From 0e1aca53fc9c35d3cf6a0b9cbc5ca05584ad4253 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 30 May 2021 16:40:32 -0400 Subject: [PATCH] Fixes for 4.9 Signed-off-by: Sasha Levin --- ...omment-note-regarding-an-unused-poin.patch | 45 +++++++++ ...ror-code-in-ath6kl_wmi_set_roam_lrss.patch | 61 ++++++++++++ ...s-do-not-bug_on-in-link_to_fixup_dir.patch | 76 ++++++++++++++ ...pet-add-checks-after-calling-ioremap.patch | 46 +++++++++ ...idma-comment-platform_driver_registe.patch | 52 ++++++++++ .../drm-amdgpu-fix-a-use-after-free.patch | 52 ++++++++++ ...on-check-cleanup-ioremap-failure-cor.patch | 99 +++++++++++++++++++ ...ertas-register-sysfs-groups-properly.patch | 94 ++++++++++++++++++ ...b-add-check-on-sp8870_readreg-return.patch | 40 ++++++++ ...9m111-check-write_bridge-for-timeout.patch | 58 +++++++++++ ...erly-check-for-errors-in-po1030_prob.patch | 52 ++++++++++ ...-remove-bug_on-dev-null-in-caif_xmit.patch | 80 +++++++++++++++ ...fujitsu-fix-potential-null-ptr-deref.patch | 42 ++++++++ .../openrisc-define-memory-barrier-mb.patch | 48 +++++++++ ...accel-avoid-invoking-_ini-to-speed-u.patch | 95 ++++++++++++++++++ ...el_punit_ipc-append-module_device_ta.patch | 38 +++++++ ...x-64-bit-system-enumeration-error-fo.patch | 65 ++++++++++++ ...nregister-uart-driver-in-case-of-fai.patch | 49 +++++++++ queue-4.9/series | 18 ++++ 19 files changed, 1110 insertions(+) create mode 100644 queue-4.9/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch create mode 100644 queue-4.9/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch create mode 100644 queue-4.9/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch create mode 100644 queue-4.9/char-hpet-add-checks-after-calling-ioremap.patch create mode 100644 queue-4.9/dmaengine-qcom_hidma-comment-platform_driver_registe.patch create mode 100644 queue-4.9/drm-amdgpu-fix-a-use-after-free.patch create mode 100644 queue-4.9/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch create mode 100644 queue-4.9/libertas-register-sysfs-groups-properly.patch create mode 100644 queue-4.9/media-dvb-add-check-on-sp8870_readreg-return.patch create mode 100644 queue-4.9/media-gspca-mt9m111-check-write_bridge-for-timeout.patch create mode 100644 queue-4.9/media-gspca-properly-check-for-errors-in-po1030_prob.patch create mode 100644 queue-4.9/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch create mode 100644 queue-4.9/net-fujitsu-fix-potential-null-ptr-deref.patch create mode 100644 queue-4.9/openrisc-define-memory-barrier-mb.patch create mode 100644 queue-4.9/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch create mode 100644 queue-4.9/platform-x86-intel_punit_ipc-append-module_device_ta.patch create mode 100644 queue-4.9/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch create mode 100644 queue-4.9/serial-max310x-unregister-uart-driver-in-case-of-fai.patch diff --git a/queue-4.9/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch b/queue-4.9/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch new file mode 100644 index 00000000000..3ad0326136e --- /dev/null +++ b/queue-4.9/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch @@ -0,0 +1,45 @@ +From 25c7a22d62833b82a91f50224e110ac29e697faf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:02 +0200 +Subject: ALSA: sb8: Add a comment note regarding an unused pointer + +From: Atul Gopinathan + +[ Upstream commit a28591f61b60fac820c6de59826ffa710e5e314e ] + +The field "fm_res" of "struct snd_sb8" is never used/dereferenced +throughout the sb8.c code. Therefore there is no need for any null value +check after the "request_region()". + +Add a comment note to make developers know about this and prevent any +"NULL check" patches on this part of code. + +Cc: Takashi Iwai +Signed-off-by: Atul Gopinathan +Link: https://lore.kernel.org/r/20210503115736.2104747-36-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + sound/isa/sb/sb8.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c +index ad42d2364199..ca4350bd24d1 100644 +--- a/sound/isa/sb/sb8.c ++++ b/sound/isa/sb/sb8.c +@@ -109,7 +109,11 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev) + acard = card->private_data; + card->private_free = snd_sb8_free; + +- /* block the 0x388 port to avoid PnP conflicts */ ++ /* ++ * Block the 0x388 port to avoid PnP conflicts. ++ * No need to check this value after request_region, ++ * as we never do anything with it. ++ */ + acard->fm_res = request_region(0x388, 4, "SoundBlaster FM"); + + if (port[dev] != SNDRV_AUTO_PORT) { +-- +2.30.2 + diff --git a/queue-4.9/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch b/queue-4.9/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch new file mode 100644 index 00000000000..9b46b12353c --- /dev/null +++ b/queue-4.9/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch @@ -0,0 +1,61 @@ +From 90b9c53311021ecbcfefa482628b3df30f45eec4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:10 +0200 +Subject: ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() + +From: Anirudh Rayabharam + +[ Upstream commit fc6a6521556c8250e356ddc6a3f2391aa62dc976 ] + +ath6kl_wmi_cmd_send could fail, so let's return its error code upstream. + +Signed-off-by: Kangjie Lu +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/debug.c | 5 ++++- + drivers/net/wireless/ath/ath6kl/wmi.c | 4 +--- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c +index e2b7809d7886..f3a786af7ece 100644 +--- a/drivers/net/wireless/ath/ath6kl/debug.c ++++ b/drivers/net/wireless/ath/ath6kl/debug.c +@@ -1027,14 +1027,17 @@ static ssize_t ath6kl_lrssi_roam_write(struct file *file, + { + struct ath6kl *ar = file->private_data; + unsigned long lrssi_roam_threshold; ++ int ret; + + if (kstrtoul_from_user(user_buf, count, 0, &lrssi_roam_threshold)) + return -EINVAL; + + ar->lrssi_roam_threshold = lrssi_roam_threshold; + +- ath6kl_wmi_set_roam_lrssi_cmd(ar->wmi, ar->lrssi_roam_threshold); ++ ret = ath6kl_wmi_set_roam_lrssi_cmd(ar->wmi, ar->lrssi_roam_threshold); + ++ if (ret) ++ return ret; + return count; + } + +diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c +index 73eab12cb3bd..1d6726744949 100644 +--- a/drivers/net/wireless/ath/ath6kl/wmi.c ++++ b/drivers/net/wireless/ath/ath6kl/wmi.c +@@ -776,10 +776,8 @@ int ath6kl_wmi_set_roam_lrssi_cmd(struct wmi *wmi, u8 lrssi) + cmd->info.params.roam_rssi_floor = DEF_LRSSI_ROAM_FLOOR; + cmd->roam_ctrl = WMI_SET_LRSSI_SCAN_PARAMS; + +- ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID, ++ return ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID, + NO_SYNC_WMIFLAG); +- +- return 0; + } + + int ath6kl_wmi_force_roam_cmd(struct wmi *wmi, const u8 *bssid) +-- +2.30.2 + diff --git a/queue-4.9/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch b/queue-4.9/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch new file mode 100644 index 00000000000..1a662d07674 --- /dev/null +++ b/queue-4.9/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch @@ -0,0 +1,76 @@ +From e4c7656e2b3b411ee2df0513a420d0d99abf230f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 10:56:16 -0400 +Subject: btrfs: do not BUG_ON in link_to_fixup_dir + +From: Josef Bacik + +[ Upstream commit 91df99a6eb50d5a1bc70fff4a09a0b7ae6aab96d ] + +While doing error injection testing I got the following panic + + kernel BUG at fs/btrfs/tree-log.c:1862! + invalid opcode: 0000 [#1] SMP NOPTI + CPU: 1 PID: 7836 Comm: mount Not tainted 5.13.0-rc1+ #305 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 + RIP: 0010:link_to_fixup_dir+0xd5/0xe0 + RSP: 0018:ffffb5800180fa30 EFLAGS: 00010216 + RAX: fffffffffffffffb RBX: 00000000fffffffb RCX: ffff8f595287faf0 + RDX: ffffb5800180fa37 RSI: ffff8f5954978800 RDI: 0000000000000000 + RBP: ffff8f5953af9450 R08: 0000000000000019 R09: 0000000000000001 + R10: 000151f408682970 R11: 0000000120021001 R12: ffff8f5954978800 + R13: ffff8f595287faf0 R14: ffff8f5953c77dd0 R15: 0000000000000065 + FS: 00007fc5284c8c40(0000) GS:ffff8f59bbd00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007fc5287f47c0 CR3: 000000011275e002 CR4: 0000000000370ee0 + Call Trace: + replay_one_buffer+0x409/0x470 + ? btree_read_extent_buffer_pages+0xd0/0x110 + walk_up_log_tree+0x157/0x1e0 + walk_log_tree+0xa6/0x1d0 + btrfs_recover_log_trees+0x1da/0x360 + ? replay_one_extent+0x7b0/0x7b0 + open_ctree+0x1486/0x1720 + btrfs_mount_root.cold+0x12/0xea + ? __kmalloc_track_caller+0x12f/0x240 + legacy_get_tree+0x24/0x40 + vfs_get_tree+0x22/0xb0 + vfs_kern_mount.part.0+0x71/0xb0 + btrfs_mount+0x10d/0x380 + ? vfs_parse_fs_string+0x4d/0x90 + legacy_get_tree+0x24/0x40 + vfs_get_tree+0x22/0xb0 + path_mount+0x433/0xa10 + __x64_sys_mount+0xe3/0x120 + do_syscall_64+0x3d/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +We can get -EIO or any number of legitimate errors from +btrfs_search_slot(), panicing here is not the appropriate response. The +error path for this code handles errors properly, simply return the +error. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/tree-log.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 9909b63d2acd..5c86fecaf167 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -1600,8 +1600,6 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans, + ret = btrfs_update_inode(trans, root, inode); + } else if (ret == -EEXIST) { + ret = 0; +- } else { +- BUG(); /* Logic Error */ + } + iput(inode); + +-- +2.30.2 + diff --git a/queue-4.9/char-hpet-add-checks-after-calling-ioremap.patch b/queue-4.9/char-hpet-add-checks-after-calling-ioremap.patch new file mode 100644 index 00000000000..0c1eb396f1e --- /dev/null +++ b/queue-4.9/char-hpet-add-checks-after-calling-ioremap.patch @@ -0,0 +1,46 @@ +From 8aac8c4ae6d19f34359423d308f0a7b73a543164 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:56 +0200 +Subject: char: hpet: add checks after calling ioremap + +From: Tom Seewald + +[ Upstream commit b11701c933112d49b808dee01cb7ff854ba6a77a ] + +The function hpet_resources() calls ioremap() two times, but in both +cases it does not check if ioremap() returned a null pointer. Fix this +by adding null pointer checks and returning an appropriate error. + +Signed-off-by: Tom Seewald +Link: https://lore.kernel.org/r/20210503115736.2104747-30-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/hpet.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c +index bedfd2412ec1..7975ddd40b35 100644 +--- a/drivers/char/hpet.c ++++ b/drivers/char/hpet.c +@@ -976,6 +976,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data) + if (ACPI_SUCCESS(status)) { + hdp->hd_phys_address = addr.address.minimum; + hdp->hd_address = ioremap(addr.address.minimum, addr.address.address_length); ++ if (!hdp->hd_address) ++ return AE_ERROR; + + if (hpet_is_known(hdp)) { + iounmap(hdp->hd_address); +@@ -989,6 +991,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data) + hdp->hd_phys_address = fixmem32->address; + hdp->hd_address = ioremap(fixmem32->address, + HPET_RANGE_SIZE); ++ if (!hdp->hd_address) ++ return AE_ERROR; + + if (hpet_is_known(hdp)) { + iounmap(hdp->hd_address); +-- +2.30.2 + diff --git a/queue-4.9/dmaengine-qcom_hidma-comment-platform_driver_registe.patch b/queue-4.9/dmaengine-qcom_hidma-comment-platform_driver_registe.patch new file mode 100644 index 00000000000..31de7354a5a --- /dev/null +++ b/queue-4.9/dmaengine-qcom_hidma-comment-platform_driver_registe.patch @@ -0,0 +1,52 @@ +From 01b0b9a7cd4b8c990cfbf021a224ab37ce9678ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:18 +0200 +Subject: dmaengine: qcom_hidma: comment platform_driver_register call + +From: Phillip Potter + +[ Upstream commit 4df2a8b0ad634d98a67e540a4e18a60f943e7d9f ] + +Place a comment in hidma_mgmt_init explaining why success must +currently be assumed, due to the cleanup issue that would need to +be considered were this module ever to be unloadable or were this +platform_driver_register call ever to fail. + +Acked-By: Vinod Koul +Acked-By: Sinan Kaya +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20210503115736.2104747-52-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/dma/qcom/hidma_mgmt.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/dma/qcom/hidma_mgmt.c b/drivers/dma/qcom/hidma_mgmt.c +index 82f36e466083..143ea7cad756 100644 +--- a/drivers/dma/qcom/hidma_mgmt.c ++++ b/drivers/dma/qcom/hidma_mgmt.c +@@ -398,6 +398,20 @@ static int __init hidma_mgmt_init(void) + of_node_put(child); + } + #endif ++ /* ++ * We do not check for return value here, as it is assumed that ++ * platform_driver_register must not fail. The reason for this is that ++ * the (potential) hidma_mgmt_of_populate_channels calls above are not ++ * cleaned up if it does fail, and to do this work is quite ++ * complicated. In particular, various calls of of_address_to_resource, ++ * of_irq_to_resource, platform_device_register_full, of_dma_configure, ++ * and of_msi_configure which then call other functions and so on, must ++ * be cleaned up - this is not a trivial exercise. ++ * ++ * Currently, this module is not intended to be unloaded, and there is ++ * no module_exit function defined which does the needed cleanup. For ++ * this reason, we have to assume success here. ++ */ + platform_driver_register(&hidma_mgmt_driver); + + return 0; +-- +2.30.2 + diff --git a/queue-4.9/drm-amdgpu-fix-a-use-after-free.patch b/queue-4.9/drm-amdgpu-fix-a-use-after-free.patch new file mode 100644 index 00000000000..d6a450c6a5b --- /dev/null +++ b/queue-4.9/drm-amdgpu-fix-a-use-after-free.patch @@ -0,0 +1,52 @@ +From c47273c702f75206d5c4d7b1eef18c4678a3a5a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 10:56:07 +0800 +Subject: drm/amdgpu: Fix a use-after-free +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: xinhui pan + +[ Upstream commit 1e5c37385097c35911b0f8a0c67ffd10ee1af9a2 ] + +looks like we forget to set ttm->sg to NULL. +Hit panic below + +[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI +[ 1235.989074] Call Trace: +[ 1235.991751] sg_free_table+0x17/0x20 +[ 1235.995667] amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu] +[ 1236.002288] amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu] +[ 1236.008464] ttm_tt_destroy+0x1e/0x30 [ttm] +[ 1236.013066] ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm] +[ 1236.018783] ttm_bo_release+0x262/0xa50 [ttm] +[ 1236.023547] ttm_bo_put+0x82/0xd0 [ttm] +[ 1236.027766] amdgpu_bo_unref+0x26/0x50 [amdgpu] +[ 1236.032809] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu] +[ 1236.040400] kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu] +[ 1236.046912] kfd_ioctl+0x463/0x690 [amdgpu] + +Signed-off-by: xinhui pan +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index 7271e3f32d82..ab041ae58b20 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -886,6 +886,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm) + + if (gtt && gtt->userptr) { + kfree(ttm->sg); ++ ttm->sg = NULL; + ttm->page_flags &= ~TTM_PAGE_FLAG_SG; + return; + } +-- +2.30.2 + diff --git a/queue-4.9/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch b/queue-4.9/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch new file mode 100644 index 00000000000..3b7aac4e2f5 --- /dev/null +++ b/queue-4.9/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch @@ -0,0 +1,99 @@ +From cea9b7296ac804b1f9988a625574f08361257b22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:08 +0200 +Subject: isdn: mISDNinfineon: check/cleanup ioremap failure correctly in + setup_io + +From: Phillip Potter + +[ Upstream commit c446f0d4702d316e1c6bf621f70e79678d28830a ] + +Move hw->cfg.mode and hw->addr.mode assignments from hw->ci->cfg_mode +and hw->ci->addr_mode respectively, to be before the subsequent checks +for memory IO mode (and possible ioremap calls in this case). + +Also introduce ioremap error checks at both locations. This allows +resources to be properly freed on ioremap failure, as when the caller +of setup_io then subsequently calls release_io via its error path, +release_io can now correctly determine the mode as it has been set +before the ioremap call. + +Finally, refactor release_io function so that it will call +release_mem_region in the memory IO case, regardless of whether or not +hw->cfg.p/hw->addr.p are NULL. This means resources are then properly +released on failure. + +This properly implements the original reverted commit (d721fe99f6ad) +from the University of Minnesota, whilst also implementing the ioremap +check for the hw->ci->cfg_mode if block as well. + +Cc: David S. Miller +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20210503115736.2104747-42-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/mISDNinfineon.c | 24 ++++++++++++++------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/isdn/hardware/mISDN/mISDNinfineon.c b/drivers/isdn/hardware/mISDN/mISDNinfineon.c +index d5bdbaf93a1a..d0b6377b9834 100644 +--- a/drivers/isdn/hardware/mISDN/mISDNinfineon.c ++++ b/drivers/isdn/hardware/mISDN/mISDNinfineon.c +@@ -645,17 +645,19 @@ static void + release_io(struct inf_hw *hw) + { + if (hw->cfg.mode) { +- if (hw->cfg.p) { ++ if (hw->cfg.mode == AM_MEMIO) { + release_mem_region(hw->cfg.start, hw->cfg.size); +- iounmap(hw->cfg.p); ++ if (hw->cfg.p) ++ iounmap(hw->cfg.p); + } else + release_region(hw->cfg.start, hw->cfg.size); + hw->cfg.mode = AM_NONE; + } + if (hw->addr.mode) { +- if (hw->addr.p) { ++ if (hw->addr.mode == AM_MEMIO) { + release_mem_region(hw->addr.start, hw->addr.size); +- iounmap(hw->addr.p); ++ if (hw->addr.p) ++ iounmap(hw->addr.p); + } else + release_region(hw->addr.start, hw->addr.size); + hw->addr.mode = AM_NONE; +@@ -685,9 +687,12 @@ setup_io(struct inf_hw *hw) + (ulong)hw->cfg.start, (ulong)hw->cfg.size); + return err; + } +- if (hw->ci->cfg_mode == AM_MEMIO) +- hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size); + hw->cfg.mode = hw->ci->cfg_mode; ++ if (hw->ci->cfg_mode == AM_MEMIO) { ++ hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size); ++ if (!hw->cfg.p) ++ return -ENOMEM; ++ } + if (debug & DEBUG_HW) + pr_notice("%s: IO cfg %lx (%lu bytes) mode%d\n", + hw->name, (ulong)hw->cfg.start, +@@ -712,9 +717,12 @@ setup_io(struct inf_hw *hw) + (ulong)hw->addr.start, (ulong)hw->addr.size); + return err; + } +- if (hw->ci->addr_mode == AM_MEMIO) +- hw->addr.p = ioremap(hw->addr.start, hw->addr.size); + hw->addr.mode = hw->ci->addr_mode; ++ if (hw->ci->addr_mode == AM_MEMIO) { ++ hw->addr.p = ioremap(hw->addr.start, hw->addr.size); ++ if (!hw->addr.p) ++ return -ENOMEM; ++ } + if (debug & DEBUG_HW) + pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n", + hw->name, (ulong)hw->addr.start, +-- +2.30.2 + diff --git a/queue-4.9/libertas-register-sysfs-groups-properly.patch b/queue-4.9/libertas-register-sysfs-groups-properly.patch new file mode 100644 index 00000000000..5df64cd4bdb --- /dev/null +++ b/queue-4.9/libertas-register-sysfs-groups-properly.patch @@ -0,0 +1,94 @@ +From 0a51c7438db6256020e766f3b98df45c6c9595d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:20 +0200 +Subject: libertas: register sysfs groups properly + +From: Greg Kroah-Hartman + +[ Upstream commit 7e79b38fe9a403b065ac5915465f620a8fb3de84 ] + +The libertas driver was trying to register sysfs groups "by hand" which +causes them to be created _after_ the device is initialized and +announced to userspace, which causes races and can prevent userspace +tools from seeing the sysfs files correctly. + +Fix this up by using the built-in sysfs_groups pointers in struct +net_device which were created for this very reason, fixing the race +condition, and properly allowing for any error that might have occured +to be handled properly. + +Cc: Kalle Valo +Link: https://lore.kernel.org/r/20210503115736.2104747-54-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/mesh.c | 28 +++----------------- + 1 file changed, 4 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/wireless/marvell/libertas/mesh.c b/drivers/net/wireless/marvell/libertas/mesh.c +index d0c881dd5846..f1e9cbcfdc16 100644 +--- a/drivers/net/wireless/marvell/libertas/mesh.c ++++ b/drivers/net/wireless/marvell/libertas/mesh.c +@@ -797,19 +797,6 @@ static const struct attribute_group mesh_ie_group = { + .attrs = mesh_ie_attrs, + }; + +-static void lbs_persist_config_init(struct net_device *dev) +-{ +- int ret; +- ret = sysfs_create_group(&(dev->dev.kobj), &boot_opts_group); +- ret = sysfs_create_group(&(dev->dev.kobj), &mesh_ie_group); +-} +- +-static void lbs_persist_config_remove(struct net_device *dev) +-{ +- sysfs_remove_group(&(dev->dev.kobj), &boot_opts_group); +- sysfs_remove_group(&(dev->dev.kobj), &mesh_ie_group); +-} +- + + /*************************************************************************** + * Initializing and starting, stopping mesh +@@ -1021,6 +1008,10 @@ static int lbs_add_mesh(struct lbs_private *priv) + SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent); + + mesh_dev->flags |= IFF_BROADCAST | IFF_MULTICAST; ++ mesh_dev->sysfs_groups[0] = &lbs_mesh_attr_group; ++ mesh_dev->sysfs_groups[1] = &boot_opts_group; ++ mesh_dev->sysfs_groups[2] = &mesh_ie_group; ++ + /* Register virtual mesh interface */ + ret = register_netdev(mesh_dev); + if (ret) { +@@ -1028,19 +1019,10 @@ static int lbs_add_mesh(struct lbs_private *priv) + goto err_free_netdev; + } + +- ret = sysfs_create_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group); +- if (ret) +- goto err_unregister; +- +- lbs_persist_config_init(mesh_dev); +- + /* Everything successful */ + ret = 0; + goto done; + +-err_unregister: +- unregister_netdev(mesh_dev); +- + err_free_netdev: + free_netdev(mesh_dev); + +@@ -1063,8 +1045,6 @@ void lbs_remove_mesh(struct lbs_private *priv) + lbs_deb_enter(LBS_DEB_MESH); + netif_stop_queue(mesh_dev); + netif_carrier_off(mesh_dev); +- sysfs_remove_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group); +- lbs_persist_config_remove(mesh_dev); + unregister_netdev(mesh_dev); + priv->mesh_dev = NULL; + kfree(mesh_dev->ieee80211_ptr); +-- +2.30.2 + diff --git a/queue-4.9/media-dvb-add-check-on-sp8870_readreg-return.patch b/queue-4.9/media-dvb-add-check-on-sp8870_readreg-return.patch new file mode 100644 index 00000000000..b58877dbee6 --- /dev/null +++ b/queue-4.9/media-dvb-add-check-on-sp8870_readreg-return.patch @@ -0,0 +1,40 @@ +From 9a63735a406b7e990a6e2436ccafa4c3a8e7ff4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:26 +0200 +Subject: media: dvb: Add check on sp8870_readreg return + +From: Alaa Emad + +[ Upstream commit c6d822c56e7fd29e6fa1b1bb91b98f6a1e942b3c ] + +The function sp8870_readreg returns a negative value when i2c_transfer +fails so properly check for this and return the error if it happens. + +Cc: Sean Young +Cc: Mauro Carvalho Chehab +Signed-off-by: Alaa Emad +Link: https://lore.kernel.org/r/20210503115736.2104747-60-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/sp8870.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-frontends/sp8870.c b/drivers/media/dvb-frontends/sp8870.c +index e87ac30d7fb8..b43135c5a960 100644 +--- a/drivers/media/dvb-frontends/sp8870.c ++++ b/drivers/media/dvb-frontends/sp8870.c +@@ -293,7 +293,9 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe) + sp8870_writereg(state, 0xc05, reg0xc05); + + // read status reg in order to clear pending irqs +- sp8870_readreg(state, 0x200); ++ err = sp8870_readreg(state, 0x200); ++ if (err < 0) ++ return err; + + // system controller start + sp8870_microcontroller_start(state); +-- +2.30.2 + diff --git a/queue-4.9/media-gspca-mt9m111-check-write_bridge-for-timeout.patch b/queue-4.9/media-gspca-mt9m111-check-write_bridge-for-timeout.patch new file mode 100644 index 00000000000..ed65d62b091 --- /dev/null +++ b/queue-4.9/media-gspca-mt9m111-check-write_bridge-for-timeout.patch @@ -0,0 +1,58 @@ +From d4ca5b8144fe12fb36124819a02abb386cd5df78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:28 +0200 +Subject: media: gspca: mt9m111: Check write_bridge for timeout + +From: Alaa Emad + +[ Upstream commit 656025850074f5c1ba2e05be37bda57ba2b8d491 ] + +In mt9m111_probe, m5602_write_bridge can timeout and return a negative +error value. The fix checks for this error and passes it upstream. + +Signed-off-by: Aditya Pakki +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/m5602/m5602_mt9m111.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c +index 7d01ddd7ed01..da17c384e64d 100644 +--- a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c ++++ b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c +@@ -199,7 +199,7 @@ static const struct v4l2_ctrl_config mt9m111_greenbal_cfg = { + int mt9m111_probe(struct sd *sd) + { + u8 data[2] = {0x00, 0x00}; +- int i; ++ int i, err; + struct gspca_dev *gspca_dev = (struct gspca_dev *)sd; + + if (force_sensor) { +@@ -217,15 +217,17 @@ int mt9m111_probe(struct sd *sd) + /* Do the preinit */ + for (i = 0; i < ARRAY_SIZE(preinit_mt9m111); i++) { + if (preinit_mt9m111[i][0] == BRIDGE) { +- m5602_write_bridge(sd, +- preinit_mt9m111[i][1], +- preinit_mt9m111[i][2]); ++ err = m5602_write_bridge(sd, ++ preinit_mt9m111[i][1], ++ preinit_mt9m111[i][2]); + } else { + data[0] = preinit_mt9m111[i][2]; + data[1] = preinit_mt9m111[i][3]; +- m5602_write_sensor(sd, +- preinit_mt9m111[i][1], data, 2); ++ err = m5602_write_sensor(sd, ++ preinit_mt9m111[i][1], data, 2); + } ++ if (err < 0) ++ return err; + } + + if (m5602_read_sensor(sd, MT9M111_SC_CHIPVER, data, 2)) +-- +2.30.2 + diff --git a/queue-4.9/media-gspca-properly-check-for-errors-in-po1030_prob.patch b/queue-4.9/media-gspca-properly-check-for-errors-in-po1030_prob.patch new file mode 100644 index 00000000000..70112835c42 --- /dev/null +++ b/queue-4.9/media-gspca-properly-check-for-errors-in-po1030_prob.patch @@ -0,0 +1,52 @@ +From 2d37a5481dbfba806f82812eb432a409c2ce0852 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:30 +0200 +Subject: media: gspca: properly check for errors in po1030_probe() + +From: Greg Kroah-Hartman + +[ Upstream commit dacb408ca6f0e34df22b40d8dd5fae7f8e777d84 ] + +If m5602_write_sensor() or m5602_write_bridge() fail, do not continue to +initialize the device but return the error to the calling funtion. + +Cc: Mauro Carvalho Chehab +Link: https://lore.kernel.org/r/20210503115736.2104747-64-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/m5602/m5602_po1030.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/usb/gspca/m5602/m5602_po1030.c b/drivers/media/usb/gspca/m5602/m5602_po1030.c +index a0a90dd34ca8..a098aeb290c3 100644 +--- a/drivers/media/usb/gspca/m5602/m5602_po1030.c ++++ b/drivers/media/usb/gspca/m5602/m5602_po1030.c +@@ -159,6 +159,7 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = { + int po1030_probe(struct sd *sd) + { + u8 dev_id_h = 0, i; ++ int err; + struct gspca_dev *gspca_dev = (struct gspca_dev *)sd; + + if (force_sensor) { +@@ -177,10 +178,13 @@ int po1030_probe(struct sd *sd) + for (i = 0; i < ARRAY_SIZE(preinit_po1030); i++) { + u8 data = preinit_po1030[i][2]; + if (preinit_po1030[i][0] == SENSOR) +- m5602_write_sensor(sd, +- preinit_po1030[i][1], &data, 1); ++ err = m5602_write_sensor(sd, preinit_po1030[i][1], ++ &data, 1); + else +- m5602_write_bridge(sd, preinit_po1030[i][1], data); ++ err = m5602_write_bridge(sd, preinit_po1030[i][1], ++ data); ++ if (err < 0) ++ return err; + } + + if (m5602_read_sensor(sd, PO1030_DEVID_H, &dev_id_h, 1)) +-- +2.30.2 + diff --git a/queue-4.9/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch b/queue-4.9/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch new file mode 100644 index 00000000000..65cfae0d20d --- /dev/null +++ b/queue-4.9/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch @@ -0,0 +1,80 @@ +From 4f45fd2445511b943edb4868e373e05dcdf43c48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:46 +0200 +Subject: net: caif: remove BUG_ON(dev == NULL) in caif_xmit + +From: Du Cheng + +[ Upstream commit 65a67792e3416f7c5d7daa47d99334cbb19a7449 ] + +The condition of dev == NULL is impossible in caif_xmit(), hence it is +for the removal. + +Explanation: +The static caif_xmit() is only called upon via a function pointer +`ndo_start_xmit` defined in include/linux/netdevice.h: +``` +struct net_device_ops { + ... + netdev_tx_t (*ndo_start_xmit)(struct sk_buff *skb, struct net_device *dev); + ... +} +``` + +The exhausive list of call points are: +``` +drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c + dev->netdev_ops->ndo_start_xmit(skb, dev); + ^ ^ + +drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c + struct opa_vnic_adapter *adapter = opa_vnic_priv(netdev); + ^ ^ + return adapter->rn_ops->ndo_start_xmit(skb, netdev); // adapter would crash first + ^ ^ + +drivers/usb/gadget/function/f_ncm.c + ncm->netdev->netdev_ops->ndo_start_xmit(NULL, ncm->netdev); + ^ ^ + +include/linux/netdevice.h +static inline netdev_tx_t __netdev_start_xmit(... +{ + return ops->ndo_start_xmit(skb, dev); + ^ +} + + const struct net_device_ops *ops = dev->netdev_ops; + ^ + rc = __netdev_start_xmit(ops, skb, dev, more); + ^ +``` + +In each of the enumerated scenarios, it is impossible for the NULL-valued dev to +reach the caif_xmit() without crashing the kernel earlier, therefore `BUG_ON(dev == +NULL)` is rather useless, hence the removal. + +Cc: David S. Miller +Signed-off-by: Du Cheng +Link: https://lore.kernel.org/r/20210503115736.2104747-20-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/caif/caif_serial.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c +index c2dea4916e5d..32834dad0b83 100644 +--- a/drivers/net/caif/caif_serial.c ++++ b/drivers/net/caif/caif_serial.c +@@ -281,7 +281,6 @@ static int caif_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct ser_device *ser; + +- BUG_ON(dev == NULL); + ser = netdev_priv(dev); + + /* Send flow off once, on high water mark */ +-- +2.30.2 + diff --git a/queue-4.9/net-fujitsu-fix-potential-null-ptr-deref.patch b/queue-4.9/net-fujitsu-fix-potential-null-ptr-deref.patch new file mode 100644 index 00000000000..2d9d5217e35 --- /dev/null +++ b/queue-4.9/net-fujitsu-fix-potential-null-ptr-deref.patch @@ -0,0 +1,42 @@ +From 60288e57c33f63b4d7ea170e3b5e1f6e353bbcfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:42 +0200 +Subject: net: fujitsu: fix potential null-ptr-deref + +From: Anirudh Rayabharam + +[ Upstream commit 52202be1cd996cde6e8969a128dc27ee45a7cb5e ] + +In fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer +deref. To fix this, check the return value of ioremap and return -1 +to the caller in case of failure. + +Cc: "David S. Miller" +Acked-by: Dominik Brodowski +Signed-off-by: Anirudh Rayabharam +Link: https://lore.kernel.org/r/20210503115736.2104747-16-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c +index 399cfd217288..cfda55bfa811 100644 +--- a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c ++++ b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c +@@ -548,6 +548,11 @@ static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id) + return -1; + + base = ioremap(link->resource[2]->start, resource_size(link->resource[2])); ++ if (!base) { ++ pcmcia_release_window(link, link->resource[2]); ++ return -1; ++ } ++ + pcmcia_map_mem_page(link, link->resource[2], 0); + + /* +-- +2.30.2 + diff --git a/queue-4.9/openrisc-define-memory-barrier-mb.patch b/queue-4.9/openrisc-define-memory-barrier-mb.patch new file mode 100644 index 00000000000..72a83a60467 --- /dev/null +++ b/queue-4.9/openrisc-define-memory-barrier-mb.patch @@ -0,0 +1,48 @@ +From 59fe6386e4e5d84383969b0807f989aacdbdbd77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 14:45:43 +0200 +Subject: openrisc: Define memory barrier mb + +From: Peter Zijlstra + +[ Upstream commit 8b549c18ae81dbc36fb11e4aa08b8378c599ca95 ] + +This came up in the discussion of the requirements of qspinlock on an +architecture. OpenRISC uses qspinlock, but it was noticed that the +memmory barrier was not defined. + +Peter defined it in the mail thread writing: + + As near as I can tell this should do. The arch spec only lists + this one instruction and the text makes it sound like a completion + barrier. + +This is correct so applying this patch. + +Signed-off-by: Peter Zijlstra +[shorne@gmail.com:Turned the mail into a patch] +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/barrier.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + create mode 100644 arch/openrisc/include/asm/barrier.h + +diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h +new file mode 100644 +index 000000000000..7538294721be +--- /dev/null ++++ b/arch/openrisc/include/asm/barrier.h +@@ -0,0 +1,9 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef __ASM_BARRIER_H ++#define __ASM_BARRIER_H ++ ++#define mb() asm volatile ("l.msync" ::: "memory") ++ ++#include ++ ++#endif /* __ASM_BARRIER_H */ +-- +2.30.2 + diff --git a/queue-4.9/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch b/queue-4.9/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch new file mode 100644 index 00000000000..2fa17079f16 --- /dev/null +++ b/queue-4.9/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch @@ -0,0 +1,95 @@ +From d10e2a3adbc1b4c080bc64d74373155d438d0b98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Apr 2021 14:07:35 +0800 +Subject: platform/x86: hp_accel: Avoid invoking _INI to speed up resume +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai-Heng Feng + +[ Upstream commit 79d341e26ebcdbc622348aaaab6f8f89b6fdb25f ] + +hp_accel can take almost two seconds to resume on some HP laptops. + +The bottleneck is on evaluating _INI, which is only needed to run once. + +Resolve the issue by only invoking _INI when it's necessary. Namely, on +probe and on hibernation restore. + +Signed-off-by: Kai-Heng Feng +Acked-by: Éric Piel +Link: https://lore.kernel.org/r/20210430060736.590321-1-kai.heng.feng@canonical.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/misc/lis3lv02d/lis3lv02d.h | 1 + + drivers/platform/x86/hp_accel.c | 22 +++++++++++++++++++++- + 2 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h +index c439c827eea8..0ef759671b54 100644 +--- a/drivers/misc/lis3lv02d/lis3lv02d.h ++++ b/drivers/misc/lis3lv02d/lis3lv02d.h +@@ -284,6 +284,7 @@ struct lis3lv02d { + int regs_size; + u8 *reg_cache; + bool regs_stored; ++ bool init_required; + u8 odr_mask; /* ODR bit mask */ + u8 whoami; /* indicates measurement precision */ + s16 (*read_data) (struct lis3lv02d *lis3, int reg); +diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c +index abd9d83f6009..403d966223ee 100644 +--- a/drivers/platform/x86/hp_accel.c ++++ b/drivers/platform/x86/hp_accel.c +@@ -101,6 +101,9 @@ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids); + static int lis3lv02d_acpi_init(struct lis3lv02d *lis3) + { + struct acpi_device *dev = lis3->bus_priv; ++ if (!lis3->init_required) ++ return 0; ++ + if (acpi_evaluate_object(dev->handle, METHOD_NAME__INI, + NULL, NULL) != AE_OK) + return -EINVAL; +@@ -366,6 +369,7 @@ static int lis3lv02d_add(struct acpi_device *device) + } + + /* call the core layer do its init */ ++ lis3_dev.init_required = true; + ret = lis3lv02d_init_device(&lis3_dev); + if (ret) + return ret; +@@ -413,11 +417,27 @@ static int lis3lv02d_suspend(struct device *dev) + + static int lis3lv02d_resume(struct device *dev) + { ++ lis3_dev.init_required = false; ++ lis3lv02d_poweron(&lis3_dev); ++ return 0; ++} ++ ++static int lis3lv02d_restore(struct device *dev) ++{ ++ lis3_dev.init_required = true; + lis3lv02d_poweron(&lis3_dev); + return 0; + } + +-static SIMPLE_DEV_PM_OPS(hp_accel_pm, lis3lv02d_suspend, lis3lv02d_resume); ++static const struct dev_pm_ops hp_accel_pm = { ++ .suspend = lis3lv02d_suspend, ++ .resume = lis3lv02d_resume, ++ .freeze = lis3lv02d_suspend, ++ .thaw = lis3lv02d_resume, ++ .poweroff = lis3lv02d_suspend, ++ .restore = lis3lv02d_restore, ++}; ++ + #define HP_ACCEL_PM (&hp_accel_pm) + #else + #define HP_ACCEL_PM NULL +-- +2.30.2 + diff --git a/queue-4.9/platform-x86-intel_punit_ipc-append-module_device_ta.patch b/queue-4.9/platform-x86-intel_punit_ipc-append-module_device_ta.patch new file mode 100644 index 00000000000..93876f3e35d --- /dev/null +++ b/queue-4.9/platform-x86-intel_punit_ipc-append-module_device_ta.patch @@ -0,0 +1,38 @@ +From 2caea7ad4c305f563ec12676fe62cae8bad6c8e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 13:15:21 +0300 +Subject: platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI + +From: Andy Shevchenko + +[ Upstream commit bc1eca606d8084465e6f89fd646cc71defbad490 ] + +The intel_punit_ipc driver might be compiled as a module. +When udev handles the event of the devices appearing +the intel_punit_ipc module is missing. + +Append MODULE_DEVICE_TABLE for ACPI case to fix the loading issue. + +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210519101521.79338-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel_punit_ipc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c +index b7dfe06261f1..9865d11eda75 100644 +--- a/drivers/platform/x86/intel_punit_ipc.c ++++ b/drivers/platform/x86/intel_punit_ipc.c +@@ -330,6 +330,7 @@ static const struct acpi_device_id punit_ipc_acpi_ids[] = { + { "INT34D4", 0 }, + { } + }; ++MODULE_DEVICE_TABLE(acpi, punit_ipc_acpi_ids); + + static struct platform_driver intel_punit_ipc_driver = { + .probe = intel_punit_ipc_probe, +-- +2.30.2 + diff --git a/queue-4.9/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch b/queue-4.9/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch new file mode 100644 index 00000000000..b31e3a490a6 --- /dev/null +++ b/queue-4.9/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch @@ -0,0 +1,65 @@ +From 9fc38a2f4697f13b495091377f9c5b40aed1c8d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 03:04:37 +0000 +Subject: scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic + +From: Matt Wang + +[ Upstream commit 56f396146af278135c0ff958c79b5ee1bd22453d ] + +Commit 391e2f25601e ("[SCSI] BusLogic: Port driver to 64-bit") +introduced a serious issue for 64-bit systems. With this commit, +64-bit kernel will enumerate 8*15 non-existing disks. This is caused +by the broken CCB structure. The change from u32 data to void *data +increased CCB length on 64-bit system, which introduced an extra 4 +byte offset of the CDB. This leads to incorrect response to INQUIRY +commands during enumeration. + +Fix disk enumeration failure by reverting the portion of the commit +above which switched the data pointer from u32 to void. + +Link: https://lore.kernel.org/r/C325637F-1166-4340-8F0F-3BCCD59D4D54@vmware.com +Acked-by: Khalid Aziz +Signed-off-by: Matt Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/BusLogic.c | 6 +++--- + drivers/scsi/BusLogic.h | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c +index c7be7bb37209..b9b4491d732a 100644 +--- a/drivers/scsi/BusLogic.c ++++ b/drivers/scsi/BusLogic.c +@@ -3081,11 +3081,11 @@ static int blogic_qcmd_lck(struct scsi_cmnd *command, + ccb->opcode = BLOGIC_INITIATOR_CCB_SG; + ccb->datalen = count * sizeof(struct blogic_sg_seg); + if (blogic_multimaster_type(adapter)) +- ccb->data = (void *)((unsigned int) ccb->dma_handle + ++ ccb->data = (unsigned int) ccb->dma_handle + + ((unsigned long) &ccb->sglist - +- (unsigned long) ccb)); ++ (unsigned long) ccb); + else +- ccb->data = ccb->sglist; ++ ccb->data = virt_to_32bit_virt(ccb->sglist); + + scsi_for_each_sg(command, sg, count, i) { + ccb->sglist[i].segbytes = sg_dma_len(sg); +diff --git a/drivers/scsi/BusLogic.h b/drivers/scsi/BusLogic.h +index b53ec2f1e8cd..5c950a7a1b1c 100644 +--- a/drivers/scsi/BusLogic.h ++++ b/drivers/scsi/BusLogic.h +@@ -821,7 +821,7 @@ struct blogic_ccb { + unsigned char cdblen; /* Byte 2 */ + unsigned char sense_datalen; /* Byte 3 */ + u32 datalen; /* Bytes 4-7 */ +- void *data; /* Bytes 8-11 */ ++ u32 data; /* Bytes 8-11 */ + unsigned char:8; /* Byte 12 */ + unsigned char:8; /* Byte 13 */ + enum blogic_adapter_status adapter_status; /* Byte 14 */ +-- +2.30.2 + diff --git a/queue-4.9/serial-max310x-unregister-uart-driver-in-case-of-fai.patch b/queue-4.9/serial-max310x-unregister-uart-driver-in-case-of-fai.patch new file mode 100644 index 00000000000..d44c8ee1b1e --- /dev/null +++ b/queue-4.9/serial-max310x-unregister-uart-driver-in-case-of-fai.patch @@ -0,0 +1,49 @@ +From 95953a472932d45191d76dc3141e3b90f70d9bfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:38 +0200 +Subject: serial: max310x: unregister uart driver in case of failure and abort + +From: Atul Gopinathan + +[ Upstream commit 3890e3dea315f1a257d1b940a2a4e2fa16a7b095 ] + +The macro "spi_register_driver" invokes the function +"__spi_register_driver()" which has a return type of int and can fail, +returning a negative value in such a case. This is currently ignored and +the init() function yields success even if the spi driver failed to +register. + +Fix this by collecting the return value of "__spi_register_driver()" and +also unregister the uart driver in case of failure. + +Cc: Jiri Slaby +Signed-off-by: Atul Gopinathan +Link: https://lore.kernel.org/r/20210503115736.2104747-12-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index 80ab672d61cc..febbacecb3ba 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1385,10 +1385,12 @@ static int __init max310x_uart_init(void) + return ret; + + #ifdef CONFIG_SPI_MASTER +- spi_register_driver(&max310x_spi_driver); ++ ret = spi_register_driver(&max310x_spi_driver); ++ if (ret) ++ uart_unregister_driver(&max310x_uart); + #endif + +- return 0; ++ return ret; + } + module_init(max310x_uart_init); + +-- +2.30.2 + diff --git a/queue-4.9/series b/queue-4.9/series index 34b4b42089a..1d2e8545593 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -35,3 +35,21 @@ tipc-skb_linearize-the-head-skb-when-reassembling-msgs.patch i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch perf-jevents-fix-getting-maximum-number-of-fds.patch +platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch +serial-max310x-unregister-uart-driver-in-case-of-fai.patch +net-fujitsu-fix-potential-null-ptr-deref.patch +net-caif-remove-bug_on-dev-null-in-caif_xmit.patch +char-hpet-add-checks-after-calling-ioremap.patch +alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch +isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch +ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch +dmaengine-qcom_hidma-comment-platform_driver_registe.patch +libertas-register-sysfs-groups-properly.patch +media-dvb-add-check-on-sp8870_readreg-return.patch +media-gspca-mt9m111-check-write_bridge-for-timeout.patch +media-gspca-properly-check-for-errors-in-po1030_prob.patch +scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch +openrisc-define-memory-barrier-mb.patch +btrfs-do-not-bug_on-in-link_to_fixup_dir.patch +platform-x86-intel_punit_ipc-append-module_device_ta.patch +drm-amdgpu-fix-a-use-after-free.patch -- 2.47.3