--- /dev/null
+From f997ea3b7afc108eb9761f321b57de2d089c7c48 Mon Sep 17 00:00:00 2001
+From: Xie Yongji <xieyongji@bytedance.com>
+Date: Mon, 17 May 2021 16:35:57 +0800
+Subject: 9p/trans_virtio: Remove sysfs file on probe failure
+
+From: Xie Yongji <xieyongji@bytedance.com>
+
+commit f997ea3b7afc108eb9761f321b57de2d089c7c48 upstream.
+
+This ensures we don't leak the sysfs file if we failed to
+allocate chan->vc_wq during probe.
+
+Link: http://lkml.kernel.org/r/20210517083557.172-1-xieyongji@bytedance.com
+Fixes: 86c8437383ac ("net/9p: Add sysfs mount_tag file for virtio 9P device")
+Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/9p/trans_virtio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -610,7 +610,7 @@ static int p9_virtio_probe(struct virtio
+ chan->vc_wq = kmalloc(sizeof(wait_queue_head_t), GFP_KERNEL);
+ if (!chan->vc_wq) {
+ err = -ENOMEM;
+- goto out_free_tag;
++ goto out_remove_file;
+ }
+ init_waitqueue_head(chan->vc_wq);
+ chan->ring_bufs_avail = 1;
+@@ -628,6 +628,8 @@ static int p9_virtio_probe(struct virtio
+
+ return 0;
+
++out_remove_file:
++ sysfs_remove_file(&vdev->dev.kobj, &dev_attr_mount_tag.attr);
+ out_free_tag:
+ kfree(tag);
+ out_free_vq:
--- /dev/null
+From b4002173b7989588b6feaefc42edaf011b596782 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@kernel.org>
+Date: Tue, 27 Jul 2021 15:47:12 -0400
+Subject: ceph: cancel delayed work instead of flushing on mdsc teardown
+
+From: Jeff Layton <jlayton@kernel.org>
+
+commit b4002173b7989588b6feaefc42edaf011b596782 upstream.
+
+The first thing metric_delayed_work does is check mdsc->stopping,
+and then return immediately if it's set. That's good since we would
+have already torn down the metric structures at this point, otherwise,
+but there is no locking around mdsc->stopping.
+
+It's possible that the ceph_metric_destroy call could race with the
+delayed_work, in which case we could end up with the delayed_work
+accessing destroyed percpu variables.
+
+At this point in the mdsc teardown, the "stopping" flag has already been
+set, so there's no benefit to flushing the work. Move the work
+cancellation in ceph_metric_destroy ahead of the percpu variable
+destruction, and eliminate the flush_delayed_work call in
+ceph_mdsc_destroy.
+
+Fixes: 18f473b384a6 ("ceph: periodically send perf metrics to MDSes")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: Xiubo Li <xiubli@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ceph/mds_client.c | 1 -
+ fs/ceph/metric.c | 4 ++--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -4912,7 +4912,6 @@ void ceph_mdsc_destroy(struct ceph_fs_cl
+
+ ceph_metric_destroy(&mdsc->metric);
+
+- flush_delayed_work(&mdsc->metric.delayed_work);
+ fsc->mdsc = NULL;
+ kfree(mdsc);
+ dout("mdsc_destroy %p done\n", mdsc);
+--- a/fs/ceph/metric.c
++++ b/fs/ceph/metric.c
+@@ -302,6 +302,8 @@ void ceph_metric_destroy(struct ceph_cli
+ if (!m)
+ return;
+
++ cancel_delayed_work_sync(&m->delayed_work);
++
+ percpu_counter_destroy(&m->total_inodes);
+ percpu_counter_destroy(&m->opened_inodes);
+ percpu_counter_destroy(&m->i_caps_mis);
+@@ -309,8 +311,6 @@ void ceph_metric_destroy(struct ceph_cli
+ percpu_counter_destroy(&m->d_lease_mis);
+ percpu_counter_destroy(&m->d_lease_hit);
+
+- cancel_delayed_work_sync(&m->delayed_work);
+-
+ ceph_put_mds_session(m->session);
+ }
+
--- /dev/null
+From 221e8360834c59f0c9952630fa5904a94ebd2bb8 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Thu, 9 Sep 2021 17:06:08 +0800
+Subject: n64cart: fix return value check in n64cart_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit 221e8360834c59f0c9952630fa5904a94ebd2bb8 upstream.
+
+In case of error, the function devm_platform_ioremap_resource()
+returns ERR_PTR() and never returns NULL. The NULL test in the
+return value check should be replaced with IS_ERR().
+
+Fixes: d9b2a2bbbb4d ("block: Add n64 cart driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Link: https://lore.kernel.org/r/20210909090608.2989716-1-yangyingliang@huawei.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/n64cart.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/block/n64cart.c
++++ b/drivers/block/n64cart.c
+@@ -129,8 +129,8 @@ static int __init n64cart_probe(struct p
+ }
+
+ reg_base = devm_platform_ioremap_resource(pdev, 0);
+- if (!reg_base)
+- return -EINVAL;
++ if (IS_ERR(reg_base))
++ return PTR_ERR(reg_base);
+
+ disk = blk_alloc_disk(NUMA_NO_NODE);
+ if (!disk)
--- /dev/null
+From 98e2e409e76ef7781d8511f997359e9c504a95c1 Mon Sep 17 00:00:00 2001
+From: Zhen Lei <thunder.leizhen@huawei.com>
+Date: Tue, 7 Sep 2021 20:00:26 -0700
+Subject: nilfs2: use refcount_dec_and_lock() to fix potential UAF
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+commit 98e2e409e76ef7781d8511f997359e9c504a95c1 upstream.
+
+When the refcount is decreased to 0, the resource reclamation branch is
+entered. Before CPU0 reaches the race point (1), CPU1 may obtain the
+spinlock and traverse the rbtree to find 'root', see
+nilfs_lookup_root().
+
+Although CPU1 will call refcount_inc() to increase the refcount, it is
+obviously too late. CPU0 will release 'root' directly, CPU1 then
+accesses 'root' and triggers UAF.
+
+Use refcount_dec_and_lock() to ensure that both the operations of
+decrease refcount to 0 and link deletion are lock protected eliminates
+this risk.
+
+ CPU0 CPU1
+ nilfs_put_root():
+ <-------- (1)
+ spin_lock(&nilfs->ns_cptree_lock);
+ rb_erase(&root->rb_node, &nilfs->ns_cptree);
+ spin_unlock(&nilfs->ns_cptree_lock);
+
+ kfree(root);
+ <-------- use-after-free
+
+ refcount_t: underflow; use-after-free.
+ WARNING: CPU: 2 PID: 9476 at lib/refcount.c:28 \
+ refcount_warn_saturate+0x1cf/0x210 lib/refcount.c:28
+ Modules linked in:
+ CPU: 2 PID: 9476 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ...
+ RIP: 0010:refcount_warn_saturate+0x1cf/0x210 lib/refcount.c:28
+ ... ...
+ Call Trace:
+ __refcount_sub_and_test include/linux/refcount.h:283 [inline]
+ __refcount_dec_and_test include/linux/refcount.h:315 [inline]
+ refcount_dec_and_test include/linux/refcount.h:333 [inline]
+ nilfs_put_root+0xc1/0xd0 fs/nilfs2/the_nilfs.c:795
+ nilfs_segctor_destroy fs/nilfs2/segment.c:2749 [inline]
+ nilfs_detach_log_writer+0x3fa/0x570 fs/nilfs2/segment.c:2812
+ nilfs_put_super+0x2f/0xf0 fs/nilfs2/super.c:467
+ generic_shutdown_super+0xcd/0x1f0 fs/super.c:464
+ kill_block_super+0x4a/0x90 fs/super.c:1446
+ deactivate_locked_super+0x6a/0xb0 fs/super.c:335
+ deactivate_super+0x85/0x90 fs/super.c:366
+ cleanup_mnt+0x277/0x2e0 fs/namespace.c:1118
+ __cleanup_mnt+0x15/0x20 fs/namespace.c:1125
+ task_work_run+0x8e/0x110 kernel/task_work.c:151
+ tracehook_notify_resume include/linux/tracehook.h:188 [inline]
+ exit_to_user_mode_loop kernel/entry/common.c:164 [inline]
+ exit_to_user_mode_prepare+0x13c/0x170 kernel/entry/common.c:191
+ syscall_exit_to_user_mode+0x16/0x30 kernel/entry/common.c:266
+ do_syscall_64+0x45/0x80 arch/x86/entry/common.c:56
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+There is no reproduction program, and the above is only theoretical
+analysis.
+
+Link: https://lkml.kernel.org/r/1629859428-5906-1-git-send-email-konishi.ryusuke@gmail.com
+Fixes: ba65ae4729bf ("nilfs2: add checkpoint tree to nilfs object")
+Link: https://lkml.kernel.org/r/20210723012317.4146-1-thunder.leizhen@huawei.com
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nilfs2/the_nilfs.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/fs/nilfs2/the_nilfs.c
++++ b/fs/nilfs2/the_nilfs.c
+@@ -792,14 +792,13 @@ nilfs_find_or_create_root(struct the_nil
+
+ void nilfs_put_root(struct nilfs_root *root)
+ {
+- if (refcount_dec_and_test(&root->count)) {
+- struct the_nilfs *nilfs = root->nilfs;
++ struct the_nilfs *nilfs = root->nilfs;
+
+- nilfs_sysfs_delete_snapshot_group(root);
+-
+- spin_lock(&nilfs->ns_cptree_lock);
++ if (refcount_dec_and_lock(&root->count, &nilfs->ns_cptree_lock)) {
+ rb_erase(&root->rb_node, &nilfs->ns_cptree);
+ spin_unlock(&nilfs->ns_cptree_lock);
++
++ nilfs_sysfs_delete_snapshot_group(root);
+ iput(root->ifile);
+
+ kfree(root);
--- /dev/null
+From d2930ede5218be28413a00130a6895d14393c325 Mon Sep 17 00:00:00 2001
+From: Remi Bernon <rbernon@codeweavers.com>
+Date: Thu, 9 Sep 2021 21:26:36 +0200
+Subject: perf symbol: Look for ImageBase in PE file to compute .text offset
+
+From: Remi Bernon <rbernon@codeweavers.com>
+
+commit d2930ede5218be28413a00130a6895d14393c325 upstream.
+
+Instead of using the file offset in the debug file.
+
+This fixes a regression from 00a3423492bc90be ("perf symbols: Make
+dso__load_bfd_symbols() load PE files from debug cache only"), causing
+incorrect symbol resolution when debug file have been stripped from
+non-debug sections (in which case its .text section is empty and doesn't
+have any file position).
+
+The debug files could also be created with a different file alignment,
+and have different file positions from the mmap-ed binary, or have the
+section reordered.
+
+This instead looks for the file image base, using the corresponding bfd
+*ABS* symbols. As PE symbols only have 4 bytes, it also needs to keep
+.text section vma high bits.
+
+Signed-off-by: Remi Bernon <rbernon@codeweavers.com>
+Fixes: 00a3423492bc90be ("perf symbols: Make dso__load_bfd_symbols() load PE files from debug cache only")
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Nicholas Fraser <nfraser@codeweavers.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/20210909192637.4139125-1-rbernon@codeweavers.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/symbol.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -1581,10 +1581,6 @@ int dso__load_bfd_symbols(struct dso *ds
+ if (bfd_get_flavour(abfd) == bfd_target_elf_flavour)
+ goto out_close;
+
+- section = bfd_get_section_by_name(abfd, ".text");
+- if (section)
+- dso->text_offset = section->vma - section->filepos;
+-
+ symbols_size = bfd_get_symtab_upper_bound(abfd);
+ if (symbols_size == 0) {
+ bfd_close(abfd);
+@@ -1602,6 +1598,22 @@ int dso__load_bfd_symbols(struct dso *ds
+ if (symbols_count < 0)
+ goto out_free;
+
++ section = bfd_get_section_by_name(abfd, ".text");
++ if (section) {
++ for (i = 0; i < symbols_count; ++i) {
++ if (!strcmp(bfd_asymbol_name(symbols[i]), "__ImageBase") ||
++ !strcmp(bfd_asymbol_name(symbols[i]), "__image_base__"))
++ break;
++ }
++ if (i < symbols_count) {
++ /* PE symbols can only have 4 bytes, so use .text high bits */
++ dso->text_offset = section->vma - (u32)section->vma;
++ dso->text_offset += (u32)bfd_asymbol_value(symbols[i]);
++ } else {
++ dso->text_offset = section->vma - section->filepos;
++ }
++ }
++
+ qsort(symbols, symbols_count, sizeof(asymbol *), bfd_symbols__cmpvalue);
+
+ #ifdef bfd_get_section
--- /dev/null
+From 3e11300cdfd5f1bc13a05dfc6dccf69aca5dd1dc Mon Sep 17 00:00:00 2001
+From: Michael Petlan <mpetlan@redhat.com>
+Date: Thu, 5 Aug 2021 18:06:11 +0200
+Subject: perf test: Fix bpf test sample mismatch reporting
+
+From: Michael Petlan <mpetlan@redhat.com>
+
+commit 3e11300cdfd5f1bc13a05dfc6dccf69aca5dd1dc upstream.
+
+When the expected sample count in the condition changed, the message
+needs to be changed too, otherwise we'll get:
+
+ 0x1001f2091d8: mmap mask[0]:
+ BPF filter result incorrect, expected 56, got 56 samples
+
+Fixes: 4b04e0decd2518e5 ("perf test: Fix basic bpf filtering test")
+Signed-off-by: Michael Petlan <mpetlan@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Link: https //lore.kernel.org/r/20210805160611.5542-1-mpetlan@redhat.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/tests/bpf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/tests/bpf.c
++++ b/tools/perf/tests/bpf.c
+@@ -192,7 +192,7 @@ static int do_test(struct bpf_object *ob
+ }
+
+ if (count != expect * evlist->core.nr_entries) {
+- pr_debug("BPF filter result incorrect, expected %d, got %d samples\n", expect, count);
++ pr_debug("BPF filter result incorrect, expected %d, got %d samples\n", expect * evlist->core.nr_entries, count);
+ goto out_delete_evlist;
+ }
+
--- /dev/null
+From 4a86d41404005a3c7e7b6065e8169ac6202887a9 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@kernel.org>
+Date: Fri, 10 Sep 2021 15:46:30 -0700
+Subject: perf tools: Allow build-id with trailing zeros
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+commit 4a86d41404005a3c7e7b6065e8169ac6202887a9 upstream.
+
+Currently perf saves a build-id with size but old versions assumes the
+size of 20. In case the build-id is less than 20 (like for MD5), it'd
+fill the rest with 0s.
+
+I saw a problem when old version of perf record saved a binary in the
+build-id cache and new version of perf reads the data. The symbols
+should be read from the build-id cache (as the path no longer has the
+same binary) but it failed due to mismatch in the build-id.
+
+ symsrc__init: build id mismatch for /home/namhyung/.debug/.build-id/53/e4c2f42a4c61a2d632d92a72afa08f00000000/elf.
+
+The build-id event in the data has 20 byte build-ids, but it saw a
+different size (16) when it reads the build-id of the elf file in the
+build-id cache.
+
+ $ readelf -n ~/.debug/.build-id/53/e4c2f42a4c61a2d632d92a72afa08f00000000/elf
+
+ Displaying notes found in: .note.gnu.build-id
+ Owner Data size Description
+ GNU 0x00000010 NT_GNU_BUILD_ID (unique build ID bitstring)
+ Build ID: 53e4c2f42a4c61a2d632d92a72afa08f
+
+Let's fix this by allowing trailing zeros if the size is different.
+
+Fixes: 39be8d0115b321ed ("perf tools: Pass build_id object to dso__build_id_equal()")
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/20210910224630.1084877-1-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/dso.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/tools/perf/util/dso.c
++++ b/tools/perf/util/dso.c
+@@ -1349,6 +1349,16 @@ void dso__set_build_id(struct dso *dso,
+
+ bool dso__build_id_equal(const struct dso *dso, struct build_id *bid)
+ {
++ if (dso->bid.size > bid->size && dso->bid.size == BUILD_ID_SIZE) {
++ /*
++ * For the backward compatibility, it allows a build-id has
++ * trailing zeros.
++ */
++ return !memcmp(dso->bid.data, bid->data, bid->size) &&
++ !memchr_inv(&dso->bid.data[bid->size], 0,
++ dso->bid.size - bid->size);
++ }
++
+ return dso->bid.size == bid->size &&
+ memcmp(dso->bid.data, bid->data, dso->bid.size) == 0;
+ }
--- /dev/null
+From 4a9344cd0aa4499beb3772bbecb40bb78888c0e1 Mon Sep 17 00:00:00 2001
+From: Prasad Sodagudi <psodagud@codeaurora.org>
+Date: Tue, 7 Sep 2021 04:24:23 -0700
+Subject: PM: sleep: core: Avoid setting power.must_resume to false
+
+From: Prasad Sodagudi <psodagud@codeaurora.org>
+
+commit 4a9344cd0aa4499beb3772bbecb40bb78888c0e1 upstream.
+
+There are variables(power.may_skip_resume and dev->power.must_resume)
+and DPM_FLAG_MAY_SKIP_RESUME flags to control the resume of devices after
+a system wide suspend transition.
+
+Setting the DPM_FLAG_MAY_SKIP_RESUME flag means that the driver allows
+its "noirq" and "early" resume callbacks to be skipped if the device
+can be left in suspend after a system-wide transition into the working
+state. PM core determines that the driver's "noirq" and "early" resume
+callbacks should be skipped or not with dev_pm_skip_resume() function by
+checking power.may_skip_resume variable.
+
+power.must_resume variable is getting set to false in __device_suspend()
+function without checking device's DPM_FLAG_MAY_SKIP_RESUME settings.
+In problematic scenario, where all the devices in the suspend_late
+stage are successful and some device can fail to suspend in
+suspend_noirq phase. So some devices successfully suspended in suspend_late
+stage are not getting chance to execute __device_suspend_noirq()
+to set dev->power.must_resume variable to true and not getting
+resumed in early_resume phase.
+
+Add a check for device's DPM_FLAG_MAY_SKIP_RESUME flag before
+setting power.must_resume variable in __device_suspend function.
+
+Fixes: 6e176bf8d461 ("PM: sleep: core: Do not skip callbacks in the resume phase")
+Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/power/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -1642,7 +1642,7 @@ static int __device_suspend(struct devic
+ }
+
+ dev->power.may_skip_resume = true;
+- dev->power.must_resume = false;
++ dev->power.must_resume = !dev_pm_test_driver_flags(dev, DPM_FLAG_MAY_SKIP_RESUME);
+
+ dpm_watchdog_set(&wd, dev);
+ device_lock(dev);
--- /dev/null
+From e1fbbd073137a9d63279f6bf363151a938347640 Mon Sep 17 00:00:00 2001
+From: Cyrill Gorcunov <gorcunov@gmail.com>
+Date: Tue, 7 Sep 2021 20:00:41 -0700
+Subject: prctl: allow to setup brk for et_dyn executables
+
+From: Cyrill Gorcunov <gorcunov@gmail.com>
+
+commit e1fbbd073137a9d63279f6bf363151a938347640 upstream.
+
+Keno Fischer reported that when a binray loaded via ld-linux-x the
+prctl(PR_SET_MM_MAP) doesn't allow to setup brk value because it lays
+before mm:end_data.
+
+For example a test program shows
+
+ | # ~/t
+ |
+ | start_code 401000
+ | end_code 401a15
+ | start_stack 7ffce4577dd0
+ | start_data 403e10
+ | end_data 40408c
+ | start_brk b5b000
+ | sbrk(0) b5b000
+
+and when executed via ld-linux
+
+ | # /lib64/ld-linux-x86-64.so.2 ~/t
+ |
+ | start_code 7fc25b0a4000
+ | end_code 7fc25b0c4524
+ | start_stack 7fffcc6b2400
+ | start_data 7fc25b0ce4c0
+ | end_data 7fc25b0cff98
+ | start_brk 55555710c000
+ | sbrk(0) 55555710c000
+
+This of course prevent criu from restoring such programs. Looking into
+how kernel operates with brk/start_brk inside brk() syscall I don't see
+any problem if we allow to setup brk/start_brk without checking for
+end_data. Even if someone pass some weird address here on a purpose then
+the worst possible result will be an unexpected unmapping of existing vma
+(own vma, since prctl works with the callers memory) but test for
+RLIMIT_DATA is still valid and a user won't be able to gain more memory in
+case of expanding VMAs via new values shipped with prctl call.
+
+Link: https://lkml.kernel.org/r/20210121221207.GB2174@grain
+Fixes: bbdc6076d2e5 ("binfmt_elf: move brk out of mmap when doing direct loader exec")
+Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
+Reported-by: Keno Fischer <keno@juliacomputing.com>
+Acked-by: Andrey Vagin <avagin@gmail.com>
+Tested-by: Andrey Vagin <avagin@gmail.com>
+Cc: Dmitry Safonov <0x7f454c46@gmail.com>
+Cc: Kirill Tkhai <ktkhai@virtuozzo.com>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Cc: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
+Cc: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sys.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1960,13 +1960,6 @@ static int validate_prctl_map_addr(struc
+ error = -EINVAL;
+
+ /*
+- * @brk should be after @end_data in traditional maps.
+- */
+- if (prctl_map->start_brk <= prctl_map->end_data ||
+- prctl_map->brk <= prctl_map->end_data)
+- goto out;
+-
+- /*
+ * Neither we should allow to override limits if they set.
+ */
+ if (check_data_rlimit(rlimit(RLIMIT_DATA), prctl_map->brk,
--- /dev/null
+From 2d186afd04d669fe9c48b994c41a7405a3c9f16d Mon Sep 17 00:00:00 2001
+From: Pavel Skripkin <paskripkin@gmail.com>
+Date: Tue, 7 Sep 2021 19:58:21 -0700
+Subject: profiling: fix shift-out-of-bounds bugs
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+commit 2d186afd04d669fe9c48b994c41a7405a3c9f16d upstream.
+
+Syzbot reported shift-out-of-bounds bug in profile_init().
+The problem was in incorrect prof_shift. Since prof_shift value comes from
+userspace we need to clamp this value into [0, BITS_PER_LONG -1]
+boundaries.
+
+Second possible shiht-out-of-bounds was found by Tetsuo:
+sample_step local variable in read_profile() had "unsigned int" type,
+but prof_shift allows to make a BITS_PER_LONG shift. So, to prevent
+possible shiht-out-of-bounds sample_step type was changed to
+"unsigned long".
+
+Also, "unsigned short int" will be sufficient for storing
+[0, BITS_PER_LONG] value, that's why there is no need for
+"unsigned long" prof_shift.
+
+Link: https://lkml.kernel.org/r/20210813140022.5011-1-paskripkin@gmail.com
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-and-tested-by: syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
+Suggested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/profile.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+--- a/kernel/profile.c
++++ b/kernel/profile.c
+@@ -41,7 +41,8 @@ struct profile_hit {
+ #define NR_PROFILE_GRP (NR_PROFILE_HIT/PROFILE_GRPSZ)
+
+ static atomic_t *prof_buffer;
+-static unsigned long prof_len, prof_shift;
++static unsigned long prof_len;
++static unsigned short int prof_shift;
+
+ int prof_on __read_mostly;
+ EXPORT_SYMBOL_GPL(prof_on);
+@@ -67,8 +68,8 @@ int profile_setup(char *str)
+ if (str[strlen(sleepstr)] == ',')
+ str += strlen(sleepstr) + 1;
+ if (get_option(&str, &par))
+- prof_shift = par;
+- pr_info("kernel sleep profiling enabled (shift: %ld)\n",
++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
++ pr_info("kernel sleep profiling enabled (shift: %u)\n",
+ prof_shift);
+ #else
+ pr_warn("kernel sleep profiling requires CONFIG_SCHEDSTATS\n");
+@@ -78,21 +79,21 @@ int profile_setup(char *str)
+ if (str[strlen(schedstr)] == ',')
+ str += strlen(schedstr) + 1;
+ if (get_option(&str, &par))
+- prof_shift = par;
+- pr_info("kernel schedule profiling enabled (shift: %ld)\n",
++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
++ pr_info("kernel schedule profiling enabled (shift: %u)\n",
+ prof_shift);
+ } else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
+ prof_on = KVM_PROFILING;
+ if (str[strlen(kvmstr)] == ',')
+ str += strlen(kvmstr) + 1;
+ if (get_option(&str, &par))
+- prof_shift = par;
+- pr_info("kernel KVM profiling enabled (shift: %ld)\n",
++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
++ pr_info("kernel KVM profiling enabled (shift: %u)\n",
+ prof_shift);
+ } else if (get_option(&str, &par)) {
+- prof_shift = par;
++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
+ prof_on = CPU_PROFILING;
+- pr_info("kernel profiling enabled (shift: %ld)\n",
++ pr_info("kernel profiling enabled (shift: %u)\n",
+ prof_shift);
+ }
+ return 1;
+@@ -468,7 +469,7 @@ read_profile(struct file *file, char __u
+ unsigned long p = *ppos;
+ ssize_t read;
+ char *pnt;
+- unsigned int sample_step = 1 << prof_shift;
++ unsigned long sample_step = 1UL << prof_shift;
+
+ profile_flip_buffers();
+ if (p >= (prof_len+1)*sizeof(unsigned int))
--- /dev/null
+From eb41f334589d66b9da6f2b1acf7963ef8ca8d94e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Mon, 5 Jul 2021 18:55:10 +0200
+Subject: pwm: ab8500: Fix register offset calculation to not depend on probe order
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+commit eb41f334589d66b9da6f2b1acf7963ef8ca8d94e upstream.
+
+The assumption that lead to commit 5e5da1e9fbee ("pwm: ab8500:
+Explicitly allocate pwm chip base dynamically") was wrong: The
+pwm-ab8500 devices are not directly instantiated from device tree, but
+from the ab8500 mfd driver. So the pdev->id isn't -1, but a number
+between 1 and 3. Now that pwmchip ids are always allocated dynamically,
+this cannot easily be reverted.
+
+Introduce a new member in the driver data struct that tracks the
+hardware id and use this to calculate the register offset.
+
+Side-note: Using chip->base to calculate the offset was never robust
+because if there was already a PWM with id 1 at the time ab8500-pwm.1
+was probed, the associated pwmchip would get assigned chip->base = 2 (or
+something bigger).
+
+Fixes: 5e5da1e9fbee ("pwm: ab8500: Explicitly allocate pwm chip base dynamically")
+Fixes: 6173f8f4ed9c ("pwm: Move AB8500 PWM driver to PWM framework")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pwm/pwm-ab8500.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/pwm/pwm-ab8500.c
++++ b/drivers/pwm/pwm-ab8500.c
+@@ -22,14 +22,21 @@
+
+ struct ab8500_pwm_chip {
+ struct pwm_chip chip;
++ unsigned int hwid;
+ };
+
++static struct ab8500_pwm_chip *ab8500_pwm_from_chip(struct pwm_chip *chip)
++{
++ return container_of(chip, struct ab8500_pwm_chip, chip);
++}
++
+ static int ab8500_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ const struct pwm_state *state)
+ {
+ int ret;
+ u8 reg;
+ unsigned int higher_val, lower_val;
++ struct ab8500_pwm_chip *ab8500 = ab8500_pwm_from_chip(chip);
+
+ if (state->polarity != PWM_POLARITY_NORMAL)
+ return -EINVAL;
+@@ -37,7 +44,7 @@ static int ab8500_pwm_apply(struct pwm_c
+ if (!state->enabled) {
+ ret = abx500_mask_and_set_register_interruptible(chip->dev,
+ AB8500_MISC, AB8500_PWM_OUT_CTRL7_REG,
+- 1 << (chip->base - 1), 0);
++ 1 << ab8500->hwid, 0);
+
+ if (ret < 0)
+ dev_err(chip->dev, "%s: Failed to disable PWM, Error %d\n",
+@@ -56,7 +63,7 @@ static int ab8500_pwm_apply(struct pwm_c
+ */
+ higher_val = ((state->duty_cycle & 0x0300) >> 8);
+
+- reg = AB8500_PWM_OUT_CTRL1_REG + ((chip->base - 1) * 2);
++ reg = AB8500_PWM_OUT_CTRL1_REG + (ab8500->hwid * 2);
+
+ ret = abx500_set_register_interruptible(chip->dev, AB8500_MISC,
+ reg, (u8)lower_val);
+@@ -70,7 +77,7 @@ static int ab8500_pwm_apply(struct pwm_c
+
+ ret = abx500_mask_and_set_register_interruptible(chip->dev,
+ AB8500_MISC, AB8500_PWM_OUT_CTRL7_REG,
+- 1 << (chip->base - 1), 1 << (chip->base - 1));
++ 1 << ab8500->hwid, 1 << ab8500->hwid);
+ if (ret < 0)
+ dev_err(chip->dev, "%s: Failed to enable PWM, Error %d\n",
+ pwm->label, ret);
+@@ -88,6 +95,9 @@ static int ab8500_pwm_probe(struct platf
+ struct ab8500_pwm_chip *ab8500;
+ int err;
+
++ if (pdev->id < 1 || pdev->id > 31)
++ return dev_err_probe(&pdev->dev, EINVAL, "Invalid device id %d\n", pdev->id);
++
+ /*
+ * Nothing to be done in probe, this is required to get the
+ * device which is required for ab8500 read and write
+@@ -99,6 +109,7 @@ static int ab8500_pwm_probe(struct platf
+ ab8500->chip.dev = &pdev->dev;
+ ab8500->chip.ops = &ab8500_pwm_ops;
+ ab8500->chip.npwm = 1;
++ ab8500->hwid = pdev->id - 1;
+
+ err = pwmchip_add(&ab8500->chip);
+ if (err < 0)
--- /dev/null
+From 3d2813fb17e5fd0d73c1d1442ca0192bde4af10e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Wed, 7 Jul 2021 18:27:49 +0200
+Subject: pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+commit 3d2813fb17e5fd0d73c1d1442ca0192bde4af10e upstream.
+
+This fixes a race condition: After pwmchip_add() is called there might
+already be a consumer and then modifying the hardware behind the
+consumer's back is bad. So set the default before.
+
+(Side-note: I don't know what this register setting actually does, if
+this modifies the polarity there is an inconsistency because the
+inversed polarity isn't considered if the PWM is already running during
+.probe().)
+
+Fixes: acfd92fdfb93 ("pwm: lpc32xx: Set PWM_PIN_LEVEL bit to default value")
+Cc: Sylvain Lemieux <slemieux@tycoint.com>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pwm/pwm-lpc32xx.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/pwm/pwm-lpc32xx.c
++++ b/drivers/pwm/pwm-lpc32xx.c
+@@ -117,17 +117,17 @@ static int lpc32xx_pwm_probe(struct plat
+ lpc32xx->chip.ops = &lpc32xx_pwm_ops;
+ lpc32xx->chip.npwm = 1;
+
++ /* If PWM is disabled, configure the output to the default value */
++ val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
++ val &= ~PWM_PIN_LEVEL;
++ writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
++
+ ret = pwmchip_add(&lpc32xx->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to add PWM chip, error %d\n", ret);
+ return ret;
+ }
+
+- /* When PWM is disable, configure the output to the default value */
+- val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
+- val &= ~PWM_PIN_LEVEL;
+- writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
+-
+ platform_set_drvdata(pdev, lpc32xx);
+
+ return 0;
--- /dev/null
+From 020162d6f49f2963062229814a56a89c86cbeaa8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Wed, 7 Jul 2021 18:27:50 +0200
+Subject: pwm: mxs: Don't modify HW state in .probe() after the PWM chip was registered
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+commit 020162d6f49f2963062229814a56a89c86cbeaa8 upstream.
+
+This fixes a race condition: After pwmchip_add() is called there might
+already be a consumer and then modifying the hardware behind the
+consumer's back is bad. So reset before calling pwmchip_add().
+
+Note that reseting the hardware isn't the right thing to do if the PWM
+is already running as it might e.g. disable (or even enable) a backlight
+that is supposed to be on (or off).
+
+Fixes: 4dce82c1e840 ("pwm: add pwm-mxs support")
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pwm/pwm-mxs.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/pwm/pwm-mxs.c
++++ b/drivers/pwm/pwm-mxs.c
+@@ -145,6 +145,11 @@ static int mxs_pwm_probe(struct platform
+ return ret;
+ }
+
++ /* FIXME: Only do this if the PWM isn't already running */
++ ret = stmp_reset_block(mxs->base);
++ if (ret)
++ return dev_err_probe(&pdev->dev, ret, "failed to reset PWM\n");
++
+ ret = pwmchip_add(&mxs->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to add pwm chip %d\n", ret);
+@@ -153,15 +158,7 @@ static int mxs_pwm_probe(struct platform
+
+ platform_set_drvdata(pdev, mxs);
+
+- ret = stmp_reset_block(mxs->base);
+- if (ret)
+- goto pwm_remove;
+-
+ return 0;
+-
+-pwm_remove:
+- pwmchip_remove(&mxs->chip);
+- return ret;
+ }
+
+ static int mxs_pwm_remove(struct platform_device *pdev)
rdma-hns-enable-stash-feature-of-hip09.patch
rdma-mlx5-fix-xlt_chunk_align-calculation.patch
dmaengine-acpi-avoid-comparison-gsi-with-linux-virq.patch
+perf-test-fix-bpf-test-sample-mismatch-reporting.patch
+perf-symbol-look-for-imagebase-in-pe-file-to-compute-.text-offset.patch
+perf-tools-allow-build-id-with-trailing-zeros.patch
+staging-rtl8723bs-fix-wpa_set_auth_algs-function.patch
+n64cart-fix-return-value-check-in-n64cart_probe.patch
+thermal-drivers-exynos-fix-an-error-code-in-exynos_tmu_probe.patch
+9p-trans_virtio-remove-sysfs-file-on-probe-failure.patch
+pwm-ab8500-fix-register-offset-calculation-to-not-depend-on-probe-order.patch
+prctl-allow-to-setup-brk-for-et_dyn-executables.patch
+nilfs2-use-refcount_dec_and_lock-to-fix-potential-uaf.patch
+profiling-fix-shift-out-of-bounds-bugs.patch
+pm-sleep-core-avoid-setting-power.must_resume-to-false.patch
+thermal-drivers-qcom-spmi-adc-tm5-don-t-abort-probing-if-a-sensor-is-not-used.patch
+ceph-cancel-delayed-work-instead-of-flushing-on-mdsc-teardown.patch
+pwm-lpc32xx-don-t-modify-hw-state-in-.probe-after-the-pwm-chip-was-registered.patch
+pwm-mxs-don-t-modify-hw-state-in-.probe-after-the-pwm-chip-was-registered.patch
--- /dev/null
+From b658acbf64ae38b8fca982c2929ccc0bf4eb1ea2 Mon Sep 17 00:00:00 2001
+From: Fabio Aiuto <fabioaiuto83@gmail.com>
+Date: Thu, 15 Jul 2021 16:57:00 +0200
+Subject: staging: rtl8723bs: fix wpa_set_auth_algs() function
+
+From: Fabio Aiuto <fabioaiuto83@gmail.com>
+
+commit b658acbf64ae38b8fca982c2929ccc0bf4eb1ea2 upstream.
+
+fix authentication algorithm constants.
+wpa_set_auth_algs() function contains some conditional
+statements masking the checked value with the wrong
+constants. This produces some unintentional dead code.
+Mask the value with the right macros.
+
+Fixes: 5befa937e8da ("staging: rtl8723bs: Fix IEEE80211 authentication algorithm constants.")
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Tested-on: Lenovo Ideapad MiiX 300-10IBY
+Signed-off-by: Fabio Aiuto <fabioaiuto83@gmail.com>
+Link: https://lore.kernel.org/r/20210715145700.9427-1-fabioaiuto83@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+@@ -349,16 +349,16 @@ static int wpa_set_auth_algs(struct net_
+ struct adapter *padapter = rtw_netdev_priv(dev);
+ int ret = 0;
+
+- if ((value & WLAN_AUTH_SHARED_KEY) && (value & WLAN_AUTH_OPEN)) {
++ if ((value & IW_AUTH_ALG_SHARED_KEY) && (value & IW_AUTH_ALG_OPEN_SYSTEM)) {
+ padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+ padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeAutoSwitch;
+ padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+- } else if (value & WLAN_AUTH_SHARED_KEY) {
++ } else if (value & IW_AUTH_ALG_SHARED_KEY) {
+ padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+
+ padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeShared;
+ padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Shared;
+- } else if (value & WLAN_AUTH_OPEN) {
++ } else if (value & IW_AUTH_ALG_OPEN_SYSTEM) {
+ /* padapter->securitypriv.ndisencryptstatus = Ndis802_11EncryptionDisabled; */
+ if (padapter->securitypriv.ndisauthtype < Ndis802_11AuthModeWPAPSK) {
+ padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeOpen;
--- /dev/null
+From 02d438f62c05f0d055ceeedf12a2f8796b258c08 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 10 Aug 2021 11:44:13 +0300
+Subject: thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 02d438f62c05f0d055ceeedf12a2f8796b258c08 upstream.
+
+This error path return success but it should propagate the negative
+error code from devm_clk_get().
+
+Fixes: 6c247393cfdd ("thermal: exynos: Add TMU support for Exynos7 SoC")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20210810084413.GA23810@kili
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thermal/samsung/exynos_tmu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/thermal/samsung/exynos_tmu.c
++++ b/drivers/thermal/samsung/exynos_tmu.c
+@@ -1073,6 +1073,7 @@ static int exynos_tmu_probe(struct platf
+ data->sclk = devm_clk_get(&pdev->dev, "tmu_sclk");
+ if (IS_ERR(data->sclk)) {
+ dev_err(&pdev->dev, "Failed to get sclk\n");
++ ret = PTR_ERR(data->sclk);
+ goto err_clk;
+ } else {
+ ret = clk_prepare_enable(data->sclk);
--- /dev/null
+From 70ee251ded6ba24c15537f4abb8a318e233d0d1a Mon Sep 17 00:00:00 2001
+From: Matthias Kaehlcke <mka@chromium.org>
+Date: Mon, 23 Aug 2021 13:47:30 -0700
+Subject: thermal/drivers/qcom/spmi-adc-tm5: Don't abort probing if a sensor is not used
+
+From: Matthias Kaehlcke <mka@chromium.org>
+
+commit 70ee251ded6ba24c15537f4abb8a318e233d0d1a upstream.
+
+adc_tm5_register_tzd() registers the thermal zone sensors for all
+channels of the thermal monitor. If the registration of one channel
+fails the function skips the processing of the remaining channels
+and returns an error, which results in _probe() being aborted.
+
+One of the reasons the registration could fail is that none of the
+thermal zones is using the channel/sensor, which hardly is a critical
+error (if it is an error at all). If this case is detected emit a
+warning and continue with processing the remaining channels.
+
+Fixes: ca66dca5eda6 ("thermal: qcom: add support for adc-tm5 PMIC thermal monitor")
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Reported-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20210823134726.1.I1dd23ddf77e5b3568625d80d6827653af071ce19@changeid
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thermal/qcom/qcom-spmi-adc-tm5.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/thermal/qcom/qcom-spmi-adc-tm5.c
++++ b/drivers/thermal/qcom/qcom-spmi-adc-tm5.c
+@@ -359,6 +359,12 @@ static int adc_tm5_register_tzd(struct a
+ &adc_tm->channels[i],
+ &adc_tm5_ops);
+ if (IS_ERR(tzd)) {
++ if (PTR_ERR(tzd) == -ENODEV) {
++ dev_warn(adc_tm->dev, "thermal sensor on channel %d is not used\n",
++ adc_tm->channels[i].channel);
++ continue;
++ }
++
+ dev_err(adc_tm->dev, "Error registering TZ zone for channel %d: %ld\n",
+ adc_tm->channels[i].channel, PTR_ERR(tzd));
+ return PTR_ERR(tzd);
projects / thirdparty / kernel / stable-queue.git / commitdiff
