--- /dev/null
+From b9a3589332c2a25fb7edad25a26fcaada3209126 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 5 Dec 2017 11:57:27 +0100
+Subject: iio: ABI: Fix name of timestamp sysfs file
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit b9a3589332c2a25fb7edad25a26fcaada3209126 upstream.
+
+The name of the file is "current_timetamp_clock" not
+"timestamp_clock".
+
+Fixes: bc2b7dab629a ("iio:core: timestamping clock selection support")
+Cc: Gregor Boirie <gregor.boirie@parrot.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/ABI/testing/sysfs-bus-iio | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/ABI/testing/sysfs-bus-iio
++++ b/Documentation/ABI/testing/sysfs-bus-iio
+@@ -32,7 +32,7 @@ Description:
+ Description of the physical chip / device for device X.
+ Typically a part number.
+
+-What: /sys/bus/iio/devices/iio:deviceX/timestamp_clock
++What: /sys/bus/iio/devices/iio:deviceX/current_timestamp_clock
+ KernelVersion: 4.5
+ Contact: linux-iio@vger.kernel.org
+ Description:
--- /dev/null
+From 7b9ebe428266fb7e0a6d769bb3ff3fcb6044b15e Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Mon, 1 Jan 2018 19:54:42 +0100
+Subject: iio: imu: st_lsm6dsx: fix endianness in st_lsm6dsx_read_oneshot()
+
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+
+commit 7b9ebe428266fb7e0a6d769bb3ff3fcb6044b15e upstream.
+
+Apply le16_to_cpu() to data read from the sensor in order to take into
+account architecture endianness
+
+Fixes: 290a6ce11d93 (iio: imu: add support to lsm6dsx driver)
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
+@@ -392,7 +392,7 @@ static int st_lsm6dsx_read_oneshot(struc
+
+ st_lsm6dsx_sensor_disable(sensor);
+
+- *val = (s16)data;
++ *val = (s16)le16_to_cpu(data);
+
+ return IIO_VAL_INT;
+ }
perf-core-fix-ctx_event_type-in-ctx_resched.patch
perf-x86-intel-don-t-accidentally-clear-high-bits-in-bdw_limit_period.patch
perf-x86-intel-uncore-fix-multi-domain-pci-cha-enumeration-bug-on-skylake-servers.patch
+iio-abi-fix-name-of-timestamp-sysfs-file.patch
+iio-imu-st_lsm6dsx-fix-endianness-in-st_lsm6dsx_read_oneshot.patch
+staging-android-ion-zero-cma-allocated-memory.patch
+staging-lustre-ptlrpc-kfree-used-instead-of-kvfree.patch
+usb-xhci-disable-slot-even-when-virt-dev-is-null.patch
+usb-xhci-fix-potential-memory-leak-in-xhci_disable_slot.patch
--- /dev/null
+From 6d79bd5bb6c79a9dba4842040c9adf39e7806330 Mon Sep 17 00:00:00 2001
+From: Liam Mark <lmark@codeaurora.org>
+Date: Fri, 26 Jan 2018 09:48:18 -0800
+Subject: staging: android: ion: Zero CMA allocated memory
+
+From: Liam Mark <lmark@codeaurora.org>
+
+commit 6d79bd5bb6c79a9dba4842040c9adf39e7806330 upstream.
+
+Since commit 204f672255c2 ("staging: android: ion: Use CMA APIs directly")
+the CMA API is now used directly and therefore the allocated memory is no
+longer automatically zeroed.
+
+Explicitly zero CMA allocated memory to ensure that no data is exposed to
+userspace.
+
+Fixes: 204f672255c2 ("staging: android: ion: Use CMA APIs directly")
+Signed-off-by: Liam Mark <lmark@codeaurora.org>
+Acked-by: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/android/ion/ion_cma_heap.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/staging/android/ion/ion_cma_heap.c
++++ b/drivers/staging/android/ion/ion_cma_heap.c
+@@ -21,6 +21,7 @@
+ #include <linux/err.h>
+ #include <linux/cma.h>
+ #include <linux/scatterlist.h>
++#include <linux/highmem.h>
+
+ #include "ion.h"
+
+@@ -51,6 +52,22 @@ static int ion_cma_allocate(struct ion_h
+ if (!pages)
+ return -ENOMEM;
+
++ if (PageHighMem(pages)) {
++ unsigned long nr_clear_pages = nr_pages;
++ struct page *page = pages;
++
++ while (nr_clear_pages > 0) {
++ void *vaddr = kmap_atomic(page);
++
++ memset(vaddr, 0, PAGE_SIZE);
++ kunmap_atomic(vaddr);
++ page++;
++ nr_clear_pages--;
++ }
++ } else {
++ memset(page_address(pages), 0, size);
++ }
++
+ table = kmalloc(sizeof(*table), GFP_KERNEL);
+ if (!table)
+ goto err;
--- /dev/null
+From c3eec59659cf25916647d2178c541302bb4822ad Mon Sep 17 00:00:00 2001
+From: Nadav Amit <namit@vmware.com>
+Date: Tue, 5 Sep 2017 20:25:25 +0000
+Subject: staging: lustre: ptlrpc: kfree used instead of kvfree
+
+From: Nadav Amit <namit@vmware.com>
+
+commit c3eec59659cf25916647d2178c541302bb4822ad upstream.
+
+rq_reqbuf is allocated using kvmalloc() but released in one occasion
+using kfree() instead of kvfree().
+
+The issue was found using grep based on a similar bug.
+
+Fixes: d7e09d0397e8 ("add Lustre file system client support")
+Fixes: ee0ec1946ec2 ("lustre: ptlrpc: Replace uses of OBD_{ALLOC,FREE}_LARGE")
+
+Cc: Peng Tao <bergwolf@gmail.com>
+Cc: Oleg Drokin <oleg.drokin@intel.com>
+Cc: James Simmons <jsimmons@infradead.org>
+
+Signed-off-by: Nadav Amit <namit@vmware.com>
+Signed-off-by: Andreas Dilger <andreas.dilger@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/lustre/lustre/ptlrpc/sec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/lustre/lustre/ptlrpc/sec.c
++++ b/drivers/staging/lustre/lustre/ptlrpc/sec.c
+@@ -847,7 +847,7 @@ void sptlrpc_request_out_callback(struct
+ if (req->rq_pool || !req->rq_reqbuf)
+ return;
+
+- kfree(req->rq_reqbuf);
++ kvfree(req->rq_reqbuf);
+ req->rq_reqbuf = NULL;
+ req->rq_reqbuf_len = 0;
+ }
--- /dev/null
+From b64149ca016c25f30b39ac5a8f37cfb9017e19bb Mon Sep 17 00:00:00 2001
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Thu, 5 Oct 2017 11:21:40 +0300
+Subject: usb: xhci: Disable slot even when virt-dev is null
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+commit b64149ca016c25f30b39ac5a8f37cfb9017e19bb upstream.
+
+xhci_disable_slot() is a helper for disabling a slot when a device
+goes away or recovers from error situations. Currently, it checks
+the corespoding virt-dev pointer and returns directly (w/o issuing
+disable slot command) if it's null.
+
+This is unnecessary and will cause problems in case where virt-dev
+allocation fails and xhci_disable_slot() is called to roll back the
+hardware state. Refer to the implementation of xhci_alloc_dev().
+
+This patch removes lines to check virt-dev in xhci_disable_slot().
+
+Fixes: f9e609b82479 ("usb: xhci: Add helper function xhci_disable_slot().")
+Cc: Guoqing Zhang <guoqing.zhang@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 3 +++
+ drivers/usb/host/xhci.c | 4 ----
+ 2 files changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -634,6 +634,9 @@ static int xhci_enter_test_mode(struct x
+ xhci_dbg(xhci, "Disable all slots\n");
+ spin_unlock_irqrestore(&xhci->lock, *flags);
+ for (i = 1; i <= HCS_MAX_SLOTS(xhci->hcs_params1); i++) {
++ if (!xhci->devs[i])
++ continue;
++
+ retval = xhci_disable_slot(xhci, NULL, i);
+ if (retval)
+ xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n",
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3571,11 +3571,7 @@ int xhci_disable_slot(struct xhci_hcd *x
+ unsigned long flags;
+ u32 state;
+ int ret = 0;
+- struct xhci_virt_device *virt_dev;
+
+- virt_dev = xhci->devs[slot_id];
+- if (!virt_dev)
+- return -EINVAL;
+ if (!command)
+ command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
+ if (!command)
--- /dev/null
+From cd3f1790b006d91786728c20a01da21ee277aff1 Mon Sep 17 00:00:00 2001
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Thu, 5 Oct 2017 11:21:41 +0300
+Subject: usb: xhci: Fix potential memory leak in xhci_disable_slot()
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+commit cd3f1790b006d91786728c20a01da21ee277aff1 upstream.
+
+xhci_disable_slot() allows the invoker to pass a command pointer
+as paramenter. Otherwise, it will allocate one. This will cause
+memory leak when a command structure was allocated inside of this
+function while queuing command trb fails. Another problem comes up
+when the invoker passed a command pointer, but xhci_disable_slot()
+frees it when it detects a dead host.
+
+This patch fixes these two problems by removing the command parameter
+from xhci_disable_slot().
+
+Fixes: f9e609b82479 ("usb: xhci: Add helper function xhci_disable_slot().")
+Cc: Guoqing Zhang <guoqing.zhang@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 2 +-
+ drivers/usb/host/xhci.c | 30 +++++++++---------------------
+ drivers/usb/host/xhci.h | 3 +--
+ 3 files changed, 11 insertions(+), 24 deletions(-)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -637,7 +637,7 @@ static int xhci_enter_test_mode(struct x
+ if (!xhci->devs[i])
+ continue;
+
+- retval = xhci_disable_slot(xhci, NULL, i);
++ retval = xhci_disable_slot(xhci, i);
+ if (retval)
+ xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n",
+ i, retval);
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3523,11 +3523,6 @@ static void xhci_free_dev(struct usb_hcd
+ struct xhci_virt_device *virt_dev;
+ struct xhci_slot_ctx *slot_ctx;
+ int i, ret;
+- struct xhci_command *command;
+-
+- command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
+- if (!command)
+- return;
+
+ #ifndef CONFIG_USB_DEFAULT_PERSIST
+ /*
+@@ -3543,10 +3538,8 @@ static void xhci_free_dev(struct usb_hcd
+ /* If the host is halted due to driver unload, we still need to free the
+ * device.
+ */
+- if (ret <= 0 && ret != -ENODEV) {
+- kfree(command);
++ if (ret <= 0 && ret != -ENODEV)
+ return;
+- }
+
+ virt_dev = xhci->devs[udev->slot_id];
+ slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx);
+@@ -3558,22 +3551,21 @@ static void xhci_free_dev(struct usb_hcd
+ del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
+ }
+
+- xhci_disable_slot(xhci, command, udev->slot_id);
++ xhci_disable_slot(xhci, udev->slot_id);
+ /*
+ * Event command completion handler will free any data structures
+ * associated with the slot. XXX Can free sleep?
+ */
+ }
+
+-int xhci_disable_slot(struct xhci_hcd *xhci, struct xhci_command *command,
+- u32 slot_id)
++int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
+ {
++ struct xhci_command *command;
+ unsigned long flags;
+ u32 state;
+ int ret = 0;
+
+- if (!command)
+- command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
++ command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
+ if (!command)
+ return -ENOMEM;
+
+@@ -3591,7 +3583,7 @@ int xhci_disable_slot(struct xhci_hcd *x
+ slot_id);
+ if (ret) {
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- xhci_dbg(xhci, "FIXME: allocate a command ring segment\n");
++ kfree(command);
+ return ret;
+ }
+ xhci_ring_cmd_db(xhci);
+@@ -3666,6 +3658,8 @@ int xhci_alloc_dev(struct usb_hcd *hcd,
+ return 0;
+ }
+
++ xhci_free_command(xhci, command);
++
+ if ((xhci->quirks & XHCI_EP_LIMIT_QUIRK)) {
+ spin_lock_irqsave(&xhci->lock, flags);
+ ret = xhci_reserve_host_control_ep_resources(xhci);
+@@ -3701,18 +3695,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd,
+ pm_runtime_get_noresume(hcd->self.controller);
+ #endif
+
+-
+- xhci_free_command(xhci, command);
+ /* Is this a LS or FS device under a HS hub? */
+ /* Hub or peripherial? */
+ return 1;
+
+ disable_slot:
+- /* Disable slot, if we can do it without mem alloc */
+- kfree(command->completion);
+- command->completion = NULL;
+- command->status = 0;
+- return xhci_disable_slot(xhci, command, udev->slot_id);
++ return xhci_disable_slot(xhci, udev->slot_id);
+ }
+
+ /*
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -2014,8 +2014,7 @@ int xhci_run(struct usb_hcd *hcd);
+ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks);
+ void xhci_init_driver(struct hc_driver *drv,
+ const struct xhci_driver_overrides *over);
+-int xhci_disable_slot(struct xhci_hcd *xhci,
+- struct xhci_command *command, u32 slot_id);
++int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id);
+
+ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup);
+ int xhci_resume(struct xhci_hcd *xhci, bool hibernated);
projects / thirdparty / kernel / stable-queue.git / commitdiff
