Fixes for 4.9

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.9/net-dsa-bcm_sf2-fix-node-reference-count.patch b/queue-4.9/net-dsa-bcm_sf2-fix-node-reference-count.patch
new file mode 100644 (file)
index 0000000..3f99f0a
--- /dev/null
+++ b/queue-4.9/net-dsa-bcm_sf2-fix-node-reference-count.patch
@@ -0,0 +1,77 @@
+From 6b6acf5efaa59c60c49d8b837ce68e22aa48c177 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 20:42:44 -0700
+Subject: net: dsa: bcm_sf2: Fix node reference count
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 8dbe4c5d5e40fe140221024f7b16bec9f310bf70 ]
+
+of_find_node_by_name() will do an of_node_put() on the "from" argument.
+With CONFIG_OF_DYNAMIC enabled which checks for device_node reference
+counts, we would be getting a warning like this:
+
+[    6.347230] refcount_t: increment on 0; use-after-free.
+[    6.352498] WARNING: CPU: 3 PID: 77 at lib/refcount.c:156
+refcount_inc_checked+0x38/0x44
+[    6.360601] Modules linked in:
+[    6.363661] CPU: 3 PID: 77 Comm: kworker/3:1 Tainted: G        W
+5.4.46-gb78b3e9956e6 #13
+[    6.372546] Hardware name: BCM97278SV (DT)
+[    6.376649] Workqueue: events deferred_probe_work_func
+[    6.381796] pstate: 60000005 (nZCv daif -PAN -UAO)
+[    6.386595] pc : refcount_inc_checked+0x38/0x44
+[    6.391133] lr : refcount_inc_checked+0x38/0x44
+...
+[    6.478791] Call trace:
+[    6.481243]  refcount_inc_checked+0x38/0x44
+[    6.485433]  kobject_get+0x3c/0x4c
+[    6.488840]  of_node_get+0x24/0x34
+[    6.492247]  of_irq_find_parent+0x3c/0xe0
+[    6.496263]  of_irq_parse_one+0xe4/0x1d0
+[    6.500191]  irq_of_parse_and_map+0x44/0x84
+[    6.504381]  bcm_sf2_sw_probe+0x22c/0x844
+[    6.508397]  platform_drv_probe+0x58/0xa8
+[    6.512413]  really_probe+0x238/0x3fc
+[    6.516081]  driver_probe_device+0x11c/0x12c
+[    6.520358]  __device_attach_driver+0xa8/0x100
+[    6.524808]  bus_for_each_drv+0xb4/0xd0
+[    6.528650]  __device_attach+0xd0/0x164
+[    6.532493]  device_initial_probe+0x24/0x30
+[    6.536682]  bus_probe_device+0x38/0x98
+[    6.540524]  deferred_probe_work_func+0xa8/0xd4
+[    6.545061]  process_one_work+0x178/0x288
+[    6.549078]  process_scheduled_works+0x44/0x48
+[    6.553529]  worker_thread+0x218/0x270
+[    6.557285]  kthread+0xdc/0xe4
+[    6.560344]  ret_from_fork+0x10/0x18
+[    6.563925] ---[ end trace 68f65caf69bb152a ]---
+
+Fix this by adding a of_node_get() to increment the reference count
+prior to the call.
+
+Fixes: afa3b592953b ("net: dsa: bcm_sf2: Ensure correct sub-node is parsed")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 796571fccba70..84def5819d2ec 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -1039,6 +1039,8 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev)
+       spin_lock_init(&priv->indir_lock);
+       mutex_init(&priv->stats_mutex);
+ 
++      /* Balance of_node_put() done by of_find_node_by_name() */
++      of_node_get(dn);
+       ports = of_find_node_by_name(dn, "ports");
+       if (ports) {
+               bcm_sf2_identify_ports(priv, ports);
+-- 
+2.25.1
+

diff --git a/queue-4.9/series b/queue-4.9/series
index 655501a58f19976918853549cc2da633302d48fc..69eb2d8bfed25bcb146e351fe47360c3fb90d9f5 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -44,3 +44,5 @@ iio-mma8452-add-missed-iio_device_unregister-call-in-mma8452_probe.patch
 iio-pressure-zpa2326-handle-pm_runtime_get_sync-failure.patch
 iio-pressure-ms5611-fix-buffer-element-alignment.patch
 iio-health-afe4403-fix-timestamp-alignment-and-prevent-data-leak.patch
+spi-fix-initial-spi_sr-value-in-spi-fsl-dspi.patch
+net-dsa-bcm_sf2-fix-node-reference-count.patch

diff --git a/queue-4.9/spi-fix-initial-spi_sr-value-in-spi-fsl-dspi.patch b/queue-4.9/spi-fix-initial-spi_sr-value-in-spi-fsl-dspi.patch
new file mode 100644 (file)
index 0000000..4baaeff
--- /dev/null
+++ b/queue-4.9/spi-fix-initial-spi_sr-value-in-spi-fsl-dspi.patch
@@ -0,0 +1,42 @@
+From a3c17321fa3d3662dbfe59f88f19e8cfdd61896a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 22:45:06 +0100
+Subject: spi: fix initial SPI_SR value in spi-fsl-dspi
+
+From: Angelo Dureghello <angelo@sysam.it>
+
+[ Upstream commit aa54c1c9d90e6db75190813907190fadcce1bf45 ]
+
+On ColdFire mcf54418, using DSPI_DMA_MODE mode, spi transfers
+at first boot stage are not succeding:
+
+m25p80 spi0.1: unrecognized JEDEC id bytes: 00, 00, 00
+
+The reason is the SPI_SR initial value set by the driver, that
+is not clearing (not setting to 1) the RF_DF flag. After a tour
+on the dspi hw modules that use this driver(Vybrid, ColdFire and
+ls1021a) a better init value for SR register has been set.
+
+Signed-off-by: Angelo Dureghello <angelo@sysam.it>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index db3b6e9151a81..672152b49d95c 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -70,7 +70,7 @@
+ #define SPI_SR                        0x2c
+ #define SPI_SR_EOQF           0x10000000
+ #define SPI_SR_TCFQF          0x80000000
+-#define SPI_SR_CLEAR          0xdaad0000
++#define SPI_SR_CLEAR          0x9aaf0000
+ 
+ #define SPI_RSER              0x30
+ #define SPI_RSER_EOQFE                0x10000000
+-- 
+2.25.1
+