--- /dev/null
+From 58959100f72046ba04f7c7189fa1fd10fd84a7ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 10:06:02 +0200
+Subject: ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit d7adfe5ffed9faa05f8926223086b101e14f700d ]
+
+Fix dtschema validator warnings like:
+ l2-cache@fffff000: $nodename:0:
+ 'l2-cache@fffff000' does not match '^(cache-controller|cpu)(@[0-9a-f,]+)*$'
+
+Fixes: 475dc86d08de ("arm: dts: socfpga: Add a base DTSI for Altera's Arria10 SOC")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/socfpga.dtsi | 2 +-
+ arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
+index 10d2fa183a9ff..7ee99e11508ca 100644
+--- a/arch/arm/boot/dts/socfpga.dtsi
++++ b/arch/arm/boot/dts/socfpga.dtsi
+@@ -706,7 +706,7 @@ ocram-ecc@ffd08144 {
+ };
+ };
+
+- L2: l2-cache@fffef000 {
++ L2: cache-controller@fffef000 {
+ compatible = "arm,pl310-cache";
+ reg = <0xfffef000 0x1000>;
+ interrupts = <0 38 0x04>;
+diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
+index bd1985694bcae..672e73e35228c 100644
+--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
+@@ -606,7 +606,7 @@ sdr: sdr@ffcfb100 {
+ reg = <0xffcfb100 0x80>;
+ };
+
+- L2: l2-cache@fffff000 {
++ L2: cache-controller@fffff000 {
+ compatible = "arm,pl310-cache";
+ reg = <0xfffff000 0x1000>;
+ interrupts = <0 18 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.25.1
+
--- /dev/null
+From 009864bacf5ac6865c531e86adc388707c11be54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 14:53:46 +0200
+Subject: arm64: dts: meson: add missing gxl rng clock
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 95ca6f06dd4827ff63be5154120c7a8511cd9a41 ]
+
+The peripheral clock of the RNG is missing for gxl while it is present
+for gxbb.
+
+Fixes: 1b3f6d148692 ("ARM64: dts: meson-gx: add clock CLKID_RNG0 to hwrng node")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://lore.kernel.org/r/20200617125346.1163527-1-jbrunet@baylibre.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+index 3c30579449608..3ee6c4bae08f6 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+@@ -245,6 +245,11 @@ clkc: clock-controller@0 {
+ };
+ };
+
++&hwrng {
++ clocks = <&clkc CLKID_RNG0>;
++ clock-names = "core";
++};
++
+ &i2c_A {
+ clocks = <&clkc CLKID_I2C>;
+ };
+--
+2.25.1
+
--- /dev/null
+From 3cad19d43ef10905998cd5842bcd72497c10649c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 May 2020 18:29:57 +0100
+Subject: iio:health:afe4404 Fix timestamp alignment and prevent data leak.
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit f88ecccac4be348bbcc6d056bdbc622a8955c04d ]
+
+One of a class of bugs pointed out by Lars in a recent review.
+iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
+to the size of the timestamp (8 bytes). This is not guaranteed in
+this driver which uses a 40 byte array of smaller elements on the stack.
+As Lars also noted this anti pattern can involve a leak of data to
+userspace and that indeed can happen here. We close both issues by
+moving to a suitable structure in the iio_priv() data with alignment
+explicitly requested. This data is allocated with kzalloc so no
+data can leak appart from previous readings.
+
+Fixes: 87aec56e27ef ("iio: health: Add driver for the TI AFE4404 heart monitor")
+Reported-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/health/afe4404.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c
+index 964f5231a831c..5e256b11ac877 100644
+--- a/drivers/iio/health/afe4404.c
++++ b/drivers/iio/health/afe4404.c
+@@ -91,6 +91,7 @@ static const struct reg_field afe4404_reg_fields[] = {
+ * @regulator: Pointer to the regulator for the IC
+ * @trig: IIO trigger for this device
+ * @irq: ADC_RDY line interrupt number
++ * @buffer: Used to construct a scan to push to the iio buffer.
+ */
+ struct afe4404_data {
+ struct device *dev;
+@@ -99,6 +100,7 @@ struct afe4404_data {
+ struct regulator *regulator;
+ struct iio_trigger *trig;
+ int irq;
++ s32 buffer[10] __aligned(8);
+ };
+
+ enum afe4404_chan_id {
+@@ -337,17 +339,17 @@ static irqreturn_t afe4404_trigger_handler(int irq, void *private)
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct afe4404_data *afe = iio_priv(indio_dev);
+ int ret, bit, i = 0;
+- s32 buffer[10];
+
+ for_each_set_bit(bit, indio_dev->active_scan_mask,
+ indio_dev->masklength) {
+ ret = regmap_read(afe->regmap, afe4404_channel_values[bit],
+- &buffer[i++]);
++ &afe->buffer[i++]);
+ if (ret)
+ goto err;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp);
++ iio_push_to_buffers_with_timestamp(indio_dev, afe->buffer,
++ pf->timestamp);
+ err:
+ iio_trigger_notify_done(indio_dev->trig);
+
+--
+2.25.1
+
--- /dev/null
+From cf2b0dda8572a36ccac6bed5b21e8e580ea406b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 13:44:28 +0100
+Subject: phy: sun4i-usb: fix dereference of pointer phy0 before it is null
+ checked
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 38b1927e5bf9bcad4a2e33189ef1c5569f9599ba ]
+
+Currently pointer phy0 is being dereferenced via the assignment of
+phy on the call to phy_get_drvdata before phy0 is null checked, this
+can lead to a null pointer dereference. Fix this by performing the
+null check on phy0 before the call to phy_get_drvdata. Also replace
+the phy0 == NULL check with the more usual !phy0 idiom.
+
+Addresses-Coverity: ("Dereference before null check")
+Fixes: e6f32efb1b12 ("phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20200625124428.83564-1-colin.king@canonical.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/allwinner/phy-sun4i-usb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
+index 46d60a3bf2608..d6e47dee78b5f 100644
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -549,13 +549,14 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
+ struct sun4i_usb_phy_data *data =
+ container_of(work, struct sun4i_usb_phy_data, detect.work);
+ struct phy *phy0 = data->phys[0].phy;
+- struct sun4i_usb_phy *phy = phy_get_drvdata(phy0);
++ struct sun4i_usb_phy *phy;
+ bool force_session_end, id_notify = false, vbus_notify = false;
+ int id_det, vbus_det;
+
+- if (phy0 == NULL)
++ if (!phy0)
+ return;
+
++ phy = phy_get_drvdata(phy0);
+ id_det = sun4i_usb_phy0_get_id_det(data);
+ vbus_det = sun4i_usb_phy0_get_vbus_det(data);
+
+--
+2.25.1
+
--- /dev/null
+From f7f51841bf3c3b14187617c9843f14629f69c7d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 12:34:12 +0200
+Subject: Revert "thermal: mediatek: fix register index error"
+
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+
+[ Upstream commit a8f62f183021be389561570ab5f8c701a5e70298 ]
+
+This reverts commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6
+
+The above patch is supposed to fix a register index error on mt2701. It
+is not clear if the problem solved is a hang or just an invalid value
+returned, my guess is the second. The patch introduces, though, a new
+hang on MT8173 device making them unusable. So, seems reasonable, revert
+the patch because introduces a worst issue.
+
+The reason I send a revert instead of trying to fix the issue for MT8173
+is because the information needed to fix the issue is in the datasheet
+and is not public. So I am not really able to fix it.
+
+Fixes the following bug when CONFIG_MTK_THERMAL is set on MT8173
+devices.
+
+[ 2.222488] Unable to handle kernel paging request at virtual address ffff8000125f5001
+[ 2.230421] Mem abort info:
+[ 2.233207] ESR = 0x96000021
+[ 2.236261] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 2.241571] SET = 0, FnV = 0
+[ 2.244623] EA = 0, S1PTW = 0
+[ 2.247762] Data abort info:
+[ 2.250640] ISV = 0, ISS = 0x00000021
+[ 2.254473] CM = 0, WnR = 0
+[ 2.257544] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041850000
+[ 2.264251] [ffff8000125f5001] pgd=000000013ffff003, pud=000000013fffe003, pmd=000000013fff9003, pte=006800001100b707
+[ 2.274867] Internal error: Oops: 96000021 [#1] PREEMPT SMP
+[ 2.280432] Modules linked in:
+[ 2.283483] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.7.0-rc6+ #162
+[ 2.289914] Hardware name: Google Elm (DT)
+[ 2.294003] pstate: 20000005 (nzCv daif -PAN -UAO)
+[ 2.298792] pc : mtk_read_temp+0xb8/0x1c8
+[ 2.302793] lr : mtk_read_temp+0x7c/0x1c8
+[ 2.306794] sp : ffff80001003b930
+[ 2.310100] x29: ffff80001003b930 x28: 0000000000000000
+[ 2.315404] x27: 0000000000000002 x26: ffff0000f9550b10
+[ 2.320709] x25: ffff0000f9550a80 x24: 0000000000000090
+[ 2.326014] x23: ffff80001003ba24 x22: 00000000610344c0
+[ 2.331318] x21: 0000000000002710 x20: 00000000000001f4
+[ 2.336622] x19: 0000000000030d40 x18: ffff800011742ec0
+[ 2.341926] x17: 0000000000000001 x16: 0000000000000001
+[ 2.347230] x15: ffffffffffffffff x14: ffffff0000000000
+[ 2.352535] x13: ffffffffffffffff x12: 0000000000000028
+[ 2.357839] x11: 0000000000000003 x10: ffff800011295ec8
+[ 2.363143] x9 : 000000000000291b x8 : 0000000000000002
+[ 2.368447] x7 : 00000000000000a8 x6 : 0000000000000004
+[ 2.373751] x5 : 0000000000000000 x4 : ffff800011295cb0
+[ 2.379055] x3 : 0000000000000002 x2 : ffff8000125f5001
+[ 2.384359] x1 : 0000000000000001 x0 : ffff0000f9550a80
+[ 2.389665] Call trace:
+[ 2.392105] mtk_read_temp+0xb8/0x1c8
+[ 2.395760] of_thermal_get_temp+0x2c/0x40
+[ 2.399849] thermal_zone_get_temp+0x78/0x160
+[ 2.404198] thermal_zone_device_update.part.0+0x3c/0x1f8
+[ 2.409589] thermal_zone_device_update+0x34/0x48
+[ 2.414286] of_thermal_set_mode+0x58/0x88
+[ 2.418375] thermal_zone_of_sensor_register+0x1a8/0x1d8
+[ 2.423679] devm_thermal_zone_of_sensor_register+0x64/0xb0
+[ 2.429242] mtk_thermal_probe+0x690/0x7d0
+[ 2.433333] platform_drv_probe+0x5c/0xb0
+[ 2.437335] really_probe+0xe4/0x448
+[ 2.440901] driver_probe_device+0xe8/0x140
+[ 2.445077] device_driver_attach+0x7c/0x88
+[ 2.449252] __driver_attach+0xac/0x178
+[ 2.453082] bus_for_each_dev+0x78/0xc8
+[ 2.456909] driver_attach+0x2c/0x38
+[ 2.460476] bus_add_driver+0x14c/0x230
+[ 2.464304] driver_register+0x6c/0x128
+[ 2.468131] __platform_driver_register+0x50/0x60
+[ 2.472831] mtk_thermal_driver_init+0x24/0x30
+[ 2.477268] do_one_initcall+0x50/0x298
+[ 2.481098] kernel_init_freeable+0x1ec/0x264
+[ 2.485450] kernel_init+0x1c/0x110
+[ 2.488931] ret_from_fork+0x10/0x1c
+[ 2.492502] Code: f9401081 f9400402 b8a67821 8b010042 (b9400042)
+[ 2.498599] ---[ end trace e43e3105ed27dc99 ]---
+[ 2.503367] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
+[ 2.511020] SMP: stopping secondary CPUs
+[ 2.514941] Kernel Offset: disabled
+[ 2.518421] CPU features: 0x090002,25006005
+[ 2.522595] Memory Limit: none
+[ 2.525644] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]--
+
+Cc: Michael Kao <michael.kao@mediatek.com>
+Fixes: eb9aecd90d1a ("thermal: mediatek: fix register index error")
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20200707103412.1010823-1-enric.balletbo@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/mtk_thermal.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
+index 76b92083744c9..1e61c09153c9a 100644
+--- a/drivers/thermal/mtk_thermal.c
++++ b/drivers/thermal/mtk_thermal.c
+@@ -407,8 +407,7 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank)
+ u32 raw;
+
+ for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) {
+- raw = readl(mt->thermal_base +
+- conf->msr[conf->bank_data[bank->id].sensors[i]]);
++ raw = readl(mt->thermal_base + conf->msr[i]);
+
+ temp = raw_to_mcelsius(mt,
+ conf->bank_data[bank->id].sensors[i],
+@@ -545,8 +544,7 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num,
+
+ for (i = 0; i < conf->bank_data[num].num_sensors; i++)
+ writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]],
+- mt->thermal_base +
+- conf->adcpnp[conf->bank_data[num].sensors[i]]);
++ mt->thermal_base + conf->adcpnp[i]);
+
+ writel((1 << conf->bank_data[num].num_sensors) - 1,
+ mt->thermal_base + TEMP_MONCTL0);
+--
+2.25.1
+
mmc-sdhci-do-not-enable-card-detect-interrupt-for-gp.patch
acpi-video-use-native-backlight-on-acer-aspire-5783z.patch
acpi-video-use-native-backlight-on-acer-travelmate-5.patch
+iio-health-afe4404-fix-timestamp-alignment-and-preve.patch
+phy-sun4i-usb-fix-dereference-of-pointer-phy0-before.patch
+arm64-dts-meson-add-missing-gxl-rng-clock.patch
+spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch
+usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch
+staging-comedi-verify-array-index-is-correct-before-.patch
+revert-thermal-mediatek-fix-register-index-error.patch
+arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch
--- /dev/null
+From 1e562cb44b6a5adbf205a4ad032889c20560cab3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jul 2020 16:34:34 +0200
+Subject: spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit ed7815db70d17b1741883f2da8e1d80bc2efe517 ]
+
+A SPI transfer defines the _maximum_ speed of the SPI transfer. However the
+driver doesn't take into account that the clock divider is always rounded down
+(due to integer arithmetics). This results in a too high clock rate for the SPI
+transfer.
+
+E.g.: with a mclk_rate of 24 MHz and a SPI transfer speed of 10 MHz, the
+original code calculates a reg of "0", which results in a effective divider of
+"2" and a 12 MHz clock for the SPI transfer.
+
+This patch fixes the issue by using DIV_ROUND_UP() instead of a plain
+integer division.
+
+While there simplify the divider calculation for the CDR1 case, use
+order_base_2() instead of two ilog2() calculations.
+
+Fixes: 3558fe900e8a ("spi: sunxi: Add Allwinner A31 SPI controller driver")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Link: https://lore.kernel.org/r/20200706143443.9855-2-mkl@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sun6i.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
+index 8533f4edd00af..21a22d42818c8 100644
+--- a/drivers/spi/spi-sun6i.c
++++ b/drivers/spi/spi-sun6i.c
+@@ -202,7 +202,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+ struct spi_transfer *tfr)
+ {
+ struct sun6i_spi *sspi = spi_master_get_devdata(master);
+- unsigned int mclk_rate, div, timeout;
++ unsigned int mclk_rate, div, div_cdr1, div_cdr2, timeout;
+ unsigned int start, end, tx_time;
+ unsigned int trig_level;
+ unsigned int tx_len = 0;
+@@ -291,14 +291,12 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+ * First try CDR2, and if we can't reach the expected
+ * frequency, fall back to CDR1.
+ */
+- div = mclk_rate / (2 * tfr->speed_hz);
+- if (div <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) {
+- if (div > 0)
+- div--;
+-
+- reg = SUN6I_CLK_CTL_CDR2(div) | SUN6I_CLK_CTL_DRS;
++ div_cdr1 = DIV_ROUND_UP(mclk_rate, tfr->speed_hz);
++ div_cdr2 = DIV_ROUND_UP(div_cdr1, 2);
++ if (div_cdr2 <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) {
++ reg = SUN6I_CLK_CTL_CDR2(div_cdr2 - 1) | SUN6I_CLK_CTL_DRS;
+ } else {
+- div = ilog2(mclk_rate) - ilog2(tfr->speed_hz);
++ div = min(SUN6I_CLK_CTL_CDR1_MASK, order_base_2(div_cdr1));
+ reg = SUN6I_CLK_CTL_CDR1(div);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 710cf8ec34d62cce2aa24d5fd08c958750fca076 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 13:29:36 +0300
+Subject: staging: comedi: verify array index is correct before using it
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ef75e14a6c935eec82abac07ab68e388514e39bc ]
+
+This code reads from the array before verifying that "trig" is a valid
+index. If the index is wildly out of bounds then reading from an
+invalid address could lead to an Oops.
+
+Fixes: a8c66b684efa ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
+Link: https://lore.kernel.org/r/20200709102936.GA20875@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/comedi/drivers/addi_apci_1500.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
+index 63991c49ff230..79a8799b12628 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
+@@ -465,9 +465,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
+ unsigned int lo_mask = data[5] << shift;
+ unsigned int chan_mask = hi_mask | lo_mask;
+ unsigned int old_mask = (1 << shift) - 1;
+- unsigned int pm = devpriv->pm[trig] & old_mask;
+- unsigned int pt = devpriv->pt[trig] & old_mask;
+- unsigned int pp = devpriv->pp[trig] & old_mask;
++ unsigned int pm;
++ unsigned int pt;
++ unsigned int pp;
+
+ if (trig > 1) {
+ dev_dbg(dev->class_dev,
+@@ -480,6 +480,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
+ return -EINVAL;
+ }
+
++ pm = devpriv->pm[trig] & old_mask;
++ pt = devpriv->pt[trig] & old_mask;
++ pp = devpriv->pp[trig] & old_mask;
++
+ switch (data[2]) {
+ case COMEDI_DIGITAL_TRIG_DISABLE:
+ /* clear trigger configuration */
+--
+2.25.1
+
--- /dev/null
+From 0a9b3b7d4d471ecca77230fb02429d33a6042658 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 May 2020 20:35:54 +0200
+Subject: usb: gadget: udc: atmel: fix uninitialized read in debug printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+[ Upstream commit 30517ffeb3bff842e1355cbc32f1959d9dbb5414 ]
+
+Fixed commit moved the assignment of 'req', but did not update a
+reference in the DBG() call. Use the argument as it was renamed.
+
+Fixes: 5fb694f96e7c ("usb: gadget: udc: atmel: fix possible oops when unloading module")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/atmel_usba_udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
+index 39676824a2c6f..8540e52c28a97 100644
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -912,7 +912,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+ u32 status;
+
+ DBG(DBG_GADGET | DBG_QUEUE, "ep_dequeue: %s, req %p\n",
+- ep->ep.name, req);
++ ep->ep.name, _req);
+
+ spin_lock_irqsave(&udc->lock, flags);
+
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
