--- /dev/null
+From 9981b20a5e3694f4625ab5a1ddc98ce7503f6d12 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sat, 5 Jun 2021 18:10:54 +0900
+Subject: ALSA: firewire-lib: fix the context to call snd_pcm_stop_xrun()
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit 9981b20a5e3694f4625ab5a1ddc98ce7503f6d12 upstream.
+
+In the workqueue to queue wake-up event, isochronous context is not
+processed, thus it's useless to check context for the workqueue to switch
+status of runtime for PCM substream to XRUN. On the other hand, in
+software IRQ context of 1394 OHCI, it's needed.
+
+This commit fixes the bug introduced when tasklet was replaced with
+workqueue.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 2b3d2987d800 ("ALSA: firewire: Replace tasklet with work")
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20210605091054.68866-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/firewire/amdtp-stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/firewire/amdtp-stream.c
++++ b/sound/firewire/amdtp-stream.c
+@@ -804,7 +804,7 @@ static void generate_pkt_descs(struct am
+ static inline void cancel_stream(struct amdtp_stream *s)
+ {
+ s->packet_index = -1;
+- if (current_work() == &s->period_work)
++ if (in_interrupt())
+ amdtp_stream_pcm_abort(s);
+ WRITE_ONCE(s->pcm_buffer_pointer, SNDRV_PCM_POS_XRUN);
+ }
--- /dev/null
+From 15d295b560e6dd45f839a53ae69e4f63b54eb32f Mon Sep 17 00:00:00 2001
+From: Jeremy Szu <jeremy.szu@canonical.com>
+Date: Sat, 5 Jun 2021 16:25:36 +0800
+Subject: ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite Dragonfly G2
+
+From: Jeremy Szu <jeremy.szu@canonical.com>
+
+commit 15d295b560e6dd45f839a53ae69e4f63b54eb32f upstream.
+
+The HP Elite Dragonfly G2 using ALC285 codec which using 0x04 to control
+mute LED and 0x01 to control micmute LED.
+In the other hand, there is no output from right channel of speaker.
+Therefore, add a quirk to make it works.
+
+Signed-off-by: Jeremy Szu <jeremy.szu@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210605082539.41797-1-jeremy.szu@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8307,6 +8307,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360),
+ SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO),
++ SND_PCI_QUIRK(0x103c, 0x8716, "HP Elite Dragonfly G2 Notebook PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8730, "HP ProBook 445 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
--- /dev/null
+From 61d3e87468fad82dc8e8cb6de7db563ada64b532 Mon Sep 17 00:00:00 2001
+From: Jeremy Szu <jeremy.szu@canonical.com>
+Date: Sat, 5 Jun 2021 16:25:37 +0800
+Subject: ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8
+
+From: Jeremy Szu <jeremy.szu@canonical.com>
+
+commit 61d3e87468fad82dc8e8cb6de7db563ada64b532 upstream.
+
+The HP EliteBook x360 1040 G8 using ALC285 codec which using 0x04 to control
+mute LED and 0x01 to control micmute LED.
+In the other hand, there is no output from right channel of speaker.
+Therefore, add a quirk to make it works.
+
+Signed-off-by: Jeremy Szu <jeremy.szu@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210605082539.41797-2-jeremy.szu@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8308,6 +8308,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x8716, "HP Elite Dragonfly G2 Notebook PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
++ SND_PCI_QUIRK(0x103c, 0x8720, "HP EliteBook x360 1040 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8730, "HP ProBook 445 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
--- /dev/null
+From dfb06401b4cdfc71e2fc3e19b877ab845cc9f7f7 Mon Sep 17 00:00:00 2001
+From: Jeremy Szu <jeremy.szu@canonical.com>
+Date: Sat, 5 Jun 2021 16:25:38 +0800
+Subject: ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8
+
+From: Jeremy Szu <jeremy.szu@canonical.com>
+
+commit dfb06401b4cdfc71e2fc3e19b877ab845cc9f7f7 upstream.
+
+The HP EliteBook 840 Aero G8 using ALC285 codec which using 0x04 to
+control mute LED and 0x01 to control micmute LED.
+In the other hand, there is no output from right channel of speaker.
+Therefore, add a quirk to make it works.
+
+Signed-off-by: Jeremy Szu <jeremy.szu@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210605082539.41797-3-jeremy.szu@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8327,6 +8327,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x87f5, "HP", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x87f7, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP),
+ SND_PCI_QUIRK(0x103c, 0x8846, "HP EliteBook 850 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x884b, "HP EliteBook 840 Aero G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x884c, "HP EliteBook 840 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x886d, "HP ZBook Fury 17.3 Inch G8 Mobile Workstation PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ SND_PCI_QUIRK(0x103c, 0x8870, "HP ZBook Fury 15.6 Inch G8 Mobile Workstation PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
--- /dev/null
+From 600dd2a7e8b62170d177381cc1303861f48f9780 Mon Sep 17 00:00:00 2001
+From: Jeremy Szu <jeremy.szu@canonical.com>
+Date: Tue, 8 Jun 2021 19:47:48 +0800
+Subject: ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
+
+From: Jeremy Szu <jeremy.szu@canonical.com>
+
+commit 600dd2a7e8b62170d177381cc1303861f48f9780 upstream.
+
+The HP ZBook Power G8 using ALC236 codec which using 0x02 to
+control mute LED and 0x01 to control micmute LED.
+Therefore, add a quirk to make it works.
+
+Signed-off-by: Jeremy Szu <jeremy.szu@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210608114750.32009-1-jeremy.szu@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8332,6 +8332,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x886d, "HP ZBook Fury 17.3 Inch G8 Mobile Workstation PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ SND_PCI_QUIRK(0x103c, 0x8870, "HP ZBook Fury 15.6 Inch G8 Mobile Workstation PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ SND_PCI_QUIRK(0x103c, 0x8873, "HP ZBook Studio 15.6 Inch G8 Mobile Workstation PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
++ SND_PCI_QUIRK(0x103c, 0x888d, "HP ZBook Power 15.6 inch G8 Mobile Workstation PC", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
--- /dev/null
+From 57c9e21a49b1c196cda28f54de9a5d556ac93f20 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Tue, 8 Jun 2021 10:46:00 +0800
+Subject: ALSA: hda/realtek: headphone and mic don't work on an Acer laptop
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 57c9e21a49b1c196cda28f54de9a5d556ac93f20 upstream.
+
+There are 2 issues on this machine, the 1st one is mic's plug/unplug
+can't be detected, that is because the mic is set to manual detecting
+mode, need to apply ALC255_FIXUP_XIAOMI_HEADSET_MIC to set it to auto
+detecting mode. The other one is headphone's plug/unplug can't be
+detected by pulseaudio, that is because the pulseaudio will use
+ucm2/sof-hda-dsp on this machine, and the ucm2 only handle
+'Headphone Jack', but on this machine the headphone's pincfg sets the
+location to Front, then the alsa mixer name is "Front Headphone Jack"
+instead of "Headphone Jack", so override the pincfg to change location
+to Left.
+
+BugLink: http://bugs.launchpad.net/bugs/1930188
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://lore.kernel.org/r/20210608024600.6198-1-hui.wang@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6560,6 +6560,7 @@ enum {
+ ALC285_FIXUP_HP_SPECTRE_X360,
+ ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP,
+ ALC623_FIXUP_LENOVO_THINKSTATION_P340,
++ ALC255_FIXUP_ACER_HEADPHONE_AND_MIC,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -8132,6 +8133,15 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC283_FIXUP_HEADSET_MIC,
+ },
++ [ALC255_FIXUP_ACER_HEADPHONE_AND_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x21, 0x03211030 }, /* Change the Headphone location to Left */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC255_FIXUP_XIAOMI_HEADSET_MIC
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -8168,6 +8178,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
+ SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X),
+@@ -8722,6 +8733,7 @@ static const struct hda_model_fixup alc2
+ {.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"},
+ {.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"},
+ {.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"},
++ {.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"},
+ {}
+ };
+ #define ALC225_STANDARD_PINS \
--- /dev/null
+From 83e197a8414c0ba545e7e3916ce05f836f349273 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 10 Jun 2021 17:20:59 +0200
+Subject: ALSA: seq: Fix race of snd_seq_timer_open()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 83e197a8414c0ba545e7e3916ce05f836f349273 upstream.
+
+The timer instance per queue is exclusive, and snd_seq_timer_open()
+should have managed the concurrent accesses. It looks as if it's
+checking the already existing timer instance at the beginning, but
+it's not right, because there is no protection, hence any later
+concurrent call of snd_seq_timer_open() may override the timer
+instance easily. This may result in UAF, as the leftover timer
+instance can keep running while the queue itself gets closed, as
+spotted by syzkaller recently.
+
+For avoiding the race, add a proper check at the assignment of
+tmr->timeri again, and return -EBUSY if it's been already registered.
+
+Reported-by: syzbot+ddc1260a83ed1cbf6fb5@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/000000000000dce34f05c42f110c@google.com
+Link: https://lore.kernel.org/r/20210610152059.24633-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq/seq_timer.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/sound/core/seq/seq_timer.c
++++ b/sound/core/seq/seq_timer.c
+@@ -297,8 +297,16 @@ int snd_seq_timer_open(struct snd_seq_qu
+ return err;
+ }
+ spin_lock_irq(&tmr->lock);
+- tmr->timeri = t;
++ if (tmr->timeri)
++ err = -EBUSY;
++ else
++ tmr->timeri = t;
+ spin_unlock_irq(&tmr->lock);
++ if (err < 0) {
++ snd_timer_close(t);
++ snd_timer_instance_free(t);
++ return err;
++ }
+ return 0;
+ }
+
--- /dev/null
+From 9be148e408df7d361ec5afd6299b7736ff3928b0 Mon Sep 17 00:00:00 2001
+From: Xiao Ni <xni@redhat.com>
+Date: Fri, 28 May 2021 14:16:38 +0800
+Subject: async_xor: check src_offs is not NULL before updating it
+
+From: Xiao Ni <xni@redhat.com>
+
+commit 9be148e408df7d361ec5afd6299b7736ff3928b0 upstream.
+
+When PAGE_SIZE is greater than 4kB, multiple stripes may share the same
+page. Thus, src_offs is added to async_xor_offs() with array of offsets.
+However, async_xor() passes NULL src_offs to async_xor_offs(). In such
+case, src_offs should not be updated. Add a check before the update.
+
+Fixes: ceaf2966ab08(async_xor: increase src_offs when dropping destination page)
+Cc: stable@vger.kernel.org # v5.10+
+Reported-by: Oleksandr Shchirskyi <oleksandr.shchirskyi@linux.intel.com>
+Tested-by: Oleksandr Shchirskyi <oleksandr.shchirskyi@intel.com>
+Signed-off-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/async_tx/async_xor.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/crypto/async_tx/async_xor.c
++++ b/crypto/async_tx/async_xor.c
+@@ -233,7 +233,8 @@ async_xor_offs(struct page *dest, unsign
+ if (submit->flags & ASYNC_TX_XOR_DROP_DST) {
+ src_cnt--;
+ src_list++;
+- src_offs++;
++ if (src_offs)
++ src_offs++;
+ }
+
+ /* wait for any prerequisite operations */
--- /dev/null
+From aefd7f7065567a4666f42c0fc8cdb379d2e036bf Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Mon, 31 May 2021 12:26:01 +0300
+Subject: btrfs: promote debugging asserts to full-fledged checks in validate_super
+
+From: Nikolay Borisov <nborisov@suse.com>
+
+commit aefd7f7065567a4666f42c0fc8cdb379d2e036bf upstream.
+
+Syzbot managed to trigger this assert while performing its fuzzing.
+Turns out it's better to have those asserts turned into full-fledged
+checks so that in case buggy btrfs images are mounted the users gets
+an error and mounting is stopped. Alternatively with CONFIG_BTRFS_ASSERT
+disabled such image would have been erroneously allowed to be mounted.
+
+Reported-by: syzbot+a6bf271c02e4fe66b4e4@syzkaller.appspotmail.com
+CC: stable@vger.kernel.org # 5.4+
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ add uuids to the messages ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/disk-io.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -2467,6 +2467,24 @@ static int validate_super(struct btrfs_f
+ ret = -EINVAL;
+ }
+
++ if (memcmp(fs_info->fs_devices->fsid, fs_info->super_copy->fsid,
++ BTRFS_FSID_SIZE)) {
++ btrfs_err(fs_info,
++ "superblock fsid doesn't match fsid of fs_devices: %pU != %pU",
++ fs_info->super_copy->fsid, fs_info->fs_devices->fsid);
++ ret = -EINVAL;
++ }
++
++ if (btrfs_fs_incompat(fs_info, METADATA_UUID) &&
++ memcmp(fs_info->fs_devices->metadata_uuid,
++ fs_info->super_copy->metadata_uuid, BTRFS_FSID_SIZE)) {
++ btrfs_err(fs_info,
++"superblock metadata_uuid doesn't match metadata uuid of fs_devices: %pU != %pU",
++ fs_info->super_copy->metadata_uuid,
++ fs_info->fs_devices->metadata_uuid);
++ ret = -EINVAL;
++ }
++
+ if (memcmp(fs_info->fs_devices->metadata_uuid, sb->dev_item.fsid,
+ BTRFS_FSID_SIZE) != 0) {
+ btrfs_err(fs_info,
+@@ -2969,14 +2987,6 @@ int __cold open_ctree(struct super_block
+
+ disk_super = fs_info->super_copy;
+
+- ASSERT(!memcmp(fs_info->fs_devices->fsid, fs_info->super_copy->fsid,
+- BTRFS_FSID_SIZE));
+-
+- if (btrfs_fs_incompat(fs_info, METADATA_UUID)) {
+- ASSERT(!memcmp(fs_info->fs_devices->metadata_uuid,
+- fs_info->super_copy->metadata_uuid,
+- BTRFS_FSID_SIZE));
+- }
+
+ features = btrfs_super_flags(disk_super);
+ if (features & BTRFS_SUPER_FLAG_CHANGING_FSID_V2) {
--- /dev/null
+From e7b2ec3d3d4ebeb4cff7ae45cf430182fa6a49fb Mon Sep 17 00:00:00 2001
+From: Ritesh Harjani <riteshh@linux.ibm.com>
+Date: Sun, 30 May 2021 20:24:05 +0530
+Subject: btrfs: return value from btrfs_mark_extent_written() in case of error
+
+From: Ritesh Harjani <riteshh@linux.ibm.com>
+
+commit e7b2ec3d3d4ebeb4cff7ae45cf430182fa6a49fb upstream.
+
+We always return 0 even in case of an error in btrfs_mark_extent_written().
+Fix it to return proper error value in case of a failure. All callers
+handle it.
+
+CC: stable@vger.kernel.org # 4.4+
+Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/file.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1088,7 +1088,7 @@ int btrfs_mark_extent_written(struct btr
+ int del_nr = 0;
+ int del_slot = 0;
+ int recow;
+- int ret;
++ int ret = 0;
+ u64 ino = btrfs_ino(inode);
+
+ path = btrfs_alloc_path();
+@@ -1309,7 +1309,7 @@ again:
+ }
+ out:
+ btrfs_free_path(path);
+- return 0;
++ return ret;
+ }
+
+ /*
--- /dev/null
+From b7e24eb1caa5f8da20d405d262dba67943aedc42 Mon Sep 17 00:00:00 2001
+From: Alexander Kuznetsov <wwfq@yandex-team.ru>
+Date: Wed, 9 Jun 2021 10:17:19 +0300
+Subject: cgroup1: don't allow '\n' in renaming
+
+From: Alexander Kuznetsov <wwfq@yandex-team.ru>
+
+commit b7e24eb1caa5f8da20d405d262dba67943aedc42 upstream.
+
+cgroup_mkdir() have restriction on newline usage in names:
+$ mkdir $'/sys/fs/cgroup/cpu/test\ntest2'
+mkdir: cannot create directory
+'/sys/fs/cgroup/cpu/test\ntest2': Invalid argument
+
+But in cgroup1_rename() such check is missed.
+This allows us to make /proc/<pid>/cgroup unparsable:
+$ mkdir /sys/fs/cgroup/cpu/test
+$ mv /sys/fs/cgroup/cpu/test $'/sys/fs/cgroup/cpu/test\ntest2'
+$ echo $$ > $'/sys/fs/cgroup/cpu/test\ntest2'
+$ cat /proc/self/cgroup
+11:pids:/
+10:freezer:/
+9:hugetlb:/
+8:cpuset:/
+7:blkio:/user.slice
+6:memory:/user.slice
+5:net_cls,net_prio:/
+4:perf_event:/
+3:devices:/user.slice
+2:cpu,cpuacct:/test
+test2
+1:name=systemd:/
+0::/
+
+Signed-off-by: Alexander Kuznetsov <wwfq@yandex-team.ru>
+Reported-by: Andrey Krasichkov <buglloc@yandex-team.ru>
+Acked-by: Dmitry Yakunin <zeil@yandex-team.ru>
+Cc: stable@vger.kernel.org
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/cgroup/cgroup-v1.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/kernel/cgroup/cgroup-v1.c
++++ b/kernel/cgroup/cgroup-v1.c
+@@ -820,6 +820,10 @@ static int cgroup1_rename(struct kernfs_
+ struct cgroup *cgrp = kn->priv;
+ int ret;
+
++ /* do not accept '\n' to prevent making /proc/<pid>/cgroup unparsable */
++ if (strchr(new_name_str, '\n'))
++ return -EINVAL;
++
+ if (kernfs_type(kn) != KERNFS_DIR)
+ return -ENOTDIR;
+ if (kn->parent != new_parent)
--- /dev/null
+From b436acd1cf7fac0ba987abd22955d98025c80c2b Mon Sep 17 00:00:00 2001
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Date: Tue, 8 Jun 2021 19:04:36 +0800
+Subject: drm: Fix use-after-free read in drm_getunique()
+
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+
+commit b436acd1cf7fac0ba987abd22955d98025c80c2b upstream.
+
+There is a time-of-check-to-time-of-use error in drm_getunique() due
+to retrieving file_priv->master prior to locking the device's master
+mutex.
+
+An example can be seen in the crash report of the use-after-free error
+found by Syzbot:
+https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803
+
+In the report, the master pointer was used after being freed. This is
+because another process had acquired the device's master mutex in
+drm_setmaster_ioctl(), then overwrote fpriv->master in
+drm_new_set_master(). The old value of fpriv->master was subsequently
+freed before the mutex was unlocked.
+
+To fix this, we lock the device's master mutex before retrieving the
+pointer from from fpriv->master. This patch passes the Syzbot
+reproducer test.
+
+Reported-by: syzbot+c3a706cec1ea99e1c693@syzkaller.appspotmail.com
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210608110436.239583-1-desmondcheongzx@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_ioctl.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/drm_ioctl.c
++++ b/drivers/gpu/drm/drm_ioctl.c
+@@ -118,17 +118,18 @@ int drm_getunique(struct drm_device *dev
+ struct drm_file *file_priv)
+ {
+ struct drm_unique *u = data;
+- struct drm_master *master = file_priv->master;
++ struct drm_master *master;
+
+- mutex_lock(&master->dev->master_mutex);
++ mutex_lock(&dev->master_mutex);
++ master = file_priv->master;
+ if (u->unique_len >= master->unique_len) {
+ if (copy_to_user(u->unique, master->unique, master->unique_len)) {
+- mutex_unlock(&master->dev->master_mutex);
++ mutex_unlock(&dev->master_mutex);
+ return -EFAULT;
+ }
+ }
+ u->unique_len = master->unique_len;
+- mutex_unlock(&master->dev->master_mutex);
++ mutex_unlock(&dev->master_mutex);
+
+ return 0;
+ }
--- /dev/null
+From c336a5ee984708db4826ef9e47d184e638e29717 Mon Sep 17 00:00:00 2001
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Date: Wed, 9 Jun 2021 17:21:19 +0800
+Subject: drm: Lock pointer access in drm_master_release()
+
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+
+commit c336a5ee984708db4826ef9e47d184e638e29717 upstream.
+
+This patch eliminates the following smatch warning:
+drivers/gpu/drm/drm_auth.c:320 drm_master_release() warn: unlocked access 'master' (line 318) expected lock '&dev->master_mutex'
+
+The 'file_priv->master' field should be protected by the mutex lock to
+'&dev->master_mutex'. This is because other processes can concurrently
+modify this field and free the current 'file_priv->master'
+pointer. This could result in a use-after-free error when 'master' is
+dereferenced in subsequent function calls to
+'drm_legacy_lock_master_cleanup()' or to 'drm_lease_revoke()'.
+
+An example of a scenario that would produce this error can be seen
+from a similar bug in 'drm_getunique()' that was reported by Syzbot:
+https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803
+
+In the Syzbot report, another process concurrently acquired the
+device's master mutex in 'drm_setmaster_ioctl()', then overwrote
+'fpriv->master' in 'drm_new_set_master()'. The old value of
+'fpriv->master' was subsequently freed before the mutex was unlocked.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210609092119.173590-1-desmondcheongzx@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_auth.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_auth.c
++++ b/drivers/gpu/drm/drm_auth.c
+@@ -314,9 +314,10 @@ int drm_master_open(struct drm_file *fil
+ void drm_master_release(struct drm_file *file_priv)
+ {
+ struct drm_device *dev = file_priv->minor->dev;
+- struct drm_master *master = file_priv->master;
++ struct drm_master *master;
+
+ mutex_lock(&dev->master_mutex);
++ master = file_priv->master;
+ if (file_priv->magic)
+ idr_remove(&file_priv->master->magic_map, file_priv->magic);
+
--- /dev/null
+From 6c14133d2d3f768e0a35128faac8aa6ed4815051 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Mon, 7 Jun 2021 21:39:08 -0400
+Subject: ftrace: Do not blindly read the ip address in ftrace_bug()
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+commit 6c14133d2d3f768e0a35128faac8aa6ed4815051 upstream.
+
+It was reported that a bug on arm64 caused a bad ip address to be used for
+updating into a nop in ftrace_init(), but the error path (rightfully)
+returned -EINVAL and not -EFAULT, as the bug caused more than one error to
+occur. But because -EINVAL was returned, the ftrace_bug() tried to report
+what was at the location of the ip address, and read it directly. This
+caused the machine to panic, as the ip was not pointing to a valid memory
+address.
+
+Instead, read the ip address with copy_from_kernel_nofault() to safely
+access the memory, and if it faults, report that the address faulted,
+otherwise report what was in that location.
+
+Link: https://lore.kernel.org/lkml/20210607032329.28671-1-mark-pk.tsai@mediatek.com/
+
+Cc: stable@vger.kernel.org
+Fixes: 05736a427f7e1 ("ftrace: warn on failure to disable mcount callers")
+Reported-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
+Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/ftrace.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1968,12 +1968,18 @@ static int ftrace_hash_ipmodify_update(s
+
+ static void print_ip_ins(const char *fmt, const unsigned char *p)
+ {
++ char ins[MCOUNT_INSN_SIZE];
+ int i;
+
++ if (copy_from_kernel_nofault(ins, p, MCOUNT_INSN_SIZE)) {
++ printk(KERN_CONT "%s[FAULT] %px\n", fmt, p);
++ return;
++ }
++
+ printk(KERN_CONT "%s", fmt);
+
+ for (i = 0; i < MCOUNT_INSN_SIZE; i++)
+- printk(KERN_CONT "%s%02x", i ? ":" : "", p[i]);
++ printk(KERN_CONT "%s%02x", i ? ":" : "", ins[i]);
+ }
+
+ enum ftrace_bug_type ftrace_bug_type;
--- /dev/null
+From da27a83fd6cc7780fea190e1f5c19e87019da65c Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 8 Jun 2021 15:31:42 -0400
+Subject: kvm: avoid speculation-based attacks from out-of-range memslot accesses
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit da27a83fd6cc7780fea190e1f5c19e87019da65c upstream.
+
+KVM's mechanism for accessing guest memory translates a guest physical
+address (gpa) to a host virtual address using the right-shifted gpa
+(also known as gfn) and a struct kvm_memory_slot. The translation is
+performed in __gfn_to_hva_memslot using the following formula:
+
+ hva = slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE
+
+It is expected that gfn falls within the boundaries of the guest's
+physical memory. However, a guest can access invalid physical addresses
+in such a way that the gfn is invalid.
+
+__gfn_to_hva_memslot is called from kvm_vcpu_gfn_to_hva_prot, which first
+retrieves a memslot through __gfn_to_memslot. While __gfn_to_memslot
+does check that the gfn falls within the boundaries of the guest's
+physical memory or not, a CPU can speculate the result of the check and
+continue execution speculatively using an illegal gfn. The speculation
+can result in calculating an out-of-bounds hva. If the resulting host
+virtual address is used to load another guest physical address, this
+is effectively a Spectre gadget consisting of two consecutive reads,
+the second of which is data dependent on the first.
+
+Right now it's not clear if there are any cases in which this is
+exploitable. One interesting case was reported by the original author
+of this patch, and involves visiting guest page tables on x86. Right
+now these are not vulnerable because the hva read goes through get_user(),
+which contains an LFENCE speculation barrier. However, there are
+patches in progress for x86 uaccess.h to mask kernel addresses instead of
+using LFENCE; once these land, a guest could use speculation to read
+from the VMM's ring 3 address space. Other architectures such as ARM
+already use the address masking method, and would be susceptible to
+this same kind of data-dependent access gadgets. Therefore, this patch
+proactively protects from these attacks by masking out-of-bounds gfns
+in __gfn_to_hva_memslot, which blocks speculation of invalid hvas.
+
+Sean Christopherson noted that this patch does not cover
+kvm_read_guest_offset_cached. This however is limited to a few bytes
+past the end of the cache, and therefore it is unlikely to be useful in
+the context of building a chain of data dependent accesses.
+
+Reported-by: Artemiy Margaritov <artemiy.margaritov@gmail.com>
+Co-developed-by: Artemiy Margaritov <artemiy.margaritov@gmail.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/kvm_host.h | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -1104,7 +1104,15 @@ __gfn_to_memslot(struct kvm_memslots *sl
+ static inline unsigned long
+ __gfn_to_hva_memslot(struct kvm_memory_slot *slot, gfn_t gfn)
+ {
+- return slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE;
++ /*
++ * The index was checked originally in search_memslots. To avoid
++ * that a malicious guest builds a Spectre gadget out of e.g. page
++ * table walks, do not let the processor speculate loads outside
++ * the guest's registered memslots.
++ */
++ unsigned long offset = array_index_nospec(gfn - slot->base_gfn,
++ slot->npages);
++ return slot->userspace_addr + offset * PAGE_SIZE;
+ }
+
+ static inline int memslot_id(struct kvm *kvm, gfn_t gfn)
--- /dev/null
+From b1bd5cba3306691c771d558e94baa73e8b0b96b7 Mon Sep 17 00:00:00 2001
+From: Lai Jiangshan <laijs@linux.alibaba.com>
+Date: Thu, 3 Jun 2021 13:24:55 +0800
+Subject: KVM: X86: MMU: Use the correct inherited permissions to get shadow page
+
+From: Lai Jiangshan <laijs@linux.alibaba.com>
+
+commit b1bd5cba3306691c771d558e94baa73e8b0b96b7 upstream.
+
+When computing the access permissions of a shadow page, use the effective
+permissions of the walk up to that point, i.e. the logic AND of its parents'
+permissions. Two guest PxE entries that point at the same table gfn need to
+be shadowed with different shadow pages if their parents' permissions are
+different. KVM currently uses the effective permissions of the last
+non-leaf entry for all non-leaf entries. Because all non-leaf SPTEs have
+full ("uwx") permissions, and the effective permissions are recorded only
+in role.access and merged into the leaves, this can lead to incorrect
+reuse of a shadow page and eventually to a missing guest protection page
+fault.
+
+For example, here is a shared pagetable:
+
+ pgd[] pud[] pmd[] virtual address pointers
+ /->pmd1(u--)->pte1(uw-)->page1 <- ptr1 (u--)
+ /->pud1(uw-)--->pmd2(uw-)->pte2(uw-)->page2 <- ptr2 (uw-)
+ pgd-| (shared pmd[] as above)
+ \->pud2(u--)--->pmd1(u--)->pte1(uw-)->page1 <- ptr3 (u--)
+ \->pmd2(uw-)->pte2(uw-)->page2 <- ptr4 (u--)
+
+ pud1 and pud2 point to the same pmd table, so:
+ - ptr1 and ptr3 points to the same page.
+ - ptr2 and ptr4 points to the same page.
+
+(pud1 and pud2 here are pud entries, while pmd1 and pmd2 here are pmd entries)
+
+- First, the guest reads from ptr1 first and KVM prepares a shadow
+ page table with role.access=u--, from ptr1's pud1 and ptr1's pmd1.
+ "u--" comes from the effective permissions of pgd, pud1 and
+ pmd1, which are stored in pt->access. "u--" is used also to get
+ the pagetable for pud1, instead of "uw-".
+
+- Then the guest writes to ptr2 and KVM reuses pud1 which is present.
+ The hypervisor set up a shadow page for ptr2 with pt->access is "uw-"
+ even though the pud1 pmd (because of the incorrect argument to
+ kvm_mmu_get_page in the previous step) has role.access="u--".
+
+- Then the guest reads from ptr3. The hypervisor reuses pud1's
+ shadow pmd for pud2, because both use "u--" for their permissions.
+ Thus, the shadow pmd already includes entries for both pmd1 and pmd2.
+
+- At last, the guest writes to ptr4. This causes no vmexit or pagefault,
+ because pud1's shadow page structures included an "uw-" page even though
+ its role.access was "u--".
+
+Any kind of shared pagetable might have the similar problem when in
+virtual machine without TDP enabled if the permissions are different
+from different ancestors.
+
+In order to fix the problem, we change pt->access to be an array, and
+any access in it will not include permissions ANDed from child ptes.
+
+The test code is: https://lore.kernel.org/kvm/20210603050537.19605-1-jiangshanlai@gmail.com/
+Remember to test it with TDP disabled.
+
+The problem had existed long before the commit 41074d07c78b ("KVM: MMU:
+Fix inherited permissions for emulated guest pte updates"), and it
+is hard to find which is the culprit. So there is no fixes tag here.
+
+Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com>
+Message-Id: <20210603052455.21023-1-jiangshanlai@gmail.com>
+Cc: stable@vger.kernel.org
+Fixes: cea0f0e7ea54 ("[PATCH] KVM: MMU: Shadow page table caching")
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/virt/kvm/mmu.rst | 4 ++--
+ arch/x86/kvm/mmu/paging_tmpl.h | 14 +++++++++-----
+ 2 files changed, 11 insertions(+), 7 deletions(-)
+
+--- a/Documentation/virt/kvm/mmu.rst
++++ b/Documentation/virt/kvm/mmu.rst
+@@ -171,8 +171,8 @@ Shadow pages contain the following infor
+ shadow pages) so role.quadrant takes values in the range 0..3. Each
+ quadrant maps 1GB virtual address space.
+ role.access:
+- Inherited guest access permissions in the form uwx. Note execute
+- permission is positive, not negative.
++ Inherited guest access permissions from the parent ptes in the form uwx.
++ Note execute permission is positive, not negative.
+ role.invalid:
+ The page is invalid and should not be used. It is a root page that is
+ currently pinned (by a cpu hardware register pointing to it); once it is
+--- a/arch/x86/kvm/mmu/paging_tmpl.h
++++ b/arch/x86/kvm/mmu/paging_tmpl.h
+@@ -90,8 +90,8 @@ struct guest_walker {
+ gpa_t pte_gpa[PT_MAX_FULL_LEVELS];
+ pt_element_t __user *ptep_user[PT_MAX_FULL_LEVELS];
+ bool pte_writable[PT_MAX_FULL_LEVELS];
+- unsigned pt_access;
+- unsigned pte_access;
++ unsigned int pt_access[PT_MAX_FULL_LEVELS];
++ unsigned int pte_access;
+ gfn_t gfn;
+ struct x86_exception fault;
+ };
+@@ -418,13 +418,15 @@ retry_walk:
+ }
+
+ walker->ptes[walker->level - 1] = pte;
++
++ /* Convert to ACC_*_MASK flags for struct guest_walker. */
++ walker->pt_access[walker->level - 1] = FNAME(gpte_access)(pt_access ^ walk_nx_mask);
+ } while (!is_last_gpte(mmu, walker->level, pte));
+
+ pte_pkey = FNAME(gpte_pkeys)(vcpu, pte);
+ accessed_dirty = have_ad ? pte_access & PT_GUEST_ACCESSED_MASK : 0;
+
+ /* Convert to ACC_*_MASK flags for struct guest_walker. */
+- walker->pt_access = FNAME(gpte_access)(pt_access ^ walk_nx_mask);
+ walker->pte_access = FNAME(gpte_access)(pte_access ^ walk_nx_mask);
+ errcode = permission_fault(vcpu, mmu, walker->pte_access, pte_pkey, access);
+ if (unlikely(errcode))
+@@ -463,7 +465,8 @@ retry_walk:
+ }
+
+ pgprintk("%s: pte %llx pte_access %x pt_access %x\n",
+- __func__, (u64)pte, walker->pte_access, walker->pt_access);
++ __func__, (u64)pte, walker->pte_access,
++ walker->pt_access[walker->level - 1]);
+ return 1;
+
+ error:
+@@ -635,7 +638,7 @@ static int FNAME(fetch)(struct kvm_vcpu
+ bool huge_page_disallowed = exec && nx_huge_page_workaround_enabled;
+ struct kvm_mmu_page *sp = NULL;
+ struct kvm_shadow_walk_iterator it;
+- unsigned direct_access, access = gw->pt_access;
++ unsigned int direct_access, access;
+ int top_level, level, req_level, ret;
+ gfn_t base_gfn = gw->gfn;
+
+@@ -667,6 +670,7 @@ static int FNAME(fetch)(struct kvm_vcpu
+ sp = NULL;
+ if (!is_shadow_present_pte(*it.sptep)) {
+ table_gfn = gw->table_gfn[it.level - 2];
++ access = gw->pt_access[it.level - 2];
+ sp = kvm_mmu_get_page(vcpu, table_gfn, addr, it.level-1,
+ false, access);
+ }
--- /dev/null
+From 2c9017d0b5d3fbf17e69577a42d9e610ca122810 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Wed, 2 Jun 2021 09:34:35 +0200
+Subject: mmc: renesas_sdhi: abort tuning when timeout detected
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+commit 2c9017d0b5d3fbf17e69577a42d9e610ca122810 upstream.
+
+We have to bring the eMMC from sending-data state back to transfer state
+once we detected a CRC error (timeout) during tuning. So, send a stop
+command via mmc_abort_tuning().
+
+Fixes: 4f11997773b6 ("mmc: tmio: Add tuning support")
+Reported-by Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/20210602073435.5955-1-wsa+renesas@sang-engineering.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -660,14 +660,19 @@ static int renesas_sdhi_execute_tuning(s
+
+ /* Issue CMD19 twice for each tap */
+ for (i = 0; i < 2 * priv->tap_num; i++) {
++ int cmd_error;
++
+ /* Set sampling clock position */
+ sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_TAPSET, i % priv->tap_num);
+
+- if (mmc_send_tuning(mmc, opcode, NULL) == 0)
++ if (mmc_send_tuning(mmc, opcode, &cmd_error) == 0)
+ set_bit(i, priv->taps);
+
+ if (sd_scc_read32(host, priv, SH_MOBILE_SDHI_SCC_SMPCMP) == 0)
+ set_bit(i, priv->smpcmp);
++
++ if (cmd_error)
++ mmc_abort_tuning(mmc, opcode);
+ }
+
+ ret = renesas_sdhi_select_tuning(host);
--- /dev/null
+From 6687cd72aa9112a454a4646986e0402dd1b07d0e Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 4 Jun 2021 14:59:43 +0200
+Subject: mmc: renesas_sdhi: Fix HS400 on R-Car M3-W+
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 6687cd72aa9112a454a4646986e0402dd1b07d0e upstream.
+
+R-Car M3-W ES3.0 is marketed as R-Car M3-W+ (R8A77961), and has its own
+compatible value "renesas,r8a77961".
+
+Hence using soc_device_match() with soc_id = "r8a7796" and revision =
+"ES3.*" does not actually match running on an R-Car M3-W+ SoC.
+
+Fix this by matching with soc_id = "r8a77961" instead.
+
+Fixes: a38c078fea0b1393 ("mmc: renesas_sdhi: Avoid bad TAP in HS400")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/ee8af5d631f5331139ffea714539030d97352e93.1622811525.git.geert+renesas@glider.be
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -902,7 +902,7 @@ static const struct soc_device_attribute
+ { .soc_id = "r8a7795", .revision = "ES3.*", .data = &sdhi_quirks_bad_taps2367 },
+ { .soc_id = "r8a7796", .revision = "ES1.[012]", .data = &sdhi_quirks_4tap_nohs400 },
+ { .soc_id = "r8a7796", .revision = "ES1.*", .data = &sdhi_quirks_r8a7796_es13 },
+- { .soc_id = "r8a7796", .revision = "ES3.*", .data = &sdhi_quirks_bad_taps1357 },
++ { .soc_id = "r8a77961", .data = &sdhi_quirks_bad_taps1357 },
+ { .soc_id = "r8a77965", .data = &sdhi_quirks_r8a77965 },
+ { .soc_id = "r8a77980", .data = &sdhi_quirks_nohs400 },
+ { .soc_id = "r8a77990", .data = &sdhi_quirks_r8a77990 },
--- /dev/null
+From 848ff3768684701a4ce73a2ec0e5d438d4e2b0da Mon Sep 17 00:00:00 2001
+From: Kan Liang <kan.liang@linux.intel.com>
+Date: Tue, 1 Jun 2021 06:09:03 -0700
+Subject: perf/x86/intel/uncore: Fix M2M event umask for Ice Lake server
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+commit 848ff3768684701a4ce73a2ec0e5d438d4e2b0da upstream.
+
+Perf tool errors out with the latest event list for the Ice Lake server.
+
+event syntax error: 'unc_m2m_imc_reads.to_pmm'
+ \___ value too big for format, maximum is 255
+
+The same as the Snow Ridge server, the M2M uncore unit in the Ice Lake
+server has the unit mask extension field as well.
+
+Fixes: 2b3b76b5ec67 ("perf/x86/intel/uncore: Add Ice Lake server uncore support")
+Reported-by: Jin Yao <yao.jin@linux.intel.com>
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/1622552943-119174-1-git-send-email-kan.liang@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/events/intel/uncore_snbep.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/events/intel/uncore_snbep.c
++++ b/arch/x86/events/intel/uncore_snbep.c
+@@ -5067,9 +5067,10 @@ static struct intel_uncore_type icx_unco
+ .perf_ctr = SNR_M2M_PCI_PMON_CTR0,
+ .event_ctl = SNR_M2M_PCI_PMON_CTL0,
+ .event_mask = SNBEP_PMON_RAW_EVENT_MASK,
++ .event_mask_ext = SNR_M2M_PCI_PMON_UMASK_EXT,
+ .box_ctl = SNR_M2M_PCI_PMON_BOX_CTL,
+ .ops = &snr_m2m_uncore_pci_ops,
+- .format_group = &skx_uncore_format_group,
++ .format_group = &snr_m2m_uncore_format_group,
+ };
+
+ static struct attribute *icx_upi_uncore_formats_attr[] = {
--- /dev/null
+From f1ffa9d4cccc8fdf6c03fb1b3429154d22037988 Mon Sep 17 00:00:00 2001
+From: Zhang Rui <rui.zhang@intel.com>
+Date: Thu, 3 Jun 2021 10:34:14 +0800
+Subject: Revert "ACPI: sleep: Put the FACS table after using it"
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+commit f1ffa9d4cccc8fdf6c03fb1b3429154d22037988 upstream.
+
+Commit 95722237cb2a ("ACPI: sleep: Put the FACS table after using it")
+puts the FACS table during initialization.
+
+But the hardware signature bits in the FACS table need to be accessed,
+after every hibernation, to compare with the original hardware
+signature.
+
+So there is no reason to release the FACS table mapping after
+initialization.
+
+This reverts commit 95722237cb2ae4f7b73471058cdb19e8f4057c93.
+
+An alternative solution is to use acpi_gbl_FACS variable instead, which
+is mapped by the ACPICA core and never released.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=212277
+Reported-by: Stephan Hohe <sth.dev@tejp.de>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Cc: 5.8+ <stable@vger.kernel.org> # 5.8+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/sleep.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -1290,10 +1290,8 @@ static void acpi_sleep_hibernate_setup(v
+ return;
+
+ acpi_get_table(ACPI_SIG_FACS, 1, (struct acpi_table_header **)&facs);
+- if (facs) {
++ if (facs)
+ s4_hardware_signature = facs->hardware_signature;
+- acpi_put_table((struct acpi_table_header *)facs);
+- }
+ }
+ #else /* !CONFIG_HIBERNATION */
+ static inline void acpi_sleep_hibernate_setup(void) {}
spi-cleanup-on-failure-of-initial-setup.patch
i2c-mpc-make-use-of-i2c_recover_bus.patch
i2c-mpc-implement-erratum-a-004447-workaround.patch
+alsa-seq-fix-race-of-snd_seq_timer_open.patch
+alsa-firewire-lib-fix-the-context-to-call-snd_pcm_stop_xrun.patch
+alsa-hda-realtek-headphone-and-mic-don-t-work-on-an-acer-laptop.patch
+alsa-hda-realtek-fix-mute-micmute-leds-and-speaker-for-hp-elite-dragonfly-g2.patch
+alsa-hda-realtek-fix-mute-micmute-leds-and-speaker-for-hp-elitebook-x360-1040-g8.patch
+alsa-hda-realtek-fix-mute-micmute-leds-for-hp-elitebook-840-aero-g8.patch
+alsa-hda-realtek-fix-mute-micmute-leds-for-hp-zbook-power-g8.patch
+spi-bcm2835-fix-out-of-bounds-access-with-more-than-4-slaves.patch
+revert-acpi-sleep-put-the-facs-table-after-using-it.patch
+drm-fix-use-after-free-read-in-drm_getunique.patch
+drm-lock-pointer-access-in-drm_master_release.patch
+perf-x86-intel-uncore-fix-m2m-event-umask-for-ice-lake-server.patch
+kvm-x86-mmu-use-the-correct-inherited-permissions-to-get-shadow-page.patch
+kvm-avoid-speculation-based-attacks-from-out-of-range-memslot-accesses.patch
+staging-rtl8723bs-fix-uninitialized-variables.patch
+async_xor-check-src_offs-is-not-null-before-updating-it.patch
+btrfs-return-value-from-btrfs_mark_extent_written-in-case-of-error.patch
+btrfs-promote-debugging-asserts-to-full-fledged-checks-in-validate_super.patch
+cgroup1-don-t-allow-n-in-renaming.patch
+ftrace-do-not-blindly-read-the-ip-address-in-ftrace_bug.patch
+mmc-renesas_sdhi-abort-tuning-when-timeout-detected.patch
+mmc-renesas_sdhi-fix-hs400-on-r-car-m3-w.patch
+usb-f_ncm-ncm_bitrate-speed-is-unsigned.patch
+usb-f_ncm-only-first-packet-of-aggregate-needs-to-start-timer.patch
+usb-pd-set-pd_t_sink_wait_cap-to-310ms.patch
+usb-dwc3-meson-g12a-fix-usb2-phy-glue-init-when-phy0-is-disabled.patch
+usb-dwc3-meson-g12a-disable-the-regulator-in-the-error-handling-path-of-the-probe.patch
+usb-dwc3-gadget-bail-from-dwc3_gadget_exit-if-dwc-gadget-is-null.patch
+usb-dwc3-debugfs-add-and-remove-endpoint-dirs-dynamically.patch
+usb-dwc3-ep0-fix-null-pointer-exception.patch
+usb-musb-fix-musb_quirk_b_disconnect_99-handling.patch
+usb-typec-wcove-use-le-to-cpu-conversion-when-accessing-msg-header.patch
+usb-typec-ucsi-clear-ppm-capability-data-in-ucsi_init-error-path.patch
+usb-typec-intel_pmc_mux-put-fwnode-in-error-case-during-probe.patch
+usb-typec-intel_pmc_mux-add-missed-error-check-for-devm_ioremap_resource.patch
+usb-gadget-f_fs-ensure-io_completion_wq-is-idle-during-unbind.patch
+usb-serial-ftdi_sio-add-novatech-orionmx-product-id.patch
+usb-serial-omninet-add-device-id-for-zyxel-omni-56k-plus.patch
+usb-serial-quatech2-fix-control-request-directions.patch
+usb-serial-cp210x-fix-alternate-function-for-cp2102n-qfn20.patch
+usb-gadget-eem-fix-wrong-eem-header-operation.patch
+usb-fix-various-gadgets-null-ptr-deref-on-10gbps-cabling.patch
+usb-fix-various-gadget-panics-on-10gbps-cabling.patch
+usb-typec-tcpm-cancel-vdm-and-state-machine-hrtimer-when-unregister-tcpm-port.patch
+usb-typec-tcpm-cancel-frs-hrtimer-when-unregister-tcpm-port.patch
--- /dev/null
+From 13817d466eb8713a1ffd254f537402f091d48444 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sat, 22 May 2021 19:49:50 +0200
+Subject: spi: bcm2835: Fix out-of-bounds access with more than 4 slaves
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 13817d466eb8713a1ffd254f537402f091d48444 upstream.
+
+Commit 571e31fa60b3 ("spi: bcm2835: Cache CS register value for
+->prepare_message()") limited the number of slaves to 3 at compile-time.
+The limitation was necessitated by a statically-sized array prepare_cs[]
+in the driver private data which contains a per-slave register value.
+
+The commit sought to enforce the limitation at run-time by setting the
+controller's num_chipselect to 3: Slaves with a higher chipselect are
+rejected by spi_add_device().
+
+However the commit neglected that num_chipselect only limits the number
+of *native* chipselects. If GPIO chipselects are specified in the
+device tree for more than 3 slaves, num_chipselect is silently raised by
+of_spi_get_gpio_numbers() and the result are out-of-bounds accesses to
+the statically-sized array prepare_cs[].
+
+As a bandaid fix which is backportable to stable, raise the number of
+allowed slaves to 24 (which "ought to be enough for anybody"), enforce
+the limitation on slave ->setup and revert num_chipselect to 3 (which is
+the number of native chipselects supported by the controller).
+An upcoming for-next commit will allow an arbitrary number of slaves.
+
+Fixes: 571e31fa60b3 ("spi: bcm2835: Cache CS register value for ->prepare_message()")
+Reported-by: Joe Burmeister <joe.burmeister@devtank.co.uk>
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: stable@vger.kernel.org # v5.4+
+Cc: Phil Elwell <phil@raspberrypi.com>
+Link: https://lore.kernel.org/r/75854affc1923309fde05e47494263bde73e5592.1621703210.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-bcm2835.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -68,7 +68,7 @@
+ #define BCM2835_SPI_FIFO_SIZE 64
+ #define BCM2835_SPI_FIFO_SIZE_3_4 48
+ #define BCM2835_SPI_DMA_MIN_LENGTH 96
+-#define BCM2835_SPI_NUM_CS 4 /* raise as necessary */
++#define BCM2835_SPI_NUM_CS 24 /* raise as necessary */
+ #define BCM2835_SPI_MODE_BITS (SPI_CPOL | SPI_CPHA | SPI_CS_HIGH \
+ | SPI_NO_CS | SPI_3WIRE)
+
+@@ -1195,6 +1195,12 @@ static int bcm2835_spi_setup(struct spi_
+ struct gpio_chip *chip;
+ u32 cs;
+
++ if (spi->chip_select >= BCM2835_SPI_NUM_CS) {
++ dev_err(&spi->dev, "only %d chip-selects supported\n",
++ BCM2835_SPI_NUM_CS - 1);
++ return -EINVAL;
++ }
++
+ /*
+ * Precalculate SPI slave's CS register value for ->prepare_message():
+ * The driver always uses software-controlled GPIO chip select, hence
+@@ -1288,7 +1294,7 @@ static int bcm2835_spi_probe(struct plat
+ ctlr->use_gpio_descriptors = true;
+ ctlr->mode_bits = BCM2835_SPI_MODE_BITS;
+ ctlr->bits_per_word_mask = SPI_BPW_MASK(8);
+- ctlr->num_chipselect = BCM2835_SPI_NUM_CS;
++ ctlr->num_chipselect = 3;
+ ctlr->setup = bcm2835_spi_setup;
+ ctlr->transfer_one = bcm2835_spi_transfer_one;
+ ctlr->handle_err = bcm2835_spi_handle_err;
--- /dev/null
+From 43c85d770db80cb135f576f8fde6ff1a08e707a4 Mon Sep 17 00:00:00 2001
+From: Wenli Looi <wlooi@ucalgary.ca>
+Date: Mon, 7 Jun 2021 23:46:20 -0700
+Subject: staging: rtl8723bs: Fix uninitialized variables
+
+From: Wenli Looi <wlooi@ucalgary.ca>
+
+commit 43c85d770db80cb135f576f8fde6ff1a08e707a4 upstream.
+
+The sinfo.pertid and sinfo.generation variables are not initialized and
+it causes a crash when we use this as a wireless access point.
+
+[ 456.873025] ------------[ cut here ]------------
+[ 456.878198] kernel BUG at mm/slub.c:3968!
+[ 456.882680] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
+
+ [ snip ]
+
+[ 457.271004] Backtrace:
+[ 457.273733] [<c02b7ee4>] (kfree) from [<c0e2a470>] (nl80211_send_station+0x954/0xfc4)
+[ 457.282481] r9:eccca0c0 r8:e8edfec0 r7:00000000 r6:00000011 r5:e80a9480 r4:e8edfe00
+[ 457.291132] [<c0e29b1c>] (nl80211_send_station) from [<c0e2b18c>] (cfg80211_new_sta+0x90/0x1cc)
+[ 457.300850] r10:e80a9480 r9:e8edfe00 r8:ea678cca r7:00000a20 r6:00000000 r5:ec46d000
+[ 457.309586] r4:ec46d9e0
+[ 457.312433] [<c0e2b0fc>] (cfg80211_new_sta) from [<bf086684>] (rtw_cfg80211_indicate_sta_assoc+0x80/0x9c [r8723bs])
+[ 457.324095] r10:00009930 r9:e85b9d80 r8:bf091050 r7:00000000 r6:00000000 r5:0000001c
+[ 457.332831] r4:c1606788
+[ 457.335692] [<bf086604>] (rtw_cfg80211_indicate_sta_assoc [r8723bs]) from [<bf03df38>] (rtw_stassoc_event_callback+0x1c8/0x1d4 [r8723bs])
+[ 457.349489] r7:ea678cc0 r6:000000a1 r5:f1225f84 r4:f086b000
+[ 457.355845] [<bf03dd70>] (rtw_stassoc_event_callback [r8723bs]) from [<bf048e4c>] (mlme_evt_hdl+0x8c/0xb4 [r8723bs])
+[ 457.367601] r7:c1604900 r6:f086c4b8 r5:00000000 r4:f086c000
+[ 457.373959] [<bf048dc0>] (mlme_evt_hdl [r8723bs]) from [<bf03693c>] (rtw_cmd_thread+0x198/0x3d8 [r8723bs])
+[ 457.384744] r5:f086e000 r4:f086c000
+[ 457.388754] [<bf0367a4>] (rtw_cmd_thread [r8723bs]) from [<c014a214>] (kthread+0x170/0x174)
+[ 457.398083] r10:ed7a57e8 r9:bf0367a4 r8:f086b000 r7:e8ede000 r6:00000000 r5:e9975200
+[ 457.406828] r4:e8369900
+[ 457.409653] [<c014a0a4>] (kthread) from [<c01010e8>] (ret_from_fork+0x14/0x2c)
+[ 457.417718] Exception stack(0xe8edffb0 to 0xe8edfff8)
+[ 457.423356] ffa0: 00000000 00000000 00000000 00000000
+[ 457.432492] ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+[ 457.441618] ffe0: 00000000 00000000 00000000 00000000 00000013 00000000
+[ 457.449006] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:c014a0a4
+[ 457.457750] r4:e9975200
+[ 457.460574] Code: 1a000003 e5953004 e3130001 1a000000 (e7f001f2)
+[ 457.467381] ---[ end trace 4acbc8c15e9e6aa7 ]---
+
+Link: https://forum.armbian.com/topic/14727-wifi-ap-kernel-bug-in-kernel-5444/
+Fixes: 8689c051a201 ("cfg80211: dynamically allocate per-tid stats for station info")
+Fixes: f5ea9120be2e ("nl80211: add generation number to all dumps")
+Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210608064620.74059-1-wlooi@ucalgary.ca
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+@@ -2384,7 +2384,7 @@ void rtw_cfg80211_indicate_sta_assoc(str
+ DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+ {
+- struct station_info sinfo;
++ struct station_info sinfo = {};
+ u8 ie_offset;
+ if (GetFrameSubType(pmgmt_frame) == WIFI_ASSOCREQ)
+ ie_offset = _ASOCREQ_IE_OFFSET_;
--- /dev/null
+From 8d396bb0a5b62b326f6be7594d8bd46b088296bd Mon Sep 17 00:00:00 2001
+From: Jack Pham <jackp@codeaurora.org>
+Date: Sat, 29 May 2021 12:29:32 -0700
+Subject: usb: dwc3: debugfs: Add and remove endpoint dirs dynamically
+
+From: Jack Pham <jackp@codeaurora.org>
+
+commit 8d396bb0a5b62b326f6be7594d8bd46b088296bd upstream.
+
+The DWC3 DebugFS directory and files are currently created once
+during probe. This includes creation of subdirectories for each
+of the gadget's endpoints. This works fine for peripheral-only
+controllers, as dwc3_core_init_mode() calls dwc3_gadget_init()
+just prior to calling dwc3_debugfs_init().
+
+However, for dual-role controllers, dwc3_core_init_mode() will
+instead call dwc3_drd_init() which is problematic in a few ways.
+First, the initial state must be determined, then dwc3_set_mode()
+will have to schedule drd_work and by then dwc3_debugfs_init()
+could have already been invoked. Even if the initial mode is
+peripheral, dwc3_gadget_init() happens after the DebugFS files
+are created, and worse so if the initial state is host and the
+controller switches to peripheral much later. And secondly,
+even if the gadget endpoints' debug entries were successfully
+created, if the controller exits peripheral mode, its dwc3_eps
+are freed so the debug files would now hold stale references.
+
+So it is best if the DebugFS endpoint entries are created and
+removed dynamically at the same time the underlying dwc3_eps are.
+Do this by calling dwc3_debugfs_create_endpoint_dir() as each
+endpoint is created, and conversely remove the DebugFS entry when
+the endpoint is freed.
+
+Fixes: 41ce1456e1db ("usb: dwc3: core: make dwc3_set_mode() work properly")
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Link: https://lore.kernel.org/r/20210529192932.22912-1-jackp@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/debug.h | 3 +++
+ drivers/usb/dwc3/debugfs.c | 21 ++-------------------
+ drivers/usb/dwc3/gadget.c | 3 +++
+ 3 files changed, 8 insertions(+), 19 deletions(-)
+
+--- a/drivers/usb/dwc3/debug.h
++++ b/drivers/usb/dwc3/debug.h
+@@ -413,9 +413,12 @@ static inline const char *dwc3_gadget_ge
+
+
+ #ifdef CONFIG_DEBUG_FS
++extern void dwc3_debugfs_create_endpoint_dir(struct dwc3_ep *dep);
+ extern void dwc3_debugfs_init(struct dwc3 *d);
+ extern void dwc3_debugfs_exit(struct dwc3 *d);
+ #else
++static inline void dwc3_debugfs_create_endpoint_dir(struct dwc3_ep *dep)
++{ }
+ static inline void dwc3_debugfs_init(struct dwc3 *d)
+ { }
+ static inline void dwc3_debugfs_exit(struct dwc3 *d)
+--- a/drivers/usb/dwc3/debugfs.c
++++ b/drivers/usb/dwc3/debugfs.c
+@@ -890,30 +890,14 @@ static void dwc3_debugfs_create_endpoint
+ }
+ }
+
+-static void dwc3_debugfs_create_endpoint_dir(struct dwc3_ep *dep,
+- struct dentry *parent)
++void dwc3_debugfs_create_endpoint_dir(struct dwc3_ep *dep)
+ {
+ struct dentry *dir;
+
+- dir = debugfs_create_dir(dep->name, parent);
++ dir = debugfs_create_dir(dep->name, dep->dwc->root);
+ dwc3_debugfs_create_endpoint_files(dep, dir);
+ }
+
+-static void dwc3_debugfs_create_endpoint_dirs(struct dwc3 *dwc,
+- struct dentry *parent)
+-{
+- int i;
+-
+- for (i = 0; i < dwc->num_eps; i++) {
+- struct dwc3_ep *dep = dwc->eps[i];
+-
+- if (!dep)
+- continue;
+-
+- dwc3_debugfs_create_endpoint_dir(dep, parent);
+- }
+-}
+-
+ void dwc3_debugfs_init(struct dwc3 *dwc)
+ {
+ struct dentry *root;
+@@ -944,7 +928,6 @@ void dwc3_debugfs_init(struct dwc3 *dwc)
+ &dwc3_testmode_fops);
+ debugfs_create_file("link_state", 0644, root, dwc,
+ &dwc3_link_state_fops);
+- dwc3_debugfs_create_endpoint_dirs(dwc, root);
+ }
+ }
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2665,6 +2665,8 @@ static int dwc3_gadget_init_endpoint(str
+ INIT_LIST_HEAD(&dep->started_list);
+ INIT_LIST_HEAD(&dep->cancelled_list);
+
++ dwc3_debugfs_create_endpoint_dir(dep);
++
+ return 0;
+ }
+
+@@ -2708,6 +2710,7 @@ static void dwc3_gadget_free_endpoints(s
+ list_del(&dep->endpoint.ep_list);
+ }
+
++ debugfs_remove_recursive(debugfs_lookup(dep->name, dwc->root));
+ kfree(dep);
+ }
+ }
--- /dev/null
+From d00889080ab60051627dab1d85831cd9db750e2a Mon Sep 17 00:00:00 2001
+From: Marian-Cristian Rotariu <marian.c.rotariu@gmail.com>
+Date: Tue, 8 Jun 2021 19:26:50 +0300
+Subject: usb: dwc3: ep0: fix NULL pointer exception
+
+From: Marian-Cristian Rotariu <marian.c.rotariu@gmail.com>
+
+commit d00889080ab60051627dab1d85831cd9db750e2a upstream.
+
+There is no validation of the index from dwc3_wIndex_to_dep() and we might
+be referring a non-existing ep and trigger a NULL pointer exception. In
+certain configurations we might use fewer eps and the index might wrongly
+indicate a larger ep index than existing.
+
+By adding this validation from the patch we can actually report a wrong
+index back to the caller.
+
+In our usecase we are using a composite device on an older kernel, but
+upstream might use this fix also. Unfortunately, I cannot describe the
+hardware for others to reproduce the issue as it is a proprietary
+implementation.
+
+[ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4
+[ 82.966891] Mem abort info:
+[ 82.969663] ESR = 0x96000006
+[ 82.972703] Exception class = DABT (current EL), IL = 32 bits
+[ 82.978603] SET = 0, FnV = 0
+[ 82.981642] EA = 0, S1PTW = 0
+[ 82.984765] Data abort info:
+[ 82.987631] ISV = 0, ISS = 0x00000006
+[ 82.991449] CM = 0, WnR = 0
+[ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc
+[ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000
+[ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP
+[ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)
+[ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1
+[ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)
+[ 83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c
+[ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94
+
+...
+
+[ 83.141788] Call trace:
+[ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c
+[ 83.148823] dwc3_ep0_interrupt+0x3b4/0xc94
+[ 83.181546] ---[ end trace aac6b5267d84c32f ]---
+
+Signed-off-by: Marian-Cristian Rotariu <marian.c.rotariu@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210608162650.58426-1-marian.c.rotariu@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/ep0.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -292,6 +292,9 @@ static struct dwc3_ep *dwc3_wIndex_to_de
+ epnum |= 1;
+
+ dep = dwc->eps[epnum];
++ if (dep == NULL)
++ return NULL;
++
+ if (dep->flags & DWC3_EP_ENABLED)
+ return dep;
+
--- /dev/null
+From 03715ea2e3dbbc56947137ce3b4ac18a726b2f87 Mon Sep 17 00:00:00 2001
+From: Jack Pham <jackp@codeaurora.org>
+Date: Fri, 28 May 2021 09:04:05 -0700
+Subject: usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc->gadget is NULL
+
+From: Jack Pham <jackp@codeaurora.org>
+
+commit 03715ea2e3dbbc56947137ce3b4ac18a726b2f87 upstream.
+
+There exists a possible scenario in which dwc3_gadget_init() can fail:
+during during host -> peripheral mode switch in dwc3_set_mode(), and
+a pending gadget driver fails to bind. Then, if the DRD undergoes
+another mode switch from peripheral->host the resulting
+dwc3_gadget_exit() will attempt to reference an invalid and dangling
+dwc->gadget pointer as well as call dma_free_coherent() on unmapped
+DMA pointers.
+
+The exact scenario can be reproduced as follows:
+ - Start DWC3 in peripheral mode
+ - Configure ConfigFS gadget with FunctionFS instance (or use g_ffs)
+ - Run FunctionFS userspace application (open EPs, write descriptors, etc)
+ - Bind gadget driver to DWC3's UDC
+ - Switch DWC3 to host mode
+ => dwc3_gadget_exit() is called. usb_del_gadget() will put the
+ ConfigFS driver instance on the gadget_driver_pending_list
+ - Stop FunctionFS application (closes the ep files)
+ - Switch DWC3 to peripheral mode
+ => dwc3_gadget_init() fails as usb_add_gadget() calls
+ check_pending_gadget_drivers() and attempts to rebind the UDC
+ to the ConfigFS gadget but fails with -19 (-ENODEV) because the
+ FFS instance is not in FFS_ACTIVE state (userspace has not
+ re-opened and written the descriptors yet, i.e. desc_ready!=0).
+ - Switch DWC3 back to host mode
+ => dwc3_gadget_exit() is called again, but this time dwc->gadget
+ is invalid.
+
+Although it can be argued that userspace should take responsibility
+for ensuring that the FunctionFS application be ready prior to
+allowing the composite driver bind to the UDC, failure to do so
+should not result in a panic from the kernel driver.
+
+Fix this by setting dwc->gadget to NULL in the failure path of
+dwc3_gadget_init() and add a check to dwc3_gadget_exit() to bail out
+unless the gadget pointer is valid.
+
+Fixes: e81a7018d93a ("usb: dwc3: allocate gadget structure dynamically")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Link: https://lore.kernel.org/r/20210528160405.17550-1-jackp@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -3936,6 +3936,7 @@ err5:
+ dwc3_gadget_free_endpoints(dwc);
+ err4:
+ usb_put_gadget(dwc->gadget);
++ dwc->gadget = NULL;
+ err3:
+ dma_free_coherent(dwc->sysdev, DWC3_BOUNCE_SIZE, dwc->bounce,
+ dwc->bounce_addr);
+@@ -3955,6 +3956,9 @@ err0:
+
+ void dwc3_gadget_exit(struct dwc3 *dwc)
+ {
++ if (!dwc->gadget)
++ return;
++
+ usb_del_gadget(dwc->gadget);
+ dwc3_gadget_free_endpoints(dwc);
+ usb_put_gadget(dwc->gadget);
--- /dev/null
+From 1d0d3d818eafe1963ec1eaf302175cd14938188e Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Fri, 21 May 2021 18:55:50 +0200
+Subject: usb: dwc3: meson-g12a: Disable the regulator in the error handling path of the probe
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 1d0d3d818eafe1963ec1eaf302175cd14938188e upstream.
+
+If an error occurs after a successful 'regulator_enable()' call,
+'regulator_disable()' must be called.
+
+Fix the error handling path of the probe accordingly.
+
+The remove function doesn't need to be fixed, because the
+'regulator_disable()' call is already hidden in 'dwc3_meson_g12a_suspend()'
+which is called via 'pm_runtime_set_suspended()' in the remove function.
+
+Fixes: c99993376f72 ("usb: dwc3: Add Amlogic G12A DWC3 glue")
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/79df054046224bbb0716a8c5c2082650290eec86.1621616013.git.christophe.jaillet@wanadoo.fr
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-meson-g12a.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
+@@ -775,13 +775,13 @@ static int dwc3_meson_g12a_probe(struct
+
+ ret = priv->drvdata->usb_init(priv);
+ if (ret)
+- goto err_disable_clks;
++ goto err_disable_regulator;
+
+ /* Init PHYs */
+ for (i = 0 ; i < PHY_COUNT ; ++i) {
+ ret = phy_init(priv->phys[i]);
+ if (ret)
+- goto err_disable_clks;
++ goto err_disable_regulator;
+ }
+
+ /* Set PHY Power */
+@@ -819,6 +819,10 @@ err_phys_exit:
+ for (i = 0 ; i < PHY_COUNT ; ++i)
+ phy_exit(priv->phys[i]);
+
++err_disable_regulator:
++ if (priv->vbus)
++ regulator_disable(priv->vbus);
++
+ err_disable_clks:
+ clk_bulk_disable_unprepare(priv->drvdata->num_clks,
+ priv->drvdata->clks);
--- /dev/null
+From 4d2aa178d2ad2fb156711113790dde13e9aa2376 Mon Sep 17 00:00:00 2001
+From: Neil Armstrong <narmstrong@baylibre.com>
+Date: Tue, 1 Jun 2021 10:48:30 +0200
+Subject: usb: dwc3-meson-g12a: fix usb2 PHY glue init when phy0 is disabled
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+commit 4d2aa178d2ad2fb156711113790dde13e9aa2376 upstream.
+
+When only PHY1 is used (for example on Odroid-HC4), the regmap init code
+uses the usb2 ports when doesn't initialize the PHY1 regmap entry.
+
+This fixes:
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
+...
+pc : regmap_update_bits_base+0x40/0xa0
+lr : dwc3_meson_g12a_usb2_init_phy+0x4c/0xf8
+...
+Call trace:
+regmap_update_bits_base+0x40/0xa0
+dwc3_meson_g12a_usb2_init_phy+0x4c/0xf8
+dwc3_meson_g12a_usb2_init+0x7c/0xc8
+dwc3_meson_g12a_usb_init+0x28/0x48
+dwc3_meson_g12a_probe+0x298/0x540
+platform_probe+0x70/0xe0
+really_probe+0xf0/0x4d8
+driver_probe_device+0xfc/0x168
+...
+
+Fixes: 013af227f58a97 ("usb: dwc3: meson-g12a: handle the phy and glue registers separately")
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210601084830.260196-1-narmstrong@baylibre.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-meson-g12a.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
+@@ -651,7 +651,7 @@ static int dwc3_meson_g12a_setup_regmaps
+ return PTR_ERR(priv->usb_glue_regmap);
+
+ /* Create a regmap for each USB2 PHY control register set */
+- for (i = 0; i < priv->usb2_ports; i++) {
++ for (i = 0; i < priv->drvdata->num_phys; i++) {
+ struct regmap_config u2p_regmap_config = {
+ .reg_bits = 8,
+ .val_bits = 32,
+@@ -659,6 +659,9 @@ static int dwc3_meson_g12a_setup_regmaps
+ .max_register = U2P_R1,
+ };
+
++ if (!strstr(priv->drvdata->phy_names[i], "usb2"))
++ continue;
++
+ u2p_regmap_config.name = devm_kasprintf(priv->dev, GFP_KERNEL,
+ "u2p-%d", i);
+ if (!u2p_regmap_config.name)
--- /dev/null
+From 3370139745853f7826895293e8ac3aec1430508e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
+Date: Mon, 7 Jun 2021 17:53:44 -0700
+Subject: USB: f_ncm: ncm_bitrate (speed) is unsigned
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej Żenczykowski <maze@google.com>
+
+commit 3370139745853f7826895293e8ac3aec1430508e upstream.
+
+[ 190.544755] configfs-gadget gadget: notify speed -44967296
+
+This is because 4250000000 - 2**32 is -44967296.
+
+Fixes: 9f6ce4240a2b ("usb: gadget: f_ncm.c added")
+Cc: Brooke Basile <brookebasile@gmail.com>
+Cc: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: Lorenzo Colitti <lorenzo@google.com>
+Cc: Yauheni Kaliuta <yauheni.kaliuta@nokia.com>
+Cc: Linux USB Mailing List <linux-usb@vger.kernel.org>
+Acked-By: Lorenzo Colitti <lorenzo@google.com>
+Signed-off-by: Maciej Żenczykowski <maze@google.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210608005344.3762668-1-zenczykowski@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_ncm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -583,7 +583,7 @@ static void ncm_do_notify(struct f_ncm *
+ data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
+ data[1] = data[0];
+
+- DBG(cdev, "notify speed %d\n", ncm_bitrate(cdev->gadget));
++ DBG(cdev, "notify speed %u\n", ncm_bitrate(cdev->gadget));
+ ncm->notify_state = NCM_NOTIFY_CONNECT;
+ break;
+ }
--- /dev/null
+From 1958ff5ad2d4908b44a72bcf564dfe67c981e7fe Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
+Date: Tue, 8 Jun 2021 01:54:38 -0700
+Subject: usb: f_ncm: only first packet of aggregate needs to start timer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej Żenczykowski <maze@google.com>
+
+commit 1958ff5ad2d4908b44a72bcf564dfe67c981e7fe upstream.
+
+The reasoning for this change is that if we already had
+a packet pending, then we also already had a pending timer,
+and as such there is no need to reschedule it.
+
+This also prevents packets getting delayed 60 ms worst case
+under a tiny packet every 290us transmit load, by keeping the
+timeout always relative to the first queued up packet.
+(300us delay * 16KB max aggregation / 80 byte packet =~ 60 ms)
+
+As such the first packet is now at most delayed by 300us.
+
+Under low transmit load, this will simply result in us sending
+a shorter aggregate, as originally intended.
+
+This patch has the benefit of greatly reducing (by ~10 factor
+with 1500 byte frames aggregated into 16 kiB) the number of
+(potentially pretty costly) updates to the hrtimer.
+
+Cc: Brooke Basile <brookebasile@gmail.com>
+Cc: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: Lorenzo Colitti <lorenzo@google.com>
+Signed-off-by: Maciej Żenczykowski <maze@google.com>
+Link: https://lore.kernel.org/r/20210608085438.813960-1-zenczykowski@gmail.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_ncm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1101,11 +1101,11 @@ static struct sk_buff *ncm_wrap_ntb(stru
+ ncm->ndp_dgram_count = 1;
+
+ /* Note: we skip opts->next_ndp_index */
+- }
+
+- /* Delay the timer. */
+- hrtimer_start(&ncm->task_timer, TX_TIMEOUT_NSECS,
+- HRTIMER_MODE_REL_SOFT);
++ /* Start the timer. */
++ hrtimer_start(&ncm->task_timer, TX_TIMEOUT_NSECS,
++ HRTIMER_MODE_REL_SOFT);
++ }
+
+ /* Add the datagram position entries */
+ ntb_ndp = skb_put_zero(ncm->skb_tx_ndp, dgram_idx_len);
--- /dev/null
+From 032e288097a553db5653af552dd8035cd2a0ba96 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
+Date: Tue, 8 Jun 2021 19:44:59 -0700
+Subject: usb: fix various gadget panics on 10gbps cabling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej Żenczykowski <maze@google.com>
+
+commit 032e288097a553db5653af552dd8035cd2a0ba96 upstream.
+
+usb_assign_descriptors() is called with 5 parameters,
+the last 4 of which are the usb_descriptor_header for:
+ full-speed (USB1.1 - 12Mbps [including USB1.0 low-speed @ 1.5Mbps),
+ high-speed (USB2.0 - 480Mbps),
+ super-speed (USB3.0 - 5Gbps),
+ super-speed-plus (USB3.1 - 10Gbps).
+
+The differences between full/high/super-speed descriptors are usually
+substantial (due to changes in the maximum usb block size from 64 to 512
+to 1024 bytes and other differences in the specs), while the difference
+between 5 and 10Gbps descriptors may be as little as nothing
+(in many cases the same tuning is simply good enough).
+
+However if a gadget driver calls usb_assign_descriptors() with
+a NULL descriptor for super-speed-plus and is then used on a max 10gbps
+configuration, the kernel will crash with a null pointer dereference,
+when a 10gbps capable device port + cable + host port combination shows up.
+(This wouldn't happen if the gadget max-speed was set to 5gbps, but
+it of course defaults to the maximum, and there's no real reason to
+artificially limit it)
+
+The fix is to simply use the 5gbps descriptor as the 10gbps descriptor,
+if a 10gbps descriptor wasn't provided.
+
+Obviously this won't fix the problem if the 5gbps descriptor is also
+NULL, but such cases can't be so trivially solved (and any such gadgets
+are unlikely to be used with USB3 ports any way).
+
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Maciej Żenczykowski <maze@google.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210609024459.1126080-1-zenczykowski@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/config.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/usb/gadget/config.c
++++ b/drivers/usb/gadget/config.c
+@@ -164,6 +164,14 @@ int usb_assign_descriptors(struct usb_fu
+ {
+ struct usb_gadget *g = f->config->cdev->gadget;
+
++ /* super-speed-plus descriptor falls back to super-speed one,
++ * if such a descriptor was provided, thus avoiding a NULL
++ * pointer dereference if a 5gbps capable gadget is used with
++ * a 10gbps capable config (device port + cable + host port)
++ */
++ if (!ssp)
++ ssp = ss;
++
+ if (fs) {
+ f->fs_descriptors = usb_copy_descriptors(fs);
+ if (!f->fs_descriptors)
--- /dev/null
+From 90c4d05780d47e14a50e11a7f17373104cd47d25 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
+Date: Mon, 7 Jun 2021 21:41:41 -0700
+Subject: usb: fix various gadgets null ptr deref on 10gbps cabling.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej Żenczykowski <maze@google.com>
+
+commit 90c4d05780d47e14a50e11a7f17373104cd47d25 upstream.
+
+This avoids a null pointer dereference in
+f_{ecm,eem,hid,loopback,printer,rndis,serial,sourcesink,subset,tcm}
+by simply reusing the 5gbps config for 10gbps.
+
+Fixes: eaef50c76057 ("usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus")
+Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
+Cc: Lorenzo Colitti <lorenzo@google.com>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: Michael R Sweet <msweet@msweet.org>
+Cc: Mike Christie <michael.christie@oracle.com>
+Cc: Pawel Laszczak <pawell@cadence.com>
+Cc: Peter Chen <peter.chen@nxp.com>
+Cc: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>
+Cc: Wei Ming Chen <jj251510319013@gmail.com>
+Cc: Will McVicker <willmcvicker@google.com>
+Cc: Zqiang <qiang.zhang@windriver.com>
+Reviewed-By: Lorenzo Colitti <lorenzo@google.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Maciej Żenczykowski <maze@google.com>
+Link: https://lore.kernel.org/r/20210608044141.3898496-1-zenczykowski@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_ecm.c | 2 +-
+ drivers/usb/gadget/function/f_eem.c | 2 +-
+ drivers/usb/gadget/function/f_hid.c | 3 ++-
+ drivers/usb/gadget/function/f_loopback.c | 2 +-
+ drivers/usb/gadget/function/f_printer.c | 3 ++-
+ drivers/usb/gadget/function/f_rndis.c | 2 +-
+ drivers/usb/gadget/function/f_serial.c | 2 +-
+ drivers/usb/gadget/function/f_sourcesink.c | 3 ++-
+ drivers/usb/gadget/function/f_subset.c | 2 +-
+ drivers/usb/gadget/function/f_tcm.c | 3 ++-
+ 10 files changed, 14 insertions(+), 10 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_ecm.c
++++ b/drivers/usb/gadget/function/f_ecm.c
+@@ -791,7 +791,7 @@ ecm_bind(struct usb_configuration *c, st
+ fs_ecm_notify_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, ecm_fs_function, ecm_hs_function,
+- ecm_ss_function, NULL);
++ ecm_ss_function, ecm_ss_function);
+ if (status)
+ goto fail;
+
+--- a/drivers/usb/gadget/function/f_eem.c
++++ b/drivers/usb/gadget/function/f_eem.c
+@@ -302,7 +302,7 @@ static int eem_bind(struct usb_configura
+ eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, eem_fs_function, eem_hs_function,
+- eem_ss_function, NULL);
++ eem_ss_function, eem_ss_function);
+ if (status)
+ goto fail;
+
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -802,7 +802,8 @@ static int hidg_bind(struct usb_configur
+ hidg_fs_out_ep_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, hidg_fs_descriptors,
+- hidg_hs_descriptors, hidg_ss_descriptors, NULL);
++ hidg_hs_descriptors, hidg_ss_descriptors,
++ hidg_ss_descriptors);
+ if (status)
+ goto fail;
+
+--- a/drivers/usb/gadget/function/f_loopback.c
++++ b/drivers/usb/gadget/function/f_loopback.c
+@@ -207,7 +207,7 @@ autoconf_fail:
+ ss_loop_sink_desc.bEndpointAddress = fs_loop_sink_desc.bEndpointAddress;
+
+ ret = usb_assign_descriptors(f, fs_loopback_descs, hs_loopback_descs,
+- ss_loopback_descs, NULL);
++ ss_loopback_descs, ss_loopback_descs);
+ if (ret)
+ return ret;
+
+--- a/drivers/usb/gadget/function/f_printer.c
++++ b/drivers/usb/gadget/function/f_printer.c
+@@ -1099,7 +1099,8 @@ autoconf_fail:
+ ss_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
+
+ ret = usb_assign_descriptors(f, fs_printer_function,
+- hs_printer_function, ss_printer_function, NULL);
++ hs_printer_function, ss_printer_function,
++ ss_printer_function);
+ if (ret)
+ return ret;
+
+--- a/drivers/usb/gadget/function/f_rndis.c
++++ b/drivers/usb/gadget/function/f_rndis.c
+@@ -789,7 +789,7 @@ rndis_bind(struct usb_configuration *c,
+ ss_notify_desc.bEndpointAddress = fs_notify_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, eth_fs_function, eth_hs_function,
+- eth_ss_function, NULL);
++ eth_ss_function, eth_ss_function);
+ if (status)
+ goto fail;
+
+--- a/drivers/usb/gadget/function/f_serial.c
++++ b/drivers/usb/gadget/function/f_serial.c
+@@ -233,7 +233,7 @@ static int gser_bind(struct usb_configur
+ gser_ss_out_desc.bEndpointAddress = gser_fs_out_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, gser_fs_function, gser_hs_function,
+- gser_ss_function, NULL);
++ gser_ss_function, gser_ss_function);
+ if (status)
+ goto fail;
+ dev_dbg(&cdev->gadget->dev, "generic ttyGS%d: %s speed IN/%s OUT/%s\n",
+--- a/drivers/usb/gadget/function/f_sourcesink.c
++++ b/drivers/usb/gadget/function/f_sourcesink.c
+@@ -431,7 +431,8 @@ no_iso:
+ ss_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress;
+
+ ret = usb_assign_descriptors(f, fs_source_sink_descs,
+- hs_source_sink_descs, ss_source_sink_descs, NULL);
++ hs_source_sink_descs, ss_source_sink_descs,
++ ss_source_sink_descs);
+ if (ret)
+ return ret;
+
+--- a/drivers/usb/gadget/function/f_subset.c
++++ b/drivers/usb/gadget/function/f_subset.c
+@@ -358,7 +358,7 @@ geth_bind(struct usb_configuration *c, s
+ fs_subset_out_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, fs_eth_function, hs_eth_function,
+- ss_eth_function, NULL);
++ ss_eth_function, ss_eth_function);
+ if (status)
+ goto fail;
+
+--- a/drivers/usb/gadget/function/f_tcm.c
++++ b/drivers/usb/gadget/function/f_tcm.c
+@@ -2061,7 +2061,8 @@ static int tcm_bind(struct usb_configura
+ uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
+
+ ret = usb_assign_descriptors(f, uasp_fs_function_desc,
+- uasp_hs_function_desc, uasp_ss_function_desc, NULL);
++ uasp_hs_function_desc, uasp_ss_function_desc,
++ uasp_ss_function_desc);
+ if (ret)
+ goto ep_fail;
+
--- /dev/null
+From 305f670846a31a261462577dd0b967c4fa796871 Mon Sep 17 00:00:00 2001
+From: Linyu Yuan <linyyuan@codeaurora.com>
+Date: Wed, 9 Jun 2021 07:35:47 +0800
+Subject: usb: gadget: eem: fix wrong eem header operation
+
+From: Linyu Yuan <linyyuan@codeaurora.com>
+
+commit 305f670846a31a261462577dd0b967c4fa796871 upstream.
+
+when skb_clone() or skb_copy_expand() fail,
+it should pull skb with lengh indicated by header,
+or not it will read network data and check it as header.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Linyu Yuan <linyyuan@codeaurora.com>
+Link: https://lore.kernel.org/r/20210608233547.3767-1-linyyuan@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_eem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_eem.c
++++ b/drivers/usb/gadget/function/f_eem.c
+@@ -495,7 +495,7 @@ static int eem_unwrap(struct gether *por
+ skb2 = skb_clone(skb, GFP_ATOMIC);
+ if (unlikely(!skb2)) {
+ DBG(cdev, "unable to unframe EEM packet\n");
+- continue;
++ goto next;
+ }
+ skb_trim(skb2, len - ETH_FCS_LEN);
+
+@@ -505,7 +505,7 @@ static int eem_unwrap(struct gether *por
+ GFP_ATOMIC);
+ if (unlikely(!skb3)) {
+ dev_kfree_skb_any(skb2);
+- continue;
++ goto next;
+ }
+ dev_kfree_skb_any(skb2);
+ skb_queue_tail(list, skb3);
--- /dev/null
+From 6fc1db5e6211e30fbb1cee8d7925d79d4ed2ae14 Mon Sep 17 00:00:00 2001
+From: Wesley Cheng <wcheng@codeaurora.org>
+Date: Fri, 21 May 2021 17:44:21 -0700
+Subject: usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind
+
+From: Wesley Cheng <wcheng@codeaurora.org>
+
+commit 6fc1db5e6211e30fbb1cee8d7925d79d4ed2ae14 upstream.
+
+During unbind, ffs_func_eps_disable() will be executed, resulting in
+completion callbacks for any pending USB requests. When using AIO,
+irrespective of the completion status, io_data work is queued to
+io_completion_wq to evaluate and handle the completed requests. Since
+work runs asynchronously to the unbind() routine, there can be a
+scenario where the work runs after the USB gadget has been fully
+removed, resulting in accessing of a resource which has been already
+freed. (i.e. usb_ep_free_request() accessing the USB ep structure)
+
+Explicitly drain the io_completion_wq, instead of relying on the
+destroy_workqueue() (in ffs_data_put()) to make sure no pending
+completion work items are running.
+
+Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/1621644261-1236-1-git-send-email-wcheng@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -3566,6 +3566,9 @@ static void ffs_func_unbind(struct usb_c
+ ffs->func = NULL;
+ }
+
++ /* Drain any pending AIO completions */
++ drain_workqueue(ffs->io_completion_wq);
++
+ if (!--opts->refcnt)
+ functionfs_unbind(ffs);
+
--- /dev/null
+From b65ba0c362be665192381cc59e3ac3ef6f0dd1e1 Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Fri, 28 May 2021 16:04:46 +0200
+Subject: usb: musb: fix MUSB_QUIRK_B_DISCONNECT_99 handling
+
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+
+commit b65ba0c362be665192381cc59e3ac3ef6f0dd1e1 upstream.
+
+In commit 92af4fc6ec33 ("usb: musb: Fix suspend with devices
+connected for a64"), the logic to support the
+MUSB_QUIRK_B_DISCONNECT_99 quirk was modified to only conditionally
+schedule the musb->irq_work delayed work.
+
+This commit badly breaks ECM Gadget on AM335X. Indeed, with this
+commit, one can observe massive packet loss:
+
+$ ping 192.168.0.100
+...
+15 packets transmitted, 3 received, 80% packet loss, time 14316ms
+
+Reverting this commit brings back a properly functioning ECM
+Gadget. An analysis of the commit seems to indicate that a mistake was
+made: the previous code was not falling through into the
+MUSB_QUIRK_B_INVALID_VBUS_91, but now it is, unless the condition is
+taken.
+
+Changing the logic to be as it was before the problematic commit *and*
+only conditionally scheduling musb->irq_work resolves the regression:
+
+$ ping 192.168.0.100
+...
+64 packets transmitted, 64 received, 0% packet loss, time 64475ms
+
+Fixes: 92af4fc6ec33 ("usb: musb: Fix suspend with devices connected for a64")
+Cc: stable@vger.kernel.org
+Tested-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Tested-by: Drew Fustini <drew@beagleboard.org>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Link: https://lore.kernel.org/r/20210528140446.278076-1-thomas.petazzoni@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/musb/musb_core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -2009,9 +2009,8 @@ static void musb_pm_runtime_check_sessio
+ schedule_delayed_work(&musb->irq_work,
+ msecs_to_jiffies(1000));
+ musb->quirk_retries--;
+- break;
+ }
+- fallthrough;
++ break;
+ case MUSB_QUIRK_B_INVALID_VBUS_91:
+ if (musb->quirk_retries && !musb->flush_irq_work) {
+ musb_dbg(musb,
--- /dev/null
+From 6490fa565534fa83593278267785a694fd378a2b Mon Sep 17 00:00:00 2001
+From: Kyle Tso <kyletso@google.com>
+Date: Fri, 28 May 2021 16:16:13 +0800
+Subject: usb: pd: Set PD_T_SINK_WAIT_CAP to 310ms
+
+From: Kyle Tso <kyletso@google.com>
+
+commit 6490fa565534fa83593278267785a694fd378a2b upstream.
+
+Current timer PD_T_SINK_WAIT_CAP is set to 240ms which will violate the
+SinkWaitCapTimer (tTypeCSinkWaitCap 310 - 620 ms) defined in the PD
+Spec if the port is faster enough when running the state machine. Set it
+to the lower bound 310ms to ensure the timeout is in Spec.
+
+Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)")
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Kyle Tso <kyletso@google.com>
+Link: https://lore.kernel.org/r/20210528081613.730661-1-kyletso@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/usb/pd.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/usb/pd.h
++++ b/include/linux/usb/pd.h
+@@ -459,7 +459,7 @@ static inline unsigned int rdo_max_power
+ #define PD_T_RECEIVER_RESPONSE 15 /* 15ms max */
+ #define PD_T_SOURCE_ACTIVITY 45
+ #define PD_T_SINK_ACTIVITY 135
+-#define PD_T_SINK_WAIT_CAP 240
++#define PD_T_SINK_WAIT_CAP 310 /* 310 - 620 ms */
+ #define PD_T_PS_TRANSITION 500
+ #define PD_T_SRC_TRANSITION 35
+ #define PD_T_DRP_SNK 40
--- /dev/null
+From 6f7ec77cc8b64ff5037c1945e4650c65c458037d Mon Sep 17 00:00:00 2001
+From: Stefan Agner <stefan@agner.ch>
+Date: Fri, 28 May 2021 22:39:31 +0200
+Subject: USB: serial: cp210x: fix alternate function for CP2102N QFN20
+
+From: Stefan Agner <stefan@agner.ch>
+
+commit 6f7ec77cc8b64ff5037c1945e4650c65c458037d upstream.
+
+The QFN20 part has a different GPIO/port function assignment. The
+configuration struct bit field ordered as TX/RX/RS485/WAKEUP/CLK
+which exactly matches GPIO0-3 for QFN24/28. However, QFN20 has a
+different GPIO to primary function assignment.
+
+Special case QFN20 to follow to properly detect which GPIOs are
+available.
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Link: https://lore.kernel.org/r/51830b2b24118eb0f77c5c9ac64ffb2f519dbb1d.1622218300.git.stefan@agner.ch
+Fixes: c8acfe0aadbe ("USB: serial: cp210x: implement GPIO support for CP2102N")
+Cc: stable@vger.kernel.org # 4.19
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -533,6 +533,12 @@ struct cp210x_single_port_config {
+ #define CP210X_2NCONFIG_GPIO_RSTLATCH_IDX 587
+ #define CP210X_2NCONFIG_GPIO_CONTROL_IDX 600
+
++/* CP2102N QFN20 port configuration values */
++#define CP2102N_QFN20_GPIO2_TXLED_MODE BIT(2)
++#define CP2102N_QFN20_GPIO3_RXLED_MODE BIT(3)
++#define CP2102N_QFN20_GPIO1_RS485_MODE BIT(4)
++#define CP2102N_QFN20_GPIO0_CLK_MODE BIT(6)
++
+ /* CP210X_VENDOR_SPECIFIC, CP210X_WRITE_LATCH call writes these 0x2 bytes. */
+ struct cp210x_gpio_write {
+ u8 mask;
+@@ -1884,7 +1890,19 @@ static int cp2102n_gpioconf_init(struct
+ priv->gpio_pushpull = (gpio_pushpull >> 3) & 0x0f;
+
+ /* 0 indicates GPIO mode, 1 is alternate function */
+- priv->gpio_altfunc = (gpio_ctrl >> 2) & 0x0f;
++ if (priv->partnum == CP210X_PARTNUM_CP2102N_QFN20) {
++ /* QFN20 is special... */
++ if (gpio_ctrl & CP2102N_QFN20_GPIO0_CLK_MODE) /* GPIO 0 */
++ priv->gpio_altfunc |= BIT(0);
++ if (gpio_ctrl & CP2102N_QFN20_GPIO1_RS485_MODE) /* GPIO 1 */
++ priv->gpio_altfunc |= BIT(1);
++ if (gpio_ctrl & CP2102N_QFN20_GPIO2_TXLED_MODE) /* GPIO 2 */
++ priv->gpio_altfunc |= BIT(2);
++ if (gpio_ctrl & CP2102N_QFN20_GPIO3_RXLED_MODE) /* GPIO 3 */
++ priv->gpio_altfunc |= BIT(3);
++ } else {
++ priv->gpio_altfunc = (gpio_ctrl >> 2) & 0x0f;
++ }
+
+ if (priv->partnum == CP210X_PARTNUM_CP2102N_QFN28) {
+ /*
--- /dev/null
+From bc96c72df33ee81b24d87eab953c73f7bcc04f29 Mon Sep 17 00:00:00 2001
+From: George McCollister <george.mccollister@gmail.com>
+Date: Thu, 3 Jun 2021 19:32:08 -0500
+Subject: USB: serial: ftdi_sio: add NovaTech OrionMX product ID
+
+From: George McCollister <george.mccollister@gmail.com>
+
+commit bc96c72df33ee81b24d87eab953c73f7bcc04f29 upstream.
+
+Add PID for the NovaTech OrionMX so it can be automatically detected.
+
+Signed-off-by: George McCollister <george.mccollister@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -611,6 +611,7 @@ static const struct usb_device_id id_tab
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONMX_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -581,6 +581,7 @@
+ #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
+ #define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */
+ #define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */
++#define FTDI_NT_ORIONMX_PID 0x7c93 /* OrionMX */
+
+ /*
+ * Synapse Wireless product ids (FTDI_VID)
--- /dev/null
+From fc0b3dc9a11771c3919eaaaf9d649138b095aa0f Mon Sep 17 00:00:00 2001
+From: Alexandre GRIVEAUX <agriveaux@deutnet.info>
+Date: Sun, 23 May 2021 18:35:21 +0200
+Subject: USB: serial: omninet: add device id for Zyxel Omni 56K Plus
+
+From: Alexandre GRIVEAUX <agriveaux@deutnet.info>
+
+commit fc0b3dc9a11771c3919eaaaf9d649138b095aa0f upstream.
+
+Add device id for Zyxel Omni 56K Plus modem, this modem include:
+
+USB chip:
+NetChip
+NET2888
+
+Main chip:
+901041A
+F721501APGF
+
+Another modem using the same chips is the Zyxel Omni 56K DUO/NEO,
+could be added with the right USB ID.
+
+Signed-off-by: Alexandre GRIVEAUX <agriveaux@deutnet.info>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/omninet.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/omninet.c
++++ b/drivers/usb/serial/omninet.c
+@@ -26,6 +26,7 @@
+
+ #define ZYXEL_VENDOR_ID 0x0586
+ #define ZYXEL_OMNINET_ID 0x1000
++#define ZYXEL_OMNI_56K_PLUS_ID 0x1500
+ /* This one seems to be a re-branded ZyXEL device */
+ #define BT_IGNITIONPRO_ID 0x2000
+
+@@ -40,6 +41,7 @@ static int omninet_port_remove(struct us
+
+ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(ZYXEL_VENDOR_ID, ZYXEL_OMNINET_ID) },
++ { USB_DEVICE(ZYXEL_VENDOR_ID, ZYXEL_OMNI_56K_PLUS_ID) },
+ { USB_DEVICE(ZYXEL_VENDOR_ID, BT_IGNITIONPRO_ID) },
+ { } /* Terminating entry */
+ };
--- /dev/null
+From eb8dbe80326c3d44c1e38ee4f40e0d8d3e06f2d0 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 24 May 2021 11:17:05 +0200
+Subject: USB: serial: quatech2: fix control-request directions
+
+From: Johan Hovold <johan@kernel.org>
+
+commit eb8dbe80326c3d44c1e38ee4f40e0d8d3e06f2d0 upstream.
+
+The direction of the pipe argument must match the request-type direction
+bit or control requests may fail depending on the host-controller-driver
+implementation.
+
+Fix the three requests which erroneously used usb_rcvctrlpipe().
+
+Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver")
+Cc: stable@vger.kernel.org # 3.5
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/quatech2.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/serial/quatech2.c
++++ b/drivers/usb/serial/quatech2.c
+@@ -416,7 +416,7 @@ static void qt2_close(struct usb_serial_
+
+ /* flush the port transmit buffer */
+ i = usb_control_msg(serial->dev,
+- usb_rcvctrlpipe(serial->dev, 0),
++ usb_sndctrlpipe(serial->dev, 0),
+ QT2_FLUSH_DEVICE, 0x40, 1,
+ port_priv->device_port, NULL, 0, QT2_USB_TIMEOUT);
+
+@@ -426,7 +426,7 @@ static void qt2_close(struct usb_serial_
+
+ /* flush the port receive buffer */
+ i = usb_control_msg(serial->dev,
+- usb_rcvctrlpipe(serial->dev, 0),
++ usb_sndctrlpipe(serial->dev, 0),
+ QT2_FLUSH_DEVICE, 0x40, 0,
+ port_priv->device_port, NULL, 0, QT2_USB_TIMEOUT);
+
+@@ -654,7 +654,7 @@ static int qt2_attach(struct usb_serial
+ int status;
+
+ /* power on unit */
+- status = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
++ status = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+ 0xc2, 0x40, 0x8000, 0, NULL, 0,
+ QT2_USB_TIMEOUT);
+ if (status < 0) {
--- /dev/null
+From 843fabdd7623271330af07f1b7fbd7fabe33c8de Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andy.shevchenko@gmail.com>
+Date: Mon, 7 Jun 2021 23:50:06 +0300
+Subject: usb: typec: intel_pmc_mux: Add missed error check for devm_ioremap_resource()
+
+From: Andy Shevchenko <andy.shevchenko@gmail.com>
+
+commit 843fabdd7623271330af07f1b7fbd7fabe33c8de upstream.
+
+devm_ioremap_resource() can return an error, add missed check for it.
+
+Fixes: 43d596e32276 ("usb: typec: intel_pmc_mux: Check the port status before connect")
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210607205007.71458-2-andy.shevchenko@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/mux/intel_pmc_mux.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/typec/mux/intel_pmc_mux.c
++++ b/drivers/usb/typec/mux/intel_pmc_mux.c
+@@ -573,6 +573,11 @@ static int pmc_usb_probe_iom(struct pmc_
+ return -ENOMEM;
+ }
+
++ if (IS_ERR(pmc->iom_base)) {
++ put_device(&adev->dev);
++ return PTR_ERR(pmc->iom_base);
++ }
++
+ pmc->iom_adev = adev;
+
+ return 0;
--- /dev/null
+From 1a85b350a7741776a406005b943e3dec02c424ed Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andy.shevchenko@gmail.com>
+Date: Mon, 7 Jun 2021 23:50:05 +0300
+Subject: usb: typec: intel_pmc_mux: Put fwnode in error case during ->probe()
+
+From: Andy Shevchenko <andy.shevchenko@gmail.com>
+
+commit 1a85b350a7741776a406005b943e3dec02c424ed upstream.
+
+device_get_next_child_node() bumps a reference counting of a returned variable.
+We have to balance it whenever we return to the caller.
+
+Fixes: 6701adfa9693 ("usb: typec: driver for Intel PMC mux control")
+Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210607205007.71458-1-andy.shevchenko@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/mux/intel_pmc_mux.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/typec/mux/intel_pmc_mux.c
++++ b/drivers/usb/typec/mux/intel_pmc_mux.c
+@@ -623,8 +623,10 @@ static int pmc_usb_probe(struct platform
+ break;
+
+ ret = pmc_usb_register_port(pmc, i, fwnode);
+- if (ret)
++ if (ret) {
++ fwnode_handle_put(fwnode);
+ goto err_remove_ports;
++ }
+ }
+
+ platform_set_drvdata(pdev, pmc);
--- /dev/null
+From 7ade4805e296c8d1e40c842395bbe478c7210555 Mon Sep 17 00:00:00 2001
+From: Li Jun <jun.li@nxp.com>
+Date: Wed, 2 Jun 2021 17:57:08 +0800
+Subject: usb: typec: tcpm: cancel frs hrtimer when unregister tcpm port
+
+From: Li Jun <jun.li@nxp.com>
+
+commit 7ade4805e296c8d1e40c842395bbe478c7210555 upstream.
+
+Like the state_machine_timer, we should also cancel possible pending
+frs hrtimer when unregister tcpm port.
+
+Fixes: 8dc4bd073663 ("usb: typec: tcpm: Add support for Sink Fast Role SWAP(FRS)")
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Li Jun <jun.li@nxp.com>
+Link: https://lore.kernel.org/r/1622627829-11070-2-git-send-email-jun.li@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -5187,6 +5187,7 @@ void tcpm_unregister_port(struct tcpm_po
+ {
+ int i;
+
++ hrtimer_cancel(&port->enable_frs_timer);
+ hrtimer_cancel(&port->vdm_state_machine_timer);
+ hrtimer_cancel(&port->state_machine_timer);
+
--- /dev/null
+From 3a13ff7ef4349d70d1d18378d661117dd5af8efe Mon Sep 17 00:00:00 2001
+From: Li Jun <jun.li@nxp.com>
+Date: Wed, 2 Jun 2021 17:57:07 +0800
+Subject: usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port
+
+From: Li Jun <jun.li@nxp.com>
+
+commit 3a13ff7ef4349d70d1d18378d661117dd5af8efe upstream.
+
+A pending hrtimer may expire after the kthread_worker of tcpm port
+is destroyed, see below kernel dump when do module unload, fix it
+by cancel the 2 hrtimers.
+
+[ 111.517018] Unable to handle kernel paging request at virtual address ffff8000118cb880
+[ 111.518786] blk_update_request: I/O error, dev sda, sector 60061185 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
+[ 111.526594] Mem abort info:
+[ 111.526597] ESR = 0x96000047
+[ 111.526600] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 111.526604] SET = 0, FnV = 0
+[ 111.526607] EA = 0, S1PTW = 0
+[ 111.526610] Data abort info:
+[ 111.526612] ISV = 0, ISS = 0x00000047
+[ 111.526615] CM = 0, WnR = 1
+[ 111.526619] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041d75000
+[ 111.526623] [ffff8000118cb880] pgd=10000001bffff003, p4d=10000001bffff003, pud=10000001bfffe003, pmd=10000001bfffa003, pte=0000000000000000
+[ 111.526642] Internal error: Oops: 96000047 [#1] PREEMPT SMP
+[ 111.526647] Modules linked in: dwc3_imx8mp dwc3 phy_fsl_imx8mq_usb [last unloaded: tcpci]
+[ 111.526663] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc4-00927-gebbe9dbd802c-dirty #36
+[ 111.526670] Hardware name: NXP i.MX8MPlus EVK board (DT)
+[ 111.526674] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO BTYPE=--)
+[ 111.526681] pc : queued_spin_lock_slowpath+0x1a0/0x390
+[ 111.526695] lr : _raw_spin_lock_irqsave+0x88/0xb4
+[ 111.526703] sp : ffff800010003e20
+[ 111.526706] x29: ffff800010003e20 x28: ffff00017f380180
+[ 111.537156] buffer_io_error: 6 callbacks suppressed
+[ 111.537162] Buffer I/O error on dev sda1, logical block 60040704, async page read
+[ 111.539932] x27: ffff00017f3801c0
+[ 111.539938] x26: ffff800010ba2490 x25: 0000000000000000 x24: 0000000000000001
+[ 111.543025] blk_update_request: I/O error, dev sda, sector 60061186 op 0x0:(READ) flags 0x0 phys_seg 7 prio class 0
+[ 111.548304]
+[ 111.548306] x23: 00000000000000c0 x22: ffff0000c2a9f184 x21: ffff00017f380180
+[ 111.551374] Buffer I/O error on dev sda1, logical block 60040705, async page read
+[ 111.554499]
+[ 111.554503] x20: ffff0000c5f14210 x19: 00000000000000c0 x18: 0000000000000000
+[ 111.557391] Buffer I/O error on dev sda1, logical block 60040706, async page read
+[ 111.561218]
+[ 111.561222] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
+[ 111.564205] Buffer I/O error on dev sda1, logical block 60040707, async page read
+[ 111.570887] x14: 00000000000000f5 x13: 0000000000000001 x12: 0000000000000040
+[ 111.570902] x11: ffff0000c05ac6d8
+[ 111.583420] Buffer I/O error on dev sda1, logical block 60040708, async page read
+[ 111.588978] x10: 0000000000000000 x9 : 0000000000040000
+[ 111.588988] x8 : 0000000000000000
+[ 111.597173] Buffer I/O error on dev sda1, logical block 60040709, async page read
+[ 111.605766] x7 : ffff00017f384880 x6 : ffff8000118cb880
+[ 111.605777] x5 : ffff00017f384880
+[ 111.611094] Buffer I/O error on dev sda1, logical block 60040710, async page read
+[ 111.617086] x4 : 0000000000000000 x3 : ffff0000c2a9f184
+[ 111.617096] x2 : ffff8000118cb880
+[ 111.622242] Buffer I/O error on dev sda1, logical block 60040711, async page read
+[ 111.626927] x1 : ffff8000118cb880 x0 : ffff00017f384888
+[ 111.626938] Call trace:
+[ 111.626942] queued_spin_lock_slowpath+0x1a0/0x390
+[ 111.795809] kthread_queue_work+0x30/0xc0
+[ 111.799828] state_machine_timer_handler+0x20/0x30
+[ 111.804624] __hrtimer_run_queues+0x140/0x1e0
+[ 111.808990] hrtimer_interrupt+0xec/0x2c0
+[ 111.813004] arch_timer_handler_phys+0x38/0x50
+[ 111.817456] handle_percpu_devid_irq+0x88/0x150
+[ 111.821991] __handle_domain_irq+0x80/0xe0
+[ 111.826093] gic_handle_irq+0xc0/0x140
+[ 111.829848] el1_irq+0xbc/0x154
+[ 111.832991] arch_cpu_idle+0x1c/0x2c
+[ 111.836572] default_idle_call+0x24/0x6c
+[ 111.840497] do_idle+0x238/0x2ac
+[ 111.843729] cpu_startup_entry+0x2c/0x70
+[ 111.847657] rest_init+0xdc/0xec
+[ 111.850890] arch_call_rest_init+0x14/0x20
+[ 111.854988] start_kernel+0x508/0x540
+[ 111.858659] Code: 910020e0 8b0200c2 f861d884 aa0203e1 (f8246827)
+[ 111.864760] ---[ end trace 308b9a4a3dcb73ac ]---
+[ 111.869381] Kernel panic - not syncing: Oops: Fatal exception in interrupt
+[ 111.876258] SMP: stopping secondary CPUs
+[ 111.880185] Kernel Offset: disabled
+[ 111.883673] CPU features: 0x00001001,20000846
+[ 111.888031] Memory Limit: none
+[ 111.891090] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---
+
+Fixes: 3ed8e1c2ac99 ("usb: typec: tcpm: Migrate workqueue to RT priority for processing events")
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Li Jun <jun.li@nxp.com>
+Link: https://lore.kernel.org/r/1622627829-11070-1-git-send-email-jun.li@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -5187,6 +5187,9 @@ void tcpm_unregister_port(struct tcpm_po
+ {
+ int i;
+
++ hrtimer_cancel(&port->vdm_state_machine_timer);
++ hrtimer_cancel(&port->state_machine_timer);
++
+ tcpm_reset_port(port);
+ for (i = 0; i < ARRAY_SIZE(port->port_altmode); i++)
+ typec_unregister_altmode(port->port_altmode[i]);
--- /dev/null
+From f247f0a82a4f8c3bfed178d8fd9e069d1424ee4e Mon Sep 17 00:00:00 2001
+From: Mayank Rana <mrana@codeaurora.org>
+Date: Wed, 9 Jun 2021 00:35:35 -0700
+Subject: usb: typec: ucsi: Clear PPM capability data in ucsi_init() error path
+
+From: Mayank Rana <mrana@codeaurora.org>
+
+commit f247f0a82a4f8c3bfed178d8fd9e069d1424ee4e upstream.
+
+If ucsi_init() fails for some reason (e.g. ucsi_register_port()
+fails or general communication failure to the PPM), particularly at
+any point after the GET_CAPABILITY command had been issued, this
+results in unwinding the initialization and returning an error.
+However the ucsi structure's ucsi_capability member retains its
+current value, including likely a non-zero num_connectors.
+And because ucsi_init() itself is done in a workqueue a UCSI
+interface driver will be unaware that it failed and may think the
+ucsi_register() call was completely successful. Later, if
+ucsi_unregister() is called, due to this stale ucsi->cap value it
+would try to access the items in the ucsi->connector array which
+might not be in a proper state or not even allocated at all and
+results in NULL or invalid pointer dereference.
+
+Fix this by clearing the ucsi->cap value to 0 during the error
+path of ucsi_init() in order to prevent a later ucsi_unregister()
+from entering the connector cleanup loop.
+
+Fixes: c1b0bc2dabfa ("usb: typec: Add support for UCSI interface")
+Cc: stable@vger.kernel.org
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Mayank Rana <mrana@codeaurora.org>
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Link: https://lore.kernel.org/r/20210609073535.5094-1-jackp@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -1118,6 +1118,7 @@ err_unregister:
+ }
+
+ err_reset:
++ memset(&ucsi->cap, 0, sizeof(ucsi->cap));
+ ucsi_reset_ppm(ucsi);
+ err:
+ return ret;
--- /dev/null
+From d5ab95da2a41567440097c277c5771ad13928dad Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Wed, 9 Jun 2021 20:22:02 +0300
+Subject: usb: typec: wcove: Use LE to CPU conversion when accessing msg->header
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit d5ab95da2a41567440097c277c5771ad13928dad upstream.
+
+As LKP noticed the Sparse is not happy about strict type handling:
+ .../typec/tcpm/wcove.c:380:50: sparse: expected unsigned short [usertype] header
+ .../typec/tcpm/wcove.c:380:50: sparse: got restricted __le16 const [usertype] header
+
+Fix this by switching to use pd_header_cnt_le() instead of pd_header_cnt()
+in the affected code.
+
+Fixes: ae8a2ca8a221 ("usb: typec: Group all TCPCI/TCPM code together")
+Fixes: 3c4fb9f16921 ("usb: typec: wcove: start using tcpm for USB PD support")
+Reported-by: kernel test robot <lkp@intel.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210609172202.83377-1-andriy.shevchenko@linux.intel.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/wcove.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/typec/tcpm/wcove.c
++++ b/drivers/usb/typec/tcpm/wcove.c
+@@ -377,7 +377,7 @@ static int wcove_pd_transmit(struct tcpc
+ const u8 *data = (void *)msg;
+ int i;
+
+- for (i = 0; i < pd_header_cnt(msg->header) * 4 + 2; i++) {
++ for (i = 0; i < pd_header_cnt_le(msg->header) * 4 + 2; i++) {
+ ret = regmap_write(wcove->regmap, USBC_TX_DATA + i,
+ data[i]);
+ if (ret)
projects / thirdparty / kernel / stable-queue.git / commitdiff
