--- /dev/null
+From 9517949d20001f246cd52f5c4ad20ce6925132a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 22:13:40 -0700
+Subject: arm64: Add missing sentinel to erratum_1463225
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 09c717c92b52df54918e12cbfe6a4658233fda69 ]
+
+When the erratum_1463225 array was introduced a sentinel at the end was
+missing thus causing a KASAN: global-out-of-bounds in
+is_affected_midr_range_list on arm64 error.
+
+Fixes: a9e821b89daa ("arm64: Add KRYO4XX gold CPU cores to erratum list 1463225 and 1418040")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Link: https://lore.kernel.org/linux-arm-kernel/CA+G9fYs3EavpU89-rTQfqQ9GgxAMgMAk7jiiVrfP0yxj5s+Q6g@mail.gmail.com/
+Link: https://lore.kernel.org/r/20200709051345.14544-1-f.fainelli@gmail.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/cpu_errata.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index dbf266212808e..f9387c1252325 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -778,6 +778,7 @@ static const struct midr_range erratum_1463225[] = {
+ MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 1),
+ /* Kryo4xx Gold (rcpe to rfpf) => (r0p0 to r3p1) */
+ MIDR_RANGE(MIDR_QCOM_KRYO_4XX_GOLD, 0xc, 0xe, 0xf, 0xf),
++ {},
+ };
+ #endif
+
+--
+2.25.1
+
--- /dev/null
+From e6c21a6d57983db1c775968b2e1de2b5bea7bbdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 09:00:45 +0200
+Subject: net: ethernet: mvneta: Add back interface mode validation
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit 41c2b6b4f0f807803bb49f65835d136941a70f85 ]
+
+When writing the serdes configuration register was moved to
+mvneta_config_interface() the whole code block was removed from
+mvneta_port_power_up() in the assumption that its only purpose was to
+write the serdes configuration register. As mentioned by Russell King
+its purpose was also to check for valid interface modes early so that
+later in the driver we do not have to care for unexpected interface
+modes.
+Add back the test to let the driver bail out early on unhandled
+interface modes.
+
+Fixes: b4748553f53f ("net: ethernet: mvneta: Fix Serdes configuration for SoCs without comphy")
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Reviewed-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 7faeb4bfc282e..b2da295e2fc01 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -5003,10 +5003,18 @@ static void mvneta_conf_mbus_windows(struct mvneta_port *pp,
+ }
+
+ /* Power up the port */
+-static void mvneta_port_power_up(struct mvneta_port *pp, int phy_mode)
++static int mvneta_port_power_up(struct mvneta_port *pp, int phy_mode)
+ {
+ /* MAC Cause register should be cleared */
+ mvreg_write(pp, MVNETA_UNIT_INTR_CAUSE, 0);
++
++ if (phy_mode != PHY_INTERFACE_MODE_QSGMII &&
++ phy_mode != PHY_INTERFACE_MODE_SGMII &&
++ !phy_interface_mode_is_8023z(phy_mode) &&
++ !phy_interface_mode_is_rgmii(phy_mode))
++ return -EINVAL;
++
++ return 0;
+ }
+
+ /* Device initialization routine */
+@@ -5192,7 +5200,11 @@ static int mvneta_probe(struct platform_device *pdev)
+ if (err < 0)
+ goto err_netdev;
+
+- mvneta_port_power_up(pp, phy_mode);
++ err = mvneta_port_power_up(pp, pp->phy_interface);
++ if (err < 0) {
++ dev_err(&pdev->dev, "can't power up port\n");
++ return err;
++ }
+
+ /* Armada3700 network controller does not support per-cpu
+ * operation, so only single NAPI should be initialized.
+@@ -5346,7 +5358,11 @@ static int mvneta_resume(struct device *device)
+ }
+ }
+ mvneta_defaults_set(pp);
+- mvneta_port_power_up(pp, pp->phy_interface);
++ err = mvneta_port_power_up(pp, pp->phy_interface);
++ if (err < 0) {
++ dev_err(device, "can't power up port\n");
++ return err;
++ }
+
+ netif_device_attach(dev);
+
+--
+2.25.1
+
--- /dev/null
+From 32915f5dfeb8f2ece6caa3b4a164b1210754008f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 09:00:44 +0200
+Subject: net: ethernet: mvneta: Do not error out in non serdes modes
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit d3d239dcb8aae6d7b10642d292b404e57604f7ea ]
+
+In mvneta_config_interface() the RGMII modes are catched by the default
+case which is an error return. The RGMII modes are valid modes for the
+driver, so instead of returning an error add a break statement to return
+successfully.
+
+This avoids this warning for non comphy SoCs which use RGMII, like
+SolidRun Clearfog:
+
+WARNING: CPU: 0 PID: 268 at drivers/net/ethernet/marvell/mvneta.c:3512 mvneta_start_dev+0x220/0x23c
+
+Fixes: b4748553f53f ("net: ethernet: mvneta: Fix Serdes configuration for SoCs without comphy")
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Reviewed-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index cf26cf4e47aa8..7faeb4bfc282e 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -3565,7 +3565,7 @@ static int mvneta_config_interface(struct mvneta_port *pp,
+ MVNETA_HSGMII_SERDES_PROTO);
+ break;
+ default:
+- return -EINVAL;
++ break;
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From af9cba6f742a9230a97408832ef83b2b3a86d004 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Apr 2020 11:20:13 +0100
+Subject: scsi: qla2xxx: make 1-bit bit-fields unsigned int
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 78b874b7cbf09fbfadfa5f18a347ebef7bbb49fe ]
+
+The bitfields mpi_fw_dump_reading and mpi_fw_dumped are currently signed
+which is not recommended as the representation is an implementation defined
+behaviour. Fix this by making the bit-fields unsigned ints.
+
+Link: https://lore.kernel.org/r/20200428102013.1040598-1-colin.king@canonical.com
+Fixes: cbb01c2f2f63 ("scsi: qla2xxx: Fix MPI failure AEN (8200) handling")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_def.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index daa9e936887bb..172ea4e5887d9 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -4248,8 +4248,8 @@ struct qla_hw_data {
+ int fw_dump_reading;
+ void *mpi_fw_dump;
+ u32 mpi_fw_dump_len;
+- int mpi_fw_dump_reading:1;
+- int mpi_fw_dumped:1;
++ unsigned int mpi_fw_dump_reading:1;
++ unsigned int mpi_fw_dumped:1;
+ int prev_minidump_failed;
+ dma_addr_t eft_dma;
+ void *eft;
+--
+2.25.1
+
iio-humidity-hts221-fix-alignment-and-data-leak-issues.patch
iio-pressure-ms5611-fix-buffer-element-alignment.patch
iio-health-afe4403-fix-timestamp-alignment-and-prevent-data-leak.patch
+arm64-add-missing-sentinel-to-erratum_1463225.patch
+xen-xenbus-fix-a-double-free-in-xenbus_map_ring_pv.patch
+net-ethernet-mvneta-do-not-error-out-in-non-serdes-m.patch
+net-ethernet-mvneta-add-back-interface-mode-validati.patch
+scsi-qla2xxx-make-1-bit-bit-fields-unsigned-int.patch
+spi-spi-fsl-dspi-fix-lockup-if-device-is-shutdown-du.patch
--- /dev/null
+From 11de8c48a1271655e6b14fcd3955ffc544a08645 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jun 2020 13:05:41 +0200
+Subject: spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI
+ transfer
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 3c525b69e8c1a9a6944e976603c7a1a713e728f9 ]
+
+During shutdown, the driver should unregister the SPI controller
+and stop the hardware. Otherwise the dspi_transfer_one_message() could
+wait on completion infinitely.
+
+Additionally, calling spi_unregister_controller() first in device
+shutdown reverse-matches the probe function, where SPI controller is
+registered at the end.
+
+Fixes: dc234825997e ("spi: spi-fsl-dspi: Adding shutdown hook")
+Reported-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200622110543.5035-2-krzk@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 15 +--------------
+ 1 file changed, 1 insertion(+), 14 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 38d337f0967db..e0b30e4b1b695 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -1461,20 +1461,7 @@ static int dspi_remove(struct platform_device *pdev)
+
+ static void dspi_shutdown(struct platform_device *pdev)
+ {
+- struct spi_controller *ctlr = platform_get_drvdata(pdev);
+- struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr);
+-
+- /* Disable RX and TX */
+- regmap_update_bits(dspi->regmap, SPI_MCR,
+- SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF,
+- SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF);
+-
+- /* Stop Running */
+- regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_HALT, SPI_MCR_HALT);
+-
+- dspi_release_dma(dspi);
+- clk_disable_unprepare(dspi->clk);
+- spi_unregister_controller(dspi->ctlr);
++ dspi_remove(pdev);
+ }
+
+ static struct platform_driver fsl_dspi_driver = {
+--
+2.25.1
+
--- /dev/null
+From bef4c9cfeda8f7a81ff11ab62053c8edbe9e52bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 14:36:10 +0300
+Subject: xen/xenbus: Fix a double free in xenbus_map_ring_pv()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ba8c423488974f02b538e9dc1730f0334f9b85aa ]
+
+When there is an error the caller frees "info->node" so the free here
+will result in a double free. We should just delete first kfree().
+
+Fixes: 3848e4e0a32a ("xen/xenbus: avoid large structs and arrays on the stack")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20200710113610.GA92345@mwanda
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_client.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
+index 4f168b46fbca5..786fbb7d8be06 100644
+--- a/drivers/xen/xenbus/xenbus_client.c
++++ b/drivers/xen/xenbus/xenbus_client.c
+@@ -693,10 +693,8 @@ static int xenbus_map_ring_pv(struct xenbus_device *dev,
+ bool leaked;
+
+ area = alloc_vm_area(XEN_PAGE_SIZE * nr_grefs, info->ptes);
+- if (!area) {
+- kfree(node);
++ if (!area)
+ return -ENOMEM;
+- }
+
+ for (i = 0; i < nr_grefs; i++)
+ info->phys_addrs[i] =
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
