--- /dev/null
+From b97ad42dc36d54829d132bd7650fbec853875c73 Mon Sep 17 00:00:00 2001
+From: Matt Flax <flatmax@flatmax.org>
+Date: Wed, 8 May 2019 16:33:13 +1000
+Subject: ASoC : cs4265 : readable register too low
+
+[ Upstream commit f3df05c805983427319eddc2411a2105ee1757cf ]
+
+The cs4265_readable_register function stopped short of the maximum
+register.
+
+An example bug is taken from :
+https://github.com/Audio-Injector/Ultra/issues/25
+
+Where alsactl store fails with :
+Cannot read control '2,0,0,C Data Buffer,0': Input/output error
+
+This patch fixes the bug by setting the cs4265 to have readable
+registers up to the maximum hardware register CS4265_MAX_REGISTER.
+
+Signed-off-by: Matt Flax <flatmax@flatmax.org>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs4265.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
+index 93b02be3a90e..6edec2387861 100644
+--- a/sound/soc/codecs/cs4265.c
++++ b/sound/soc/codecs/cs4265.c
+@@ -60,7 +60,7 @@ static const struct reg_default cs4265_reg_defaults[] = {
+ static bool cs4265_readable_register(struct device *dev, unsigned int reg)
+ {
+ switch (reg) {
+- case CS4265_CHIP_ID ... CS4265_SPDIF_CTL2:
++ case CS4265_CHIP_ID ... CS4265_MAX_REGISTER:
+ return true;
+ default:
+ return false;
+--
+2.20.1
+
--- /dev/null
+From 03c2a9fc29c49f975cdbb45e2f5215a0980d6ecf Mon Sep 17 00:00:00 2001
+From: Yu-Hsuan Hsu <yuhsuan@chromium.org>
+Date: Tue, 4 Jun 2019 18:49:09 +0800
+Subject: ASoC: max98090: remove 24-bit format support if RJ is 0
+
+[ Upstream commit 5628c8979642a076f91ee86c3bae5ad251639af0 ]
+
+The supported formats are S16_LE and S24_LE now. However, by datasheet
+of max98090, S24_LE is only supported when it is in the right justified
+mode. We should remove 24-bit format if it is not in that mode to avoid
+triggering error.
+
+Signed-off-by: Yu-Hsuan Hsu <yuhsuan@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98090.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 3e65dc74eb33..e7aef841f87d 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1924,6 +1924,21 @@ static int max98090_configure_dmic(struct max98090_priv *max98090,
+ return 0;
+ }
+
++static int max98090_dai_startup(struct snd_pcm_substream *substream,
++ struct snd_soc_dai *dai)
++{
++ struct snd_soc_component *component = dai->component;
++ struct max98090_priv *max98090 = snd_soc_component_get_drvdata(component);
++ unsigned int fmt = max98090->dai_fmt;
++
++ /* Remove 24-bit format support if it is not in right justified mode. */
++ if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_RIGHT_J) {
++ substream->runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
++ snd_pcm_hw_constraint_msbits(substream->runtime, 0, 16, 16);
++ }
++ return 0;
++}
++
+ static int max98090_dai_hw_params(struct snd_pcm_substream *substream,
+ struct snd_pcm_hw_params *params,
+ struct snd_soc_dai *dai)
+@@ -2331,6 +2346,7 @@ EXPORT_SYMBOL_GPL(max98090_mic_detect);
+ #define MAX98090_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE)
+
+ static const struct snd_soc_dai_ops max98090_dai_ops = {
++ .startup = max98090_dai_startup,
+ .set_sysclk = max98090_dai_set_sysclk,
+ .set_fmt = max98090_dai_set_fmt,
+ .set_tdm_slot = max98090_set_tdm_slot,
+--
+2.20.1
+
--- /dev/null
+From dc21b39e405c80469cf5a8374f0075a0650efb56 Mon Sep 17 00:00:00 2001
+From: Don Brace <don.brace@microsemi.com>
+Date: Mon, 3 Jun 2019 16:43:29 -0500
+Subject: scsi: hpsa: correct ioaccel2 chaining
+
+[ Upstream commit 625d7d3518875c4d303c652a198feaa13d9f52d9 ]
+
+- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_LAST_SG for
+ the last s/g element.
+
+- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_CHAIN when
+ chaining.
+
+Reviewed-by: Bader Ali - Saleh <bader.alisaleh@microsemi.com>
+Reviewed-by: Scott Teel <scott.teel@microsemi.com>
+Reviewed-by: Matt Perricone <matt.perricone@microsemi.com>
+Signed-off-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hpsa.c | 7 ++++++-
+ drivers/scsi/hpsa_cmd.h | 1 +
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 910b795fc5eb..e0952882e132 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -4562,7 +4562,7 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h,
+ curr_sg->reserved[0] = 0;
+ curr_sg->reserved[1] = 0;
+ curr_sg->reserved[2] = 0;
+- curr_sg->chain_indicator = 0x80;
++ curr_sg->chain_indicator = IOACCEL2_CHAIN;
+
+ curr_sg = h->ioaccel2_cmd_sg_list[c->cmdindex];
+ }
+@@ -4579,6 +4579,11 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h,
+ curr_sg++;
+ }
+
++ /*
++ * Set the last s/g element bit
++ */
++ (curr_sg - 1)->chain_indicator = IOACCEL2_LAST_SG;
++
+ switch (cmd->sc_data_direction) {
+ case DMA_TO_DEVICE:
+ cp->direction &= ~IOACCEL2_DIRECTION_MASK;
+diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h
+index 26488e2a7f02..7ffde12d57d4 100644
+--- a/drivers/scsi/hpsa_cmd.h
++++ b/drivers/scsi/hpsa_cmd.h
+@@ -513,6 +513,7 @@ struct ioaccel2_sg_element {
+ u8 reserved[3];
+ u8 chain_indicator;
+ #define IOACCEL2_CHAIN 0x80
++#define IOACCEL2_LAST_SG 0x40
+ };
+
+ /*
+--
+2.20.1
+
net-check-before-dereferencing-netdev_ops-during-busy-poll.patch
bluetooth-fix-faulty-expression-for-minimum-encryption-key-size-check.patch
um-compile-with-modern-headers.patch
+asoc-cs4265-readable-register-too-low.patch
+spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch
+asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch
+usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch
+usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch
+scsi-hpsa-correct-ioaccel2-chaining.patch
--- /dev/null
+From 2dbc75b1593c23df32f2a97cefce93a63ab9befd Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 16 May 2019 15:56:56 +0800
+Subject: spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
+
+[ Upstream commit 5caaf29af5ca82d5da8bc1d0ad07d9e664ccf1d8 ]
+
+If spi_register_master fails in spi_bitbang_start
+because device_add failure, We should return the
+error code other than 0, otherwise calling
+spi_bitbang_stop may trigger NULL pointer dereference
+like this:
+
+BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0
+Read of size 8 at addr 0000000000000000 by task syz-executor.0/3661
+
+CPU: 0 PID: 3661 Comm: syz-executor.0 Not tainted 5.1.0+ #28
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+Call Trace:
+ dump_stack+0xa9/0x10e
+ ? __list_del_entry_valid+0x45/0xd0
+ ? __list_del_entry_valid+0x45/0xd0
+ __kasan_report+0x171/0x18d
+ ? __list_del_entry_valid+0x45/0xd0
+ kasan_report+0xe/0x20
+ __list_del_entry_valid+0x45/0xd0
+ spi_unregister_controller+0x99/0x1b0
+ spi_lm70llp_attach+0x3ae/0x4b0 [spi_lm70llp]
+ ? 0xffffffffc1128000
+ ? klist_next+0x131/0x1e0
+ ? driver_detach+0x40/0x40 [parport]
+ port_check+0x3b/0x50 [parport]
+ bus_for_each_dev+0x115/0x180
+ ? subsys_dev_iter_exit+0x20/0x20
+ __parport_register_driver+0x1f0/0x210 [parport]
+ ? 0xffffffffc1150000
+ do_one_initcall+0xb9/0x3b5
+ ? perf_trace_initcall_level+0x270/0x270
+ ? kasan_unpoison_shadow+0x30/0x40
+ ? kasan_unpoison_shadow+0x30/0x40
+ do_init_module+0xe0/0x330
+ load_module+0x38eb/0x4270
+ ? module_frob_arch_sections+0x20/0x20
+ ? kernel_read_file+0x188/0x3f0
+ ? find_held_lock+0x6d/0xd0
+ ? fput_many+0x1a/0xe0
+ ? __do_sys_finit_module+0x162/0x190
+ __do_sys_finit_module+0x162/0x190
+ ? __ia32_sys_init_module+0x40/0x40
+ ? __mutex_unlock_slowpath+0xb4/0x3f0
+ ? wait_for_completion+0x240/0x240
+ ? vfs_write+0x160/0x2a0
+ ? lockdep_hardirqs_off+0xb5/0x100
+ ? mark_held_locks+0x1a/0x90
+ ? do_syscall_64+0x14/0x2a0
+ do_syscall_64+0x72/0x2a0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference to master")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Axel Lin <axel.lin@ingics.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bitbang.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c
+index 3aa9e6e3dac8..4ef54436b9d4 100644
+--- a/drivers/spi/spi-bitbang.c
++++ b/drivers/spi/spi-bitbang.c
+@@ -392,7 +392,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang)
+ if (ret)
+ spi_master_put(master);
+
+- return 0;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(spi_bitbang_start);
+
+--
+2.20.1
+
--- /dev/null
+From e5781a657c2ec2a3bb6bec0551d93ee6525b52c5 Mon Sep 17 00:00:00 2001
+From: Young Xiao <92siuyang@gmail.com>
+Date: Tue, 28 May 2019 20:17:54 +0800
+Subject: usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]
+
+[ Upstream commit 62fd0e0a24abeebe2c19fce49dd5716d9b62042d ]
+
+There is no deallocation of fusb300->ep[i] elements, allocated at
+fusb300_probe.
+
+The patch adds deallocation of fusb300->ep array elements.
+
+Signed-off-by: Young Xiao <92siuyang@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fusb300_udc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c
+index 948845c90e47..351012c498c5 100644
+--- a/drivers/usb/gadget/udc/fusb300_udc.c
++++ b/drivers/usb/gadget/udc/fusb300_udc.c
+@@ -1345,12 +1345,15 @@ static const struct usb_gadget_ops fusb300_gadget_ops = {
+ static int fusb300_remove(struct platform_device *pdev)
+ {
+ struct fusb300 *fusb300 = platform_get_drvdata(pdev);
++ int i;
+
+ usb_del_gadget_udc(&fusb300->gadget);
+ iounmap(fusb300->reg);
+ free_irq(platform_get_irq(pdev, 0), fusb300);
+
+ fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req);
++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++)
++ kfree(fusb300->ep[i]);
+ kfree(fusb300);
+
+ return 0;
+@@ -1494,6 +1497,8 @@ clean_up:
+ if (fusb300->ep0_req)
+ fusb300_free_request(&fusb300->ep[0]->ep,
+ fusb300->ep0_req);
++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++)
++ kfree(fusb300->ep[i]);
+ kfree(fusb300);
+ }
+ if (reg)
+--
+2.20.1
+
--- /dev/null
+From 9f24cca802fea37e6ee9aa9cd04f8ff628bbdeb5 Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Wed, 22 May 2019 14:07:36 +0200
+Subject: usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC
+
+[ Upstream commit fbc318afadd6e7ae2252d6158cf7d0c5a2132f7d ]
+
+Gadget drivers may queue request in interrupt context. This would lead to
+a descriptor allocation in that context. In that case we would hit
+BUG_ON(in_interrupt()) in __get_vm_area_node.
+
+Also remove the unnecessary cast.
+
+Acked-by: Sylvain Lemieux <slemieux.tyco@gmail.com>
+Tested-by: James Grant <jamesg@zaltys.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/lpc32xx_udc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
+index 00b5006baf15..90d24f62bd81 100644
+--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
+@@ -964,8 +964,7 @@ static struct lpc32xx_usbd_dd_gad *udc_dd_alloc(struct lpc32xx_udc *udc)
+ dma_addr_t dma;
+ struct lpc32xx_usbd_dd_gad *dd;
+
+- dd = (struct lpc32xx_usbd_dd_gad *) dma_pool_alloc(
+- udc->dd_cache, (GFP_KERNEL | GFP_DMA), &dma);
++ dd = dma_pool_alloc(udc->dd_cache, GFP_ATOMIC | GFP_DMA, &dma);
+ if (dd)
+ dd->this_dma = dma;
+
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
