--- /dev/null
+From f060db99374e80e853ac4916b49f0a903f65e9dc Mon Sep 17 00:00:00 2001
+From: Jia He <justin.he@arm.com>
+Date: Wed, 22 Sep 2021 23:29:19 +0800
+Subject: ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect
+
+From: Jia He <justin.he@arm.com>
+
+commit f060db99374e80e853ac4916b49f0a903f65e9dc upstream.
+
+When ACPI NFIT table is failing to populate correct numa information
+on arm64, dax_kmem will get NUMA_NO_NODE from the NFIT driver.
+
+Without this patch, pmem can't be probed as RAM devices on arm64 guest:
+ $ndctl create-namespace -fe namespace0.0 --mode=devdax --map=dev -s 1g -a 128M
+ kmem dax0.0: rejecting DAX region [mem 0x240400000-0x2bfffffff] with invalid node: -1
+ kmem: probe of dax0.0 failed with error -22
+
+Suggested-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Jia He <justin.he@arm.com>
+Cc: <stable@vger.kernel.org>
+Fixes: c221c0b0308f ("device-dax: "Hotplug" persistent memory for use like normal RAM")
+Link: https://lore.kernel.org/r/20210922152919.6940-1-justin.he@arm.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/nfit/core.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -3007,6 +3007,18 @@ static int acpi_nfit_register_region(str
+ ndr_desc->target_node = NUMA_NO_NODE;
+ }
+
++ /* Fallback to address based numa information if node lookup failed */
++ if (ndr_desc->numa_node == NUMA_NO_NODE) {
++ ndr_desc->numa_node = memory_add_physaddr_to_nid(spa->address);
++ dev_info(acpi_desc->dev, "changing numa node from %d to %d for nfit region [%pa-%pa]",
++ NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
++ }
++ if (ndr_desc->target_node == NUMA_NO_NODE) {
++ ndr_desc->target_node = phys_to_target_node(spa->address);
++ dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
++ NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
++ }
++
+ /*
+ * Persistence domain bits are hierarchical, if
+ * ACPI_NFIT_CAPABILITY_CACHE_FLUSH is set then
--- /dev/null
+From cb1bcf5ed536747013fe2b3f9bd56ce3242c295a Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Mon, 20 Sep 2021 20:07:34 +0900
+Subject: ALSA: firewire-motu: fix truncated bytes in message tracepoints
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit cb1bcf5ed536747013fe2b3f9bd56ce3242c295a upstream.
+
+In MOTU protocol v2/v3, first two data chunks across 2nd and 3rd data
+channels includes message bytes from device. The total size of message
+is 48 bits per data block.
+
+The 'data_block_message' tracepoints event produced by ALSA firewire-motu
+driver exposes the sequence of messages to userspace in 64 bit storage,
+however lower 32 bits are actually available since current implementation
+truncates 16 bits in upper of the message as a result of bit shift
+operation within 32 bit storage.
+
+This commit fixes the bug by perform the bit shift in 64 bit storage.
+
+Fixes: c6b0b9e65f09 ("ALSA: firewire-motu: add tracepoints for messages for unique protocol")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20210920110734.27161-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/firewire/motu/amdtp-motu.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/sound/firewire/motu/amdtp-motu.c
++++ b/sound/firewire/motu/amdtp-motu.c
+@@ -276,10 +276,11 @@ static void __maybe_unused copy_message(
+
+ /* This is just for v2/v3 protocol. */
+ for (i = 0; i < data_blocks; ++i) {
+- *frames = (be32_to_cpu(buffer[1]) << 16) |
+- (be32_to_cpu(buffer[2]) >> 16);
++ *frames = be32_to_cpu(buffer[1]);
++ *frames <<= 16;
++ *frames |= be32_to_cpu(buffer[2]) >> 16;
++ ++frames;
+ buffer += data_block_quadlets;
+- frames++;
+ }
+ }
+
--- /dev/null
+From ad7cc2d41b7a8d0c5c5ecff37c3de7a4e137b3a6 Mon Sep 17 00:00:00 2001
+From: Cameron Berkenpas <cam@neo-zeon.de>
+Date: Mon, 13 Sep 2021 14:26:29 -0700
+Subject: ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.
+
+From: Cameron Berkenpas <cam@neo-zeon.de>
+
+commit ad7cc2d41b7a8d0c5c5ecff37c3de7a4e137b3a6 upstream.
+
+This patch initializes and enables speaker output on the Lenovo Legion 7i
+15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 series of laptops using the
+HDA verb sequence specific to each model.
+
+Speaker automute is suppressed for the Lenovo Legion 7i 15IMHG05 to avoid
+breaking speaker output on resume and when devices are unplugged from its
+headphone jack.
+
+Thanks to: Andreas Holzer, Vincent Morel, sycxyc, Max Christian Pohle and
+all others that helped.
+
+[ minor coding style fixes by tiwai ]
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208555
+Signed-off-by: Cameron Berkenpas <cam@neo-zeon.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210913212627.339362-1-cam@neo-zeon.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 129 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 129 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6442,6 +6442,20 @@ static void alc_fixup_thinkpad_acpi(stru
+ hda_fixup_thinkpad_acpi(codec, fix, action);
+ }
+
++/* Fixup for Lenovo Legion 15IMHg05 speaker output on headset removal. */
++static void alc287_fixup_legion_15imhg05_speakers(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ struct alc_spec *spec = codec->spec;
++
++ switch (action) {
++ case HDA_FIXUP_ACT_PRE_PROBE:
++ spec->gen.suppress_auto_mute = 1;
++ break;
++ }
++}
++
+ /* for alc295_fixup_hp_top_speakers */
+ #include "hp_x360_helper.c"
+
+@@ -6659,6 +6673,10 @@ enum {
+ ALC623_FIXUP_LENOVO_THINKSTATION_P340,
+ ALC255_FIXUP_ACER_HEADPHONE_AND_MIC,
+ ALC236_FIXUP_HP_LIMIT_INT_MIC_BOOST,
++ ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS,
++ ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
++ ALC287_FIXUP_YOGA7_14ITL_SPEAKERS,
++ ALC287_FIXUP_13S_GEN2_SPEAKERS
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -8249,6 +8267,113 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF,
+ },
++ [ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS] = {
++ .type = HDA_FIXUP_VERBS,
++ //.v.verbs = legion_15imhg05_coefs,
++ .v.verbs = (const struct hda_verb[]) {
++ // set left speaker Legion 7i.
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
++
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xc },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x1a },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
++
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
++
++ // set right speaker Legion 7i.
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x42 },
++
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xc },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x2a },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
++
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
++ {}
++ },
++ .chained = true,
++ .chain_id = ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
++ },
++ [ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc287_fixup_legion_15imhg05_speakers,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE,
++ },
++ [ALC287_FIXUP_YOGA7_14ITL_SPEAKERS] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ // set left speaker Yoga 7i.
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
++
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xc },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x1a },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
++
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
++
++ // set right speaker Yoga 7i.
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x46 },
++
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xc },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x2a },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
++
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
++ {}
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE,
++ },
++ [ALC287_FIXUP_13S_GEN2_SPEAKERS] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x42 },
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
++ {}
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE,
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -8643,6 +8768,10 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x3818, "Lenovo C940", ALC298_FIXUP_LENOVO_SPK_VOLUME),
+ SND_PCI_QUIRK(0x17aa, 0x3827, "Ideapad S740", ALC285_FIXUP_IDEAPAD_S740_COEF),
+ SND_PCI_QUIRK(0x17aa, 0x3843, "Yoga 9i", ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP),
++ SND_PCI_QUIRK(0x17aa, 0x3813, "Legion 7i 15IMHG05", ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS),
++ SND_PCI_QUIRK(0x17aa, 0x3852, "Lenovo Yoga 7 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
++ SND_PCI_QUIRK(0x17aa, 0x3853, "Lenovo Yoga 7 15ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
++ SND_PCI_QUIRK(0x17aa, 0x3819, "Lenovo 13s Gen2 ITL", ALC287_FIXUP_13S_GEN2_SPEAKERS),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
--- /dev/null
+From 09d23174402da0f10e98da2c61bb5ac8e7d79fdd Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Mon, 20 Sep 2021 19:18:50 +0200
+Subject: ALSA: rawmidi: introduce SNDRV_RAWMIDI_IOCTL_USER_PVERSION
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit 09d23174402da0f10e98da2c61bb5ac8e7d79fdd upstream.
+
+The new framing mode causes the user space regression, because
+the alsa-lib code does not initialize the reserved space in
+the params structure when the device is opened.
+
+This change adds SNDRV_RAWMIDI_IOCTL_USER_PVERSION like we
+do for the PCM interface for the protocol acknowledgment.
+
+Cc: David Henningsson <coding@diwic.se>
+Cc: <stable@vger.kernel.org>
+Fixes: 08fdced60ca0 ("ALSA: rawmidi: Add framing mode")
+BugLink: https://github.com/alsa-project/alsa-lib/issues/178
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://lore.kernel.org/r/20210920171850.154186-1-perex@perex.cz
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/sound/rawmidi.h | 1 +
+ include/uapi/sound/asound.h | 1 +
+ sound/core/rawmidi.c | 9 +++++++++
+ 3 files changed, 11 insertions(+)
+
+--- a/include/sound/rawmidi.h
++++ b/include/sound/rawmidi.h
+@@ -98,6 +98,7 @@ struct snd_rawmidi_file {
+ struct snd_rawmidi *rmidi;
+ struct snd_rawmidi_substream *input;
+ struct snd_rawmidi_substream *output;
++ unsigned int user_pversion; /* supported protocol version */
+ };
+
+ struct snd_rawmidi_str {
+--- a/include/uapi/sound/asound.h
++++ b/include/uapi/sound/asound.h
+@@ -783,6 +783,7 @@ struct snd_rawmidi_status {
+
+ #define SNDRV_RAWMIDI_IOCTL_PVERSION _IOR('W', 0x00, int)
+ #define SNDRV_RAWMIDI_IOCTL_INFO _IOR('W', 0x01, struct snd_rawmidi_info)
++#define SNDRV_RAWMIDI_IOCTL_USER_PVERSION _IOW('W', 0x02, int)
+ #define SNDRV_RAWMIDI_IOCTL_PARAMS _IOWR('W', 0x10, struct snd_rawmidi_params)
+ #define SNDRV_RAWMIDI_IOCTL_STATUS _IOWR('W', 0x20, struct snd_rawmidi_status)
+ #define SNDRV_RAWMIDI_IOCTL_DROP _IOW('W', 0x30, int)
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -873,12 +873,21 @@ static long snd_rawmidi_ioctl(struct fil
+ return -EINVAL;
+ }
+ }
++ case SNDRV_RAWMIDI_IOCTL_USER_PVERSION:
++ if (get_user(rfile->user_pversion, (unsigned int __user *)arg))
++ return -EFAULT;
++ return 0;
++
+ case SNDRV_RAWMIDI_IOCTL_PARAMS:
+ {
+ struct snd_rawmidi_params params;
+
+ if (copy_from_user(¶ms, argp, sizeof(struct snd_rawmidi_params)))
+ return -EFAULT;
++ if (rfile->user_pversion < SNDRV_PROTOCOL_VERSION(2, 0, 2)) {
++ params.mode = 0;
++ memset(params.reserved, 0, sizeof(params.reserved));
++ }
+ switch (params.stream) {
+ case SNDRV_RAWMIDI_STREAM_OUTPUT:
+ if (rfile->output == NULL)
--- /dev/null
+From 80f6e3080bfcf865062a926817b3ca6c4a137a57 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Thu, 16 Sep 2021 13:34:24 -0700
+Subject: fs-verity: fix signed integer overflow with i_size near S64_MAX
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 80f6e3080bfcf865062a926817b3ca6c4a137a57 upstream.
+
+If the file size is almost S64_MAX, the calculated number of Merkle tree
+levels exceeds FS_VERITY_MAX_LEVELS, causing FS_IOC_ENABLE_VERITY to
+fail. This is unintentional, since as the comment above the definition
+of FS_VERITY_MAX_LEVELS states, it is enough for over U64_MAX bytes of
+data using SHA-256 and 4K blocks. (Specifically, 4096*128**8 >= 2**64.)
+
+The bug is actually that when the number of blocks in the first level is
+calculated from i_size, there is a signed integer overflow due to i_size
+being signed. Fix this by treating i_size as unsigned.
+
+This was found by the new test "generic: test fs-verity EFBIG scenarios"
+(https://lkml.kernel.org/r/b1d116cd4d0ea74b9cd86f349c672021e005a75c.1631558495.git.boris@bur.io).
+
+This didn't affect ext4 or f2fs since those have a smaller maximum file
+size, but it did affect btrfs which allows files up to S64_MAX bytes.
+
+Reported-by: Boris Burkov <boris@bur.io>
+Fixes: 3fda4c617e84 ("fs-verity: implement FS_IOC_ENABLE_VERITY ioctl")
+Fixes: fd2d1acfcadf ("fs-verity: add the hook for file ->open()")
+Cc: <stable@vger.kernel.org> # v5.4+
+Reviewed-by: Boris Burkov <boris@bur.io>
+Link: https://lore.kernel.org/r/20210916203424.113376-1-ebiggers@kernel.org
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/verity/enable.c | 2 +-
+ fs/verity/open.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/verity/enable.c
++++ b/fs/verity/enable.c
+@@ -177,7 +177,7 @@ static int build_merkle_tree(struct file
+ * (level 0) and ascending to the root node (level 'num_levels - 1').
+ * Then at the end (level 'num_levels'), calculate the root hash.
+ */
+- blocks = (inode->i_size + params->block_size - 1) >>
++ blocks = ((u64)inode->i_size + params->block_size - 1) >>
+ params->log_blocksize;
+ for (level = 0; level <= params->num_levels; level++) {
+ err = build_merkle_tree_level(filp, level, blocks, params,
+--- a/fs/verity/open.c
++++ b/fs/verity/open.c
+@@ -89,7 +89,7 @@ int fsverity_init_merkle_tree_params(str
+ */
+
+ /* Compute number of levels and the number of blocks in each level */
+- blocks = (inode->i_size + params->block_size - 1) >> log_blocksize;
++ blocks = ((u64)inode->i_size + params->block_size - 1) >> log_blocksize;
+ pr_debug("Data is %lld bytes (%llu blocks)\n", inode->i_size, blocks);
+ while (blocks > 1) {
+ if (params->num_levels >= FS_VERITY_MAX_LEVELS) {
--- /dev/null
+From 540cffbab8b8e6c52a4121666ca18d6e94586ed2 Mon Sep 17 00:00:00 2001
+From: Andrey Gusakov <andrey.gusakov@cogentembedded.com>
+Date: Thu, 23 Sep 2021 20:22:16 +0300
+Subject: gpio: pca953x: do not ignore i2c errors
+
+From: Andrey Gusakov <andrey.gusakov@cogentembedded.com>
+
+commit 540cffbab8b8e6c52a4121666ca18d6e94586ed2 upstream.
+
+Per gpio_chip interface, error shall be proparated to the caller.
+
+Attempt to silent diagnostics by returning zero (as written in the
+comment) is plain wrong, because the zero return can be interpreted by
+the caller as the gpio value.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Andrey Gusakov <andrey.gusakov@cogentembedded.com>
+Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-pca953x.c | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -468,15 +468,8 @@ static int pca953x_gpio_get_value(struct
+ mutex_lock(&chip->i2c_lock);
+ ret = regmap_read(chip->regmap, inreg, ®_val);
+ mutex_unlock(&chip->i2c_lock);
+- if (ret < 0) {
+- /*
+- * NOTE:
+- * diagnostic already emitted; that's all we should
+- * do unless gpio_*_value_cansleep() calls become different
+- * from their nonsleeping siblings (and report faults).
+- */
+- return 0;
+- }
++ if (ret < 0)
++ return ret;
+
+ return !!(reg_val & bit);
+ }
--- /dev/null
+From 2938b2978a70d4cc10777ee71c9e512ffe4e0f4b Mon Sep 17 00:00:00 2001
+From: Paul Fertser <fercerpav@gmail.com>
+Date: Fri, 24 Sep 2021 12:30:09 +0300
+Subject: hwmon: (tmp421) handle I2C errors
+
+From: Paul Fertser <fercerpav@gmail.com>
+
+commit 2938b2978a70d4cc10777ee71c9e512ffe4e0f4b upstream.
+
+Function i2c_smbus_read_byte_data() can return a negative error number
+instead of the data read if I2C transaction failed for whatever reason.
+
+Lack of error checking can lead to serious issues on production
+hardware, e.g. errors treated as temperatures produce spurious critical
+temperature-crossed-threshold errors in BMC logs for OCP server
+hardware. The patch was tested with Mellanox OCP Mezzanine card
+emulating TMP421 protocol for temperature sensing which sometimes leads
+to I2C protocol error during early boot up stage.
+
+Fixes: 9410700b881f ("hwmon: Add driver for Texas Instruments TMP421/422/423 sensor chips")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paul Fertser <fercerpav@gmail.com>
+Link: https://lore.kernel.org/r/20210924093011.26083-1-fercerpav@gmail.com
+[groeck: dropped unnecessary line breaks]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/tmp421.c | 38 ++++++++++++++++++++++++++++----------
+ 1 file changed, 28 insertions(+), 10 deletions(-)
+
+--- a/drivers/hwmon/tmp421.c
++++ b/drivers/hwmon/tmp421.c
+@@ -119,38 +119,56 @@ static int temp_from_u16(u16 reg)
+ return (temp * 1000 + 128) / 256;
+ }
+
+-static struct tmp421_data *tmp421_update_device(struct device *dev)
++static int tmp421_update_device(struct tmp421_data *data)
+ {
+- struct tmp421_data *data = dev_get_drvdata(dev);
+ struct i2c_client *client = data->client;
++ int ret = 0;
+ int i;
+
+ mutex_lock(&data->update_lock);
+
+ if (time_after(jiffies, data->last_updated + (HZ / 2)) ||
+ !data->valid) {
+- data->config = i2c_smbus_read_byte_data(client,
+- TMP421_CONFIG_REG_1);
++ ret = i2c_smbus_read_byte_data(client, TMP421_CONFIG_REG_1);
++ if (ret < 0)
++ goto exit;
++ data->config = ret;
+
+ for (i = 0; i < data->channels; i++) {
+- data->temp[i] = i2c_smbus_read_byte_data(client,
+- TMP421_TEMP_MSB[i]) << 8;
+- data->temp[i] |= i2c_smbus_read_byte_data(client,
+- TMP421_TEMP_LSB[i]);
++ ret = i2c_smbus_read_byte_data(client, TMP421_TEMP_MSB[i]);
++ if (ret < 0)
++ goto exit;
++ data->temp[i] = ret << 8;
++
++ ret = i2c_smbus_read_byte_data(client, TMP421_TEMP_LSB[i]);
++ if (ret < 0)
++ goto exit;
++ data->temp[i] |= ret;
+ }
+ data->last_updated = jiffies;
+ data->valid = 1;
+ }
+
++exit:
+ mutex_unlock(&data->update_lock);
+
+- return data;
++ if (ret < 0) {
++ data->valid = 0;
++ return ret;
++ }
++
++ return 0;
+ }
+
+ static int tmp421_read(struct device *dev, enum hwmon_sensor_types type,
+ u32 attr, int channel, long *val)
+ {
+- struct tmp421_data *tmp421 = tmp421_update_device(dev);
++ struct tmp421_data *tmp421 = dev_get_drvdata(dev);
++ int ret = 0;
++
++ ret = tmp421_update_device(tmp421);
++ if (ret)
++ return ret;
+
+ switch (attr) {
+ case hwmon_temp_input:
--- /dev/null
+From 943c15ac1b84d378da26bba41c83c67e16499ac4 Mon Sep 17 00:00:00 2001
+From: Nadezda Lutovinova <lutovinova@ispras.ru>
+Date: Tue, 21 Sep 2021 18:51:51 +0300
+Subject: hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field
+
+From: Nadezda Lutovinova <lutovinova@ispras.ru>
+
+commit 943c15ac1b84d378da26bba41c83c67e16499ac4 upstream.
+
+If driver read val value sufficient for
+(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))
+from device then Null pointer dereference occurs.
+(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)
+Also lm75[] does not serve a purpose anymore after switching to
+devm_i2c_new_dummy_device() in w83791d_detect_subclients().
+
+The patch fixes possible NULL pointer dereference by removing lm75[].
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
+Link: https://lore.kernel.org/r/20210921155153.28098-1-lutovinova@ispras.ru
+[groeck: Dropped unnecessary continuation lines, fixed multi-line alignment]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83791d.c | 29 +++++++++++------------------
+ 1 file changed, 11 insertions(+), 18 deletions(-)
+
+--- a/drivers/hwmon/w83791d.c
++++ b/drivers/hwmon/w83791d.c
+@@ -273,9 +273,6 @@ struct w83791d_data {
+ char valid; /* !=0 if following fields are valid */
+ unsigned long last_updated; /* In jiffies */
+
+- /* array of 2 pointers to subclients */
+- struct i2c_client *lm75[2];
+-
+ /* volts */
+ u8 in[NUMBER_OF_VIN]; /* Register value */
+ u8 in_max[NUMBER_OF_VIN]; /* Register value */
+@@ -1257,7 +1254,6 @@ static const struct attribute_group w837
+ static int w83791d_detect_subclients(struct i2c_client *client)
+ {
+ struct i2c_adapter *adapter = client->adapter;
+- struct w83791d_data *data = i2c_get_clientdata(client);
+ int address = client->addr;
+ int i, id;
+ u8 val;
+@@ -1280,22 +1276,19 @@ static int w83791d_detect_subclients(str
+ }
+
+ val = w83791d_read(client, W83791D_REG_I2C_SUBADDR);
+- if (!(val & 0x08))
+- data->lm75[0] = devm_i2c_new_dummy_device(&client->dev, adapter,
+- 0x48 + (val & 0x7));
+- if (!(val & 0x80)) {
+- if (!IS_ERR(data->lm75[0]) &&
+- ((val & 0x7) == ((val >> 4) & 0x7))) {
+- dev_err(&client->dev,
+- "duplicate addresses 0x%x, "
+- "use force_subclient\n",
+- data->lm75[0]->addr);
+- return -ENODEV;
+- }
+- data->lm75[1] = devm_i2c_new_dummy_device(&client->dev, adapter,
+- 0x48 + ((val >> 4) & 0x7));
++
++ if (!(val & 0x88) && (val & 0x7) == ((val >> 4) & 0x7)) {
++ dev_err(&client->dev,
++ "duplicate addresses 0x%x, use force_subclient\n", 0x48 + (val & 0x7));
++ return -ENODEV;
+ }
+
++ if (!(val & 0x08))
++ devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + (val & 0x7));
++
++ if (!(val & 0x80))
++ devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + ((val >> 4) & 0x7));
++
+ return 0;
+ }
+
--- /dev/null
+From 0f36b88173f028e372668ae040ab1a496834d278 Mon Sep 17 00:00:00 2001
+From: Nadezda Lutovinova <lutovinova@ispras.ru>
+Date: Tue, 21 Sep 2021 18:51:52 +0300
+Subject: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field
+
+From: Nadezda Lutovinova <lutovinova@ispras.ru>
+
+commit 0f36b88173f028e372668ae040ab1a496834d278 upstream.
+
+If driver read val value sufficient for
+(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))
+from device then Null pointer dereference occurs.
+(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)
+Also lm75[] does not serve a purpose anymore after switching to
+devm_i2c_new_dummy_device() in w83791d_detect_subclients().
+
+The patch fixes possible NULL pointer dereference by removing lm75[].
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
+Link: https://lore.kernel.org/r/20210921155153.28098-2-lutovinova@ispras.ru
+[groeck: Dropped unnecessary continuation lines, fixed multipline alignment]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83792d.c | 28 +++++++++++-----------------
+ 1 file changed, 11 insertions(+), 17 deletions(-)
+
+--- a/drivers/hwmon/w83792d.c
++++ b/drivers/hwmon/w83792d.c
+@@ -264,9 +264,6 @@ struct w83792d_data {
+ char valid; /* !=0 if following fields are valid */
+ unsigned long last_updated; /* In jiffies */
+
+- /* array of 2 pointers to subclients */
+- struct i2c_client *lm75[2];
+-
+ u8 in[9]; /* Register value */
+ u8 in_max[9]; /* Register value */
+ u8 in_min[9]; /* Register value */
+@@ -927,7 +924,6 @@ w83792d_detect_subclients(struct i2c_cli
+ int address = new_client->addr;
+ u8 val;
+ struct i2c_adapter *adapter = new_client->adapter;
+- struct w83792d_data *data = i2c_get_clientdata(new_client);
+
+ id = i2c_adapter_id(adapter);
+ if (force_subclients[0] == id && force_subclients[1] == address) {
+@@ -946,21 +942,19 @@ w83792d_detect_subclients(struct i2c_cli
+ }
+
+ val = w83792d_read_value(new_client, W83792D_REG_I2C_SUBADDR);
+- if (!(val & 0x08))
+- data->lm75[0] = devm_i2c_new_dummy_device(&new_client->dev, adapter,
+- 0x48 + (val & 0x7));
+- if (!(val & 0x80)) {
+- if (!IS_ERR(data->lm75[0]) &&
+- ((val & 0x7) == ((val >> 4) & 0x7))) {
+- dev_err(&new_client->dev,
+- "duplicate addresses 0x%x, use force_subclient\n",
+- data->lm75[0]->addr);
+- return -ENODEV;
+- }
+- data->lm75[1] = devm_i2c_new_dummy_device(&new_client->dev, adapter,
+- 0x48 + ((val >> 4) & 0x7));
++
++ if (!(val & 0x88) && (val & 0x7) == ((val >> 4) & 0x7)) {
++ dev_err(&new_client->dev,
++ "duplicate addresses 0x%x, use force_subclient\n", 0x48 + (val & 0x7));
++ return -ENODEV;
+ }
+
++ if (!(val & 0x08))
++ devm_i2c_new_dummy_device(&new_client->dev, adapter, 0x48 + (val & 0x7));
++
++ if (!(val & 0x80))
++ devm_i2c_new_dummy_device(&new_client->dev, adapter, 0x48 + ((val >> 4) & 0x7));
++
+ return 0;
+ }
+
--- /dev/null
+From dd4d747ef05addab887dc8ff0d6ab9860bbcd783 Mon Sep 17 00:00:00 2001
+From: Nadezda Lutovinova <lutovinova@ispras.ru>
+Date: Tue, 21 Sep 2021 18:51:53 +0300
+Subject: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
+
+From: Nadezda Lutovinova <lutovinova@ispras.ru>
+
+commit dd4d747ef05addab887dc8ff0d6ab9860bbcd783 upstream.
+
+If driver read tmp value sufficient for
+(tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7))
+from device then Null pointer dereference occurs.
+(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)
+Also lm75[] does not serve a purpose anymore after switching to
+devm_i2c_new_dummy_device() in w83791d_detect_subclients().
+
+The patch fixes possible NULL pointer dereference by removing lm75[].
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
+Link: https://lore.kernel.org/r/20210921155153.28098-3-lutovinova@ispras.ru
+[groeck: Dropped unnecessary continuation lines, fixed multi-line alignments]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83793.c | 26 +++++++++++---------------
+ 1 file changed, 11 insertions(+), 15 deletions(-)
+
+--- a/drivers/hwmon/w83793.c
++++ b/drivers/hwmon/w83793.c
+@@ -202,7 +202,6 @@ static inline s8 TEMP_TO_REG(long val, s
+ }
+
+ struct w83793_data {
+- struct i2c_client *lm75[2];
+ struct device *hwmon_dev;
+ struct mutex update_lock;
+ char valid; /* !=0 if following fields are valid */
+@@ -1566,7 +1565,6 @@ w83793_detect_subclients(struct i2c_clie
+ int address = client->addr;
+ u8 tmp;
+ struct i2c_adapter *adapter = client->adapter;
+- struct w83793_data *data = i2c_get_clientdata(client);
+
+ id = i2c_adapter_id(adapter);
+ if (force_subclients[0] == id && force_subclients[1] == address) {
+@@ -1586,21 +1584,19 @@ w83793_detect_subclients(struct i2c_clie
+ }
+
+ tmp = w83793_read_value(client, W83793_REG_I2C_SUBADDR);
+- if (!(tmp & 0x08))
+- data->lm75[0] = devm_i2c_new_dummy_device(&client->dev, adapter,
+- 0x48 + (tmp & 0x7));
+- if (!(tmp & 0x80)) {
+- if (!IS_ERR(data->lm75[0])
+- && ((tmp & 0x7) == ((tmp >> 4) & 0x7))) {
+- dev_err(&client->dev,
+- "duplicate addresses 0x%x, "
+- "use force_subclients\n", data->lm75[0]->addr);
+- return -ENODEV;
+- }
+- data->lm75[1] = devm_i2c_new_dummy_device(&client->dev, adapter,
+- 0x48 + ((tmp >> 4) & 0x7));
++
++ if (!(tmp & 0x88) && (tmp & 0x7) == ((tmp >> 4) & 0x7)) {
++ dev_err(&client->dev,
++ "duplicate addresses 0x%x, use force_subclient\n", 0x48 + (tmp & 0x7));
++ return -ENODEV;
+ }
+
++ if (!(tmp & 0x08))
++ devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + (tmp & 0x7));
++
++ if (!(tmp & 0x80))
++ devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + ((tmp >> 4) & 0x7));
++
+ return 0;
+ }
+
--- /dev/null
+From 94513069eb549737bcfc3d988d6ed4da948a2de8 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 27 Sep 2021 11:58:39 +0200
+Subject: mac80211: fix use-after-free in CCMP/GCMP RX
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 94513069eb549737bcfc3d988d6ed4da948a2de8 upstream.
+
+When PN checking is done in mac80211, for fragmentation we need
+to copy the PN to the RX struct so we can later use it to do a
+comparison, since commit bf30ca922a0c ("mac80211: check defrag
+PN against current frame").
+
+Unfortunately, in that commit I used the 'hdr' variable without
+it being necessarily valid, so use-after-free could occur if it
+was necessary to reallocate (parts of) the frame.
+
+Fix this by reloading the variable after the code that results
+in the reallocations, if any.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
+
+Cc: stable@vger.kernel.org
+Fixes: bf30ca922a0c ("mac80211: check defrag PN against current frame")
+Link: https://lore.kernel.org/r/20210927115838.12b9ac6bb233.I1d066acd5408a662c3b6e828122cd314fcb28cdb@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/wpa.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -520,6 +520,9 @@ ieee80211_crypto_ccmp_decrypt(struct iee
+ return RX_DROP_UNUSABLE;
+ }
+
++ /* reload hdr - skb might have been reallocated */
++ hdr = (void *)rx->skb->data;
++
+ data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
+ if (!rx->sta || data_len < 0)
+ return RX_DROP_UNUSABLE;
+@@ -749,6 +752,9 @@ ieee80211_crypto_gcmp_decrypt(struct iee
+ return RX_DROP_UNUSABLE;
+ }
+
++ /* reload hdr - skb might have been reallocated */
++ hdr = (void *)rx->skb->data;
++
+ data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len;
+ if (!rx->sta || data_len < 0)
+ return RX_DROP_UNUSABLE;
--- /dev/null
+From e8c2da7e329ce004fee748b921e4c765dc2fa338 Mon Sep 17 00:00:00 2001
+From: Jonathan Hsu <jonathan.hsu@mediatek.com>
+Date: Fri, 24 Sep 2021 16:58:48 +0800
+Subject: scsi: ufs: Fix illegal offset in UPIU event trace
+
+From: Jonathan Hsu <jonathan.hsu@mediatek.com>
+
+commit e8c2da7e329ce004fee748b921e4c765dc2fa338 upstream.
+
+Fix incorrect index for UTMRD reference in ufshcd_add_tm_upiu_trace().
+
+Link: https://lore.kernel.org/r/20210924085848.25500-1-jonathan.hsu@mediatek.com
+Fixes: 4b42d557a8ad ("scsi: ufs: core: Fix wrong Task Tag used in task management request UPIUs")
+Cc: stable@vger.kernel.org
+Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Jonathan Hsu <jonathan.hsu@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -330,8 +330,7 @@ static void ufshcd_add_query_upiu_trace(
+ static void ufshcd_add_tm_upiu_trace(struct ufs_hba *hba, unsigned int tag,
+ enum ufs_trace_str_t str_t)
+ {
+- int off = (int)tag - hba->nutrs;
+- struct utp_task_req_desc *descp = &hba->utmrdl_base_addr[off];
++ struct utp_task_req_desc *descp = &hba->utmrdl_base_addr[tag];
+
+ if (!trace_ufshcd_upiu_enabled())
+ return;
drm-amdgpu-stop-scheduler-when-calling-hw_fini-v2.patch
cpufreq-schedutil-destroy-mutex-before-kobject_put-f.patch
scsi-ufs-ufs-pci-fix-intel-lkf-link-stability.patch
+alsa-rawmidi-introduce-sndrv_rawmidi_ioctl_user_pversion.patch
+alsa-firewire-motu-fix-truncated-bytes-in-message-tracepoints.patch
+alsa-hda-realtek-quirks-to-enable-speaker-output-for-lenovo-legion-7i-15imhg05-yoga-7i-14itl5-15itl5-and-13s-gen2-laptops.patch
+acpi-nfit-use-fallback-node-id-when-numa-info-in-nfit-table-is-incorrect.patch
+fs-verity-fix-signed-integer-overflow-with-i_size-near-s64_max.patch
+hwmon-tmp421-handle-i2c-errors.patch
+hwmon-w83793-fix-null-pointer-dereference-by-removing-unnecessary-structure-field.patch
+hwmon-w83792d-fix-null-pointer-dereference-by-removing-unnecessary-structure-field.patch
+hwmon-w83791d-fix-null-pointer-dereference-by-removing-unnecessary-structure-field.patch
+gpio-pca953x-do-not-ignore-i2c-errors.patch
+scsi-ufs-fix-illegal-offset-in-upiu-event-trace.patch
+mac80211-fix-use-after-free-in-ccmp-gcmp-rx.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
