--- /dev/null
+From ee2a098851bfbe8bcdd964c0121f4246f00ff41e Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@kernel.org>
+Date: Mon, 14 Mar 2022 11:20:41 -0700
+Subject: bpf: Adjust BPF stack helper functions to accommodate skip > 0
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+commit ee2a098851bfbe8bcdd964c0121f4246f00ff41e upstream.
+
+Let's say that the caller has storage for num_elem stack frames. Then,
+the BPF stack helper functions walk the stack for only num_elem frames.
+This means that if skip > 0, one keeps only 'num_elem - skip' frames.
+
+This is because it sets init_nr in the perf_callchain_entry to the end
+of the buffer to save num_elem entries only. I believe it was because
+the perf callchain code unwound the stack frames until it reached the
+global max size (sysctl_perf_event_max_stack).
+
+However it now has perf_callchain_entry_ctx.max_stack to limit the
+iteration locally. This simplifies the code to handle init_nr in the
+BPF callstack entries and removes the confusion with the perf_event's
+__PERF_SAMPLE_CALLCHAIN_EARLY which sets init_nr to 0.
+
+Also change the comment on bpf_get_stack() in the header file to be
+more explicit what the return value means.
+
+Fixes: c195651e565a ("bpf: add bpf_get_stack helper")
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/30a7b5d5-6726-1cc2-eaee-8da2828a9a9c@oracle.com
+Link: https://lore.kernel.org/bpf/20220314182042.71025-1-namhyung@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Based-on-patch-by: Eugene Loh <eugene.loh@oracle.com>
+---
+ include/uapi/linux/bpf.h | 8 +++---
+ kernel/bpf/stackmap.c | 56 ++++++++++++++++++++---------------------------
+ 2 files changed, 28 insertions(+), 36 deletions(-)
+
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -2975,8 +2975,8 @@ union bpf_attr {
+ *
+ * # sysctl kernel.perf_event_max_stack=<new value>
+ * Return
+- * A non-negative value equal to or less than *size* on success,
+- * or a negative error in case of failure.
++ * The non-negative copied *buf* length equal to or less than
++ * *size* on success, or a negative error in case of failure.
+ *
+ * long bpf_skb_load_bytes_relative(const void *skb, u32 offset, void *to, u32 len, u32 start_header)
+ * Description
+@@ -4279,8 +4279,8 @@ union bpf_attr {
+ *
+ * # sysctl kernel.perf_event_max_stack=<new value>
+ * Return
+- * A non-negative value equal to or less than *size* on success,
+- * or a negative error in case of failure.
++ * The non-negative copied *buf* length equal to or less than
++ * *size* on success, or a negative error in case of failure.
+ *
+ * long bpf_load_hdr_opt(struct bpf_sock_ops *skops, void *searchby_res, u32 len, u64 flags)
+ * Description
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -166,7 +166,7 @@ static void stack_map_get_build_id_offse
+ }
+
+ static struct perf_callchain_entry *
+-get_callchain_entry_for_task(struct task_struct *task, u32 init_nr)
++get_callchain_entry_for_task(struct task_struct *task, u32 max_depth)
+ {
+ #ifdef CONFIG_STACKTRACE
+ struct perf_callchain_entry *entry;
+@@ -177,9 +177,8 @@ get_callchain_entry_for_task(struct task
+ if (!entry)
+ return NULL;
+
+- entry->nr = init_nr +
+- stack_trace_save_tsk(task, (unsigned long *)(entry->ip + init_nr),
+- sysctl_perf_event_max_stack - init_nr, 0);
++ entry->nr = stack_trace_save_tsk(task, (unsigned long *)entry->ip,
++ max_depth, 0);
+
+ /* stack_trace_save_tsk() works on unsigned long array, while
+ * perf_callchain_entry uses u64 array. For 32-bit systems, it is
+@@ -191,7 +190,7 @@ get_callchain_entry_for_task(struct task
+ int i;
+
+ /* copy data from the end to avoid using extra buffer */
+- for (i = entry->nr - 1; i >= (int)init_nr; i--)
++ for (i = entry->nr - 1; i >= 0; i--)
+ to[i] = (u64)(from[i]);
+ }
+
+@@ -208,27 +207,19 @@ static long __bpf_get_stackid(struct bpf
+ {
+ struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map);
+ struct stack_map_bucket *bucket, *new_bucket, *old_bucket;
+- u32 max_depth = map->value_size / stack_map_data_size(map);
+- /* stack_map_alloc() checks that max_depth <= sysctl_perf_event_max_stack */
+- u32 init_nr = sysctl_perf_event_max_stack - max_depth;
+ u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+ u32 hash, id, trace_nr, trace_len;
+ bool user = flags & BPF_F_USER_STACK;
+ u64 *ips;
+ bool hash_matches;
+
+- /* get_perf_callchain() guarantees that trace->nr >= init_nr
+- * and trace-nr <= sysctl_perf_event_max_stack, so trace_nr <= max_depth
+- */
+- trace_nr = trace->nr - init_nr;
+-
+- if (trace_nr <= skip)
++ if (trace->nr <= skip)
+ /* skipping more than usable stack trace */
+ return -EFAULT;
+
+- trace_nr -= skip;
++ trace_nr = trace->nr - skip;
+ trace_len = trace_nr * sizeof(u64);
+- ips = trace->ip + skip + init_nr;
++ ips = trace->ip + skip;
+ hash = jhash2((u32 *)ips, trace_len / sizeof(u32), 0);
+ id = hash & (smap->n_buckets - 1);
+ bucket = READ_ONCE(smap->buckets[id]);
+@@ -285,8 +276,7 @@ BPF_CALL_3(bpf_get_stackid, struct pt_re
+ u64, flags)
+ {
+ u32 max_depth = map->value_size / stack_map_data_size(map);
+- /* stack_map_alloc() checks that max_depth <= sysctl_perf_event_max_stack */
+- u32 init_nr = sysctl_perf_event_max_stack - max_depth;
++ u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+ bool user = flags & BPF_F_USER_STACK;
+ struct perf_callchain_entry *trace;
+ bool kernel = !user;
+@@ -295,8 +285,12 @@ BPF_CALL_3(bpf_get_stackid, struct pt_re
+ BPF_F_FAST_STACK_CMP | BPF_F_REUSE_STACKID)))
+ return -EINVAL;
+
+- trace = get_perf_callchain(regs, init_nr, kernel, user,
+- sysctl_perf_event_max_stack, false, false);
++ max_depth += skip;
++ if (max_depth > sysctl_perf_event_max_stack)
++ max_depth = sysctl_perf_event_max_stack;
++
++ trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
++ false, false);
+
+ if (unlikely(!trace))
+ /* couldn't fetch the stack trace */
+@@ -387,7 +381,7 @@ static long __bpf_get_stack(struct pt_re
+ struct perf_callchain_entry *trace_in,
+ void *buf, u32 size, u64 flags)
+ {
+- u32 init_nr, trace_nr, copy_len, elem_size, num_elem;
++ u32 trace_nr, copy_len, elem_size, num_elem, max_depth;
+ bool user_build_id = flags & BPF_F_USER_BUILD_ID;
+ u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+ bool user = flags & BPF_F_USER_STACK;
+@@ -412,30 +406,28 @@ static long __bpf_get_stack(struct pt_re
+ goto err_fault;
+
+ num_elem = size / elem_size;
+- if (sysctl_perf_event_max_stack < num_elem)
+- init_nr = 0;
+- else
+- init_nr = sysctl_perf_event_max_stack - num_elem;
++ max_depth = num_elem + skip;
++ if (sysctl_perf_event_max_stack < max_depth)
++ max_depth = sysctl_perf_event_max_stack;
+
+ if (trace_in)
+ trace = trace_in;
+ else if (kernel && task)
+- trace = get_callchain_entry_for_task(task, init_nr);
++ trace = get_callchain_entry_for_task(task, max_depth);
+ else
+- trace = get_perf_callchain(regs, init_nr, kernel, user,
+- sysctl_perf_event_max_stack,
++ trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
+ false, false);
+ if (unlikely(!trace))
+ goto err_fault;
+
+- trace_nr = trace->nr - init_nr;
+- if (trace_nr < skip)
++ if (trace->nr < skip)
+ goto err_fault;
+
+- trace_nr -= skip;
++ trace_nr = trace->nr - skip;
+ trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem;
+ copy_len = trace_nr * elem_size;
+- ips = trace->ip + skip + init_nr;
++
++ ips = trace->ip + skip;
+ if (user && user_build_id)
+ stack_map_get_build_id_offset(buf, ips, trace_nr, user);
+ else
--- /dev/null
+From 58617014405ad5c9f94f464444f4972dabb71ca7 Mon Sep 17 00:00:00 2001
+From: Hengqi Chen <hengqi.chen@gmail.com>
+Date: Thu, 10 Mar 2022 23:53:35 +0800
+Subject: bpf: Fix comment for helper bpf_current_task_under_cgroup()
+
+From: Hengqi Chen <hengqi.chen@gmail.com>
+
+commit 58617014405ad5c9f94f464444f4972dabb71ca7 upstream.
+
+Fix the descriptions of the return values of helper bpf_current_task_under_cgroup().
+
+Fixes: c6b5fb8690fa ("bpf: add documentation for eBPF helpers (42-50)")
+Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20220310155335.1278783-1-hengqi.chen@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/uapi/linux/bpf.h | 4 ++--
+ tools/include/uapi/linux/bpf.h | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -2286,8 +2286,8 @@ union bpf_attr {
+ * Return
+ * The return value depends on the result of the test, and can be:
+ *
+- * * 0, if current task belongs to the cgroup2.
+- * * 1, if current task does not belong to the cgroup2.
++ * * 1, if current task belongs to the cgroup2.
++ * * 0, if current task does not belong to the cgroup2.
+ * * A negative error code, if an error occurred.
+ *
+ * long bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags)
+--- a/tools/include/uapi/linux/bpf.h
++++ b/tools/include/uapi/linux/bpf.h
+@@ -2286,8 +2286,8 @@ union bpf_attr {
+ * Return
+ * The return value depends on the result of the test, and can be:
+ *
+- * * 0, if current task belongs to the cgroup2.
+- * * 1, if current task does not belong to the cgroup2.
++ * * 1, if current task belongs to the cgroup2.
++ * * 0, if current task does not belong to the cgroup2.
+ * * A negative error code, if an error occurred.
+ *
+ * long bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags)
--- /dev/null
+From 996ebc0e332bfb3091395f9bd286d8349a57be62 Mon Sep 17 00:00:00 2001
+From: Yong Wu <yong.wu@mediatek.com>
+Date: Thu, 13 Jan 2022 19:10:53 +0800
+Subject: dt-bindings: memory: mtk-smi: Correct minItems to 2 for the gals clocks
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+commit 996ebc0e332bfb3091395f9bd286d8349a57be62 upstream.
+
+Mute the warning from "make dtbs_check":
+
+larb@14017000: clock-names: ['apb', 'smi'] is too short
+ arch/arm64/boot/dts/mediatek/mt8183-evb.dt.yaml
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dt.yaml
+ ...
+
+larb@16010000: clock-names: ['apb', 'smi'] is too short
+ arch/arm64/boot/dts/mediatek/mt8183-evb.dt.yaml
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dt.yaml
+
+larb@17010000: clock-names: ['apb', 'smi'] is too short
+ arch/arm64/boot/dts/mediatek/mt8183-evb.dt.yaml
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dt.yaml
+
+If a platform's larb supports gals, there will be some larbs have one
+more "gals" clock while the others still only need "apb"/"smi" clocks,
+then the minItems for clocks and clock-names are 2.
+
+Fixes: 27bb0e42855a ("dt-bindings: memory: mediatek: Convert SMI to DT schema")
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20220113111057.29918-4-yong.wu@mediatek.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml
++++ b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml
+@@ -80,9 +80,10 @@ allOf:
+ then:
+ properties:
+ clocks:
+- minItems: 3
++ minItems: 2
+ maxItems: 3
+ clock-names:
++ minItems: 2
+ items:
+ - const: apb
+ - const: smi
--- /dev/null
+From ddc3a324889686ec9b358de20fdeec0d2668c7a8 Mon Sep 17 00:00:00 2001
+From: Yong Wu <yong.wu@mediatek.com>
+Date: Thu, 13 Jan 2022 19:10:52 +0800
+Subject: dt-bindings: memory: mtk-smi: No need mediatek,larb-id for mt8167
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+commit ddc3a324889686ec9b358de20fdeec0d2668c7a8 upstream.
+
+Mute the warning from "make dtbs_check":
+
+larb@14016000: 'mediatek,larb-id' is a required property
+ arch/arm64/boot/dts/mediatek/mt8167-pumpkin.dt.yaml
+larb@15001000: 'mediatek,larb-id' is a required property
+ arch/arm64/boot/dts/mediatek/mt8167-pumpkin.dt.yaml
+larb@16010000: 'mediatek,larb-id' is a required property
+ arch/arm64/boot/dts/mediatek/mt8167-pumpkin.dt.yaml
+
+As the description of mediatek,larb-id, the property is only
+required when the larbid is not consecutive from its IOMMU point of view.
+
+Also, from the description of mediatek,larbs in
+Documentation/devicetree/bindings/iommu/mediatek,iommu.yaml, all the larbs
+must sort by the larb index.
+
+In mt8167, there is only one IOMMU HW and three larbs. The drivers already
+know its larb index from the mediatek,larbs property of IOMMU, thus no
+need this property.
+
+Fixes: 27bb0e42855a ("dt-bindings: memory: mediatek: Convert SMI to DT schema")
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Acked-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20220113111057.29918-3-yong.wu@mediatek.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml
++++ b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml
+@@ -106,7 +106,6 @@ allOf:
+ - mediatek,mt2701-smi-larb
+ - mediatek,mt2712-smi-larb
+ - mediatek,mt6779-smi-larb
+- - mediatek,mt8167-smi-larb
+ - mediatek,mt8192-smi-larb
+ - mediatek,mt8195-smi-larb
+
--- /dev/null
+From 5bf7fa48374eafe29dbb30448a0b0c083853583f Mon Sep 17 00:00:00 2001
+From: Yong Wu <yong.wu@mediatek.com>
+Date: Thu, 13 Jan 2022 19:10:51 +0800
+Subject: dt-bindings: memory: mtk-smi: Rename clock to clocks
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+commit 5bf7fa48374eafe29dbb30448a0b0c083853583f upstream.
+
+The property "clock" should be rename to "clocks", and delete the "items",
+the minItems/maxItems should not be put under "items".
+
+Fixes: 27bb0e42855a ("dt-bindings: memory: mediatek: Convert SMI to DT schema")
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Acked-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20220113111057.29918-2-yong.wu@mediatek.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml | 28 ++++------
+ Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml | 14 ++---
+ 2 files changed, 18 insertions(+), 24 deletions(-)
+
+--- a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml
++++ b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml
+@@ -88,10 +88,9 @@ allOf:
+ - mediatek,mt2701-smi-common
+ then:
+ properties:
+- clock:
+- items:
+- minItems: 3
+- maxItems: 3
++ clocks:
++ minItems: 3
++ maxItems: 3
+ clock-names:
+ items:
+ - const: apb
+@@ -108,10 +107,9 @@ allOf:
+ required:
+ - mediatek,smi
+ properties:
+- clock:
+- items:
+- minItems: 3
+- maxItems: 3
++ clocks:
++ minItems: 3
++ maxItems: 3
+ clock-names:
+ items:
+ - const: apb
+@@ -133,10 +131,9 @@ allOf:
+
+ then:
+ properties:
+- clock:
+- items:
+- minItems: 4
+- maxItems: 4
++ clocks:
++ minItems: 4
++ maxItems: 4
+ clock-names:
+ items:
+ - const: apb
+@@ -146,10 +143,9 @@ allOf:
+
+ else: # for gen2 HW that don't have gals
+ properties:
+- clock:
+- items:
+- minItems: 2
+- maxItems: 2
++ clocks:
++ minItems: 2
++ maxItems: 2
+ clock-names:
+ items:
+ - const: apb
+--- a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml
++++ b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml
+@@ -79,10 +79,9 @@ allOf:
+
+ then:
+ properties:
+- clock:
+- items:
+- minItems: 3
+- maxItems: 3
++ clocks:
++ minItems: 3
++ maxItems: 3
+ clock-names:
+ items:
+ - const: apb
+@@ -91,10 +90,9 @@ allOf:
+
+ else:
+ properties:
+- clock:
+- items:
+- minItems: 2
+- maxItems: 2
++ clocks:
++ minItems: 2
++ maxItems: 2
+ clock-names:
+ items:
+ - const: apb
--- /dev/null
+From 0e7f1b557974ce297e5e4c9d4245720fbb489886 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Thu, 16 Dec 2021 12:16:28 +0100
+Subject: dt-bindings: mtd: nand-controller: Fix a comment in the examples
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 0e7f1b557974ce297e5e4c9d4245720fbb489886 upstream.
+
+The controller properties should be in the controller 'parent' node,
+while properties in the children nodes are specific to the NAND
+*chip*. This error was already present during the yaml conversion.
+
+Fixes: 2d472aba15ff ("mtd: nand: document the NAND controller/NAND chip DT representation")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/linux-mtd/20211216111654.238086-3-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/mtd/nand-controller.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/mtd/nand-controller.yaml
++++ b/Documentation/devicetree/bindings/mtd/nand-controller.yaml
+@@ -184,7 +184,7 @@ examples:
+ nand-use-soft-ecc-engine;
+ nand-ecc-algo = "bch";
+
+- /* controller specific properties */
++ /* NAND chip specific properties */
+ };
+
+ nand@1 {
--- /dev/null
+From 93f2ec9e401276fb4ea9903194a5bfcf175f9a2c Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Thu, 16 Dec 2021 12:16:27 +0100
+Subject: dt-bindings: mtd: nand-controller: Fix the reg property description
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 93f2ec9e401276fb4ea9903194a5bfcf175f9a2c upstream.
+
+The reg property of a NAND device always references the chip-selects.
+The ready/busy lines are described in the nand-rb property. I believe
+this was a harmless copy/paste error during the conversion to yaml.
+
+Fixes: 212e49693592 ("dt-bindings: mtd: Add YAML schemas for the generic NAND options")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/linux-mtd/20211216111654.238086-2-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/mtd/nand-controller.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/mtd/nand-controller.yaml
++++ b/Documentation/devicetree/bindings/mtd/nand-controller.yaml
+@@ -55,7 +55,7 @@ patternProperties:
+ properties:
+ reg:
+ description:
+- Contains the native Ready/Busy IDs.
++ Contains the chip-select IDs.
+
+ nand-ecc-engine:
+ allOf:
--- /dev/null
+From c76eeb14ec4e645a23ed8d627c7e38eca048c527 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wenst@chromium.org>
+Date: Wed, 2 Feb 2022 23:35:28 +0800
+Subject: dt-bindings: pinctrl: mt8195: fix bias-pull-{up,down} checks
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+commit c76eeb14ec4e645a23ed8d627c7e38eca048c527 upstream.
+
+When the constraints and description for bias-pull-{up,down} were added,
+the constraints were not indented correctly, resulting in them being
+parsed as part of the description. This effectively nullified their
+purpose.
+
+Move the constraints out of the description block, make each description
+part of the same associative array as the enum its describing, and
+reindent them correctly so they take effect.
+
+Also add "type: boolean" to the list of valid values. This corresponds
+to having bias-pull-{up,down} without any arguments.
+
+Fixes: 91e7edceda96 ("dt-bindings: pinctrl: mt8195: change pull up/down description")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20220202153528.707185-1-wenst@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/pinctrl/pinctrl-mt8195.yaml | 30 +++++-----
+ 1 file changed, 16 insertions(+), 14 deletions(-)
+
+--- a/Documentation/devicetree/bindings/pinctrl/pinctrl-mt8195.yaml
++++ b/Documentation/devicetree/bindings/pinctrl/pinctrl-mt8195.yaml
+@@ -99,6 +99,14 @@ patternProperties:
+ enum: [2, 4, 6, 8, 10, 12, 14, 16]
+
+ bias-pull-down:
++ oneOf:
++ - type: boolean
++ - enum: [100, 101, 102, 103]
++ description: mt8195 pull down PUPD/R0/R1 type define value.
++ - enum: [200, 201, 202, 203, 204, 205, 206, 207]
++ description: mt8195 pull down RSEL type define value.
++ - enum: [75000, 5000]
++ description: mt8195 pull down RSEL type si unit value(ohm).
+ description: |
+ For pull down type is normal, it don't need add RSEL & R1R0 define
+ and resistance value.
+@@ -115,13 +123,6 @@ patternProperties:
+ & "MTK_PULL_SET_RSEL_110" & "MTK_PULL_SET_RSEL_111"
+ define in mt8195. It can also support resistance value(ohm)
+ "75000" & "5000" in mt8195.
+- oneOf:
+- - enum: [100, 101, 102, 103]
+- - description: mt8195 pull down PUPD/R0/R1 type define value.
+- - enum: [200, 201, 202, 203, 204, 205, 206, 207]
+- - description: mt8195 pull down RSEL type define value.
+- - enum: [75000, 5000]
+- - description: mt8195 pull down RSEL type si unit value(ohm).
+
+ An example of using RSEL define:
+ pincontroller {
+@@ -146,6 +147,14 @@ patternProperties:
+ };
+
+ bias-pull-up:
++ oneOf:
++ - type: boolean
++ - enum: [100, 101, 102, 103]
++ description: mt8195 pull up PUPD/R0/R1 type define value.
++ - enum: [200, 201, 202, 203, 204, 205, 206, 207]
++ description: mt8195 pull up RSEL type define value.
++ - enum: [1000, 1500, 2000, 3000, 4000, 5000, 10000, 75000]
++ description: mt8195 pull up RSEL type si unit value(ohm).
+ description: |
+ For pull up type is normal, it don't need add RSEL & R1R0 define
+ and resistance value.
+@@ -163,13 +172,6 @@ patternProperties:
+ define in mt8195. It can also support resistance value(ohm)
+ "1000" & "1500" & "2000" & "3000" & "4000" & "5000" & "10000" &
+ "75000" in mt8195.
+- oneOf:
+- - enum: [100, 101, 102, 103]
+- - description: mt8195 pull up PUPD/R0/R1 type define value.
+- - enum: [200, 201, 202, 203, 204, 205, 206, 207]
+- - description: mt8195 pull up RSEL type define value.
+- - enum: [1000, 1500, 2000, 3000, 4000, 5000, 10000, 75000]
+- - description: mt8195 pull up RSEL type si unit value(ohm).
+ An example of using RSEL define:
+ pincontroller {
+ i2c0-pins {
--- /dev/null
+From a6ff90f3fbd4d902aad8777f0329cef3a2768bde Mon Sep 17 00:00:00 2001
+From: Horatiu Vultur <horatiu.vultur@microchip.com>
+Date: Fri, 4 Feb 2022 16:35:34 +0100
+Subject: dt-bindings: pinctrl: pinctrl-microchip-sgpio: Fix example
+
+From: Horatiu Vultur <horatiu.vultur@microchip.com>
+
+commit a6ff90f3fbd4d902aad8777f0329cef3a2768bde upstream.
+
+The blamed commit adds support for irq, but the reqisters for irq are
+outside of the memory size. They are at address 0x108. Therefore update
+the memory size to cover all the registers used by the device.
+
+Fixes: 01a9350bdd49fb ("dt-bindings: pinctrl: pinctrl-microchip-sgpio: Add irq support")
+Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
+Link: https://lore.kernel.org/r/20220204153535.465827-2-horatiu.vultur@microchip.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/pinctrl/microchip,sparx5-sgpio.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/pinctrl/microchip,sparx5-sgpio.yaml
++++ b/Documentation/devicetree/bindings/pinctrl/microchip,sparx5-sgpio.yaml
+@@ -145,7 +145,7 @@ examples:
+ clocks = <&sys_clk>;
+ pinctrl-0 = <&sgpio2_pins>;
+ pinctrl-names = "default";
+- reg = <0x1101059c 0x100>;
++ reg = <0x1101059c 0x118>;
+ microchip,sgpio-port-ranges = <0 0>, <16 18>, <28 31>;
+ bus-frequency = <25000000>;
+ sgpio_in2: gpio@0 {
--- /dev/null
+From 90c204d3195a795f77f5bce767e311dd1c59ca17 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Thu, 16 Dec 2021 12:16:33 +0100
+Subject: dt-bindings: spi: mxic: The interrupt property is not mandatory
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 90c204d3195a795f77f5bce767e311dd1c59ca17 upstream.
+
+The interrupt property is not mandatory at all, this property should not
+be part of the required properties list, so move it into the optional
+properties list.
+
+Fixes: 326e5c8d4a87 ("dt-binding: spi: Document Macronix controller bindings")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/linux-mtd/20211216111654.238086-8-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/spi/spi-mxic.txt | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/spi/spi-mxic.txt
++++ b/Documentation/devicetree/bindings/spi/spi-mxic.txt
+@@ -8,11 +8,13 @@ Required properties:
+ - reg: should contain 2 entries, one for the registers and one for the direct
+ mapping area
+ - reg-names: should contain "regs" and "dirmap"
+-- interrupts: interrupt line connected to the SPI controller
+ - clock-names: should contain "ps_clk", "send_clk" and "send_dly_clk"
+ - clocks: should contain 3 entries for the "ps_clk", "send_clk" and
+ "send_dly_clk" clocks
+
++Optional properties:
++- interrupts: interrupt line connected to the SPI controller
++
+ Example:
+
+ spi@43c30000 {
--- /dev/null
+From 6492eba4fafb5a9715ecf78b7155e88f8f88909a Mon Sep 17 00:00:00 2001
+From: Martin Kepplinger <martin.kepplinger@puri.sm>
+Date: Tue, 11 Jan 2022 14:39:36 +0100
+Subject: media: dt-binding: media: hynix,hi846: use $defs/port-base port description
+
+From: Martin Kepplinger <martin.kepplinger@puri.sm>
+
+commit 6492eba4fafb5a9715ecf78b7155e88f8f88909a upstream.
+
+This fixes "make dt_binding_check":
+
+ Documentation/devicetree/bindings/media/i2c/hynix,hi846.example.dt.yaml:
+camera@20: port:endpoint: Unevaluated properties are not allowed
+('link-frequencies', 'data-lanes' were unexpected)
+ From schema: Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml
+
+[Sakari Ailus: Reword commit message]
+
+Fixes: f3ce7200ca18 ("media: dt-bindings: media: document SK Hynix Hi-846 MIPI CSI-2 8M pixel sensor")
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml
+@@ -49,7 +49,8 @@ properties:
+ description: Definition of the regulator used for the VDDD power supply.
+
+ port:
+- $ref: /schemas/graph.yaml#/properties/port
++ $ref: /schemas/graph.yaml#/$defs/port-base
++ unevaluatedProperties: false
+
+ properties:
+ endpoint:
--- /dev/null
+From a44b8e8c9b2615ea7cf2361cbca3c1dff8119c87 Mon Sep 17 00:00:00 2001
+From: Martin Kepplinger <martin.kepplinger@puri.sm>
+Date: Tue, 11 Jan 2022 14:39:37 +0100
+Subject: media: dt-bindings: media: hynix,hi846: add link-frequencies description
+
+From: Martin Kepplinger <martin.kepplinger@puri.sm>
+
+commit a44b8e8c9b2615ea7cf2361cbca3c1dff8119c87 upstream.
+
+link-frequencies is required but only mentioned in the example. Add
+it to the description.
+
+Fixes: f3ce7200ca18 ("media: dt-bindings: media: document SK Hynix Hi-846 MIPI CSI-2 8M pixel sensor")
+Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml
+@@ -69,8 +69,11 @@ properties:
+ - const: 1
+ - const: 2
+
++ link-frequencies: true
++
+ required:
+ - data-lanes
++ - link-frequencies
+
+ required:
+ - compatible
--- /dev/null
+From 7499b529d97f752124fa62fefa1d6d44b371215a Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Tue, 25 Jan 2022 13:50:06 +0800
+Subject: mmc: rtsx: Use pm_runtime_{get,put}() to handle runtime PM
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit 7499b529d97f752124fa62fefa1d6d44b371215a upstream.
+
+Commit 5b4258f6721f ("misc: rtsx: rts5249 support runtime PM") doesn't
+use pm_runtime_{get,put}() helpers when it should, so the RPM refcount
+keeps at zero, hence its parent driver, rtsx_pci, has to do lots of
+weird tricks to keep it from runtime suspending.
+
+So use those helpers at right places to properly manage runtime PM.
+
+Fixes: 5b4258f6721f ("misc: rtsx: rts5249 support runtime PM")
+Cc: Ricky WU <ricky_wu@realtek.com>
+Tested-by: Ricky WU <ricky_wu@realtek.com>
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Link: https://lore.kernel.org/r/20220125055010.1866563-1-kai.heng.feng@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/rtsx_pci_sdmmc.c | 44 ++++++++++++++++++++++++++++----------
+ 1 file changed, 33 insertions(+), 11 deletions(-)
+
+--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
+@@ -806,6 +806,7 @@ static void sd_request(struct work_struc
+ struct mmc_request *mrq = host->mrq;
+ struct mmc_command *cmd = mrq->cmd;
+ struct mmc_data *data = mrq->data;
++ struct device *dev = &host->pdev->dev;
+
+ unsigned int data_size = 0;
+ int err;
+@@ -822,6 +823,7 @@ static void sd_request(struct work_struc
+ }
+
+ mutex_lock(&pcr->pcr_mutex);
++ pm_runtime_get_sync(dev);
+
+ rtsx_pci_start_run(pcr);
+
+@@ -858,6 +860,8 @@ static void sd_request(struct work_struc
+ data->bytes_xfered = data->blocks * data->blksz;
+ }
+
++ pm_runtime_mark_last_busy(dev);
++ pm_runtime_put_autosuspend(dev);
+ mutex_unlock(&pcr->pcr_mutex);
+
+ finish:
+@@ -1080,6 +1084,7 @@ static void sdmmc_set_ios(struct mmc_hos
+ {
+ struct realtek_pci_sdmmc *host = mmc_priv(mmc);
+ struct rtsx_pcr *pcr = host->pcr;
++ struct device *dev = &host->pdev->dev;
+
+ if (host->eject)
+ return;
+@@ -1088,6 +1093,7 @@ static void sdmmc_set_ios(struct mmc_hos
+ return;
+
+ mutex_lock(&pcr->pcr_mutex);
++ pm_runtime_get_sync(dev);
+
+ rtsx_pci_start_run(pcr);
+
+@@ -1121,6 +1127,8 @@ static void sdmmc_set_ios(struct mmc_hos
+ rtsx_pci_switch_clock(pcr, ios->clock, host->ssc_depth,
+ host->initial_mode, host->double_clk, host->vpclk);
+
++ pm_runtime_mark_last_busy(dev);
++ pm_runtime_put_autosuspend(dev);
+ mutex_unlock(&pcr->pcr_mutex);
+ }
+
+@@ -1128,6 +1136,7 @@ static int sdmmc_get_ro(struct mmc_host
+ {
+ struct realtek_pci_sdmmc *host = mmc_priv(mmc);
+ struct rtsx_pcr *pcr = host->pcr;
++ struct device *dev = &host->pdev->dev;
+ int ro = 0;
+ u32 val;
+
+@@ -1135,6 +1144,7 @@ static int sdmmc_get_ro(struct mmc_host
+ return -ENOMEDIUM;
+
+ mutex_lock(&pcr->pcr_mutex);
++ pm_runtime_get_sync(dev);
+
+ rtsx_pci_start_run(pcr);
+
+@@ -1144,6 +1154,8 @@ static int sdmmc_get_ro(struct mmc_host
+ if (val & SD_WRITE_PROTECT)
+ ro = 1;
+
++ pm_runtime_mark_last_busy(dev);
++ pm_runtime_put_autosuspend(dev);
+ mutex_unlock(&pcr->pcr_mutex);
+
+ return ro;
+@@ -1153,6 +1165,7 @@ static int sdmmc_get_cd(struct mmc_host
+ {
+ struct realtek_pci_sdmmc *host = mmc_priv(mmc);
+ struct rtsx_pcr *pcr = host->pcr;
++ struct device *dev = &host->pdev->dev;
+ int cd = 0;
+ u32 val;
+
+@@ -1160,6 +1173,7 @@ static int sdmmc_get_cd(struct mmc_host
+ return cd;
+
+ mutex_lock(&pcr->pcr_mutex);
++ pm_runtime_get_sync(dev);
+
+ rtsx_pci_start_run(pcr);
+
+@@ -1169,6 +1183,8 @@ static int sdmmc_get_cd(struct mmc_host
+ if (val & SD_EXIST)
+ cd = 1;
+
++ pm_runtime_mark_last_busy(dev);
++ pm_runtime_put_autosuspend(dev);
+ mutex_unlock(&pcr->pcr_mutex);
+
+ return cd;
+@@ -1251,6 +1267,7 @@ static int sdmmc_switch_voltage(struct m
+ {
+ struct realtek_pci_sdmmc *host = mmc_priv(mmc);
+ struct rtsx_pcr *pcr = host->pcr;
++ struct device *dev = &host->pdev->dev;
+ int err = 0;
+ u8 voltage;
+
+@@ -1265,6 +1282,7 @@ static int sdmmc_switch_voltage(struct m
+ return err;
+
+ mutex_lock(&pcr->pcr_mutex);
++ pm_runtime_get_sync(dev);
+
+ rtsx_pci_start_run(pcr);
+
+@@ -1294,6 +1312,8 @@ out:
+ err = rtsx_pci_write_register(pcr, SD_BUS_STAT,
+ SD_CLK_TOGGLE_EN | SD_CLK_FORCE_STOP, 0);
+
++ pm_runtime_mark_last_busy(dev);
++ pm_runtime_put_autosuspend(dev);
+ mutex_unlock(&pcr->pcr_mutex);
+
+ return err;
+@@ -1303,6 +1323,7 @@ static int sdmmc_execute_tuning(struct m
+ {
+ struct realtek_pci_sdmmc *host = mmc_priv(mmc);
+ struct rtsx_pcr *pcr = host->pcr;
++ struct device *dev = &host->pdev->dev;
+ int err = 0;
+
+ if (host->eject)
+@@ -1313,6 +1334,7 @@ static int sdmmc_execute_tuning(struct m
+ return err;
+
+ mutex_lock(&pcr->pcr_mutex);
++ pm_runtime_get_sync(dev);
+
+ rtsx_pci_start_run(pcr);
+
+@@ -1345,6 +1367,8 @@ static int sdmmc_execute_tuning(struct m
+ err = sd_change_phase(host, DDR50_RX_PHASE(pcr), true);
+
+ out:
++ pm_runtime_mark_last_busy(dev);
++ pm_runtime_put_autosuspend(dev);
+ mutex_unlock(&pcr->pcr_mutex);
+
+ return err;
+@@ -1495,12 +1519,12 @@ static int rtsx_pci_sdmmc_drv_probe(stru
+
+ realtek_init_host(host);
+
+- if (pcr->rtd3_en) {
+- pm_runtime_set_autosuspend_delay(&pdev->dev, 5000);
+- pm_runtime_use_autosuspend(&pdev->dev);
+- pm_runtime_enable(&pdev->dev);
+- }
+-
++ pm_runtime_no_callbacks(&pdev->dev);
++ pm_runtime_set_active(&pdev->dev);
++ pm_runtime_enable(&pdev->dev);
++ pm_runtime_set_autosuspend_delay(&pdev->dev, 200);
++ pm_runtime_mark_last_busy(&pdev->dev);
++ pm_runtime_use_autosuspend(&pdev->dev);
+
+ mmc_add_host(mmc);
+
+@@ -1521,11 +1545,6 @@ static int rtsx_pci_sdmmc_drv_remove(str
+ pcr->slots[RTSX_SD_CARD].card_event = NULL;
+ mmc = host->mmc;
+
+- if (pcr->rtd3_en) {
+- pm_runtime_dont_use_autosuspend(&pdev->dev);
+- pm_runtime_disable(&pdev->dev);
+- }
+-
+ cancel_work_sync(&host->work);
+
+ mutex_lock(&host->host_mutex);
+@@ -1548,6 +1567,9 @@ static int rtsx_pci_sdmmc_drv_remove(str
+
+ flush_work(&host->work);
+
++ pm_runtime_dont_use_autosuspend(&pdev->dev);
++ pm_runtime_disable(&pdev->dev);
++
+ mmc_free_host(mmc);
+
+ dev_dbg(&(pdev->dev),
--- /dev/null
+From 6d35d04a9e18990040e87d2bbf72689252669d54 Mon Sep 17 00:00:00 2001
+From: Zhang Wensheng <zhangwensheng5@huawei.com>
+Date: Thu, 10 Mar 2022 17:32:24 +0800
+Subject: nbd: fix possible overflow on 'first_minor' in nbd_dev_add()
+
+From: Zhang Wensheng <zhangwensheng5@huawei.com>
+
+commit 6d35d04a9e18990040e87d2bbf72689252669d54 upstream.
+
+When 'index' is a big numbers, it may become negative which forced
+to 'int'. then 'index << part_shift' might overflow to a positive
+value that is not greater than '0xfffff', then sysfs might complains
+about duplicate creation. Because of this, move the 'index' judgment
+to the front will fix it and be better.
+
+Fixes: b0d9111a2d53 ("nbd: use an idr to keep track of nbd devices")
+Fixes: 940c264984fd ("nbd: fix possible overflow for 'first_minor' in nbd_dev_add()")
+Signed-off-by: Zhang Wensheng <zhangwensheng5@huawei.com>
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Link: https://lore.kernel.org/r/20220310093224.4002895-1-zhangwensheng5@huawei.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/nbd.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1800,17 +1800,6 @@ static struct nbd_device *nbd_dev_add(in
+ refcount_set(&nbd->refs, 0);
+ INIT_LIST_HEAD(&nbd->list);
+ disk->major = NBD_MAJOR;
+-
+- /* Too big first_minor can cause duplicate creation of
+- * sysfs files/links, since index << part_shift might overflow, or
+- * MKDEV() expect that the max bits of first_minor is 20.
+- */
+- disk->first_minor = index << part_shift;
+- if (disk->first_minor < index || disk->first_minor > MINORMASK) {
+- err = -EINVAL;
+- goto out_free_work;
+- }
+-
+ disk->minors = 1 << part_shift;
+ disk->fops = &nbd_fops;
+ disk->private_data = nbd;
+@@ -1915,8 +1904,19 @@ static int nbd_genl_connect(struct sk_bu
+ if (!netlink_capable(skb, CAP_SYS_ADMIN))
+ return -EPERM;
+
+- if (info->attrs[NBD_ATTR_INDEX])
++ if (info->attrs[NBD_ATTR_INDEX]) {
+ index = nla_get_u32(info->attrs[NBD_ATTR_INDEX]);
++
++ /*
++ * Too big first_minor can cause duplicate creation of
++ * sysfs files/links, since index << part_shift might overflow, or
++ * MKDEV() expect that the max bits of first_minor is 20.
++ */
++ if (index < 0 || index > MINORMASK >> part_shift) {
++ printk(KERN_ERR "nbd: illegal input index %d\n", index);
++ return -EINVAL;
++ }
++ }
+ if (!info->attrs[NBD_ATTR_SOCKETS]) {
+ printk(KERN_ERR "nbd: must specify at least one socket\n");
+ return -EINVAL;
mm-usercopy-return-1-from-hardened_usercopy-__setup-handler.patch
af_unix-support-pollpri-for-oob.patch
libbpf-define-btf_kind_-constants-in-btf.h-to-avoid-compilation-errors.patch
+bpf-adjust-bpf-stack-helper-functions-to-accommodate-skip-0.patch
+bpf-fix-comment-for-helper-bpf_current_task_under_cgroup.patch
+nbd-fix-possible-overflow-on-first_minor-in-nbd_dev_add.patch
+mmc-rtsx-use-pm_runtime_-get-put-to-handle-runtime-pm.patch
+dt-bindings-mtd-nand-controller-fix-the-reg-property-description.patch
+dt-bindings-mtd-nand-controller-fix-a-comment-in-the-examples.patch
+dt-bindings-spi-mxic-the-interrupt-property-is-not-mandatory.patch
+media-dt-binding-media-hynix-hi846-use-defs-port-base-port-description.patch
+media-dt-bindings-media-hynix-hi846-add-link-frequencies-description.patch
+dt-bindings-memory-mtk-smi-rename-clock-to-clocks.patch
+dt-bindings-memory-mtk-smi-no-need-mediatek-larb-id-for-mt8167.patch
+dt-bindings-memory-mtk-smi-correct-minitems-to-2-for-the-gals-clocks.patch
+dt-bindings-pinctrl-mt8195-fix-bias-pull-up-down-checks.patch
+dt-bindings-pinctrl-pinctrl-microchip-sgpio-fix-example.patch
+ubi-fastmap-return-error-code-if-memory-allocation-fails-in-add_aeb.patch
net-preserve-skb_end_offset-in-skb_unclone_keeptruesize.patch
--- /dev/null
+From c3c07fc25f37c157fde041b3a0c3dfcb1590cbce Mon Sep 17 00:00:00 2001
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+Date: Mon, 27 Dec 2021 11:22:42 +0800
+Subject: ubi: fastmap: Return error code if memory allocation fails in add_aeb()
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+commit c3c07fc25f37c157fde041b3a0c3dfcb1590cbce upstream.
+
+Abort fastmap scanning and return error code if memory allocation fails
+in add_aeb(). Otherwise ubi will get wrong peb statistics information
+after scanning.
+
+Fixes: dbb7d2a88d2a7b ("UBI: Add fastmap core")
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/ubi/fastmap.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+--- a/drivers/mtd/ubi/fastmap.c
++++ b/drivers/mtd/ubi/fastmap.c
+@@ -468,7 +468,9 @@ static int scan_pool(struct ubi_device *
+ if (err == UBI_IO_FF_BITFLIPS)
+ scrub = 1;
+
+- add_aeb(ai, free, pnum, ec, scrub);
++ ret = add_aeb(ai, free, pnum, ec, scrub);
++ if (ret)
++ goto out;
+ continue;
+ } else if (err == 0 || err == UBI_IO_BITFLIPS) {
+ dbg_bld("Found non empty PEB:%i in pool", pnum);
+@@ -638,8 +640,10 @@ static int ubi_attach_fastmap(struct ubi
+ if (fm_pos >= fm_size)
+ goto fail_bad;
+
+- add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum),
+- be32_to_cpu(fmec->ec), 0);
++ ret = add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum),
++ be32_to_cpu(fmec->ec), 0);
++ if (ret)
++ goto fail;
+ }
+
+ /* read EC values from used list */
+@@ -649,8 +653,10 @@ static int ubi_attach_fastmap(struct ubi
+ if (fm_pos >= fm_size)
+ goto fail_bad;
+
+- add_aeb(ai, &used, be32_to_cpu(fmec->pnum),
+- be32_to_cpu(fmec->ec), 0);
++ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum),
++ be32_to_cpu(fmec->ec), 0);
++ if (ret)
++ goto fail;
+ }
+
+ /* read EC values from scrub list */
+@@ -660,8 +666,10 @@ static int ubi_attach_fastmap(struct ubi
+ if (fm_pos >= fm_size)
+ goto fail_bad;
+
+- add_aeb(ai, &used, be32_to_cpu(fmec->pnum),
+- be32_to_cpu(fmec->ec), 1);
++ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum),
++ be32_to_cpu(fmec->ec), 1);
++ if (ret)
++ goto fail;
+ }
+
+ /* read EC values from erase list */
+@@ -671,8 +679,10 @@ static int ubi_attach_fastmap(struct ubi
+ if (fm_pos >= fm_size)
+ goto fail_bad;
+
+- add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum),
+- be32_to_cpu(fmec->ec), 1);
++ ret = add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum),
++ be32_to_cpu(fmec->ec), 1);
++ if (ret)
++ goto fail;
+ }
+
+ ai->mean_ec = div_u64(ai->ec_sum, ai->ec_count);
projects / thirdparty / kernel / stable-queue.git / commitdiff
