--- /dev/null
+From 9042db32aa45e592bdefc0ea18bcb25c187bb9e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 10:51:32 +0800
+Subject: ALSA: hda: Add support for Loongson 7A1000 controller
+
+From: Kaige Li <likaige@loongson.cn>
+
+[ Upstream commit 61eee4a7fc406f94e441778c3cecbbed30373c89 ]
+
+Add the new PCI ID 0x0014 0x7a07 to support Loongson 7A1000 controller.
+
+Signed-off-by: Kaige Li <likaige@loongson.cn>
+Link: https://lore.kernel.org/r/1594954292-1703-2-git-send-email-likaige@loongson.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 4c23b169ac67e..1a26940a3fd7c 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2747,6 +2747,8 @@ static const struct pci_device_id azx_ids[] = {
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_HDMI },
+ /* Zhaoxin */
+ { PCI_DEVICE(0x1d17, 0x3288), .driver_data = AZX_DRIVER_ZHAOXIN },
++ /* Loongson */
++ { PCI_DEVICE(0x0014, 0x7a07), .driver_data = AZX_DRIVER_GENERIC },
+ { 0, }
+ };
+ MODULE_DEVICE_TABLE(pci, azx_ids);
+--
+2.25.1
+
--- /dev/null
+From 72e31ed54f8a619aeacca3bf3e5796759c8bd00e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Aug 2020 23:58:34 +0800
+Subject: ALSA: hda/hdmi: Add quirk to force connectivity
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit cd72c317a0a11f64225b9a3f1fe503bb8c7327b5 ]
+
+HDMI on some platforms doesn't enable audio support because its Port
+Connectivity [31:30] is set to AC_JACK_PORT_NONE:
+Node 0x05 [Pin Complex] wcaps 0x40778d: 8-Channels Digital Amp-Out CP
+ Amp-Out caps: ofs=0x00, nsteps=0x00, stepsize=0x00, mute=1
+ Amp-Out vals: [0x00 0x00]
+ Pincap 0x0b000094: OUT Detect HBR HDMI DP
+ Pin Default 0x58560010: [N/A] Digital Out at Int HDMI
+ Conn = Digital, Color = Unknown
+ DefAssociation = 0x1, Sequence = 0x0
+ Pin-ctls: 0x40: OUT
+ Unsolicited: tag=00, enabled=0
+ Power states: D0 D3 EPSS
+ Power: setting=D0, actual=D0
+ Devices: 0
+ Connection: 3
+ 0x02 0x03* 0x04
+
+For now, use a quirk to force connectivity based on SSID. If there are
+more platforms affected by the same issue, we can eye for a more generic
+solution.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Link: https://lore.kernel.org/r/20200804155836.16252-1-kai.heng.feng@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index cd46247988e4d..b62cd3abb8273 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -160,6 +160,7 @@ struct hdmi_spec {
+
+ bool use_acomp_notifier; /* use eld_notify callback for hotplug */
+ bool acomp_registered; /* audio component registered in this driver */
++ bool force_connect; /* force connectivity */
+ struct drm_audio_component_audio_ops drm_audio_ops;
+ int (*port2pin)(struct hda_codec *, int); /* reverse port/pin mapping */
+
+@@ -1701,7 +1702,8 @@ static int hdmi_add_pin(struct hda_codec *codec, hda_nid_t pin_nid)
+ * all device entries on the same pin
+ */
+ config = snd_hda_codec_get_pincfg(codec, pin_nid);
+- if (get_defcfg_connect(config) == AC_JACK_PORT_NONE)
++ if (get_defcfg_connect(config) == AC_JACK_PORT_NONE &&
++ !spec->force_connect)
+ return 0;
+
+ /*
+@@ -1803,11 +1805,18 @@ static int hdmi_add_cvt(struct hda_codec *codec, hda_nid_t cvt_nid)
+ return 0;
+ }
+
++static const struct snd_pci_quirk force_connect_list[] = {
++ SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1),
++ {}
++};
++
+ static int hdmi_parse_codec(struct hda_codec *codec)
+ {
++ struct hdmi_spec *spec = codec->spec;
+ hda_nid_t start_nid;
+ unsigned int caps;
+ int i, nodes;
++ const struct snd_pci_quirk *q;
+
+ nodes = snd_hda_get_sub_nodes(codec, codec->core.afg, &start_nid);
+ if (!start_nid || nodes < 0) {
+@@ -1815,6 +1824,11 @@ static int hdmi_parse_codec(struct hda_codec *codec)
+ return -EINVAL;
+ }
+
++ q = snd_pci_quirk_lookup(codec->bus->pci, force_connect_list);
++
++ if (q && q->value)
++ spec->force_connect = true;
++
+ /*
+ * hdmi_add_pin() assumes total amount of converters to
+ * be known, so first discover all converters
+--
+2.25.1
+
--- /dev/null
+From ffc575e4460bea28d16ce85abc682cfd2cf2bb8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 17:53:34 +0800
+Subject: ALSA: hda/hdmi: Use force connectivity quirk on another HP desktop
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit d96f27c80b65437a7b572647ecb4717ec9a50c98 ]
+
+There's another HP desktop has buggy BIOS which flags the Port
+Connectivity bit as no connection.
+
+Apply force connectivity quirk to enable DP/HDMI audio.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Link: https://lore.kernel.org/r/20200811095336.32396-1-kai.heng.feng@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index b62cd3abb8273..f0c6d2907e396 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1806,6 +1806,7 @@ static int hdmi_add_cvt(struct hda_codec *codec, hda_nid_t cvt_nid)
+ }
+
+ static const struct snd_pci_quirk force_connect_list[] = {
++ SND_PCI_QUIRK(0x103c, 0x870f, "HP", 1),
+ SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1),
+ {}
+ };
+--
+2.25.1
+
--- /dev/null
+From 35cc219a879ce77eda3783d2c5a1102ed09b67fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2020 16:05:12 +0800
+Subject: ALSA: hda/realtek: Fix pin default on Intel NUC 8 Rugged
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit e2d2fded6bdf3f7bb40718a208140dba8b4ec574 ]
+
+The jack on Intel NUC 8 Rugged rear panel doesn't work.
+
+The spec [1] states that the jack supports both headphone and
+microphone, so override a Pin Complex which has both Amp-In and Amp-Out
+to make the jack work.
+
+Node 0x1b fits the requirement, and user confirmed the jack now works
+with new pin config.
+
+[1] https://www.intel.com/content/dam/support/us/en/documents/mini-pcs/NUC8CCH_TechProdSpec.pdf
+BugLink: https://bugs.launchpad.net/bugs/1875199
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Link: https://lore.kernel.org/r/20200807080514.15293-1-kai.heng.feng@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b10d005786d07..b767d8fce828e 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6167,6 +6167,7 @@ enum {
+ ALC269_FIXUP_CZC_L101,
+ ALC269_FIXUP_LEMOTE_A1802,
+ ALC269_FIXUP_LEMOTE_A190X,
++ ALC256_FIXUP_INTEL_NUC8_RUGGED,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -7488,6 +7489,15 @@ static const struct hda_fixup alc269_fixups[] = {
+ },
+ .chain_id = ALC269_FIXUP_DMIC,
+ },
++ [ALC256_FIXUP_INTEL_NUC8_RUGGED] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x1b, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -7787,6 +7797,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802),
+ SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X),
++ SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED),
+
+ #if 0
+ /* Below is a quirk table taken from the old code.
+--
+2.25.1
+
--- /dev/null
+From 570ba61a7adbaa010109ab6819f1a1969d2d3dce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 19:19:26 -0700
+Subject: ALSA: pci: delete repeated words in comments
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit c7fabbc51352f50cc58242a6dc3b9c1a3599849b ]
+
+Drop duplicated words in sound/pci/.
+{and, the, at}
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20200806021926.32418-1-rdunlap@infradead.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/cs46xx/cs46xx_lib.c | 2 +-
+ sound/pci/cs46xx/dsp_spos_scb_lib.c | 2 +-
+ sound/pci/hda/hda_codec.c | 2 +-
+ sound/pci/hda/hda_generic.c | 2 +-
+ sound/pci/hda/patch_sigmatel.c | 2 +-
+ sound/pci/ice1712/prodigy192.c | 2 +-
+ sound/pci/oxygen/xonar_dg.c | 2 +-
+ 7 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c
+index a080d63a9b456..4490dd7469d99 100644
+--- a/sound/pci/cs46xx/cs46xx_lib.c
++++ b/sound/pci/cs46xx/cs46xx_lib.c
+@@ -766,7 +766,7 @@ static void snd_cs46xx_set_capture_sample_rate(struct snd_cs46xx *chip, unsigned
+ rate = 48000 / 9;
+
+ /*
+- * We can not capture at at rate greater than the Input Rate (48000).
++ * We can not capture at a rate greater than the Input Rate (48000).
+ * Return an error if an attempt is made to stray outside that limit.
+ */
+ if (rate > 48000)
+diff --git a/sound/pci/cs46xx/dsp_spos_scb_lib.c b/sound/pci/cs46xx/dsp_spos_scb_lib.c
+index 6b536fc23ca62..1f90ca723f4df 100644
+--- a/sound/pci/cs46xx/dsp_spos_scb_lib.c
++++ b/sound/pci/cs46xx/dsp_spos_scb_lib.c
+@@ -1716,7 +1716,7 @@ int cs46xx_iec958_pre_open (struct snd_cs46xx *chip)
+ struct dsp_spos_instance * ins = chip->dsp_spos_instance;
+
+ if ( ins->spdif_status_out & DSP_SPDIF_STATUS_OUTPUT_ENABLED ) {
+- /* remove AsynchFGTxSCB and and PCMSerialInput_II */
++ /* remove AsynchFGTxSCB and PCMSerialInput_II */
+ cs46xx_dsp_disable_spdif_out (chip);
+
+ /* save state */
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 803978d69e3c4..ea7f16dd1f73c 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -3427,7 +3427,7 @@ EXPORT_SYMBOL_GPL(snd_hda_set_power_save);
+ * @nid: NID to check / update
+ *
+ * Check whether the given NID is in the amp list. If it's in the list,
+- * check the current AMP status, and update the the power-status according
++ * check the current AMP status, and update the power-status according
+ * to the mute status.
+ *
+ * This function is supposed to be set or called from the check_power_status
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index f4e9d9445e18f..201a3b6b0b0f6 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -813,7 +813,7 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path,
+ }
+ }
+
+-/* sync power of each widget in the the given path */
++/* sync power of each widget in the given path */
+ static hda_nid_t path_power_update(struct hda_codec *codec,
+ struct nid_path *path,
+ bool allow_powerdown)
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index a608d0486ae49..2bea11d62d3e9 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -832,7 +832,7 @@ static int stac_auto_create_beep_ctls(struct hda_codec *codec,
+ static const struct snd_kcontrol_new beep_vol_ctl =
+ HDA_CODEC_VOLUME(NULL, 0, 0, 0);
+
+- /* check for mute support for the the amp */
++ /* check for mute support for the amp */
+ if ((caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT) {
+ const struct snd_kcontrol_new *temp;
+ if (spec->anabeep_nid == nid)
+diff --git a/sound/pci/ice1712/prodigy192.c b/sound/pci/ice1712/prodigy192.c
+index 8df14f63b10df..096ec76f53046 100644
+--- a/sound/pci/ice1712/prodigy192.c
++++ b/sound/pci/ice1712/prodigy192.c
+@@ -32,7 +32,7 @@
+ * Experimentally I found out that only a combination of
+ * OCKS0=1, OCKS1=1 (128fs, 64fs output) and ice1724 -
+ * VT1724_MT_I2S_MCLK_128X=0 (256fs input) yields correct
+- * sampling rate. That means the the FPGA doubles the
++ * sampling rate. That means that the FPGA doubles the
+ * MCK01 rate.
+ *
+ * Copyright (c) 2003 Takashi Iwai <tiwai@suse.de>
+diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
+index c3f8721624cd4..b90421a1d909a 100644
+--- a/sound/pci/oxygen/xonar_dg.c
++++ b/sound/pci/oxygen/xonar_dg.c
+@@ -29,7 +29,7 @@
+ * GPIO 4 <- headphone detect
+ * GPIO 5 -> enable ADC analog circuit for the left channel
+ * GPIO 6 -> enable ADC analog circuit for the right channel
+- * GPIO 7 -> switch green rear output jack between CS4245 and and the first
++ * GPIO 7 -> switch green rear output jack between CS4245 and the first
+ * channel of CS4361 (mechanical relay)
+ * GPIO 8 -> enable output to speakers
+ *
+--
+2.25.1
+
--- /dev/null
+From e5341e5a59175838fa33c1705df4f8484881eced Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 09:30:52 +0800
+Subject: ARM: dts: ls1021a: output PPS signal on FIPER2
+
+From: Yangbo Lu <yangbo.lu@nxp.com>
+
+[ Upstream commit 5656bb3857c4904d1dec6e1b8f876c1c0337274e ]
+
+The timer fixed interval period pulse generator register
+is used to generate periodic pulses. The down count
+register loads the value programmed in the fixed period
+interval (FIPER). At every tick of the timer accumulator
+overflow, the counter decrements by the value of
+TMR_CTRL[TCLK_PERIOD]. It generates a pulse when the down
+counter value reaches zero. It reloads the down counter
+in the cycle following a pulse.
+
+To use the TMR_FIPER register to generate desired periodic
+pulses. The value should programmed is,
+desired_period - tclk_period
+
+Current tmr-fiper2 value is to generate 100us periodic pulses.
+(But the value should have been 99995, not 99990. The tclk_period is 5.)
+This patch is to generate 1 second periodic pulses with value
+999999995 programmed which is more desired by user.
+
+Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ls1021a.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
+index 760a68c163c83..b2ff27af090ec 100644
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -772,7 +772,7 @@
+ fsl,tmr-prsc = <2>;
+ fsl,tmr-add = <0xaaaaaaab>;
+ fsl,tmr-fiper1 = <999999995>;
+- fsl,tmr-fiper2 = <99990>;
++ fsl,tmr-fiper2 = <999999995>;
+ fsl,max-adj = <499999999>;
+ fsl,extts-fifo;
+ };
+--
+2.25.1
+
--- /dev/null
+From 61975201b18ebc8e576dc2ffc6f706129b22791e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jun 2020 20:59:15 +0200
+Subject: arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit e2ee9edc282961783d519c760bbaa20fed4dec38 ]
+
+The original qcom kernel changed the PDM GPIOs to be pull-down
+during sleep at some point. Reportedly this was done because
+there was some "leakage at PDM outputs during sleep":
+
+ https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=0f87e08c1cd3e6484a6f7fb3e74e37340bdcdee0
+
+I cannot say how effective this is, but everything seems to work
+fine with this change so let's apply the same to mainline just
+to be sure.
+
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Link: https://lore.kernel.org/r/20200605185916.318494-3-stephan@gerhold.net
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916-pins.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
+index 5785bf0a807ce..591f48a575353 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
+@@ -569,7 +569,7 @@
+ pins = "gpio63", "gpio64", "gpio65", "gpio66",
+ "gpio67", "gpio68";
+ drive-strength = <2>;
+- bias-disable;
++ bias-pull-down;
+ };
+ };
+ };
+--
+2.25.1
+
--- /dev/null
+From 6c9d715eacda8c5ab94cbff542355eaf242b142a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 22:37:48 -0500
+Subject: ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit c4c59b95b7f7d4cef5071b151be2dadb33f3287b ]
+
+pm_runtime_get_sync() increments the runtime PM usage counter even
+when it returns an error code, causing incorrect ref count if
+pm_runtime_put_noidle() is not called in error handling paths.
+Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
+
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Link: https://lore.kernel.org/r/20200614033749.2975-1-wu000273@umn.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/img/img-i2s-in.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/img/img-i2s-in.c b/sound/soc/img/img-i2s-in.c
+index e30b66b94bf67..0843235d73c91 100644
+--- a/sound/soc/img/img-i2s-in.c
++++ b/sound/soc/img/img-i2s-in.c
+@@ -343,8 +343,10 @@ static int img_i2s_in_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ chan_control_mask = IMG_I2S_IN_CH_CTL_CLK_TRANS_MASK;
+
+ ret = pm_runtime_get_sync(i2s->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(i2s->dev);
+ return ret;
++ }
+
+ for (i = 0; i < i2s->active_channels; i++)
+ img_i2s_in_ch_disable(i2s, i);
+--
+2.25.1
+
--- /dev/null
+From 922e4eaed4e4209ed9f3bedc72b7b9db39e11174 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 22:33:43 -0500
+Subject: ASoC: img-parallel-out: Fix a reference count leak
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit 6b9fbb073636906eee9fe4d4c05a4f445b9e2a23 ]
+
+pm_runtime_get_sync() increments the runtime PM usage counter even
+when it returns an error code, causing incorrect ref count if
+pm_runtime_put_noidle() is not called in error handling paths.
+Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
+
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Link: https://lore.kernel.org/r/20200614033344.1814-1-wu000273@umn.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/img/img-parallel-out.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/img/img-parallel-out.c b/sound/soc/img/img-parallel-out.c
+index 5ddbe3a31c2e9..4da49a42e8547 100644
+--- a/sound/soc/img/img-parallel-out.c
++++ b/sound/soc/img/img-parallel-out.c
+@@ -163,8 +163,10 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ }
+
+ ret = pm_runtime_get_sync(prl->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(prl->dev);
+ return ret;
++ }
+
+ reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL);
+ reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK) | control_set;
+--
+2.25.1
+
--- /dev/null
+From 322ed8850c263b6971e7ccf644fc37829b967325 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 16:28:04 +0300
+Subject: ASoC: intel/skl/hda - fix probe regression on systems without i915
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit ffc6d45d96f07a32700cb6b7be2d3459e63c255a ]
+
+Starting in commit cbc7a6b5a87a ("ASoC: soc-card: add
+snd_soc_card_add_dai_link()"), error value from ASoc add_dai_link() is
+no longer ignored.
+
+The generic HDA machine driver relied on the old semantics to disable
+i915 HDMI/DP audio codec at runtime. If no display codec was present,
+add_dai_link() returned an error, but this was ignored and rest of the
+card was successfully probed.
+
+Fix the problem by changing the machine driver add_dai_link() to not
+return an error in this case.
+
+Fixes: cbc7a6b5a87a ("ASoC: soc-card: add snd_soc_card_add_dai_link()")
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+BugLink: https://github.com/thesofproject/linux/issues/2261
+Link: https://lore.kernel.org/r/20200714132804.3638221-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/skl_hda_dsp_common.h | 1 +
+ sound/soc/intel/boards/skl_hda_dsp_generic.c | 17 +++++++++++------
+ 2 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/intel/boards/skl_hda_dsp_common.h b/sound/soc/intel/boards/skl_hda_dsp_common.h
+index 507750ef67f30..4b0b3959182e5 100644
+--- a/sound/soc/intel/boards/skl_hda_dsp_common.h
++++ b/sound/soc/intel/boards/skl_hda_dsp_common.h
+@@ -33,6 +33,7 @@ struct skl_hda_private {
+ int dai_index;
+ const char *platform_name;
+ bool common_hdmi_codec_drv;
++ bool idisp_codec;
+ };
+
+ extern struct snd_soc_dai_link skl_hda_be_dai_links[HDA_DSP_MAX_BE_DAI_LINKS];
+diff --git a/sound/soc/intel/boards/skl_hda_dsp_generic.c b/sound/soc/intel/boards/skl_hda_dsp_generic.c
+index 79c8947f840b9..ca4900036ead9 100644
+--- a/sound/soc/intel/boards/skl_hda_dsp_generic.c
++++ b/sound/soc/intel/boards/skl_hda_dsp_generic.c
+@@ -79,6 +79,9 @@ skl_hda_add_dai_link(struct snd_soc_card *card, struct snd_soc_dai_link *link)
+ link->platforms->name = ctx->platform_name;
+ link->nonatomic = 1;
+
++ if (!ctx->idisp_codec)
++ return 0;
++
+ if (strstr(link->name, "HDMI")) {
+ ret = skl_hda_hdmi_add_pcm(card, ctx->pcm_count);
+
+@@ -118,19 +121,20 @@ static char hda_soc_components[30];
+ static int skl_hda_fill_card_info(struct snd_soc_acpi_mach_params *mach_params)
+ {
+ struct snd_soc_card *card = &hda_soc_card;
++ struct skl_hda_private *ctx = snd_soc_card_get_drvdata(card);
+ struct snd_soc_dai_link *dai_link;
+- u32 codec_count, codec_mask, idisp_mask;
++ u32 codec_count, codec_mask;
+ int i, num_links, num_route;
+
+ codec_mask = mach_params->codec_mask;
+ codec_count = hweight_long(codec_mask);
+- idisp_mask = codec_mask & IDISP_CODEC_MASK;
++ ctx->idisp_codec = !!(codec_mask & IDISP_CODEC_MASK);
+
+ if (!codec_count || codec_count > 2 ||
+- (codec_count == 2 && !idisp_mask))
++ (codec_count == 2 && !ctx->idisp_codec))
+ return -EINVAL;
+
+- if (codec_mask == idisp_mask) {
++ if (codec_mask == IDISP_CODEC_MASK) {
+ /* topology with iDisp as the only HDA codec */
+ num_links = IDISP_DAI_COUNT + DMIC_DAI_COUNT;
+ num_route = IDISP_ROUTE_COUNT;
+@@ -152,7 +156,7 @@ static int skl_hda_fill_card_info(struct snd_soc_acpi_mach_params *mach_params)
+ num_route = ARRAY_SIZE(skl_hda_map);
+ card->dapm_widgets = skl_hda_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(skl_hda_widgets);
+- if (!idisp_mask) {
++ if (!ctx->idisp_codec) {
+ for (i = 0; i < IDISP_DAI_COUNT; i++) {
+ skl_hda_be_dai_links[i].codecs = dummy_codec;
+ skl_hda_be_dai_links[i].num_codecs =
+@@ -211,6 +215,8 @@ static int skl_hda_audio_probe(struct platform_device *pdev)
+ if (!mach)
+ return -EINVAL;
+
++ snd_soc_card_set_drvdata(&hda_soc_card, ctx);
++
+ ret = skl_hda_fill_card_info(&mach->mach_params);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Unsupported HDAudio/iDisp configuration found\n");
+@@ -223,7 +229,6 @@ static int skl_hda_audio_probe(struct platform_device *pdev)
+ ctx->common_hdmi_codec_drv = mach->mach_params.common_hdmi_codec_drv;
+
+ hda_soc_card.dev = &pdev->dev;
+- snd_soc_card_set_drvdata(&hda_soc_card, ctx);
+
+ if (mach->mach_params.dmic_num > 0) {
+ snprintf(hda_soc_components, sizeof(hda_soc_components),
+--
+2.25.1
+
--- /dev/null
+From 4b0f326aef0fc976615d4347bf5ed141776d4c41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 16:13:33 -0500
+Subject: ASoC: Intel: sof_sdw_rt711: remove properties in card remove
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit cf0418cd06ce42fcf35beb33e315b5a77e596926 ]
+
+The rt711 jack detection properties are set from the machine drivers
+during the card probe, as done in other ASoC examples.
+
+KASAN reports a use-after-free error when unbinding drivers due to a
+confusing sequence between the ACPI core, the device core and the
+SoundWire device cleanups.
+
+Rather than fixing this sequence, follow the recommendation to have
+the same caller add and remove properties, add an explicit
+device_remove_properties() in the card .remove() callback.
+
+In future patches the use of device_add/remove_properties will be
+replaced by a direct handling of a swnode, but the sequence will
+remain the same.
+
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200717211337.31956-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 1 +
+ sound/soc/intel/boards/sof_sdw_common.h | 1 +
+ sound/soc/intel/boards/sof_sdw_rt711.c | 15 +++++++++++++++
+ 3 files changed, 17 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 1bfd9613449e9..95a119a2d354e 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -184,6 +184,7 @@ static struct sof_sdw_codec_info codec_info_list[] = {
+ .direction = {true, true},
+ .dai_name = "rt711-aif1",
+ .init = sof_sdw_rt711_init,
++ .exit = sof_sdw_rt711_exit,
+ },
+ {
+ .id = 0x1308,
+diff --git a/sound/soc/intel/boards/sof_sdw_common.h b/sound/soc/intel/boards/sof_sdw_common.h
+index 69b363b8a6869..fdd2385049e1e 100644
+--- a/sound/soc/intel/boards/sof_sdw_common.h
++++ b/sound/soc/intel/boards/sof_sdw_common.h
+@@ -84,6 +84,7 @@ int sof_sdw_rt711_init(const struct snd_soc_acpi_link_adr *link,
+ struct snd_soc_dai_link *dai_links,
+ struct sof_sdw_codec_info *info,
+ bool playback);
++int sof_sdw_rt711_exit(struct device *dev, struct snd_soc_dai_link *dai_link);
+
+ /* RT700 support */
+ int sof_sdw_rt700_init(const struct snd_soc_acpi_link_adr *link,
+diff --git a/sound/soc/intel/boards/sof_sdw_rt711.c b/sound/soc/intel/boards/sof_sdw_rt711.c
+index d4d75c8dc6b78..0cb9f1c1f8676 100644
+--- a/sound/soc/intel/boards/sof_sdw_rt711.c
++++ b/sound/soc/intel/boards/sof_sdw_rt711.c
+@@ -133,6 +133,21 @@ static int rt711_rtd_init(struct snd_soc_pcm_runtime *rtd)
+ return ret;
+ }
+
++int sof_sdw_rt711_exit(struct device *dev, struct snd_soc_dai_link *dai_link)
++{
++ struct device *sdw_dev;
++
++ sdw_dev = bus_find_device_by_name(&sdw_bus_type, NULL,
++ dai_link->codecs[0].name);
++ if (!sdw_dev)
++ return -EINVAL;
++
++ device_remove_properties(sdw_dev);
++ put_device(sdw_dev);
++
++ return 0;
++}
++
+ int sof_sdw_rt711_init(const struct snd_soc_acpi_link_adr *link,
+ struct snd_soc_dai_link *dai_links,
+ struct sof_sdw_codec_info *info,
+--
+2.25.1
+
--- /dev/null
+From aa2fee6c39e855d87b211f302e76b5649235c2cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 15:44:19 -0500
+Subject: ASoC: tegra: Fix reference count leaks.
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit deca195383a6085be62cb453079e03e04d618d6e ]
+
+Calling pm_runtime_get_sync increments the counter even in case of
+failure, causing incorrect ref count if pm_runtime_put is not called in
+error handling paths. Call pm_runtime_put if pm_runtime_get_sync fails.
+
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20200613204422.24484-1-wu000273@umn.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/tegra/tegra30_ahub.c | 4 +++-
+ sound/soc/tegra/tegra30_i2s.c | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
+index 635eacbd28d47..156e3b9d613c6 100644
+--- a/sound/soc/tegra/tegra30_ahub.c
++++ b/sound/soc/tegra/tegra30_ahub.c
+@@ -643,8 +643,10 @@ static int tegra30_ahub_resume(struct device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put(dev);
+ return ret;
++ }
+ ret = regcache_sync(ahub->regmap_ahub);
+ ret |= regcache_sync(ahub->regmap_apbif);
+ pm_runtime_put(dev);
+diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
+index d59882ec48f16..db5a8587bfa4c 100644
+--- a/sound/soc/tegra/tegra30_i2s.c
++++ b/sound/soc/tegra/tegra30_i2s.c
+@@ -567,8 +567,10 @@ static int tegra30_i2s_resume(struct device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put(dev);
+ return ret;
++ }
+ ret = regcache_sync(i2s->regmap);
+ pm_runtime_put(dev);
+
+--
+2.25.1
+
--- /dev/null
+From d880e50e856362b31a3525a8985130f0df30f686 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 20:47:29 +0000
+Subject: blktrace: ensure our debugfs dir exists
+
+From: Luis Chamberlain <mcgrof@kernel.org>
+
+[ Upstream commit b431ef837e3374da0db8ff6683170359aaa0859c ]
+
+We make an assumption that a debugfs directory exists, but since
+this can fail ensure it exists before allowing blktrace setup to
+complete. Otherwise we end up stuffing blktrace files on the debugfs
+root directory. In the worst case scenario this *in theory* can create
+an eventual panic *iff* in the future a similarly named file is created
+prior on the debugfs root directory. This theoretical crash can happen
+due to a recursive removal followed by a specific dentry removal.
+
+This doesn't fix any known crash, however I have seen the files
+go into the main debugfs root directory in cases where the debugfs
+directory was not created due to other internal bugs with blktrace
+now fixed.
+
+blktrace is also completely useless without this directory, so
+this ensures to userspace we only setup blktrace if the kernel
+can stuff files where they are supposed to go into.
+
+debugfs directory creations typically aren't checked for, and we have
+maintainers doing sweep removals of these checks, but since we need this
+check to ensure proper userspace blktrace functionality we make sure
+to annotate the justification for the check.
+
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/blktrace.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 588e8e3960197..1bd6563939e59 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -536,6 +536,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ #endif
+ bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root);
+
++ /*
++ * As blktrace relies on debugfs for its interface the debugfs directory
++ * is required, contrary to the usual mantra of not checking for debugfs
++ * files or directories.
++ */
++ if (IS_ERR_OR_NULL(dir)) {
++ pr_warn("debugfs_dir not present for %s so skipping\n",
++ buts->name);
++ ret = -ENOENT;
++ goto err;
++ }
++
+ bt->dev = dev;
+ atomic_set(&bt->dropped, 0);
+ INIT_LIST_HEAD(&bt->running_list);
+--
+2.25.1
+
--- /dev/null
+From e973703324f56af414476eddf954d81a6ef920af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jun 2020 09:04:42 +0800
+Subject: btrfs: file: reserve qgroup space after the hole punch range is
+ locked
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit a7f8b1c2ac21bf081b41264c9cfd6260dffa6246 ]
+
+The incoming qgroup reserved space timing will move the data reservation
+to ordered extent completely.
+
+However in btrfs_punch_hole_lock_range() will call
+btrfs_invalidate_page(), which will clear QGROUP_RESERVED bit for the
+range.
+
+In current stage it's OK, but if we're making ordered extents handle the
+reserved space, then btrfs_punch_hole_lock_range() can clear the
+QGROUP_RESERVED bit before we submit ordered extent, leading to qgroup
+reserved space leakage.
+
+So here change the timing to make reserve data space after
+btrfs_punch_hole_lock_range().
+The new timing is fine for either current code or the new code.
+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 1523aa4eaff07..9e8f6c66788d0 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -3176,14 +3176,14 @@ reserve_space:
+ if (ret < 0)
+ goto out;
+ space_reserved = true;
+- ret = btrfs_qgroup_reserve_data(inode, &data_reserved,
+- alloc_start, bytes_to_reserve);
+- if (ret)
+- goto out;
+ ret = btrfs_punch_hole_lock_range(inode, lockstart, lockend,
+ &cached_state);
+ if (ret)
+ goto out;
++ ret = btrfs_qgroup_reserve_data(inode, &data_reserved,
++ alloc_start, bytes_to_reserve);
++ if (ret)
++ goto out;
+ ret = btrfs_prealloc_file_range(inode, mode, alloc_start,
+ alloc_end - alloc_start,
+ i_blocksize(inode),
+--
+2.25.1
+
--- /dev/null
+From e97afe1ed230347d9a4a78c518d05c3de91e7dd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 08:55:46 +0300
+Subject: btrfs: make btrfs_qgroup_check_reserved_leak take btrfs_inode
+
+From: Nikolay Borisov <nborisov@suse.com>
+
+[ Upstream commit cfdd45921571eb24073e0737fa0bd44b4218f914 ]
+
+vfs_inode is used only for the inode number everything else requires
+btrfs_inode.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ use btrfs_ino ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode.c | 2 +-
+ fs/btrfs/qgroup.c | 14 +++++++-------
+ fs/btrfs/qgroup.h | 2 +-
+ 3 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 7ba1218b1630e..d932844d0e80a 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -8640,7 +8640,7 @@ void btrfs_destroy_inode(struct inode *inode)
+ btrfs_put_ordered_extent(ordered);
+ }
+ }
+- btrfs_qgroup_check_reserved_leak(inode);
++ btrfs_qgroup_check_reserved_leak(BTRFS_I(inode));
+ inode_tree_del(inode);
+ btrfs_drop_extent_cache(BTRFS_I(inode), 0, (u64)-1, 0);
+ btrfs_inode_clear_file_extent_range(BTRFS_I(inode), 0, (u64)-1);
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 5bd4089ad0e1a..574a669894774 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -3742,7 +3742,7 @@ void btrfs_qgroup_convert_reserved_meta(struct btrfs_root *root, int num_bytes)
+ * Check qgroup reserved space leaking, normally at destroy inode
+ * time
+ */
+-void btrfs_qgroup_check_reserved_leak(struct inode *inode)
++void btrfs_qgroup_check_reserved_leak(struct btrfs_inode *inode)
+ {
+ struct extent_changeset changeset;
+ struct ulist_node *unode;
+@@ -3750,19 +3750,19 @@ void btrfs_qgroup_check_reserved_leak(struct inode *inode)
+ int ret;
+
+ extent_changeset_init(&changeset);
+- ret = clear_record_extent_bits(&BTRFS_I(inode)->io_tree, 0, (u64)-1,
++ ret = clear_record_extent_bits(&inode->io_tree, 0, (u64)-1,
+ EXTENT_QGROUP_RESERVED, &changeset);
+
+ WARN_ON(ret < 0);
+ if (WARN_ON(changeset.bytes_changed)) {
+ ULIST_ITER_INIT(&iter);
+ while ((unode = ulist_next(&changeset.range_changed, &iter))) {
+- btrfs_warn(BTRFS_I(inode)->root->fs_info,
+- "leaking qgroup reserved space, ino: %lu, start: %llu, end: %llu",
+- inode->i_ino, unode->val, unode->aux);
++ btrfs_warn(inode->root->fs_info,
++ "leaking qgroup reserved space, ino: %llu, start: %llu, end: %llu",
++ btrfs_ino(inode), unode->val, unode->aux);
+ }
+- btrfs_qgroup_free_refroot(BTRFS_I(inode)->root->fs_info,
+- BTRFS_I(inode)->root->root_key.objectid,
++ btrfs_qgroup_free_refroot(inode->root->fs_info,
++ inode->root->root_key.objectid,
+ changeset.bytes_changed, BTRFS_QGROUP_RSV_DATA);
+
+ }
+diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h
+index 1bc6544594690..406366f20cb0a 100644
+--- a/fs/btrfs/qgroup.h
++++ b/fs/btrfs/qgroup.h
+@@ -399,7 +399,7 @@ void btrfs_qgroup_free_meta_all_pertrans(struct btrfs_root *root);
+ */
+ void btrfs_qgroup_convert_reserved_meta(struct btrfs_root *root, int num_bytes);
+
+-void btrfs_qgroup_check_reserved_leak(struct inode *inode);
++void btrfs_qgroup_check_reserved_leak(struct btrfs_inode *inode);
+
+ /* btrfs_qgroup_swapped_blocks related functions */
+ void btrfs_qgroup_init_swapped_blocks(
+--
+2.25.1
+
--- /dev/null
+From b04afcfe99a4897ff064cd6b63eed03d0bb37132 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 12:44:26 +0200
+Subject: cec-api: prevent leaking memory through hole in structure
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 6c42227c3467549ddc65efe99c869021d2f4a570 ]
+
+Fix this smatch warning:
+
+drivers/media/cec/core/cec-api.c:156 cec_adap_g_log_addrs() warn: check that 'log_addrs' doesn't leak information (struct has a hole after
+'features')
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/core/cec-api.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/cec/core/cec-api.c b/drivers/media/cec/core/cec-api.c
+index 17d1cb2e5f976..f922a2196b2b7 100644
+--- a/drivers/media/cec/core/cec-api.c
++++ b/drivers/media/cec/core/cec-api.c
+@@ -147,7 +147,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap,
+ struct cec_log_addrs log_addrs;
+
+ mutex_lock(&adap->lock);
+- log_addrs = adap->log_addrs;
++ /*
++ * We use memcpy here instead of assignment since there is a
++ * hole at the end of struct cec_log_addrs that an assignment
++ * might ignore. So when we do copy_to_user() we could leak
++ * one byte of memory.
++ */
++ memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs));
+ if (!adap->is_configured)
+ memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID,
+ sizeof(log_addrs.log_addr));
+--
+2.25.1
+
--- /dev/null
+From e6e719b39d3df104920572d0cc626fae0d616f27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jul 2020 08:51:35 -0400
+Subject: ceph: do not access the kiocb after aio requests
+
+From: Xiubo Li <xiubli@redhat.com>
+
+[ Upstream commit d1d9655052606fd9078e896668ec90191372d513 ]
+
+In aio case, if the completion comes very fast just before the
+ceph_read_iter() returns to fs/aio.c, the kiocb will be freed in
+the completion callback, then if ceph_read_iter() access again
+we will potentially hit the use-after-free bug.
+
+[ jlayton: initialize direct_lock early, and use it everywhere ]
+
+URL: https://tracker.ceph.com/issues/45649
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/file.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index 160644ddaeed7..d51c3f2fdca02 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -1538,6 +1538,7 @@ static ssize_t ceph_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ struct inode *inode = file_inode(filp);
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ struct page *pinned_page = NULL;
++ bool direct_lock = iocb->ki_flags & IOCB_DIRECT;
+ ssize_t ret;
+ int want, got = 0;
+ int retry_op = 0, read = 0;
+@@ -1546,7 +1547,7 @@ again:
+ dout("aio_read %p %llx.%llx %llu~%u trying to get caps on %p\n",
+ inode, ceph_vinop(inode), iocb->ki_pos, (unsigned)len, inode);
+
+- if (iocb->ki_flags & IOCB_DIRECT)
++ if (direct_lock)
+ ceph_start_io_direct(inode);
+ else
+ ceph_start_io_read(inode);
+@@ -1603,7 +1604,7 @@ again:
+ }
+ ceph_put_cap_refs(ci, got);
+
+- if (iocb->ki_flags & IOCB_DIRECT)
++ if (direct_lock)
+ ceph_end_io_direct(inode);
+ else
+ ceph_end_io_read(inode);
+--
+2.25.1
+
--- /dev/null
+From de5c254ae466441fbfb2c2576bec10d82dfe9240 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jul 2020 01:52:48 -0400
+Subject: ceph: fix potential mdsc use-after-free crash
+
+From: Xiubo Li <xiubli@redhat.com>
+
+[ Upstream commit fa9967734227b44acb1b6918033f9122dc7825b9 ]
+
+Make sure the delayed work stopped before releasing the resources.
+
+cancel_delayed_work_sync() will only guarantee that the work finishes
+executing if the work is already in the ->worklist. That means after
+the cancel_delayed_work_sync() returns, it will leave the work requeued
+if it was rearmed at the end. That can lead to a use after free once the
+work struct is freed.
+
+Fix it by flushing the delayed work instead of trying to cancel it, and
+ensure that the work doesn't rearm if the mdsc is stopping.
+
+URL: https://tracker.ceph.com/issues/46293
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/mds_client.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 946f9a92658ab..903b6a35b321b 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -4285,6 +4285,9 @@ static void delayed_work(struct work_struct *work)
+
+ dout("mdsc delayed_work\n");
+
++ if (mdsc->stopping)
++ return;
++
+ mutex_lock(&mdsc->mutex);
+ renew_interval = mdsc->mdsmap->m_session_timeout >> 2;
+ renew_caps = time_after_eq(jiffies, HZ*renew_interval +
+@@ -4660,7 +4663,16 @@ void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc)
+ static void ceph_mdsc_stop(struct ceph_mds_client *mdsc)
+ {
+ dout("stop\n");
+- cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */
++ /*
++ * Make sure the delayed work stopped before releasing
++ * the resources.
++ *
++ * Because the cancel_delayed_work_sync() will only
++ * guarantee that the work finishes executing. But the
++ * delayed work will re-arm itself again after that.
++ */
++ flush_delayed_work(&mdsc->delayed_work);
++
+ if (mdsc->mdsmap)
+ ceph_mdsmap_destroy(mdsc->mdsmap);
+ kfree(mdsc->sessions);
+--
+2.25.1
+
--- /dev/null
+From e7635566f960b344786e1a95b6cc43270b4bcf76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Jun 2020 02:14:50 -0500
+Subject: drm/amd/display: fix ref count leak in amdgpu_drm_ioctl
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 5509ac65f2fe5aa3c0003237ec629ca55024307c ]
+
+in amdgpu_drm_ioctl the call to pm_runtime_get_sync increments the
+counter even in case of failure, leading to incorrect
+ref count. In case of failure, decrement the ref count before returning.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 126e74758a342..d73924e35a57e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1373,11 +1373,12 @@ long amdgpu_drm_ioctl(struct file *filp,
+ dev = file_priv->minor->dev;
+ ret = pm_runtime_get_sync(dev->dev);
+ if (ret < 0)
+- return ret;
++ goto out;
+
+ ret = drm_ioctl(filp, cmd, arg);
+
+ pm_runtime_mark_last_busy(dev->dev);
++out:
+ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From d2b98ac5dc2fcc2a3f26cf7f4545a61e8f109343 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Jun 2020 02:05:28 -0500
+Subject: drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit f79f94765f8c39db0b7dec1d335ab046aac03f20 ]
+
+The call to pm_runtime_get_sync increments the counter even in case of
+failure, leading to incorrect ref count.
+In case of failure, decrement the ref count before returning.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+index f355d9a752d29..a1aec205435de 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -716,8 +716,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ if (encoder) {
+@@ -854,8 +856,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ encoder = amdgpu_connector_best_single_encoder(connector);
+@@ -977,8 +981,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
+@@ -1328,8 +1334,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
+--
+2.25.1
+
--- /dev/null
+From e03d4ab1519783110bfed1f3928a82c72df568b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 14:50:02 -0400
+Subject: drm/amdgpu/fence: fix ref count leak when pm_runtime_get_sync fails
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit e520d3e0d2818aafcdf9d8b60916754d8fedc366 ]
+
+The call to pm_runtime_get_sync increments the counter even in case of
+failure, leading to incorrect ref count.
+In case of failure, decrement the ref count before returning.
+
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Acked-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+index 3414e119f0cbf..f5a6ee7c2eaa3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+@@ -754,8 +754,10 @@ static int amdgpu_debugfs_gpu_recover(struct seq_file *m, void *data)
+ int r;
+
+ r = pm_runtime_get_sync(dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return 0;
++ }
+
+ seq_printf(m, "gpu recover\n");
+ amdgpu_device_gpu_recover(adev, NULL);
+--
+2.25.1
+
--- /dev/null
+From 531f190829007eabb77196b2ca9eb720ebbb388e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jun 2020 13:46:22 +0800
+Subject: drm/amdgpu: fix RAS memory leak in error case
+
+From: Guchun Chen <guchun.chen@amd.com>
+
+[ Upstream commit 5e91160ac0b5cfbbaeb62cbff8b069262095f744 ]
+
+RAS context memory needs to freed in failure case.
+
+Signed-off-by: Guchun Chen <guchun.chen@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index 50fe08bf2f727..20a7d75b2eb88 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -1914,9 +1914,8 @@ int amdgpu_ras_init(struct amdgpu_device *adev)
+ amdgpu_ras_check_supported(adev, &con->hw_supported,
+ &con->supported);
+ if (!con->hw_supported) {
+- amdgpu_ras_set_context(adev, NULL);
+- kfree(con);
+- return 0;
++ r = 0;
++ goto err_out;
+ }
+
+ con->features = 0;
+@@ -1927,29 +1926,31 @@ int amdgpu_ras_init(struct amdgpu_device *adev)
+ if (adev->nbio.funcs->init_ras_controller_interrupt) {
+ r = adev->nbio.funcs->init_ras_controller_interrupt(adev);
+ if (r)
+- return r;
++ goto err_out;
+ }
+
+ if (adev->nbio.funcs->init_ras_err_event_athub_interrupt) {
+ r = adev->nbio.funcs->init_ras_err_event_athub_interrupt(adev);
+ if (r)
+- return r;
++ goto err_out;
+ }
+
+ amdgpu_ras_mask &= AMDGPU_RAS_BLOCK_MASK;
+
+- if (amdgpu_ras_fs_init(adev))
+- goto fs_out;
++ if (amdgpu_ras_fs_init(adev)) {
++ r = -EINVAL;
++ goto err_out;
++ }
+
+ dev_info(adev->dev, "RAS INFO: ras initialized successfully, "
+ "hardware ability[%x] ras_mask[%x]\n",
+ con->hw_supported, con->supported);
+ return 0;
+-fs_out:
++err_out:
+ amdgpu_ras_set_context(adev, NULL);
+ kfree(con);
+
+- return -EINVAL;
++ return r;
+ }
+
+ /* helper function to handle common stuff in ip late init phase */
+--
+2.25.1
+
--- /dev/null
+From c25dd45f8181deeccee1d0fd3d6bb3c408bfe1fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Jun 2020 02:09:44 -0500
+Subject: drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit e008fa6fb41544b63973a529b704ef342f47cc65 ]
+
+in amdgpu_display_crtc_set_config, the call to pm_runtime_get_sync
+increments the counter even in case of failure, leading to incorrect
+ref count. In case of failure, decrement the ref count before returning.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+index f7143d927b6d8..5e51f0acf744f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+@@ -282,7 +282,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
+
+ ret = pm_runtime_get_sync(dev->dev);
+ if (ret < 0)
+- return ret;
++ goto out;
+
+ ret = drm_crtc_helper_set_config(set, ctx);
+
+@@ -297,7 +297,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
+ take the current one */
+ if (active && !adev->have_disp_power_ref) {
+ adev->have_disp_power_ref = true;
+- return ret;
++ goto out;
+ }
+ /* if we have no active crtcs, then drop the power ref
+ we got before */
+@@ -306,6 +306,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
+ adev->have_disp_power_ref = false;
+ }
+
++out:
+ /* drop the power reference we got coming in here */
+ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
+--
+2.25.1
+
--- /dev/null
+From d1ab7e33ddb9882731b9fc3ac02cd11fad29cbd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Jun 2020 02:12:29 -0500
+Subject: drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 9ba8923cbbe11564dd1bf9f3602add9a9cfbb5c6 ]
+
+in amdgpu_driver_open_kms the call to pm_runtime_get_sync increments the
+counter even in case of failure, leading to incorrect
+ref count. In case of failure, decrement the ref count before returning.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 21292098bc023..0c49ab17be303 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -992,7 +992,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
+
+ r = pm_runtime_get_sync(dev->dev);
+ if (r < 0)
+- return r;
++ goto pm_put;
+
+ fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
+ if (unlikely(!fpriv)) {
+@@ -1043,6 +1043,7 @@ error_pasid:
+
+ out_suspend:
+ pm_runtime_mark_last_busy(dev->dev);
++pm_put:
+ pm_runtime_put_autosuspend(dev->dev);
+
+ return r;
+--
+2.25.1
+
--- /dev/null
+From eafa0ef2a4064de5b8cb0b190b65c642fb17f1ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 14:43:08 -0400
+Subject: drm/amdgpu/pm: fix ref count leak when pm_runtime_get_sync fails
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 66429300e1bd9cdfbe96cfc475e4964db2a36921 ]
+
+The call to pm_runtime_get_sync increments the counter even in case of
+failure, leading to incorrect ref count.
+In case of failure, decrement the ref count before returning.
+
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 220 ++++++++++++++++++-------
+ 1 file changed, 165 insertions(+), 55 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+index 02e6f8c4dde08..459b81fc5aef4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+@@ -167,8 +167,10 @@ static ssize_t amdgpu_get_power_dpm_state(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ if (adev->smu.ppt_funcs->get_current_power_state)
+@@ -212,8 +214,10 @@ static ssize_t amdgpu_set_power_dpm_state(struct device *dev,
+ return -EINVAL;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ mutex_lock(&adev->pm.mutex);
+@@ -307,8 +311,10 @@ static ssize_t amdgpu_get_power_dpm_force_performance_level(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ level = smu_get_performance_level(&adev->smu);
+@@ -369,8 +375,10 @@ static ssize_t amdgpu_set_power_dpm_force_performance_level(struct device *dev,
+ }
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ current_level = smu_get_performance_level(&adev->smu);
+@@ -449,8 +457,10 @@ static ssize_t amdgpu_get_pp_num_states(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ ret = smu_get_power_num_states(&adev->smu, &data);
+@@ -491,8 +501,10 @@ static ssize_t amdgpu_get_pp_cur_state(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ pm = smu_get_current_power_state(smu);
+@@ -567,8 +579,10 @@ static ssize_t amdgpu_set_pp_force_state(struct device *dev,
+ state = data.states[idx];
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ /* only set user selected power states */
+ if (state != POWER_STATE_TYPE_INTERNAL_BOOT &&
+@@ -608,8 +622,10 @@ static ssize_t amdgpu_get_pp_table(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ size = smu_sys_get_pp_table(&adev->smu, (void **)&table);
+@@ -650,8 +666,10 @@ static ssize_t amdgpu_set_pp_table(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ ret = smu_sys_set_pp_table(&adev->smu, (void *)buf, count);
+@@ -790,8 +808,10 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
+ }
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ ret = smu_od_edit_dpm_table(&adev->smu, type,
+@@ -847,8 +867,10 @@ static ssize_t amdgpu_get_pp_od_clk_voltage(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ size = smu_print_clk_levels(&adev->smu, SMU_OD_SCLK, buf);
+@@ -905,8 +927,10 @@ static ssize_t amdgpu_set_pp_features(struct device *dev,
+ pr_debug("featuremask = 0x%llx\n", featuremask);
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ ret = smu_sys_set_pp_feature_mask(&adev->smu, featuremask);
+@@ -942,8 +966,10 @@ static ssize_t amdgpu_get_pp_features(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ size = smu_sys_get_pp_feature_mask(&adev->smu, buf);
+@@ -1001,8 +1027,10 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ size = smu_print_clk_levels(&adev->smu, SMU_SCLK, buf);
+@@ -1071,8 +1099,10 @@ static ssize_t amdgpu_set_pp_dpm_sclk(struct device *dev,
+ return ret;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ ret = smu_force_clk_levels(&adev->smu, SMU_SCLK, mask, true);
+@@ -1101,8 +1131,10 @@ static ssize_t amdgpu_get_pp_dpm_mclk(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ size = smu_print_clk_levels(&adev->smu, SMU_MCLK, buf);
+@@ -1135,8 +1167,10 @@ static ssize_t amdgpu_set_pp_dpm_mclk(struct device *dev,
+ return ret;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ ret = smu_force_clk_levels(&adev->smu, SMU_MCLK, mask, true);
+@@ -1165,8 +1199,10 @@ static ssize_t amdgpu_get_pp_dpm_socclk(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ size = smu_print_clk_levels(&adev->smu, SMU_SOCCLK, buf);
+@@ -1199,8 +1235,10 @@ static ssize_t amdgpu_set_pp_dpm_socclk(struct device *dev,
+ return ret;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ ret = smu_force_clk_levels(&adev->smu, SMU_SOCCLK, mask, true);
+@@ -1231,8 +1269,10 @@ static ssize_t amdgpu_get_pp_dpm_fclk(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ size = smu_print_clk_levels(&adev->smu, SMU_FCLK, buf);
+@@ -1265,8 +1305,10 @@ static ssize_t amdgpu_set_pp_dpm_fclk(struct device *dev,
+ return ret;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ ret = smu_force_clk_levels(&adev->smu, SMU_FCLK, mask, true);
+@@ -1297,8 +1339,10 @@ static ssize_t amdgpu_get_pp_dpm_dcefclk(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ size = smu_print_clk_levels(&adev->smu, SMU_DCEFCLK, buf);
+@@ -1331,8 +1375,10 @@ static ssize_t amdgpu_set_pp_dpm_dcefclk(struct device *dev,
+ return ret;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ ret = smu_force_clk_levels(&adev->smu, SMU_DCEFCLK, mask, true);
+@@ -1363,8 +1409,10 @@ static ssize_t amdgpu_get_pp_dpm_pcie(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ size = smu_print_clk_levels(&adev->smu, SMU_PCIE, buf);
+@@ -1397,8 +1445,10 @@ static ssize_t amdgpu_set_pp_dpm_pcie(struct device *dev,
+ return ret;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ ret = smu_force_clk_levels(&adev->smu, SMU_PCIE, mask, true);
+@@ -1429,8 +1479,10 @@ static ssize_t amdgpu_get_pp_sclk_od(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ value = smu_get_od_percentage(&(adev->smu), SMU_OD_SCLK);
+@@ -1462,8 +1514,10 @@ static ssize_t amdgpu_set_pp_sclk_od(struct device *dev,
+ return -EINVAL;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ value = smu_set_od_percentage(&(adev->smu), SMU_OD_SCLK, (uint32_t)value);
+@@ -1498,8 +1552,10 @@ static ssize_t amdgpu_get_pp_mclk_od(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ value = smu_get_od_percentage(&(adev->smu), SMU_OD_MCLK);
+@@ -1531,8 +1587,10 @@ static ssize_t amdgpu_set_pp_mclk_od(struct device *dev,
+ return -EINVAL;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ value = smu_set_od_percentage(&(adev->smu), SMU_OD_MCLK, (uint32_t)value);
+@@ -1587,8 +1645,10 @@ static ssize_t amdgpu_get_pp_power_profile_mode(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ size = smu_get_power_profile_mode(&adev->smu, buf);
+@@ -1650,8 +1710,10 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev,
+ parameter[parameter_size] = profile_mode;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev))
+ ret = smu_set_power_profile_mode(&adev->smu, parameter, parameter_size, true);
+@@ -1687,8 +1749,10 @@ static ssize_t amdgpu_get_gpu_busy_percent(struct device *dev,
+ return -EPERM;
+
+ r = pm_runtime_get_sync(ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return r;
++ }
+
+ /* read the IP busy sensor */
+ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_GPU_LOAD,
+@@ -1723,8 +1787,10 @@ static ssize_t amdgpu_get_mem_busy_percent(struct device *dev,
+ return -EPERM;
+
+ r = pm_runtime_get_sync(ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return r;
++ }
+
+ /* read the IP busy sensor */
+ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_MEM_LOAD,
+@@ -1770,8 +1836,10 @@ static ssize_t amdgpu_get_pcie_bw(struct device *dev,
+ return -ENODATA;
+
+ ret = pm_runtime_get_sync(ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(ddev->dev);
+ return ret;
++ }
+
+ amdgpu_asic_get_pcie_usage(adev, &count0, &count1);
+
+@@ -2003,8 +2071,10 @@ static ssize_t amdgpu_hwmon_show_temp(struct device *dev,
+ return -EINVAL;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ switch (channel) {
+ case PP_TEMP_JUNCTION:
+@@ -2134,8 +2204,10 @@ static ssize_t amdgpu_hwmon_get_pwm1_enable(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(adev->ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ pwm_mode = smu_get_fan_control_mode(&adev->smu);
+@@ -2172,8 +2244,10 @@ static ssize_t amdgpu_hwmon_set_pwm1_enable(struct device *dev,
+ return err;
+
+ ret = pm_runtime_get_sync(adev->ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ smu_set_fan_control_mode(&adev->smu, value);
+@@ -2220,8 +2294,10 @@ static ssize_t amdgpu_hwmon_set_pwm1(struct device *dev,
+ return -EPERM;
+
+ err = pm_runtime_get_sync(adev->ddev->dev);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return err;
++ }
+
+ if (is_support_sw_smu(adev))
+ pwm_mode = smu_get_fan_control_mode(&adev->smu);
+@@ -2272,8 +2348,10 @@ static ssize_t amdgpu_hwmon_get_pwm1(struct device *dev,
+ return -EPERM;
+
+ err = pm_runtime_get_sync(adev->ddev->dev);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return err;
++ }
+
+ if (is_support_sw_smu(adev))
+ err = smu_get_fan_speed_percent(&adev->smu, &speed);
+@@ -2305,8 +2383,10 @@ static ssize_t amdgpu_hwmon_get_fan1_input(struct device *dev,
+ return -EPERM;
+
+ err = pm_runtime_get_sync(adev->ddev->dev);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return err;
++ }
+
+ if (is_support_sw_smu(adev))
+ err = smu_get_fan_speed_rpm(&adev->smu, &speed);
+@@ -2337,8 +2417,10 @@ static ssize_t amdgpu_hwmon_get_fan1_min(struct device *dev,
+ return -EPERM;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_MIN_FAN_RPM,
+ (void *)&min_rpm, &size);
+@@ -2365,8 +2447,10 @@ static ssize_t amdgpu_hwmon_get_fan1_max(struct device *dev,
+ return -EPERM;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_MAX_FAN_RPM,
+ (void *)&max_rpm, &size);
+@@ -2392,8 +2476,10 @@ static ssize_t amdgpu_hwmon_get_fan1_target(struct device *dev,
+ return -EPERM;
+
+ err = pm_runtime_get_sync(adev->ddev->dev);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return err;
++ }
+
+ if (is_support_sw_smu(adev))
+ err = smu_get_fan_speed_rpm(&adev->smu, &rpm);
+@@ -2424,8 +2510,10 @@ static ssize_t amdgpu_hwmon_set_fan1_target(struct device *dev,
+ return -EPERM;
+
+ err = pm_runtime_get_sync(adev->ddev->dev);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return err;
++ }
+
+ if (is_support_sw_smu(adev))
+ pwm_mode = smu_get_fan_control_mode(&adev->smu);
+@@ -2473,8 +2561,10 @@ static ssize_t amdgpu_hwmon_get_fan1_enable(struct device *dev,
+ return -EPERM;
+
+ ret = pm_runtime_get_sync(adev->ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ pwm_mode = smu_get_fan_control_mode(&adev->smu);
+@@ -2519,8 +2609,10 @@ static ssize_t amdgpu_hwmon_set_fan1_enable(struct device *dev,
+ return -EINVAL;
+
+ err = pm_runtime_get_sync(adev->ddev->dev);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return err;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ smu_set_fan_control_mode(&adev->smu, pwm_mode);
+@@ -2551,8 +2643,10 @@ static ssize_t amdgpu_hwmon_show_vddgfx(struct device *dev,
+ return -EPERM;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ /* get the voltage */
+ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_VDDGFX,
+@@ -2590,8 +2684,10 @@ static ssize_t amdgpu_hwmon_show_vddnb(struct device *dev,
+ return -EINVAL;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ /* get the voltage */
+ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_VDDNB,
+@@ -2626,8 +2722,10 @@ static ssize_t amdgpu_hwmon_show_power_avg(struct device *dev,
+ return -EPERM;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ /* get the voltage */
+ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_GPU_POWER,
+@@ -2665,8 +2763,10 @@ static ssize_t amdgpu_hwmon_show_power_cap_max(struct device *dev,
+ return -EPERM;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ smu_get_power_limit(&adev->smu, &limit, true, true);
+@@ -2697,8 +2797,10 @@ static ssize_t amdgpu_hwmon_show_power_cap(struct device *dev,
+ return -EPERM;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ smu_get_power_limit(&adev->smu, &limit, false, true);
+@@ -2740,8 +2842,10 @@ static ssize_t amdgpu_hwmon_set_power_cap(struct device *dev,
+
+
+ err = pm_runtime_get_sync(adev->ddev->dev);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return err;
++ }
+
+ if (is_support_sw_smu(adev))
+ err = smu_set_power_limit(&adev->smu, value);
+@@ -2771,8 +2875,10 @@ static ssize_t amdgpu_hwmon_show_sclk(struct device *dev,
+ return -EPERM;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ /* get the sclk */
+ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_GFX_SCLK,
+@@ -2806,8 +2912,10 @@ static ssize_t amdgpu_hwmon_show_mclk(struct device *dev,
+ return -EPERM;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ /* get the sclk */
+ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_GFX_MCLK,
+@@ -3669,8 +3777,10 @@ static int amdgpu_debugfs_pm_info(struct seq_file *m, void *data)
+ return -EPERM;
+
+ r = pm_runtime_get_sync(dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return r;
++ }
+
+ amdgpu_device_ip_get_clockgating_state(adev, &flags);
+ seq_printf(m, "Clock Gating Flags Mask: 0x%x\n", flags);
+--
+2.25.1
+
--- /dev/null
+From 631bc3a498d79f724444a60a8f6c8ab20263fb97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 14:52:07 -0400
+Subject: drm/amdkfd: fix ref count leak when pm_runtime_get_sync fails
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 1c1ada37af6ee6fb9cfc8da6a56cc83208cd8d6f ]
+
+The call to pm_runtime_get_sync increments the counter even in case of
+failure, leading to incorrect ref count.
+In case of failure, decrement the ref count before returning.
+
+Reviewed-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_process.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+index 0e0c42e9f6a31..6520a920cad4a 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+@@ -1003,8 +1003,10 @@ struct kfd_process_device *kfd_bind_process_to_device(struct kfd_dev *dev,
+ */
+ if (!pdd->runtime_inuse) {
+ err = pm_runtime_get_sync(dev->ddev->dev);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put_autosuspend(dev->ddev->dev);
+ return ERR_PTR(err);
++ }
+ }
+
+ err = kfd_iommu_bind_process_to_device(pdd);
+--
+2.25.1
+
--- /dev/null
+From d98f8b3cf6197213658eb0b459a1b8506220cf10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 14:32:26 -0500
+Subject: drm/amdkfd: Fix reference count leaks.
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit 20eca0123a35305e38b344d571cf32768854168c ]
+
+kobject_init_and_add() takes reference even when it fails.
+If this function returns an error, kobject_put() must be called to
+properly clean up the memory associated with the object.
+
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+index bb77f7af2b6d9..dc3c4149f8600 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -632,8 +632,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
+
+ ret = kobject_init_and_add(dev->kobj_node, &node_type,
+ sys_props.kobj_nodes, "%d", id);
+- if (ret < 0)
++ if (ret < 0) {
++ kobject_put(dev->kobj_node);
+ return ret;
++ }
+
+ dev->kobj_mem = kobject_create_and_add("mem_banks", dev->kobj_node);
+ if (!dev->kobj_mem)
+@@ -680,8 +682,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
+ return -ENOMEM;
+ ret = kobject_init_and_add(mem->kobj, &mem_type,
+ dev->kobj_mem, "%d", i);
+- if (ret < 0)
++ if (ret < 0) {
++ kobject_put(mem->kobj);
+ return ret;
++ }
+
+ mem->attr.name = "properties";
+ mem->attr.mode = KFD_SYSFS_FILE_MODE;
+@@ -699,8 +703,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
+ return -ENOMEM;
+ ret = kobject_init_and_add(cache->kobj, &cache_type,
+ dev->kobj_cache, "%d", i);
+- if (ret < 0)
++ if (ret < 0) {
++ kobject_put(cache->kobj);
+ return ret;
++ }
+
+ cache->attr.name = "properties";
+ cache->attr.mode = KFD_SYSFS_FILE_MODE;
+@@ -718,8 +724,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
+ return -ENOMEM;
+ ret = kobject_init_and_add(iolink->kobj, &iolink_type,
+ dev->kobj_iolink, "%d", i);
+- if (ret < 0)
++ if (ret < 0) {
++ kobject_put(iolink->kobj);
+ return ret;
++ }
+
+ iolink->attr.name = "properties";
+ iolink->attr.mode = KFD_SYSFS_FILE_MODE;
+@@ -798,8 +806,10 @@ static int kfd_topology_update_sysfs(void)
+ ret = kobject_init_and_add(sys_props.kobj_topology,
+ &sysprops_type, &kfd_device->kobj,
+ "topology");
+- if (ret < 0)
++ if (ret < 0) {
++ kobject_put(sys_props.kobj_topology);
+ return ret;
++ }
+
+ sys_props.kobj_nodes = kobject_create_and_add("nodes",
+ sys_props.kobj_topology);
+--
+2.25.1
+
--- /dev/null
+From 2f3de792f7ac9c3bd630c504bb9745a6c0373724 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 20:33:42 -0500
+Subject: drm/nouveau/drm/noveau: fix reference count leak in
+ nouveau_fbcon_open
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit bfad51c7633325b5d4b32444efe04329d53297b2 ]
+
+nouveau_fbcon_open() calls calls pm_runtime_get_sync() that
+increments the reference count. In case of failure, decrement the
+ref count before returning the error.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_fbcon.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+index d5c23d1c20d88..44e515bbbb444 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+@@ -189,8 +189,10 @@ nouveau_fbcon_open(struct fb_info *info, int user)
+ struct nouveau_fbdev *fbcon = info->par;
+ struct nouveau_drm *drm = nouveau_drm(fbcon->helper.dev);
+ int ret = pm_runtime_get_sync(drm->dev->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put(drm->dev->dev);
+ return ret;
++ }
+ return 0;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 1c9c0d066ab397d99fab53315752379da1f9f630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 20:22:23 -0500
+Subject: drm/nouveau: Fix reference count leak in nouveau_connector_detect
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 990a1162986e8eff7ca18cc5a0e03b4304392ae2 ]
+
+nouveau_connector_detect() calls pm_runtime_get_sync and in turn
+increments the reference count. In case of failure, decrement the
+ref count before returning the error.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_connector.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index 1b383ae0248f3..ef8ddbe445812 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -572,8 +572,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
+ pm_runtime_get_noresume(dev->dev);
+ } else {
+ ret = pm_runtime_get_sync(dev->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return conn_status;
++ }
+ }
+
+ nv_encoder = nouveau_connector_ddc_detect(connector);
+--
+2.25.1
+
--- /dev/null
+From f75d3e4d91455bd795dfe9dd9a1f7a5cf307a5df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 20:29:18 -0500
+Subject: drm/nouveau: fix reference count leak in nv50_disp_atomic_commit
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit a2cdf39536b0d21fb06113f5e16692513d7bcb9c ]
+
+nv50_disp_atomic_commit() calls calls pm_runtime_get_sync and in turn
+increments the reference count. In case of failure, decrement the
+ref count before returning the error.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index 800b7757252e3..d2c2d102e7329 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -2160,8 +2160,10 @@ nv50_disp_atomic_commit(struct drm_device *dev,
+ int ret, i;
+
+ ret = pm_runtime_get_sync(dev->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
++ }
+
+ ret = drm_atomic_helper_setup_commit(state, nonblock);
+ if (ret)
+--
+2.25.1
+
--- /dev/null
+From 35e42c5087cc6f9ea0f4b8ba13dd994e8690977a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 20:55:39 -0500
+Subject: drm/radeon: fix multiple reference count leak
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 6f2e8acdb48ed166b65d47837c31b177460491ec ]
+
+On calling pm_runtime_get_sync() the reference count of the device
+is incremented. In case of failure, decrement the
+reference count before returning the error.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index fe12d9d91d7a5..e308344344425 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -879,8 +879,10 @@ radeon_lvds_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ if (encoder) {
+@@ -1025,8 +1027,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ encoder = radeon_best_single_encoder(connector);
+@@ -1163,8 +1167,10 @@ radeon_tv_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ encoder = radeon_best_single_encoder(connector);
+@@ -1247,8 +1253,10 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ if (radeon_connector->detected_hpd_without_ddc) {
+@@ -1657,8 +1665,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ if (!force && radeon_check_hpd_status_unchanged(connector)) {
+--
+2.25.1
+
--- /dev/null
+From a480d9d6ce8022b5a75f9879ca59cf995980ede3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 14:25:11 -0400
+Subject: EDAC/ie31200: Fallback if host bridge device is already initialized
+
+From: Jason Baron <jbaron@akamai.com>
+
+[ Upstream commit 709ed1bcef12398ac1a35c149f3e582db04456c2 ]
+
+The Intel uncore driver may claim some of the pci ids from ie31200 which
+means that the ie31200 edac driver will not initialize them as part of
+pci_register_driver().
+
+Let's add a fallback for this case to 'pci_get_device()' to get a
+reference on the device such that it can still be configured. This is
+similar in approach to other edac drivers.
+
+Signed-off-by: Jason Baron <jbaron@akamai.com>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/r/1594923911-10885-1-git-send-email-jbaron@akamai.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/ie31200_edac.c | 50 ++++++++++++++++++++++++++++++++++---
+ 1 file changed, 47 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c
+index d68346a8e141a..ebe50996cc423 100644
+--- a/drivers/edac/ie31200_edac.c
++++ b/drivers/edac/ie31200_edac.c
+@@ -170,6 +170,8 @@
+ (n << (28 + (2 * skl) - PAGE_SHIFT))
+
+ static int nr_channels;
++static struct pci_dev *mci_pdev;
++static int ie31200_registered = 1;
+
+ struct ie31200_priv {
+ void __iomem *window;
+@@ -538,12 +540,16 @@ fail_free:
+ static int ie31200_init_one(struct pci_dev *pdev,
+ const struct pci_device_id *ent)
+ {
+- edac_dbg(0, "MC:\n");
++ int rc;
+
++ edac_dbg(0, "MC:\n");
+ if (pci_enable_device(pdev) < 0)
+ return -EIO;
++ rc = ie31200_probe1(pdev, ent->driver_data);
++ if (rc == 0 && !mci_pdev)
++ mci_pdev = pci_dev_get(pdev);
+
+- return ie31200_probe1(pdev, ent->driver_data);
++ return rc;
+ }
+
+ static void ie31200_remove_one(struct pci_dev *pdev)
+@@ -552,6 +558,8 @@ static void ie31200_remove_one(struct pci_dev *pdev)
+ struct ie31200_priv *priv;
+
+ edac_dbg(0, "\n");
++ pci_dev_put(mci_pdev);
++ mci_pdev = NULL;
+ mci = edac_mc_del_mc(&pdev->dev);
+ if (!mci)
+ return;
+@@ -593,17 +601,53 @@ static struct pci_driver ie31200_driver = {
+
+ static int __init ie31200_init(void)
+ {
++ int pci_rc, i;
++
+ edac_dbg(3, "MC:\n");
+ /* Ensure that the OPSTATE is set correctly for POLL or NMI */
+ opstate_init();
+
+- return pci_register_driver(&ie31200_driver);
++ pci_rc = pci_register_driver(&ie31200_driver);
++ if (pci_rc < 0)
++ goto fail0;
++
++ if (!mci_pdev) {
++ ie31200_registered = 0;
++ for (i = 0; ie31200_pci_tbl[i].vendor != 0; i++) {
++ mci_pdev = pci_get_device(ie31200_pci_tbl[i].vendor,
++ ie31200_pci_tbl[i].device,
++ NULL);
++ if (mci_pdev)
++ break;
++ }
++ if (!mci_pdev) {
++ edac_dbg(0, "ie31200 pci_get_device fail\n");
++ pci_rc = -ENODEV;
++ goto fail1;
++ }
++ pci_rc = ie31200_init_one(mci_pdev, &ie31200_pci_tbl[i]);
++ if (pci_rc < 0) {
++ edac_dbg(0, "ie31200 init fail\n");
++ pci_rc = -ENODEV;
++ goto fail1;
++ }
++ }
++ return 0;
++
++fail1:
++ pci_unregister_driver(&ie31200_driver);
++fail0:
++ pci_dev_put(mci_pdev);
++
++ return pci_rc;
+ }
+
+ static void __exit ie31200_exit(void)
+ {
+ edac_dbg(3, "MC:\n");
+ pci_unregister_driver(&ie31200_driver);
++ if (!ie31200_registered)
++ ie31200_remove_one(mci_pdev);
+ }
+
+ module_init(ie31200_init);
+--
+2.25.1
+
--- /dev/null
+From 3f61224c46d4ffbe5e9b12709fdf6c25d506d6ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jun 2020 14:58:46 +0800
+Subject: EDAC/mc: Call edac_inc_ue_error() before panic
+
+From: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+
+[ Upstream commit e9ff6636d3f97a764487999754c0bfee9d2c231e ]
+
+By calling edac_inc_ue_error() before panic, we get a correct UE error
+count for core dump analysis.
+
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/r/20200610065846.3626-2-zhenzhong.duan@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/edac_mc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index 5813e931f2f00..01ff71f7b6456 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -950,6 +950,8 @@ static void edac_ue_error(struct edac_raw_error_desc *e)
+ e->other_detail);
+ }
+
++ edac_inc_ue_error(e);
++
+ if (edac_mc_get_panic_on_ue()) {
+ panic("UE %s%son %s (%s page:0x%lx offset:0x%lx grain:%ld%s%s)\n",
+ e->msg,
+@@ -959,8 +961,6 @@ static void edac_ue_error(struct edac_raw_error_desc *e)
+ *e->other_detail ? " - " : "",
+ e->other_detail);
+ }
+-
+- edac_inc_ue_error(e);
+ }
+
+ static void edac_inc_csrow(struct edac_raw_error_desc *e, int row, int chan)
+--
+2.25.1
+
--- /dev/null
+From 5c8bcfaaa508eebfafc58401bcdf0b8262b080c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jul 2020 18:23:36 +0800
+Subject: f2fs: fix error path in do_recover_data()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 9627a7b31f3c4ff8bc8f3be3683983ffe6eaebe6 ]
+
+- don't panic kernel if f2fs_get_node_page() fails in
+f2fs_recover_inline_data() or f2fs_recover_inline_xattr();
+- return error number of f2fs_truncate_blocks() to
+f2fs_recover_inline_data()'s caller;
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 4 ++--
+ fs/f2fs/inline.c | 19 ++++++++++++-------
+ fs/f2fs/node.c | 6 ++++--
+ fs/f2fs/recovery.c | 10 ++++++++--
+ 4 files changed, 26 insertions(+), 13 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index b35a50f4953c5..7d9afd54e9d8f 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3287,7 +3287,7 @@ bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid);
+ void f2fs_alloc_nid_done(struct f2fs_sb_info *sbi, nid_t nid);
+ void f2fs_alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid);
+ int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink);
+-void f2fs_recover_inline_xattr(struct inode *inode, struct page *page);
++int f2fs_recover_inline_xattr(struct inode *inode, struct page *page);
+ int f2fs_recover_xattr_data(struct inode *inode, struct page *page);
+ int f2fs_recover_inode_page(struct f2fs_sb_info *sbi, struct page *page);
+ int f2fs_restore_node_summary(struct f2fs_sb_info *sbi,
+@@ -3750,7 +3750,7 @@ int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page);
+ int f2fs_convert_inline_inode(struct inode *inode);
+ int f2fs_try_convert_inline_dir(struct inode *dir, struct dentry *dentry);
+ int f2fs_write_inline_data(struct inode *inode, struct page *page);
+-bool f2fs_recover_inline_data(struct inode *inode, struct page *npage);
++int f2fs_recover_inline_data(struct inode *inode, struct page *npage);
+ struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir,
+ const struct f2fs_filename *fname,
+ struct page **res_page);
+diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
+index dbade310dc792..cf2c347bd7a3d 100644
+--- a/fs/f2fs/inline.c
++++ b/fs/f2fs/inline.c
+@@ -253,7 +253,7 @@ int f2fs_write_inline_data(struct inode *inode, struct page *page)
+ return 0;
+ }
+
+-bool f2fs_recover_inline_data(struct inode *inode, struct page *npage)
++int f2fs_recover_inline_data(struct inode *inode, struct page *npage)
+ {
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct f2fs_inode *ri = NULL;
+@@ -275,7 +275,8 @@ bool f2fs_recover_inline_data(struct inode *inode, struct page *npage)
+ ri && (ri->i_inline & F2FS_INLINE_DATA)) {
+ process_inline:
+ ipage = f2fs_get_node_page(sbi, inode->i_ino);
+- f2fs_bug_on(sbi, IS_ERR(ipage));
++ if (IS_ERR(ipage))
++ return PTR_ERR(ipage);
+
+ f2fs_wait_on_page_writeback(ipage, NODE, true, true);
+
+@@ -288,21 +289,25 @@ process_inline:
+
+ set_page_dirty(ipage);
+ f2fs_put_page(ipage, 1);
+- return true;
++ return 1;
+ }
+
+ if (f2fs_has_inline_data(inode)) {
+ ipage = f2fs_get_node_page(sbi, inode->i_ino);
+- f2fs_bug_on(sbi, IS_ERR(ipage));
++ if (IS_ERR(ipage))
++ return PTR_ERR(ipage);
+ f2fs_truncate_inline_inode(inode, ipage, 0);
+ clear_inode_flag(inode, FI_INLINE_DATA);
+ f2fs_put_page(ipage, 1);
+ } else if (ri && (ri->i_inline & F2FS_INLINE_DATA)) {
+- if (f2fs_truncate_blocks(inode, 0, false))
+- return false;
++ int ret;
++
++ ret = f2fs_truncate_blocks(inode, 0, false);
++ if (ret)
++ return ret;
+ goto process_inline;
+ }
+- return false;
++ return 0;
+ }
+
+ struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir,
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index e61ce7fb0958b..98736d0598b8d 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -2576,7 +2576,7 @@ int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink)
+ return nr - nr_shrink;
+ }
+
+-void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
++int f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
+ {
+ void *src_addr, *dst_addr;
+ size_t inline_size;
+@@ -2584,7 +2584,8 @@ void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
+ struct f2fs_inode *ri;
+
+ ipage = f2fs_get_node_page(F2FS_I_SB(inode), inode->i_ino);
+- f2fs_bug_on(F2FS_I_SB(inode), IS_ERR(ipage));
++ if (IS_ERR(ipage))
++ return PTR_ERR(ipage);
+
+ ri = F2FS_INODE(page);
+ if (ri->i_inline & F2FS_INLINE_XATTR) {
+@@ -2603,6 +2604,7 @@ void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
+ update_inode:
+ f2fs_update_inode(inode, ipage);
+ f2fs_put_page(ipage, 1);
++ return 0;
+ }
+
+ int f2fs_recover_xattr_data(struct inode *inode, struct page *page)
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index ae5310f02e7ff..2807251944668 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -544,7 +544,9 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
+
+ /* step 1: recover xattr */
+ if (IS_INODE(page)) {
+- f2fs_recover_inline_xattr(inode, page);
++ err = f2fs_recover_inline_xattr(inode, page);
++ if (err)
++ goto out;
+ } else if (f2fs_has_xattr_block(ofs_of_node(page))) {
+ err = f2fs_recover_xattr_data(inode, page);
+ if (!err)
+@@ -553,8 +555,12 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
+ }
+
+ /* step 2: recover inline data */
+- if (f2fs_recover_inline_data(inode, page))
++ err = f2fs_recover_inline_data(inode, page);
++ if (err) {
++ if (err == 1)
++ err = 0;
+ goto out;
++ }
+
+ /* step 3: recover data indices */
+ start = f2fs_start_bidx_of_node(ofs_of_node(page), inode);
+--
+2.25.1
+
--- /dev/null
+From 4ec3e43f70e41264b6649dd89f7802362cecfba4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 09:38:11 +0800
+Subject: f2fs: fix use-after-free issue
+
+From: Li Guifu <bluce.liguifu@huawei.com>
+
+[ Upstream commit 99c787cfd2bd04926f1f553b30bd7dcea2caaba1 ]
+
+During umount, f2fs_put_super() unregisters procfs entries after
+f2fs_destroy_segment_manager(), it may cause use-after-free
+issue when umount races with procfs accessing, fix it by relocating
+f2fs_unregister_sysfs().
+
+[Chao Yu: change commit title/message a bit]
+
+Signed-off-by: Li Guifu <bluce.liguifu@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 20e56b0fa46a9..0deb839da0a03 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1173,6 +1173,9 @@ static void f2fs_put_super(struct super_block *sb)
+ int i;
+ bool dropped;
+
++ /* unregister procfs/sysfs entries in advance to avoid race case */
++ f2fs_unregister_sysfs(sbi);
++
+ f2fs_quota_off_umount(sb);
+
+ /* prevent remaining shrinker jobs */
+@@ -1238,8 +1241,6 @@ static void f2fs_put_super(struct super_block *sb)
+
+ kvfree(sbi->ckpt);
+
+- f2fs_unregister_sysfs(sbi);
+-
+ sb->s_fs_info = NULL;
+ if (sbi->s_chksum_driver)
+ crypto_free_shash(sbi->s_chksum_driver);
+--
+2.25.1
+
--- /dev/null
+From 4e4143f1c6d558dd7a69167e57b1bde96aebac5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 17:51:29 +0800
+Subject: f2fs: remove write attribute of main_blkaddr sysfs node
+
+From: Dehe Gu <gudehe@huawei.com>
+
+[ Upstream commit ffcde4b29a5f20ddca6fe559b48f345818bf1d91 ]
+
+Fuzzing main_blkaddr sysfs node will corrupt this field's value,
+causing kernel panic, remove its write attribute to avoid potential
+security risk.
+
+[Chao Yu: add description]
+
+Signed-off-by: Dehe Gu <gudehe@huawei.com>
+Signed-off-by: Daiyue Zhang <zhangdaiyue1@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/sysfs.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index e877c59b9fdb4..c5e32ceb94827 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -223,6 +223,13 @@ static ssize_t avg_vblocks_show(struct f2fs_attr *a,
+ }
+ #endif
+
++static ssize_t main_blkaddr_show(struct f2fs_attr *a,
++ struct f2fs_sb_info *sbi, char *buf)
++{
++ return snprintf(buf, PAGE_SIZE, "%llu\n",
++ (unsigned long long)MAIN_BLKADDR(sbi));
++}
++
+ static ssize_t f2fs_sbi_show(struct f2fs_attr *a,
+ struct f2fs_sb_info *sbi, char *buf)
+ {
+@@ -522,7 +529,6 @@ F2FS_RW_ATTR(GC_THREAD, f2fs_gc_kthread, gc_no_gc_sleep_time, no_gc_sleep_time);
+ F2FS_RW_ATTR(F2FS_SBI, f2fs_sb_info, gc_idle, gc_mode);
+ F2FS_RW_ATTR(F2FS_SBI, f2fs_sb_info, gc_urgent, gc_mode);
+ F2FS_RW_ATTR(SM_INFO, f2fs_sm_info, reclaim_segments, rec_prefree_segments);
+-F2FS_RW_ATTR(SM_INFO, f2fs_sm_info, main_blkaddr, main_blkaddr);
+ F2FS_RW_ATTR(DCC_INFO, discard_cmd_control, max_small_discards, max_discards);
+ F2FS_RW_ATTR(DCC_INFO, discard_cmd_control, discard_granularity, discard_granularity);
+ F2FS_RW_ATTR(RESERVED_BLOCKS, f2fs_sb_info, reserved_blocks, reserved_blocks);
+@@ -565,6 +571,7 @@ F2FS_GENERAL_RO_ATTR(current_reserved_blocks);
+ F2FS_GENERAL_RO_ATTR(unusable);
+ F2FS_GENERAL_RO_ATTR(encoding);
+ F2FS_GENERAL_RO_ATTR(mounted_time_sec);
++F2FS_GENERAL_RO_ATTR(main_blkaddr);
+ #ifdef CONFIG_F2FS_STAT_FS
+ F2FS_STAT_ATTR(STAT_INFO, f2fs_stat_info, cp_foreground_calls, cp_count);
+ F2FS_STAT_ATTR(STAT_INFO, f2fs_stat_info, cp_background_calls, bg_cp_count);
+--
+2.25.1
+
--- /dev/null
+From fec21dcc6d07c144fafd541c608b4ba02e64945a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 15:33:26 +0300
+Subject: gcc-plugins/stackleak: Don't instrument itself
+
+From: Alexander Popov <alex.popov@linux.com>
+
+[ Upstream commit 005e696df65d0ff90468ecf38a50aa584dc82421 ]
+
+There is no need to try instrumenting functions in kernel/stackleak.c.
+Otherwise that can cause issues if the cleanup pass of stackleak gcc plugin
+is disabled.
+
+Signed-off-by: Alexander Popov <alex.popov@linux.com>
+Link: https://lore.kernel.org/r/20200624123330.83226-2-alex.popov@linux.com
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/Makefile b/kernel/Makefile
+index f3218bc5ec69f..155b5380500ad 100644
+--- a/kernel/Makefile
++++ b/kernel/Makefile
+@@ -125,6 +125,7 @@ obj-$(CONFIG_WATCH_QUEUE) += watch_queue.o
+
+ obj-$(CONFIG_SYSCTL_KUNIT_TEST) += sysctl-test.o
+
++CFLAGS_stackleak.o += $(DISABLE_STACKLEAK_PLUGIN)
+ obj-$(CONFIG_GCC_PLUGIN_STACKLEAK) += stackleak.o
+ KASAN_SANITIZE_stackleak.o := n
+ KCSAN_SANITIZE_stackleak.o := n
+--
+2.25.1
+
--- /dev/null
+From 7af0e44a6955236c98312639c02954a47ac3fbec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 06:18:40 +0300
+Subject: gpu: host1x: Put gather's BO on pinning error
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit fd323e9ef0a19112c0c85b85afc4848c0518174b ]
+
+This patch fixes gather's BO refcounting on a pinning error. Gather's BO
+won't be leaked now if something goes wrong.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/job.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c
+index a10643aa89aa5..2ac5a99406d98 100644
+--- a/drivers/gpu/host1x/job.c
++++ b/drivers/gpu/host1x/job.c
+@@ -102,6 +102,7 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)
+ {
+ struct host1x_client *client = job->client;
+ struct device *dev = client->dev;
++ struct host1x_job_gather *g;
+ struct iommu_domain *domain;
+ unsigned int i;
+ int err;
+@@ -184,7 +185,6 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)
+ }
+
+ for (i = 0; i < job->num_gathers; i++) {
+- struct host1x_job_gather *g = &job->gathers[i];
+ size_t gather_size = 0;
+ struct scatterlist *sg;
+ struct sg_table *sgt;
+@@ -194,6 +194,7 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)
+ dma_addr_t *phys;
+ unsigned int j;
+
++ g = &job->gathers[i];
+ g->bo = host1x_bo_get(g->bo);
+ if (!g->bo) {
+ err = -EINVAL;
+@@ -213,7 +214,7 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)
+ sgt = host1x_bo_pin(host->dev, g->bo, phys);
+ if (IS_ERR(sgt)) {
+ err = PTR_ERR(sgt);
+- goto unpin;
++ goto put;
+ }
+
+ if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && host->domain) {
+@@ -226,7 +227,7 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)
+ host->iova_end >> shift, true);
+ if (!alloc) {
+ err = -ENOMEM;
+- goto unpin;
++ goto put;
+ }
+
+ err = iommu_map_sg(host->domain,
+@@ -235,7 +236,7 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)
+ if (err == 0) {
+ __free_iova(&host->iova, alloc);
+ err = -EINVAL;
+- goto unpin;
++ goto put;
+ }
+
+ job->unpins[job->num_unpins].size = gather_size;
+@@ -245,7 +246,7 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)
+ DMA_TO_DEVICE);
+ if (!err) {
+ err = -ENOMEM;
+- goto unpin;
++ goto put;
+ }
+
+ job->unpins[job->num_unpins].dir = DMA_TO_DEVICE;
+@@ -263,6 +264,8 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)
+
+ return 0;
+
++put:
++ host1x_bo_put(g->bo);
+ unpin:
+ host1x_job_unpin(job);
+ return err;
+--
+2.25.1
+
--- /dev/null
+From cd39fd76b8b985bcd89bf0a9c39467dd349596c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 14:54:09 +0800
+Subject: HID: quirks: add NOGET quirk for Logitech GROUP
+
+From: Ikjoon Jang <ikjn@chromium.org>
+
+[ Upstream commit 68f775ddd2a6f513e225f9a565b054ab48fef142 ]
+
+Add HID_QUIRK_NOGET for Logitech GROUP device.
+
+Logitech GROUP is a compound with camera and audio.
+When the HID interface in an audio device is requested to get
+specific report id, all following control transfers are stalled
+and never be restored back.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=203419
+Signed-off-by: Ikjoon Jang <ikjn@chromium.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 6f370e020feb3..7cfa9785bfbb0 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -773,6 +773,7 @@
+ #define USB_DEVICE_ID_LOGITECH_G27_WHEEL 0xc29b
+ #define USB_DEVICE_ID_LOGITECH_WII_WHEEL 0xc29c
+ #define USB_DEVICE_ID_LOGITECH_ELITE_KBD 0xc30a
++#define USB_DEVICE_ID_LOGITECH_GROUP_AUDIO 0x0882
+ #define USB_DEVICE_ID_S510_RECEIVER 0xc50c
+ #define USB_DEVICE_ID_S510_RECEIVER_2 0xc517
+ #define USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500 0xc512
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 934fc0a798d4d..c242150d35a3a 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -179,6 +179,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD2, USB_DEVICE_ID_SMARTJOY_DUAL_PLUS), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE), HID_QUIRK_MULTI_INPUT },
++ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_GROUP_AUDIO), HID_QUIRK_NOGET },
+
+ { 0 }
+ };
+--
+2.25.1
+
--- /dev/null
+From d1ee59f41230869d624d6e8498e85e4446ca89b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 18:31:35 -0700
+Subject: hugetlbfs: prevent filesystem stacking of hugetlbfs
+
+From: Mike Kravetz <mike.kravetz@oracle.com>
+
+[ Upstream commit 15568299b7d9988063afce60731df605ab236e2a ]
+
+syzbot found issues with having hugetlbfs on a union/overlay as reported
+in [1]. Due to the limitations (no write) and special functionality of
+hugetlbfs, it does not work well in filesystem stacking. There are no
+know use cases for hugetlbfs stacking. Rather than making modifications
+to get hugetlbfs working in such environments, simply prevent stacking.
+
+[1] https://lore.kernel.org/linux-mm/000000000000b4684e05a2968ca6@google.com/
+
+Reported-by: syzbot+d6ec23007e951dadf3de@syzkaller.appspotmail.com
+Suggested-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Miklos Szeredi <mszeredi@redhat.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Colin Walters <walters@verbum.org>
+Link: http://lkml.kernel.org/r/80f869aa-810d-ef6c-8888-b46cee135907@oracle.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hugetlbfs/inode.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index ef5313f9c78fe..f936bcf02cce7 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -1364,6 +1364,12 @@ hugetlbfs_fill_super(struct super_block *sb, struct fs_context *fc)
+ sb->s_magic = HUGETLBFS_MAGIC;
+ sb->s_op = &hugetlbfs_ops;
+ sb->s_time_gran = 1;
++
++ /*
++ * Due to the special and limited functionality of hugetlbfs, it does
++ * not work well as a stacking filesystem.
++ */
++ sb->s_stack_depth = FILESYSTEM_MAX_STACK_DEPTH;
+ sb->s_root = d_make_root(hugetlbfs_get_root(sb, ctx));
+ if (!sb->s_root)
+ goto out_free;
+--
+2.25.1
+
--- /dev/null
+From f42f82011cff86c9804f04d7ad3c5a48318d1a0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jun 2020 16:42:40 +0300
+Subject: i2c: i801: Add support for Intel Tiger Lake PCH-H
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+[ Upstream commit f46efbcad97bfb2caded0397eccce7c71402868c ]
+
+Add SMBus PCI ID on Intel Tiger Lake PCH-H.
+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-i801.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index fea644921a768..f206e28af5831 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -67,6 +67,7 @@
+ * Comet Lake-H (PCH) 0x06a3 32 hard yes yes yes
+ * Elkhart Lake (PCH) 0x4b23 32 hard yes yes yes
+ * Tiger Lake-LP (PCH) 0xa0a3 32 hard yes yes yes
++ * Tiger Lake-H (PCH) 0x43a3 32 hard yes yes yes
+ * Jasper Lake (SOC) 0x4da3 32 hard yes yes yes
+ * Comet Lake-V (PCH) 0xa3a3 32 hard yes yes yes
+ *
+@@ -221,6 +222,7 @@
+ #define PCI_DEVICE_ID_INTEL_GEMINILAKE_SMBUS 0x31d4
+ #define PCI_DEVICE_ID_INTEL_ICELAKE_LP_SMBUS 0x34a3
+ #define PCI_DEVICE_ID_INTEL_5_3400_SERIES_SMBUS 0x3b30
++#define PCI_DEVICE_ID_INTEL_TIGERLAKE_H_SMBUS 0x43a3
+ #define PCI_DEVICE_ID_INTEL_ELKHART_LAKE_SMBUS 0x4b23
+ #define PCI_DEVICE_ID_INTEL_JASPER_LAKE_SMBUS 0x4da3
+ #define PCI_DEVICE_ID_INTEL_BROXTON_SMBUS 0x5ad4
+@@ -1074,6 +1076,7 @@ static const struct pci_device_id i801_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_COMETLAKE_V_SMBUS) },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ELKHART_LAKE_SMBUS) },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_TIGERLAKE_LP_SMBUS) },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_TIGERLAKE_H_SMBUS) },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_JASPER_LAKE_SMBUS) },
+ { 0, }
+ };
+@@ -1748,6 +1751,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ case PCI_DEVICE_ID_INTEL_COMETLAKE_H_SMBUS:
+ case PCI_DEVICE_ID_INTEL_ELKHART_LAKE_SMBUS:
+ case PCI_DEVICE_ID_INTEL_TIGERLAKE_LP_SMBUS:
++ case PCI_DEVICE_ID_INTEL_TIGERLAKE_H_SMBUS:
+ case PCI_DEVICE_ID_INTEL_JASPER_LAKE_SMBUS:
+ priv->features |= FEATURE_BLOCK_PROC;
+ priv->features |= FEATURE_I2C_BLOCK_READ;
+--
+2.25.1
+
--- /dev/null
+From 9c626c88707e9ed9dfc3c8db9413be684305b674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jun 2020 14:08:18 +0100
+Subject: iommu/iova: Don't BUG on invalid PFNs
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit d3e3d2be688b4b5864538de61e750721a311e4fc ]
+
+Unlike the other instances which represent a complete loss of
+consistency within the rcache mechanism itself, or a fundamental
+and obvious misconfiguration by an IOMMU driver, the BUG_ON() in
+iova_magazine_free_pfns() can be provoked at more or less any time
+in a "spooky action-at-a-distance" manner by any old device driver
+passing nonsense to dma_unmap_*() which then propagates through to
+queue_iova().
+
+Not only is this well outside the IOVA layer's control, it's also
+nowhere near fatal enough to justify panicking anyway - all that
+really achieves is to make debugging the offending driver more
+difficult. Let's simply WARN and otherwise ignore bogus PFNs.
+
+Reported-by: Prakash Gupta <guptap@codeaurora.org>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Prakash Gupta <guptap@codeaurora.org>
+Link: https://lore.kernel.org/r/acbd2d092b42738a03a21b417ce64e27f8c91c86.1591103298.git.robin.murphy@arm.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iova.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index 49fc01f2a28d4..45a251da54537 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -811,7 +811,9 @@ iova_magazine_free_pfns(struct iova_magazine *mag, struct iova_domain *iovad)
+ for (i = 0 ; i < mag->size; ++i) {
+ struct iova *iova = private_find_iova(iovad, mag->pfns[i]);
+
+- BUG_ON(!iova);
++ if (WARN_ON(!iova))
++ continue;
++
+ private_free_iova(iovad, iova);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 458cad9ca976879fa071e4c0d892978125eb715f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 23:26:25 -0700
+Subject: khugepaged: khugepaged_test_exit() check mmget_still_valid()
+
+From: Hugh Dickins <hughd@google.com>
+
+[ Upstream commit bbe98f9cadff58cdd6a4acaeba0efa8565dabe65 ]
+
+Move collapse_huge_page()'s mmget_still_valid() check into
+khugepaged_test_exit() itself. collapse_huge_page() is used for anon THP
+only, and earned its mmget_still_valid() check because it inserts a huge
+pmd entry in place of the page table's pmd entry; whereas
+collapse_file()'s retract_page_tables() or collapse_pte_mapped_thp()
+merely clears the page table's pmd entry. But core dumping without mmap
+lock must have been as open to mistaking a racily cleared pmd entry for a
+page table at physical page 0, as exit_mmap() was. And we certainly have
+no interest in mapping as a THP once dumping core.
+
+Fixes: 59ea6d06cfa9 ("coredump: fix race condition between collapse_huge_page() and core dumping")
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: <stable@vger.kernel.org> [4.8+]
+Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008021217020.27773@eggly.anvils
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/khugepaged.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index 1d6a9b0b6a9fd..dd592ea9a4a06 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -431,7 +431,7 @@ static void insert_to_mm_slots_hash(struct mm_struct *mm,
+
+ static inline int khugepaged_test_exit(struct mm_struct *mm)
+ {
+- return atomic_read(&mm->mm_users) == 0;
++ return atomic_read(&mm->mm_users) == 0 || !mmget_still_valid(mm);
+ }
+
+ static bool hugepage_vma_check(struct vm_area_struct *vma,
+@@ -1100,9 +1100,6 @@ static void collapse_huge_page(struct mm_struct *mm,
+ * handled by the anon_vma lock + PG_lock.
+ */
+ mmap_write_lock(mm);
+- result = SCAN_ANY_PROCESS;
+- if (!mmget_still_valid(mm))
+- goto out;
+ result = hugepage_vma_revalidate(mm, address, &vma);
+ if (result)
+ goto out;
+--
+2.25.1
+
--- /dev/null
+From 5daf8a9ab6650f07f4872f3b58b66c88c61cc2ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jul 2020 19:51:10 +0100
+Subject: locking/lockdep: Fix overflow in presentation of average lock-time
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+[ Upstream commit a7ef9b28aa8d72a1656fa6f0a01bbd1493886317 ]
+
+Though the number of lock-acquisitions is tracked as unsigned long, this
+is passed as the divisor to div_s64() which interprets it as a s32,
+giving nonsense values with more than 2 billion acquisitons. E.g.
+
+ acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg
+ -------------------------------------------------------------------------
+ 2350439395 0.07 353.38 649647067.36 0.-32
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20200725185110.11588-1-chris@chris-wilson.co.uk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/locking/lockdep_proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
+index 5525cd3ba0c83..02ef87f50df29 100644
+--- a/kernel/locking/lockdep_proc.c
++++ b/kernel/locking/lockdep_proc.c
+@@ -423,7 +423,7 @@ static void seq_lock_time(struct seq_file *m, struct lock_time *lt)
+ seq_time(m, lt->min);
+ seq_time(m, lt->max);
+ seq_time(m, lt->total);
+- seq_time(m, lt->nr ? div_s64(lt->total, lt->nr) : 0);
++ seq_time(m, lt->nr ? div64_u64(lt->total, lt->nr) : 0);
+ }
+
+ static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
+--
+2.25.1
+
--- /dev/null
+From 0030d707697616bc5bc44caecbb50305066e5ad8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2020 16:42:08 +0200
+Subject: media: pci: ttpci: av7110: fix possible buffer overflow caused by bad
+ DMA value in debiirq()
+
+From: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
+
+[ Upstream commit 6499a0db9b0f1e903d52f8244eacc1d4be00eea2 ]
+
+The value av7110->debi_virt is stored in DMA memory, and it is assigned
+to data, and thus data[0] can be modified at any time by malicious
+hardware. In this case, "if (data[0] < 2)" can be passed, but then
+data[0] can be changed into a large number, which may cause buffer
+overflow when the code "av7110->ci_slot[data[0]]" is used.
+
+To fix this possible bug, data[0] is assigned to a local variable, which
+replaces the use of data[0].
+
+Signed-off-by: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ttpci/av7110.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c
+index d0cdee1c6eb0b..bf36b1e22b635 100644
+--- a/drivers/media/pci/ttpci/av7110.c
++++ b/drivers/media/pci/ttpci/av7110.c
+@@ -406,14 +406,15 @@ static void debiirq(unsigned long cookie)
+ case DATA_CI_GET:
+ {
+ u8 *data = av7110->debi_virt;
++ u8 data_0 = data[0];
+
+- if ((data[0] < 2) && data[2] == 0xff) {
++ if (data_0 < 2 && data[2] == 0xff) {
+ int flags = 0;
+ if (data[5] > 0)
+ flags |= CA_CI_MODULE_PRESENT;
+ if (data[5] > 5)
+ flags |= CA_CI_MODULE_READY;
+- av7110->ci_slot[data[0]].flags = flags;
++ av7110->ci_slot[data_0].flags = flags;
+ } else
+ ci_get_data(&av7110->ci_rbuffer,
+ av7110->debi_virt,
+--
+2.25.1
+
--- /dev/null
+From 15b0a5db4cb7050d9c6f12bb9ef2b20ae5bacbf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 19:10:32 +0300
+Subject: mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 3ea2e4eab64cefa06055bb0541fcdedad4b48565 ]
+
+Intel Emmitsburg PCH has the same LPSS than Intel Ice Lake.
+Add the new IDs to the list of supported devices.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-pci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index 046222684b8b2..17bcadc00a11c 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -201,6 +201,9 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x1ac4), (kernel_ulong_t)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info },
++ /* EBG */
++ { PCI_VDEVICE(INTEL, 0x1bad), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x1bae), (kernel_ulong_t)&bxt_uart_info },
+ /* GLK */
+ { PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&glk_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&glk_i2c_info },
+--
+2.25.1
+
--- /dev/null
+From fbd9e49cc71c67e824f6f95c7e76837a2450f4f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 16:10:36 +0300
+Subject: mfd: intel-lpss: Add Intel Tiger Lake PCH-H PCI IDs
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit bb7fcad48d3804d814b97c785514e2d1657e157f ]
+
+Intel Tiger Lake PCH-H has the same LPSS than Intel Broxton.
+Add the new IDs to the list of supported devices.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-pci.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index 17bcadc00a11c..9a58032f818ae 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -233,6 +233,22 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x34ea), (kernel_ulong_t)&bxt_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x34eb), (kernel_ulong_t)&bxt_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x34fb), (kernel_ulong_t)&spt_info },
++ /* TGL-H */
++ { PCI_VDEVICE(INTEL, 0x43a7), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x43a8), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x43a9), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x43aa), (kernel_ulong_t)&bxt_info },
++ { PCI_VDEVICE(INTEL, 0x43ab), (kernel_ulong_t)&bxt_info },
++ { PCI_VDEVICE(INTEL, 0x43ad), (kernel_ulong_t)&bxt_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x43ae), (kernel_ulong_t)&bxt_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x43d8), (kernel_ulong_t)&bxt_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x43da), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x43e8), (kernel_ulong_t)&bxt_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x43e9), (kernel_ulong_t)&bxt_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x43ea), (kernel_ulong_t)&bxt_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x43eb), (kernel_ulong_t)&bxt_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x43fb), (kernel_ulong_t)&bxt_info },
++ { PCI_VDEVICE(INTEL, 0x43fd), (kernel_ulong_t)&bxt_info },
+ /* EHL */
+ { PCI_VDEVICE(INTEL, 0x4b28), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x4b29), (kernel_ulong_t)&bxt_uart_info },
+--
+2.25.1
+
--- /dev/null
+From 6f71fb5cf9eac051efc273ff4e3cbc5b83d4c1d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 14:30:17 +0800
+Subject: MIPS: KVM: Limit Trap-and-Emulate to MIPS32R2 only
+
+From: Jiaxun Yang <jiaxun.yang@flygoat.com>
+
+[ Upstream commit 01edc5e76ecfecf9a79eec2658f6146ef47bc816 ]
+
+After tons of fixes to get Trap-and-Emulate build on Loongson64,
+I've got panic on host machine when trying to run a VM.
+
+I found that it can never work on 64bit systems. Revewing the
+code, it looks like R6 can't supportrd by TE as well.
+
+Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Message-Id: <20200710063047.154611-3-jiaxun.yang@flygoat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/Kconfig | 1 +
+ arch/mips/kvm/Kconfig | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index a7e40bb1e5bc6..c43ad3b3cea4b 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -2203,6 +2203,7 @@ endchoice
+
+ config KVM_GUEST
+ bool "KVM Guest Kernel"
++ depends on CPU_MIPS32_R2
+ depends on BROKEN_ON_SMP
+ help
+ Select this option if building a guest kernel for KVM (Trap & Emulate)
+diff --git a/arch/mips/kvm/Kconfig b/arch/mips/kvm/Kconfig
+index 2bf02d849a3a8..032b3fca6cbba 100644
+--- a/arch/mips/kvm/Kconfig
++++ b/arch/mips/kvm/Kconfig
+@@ -37,10 +37,11 @@ choice
+
+ config KVM_MIPS_TE
+ bool "Trap & Emulate"
++ depends on CPU_MIPS32_R2
+ help
+ Use trap and emulate to virtualize 32-bit guests in user mode. This
+ does not require any special hardware Virtualization support beyond
+- standard MIPS32/64 r2 or later, but it does require the guest kernel
++ standard MIPS32 r2 or later, but it does require the guest kernel
+ to be configured with CONFIG_KVM_GUEST=y so that it resides in the
+ user address segment.
+
+--
+2.25.1
+
--- /dev/null
+From c74dc9b5c629787fbd813bf4a5b7632beafb097a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 20:30:18 +0800
+Subject: mips/vdso: Fix resource leaks in genvdso.c
+
+From: Peng Fan <fanpeng@loongson.cn>
+
+[ Upstream commit a859647b4e6bfeb192284d27d24b6a0c914cae1d ]
+
+Close "fd" before the return of map_vdso() and close "out_file"
+in main().
+
+Signed-off-by: Peng Fan <fanpeng@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/vdso/genvdso.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/mips/vdso/genvdso.c b/arch/mips/vdso/genvdso.c
+index be57b832bbe0a..ccba50ec8a40e 100644
+--- a/arch/mips/vdso/genvdso.c
++++ b/arch/mips/vdso/genvdso.c
+@@ -122,6 +122,7 @@ static void *map_vdso(const char *path, size_t *_size)
+ if (fstat(fd, &stat) != 0) {
+ fprintf(stderr, "%s: Failed to stat '%s': %s\n", program_name,
+ path, strerror(errno));
++ close(fd);
+ return NULL;
+ }
+
+@@ -130,6 +131,7 @@ static void *map_vdso(const char *path, size_t *_size)
+ if (addr == MAP_FAILED) {
+ fprintf(stderr, "%s: Failed to map '%s': %s\n", program_name,
+ path, strerror(errno));
++ close(fd);
+ return NULL;
+ }
+
+@@ -139,6 +141,7 @@ static void *map_vdso(const char *path, size_t *_size)
+ if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0) {
+ fprintf(stderr, "%s: '%s' is not an ELF file\n", program_name,
+ path);
++ close(fd);
+ return NULL;
+ }
+
+@@ -150,6 +153,7 @@ static void *map_vdso(const char *path, size_t *_size)
+ default:
+ fprintf(stderr, "%s: '%s' has invalid ELF class\n",
+ program_name, path);
++ close(fd);
+ return NULL;
+ }
+
+@@ -161,6 +165,7 @@ static void *map_vdso(const char *path, size_t *_size)
+ default:
+ fprintf(stderr, "%s: '%s' has invalid ELF data order\n",
+ program_name, path);
++ close(fd);
+ return NULL;
+ }
+
+@@ -168,15 +173,18 @@ static void *map_vdso(const char *path, size_t *_size)
+ fprintf(stderr,
+ "%s: '%s' has invalid ELF machine (expected EM_MIPS)\n",
+ program_name, path);
++ close(fd);
+ return NULL;
+ } else if (swap_uint16(ehdr->e_type) != ET_DYN) {
+ fprintf(stderr,
+ "%s: '%s' has invalid ELF type (expected ET_DYN)\n",
+ program_name, path);
++ close(fd);
+ return NULL;
+ }
+
+ *_size = stat.st_size;
++ close(fd);
+ return addr;
+ }
+
+@@ -293,10 +301,12 @@ int main(int argc, char **argv)
+ /* Calculate and write symbol offsets to <output file> */
+ if (!get_symbols(dbg_vdso_path, dbg_vdso)) {
+ unlink(out_path);
++ fclose(out_file);
+ return EXIT_FAILURE;
+ }
+
+ fprintf(out_file, "};\n");
++ fclose(out_file);
+
+ return EXIT_SUCCESS;
+ }
+--
+2.25.1
+
--- /dev/null
+From b71df73230aec53964e82c060b35bba1a25f7d82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Aug 2020 03:05:25 +0200
+Subject: netfilter: nf_tables: report EEXIST on overlaps
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 77a92189ecfd061616ad531d386639aab7baaad9 ]
+
+Replace EBUSY by EEXIST in the following cases:
+
+- If the user adds a chain with a different configuration such as different
+ type, hook and priority.
+
+- If the user adds a non-base chain that clashes with an existing basechain.
+
+- If the user adds a { key : value } mapping element and the key exists
+ but the value differs.
+
+- If the device already belongs to an existing flowtable.
+
+User describe that this error reporting is confusing:
+
+- https://bugzilla.netfilter.org/show_bug.cgi?id=1176
+- https://bugzilla.netfilter.org/show_bug.cgi?id=1413
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 16 +++++++---------
+ 1 file changed, 7 insertions(+), 9 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 88325b264737f..d31832d32e028 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2037,7 +2037,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
+
+ if (nla[NFTA_CHAIN_HOOK]) {
+ if (!nft_is_base_chain(chain))
+- return -EBUSY;
++ return -EEXIST;
+
+ err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
+ false);
+@@ -2047,21 +2047,21 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
+ basechain = nft_base_chain(chain);
+ if (basechain->type != hook.type) {
+ nft_chain_release_hook(&hook);
+- return -EBUSY;
++ return -EEXIST;
+ }
+
+ if (ctx->family == NFPROTO_NETDEV) {
+ if (!nft_hook_list_equal(&basechain->hook_list,
+ &hook.list)) {
+ nft_chain_release_hook(&hook);
+- return -EBUSY;
++ return -EEXIST;
+ }
+ } else {
+ ops = &basechain->ops;
+ if (ops->hooknum != hook.num ||
+ ops->priority != hook.priority) {
+ nft_chain_release_hook(&hook);
+- return -EBUSY;
++ return -EEXIST;
+ }
+ }
+ nft_chain_release_hook(&hook);
+@@ -5160,10 +5160,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
+ nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
+ nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
+- nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
+- err = -EBUSY;
++ nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
+ goto err_element_clash;
+- }
+ if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
+ nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
+ memcmp(nft_set_ext_data(ext),
+@@ -5171,7 +5169,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
+ nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
+ *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
+- err = -EBUSY;
++ goto err_element_clash;
+ else if (!(nlmsg_flags & NLM_F_EXCL))
+ err = 0;
+ } else if (err == -ENOTEMPTY) {
+@@ -6308,7 +6306,7 @@ static int nft_register_flowtable_net_hooks(struct net *net,
+ list_for_each_entry(hook2, &ft->hook_list, list) {
+ if (hook->ops.dev == hook2->ops.dev &&
+ hook->ops.pf == hook2->ops.pf) {
+- err = -EBUSY;
++ err = -EEXIST;
+ goto err_unregister_net_hooks;
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From 42bc3f15c5838647b6612fa8b42eafa818690b60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 22:05:18 -0500
+Subject: omapfb: fix multiple reference count leaks due to pm_runtime_get_sync
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 78c2ce9bde70be5be7e3615a2ae7024ed8173087 ]
+
+On calling pm_runtime_get_sync() the reference count of the device
+is incremented. In case of failure, decrement the
+reference count before returning the error.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Cc: kjlu@umn.edu
+Cc: wu000273@umn.edu
+Cc: Allison Randal <allison@lohutok.net>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Enrico Weigelt <info@metux.net>
+cc: "Andrew F. Davis" <afd@ti.com>
+Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Cc: Alexios Zavras <alexios.zavras@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200614030528.128064-1-pakki001@umn.edu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/omap2/omapfb/dss/dispc.c | 7 +++++--
+ drivers/video/fbdev/omap2/omapfb/dss/dsi.c | 7 +++++--
+ drivers/video/fbdev/omap2/omapfb/dss/dss.c | 7 +++++--
+ drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c | 5 +++--
+ drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c | 5 +++--
+ drivers/video/fbdev/omap2/omapfb/dss/venc.c | 7 +++++--
+ 6 files changed, 26 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
+index 4a16798b2ecd8..e2b572761bf61 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
+@@ -520,8 +520,11 @@ int dispc_runtime_get(void)
+ DSSDBG("dispc_runtime_get\n");
+
+ r = pm_runtime_get_sync(&dispc.pdev->dev);
+- WARN_ON(r < 0);
+- return r < 0 ? r : 0;
++ if (WARN_ON(r < 0)) {
++ pm_runtime_put_sync(&dispc.pdev->dev);
++ return r;
++ }
++ return 0;
+ }
+ EXPORT_SYMBOL(dispc_runtime_get);
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
+index d620376216e1d..6f9c25fec9946 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
+@@ -1137,8 +1137,11 @@ static int dsi_runtime_get(struct platform_device *dsidev)
+ DSSDBG("dsi_runtime_get\n");
+
+ r = pm_runtime_get_sync(&dsi->pdev->dev);
+- WARN_ON(r < 0);
+- return r < 0 ? r : 0;
++ if (WARN_ON(r < 0)) {
++ pm_runtime_put_sync(&dsi->pdev->dev);
++ return r;
++ }
++ return 0;
+ }
+
+ static void dsi_runtime_put(struct platform_device *dsidev)
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss.c b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
+index bfc5c4c5a26ad..a6b1c1598040d 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/dss.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
+@@ -768,8 +768,11 @@ int dss_runtime_get(void)
+ DSSDBG("dss_runtime_get\n");
+
+ r = pm_runtime_get_sync(&dss.pdev->dev);
+- WARN_ON(r < 0);
+- return r < 0 ? r : 0;
++ if (WARN_ON(r < 0)) {
++ pm_runtime_put_sync(&dss.pdev->dev);
++ return r;
++ }
++ return 0;
+ }
+
+ void dss_runtime_put(void)
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c
+index 7060ae56c062c..4804aab342981 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c
+@@ -39,9 +39,10 @@ static int hdmi_runtime_get(void)
+ DSSDBG("hdmi_runtime_get\n");
+
+ r = pm_runtime_get_sync(&hdmi.pdev->dev);
+- WARN_ON(r < 0);
+- if (r < 0)
++ if (WARN_ON(r < 0)) {
++ pm_runtime_put_sync(&hdmi.pdev->dev);
+ return r;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c
+index ac49531e47327..a06b6f1355bdb 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c
+@@ -43,9 +43,10 @@ static int hdmi_runtime_get(void)
+ DSSDBG("hdmi_runtime_get\n");
+
+ r = pm_runtime_get_sync(&hdmi.pdev->dev);
+- WARN_ON(r < 0);
+- if (r < 0)
++ if (WARN_ON(r < 0)) {
++ pm_runtime_put_sync(&hdmi.pdev->dev);
+ return r;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/venc.c b/drivers/video/fbdev/omap2/omapfb/dss/venc.c
+index d5404d56c922f..0b0ad20afd630 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/venc.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/venc.c
+@@ -348,8 +348,11 @@ static int venc_runtime_get(void)
+ DSSDBG("venc_runtime_get\n");
+
+ r = pm_runtime_get_sync(&venc.pdev->dev);
+- WARN_ON(r < 0);
+- return r < 0 ? r : 0;
++ if (WARN_ON(r < 0)) {
++ pm_runtime_put_sync(&venc.pdev->dev);
++ return r;
++ }
++ return 0;
+ }
+
+ static void venc_runtime_put(void)
+--
+2.25.1
+
--- /dev/null
+From f2c0613c6c85040a681b81dbda3fee30bcfc8ea7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 21:13:22 -0500
+Subject: PCI: Fix pci_create_slot() reference count leak
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit 8a94644b440eef5a7b9c104ac8aa7a7f413e35e5 ]
+
+kobject_init_and_add() takes a reference even when it fails. If it returns
+an error, kobject_put() must be called to clean up the memory associated
+with the object.
+
+When kobject_init_and_add() fails, call kobject_put() instead of kfree().
+
+b8eb718348b8 ("net-sysfs: Fix reference count leak in
+rx|netdev_queue_add_kobject") fixed a similar problem.
+
+Link: https://lore.kernel.org/r/20200528021322.1984-1-wu000273@umn.edu
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/slot.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
+index cc386ef2fa122..3861505741e6d 100644
+--- a/drivers/pci/slot.c
++++ b/drivers/pci/slot.c
+@@ -268,13 +268,16 @@ placeholder:
+ slot_name = make_slot_name(name);
+ if (!slot_name) {
+ err = -ENOMEM;
++ kfree(slot);
+ goto err;
+ }
+
+ err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
+ "%s", slot_name);
+- if (err)
++ if (err) {
++ kobject_put(&slot->kobj);
+ goto err;
++ }
+
+ INIT_LIST_HEAD(&slot->list);
+ list_add(&slot->list, &parent->slots);
+@@ -293,7 +296,6 @@ out:
+ mutex_unlock(&pci_slot_mutex);
+ return slot;
+ err:
+- kfree(slot);
+ slot = ERR_PTR(err);
+ goto out;
+ }
+--
+2.25.1
+
--- /dev/null
+From 5a6e4df7858824c16b9fab2bfb98107878252c98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 00:52:03 -0700
+Subject: platform/chrome: cros_ec_sensorhub: Fix EC timestamp overflow
+
+From: Gwendal Grignou <gwendal@chromium.org>
+
+[ Upstream commit e48bc01ed5adec203676c735365373b31c3c7600 ]
+
+EC is using 32 bit timestamps (us), and before converting it to 64bit
+they were not casted, so it would overflow every 4s.
+Regular overflow every ~70 minutes was not taken into account either.
+
+Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_ec_sensorhub_ring.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
+index 24e48d96ed766..b1c641c72f515 100644
+--- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c
++++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
+@@ -419,9 +419,7 @@ cros_ec_sensor_ring_process_event(struct cros_ec_sensorhub *sensorhub,
+ * Disable filtering since we might add more jitter
+ * if b is in a random point in time.
+ */
+- new_timestamp = fifo_timestamp -
+- fifo_info->timestamp * 1000 +
+- in->timestamp * 1000;
++ new_timestamp = c - b * 1000 + a * 1000;
+ /*
+ * The timestamp can be stale if we had to use the fifo
+ * info timestamp.
+--
+2.25.1
+
--- /dev/null
+From 256b56a155acaee212f65212782af68239ce7e39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jun 2020 14:33:03 +1000
+Subject: powerpc/xive: Ignore kmemleak false positives
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit f0993c839e95dd6c7f054a1015e693c87e33e4fb ]
+
+xive_native_provision_pages() allocates memory and passes the pointer to
+OPAL so kmemleak cannot find the pointer usage in the kernel memory and
+produces a false positive report (below) (even if the kernel did scan
+OPAL memory, it is unable to deal with __pa() addresses anyway).
+
+This silences the warning.
+
+unreferenced object 0xc000200350c40000 (size 65536):
+ comm "qemu-system-ppc", pid 2725, jiffies 4294946414 (age 70776.530s)
+ hex dump (first 32 bytes):
+ 02 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 ....P...........
+ 01 00 08 07 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<0000000081ff046c>] xive_native_alloc_vp_block+0x120/0x250
+ [<00000000d555d524>] kvmppc_xive_compute_vp_id+0x248/0x350 [kvm]
+ [<00000000d69b9c9f>] kvmppc_xive_connect_vcpu+0xc0/0x520 [kvm]
+ [<000000006acbc81c>] kvm_arch_vcpu_ioctl+0x308/0x580 [kvm]
+ [<0000000089c69580>] kvm_vcpu_ioctl+0x19c/0xae0 [kvm]
+ [<00000000902ae91e>] ksys_ioctl+0x184/0x1b0
+ [<00000000f3e68bd7>] sys_ioctl+0x48/0xb0
+ [<0000000001b2c127>] system_call_exception+0x124/0x1f0
+ [<00000000d2b2ee40>] system_call_common+0xe8/0x214
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200612043303.84894-1-aik@ozlabs.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/sysdev/xive/native.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
+index 71b881e554fcb..cb58ec7ce77ac 100644
+--- a/arch/powerpc/sysdev/xive/native.c
++++ b/arch/powerpc/sysdev/xive/native.c
+@@ -18,6 +18,7 @@
+ #include <linux/delay.h>
+ #include <linux/cpumask.h>
+ #include <linux/mm.h>
++#include <linux/kmemleak.h>
+
+ #include <asm/machdep.h>
+ #include <asm/prom.h>
+@@ -647,6 +648,7 @@ static bool xive_native_provision_pages(void)
+ pr_err("Failed to allocate provisioning page\n");
+ return false;
+ }
++ kmemleak_ignore(p);
+ opal_xive_donate_page(chip, __pa(p));
+ }
+ return true;
+--
+2.25.1
+
--- /dev/null
+From 9a5d79aff966d1e020362eb1234a0e3e2cc21567 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jun 2020 15:21:12 +0200
+Subject: rtlwifi: rtl8192cu: Prevent leaking urb
+
+From: Reto Schneider <code@reto-schneider.ch>
+
+[ Upstream commit 03128643eb5453a798db5770952c73dc64fcaf00 ]
+
+If usb_submit_urb fails the allocated urb should be unanchored and
+released.
+
+Signed-off-by: Reto Schneider <code@reto-schneider.ch>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200622132113.14508-3-code@reto-schneider.ch
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index c66c6dc003783..bad06939a247c 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -718,8 +718,11 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw)
+
+ usb_anchor_urb(urb, &rtlusb->rx_submitted);
+ err = usb_submit_urb(urb, GFP_KERNEL);
+- if (err)
++ if (err) {
++ usb_unanchor_urb(urb);
++ usb_free_urb(urb);
+ goto err_out;
++ }
+ usb_free_urb(urb);
+ }
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From 5dafc2718e2bb85b8bbaa56dbc0b955b17ea3907 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 01:18:24 -0700
+Subject: scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del()
+
+From: Javed Hasan <jhasan@marvell.com>
+
+[ Upstream commit e95b4789ff4380733006836d28e554dc296b2298 ]
+
+In fcoe_sysfs_fcf_del(), we first deleted the fcf from the list and then
+freed it if ctlr_dev was not NULL. This was causing a memory leak.
+
+Free the fcf even if ctlr_dev is NULL.
+
+Link: https://lore.kernel.org/r/20200729081824.30996-3-jhasan@marvell.com
+Reviewed-by: Girish Basrur <gbasrur@marvell.com>
+Reviewed-by: Santosh Vernekar <svernekar@marvell.com>
+Reviewed-by: Saurav Kashyap <skashyap@marvell.com>
+Reviewed-by: Shyam Sundar <ssundar@marvell.com>
+Signed-off-by: Javed Hasan <jhasan@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fcoe/fcoe_ctlr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
+index 1791a393795da..07a0dadc75bf5 100644
+--- a/drivers/scsi/fcoe/fcoe_ctlr.c
++++ b/drivers/scsi/fcoe/fcoe_ctlr.c
+@@ -255,9 +255,9 @@ static void fcoe_sysfs_fcf_del(struct fcoe_fcf *new)
+ WARN_ON(!fcf_dev);
+ new->fcf_dev = NULL;
+ fcoe_fcf_device_delete(fcf_dev);
+- kfree(new);
+ mutex_unlock(&cdev->lock);
+ }
++ kfree(new);
+ }
+
+ /**
+--
+2.25.1
+
--- /dev/null
+From 047c5fe389864fefa9f2e691197785c872d8111b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 16:12:26 +0800
+Subject: scsi: iscsi: Do not put host in iscsi_set_flashnode_param()
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit 68e12e5f61354eb42cfffbc20a693153fc39738e ]
+
+If scsi_host_lookup() fails we will jump to put_host which may cause a
+panic. Jump to exit_set_fnode instead.
+
+Link: https://lore.kernel.org/r/20200615081226.183068-1-jingxiangfeng@huawei.com
+Reviewed-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_transport_iscsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 7ae5024e78243..df07ecd94793a 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -3291,7 +3291,7 @@ static int iscsi_set_flashnode_param(struct iscsi_transport *transport,
+ pr_err("%s could not find host no %u\n",
+ __func__, ev->u.set_flashnode.host_no);
+ err = -ENODEV;
+- goto put_host;
++ goto exit_set_fnode;
+ }
+
+ idx = ev->u.set_flashnode.flashnode_idx;
+--
+2.25.1
+
--- /dev/null
+From a6c7b279049f019a9d45203c4a59d1d8467db2f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 14:49:54 -0700
+Subject: scsi: lpfc: Fix shost refcount mismatch when deleting vport
+
+From: Dick Kennedy <dick.kennedy@broadcom.com>
+
+[ Upstream commit 03dbfe0668e6692917ac278883e0586cd7f7d753 ]
+
+When vports are deleted, it is observed that there is memory/kthread
+leakage as the vport isn't fully being released.
+
+There is a shost reference taken in scsi_add_host_dma that is not released
+during scsi_remove_host. It was noticed that other drivers resolve this by
+doing a scsi_host_put after calling scsi_remove_host.
+
+The vport_delete routine is taking two references one that corresponds to
+an access to the scsi_host in the vport_delete routine and another that is
+released after the adapter mailbox command completes that destroys the VPI
+that corresponds to the vport.
+
+Remove one of the references taken such that the second reference that is
+put will complete the missing scsi_add_host_dma reference and the shost
+will be terminated.
+
+Link: https://lore.kernel.org/r/20200630215001.70793-8-jsmart2021@gmail.com
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_vport.c | 26 ++++++++------------------
+ 1 file changed, 8 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c
+index b766463579800..d0296f7cf45fc 100644
+--- a/drivers/scsi/lpfc/lpfc_vport.c
++++ b/drivers/scsi/lpfc/lpfc_vport.c
+@@ -642,27 +642,16 @@ lpfc_vport_delete(struct fc_vport *fc_vport)
+ vport->port_state < LPFC_VPORT_READY)
+ return -EAGAIN;
+ }
++
+ /*
+- * This is a bit of a mess. We want to ensure the shost doesn't get
+- * torn down until we're done with the embedded lpfc_vport structure.
+- *
+- * Beyond holding a reference for this function, we also need a
+- * reference for outstanding I/O requests we schedule during delete
+- * processing. But once we scsi_remove_host() we can no longer obtain
+- * a reference through scsi_host_get().
+- *
+- * So we take two references here. We release one reference at the
+- * bottom of the function -- after delinking the vport. And we
+- * release the other at the completion of the unreg_vpi that get's
+- * initiated after we've disposed of all other resources associated
+- * with the port.
++ * Take early refcount for outstanding I/O requests we schedule during
++ * delete processing for unreg_vpi. Always keep this before
++ * scsi_remove_host() as we can no longer obtain a reference through
++ * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL.
+ */
+ if (!scsi_host_get(shost))
+ return VPORT_INVAL;
+- if (!scsi_host_get(shost)) {
+- scsi_host_put(shost);
+- return VPORT_INVAL;
+- }
++
+ lpfc_free_sysfs_attr(vport);
+
+ lpfc_debugfs_terminate(vport);
+@@ -809,8 +798,9 @@ skip_logo:
+ if (!(vport->vpi_state & LPFC_VPI_REGISTERED) ||
+ lpfc_mbx_unreg_vpi(vport))
+ scsi_host_put(shost);
+- } else
++ } else {
+ scsi_host_put(shost);
++ }
+
+ lpfc_free_vpi(phba, vport->vpi);
+ vport->work_port_events = 0;
+--
+2.25.1
+
--- /dev/null
+From b841d34da58700cc8f844dc94ee6a7a0a1815519 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jul 2020 20:43:18 -0500
+Subject: scsi: target: Fix xcopy sess release leak
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit 3c006c7d23aac928279f7cbe83bbac4361255d53 ]
+
+transport_init_session can allocate memory via percpu_ref_init, and
+target_xcopy_release_pt never frees it. This adds a
+transport_uninit_session function to handle cleanup of resources allocated
+in the init function.
+
+Link: https://lore.kernel.org/r/1593654203-12442-3-git-send-email-michael.christie@oracle.com
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_internal.h | 1 +
+ drivers/target/target_core_transport.c | 7 ++++++-
+ drivers/target/target_core_xcopy.c | 11 +++++++++--
+ 3 files changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
+index 8533444159635..e7b3c6e5d5744 100644
+--- a/drivers/target/target_core_internal.h
++++ b/drivers/target/target_core_internal.h
+@@ -138,6 +138,7 @@ int init_se_kmem_caches(void);
+ void release_se_kmem_caches(void);
+ u32 scsi_get_new_index(scsi_index_t);
+ void transport_subsystem_check_init(void);
++void transport_uninit_session(struct se_session *);
+ unsigned char *transport_dump_cmd_direction(struct se_cmd *);
+ void transport_dump_dev_state(struct se_device *, char *, int *);
+ void transport_dump_dev_info(struct se_device *, struct se_lun *,
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 90ecdd706a017..e6e1fa68de542 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -236,6 +236,11 @@ int transport_init_session(struct se_session *se_sess)
+ }
+ EXPORT_SYMBOL(transport_init_session);
+
++void transport_uninit_session(struct se_session *se_sess)
++{
++ percpu_ref_exit(&se_sess->cmd_count);
++}
++
+ /**
+ * transport_alloc_session - allocate a session object and initialize it
+ * @sup_prot_ops: bitmask that defines which T10-PI modes are supported.
+@@ -579,7 +584,7 @@ void transport_free_session(struct se_session *se_sess)
+ sbitmap_queue_free(&se_sess->sess_tag_pool);
+ kvfree(se_sess->sess_cmd_map);
+ }
+- percpu_ref_exit(&se_sess->cmd_count);
++ transport_uninit_session(se_sess);
+ kmem_cache_free(se_sess_cache, se_sess);
+ }
+ EXPORT_SYMBOL(transport_free_session);
+diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
+index 0d00ccbeb0503..44e15d7fb2f09 100644
+--- a/drivers/target/target_core_xcopy.c
++++ b/drivers/target/target_core_xcopy.c
+@@ -474,7 +474,7 @@ int target_xcopy_setup_pt(void)
+ memset(&xcopy_pt_sess, 0, sizeof(struct se_session));
+ ret = transport_init_session(&xcopy_pt_sess);
+ if (ret < 0)
+- return ret;
++ goto destroy_wq;
+
+ xcopy_pt_nacl.se_tpg = &xcopy_pt_tpg;
+ xcopy_pt_nacl.nacl_sess = &xcopy_pt_sess;
+@@ -483,12 +483,19 @@ int target_xcopy_setup_pt(void)
+ xcopy_pt_sess.se_node_acl = &xcopy_pt_nacl;
+
+ return 0;
++
++destroy_wq:
++ destroy_workqueue(xcopy_wq);
++ xcopy_wq = NULL;
++ return ret;
+ }
+
+ void target_xcopy_release_pt(void)
+ {
+- if (xcopy_wq)
++ if (xcopy_wq) {
+ destroy_workqueue(xcopy_wq);
++ transport_uninit_session(&xcopy_pt_sess);
++ }
+ }
+
+ /*
+--
+2.25.1
+
--- /dev/null
+From cd1dc657316de9b588c3e7cd3e4d72d734e3914a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 11:37:56 +0200
+Subject: scsi: target: tcmu: Fix crash on ARM during cmd completion
+
+From: Bodo Stroesser <bstroesser@ts.fujitsu.com>
+
+[ Upstream commit 5a0c256d96f020e4771f6fd5524b80f89a2d3132 ]
+
+If tcmu_handle_completions() has to process a padding shorter than
+sizeof(struct tcmu_cmd_entry), the current call to
+tcmu_flush_dcache_range() with sizeof(struct tcmu_cmd_entry) as length
+param is wrong and causes crashes on e.g. ARM, because
+tcmu_flush_dcache_range() in this case calls
+flush_dcache_page(vmalloc_to_page(start)); with start being an invalid
+address above the end of the vmalloc'ed area.
+
+The fix is to use the minimum of remaining ring space and sizeof(struct
+tcmu_cmd_entry) as the length param.
+
+The patch was tested on kernel 4.19.118.
+
+See https://bugzilla.kernel.org/show_bug.cgi?id=208045#c10
+
+Link: https://lore.kernel.org/r/20200629093756.8947-1-bstroesser@ts.fujitsu.com
+Tested-by: JiangYu <lnsyyj@hotmail.com>
+Acked-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_user.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 63cca0e1e9123..9ab960cc39b6f 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -1220,7 +1220,14 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+
+ struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned;
+
+- tcmu_flush_dcache_range(entry, sizeof(*entry));
++ /*
++ * Flush max. up to end of cmd ring since current entry might
++ * be a padding that is shorter than sizeof(*entry)
++ */
++ size_t ring_left = head_to_end(udev->cmdr_last_cleaned,
++ udev->cmdr_size);
++ tcmu_flush_dcache_range(entry, ring_left < sizeof(*entry) ?
++ ring_left : sizeof(*entry));
+
+ if (tcmu_hdr_get_op(entry->hdr.len_op) == TCMU_OP_PAD) {
+ UPDATE_HEAD(udev->cmdr_last_cleaned,
+--
+2.25.1
+
--- /dev/null
+From 0ccc008dade7da698e3614cf155cda291c5de9d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 13:47:37 -0300
+Subject: selftests/powerpc: Purge extra count_pmc() calls of ebb selftests
+
+From: Desnes A. Nunes do Rosario <desnesn@linux.ibm.com>
+
+[ Upstream commit 3337bf41e0dd70b4064cdf60acdfcdc2d050066c ]
+
+An extra count on ebb_state.stats.pmc_count[PMC_INDEX(pmc)] is being per-
+formed when count_pmc() is used to reset PMCs on a few selftests. This
+extra pmc_count can occasionally invalidate results, such as the ones from
+cycles_test shown hereafter. The ebb_check_count() failed with an above
+the upper limit error due to the extra value on ebb_state.stats.pmc_count.
+
+Furthermore, this extra count is also indicated by extra PMC1 trace_log on
+the output of the cycle test (as well as on pmc56_overflow_test):
+
+==========
+ ...
+ [21]: counter = 8
+ [22]: register SPRN_MMCR0 = 0x0000000080000080
+ [23]: register SPRN_PMC1 = 0x0000000080000004
+ [24]: counter = 9
+ [25]: register SPRN_MMCR0 = 0x0000000080000080
+ [26]: register SPRN_PMC1 = 0x0000000080000004
+ [27]: counter = 10
+ [28]: register SPRN_MMCR0 = 0x0000000080000080
+ [29]: register SPRN_PMC1 = 0x0000000080000004
+>> [30]: register SPRN_PMC1 = 0x000000004000051e
+PMC1 count (0x280000546) above upper limit 0x2800003e8 (+0x15e)
+[FAIL] Test FAILED on line 52
+failure: cycles
+==========
+
+Signed-off-by: Desnes A. Nunes do Rosario <desnesn@linux.ibm.com>
+Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200626164737.21943-1-desnesn@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c | 2 --
+ tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c | 2 --
+ .../selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c | 2 --
+ .../selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c | 2 --
+ tools/testing/selftests/powerpc/pmu/ebb/ebb.c | 2 --
+ .../selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c | 2 --
+ .../selftests/powerpc/pmu/ebb/lost_exception_test.c | 1 -
+ .../testing/selftests/powerpc/pmu/ebb/multi_counter_test.c | 7 -------
+ .../selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c | 2 --
+ .../testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c | 2 --
+ .../selftests/powerpc/pmu/ebb/pmc56_overflow_test.c | 2 --
+ 11 files changed, 26 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
+index a2d7b0e3dca97..a26ac122c759f 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
+@@ -91,8 +91,6 @@ int back_to_back_ebbs(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ event_close(&event);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
+index bc893813483ee..bb9f587fa76e8 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
+@@ -42,8 +42,6 @@ int cycles(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ event_close(&event);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
+index dcd351d203289..9ae795ce314e6 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
+@@ -99,8 +99,6 @@ int cycles_with_freeze(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ printf("EBBs while frozen %d\n", ebbs_while_frozen);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
+index 94c99c12c0f23..4b45a2e70f62b 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
+@@ -71,8 +71,6 @@ int cycles_with_mmcr2(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ event_close(&event);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
+index dfbc5c3ad52d7..21537d6eb6b7d 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
+@@ -396,8 +396,6 @@ int ebb_child(union pipe read_pipe, union pipe write_pipe)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ event_close(&event);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
+index ca2f7d729155b..b208bf6ad58d3 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
+@@ -38,8 +38,6 @@ static int victim_child(union pipe read_pipe, union pipe write_pipe)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ FAIL_IF(ebb_state.stats.ebb_count == 0);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
+index ac3e6e182614a..ba2681a12cc7b 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
+@@ -75,7 +75,6 @@ static int test_body(void)
+ ebb_freeze_pmcs();
+ ebb_global_disable();
+
+- count_pmc(4, sample_period);
+ mtspr(SPRN_PMC4, 0xdead);
+
+ dump_summary_ebb_state();
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
+index b8242e9d97d2d..791d37ba327b5 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
+@@ -70,13 +70,6 @@ int multi_counter(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+- count_pmc(2, sample_period);
+- count_pmc(3, sample_period);
+- count_pmc(4, sample_period);
+- count_pmc(5, sample_period);
+- count_pmc(6, sample_period);
+-
+ dump_ebb_state();
+
+ for (i = 0; i < 6; i++)
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
+index a05c0e18ded63..9b0f70d597020 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
+@@ -61,8 +61,6 @@ static int cycles_child(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_summary_ebb_state();
+
+ event_close(&event);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
+index 153ebc92234fd..2904c741e04e5 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
+@@ -82,8 +82,6 @@ static int test_body(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ if (mmcr0_mismatch)
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
+index eadad75ed7e6f..b29f8ba22d1e6 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
+@@ -76,8 +76,6 @@ int pmc56_overflow(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(2, sample_period);
+-
+ dump_ebb_state();
+
+ printf("PMC5/6 overflow %d\n", pmc56_overflowed);
+--
+2.25.1
+
--- /dev/null
+khugepaged-khugepaged_test_exit-check-mmget_still_va.patch
+asoc-intel-skl-hda-fix-probe-regression-on-systems-w.patch
+alsa-hda-hdmi-add-quirk-to-force-connectivity.patch
+alsa-pci-delete-repeated-words-in-comments.patch
+alsa-hda-realtek-fix-pin-default-on-intel-nuc-8-rugg.patch
+alsa-hda-hdmi-use-force-connectivity-quirk-on-anothe.patch
+drm-amdgpu-fix-ras-memory-leak-in-error-case.patch
+edac-mc-call-edac_inc_ue_error-before-panic.patch
+asoc-img-fix-a-reference-count-leak-in-img_i2s_in_se.patch
+asoc-img-parallel-out-fix-a-reference-count-leak.patch
+asoc-tegra-fix-reference-count-leaks.patch
+mfd-intel-lpss-add-intel-emmitsburg-pch-pci-ids.patch
+arm64-dts-qcom-msm8916-pull-down-pdm-gpios-during-sl.patch
+powerpc-xive-ignore-kmemleak-false-positives.patch
+media-pci-ttpci-av7110-fix-possible-buffer-overflow-.patch
+gcc-plugins-stackleak-don-t-instrument-itself.patch
+blktrace-ensure-our-debugfs-dir-exists.patch
+staging-rts5208-fix-memleaks-on-error-handling-paths.patch
+scsi-target-tcmu-fix-crash-on-arm-during-cmd-complet.patch
+mfd-intel-lpss-add-intel-tiger-lake-pch-h-pci-ids.patch
+iommu-iova-don-t-bug-on-invalid-pfns.patch
+platform-chrome-cros_ec_sensorhub-fix-ec-timestamp-o.patch
+drm-amdkfd-fix-reference-count-leaks.patch
+drm-radeon-fix-multiple-reference-count-leak.patch
+drm-amdgpu-fix-ref-count-leak-in-amdgpu_driver_open_.patch
+drm-amd-display-fix-ref-count-leak-in-amdgpu_drm_ioc.patch
+drm-amdgpu-fix-ref-count-leak-in-amdgpu_display_crtc.patch
+drm-amdgpu-display-fix-ref-count-leak-when-pm_runtim.patch
+drm-amdgpu-fence-fix-ref-count-leak-when-pm_runtime_.patch
+drm-amdkfd-fix-ref-count-leak-when-pm_runtime_get_sy.patch
+drm-amdgpu-pm-fix-ref-count-leak-when-pm_runtime_get.patch
+scsi-lpfc-fix-shost-refcount-mismatch-when-deleting-.patch
+xfs-don-t-allow-logging-of-xfs_istale-inodes.patch
+scsi-target-fix-xcopy-sess-release-leak.patch
+selftests-powerpc-purge-extra-count_pmc-calls-of-ebb.patch
+f2fs-remove-write-attribute-of-main_blkaddr-sysfs-no.patch
+f2fs-fix-error-path-in-do_recover_data.patch
+mips-kvm-limit-trap-and-emulate-to-mips32r2-only.patch
+omapfb-fix-multiple-reference-count-leaks-due-to-pm_.patch
+pci-fix-pci_create_slot-reference-count-leak.patch
+arm-dts-ls1021a-output-pps-signal-on-fiper2.patch
+rtlwifi-rtl8192cu-prevent-leaking-urb.patch
+mips-vdso-fix-resource-leaks-in-genvdso.c.patch
+alsa-hda-add-support-for-loongson-7a1000-controller.patch
+gpu-host1x-put-gather-s-bo-on-pinning-error.patch
+cec-api-prevent-leaking-memory-through-hole-in-struc.patch
+asoc-intel-sof_sdw_rt711-remove-properties-in-card-r.patch
+hid-quirks-add-noget-quirk-for-logitech-group.patch
+f2fs-fix-use-after-free-issue.patch
+drm-nouveau-drm-noveau-fix-reference-count-leak-in-n.patch
+drm-nouveau-fix-reference-count-leak-in-nv50_disp_at.patch
+drm-nouveau-fix-reference-count-leak-in-nouveau_conn.patch
+locking-lockdep-fix-overflow-in-presentation-of-aver.patch
+btrfs-file-reserve-qgroup-space-after-the-hole-punch.patch
+btrfs-make-btrfs_qgroup_check_reserved_leak-take-btr.patch
+scsi-iscsi-do-not-put-host-in-iscsi_set_flashnode_pa.patch
+netfilter-nf_tables-report-eexist-on-overlaps.patch
+ceph-fix-potential-mdsc-use-after-free-crash.patch
+ceph-do-not-access-the-kiocb-after-aio-requests.patch
+scsi-fcoe-memory-leak-fix-in-fcoe_sysfs_fcf_del.patch
+i2c-i801-add-support-for-intel-tiger-lake-pch-h.patch
+edac-ie31200-fallback-if-host-bridge-device-is-alrea.patch
+hugetlbfs-prevent-filesystem-stacking-of-hugetlbfs.patch
--- /dev/null
+From 6fc4f98e8e12208407f6994a71e7a38ea77428ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jun 2020 17:12:30 +0300
+Subject: staging: rts5208: fix memleaks on error handling paths in probe
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit 11507bf9a8832741db69efd32bf09a2ab26426bf ]
+
+rtsx_probe() allocates host, but does not free it on error handling
+paths. The patch adds missed scsi_host_put().
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Link: https://lore.kernel.org/r/20200623141230.7258-1-novikov@ispras.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rts5208/rtsx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/rts5208/rtsx.c b/drivers/staging/rts5208/rtsx.c
+index be0053c795b7a..937f4e732a75c 100644
+--- a/drivers/staging/rts5208/rtsx.c
++++ b/drivers/staging/rts5208/rtsx.c
+@@ -972,6 +972,7 @@ ioremap_fail:
+ kfree(dev->chip);
+ chip_alloc_fail:
+ dev_err(&pci->dev, "%s failed\n", __func__);
++ scsi_host_put(host);
+ scsi_host_alloc_fail:
+ pci_release_regions(pci);
+ return err;
+--
+2.25.1
+
--- /dev/null
+From 7c284257e5970e777a9fe168acebc2c6dea70938 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 14:48:45 -0700
+Subject: xfs: Don't allow logging of XFS_ISTALE inodes
+
+From: Dave Chinner <dchinner@redhat.com>
+
+[ Upstream commit 96355d5a1f0ee6dcc182c37db4894ec0c29f1692 ]
+
+In tracking down a problem in this patchset, I discovered we are
+reclaiming dirty stale inodes. This wasn't discovered until inodes
+were always attached to the cluster buffer and then the rcu callback
+that freed inodes was assert failing because the inode still had an
+active pointer to the cluster buffer after it had been reclaimed.
+
+Debugging the issue indicated that this was a pre-existing issue
+resulting from the way the inodes are handled in xfs_inactive_ifree.
+When we free a cluster buffer from xfs_ifree_cluster, all the inodes
+in cache are marked XFS_ISTALE. Those that are clean have nothing
+else done to them and so eventually get cleaned up by background
+reclaim. i.e. it is assumed we'll never dirty/relog an inode marked
+XFS_ISTALE.
+
+On journal commit dirty stale inodes as are handled by both
+buffer and inode log items to run though xfs_istale_done() and
+removed from the AIL (buffer log item commit) or the log item will
+simply unpin it because the buffer log item will clean it. What happens
+to any specific inode is entirely dependent on which log item wins
+the commit race, but the result is the same - stale inodes are
+clean, not attached to the cluster buffer, and not in the AIL. Hence
+inode reclaim can just free these inodes without further care.
+
+However, if the stale inode is relogged, it gets dirtied again and
+relogged into the CIL. Most of the time this isn't an issue, because
+relogging simply changes the inode's location in the current
+checkpoint. Problems arise, however, when the CIL checkpoints
+between two transactions in the xfs_inactive_ifree() deferops
+processing. This results in the XFS_ISTALE inode being redirtied
+and inserted into the CIL without any of the other stale cluster
+buffer infrastructure being in place.
+
+Hence on journal commit, it simply gets unpinned, so it remains
+dirty in memory. Everything in inode writeback avoids XFS_ISTALE
+inodes so it can't be written back, and it is not tracked in the AIL
+so there's not even a trigger to attempt to clean the inode. Hence
+the inode just sits dirty in memory until inode reclaim comes along,
+sees that it is XFS_ISTALE, and goes to reclaim it. This reclaiming
+of a dirty inode caused use after free, list corruptions and other
+nasty issues later in this patchset.
+
+Hence this patch addresses a violation of the "never log XFS_ISTALE
+inodes" caused by the deferops processing rolling a transaction
+and relogging a stale inode in xfs_inactive_free. It also adds a
+bunch of asserts to catch this problem in debug kernels so that
+we don't reintroduce this problem in future.
+
+Reproducer for this issue was generic/558 on a v4 filesystem.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_trans_inode.c | 2 ++
+ fs/xfs/xfs_icache.c | 3 ++-
+ fs/xfs/xfs_inode.c | 25 ++++++++++++++++++++++---
+ 3 files changed, 26 insertions(+), 4 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_trans_inode.c b/fs/xfs/libxfs/xfs_trans_inode.c
+index b5dfb66548422..4504d215cd590 100644
+--- a/fs/xfs/libxfs/xfs_trans_inode.c
++++ b/fs/xfs/libxfs/xfs_trans_inode.c
+@@ -36,6 +36,7 @@ xfs_trans_ijoin(
+
+ ASSERT(iip->ili_lock_flags == 0);
+ iip->ili_lock_flags = lock_flags;
++ ASSERT(!xfs_iflags_test(ip, XFS_ISTALE));
+
+ /*
+ * Get a log_item_desc to point at the new item.
+@@ -89,6 +90,7 @@ xfs_trans_log_inode(
+
+ ASSERT(ip->i_itemp != NULL);
+ ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
++ ASSERT(!xfs_iflags_test(ip, XFS_ISTALE));
+
+ /*
+ * Don't bother with i_lock for the I_DIRTY_TIME check here, as races
+diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
+index 5daef654956cb..59dea8178ae3c 100644
+--- a/fs/xfs/xfs_icache.c
++++ b/fs/xfs/xfs_icache.c
+@@ -1141,7 +1141,7 @@ restart:
+ goto out_ifunlock;
+ xfs_iunpin_wait(ip);
+ }
+- if (xfs_iflags_test(ip, XFS_ISTALE) || xfs_inode_clean(ip)) {
++ if (xfs_inode_clean(ip)) {
+ xfs_ifunlock(ip);
+ goto reclaim;
+ }
+@@ -1228,6 +1228,7 @@ reclaim:
+ xfs_ilock(ip, XFS_ILOCK_EXCL);
+ xfs_qm_dqdetach(ip);
+ xfs_iunlock(ip, XFS_ILOCK_EXCL);
++ ASSERT(xfs_inode_clean(ip));
+
+ __xfs_inode_free(ip);
+ return error;
+diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
+index 9aea7d68d8ab9..6d70daf1c92a7 100644
+--- a/fs/xfs/xfs_inode.c
++++ b/fs/xfs/xfs_inode.c
+@@ -1740,10 +1740,31 @@ xfs_inactive_ifree(
+ return error;
+ }
+
++ /*
++ * We do not hold the inode locked across the entire rolling transaction
++ * here. We only need to hold it for the first transaction that
++ * xfs_ifree() builds, which may mark the inode XFS_ISTALE if the
++ * underlying cluster buffer is freed. Relogging an XFS_ISTALE inode
++ * here breaks the relationship between cluster buffer invalidation and
++ * stale inode invalidation on cluster buffer item journal commit
++ * completion, and can result in leaving dirty stale inodes hanging
++ * around in memory.
++ *
++ * We have no need for serialising this inode operation against other
++ * operations - we freed the inode and hence reallocation is required
++ * and that will serialise on reallocating the space the deferops need
++ * to free. Hence we can unlock the inode on the first commit of
++ * the transaction rather than roll it right through the deferops. This
++ * avoids relogging the XFS_ISTALE inode.
++ *
++ * We check that xfs_ifree() hasn't grown an internal transaction roll
++ * by asserting that the inode is still locked when it returns.
++ */
+ xfs_ilock(ip, XFS_ILOCK_EXCL);
+- xfs_trans_ijoin(tp, ip, 0);
++ xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
+
+ error = xfs_ifree(tp, ip);
++ ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
+ if (error) {
+ /*
+ * If we fail to free the inode, shut down. The cancel
+@@ -1756,7 +1777,6 @@ xfs_inactive_ifree(
+ xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR);
+ }
+ xfs_trans_cancel(tp);
+- xfs_iunlock(ip, XFS_ILOCK_EXCL);
+ return error;
+ }
+
+@@ -1774,7 +1794,6 @@ xfs_inactive_ifree(
+ xfs_notice(mp, "%s: xfs_trans_commit returned error %d",
+ __func__, error);
+
+- xfs_iunlock(ip, XFS_ILOCK_EXCL);
+ return 0;
+ }
+
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
