086e300daa2044051db00044cd171 upstream.
+
+For SDHCIv3+ with programmable clock mode, minimal clock frequency is
+still base clock / max(divider). Minimal programmable clock frequency is
+always greater than minimal divided clock frequency. Without this patch,
+SDHCI uses out-of-spec initial frequency when multiplier is big enough:
+
+mmc1: mmc_rescan_try_freq: trying to init card at 468750 Hz
+[for 480 MHz source clock divided by 1024]
+
+The code in sdhci_calc_clk() already chooses a correct SDCLK clock mode.
+
+Fixes: c3ed3877625f ("mmc: sdhci: add support for programmable clock mode")
+Cc: <stable@vger.kernel.org> # 4f6aa3264af4: mmc: tegra: Only advertise UHS modes if IO regulator is present
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/ffb489519a446caffe7a0a05c4b9372bd52397bb.1579082031.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3700,11 +3700,13 @@ int sdhci_setup_host(struct sdhci_host *
+ if (host->ops->get_min_clock)
+ mmc->f_min = host->ops->get_min_clock(host);
+ else if (host->version >= SDHCI_SPEC_300) {
+- if (host->clk_mul) {
+- mmc->f_min = (host->max_clk * host->clk_mul) / 1024;
++ if (host->clk_mul)
+ max_clk = host->max_clk * host->clk_mul;
+- } else
+- mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
++ /*
++ * Divided Clock Mode minimum clock rate is always less than
++ * Programmable Clock Mode minimum clock rate.
++ */
++ mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
+ } else
+ mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_200;
+
--- /dev/null
+From f571389c0b015e76f91c697c4c1700aba860d34f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Tue, 7 Jan 2020 10:47:34 +0100
+Subject: mmc: tegra: fix SDR50 tuning override
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit f571389c0b015e76f91c697c4c1700aba860d34f upstream.
+
+Commit 7ad2ed1dfcbe inadvertently mixed up a quirk flag's name and
+broke SDR50 tuning override. Use correct NVQUIRK_ name.
+
+Fixes: 7ad2ed1dfcbe ("mmc: tegra: enable UHS-I modes")
+Cc: <stable@vger.kernel.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Thierry Reding <treding@nvidia.com>
+Tested-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Link: https://lore.kernel.org/r/9aff1d859935e59edd81e4939e40d6c55e0b55f6.1578390388.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -177,7 +177,7 @@ static void tegra_sdhci_reset(struct sdh
+ misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_DDR50;
+ if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR104)
+ misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR104;
+- if (soc_data->nvquirks & SDHCI_MISC_CTRL_ENABLE_SDR50)
++ if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR50)
+ clk_ctrl |= SDHCI_CLOCK_CTRL_SDR50_TUNING_OVERRIDE;
+ }
+
--- /dev/null
+From 5e89cd303e3a4505752952259b9f1ba036632544 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 14 Jan 2020 17:09:28 -0600
+Subject: PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 5e89cd303e3a4505752952259b9f1ba036632544 upstream.
+
+To account for parts of the chip that are "harvested" (disabled) due to
+silicon flaws, caches on some AMD GPUs must be initialized before ATS is
+enabled.
+
+ATS is normally enabled by the IOMMU driver before the GPU driver loads, so
+this cache initialization would have to be done in a quirk, but that's too
+complex to be practical.
+
+For Navi14 (device ID 0x7340), this initialization is done by the VBIOS,
+but apparently some boards went to production with an older VBIOS that
+doesn't do it. Disable ATS for those boards.
+
+Link: https://lore.kernel.org/r/20200114205523.1054271-3-alexander.deucher@amd.com
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/1015
+See-also: d28ca864c493 ("PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken")
+See-also: 9b44b0b09dec ("PCI: Mark AMD Stoney GPU ATS as broken")
+[bhelgaas: squash into one patch, simplify slightly, commit log]
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/quirks.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4891,18 +4891,25 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SE
+
+ #ifdef CONFIG_PCI_ATS
+ /*
+- * Some devices have a broken ATS implementation causing IOMMU stalls.
+- * Don't use ATS for those devices.
++ * Some devices require additional driver setup to enable ATS. Don't use
++ * ATS for those devices as ATS will be enabled before the driver has had a
++ * chance to load and configure the device.
+ */
+-static void quirk_no_ats(struct pci_dev *pdev)
++static void quirk_amd_harvest_no_ats(struct pci_dev *pdev)
+ {
+- pci_info(pdev, "disabling ATS (broken on this device)\n");
++ if (pdev->device == 0x7340 && pdev->revision != 0xc5)
++ return;
++
++ pci_info(pdev, "disabling ATS\n");
+ pdev->ats_cap = 0;
+ }
+
+ /* AMD Stoney platform GPU */
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_no_ats);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_no_ats);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_amd_harvest_no_ats);
++/* AMD Iceland dGPU */
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_amd_harvest_no_ats);
++/* AMD Navi14 dGPU */
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7340, quirk_amd_harvest_no_ats);
+ #endif /* CONFIG_PCI_ATS */
+
+ /* Freescale PCIe doesn't support MSI in RC mode */
--- /dev/null
+From 8ff771f8c8d55d95f102cf88a970e541a8bd6bcf Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Date: Thu, 16 Jan 2020 20:12:27 -0800
+Subject: Revert "Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers"
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+commit 8ff771f8c8d55d95f102cf88a970e541a8bd6bcf upstream.
+
+This reverts commit a284e11c371e446371675668d8c8120a27227339.
+
+This causes problems (drifting cursor) with at least the F11 function that
+reads more than 32 bytes.
+
+The real issue is in the F54 driver, and so this should be fixed there, and
+not in rmi_smbus.c.
+
+So first revert this bad commit, then fix the real problem in F54 in another
+patch.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: Timo Kaufmann <timokau@zoho.com>
+Fixes: a284e11c371e ("Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200115124819.3191024-2-hverkuil-cisco@xs4all.nl
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/rmi4/rmi_smbus.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/input/rmi4/rmi_smbus.c
++++ b/drivers/input/rmi4/rmi_smbus.c
+@@ -166,6 +166,7 @@ static int rmi_smb_write_block(struct rm
+ /* prepare to write next block of bytes */
+ cur_len -= SMB_MAX_COUNT;
+ databuff += SMB_MAX_COUNT;
++ rmiaddr += SMB_MAX_COUNT;
+ }
+ exit:
+ mutex_unlock(&rmi_smb->page_mutex);
+@@ -217,6 +218,7 @@ static int rmi_smb_read_block(struct rmi
+ /* prepare to read next block of bytes */
+ cur_len -= SMB_MAX_COUNT;
+ databuff += SMB_MAX_COUNT;
++ rmiaddr += SMB_MAX_COUNT;
+ }
+
+ retval = 0;
tcp_bbr-improve-arithmetic-division-in-bbr_update_bw.patch
tcp-do-not-leave-dangling-pointers-in-tp-highest_sack.patch
tun-add-mutex_unlock-call-and-napi.skb-clearing-in-tun_get_user.patch
+afs-fix-characters-allowed-into-cell-names.patch
+hwmon-adt7475-make-volt2reg-return-same-reg-as-reg2volt-input.patch
+hwmon-core-do-not-use-device-managed-functions-for-memory-allocations.patch
+pci-mark-amd-navi14-gpu-rev-0xc5-ats-as-broken.patch
+tracing-trigger-replace-unneeded-rcu-list-traversals.patch
+input-keyspan-remote-fix-control-message-timeouts.patch
+revert-input-synaptics-rmi4-don-t-increment-rmiaddr-for-smbus-transfers.patch
+arm-8950-1-ftrace-recordmcount-filter-relocation-types.patch
+mmc-tegra-fix-sdr50-tuning-override.patch
+mmc-sdhci-fix-minimum-clock-rate-for-v3-controller.patch
+documentation-document-arm64-kpti-control.patch
--- /dev/null
+From aeed8aa3874dc15b9d82a6fe796fd7cfbb684448 Mon Sep 17 00:00:00 2001
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Fri, 20 Dec 2019 11:31:43 +0900
+Subject: tracing: trigger: Replace unneeded RCU-list traversals
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+commit aeed8aa3874dc15b9d82a6fe796fd7cfbb684448 upstream.
+
+With CONFIG_PROVE_RCU_LIST, I had many suspicious RCU warnings
+when I ran ftracetest trigger testcases.
+
+-----
+ # dmesg -c > /dev/null
+ # ./ftracetest test.d/trigger
+ ...
+ # dmesg | grep "RCU-list traversed" | cut -f 2 -d ] | cut -f 2 -d " "
+ kernel/trace/trace_events_hist.c:6070
+ kernel/trace/trace_events_hist.c:1760
+ kernel/trace/trace_events_hist.c:5911
+ kernel/trace/trace_events_trigger.c:504
+ kernel/trace/trace_events_hist.c:1810
+ kernel/trace/trace_events_hist.c:3158
+ kernel/trace/trace_events_hist.c:3105
+ kernel/trace/trace_events_hist.c:5518
+ kernel/trace/trace_events_hist.c:5998
+ kernel/trace/trace_events_hist.c:6019
+ kernel/trace/trace_events_hist.c:6044
+ kernel/trace/trace_events_trigger.c:1500
+ kernel/trace/trace_events_trigger.c:1540
+ kernel/trace/trace_events_trigger.c:539
+ kernel/trace/trace_events_trigger.c:584
+-----
+
+I investigated those warnings and found that the RCU-list
+traversals in event trigger and hist didn't need to use
+RCU version because those were called only under event_mutex.
+
+I also checked other RCU-list traversals related to event
+trigger list, and found that most of them were called from
+event_hist_trigger_func() or hist_unregister_trigger() or
+register/unregister functions except for a few cases.
+
+Replace these unneeded RCU-list traversals with normal list
+traversal macro and lockdep_assert_held() to check the
+event_mutex is held.
+
+Link: http://lkml.kernel.org/r/157680910305.11685.15110237954275915782.stgit@devnote2
+
+Cc: stable@vger.kernel.org
+Fixes: 30350d65ac567 ("tracing: Add variable support to hist triggers")
+Reviewed-by: Tom Zanussi <zanussi@kernel.org>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ kernel/trace/trace_events_hist.c | 38 ++++++++++++++++++++++++++----------
+ kernel/trace/trace_events_trigger.c | 20 ++++++++++++++----
+ 2 files changed, 43 insertions(+), 15 deletions(-)
+
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -1511,11 +1511,13 @@ static struct hist_field *find_var(struc
+ struct event_trigger_data *test;
+ struct hist_field *hist_field;
+
++ lockdep_assert_held(&event_mutex);
++
+ hist_field = find_var_field(hist_data, var_name);
+ if (hist_field)
+ return hist_field;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ test_data = test->private_data;
+ hist_field = find_var_field(test_data, var_name);
+@@ -1565,7 +1567,9 @@ static struct hist_field *find_file_var(
+ struct event_trigger_data *test;
+ struct hist_field *hist_field;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ test_data = test->private_data;
+ hist_field = find_var_field(test_data, var_name);
+@@ -2828,7 +2832,9 @@ static char *find_trigger_filter(struct
+ {
+ struct event_trigger_data *test;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ if (test->private_data == hist_data)
+ return test->filter_str;
+@@ -2879,9 +2885,11 @@ find_compatible_hist(struct hist_trigger
+ struct event_trigger_data *test;
+ unsigned int n_keys;
+
++ lockdep_assert_held(&event_mutex);
++
+ n_keys = target_hist_data->n_fields - target_hist_data->n_vals;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ hist_data = test->private_data;
+
+@@ -4905,7 +4913,7 @@ static int hist_show(struct seq_file *m,
+ goto out_unlock;
+ }
+
+- list_for_each_entry_rcu(data, &event_file->triggers, list) {
++ list_for_each_entry(data, &event_file->triggers, list) {
+ if (data->cmd_ops->trigger_type == ETT_EVENT_HIST)
+ hist_trigger_show(m, data, n++);
+ }
+@@ -5296,7 +5304,9 @@ static int hist_register_trigger(char *g
+ if (hist_data->attrs->name && !named_data)
+ goto new;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ if (!hist_trigger_match(data, test, named_data, false))
+ continue;
+@@ -5380,10 +5390,12 @@ static bool have_hist_trigger_match(stru
+ struct event_trigger_data *test, *named_data = NULL;
+ bool match = false;
+
++ lockdep_assert_held(&event_mutex);
++
+ if (hist_data->attrs->name)
+ named_data = find_named_trigger(hist_data->attrs->name);
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ if (hist_trigger_match(data, test, named_data, false)) {
+ match = true;
+@@ -5401,10 +5413,12 @@ static bool hist_trigger_check_refs(stru
+ struct hist_trigger_data *hist_data = data->private_data;
+ struct event_trigger_data *test, *named_data = NULL;
+
++ lockdep_assert_held(&event_mutex);
++
+ if (hist_data->attrs->name)
+ named_data = find_named_trigger(hist_data->attrs->name);
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ if (!hist_trigger_match(data, test, named_data, false))
+ continue;
+@@ -5426,10 +5440,12 @@ static void hist_unregister_trigger(char
+ struct event_trigger_data *test, *named_data = NULL;
+ bool unregistered = false;
+
++ lockdep_assert_held(&event_mutex);
++
+ if (hist_data->attrs->name)
+ named_data = find_named_trigger(hist_data->attrs->name);
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ if (!hist_trigger_match(data, test, named_data, false))
+ continue;
+@@ -5455,7 +5471,9 @@ static bool hist_file_check_refs(struct
+ struct hist_trigger_data *hist_data;
+ struct event_trigger_data *test;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ hist_data = test->private_data;
+ if (check_var_refs(hist_data))
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -495,7 +495,9 @@ void update_cond_flag(struct trace_event
+ struct event_trigger_data *data;
+ bool set_cond = false;
+
+- list_for_each_entry_rcu(data, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(data, &file->triggers, list) {
+ if (data->filter || event_command_post_trigger(data->cmd_ops) ||
+ event_command_needs_rec(data->cmd_ops)) {
+ set_cond = true;
+@@ -530,7 +532,9 @@ static int register_trigger(char *glob,
+ struct event_trigger_data *test;
+ int ret = 0;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == data->cmd_ops->trigger_type) {
+ ret = -EEXIST;
+ goto out;
+@@ -575,7 +579,9 @@ static void unregister_trigger(char *glo
+ struct event_trigger_data *data;
+ bool unregistered = false;
+
+- list_for_each_entry_rcu(data, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(data, &file->triggers, list) {
+ if (data->cmd_ops->trigger_type == test->cmd_ops->trigger_type) {
+ unregistered = true;
+ list_del_rcu(&data->list);
+@@ -1490,7 +1496,9 @@ int event_enable_register_trigger(char *
+ struct event_trigger_data *test;
+ int ret = 0;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(test, &file->triggers, list) {
+ test_enable_data = test->private_data;
+ if (test_enable_data &&
+ (test->cmd_ops->trigger_type ==
+@@ -1530,7 +1538,9 @@ void event_enable_unregister_trigger(cha
+ struct event_trigger_data *data;
+ bool unregistered = false;
+
+- list_for_each_entry_rcu(data, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(data, &file->triggers, list) {
+ enable_data = data->private_data;
+ if (enable_data &&
+ (data->cmd_ops->trigger_type ==
projects / thirdparty / kernel / stable-queue.git / commitdiff
