From 4b0f757079d02b747295b73240b47bb4c4a91dbc Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 7 Feb 2020 10:15:33 +0100 Subject: [PATCH] 5.4-stable patches added patches: asoc-sof-core-free-trace-on-errors.patch cpupower-revert-library-abi-changes-from-commit-ae2917093fb60bdc1ed3e.patch crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch crypto-ccree-fix-aead-decrypt-auth-fail.patch crypto-ccree-fix-backlog-memory-leak.patch crypto-ccree-fix-fde-descriptor-sequence.patch crypto-ccree-fix-pm-race-condition.patch crypto-ccree-fix-pm-wrongful-error-reporting.patch erofs-fix-out-of-bound-read-for-shifted-uncompressed-block.patch fs-allow-deduplication-of-eof-block-into-the-end-of-the-destination-file.patch hv_balloon-balloon-up-according-to-request-page-number.patch mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch nvmem-core-fix-memory-abort-in-cleanup-path.patch padata-remove-broken-queue-flushing.patch power-supply-axp20x_ac_power-fix-reporting-online-status.patch power-supply-ltc2941-battery-gauge-fix-use-after-free.patch scripts-find-unused-docs-fix-massive-false-positives.patch scsi-megaraid_sas-do-not-initiate-ocr-if-controller-is-not-in-ready-state.patch scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch --- .../asoc-sof-core-free-trace-on-errors.patch | 59 +++++ ...es-from-commit-ae2917093fb60bdc1ed3e.patch | 242 ++++++++++++++++++ ...-alg-under-lock-in-crypto_drop_spawn.patch | 39 +++ ...pto-ccree-fix-aead-decrypt-auth-fail.patch | 35 +++ ...crypto-ccree-fix-backlog-memory-leak.patch | 32 +++ ...to-ccree-fix-fde-descriptor-sequence.patch | 104 ++++++++ .../crypto-ccree-fix-pm-race-condition.patch | 195 ++++++++++++++ ...cree-fix-pm-wrongful-error-reporting.patch | 32 +++ ...-read-for-shifted-uncompressed-block.patch | 61 +++++ ...into-the-end-of-the-destination-file.patch | 68 +++++ ...-up-according-to-request-page-number.patch | 77 ++++++ ...-axp20x_vbus_ipsout_mgmt-as-volatile.patch | 39 +++ ...ore-fix-memory-abort-in-cleanup-path.patch | 115 +++++++++ .../padata-remove-broken-queue-flushing.patch | 137 ++++++++++ ...ac_power-fix-reporting-online-status.patch | 106 ++++++++ ...941-battery-gauge-fix-use-after-free.patch | 41 +++ ...sed-docs-fix-massive-false-positives.patch | 41 +++ ...-if-controller-is-not-in-ready-state.patch | 70 +++++ ...xxx-fix-mtcp-dump-collection-failure.patch | 37 +++ queue-5.4/series | 19 ++ 20 files changed, 1549 insertions(+) create mode 100644 queue-5.4/asoc-sof-core-free-trace-on-errors.patch create mode 100644 queue-5.4/cpupower-revert-library-abi-changes-from-commit-ae2917093fb60bdc1ed3e.patch create mode 100644 queue-5.4/crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch create mode 100644 queue-5.4/crypto-ccree-fix-aead-decrypt-auth-fail.patch create mode 100644 queue-5.4/crypto-ccree-fix-backlog-memory-leak.patch create mode 100644 queue-5.4/crypto-ccree-fix-fde-descriptor-sequence.patch create mode 100644 queue-5.4/crypto-ccree-fix-pm-race-condition.patch create mode 100644 queue-5.4/crypto-ccree-fix-pm-wrongful-error-reporting.patch create mode 100644 queue-5.4/erofs-fix-out-of-bound-read-for-shifted-uncompressed-block.patch create mode 100644 queue-5.4/fs-allow-deduplication-of-eof-block-into-the-end-of-the-destination-file.patch create mode 100644 queue-5.4/hv_balloon-balloon-up-according-to-request-page-number.patch create mode 100644 queue-5.4/mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch create mode 100644 queue-5.4/nvmem-core-fix-memory-abort-in-cleanup-path.patch create mode 100644 queue-5.4/padata-remove-broken-queue-flushing.patch create mode 100644 queue-5.4/power-supply-axp20x_ac_power-fix-reporting-online-status.patch create mode 100644 queue-5.4/power-supply-ltc2941-battery-gauge-fix-use-after-free.patch create mode 100644 queue-5.4/scripts-find-unused-docs-fix-massive-false-positives.patch create mode 100644 queue-5.4/scsi-megaraid_sas-do-not-initiate-ocr-if-controller-is-not-in-ready-state.patch create mode 100644 queue-5.4/scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch diff --git a/queue-5.4/asoc-sof-core-free-trace-on-errors.patch b/queue-5.4/asoc-sof-core-free-trace-on-errors.patch new file mode 100644 index 00000000000..cb119fef960 --- /dev/null +++ b/queue-5.4/asoc-sof-core-free-trace-on-errors.patch @@ -0,0 +1,59 @@ +From 37e97e6faeabda405d0c4319f8419dcc3da14b2b Mon Sep 17 00:00:00 2001 +From: Pierre-Louis Bossart +Date: Fri, 24 Jan 2020 15:36:20 -0600 +Subject: ASoC: SOF: core: free trace on errors + +From: Pierre-Louis Bossart + +commit 37e97e6faeabda405d0c4319f8419dcc3da14b2b upstream. + +free_trace() is not called on probe errors, fix + +Reviewed-by: Kai Vehmanen +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200124213625.30186-3-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/sof/core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/sound/soc/sof/core.c ++++ b/sound/soc/sof/core.c +@@ -368,7 +368,7 @@ static int sof_probe_continue(struct snd + if (ret < 0) { + dev_err(sdev->dev, + "error: failed to register DSP DAI driver %d\n", ret); +- goto fw_run_err; ++ goto fw_trace_err; + } + + drv_name = plat_data->machine->drv_name; +@@ -382,7 +382,7 @@ static int sof_probe_continue(struct snd + + if (IS_ERR(plat_data->pdev_mach)) { + ret = PTR_ERR(plat_data->pdev_mach); +- goto fw_run_err; ++ goto fw_trace_err; + } + + dev_dbg(sdev->dev, "created machine %s\n", +@@ -394,6 +394,8 @@ static int sof_probe_continue(struct snd + return 0; + + #if !IS_ENABLED(CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE) ++fw_trace_err: ++ snd_sof_free_trace(sdev); + fw_run_err: + snd_sof_fw_unload(sdev); + fw_load_err: +@@ -411,6 +413,7 @@ dbg_err: + * snd_sof_device_remove() when the PCI/ACPI device is removed + */ + ++fw_trace_err: + fw_run_err: + fw_load_err: + ipc_err: diff --git a/queue-5.4/cpupower-revert-library-abi-changes-from-commit-ae2917093fb60bdc1ed3e.patch b/queue-5.4/cpupower-revert-library-abi-changes-from-commit-ae2917093fb60bdc1ed3e.patch new file mode 100644 index 00000000000..6d30851ef16 --- /dev/null +++ b/queue-5.4/cpupower-revert-library-abi-changes-from-commit-ae2917093fb60bdc1ed3e.patch @@ -0,0 +1,242 @@ +From 41ddb7e1f79693d904502ae9bea609837973eff8 Mon Sep 17 00:00:00 2001 +From: Thomas Renninger +Date: Fri, 17 Jan 2020 08:55:54 +0100 +Subject: cpupower: Revert library ABI changes from commit ae2917093fb60bdc1ed3e + +From: Thomas Renninger + +commit 41ddb7e1f79693d904502ae9bea609837973eff8 upstream. + +Commit ae2917093fb6 ("tools/power/cpupower: Display boost frequency +separately") modified the library function: + +struct cpufreq_available_frequencies +*cpufreq_get_available_frequencies(unsigned int cpu) + +to +struct cpufreq_frequencies +*cpufreq_get_frequencies(const char *type, unsigned int cpu) + +This patch recovers the old API and implements the new functionality +in a newly introduce method: +struct cpufreq_boost_frequencies +*cpufreq_get_available_frequencies(unsigned int cpu) + +This one should get merged into stable kernels back to 5.0 when +the above had been introduced. + +Fixes: ae2917093fb6 ("tools/power/cpupower: Display boost frequency separately") + +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Renninger +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman + +--- + tools/power/cpupower/lib/cpufreq.c | 78 ++++++++++++++++++++++++++---- + tools/power/cpupower/lib/cpufreq.h | 20 +++++-- + tools/power/cpupower/utils/cpufreq-info.c | 12 ++-- + 3 files changed, 87 insertions(+), 23 deletions(-) + +--- a/tools/power/cpupower/lib/cpufreq.c ++++ b/tools/power/cpupower/lib/cpufreq.c +@@ -332,21 +332,74 @@ void cpufreq_put_available_governors(str + } + + +-struct cpufreq_frequencies +-*cpufreq_get_frequencies(const char *type, unsigned int cpu) ++struct cpufreq_available_frequencies ++*cpufreq_get_available_frequencies(unsigned int cpu) + { +- struct cpufreq_frequencies *first = NULL; +- struct cpufreq_frequencies *current = NULL; ++ struct cpufreq_available_frequencies *first = NULL; ++ struct cpufreq_available_frequencies *current = NULL; + char one_value[SYSFS_PATH_MAX]; + char linebuf[MAX_LINE_LEN]; +- char fname[MAX_LINE_LEN]; + unsigned int pos, i; + unsigned int len; + +- snprintf(fname, MAX_LINE_LEN, "scaling_%s_frequencies", type); ++ len = sysfs_cpufreq_read_file(cpu, "scaling_available_frequencies", ++ linebuf, sizeof(linebuf)); ++ if (len == 0) ++ return NULL; ++ ++ pos = 0; ++ for (i = 0; i < len; i++) { ++ if (linebuf[i] == ' ' || linebuf[i] == '\n') { ++ if (i - pos < 2) ++ continue; ++ if (i - pos >= SYSFS_PATH_MAX) ++ goto error_out; ++ if (current) { ++ current->next = malloc(sizeof(*current)); ++ if (!current->next) ++ goto error_out; ++ current = current->next; ++ } else { ++ first = malloc(sizeof(*first)); ++ if (!first) ++ goto error_out; ++ current = first; ++ } ++ current->first = first; ++ current->next = NULL; ++ ++ memcpy(one_value, linebuf + pos, i - pos); ++ one_value[i - pos] = '\0'; ++ if (sscanf(one_value, "%lu", ¤t->frequency) != 1) ++ goto error_out; ++ ++ pos = i + 1; ++ } ++ } ++ ++ return first; ++ ++ error_out: ++ while (first) { ++ current = first->next; ++ free(first); ++ first = current; ++ } ++ return NULL; ++} + +- len = sysfs_cpufreq_read_file(cpu, fname, +- linebuf, sizeof(linebuf)); ++struct cpufreq_available_frequencies ++*cpufreq_get_boost_frequencies(unsigned int cpu) ++{ ++ struct cpufreq_available_frequencies *first = NULL; ++ struct cpufreq_available_frequencies *current = NULL; ++ char one_value[SYSFS_PATH_MAX]; ++ char linebuf[MAX_LINE_LEN]; ++ unsigned int pos, i; ++ unsigned int len; ++ ++ len = sysfs_cpufreq_read_file(cpu, "scaling_boost_frequencies", ++ linebuf, sizeof(linebuf)); + if (len == 0) + return NULL; + +@@ -391,9 +444,9 @@ struct cpufreq_frequencies + return NULL; + } + +-void cpufreq_put_frequencies(struct cpufreq_frequencies *any) ++void cpufreq_put_available_frequencies(struct cpufreq_available_frequencies *any) + { +- struct cpufreq_frequencies *tmp, *next; ++ struct cpufreq_available_frequencies *tmp, *next; + + if (!any) + return; +@@ -406,6 +459,11 @@ void cpufreq_put_frequencies(struct cpuf + } + } + ++void cpufreq_put_boost_frequencies(struct cpufreq_available_frequencies *any) ++{ ++ cpufreq_put_available_frequencies(any); ++} ++ + static struct cpufreq_affected_cpus *sysfs_get_cpu_list(unsigned int cpu, + const char *file) + { +--- a/tools/power/cpupower/lib/cpufreq.h ++++ b/tools/power/cpupower/lib/cpufreq.h +@@ -20,10 +20,10 @@ struct cpufreq_available_governors { + struct cpufreq_available_governors *first; + }; + +-struct cpufreq_frequencies { ++struct cpufreq_available_frequencies { + unsigned long frequency; +- struct cpufreq_frequencies *next; +- struct cpufreq_frequencies *first; ++ struct cpufreq_available_frequencies *next; ++ struct cpufreq_available_frequencies *first; + }; + + +@@ -124,11 +124,17 @@ void cpufreq_put_available_governors( + * cpufreq_put_frequencies after use. + */ + +-struct cpufreq_frequencies +-*cpufreq_get_frequencies(const char *type, unsigned int cpu); ++struct cpufreq_available_frequencies ++*cpufreq_get_available_frequencies(unsigned int cpu); + +-void cpufreq_put_frequencies( +- struct cpufreq_frequencies *first); ++void cpufreq_put_available_frequencies( ++ struct cpufreq_available_frequencies *first); ++ ++struct cpufreq_available_frequencies ++*cpufreq_get_boost_frequencies(unsigned int cpu); ++ ++void cpufreq_put_boost_frequencies( ++ struct cpufreq_available_frequencies *first); + + + /* determine affected CPUs +--- a/tools/power/cpupower/utils/cpufreq-info.c ++++ b/tools/power/cpupower/utils/cpufreq-info.c +@@ -244,14 +244,14 @@ static int get_boost_mode_x86(unsigned i + + static int get_boost_mode(unsigned int cpu) + { +- struct cpufreq_frequencies *freqs; ++ struct cpufreq_available_frequencies *freqs; + + if (cpupower_cpu_info.vendor == X86_VENDOR_AMD || + cpupower_cpu_info.vendor == X86_VENDOR_HYGON || + cpupower_cpu_info.vendor == X86_VENDOR_INTEL) + return get_boost_mode_x86(cpu); + +- freqs = cpufreq_get_frequencies("boost", cpu); ++ freqs = cpufreq_get_boost_frequencies(cpu); + if (freqs) { + printf(_(" boost frequency steps: ")); + while (freqs->next) { +@@ -261,7 +261,7 @@ static int get_boost_mode(unsigned int c + } + print_speed(freqs->frequency); + printf("\n"); +- cpufreq_put_frequencies(freqs); ++ cpufreq_put_available_frequencies(freqs); + } + + return 0; +@@ -475,7 +475,7 @@ static int get_latency(unsigned int cpu, + + static void debug_output_one(unsigned int cpu) + { +- struct cpufreq_frequencies *freqs; ++ struct cpufreq_available_frequencies *freqs; + + get_driver(cpu); + get_related_cpus(cpu); +@@ -483,7 +483,7 @@ static void debug_output_one(unsigned in + get_latency(cpu, 1); + get_hardware_limits(cpu, 1); + +- freqs = cpufreq_get_frequencies("available", cpu); ++ freqs = cpufreq_get_available_frequencies(cpu); + if (freqs) { + printf(_(" available frequency steps: ")); + while (freqs->next) { +@@ -493,7 +493,7 @@ static void debug_output_one(unsigned in + } + print_speed(freqs->frequency); + printf("\n"); +- cpufreq_put_frequencies(freqs); ++ cpufreq_put_available_frequencies(freqs); + } + + get_available_governors(cpu); diff --git a/queue-5.4/crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch b/queue-5.4/crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch new file mode 100644 index 00000000000..b851560c07e --- /dev/null +++ b/queue-5.4/crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch @@ -0,0 +1,39 @@ +From 7db3b61b6bba4310f454588c2ca6faf2958ad79f Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Fri, 6 Dec 2019 13:55:17 +0800 +Subject: crypto: api - Check spawn->alg under lock in crypto_drop_spawn + +From: Herbert Xu + +commit 7db3b61b6bba4310f454588c2ca6faf2958ad79f upstream. + +We need to check whether spawn->alg is NULL under lock as otherwise +the algorithm could be removed from under us after we have checked +it and found it to be non-NULL. This could cause us to remove the +spawn from a non-existent list. + +Fixes: 7ede5a5ba55a ("crypto: api - Fix crypto_drop_spawn crash...") +Cc: +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/algapi.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/crypto/algapi.c ++++ b/crypto/algapi.c +@@ -669,11 +669,9 @@ EXPORT_SYMBOL_GPL(crypto_grab_spawn); + + void crypto_drop_spawn(struct crypto_spawn *spawn) + { +- if (!spawn->alg) +- return; +- + down_write(&crypto_alg_sem); +- list_del(&spawn->list); ++ if (spawn->alg) ++ list_del(&spawn->list); + up_write(&crypto_alg_sem); + } + EXPORT_SYMBOL_GPL(crypto_drop_spawn); diff --git a/queue-5.4/crypto-ccree-fix-aead-decrypt-auth-fail.patch b/queue-5.4/crypto-ccree-fix-aead-decrypt-auth-fail.patch new file mode 100644 index 00000000000..3a22786f7fa --- /dev/null +++ b/queue-5.4/crypto-ccree-fix-aead-decrypt-auth-fail.patch @@ -0,0 +1,35 @@ +From 2a6bc713f1cef32e39e3c4e6f2e1a9849da6379c Mon Sep 17 00:00:00 2001 +From: Gilad Ben-Yossef +Date: Thu, 16 Jan 2020 12:14:38 +0200 +Subject: crypto: ccree - fix AEAD decrypt auth fail + +From: Gilad Ben-Yossef + +commit 2a6bc713f1cef32e39e3c4e6f2e1a9849da6379c upstream. + +On AEAD decryption authentication failure we are suppose to +zero out the output plaintext buffer. However, we've missed +skipping the optional associated data that may prefix the +ciphertext. This commit fixes this issue. + +Signed-off-by: Gilad Ben-Yossef +Fixes: e88b27c8eaa8 ("crypto: ccree - use std api sg_zero_buffer") +Cc: stable@vger.kernel.org +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/ccree/cc_aead.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/ccree/cc_aead.c ++++ b/drivers/crypto/ccree/cc_aead.c +@@ -237,7 +237,7 @@ static void cc_aead_complete(struct devi + * revealed the decrypted message --> zero its memory. + */ + sg_zero_buffer(areq->dst, sg_nents(areq->dst), +- areq->cryptlen, 0); ++ areq->cryptlen, areq->assoclen); + err = -EBADMSG; + } + /*ENCRYPT*/ diff --git a/queue-5.4/crypto-ccree-fix-backlog-memory-leak.patch b/queue-5.4/crypto-ccree-fix-backlog-memory-leak.patch new file mode 100644 index 00000000000..06a1c56b9a4 --- /dev/null +++ b/queue-5.4/crypto-ccree-fix-backlog-memory-leak.patch @@ -0,0 +1,32 @@ +From 4df2ef25b3b3618fd708ab484fe6239abd130fec Mon Sep 17 00:00:00 2001 +From: Gilad Ben-Yossef +Date: Wed, 27 Nov 2019 10:49:08 +0200 +Subject: crypto: ccree - fix backlog memory leak + +From: Gilad Ben-Yossef + +commit 4df2ef25b3b3618fd708ab484fe6239abd130fec upstream. + +Fix brown paper bag bug of not releasing backlog list item buffer +when backlog was consumed causing a memory leak when backlog is +used. + +Signed-off-by: Gilad Ben-Yossef +Cc: stable@vger.kernel.org # v4.19+ +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/ccree/cc_request_mgr.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/crypto/ccree/cc_request_mgr.c ++++ b/drivers/crypto/ccree/cc_request_mgr.c +@@ -404,6 +404,7 @@ static void cc_proc_backlog(struct cc_dr + spin_lock(&mgr->bl_lock); + list_del(&bli->list); + --mgr->bl_len; ++ kfree(bli); + } + + spin_unlock(&mgr->bl_lock); diff --git a/queue-5.4/crypto-ccree-fix-fde-descriptor-sequence.patch b/queue-5.4/crypto-ccree-fix-fde-descriptor-sequence.patch new file mode 100644 index 00000000000..a56d8a9890e --- /dev/null +++ b/queue-5.4/crypto-ccree-fix-fde-descriptor-sequence.patch @@ -0,0 +1,104 @@ +From 5c83e8ec4d51ac4cc58482ed04297e6882b32a09 Mon Sep 17 00:00:00 2001 +From: Ofir Drang +Date: Thu, 16 Jan 2020 12:14:42 +0200 +Subject: crypto: ccree - fix FDE descriptor sequence + +From: Ofir Drang + +commit 5c83e8ec4d51ac4cc58482ed04297e6882b32a09 upstream. + +In FDE mode (xts, essiv and bitlocker) the cryptocell hardware requires +that the the XEX key will be loaded after Key1. + +Signed-off-by: Ofir Drang +Cc: stable@vger.kernel.org +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/ccree/cc_cipher.c | 48 ++++++++++++++++++++++++++++++++++++--- + 1 file changed, 45 insertions(+), 3 deletions(-) + +--- a/drivers/crypto/ccree/cc_cipher.c ++++ b/drivers/crypto/ccree/cc_cipher.c +@@ -523,6 +523,7 @@ static void cc_setup_readiv_desc(struct + } + } + ++ + static void cc_setup_state_desc(struct crypto_tfm *tfm, + struct cipher_req_ctx *req_ctx, + unsigned int ivsize, unsigned int nbytes, +@@ -534,8 +535,6 @@ static void cc_setup_state_desc(struct c + int cipher_mode = ctx_p->cipher_mode; + int flow_mode = ctx_p->flow_mode; + int direction = req_ctx->gen_ctx.op_type; +- dma_addr_t key_dma_addr = ctx_p->user.key_dma_addr; +- unsigned int key_len = ctx_p->keylen; + dma_addr_t iv_dma_addr = req_ctx->gen_ctx.iv_dma_addr; + unsigned int du_size = nbytes; + +@@ -571,6 +570,47 @@ static void cc_setup_state_desc(struct c + case DRV_CIPHER_XTS: + case DRV_CIPHER_ESSIV: + case DRV_CIPHER_BITLOCKER: ++ break; ++ default: ++ dev_err(dev, "Unsupported cipher mode (%d)\n", cipher_mode); ++ } ++} ++ ++ ++static void cc_setup_xex_state_desc(struct crypto_tfm *tfm, ++ struct cipher_req_ctx *req_ctx, ++ unsigned int ivsize, unsigned int nbytes, ++ struct cc_hw_desc desc[], ++ unsigned int *seq_size) ++{ ++ struct cc_cipher_ctx *ctx_p = crypto_tfm_ctx(tfm); ++ struct device *dev = drvdata_to_dev(ctx_p->drvdata); ++ int cipher_mode = ctx_p->cipher_mode; ++ int flow_mode = ctx_p->flow_mode; ++ int direction = req_ctx->gen_ctx.op_type; ++ dma_addr_t key_dma_addr = ctx_p->user.key_dma_addr; ++ unsigned int key_len = ctx_p->keylen; ++ dma_addr_t iv_dma_addr = req_ctx->gen_ctx.iv_dma_addr; ++ unsigned int du_size = nbytes; ++ ++ struct cc_crypto_alg *cc_alg = ++ container_of(tfm->__crt_alg, struct cc_crypto_alg, ++ skcipher_alg.base); ++ ++ if (cc_alg->data_unit) ++ du_size = cc_alg->data_unit; ++ ++ switch (cipher_mode) { ++ case DRV_CIPHER_ECB: ++ break; ++ case DRV_CIPHER_CBC: ++ case DRV_CIPHER_CBC_CTS: ++ case DRV_CIPHER_CTR: ++ case DRV_CIPHER_OFB: ++ break; ++ case DRV_CIPHER_XTS: ++ case DRV_CIPHER_ESSIV: ++ case DRV_CIPHER_BITLOCKER: + /* load XEX key */ + hw_desc_init(&desc[*seq_size]); + set_cipher_mode(&desc[*seq_size], cipher_mode); +@@ -881,12 +921,14 @@ static int cc_cipher_process(struct skci + + /* STAT_PHASE_2: Create sequence */ + +- /* Setup IV and XEX key used */ ++ /* Setup state (IV) */ + cc_setup_state_desc(tfm, req_ctx, ivsize, nbytes, desc, &seq_len); + /* Setup MLLI line, if needed */ + cc_setup_mlli_desc(tfm, req_ctx, dst, src, nbytes, req, desc, &seq_len); + /* Setup key */ + cc_setup_key_desc(tfm, req_ctx, nbytes, desc, &seq_len); ++ /* Setup state (IV and XEX key) */ ++ cc_setup_xex_state_desc(tfm, req_ctx, ivsize, nbytes, desc, &seq_len); + /* Data processing */ + cc_setup_flow_desc(tfm, req_ctx, dst, src, nbytes, desc, &seq_len); + /* Read next IV */ diff --git a/queue-5.4/crypto-ccree-fix-pm-race-condition.patch b/queue-5.4/crypto-ccree-fix-pm-race-condition.patch new file mode 100644 index 00000000000..e9b5e8c2f5c --- /dev/null +++ b/queue-5.4/crypto-ccree-fix-pm-race-condition.patch @@ -0,0 +1,195 @@ +From 15fd2566bf54ee4d4781d8f170acfc9472a1541f Mon Sep 17 00:00:00 2001 +From: Gilad Ben-Yossef +Date: Thu, 16 Jan 2020 12:14:43 +0200 +Subject: crypto: ccree - fix PM race condition + +From: Gilad Ben-Yossef + +commit 15fd2566bf54ee4d4781d8f170acfc9472a1541f upstream. + +The PM code was racy, possibly causing the driver to submit +requests to a powered down device. Fix the race and while +at it simplify the PM code. + +Signed-off-by: Gilad Ben-Yossef +Fixes: 1358c13a48c4 ("crypto: ccree - fix resume race condition on init") +Cc: stable@kernel.org # v4.20 +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/ccree/cc_driver.h | 1 + drivers/crypto/ccree/cc_pm.c | 28 ++++--------------- + drivers/crypto/ccree/cc_request_mgr.c | 50 ---------------------------------- + drivers/crypto/ccree/cc_request_mgr.h | 8 ----- + 4 files changed, 7 insertions(+), 80 deletions(-) + +--- a/drivers/crypto/ccree/cc_driver.h ++++ b/drivers/crypto/ccree/cc_driver.h +@@ -161,6 +161,7 @@ struct cc_drvdata { + int std_bodies; + bool sec_disabled; + u32 comp_mask; ++ bool pm_on; + }; + + struct cc_crypto_alg { +--- a/drivers/crypto/ccree/cc_pm.c ++++ b/drivers/crypto/ccree/cc_pm.c +@@ -22,14 +22,8 @@ const struct dev_pm_ops ccree_pm = { + int cc_pm_suspend(struct device *dev) + { + struct cc_drvdata *drvdata = dev_get_drvdata(dev); +- int rc; + + dev_dbg(dev, "set HOST_POWER_DOWN_EN\n"); +- rc = cc_suspend_req_queue(drvdata); +- if (rc) { +- dev_err(dev, "cc_suspend_req_queue (%x)\n", rc); +- return rc; +- } + fini_cc_regs(drvdata); + cc_iowrite(drvdata, CC_REG(HOST_POWER_DOWN_EN), POWER_DOWN_ENABLE); + cc_clk_off(drvdata); +@@ -63,13 +57,6 @@ int cc_pm_resume(struct device *dev) + /* check if tee fips error occurred during power down */ + cc_tee_handle_fips_error(drvdata); + +- rc = cc_resume_req_queue(drvdata); +- if (rc) { +- dev_err(dev, "cc_resume_req_queue (%x)\n", rc); +- return rc; +- } +- +- /* must be after the queue resuming as it uses the HW queue*/ + cc_init_hash_sram(drvdata); + + return 0; +@@ -80,10 +67,8 @@ int cc_pm_get(struct device *dev) + int rc = 0; + struct cc_drvdata *drvdata = dev_get_drvdata(dev); + +- if (cc_req_queue_suspended(drvdata)) ++ if (drvdata->pm_on) + rc = pm_runtime_get_sync(dev); +- else +- pm_runtime_get_noresume(dev); + + return (rc == 1 ? 0 : rc); + } +@@ -93,14 +78,11 @@ int cc_pm_put_suspend(struct device *dev + int rc = 0; + struct cc_drvdata *drvdata = dev_get_drvdata(dev); + +- if (!cc_req_queue_suspended(drvdata)) { ++ if (drvdata->pm_on) { + pm_runtime_mark_last_busy(dev); + rc = pm_runtime_put_autosuspend(dev); +- } else { +- /* Something wrong happens*/ +- dev_err(dev, "request to suspend already suspended queue"); +- rc = -EBUSY; + } ++ + return rc; + } + +@@ -117,7 +99,7 @@ int cc_pm_init(struct cc_drvdata *drvdat + /* must be before the enabling to avoid resdundent suspending */ + pm_runtime_set_autosuspend_delay(dev, CC_SUSPEND_TIMEOUT); + pm_runtime_use_autosuspend(dev); +- /* activate the PM module */ ++ /* set us as active - note we won't do PM ops until cc_pm_go()! */ + return pm_runtime_set_active(dev); + } + +@@ -125,9 +107,11 @@ int cc_pm_init(struct cc_drvdata *drvdat + void cc_pm_go(struct cc_drvdata *drvdata) + { + pm_runtime_enable(drvdata_to_dev(drvdata)); ++ drvdata->pm_on = true; + } + + void cc_pm_fini(struct cc_drvdata *drvdata) + { + pm_runtime_disable(drvdata_to_dev(drvdata)); ++ drvdata->pm_on = false; + } +--- a/drivers/crypto/ccree/cc_request_mgr.c ++++ b/drivers/crypto/ccree/cc_request_mgr.c +@@ -41,7 +41,6 @@ struct cc_req_mgr_handle { + #else + struct tasklet_struct comptask; + #endif +- bool is_runtime_suspended; + }; + + struct cc_bl_item { +@@ -678,52 +677,3 @@ static void comp_handler(unsigned long d + cc_proc_backlog(drvdata); + dev_dbg(dev, "Comp. handler done.\n"); + } +- +-/* +- * resume the queue configuration - no need to take the lock as this happens +- * inside the spin lock protection +- */ +-#if defined(CONFIG_PM) +-int cc_resume_req_queue(struct cc_drvdata *drvdata) +-{ +- struct cc_req_mgr_handle *request_mgr_handle = +- drvdata->request_mgr_handle; +- +- spin_lock_bh(&request_mgr_handle->hw_lock); +- request_mgr_handle->is_runtime_suspended = false; +- spin_unlock_bh(&request_mgr_handle->hw_lock); +- +- return 0; +-} +- +-/* +- * suspend the queue configuration. Since it is used for the runtime suspend +- * only verify that the queue can be suspended. +- */ +-int cc_suspend_req_queue(struct cc_drvdata *drvdata) +-{ +- struct cc_req_mgr_handle *request_mgr_handle = +- drvdata->request_mgr_handle; +- +- /* lock the send_request */ +- spin_lock_bh(&request_mgr_handle->hw_lock); +- if (request_mgr_handle->req_queue_head != +- request_mgr_handle->req_queue_tail) { +- spin_unlock_bh(&request_mgr_handle->hw_lock); +- return -EBUSY; +- } +- request_mgr_handle->is_runtime_suspended = true; +- spin_unlock_bh(&request_mgr_handle->hw_lock); +- +- return 0; +-} +- +-bool cc_req_queue_suspended(struct cc_drvdata *drvdata) +-{ +- struct cc_req_mgr_handle *request_mgr_handle = +- drvdata->request_mgr_handle; +- +- return request_mgr_handle->is_runtime_suspended; +-} +- +-#endif +--- a/drivers/crypto/ccree/cc_request_mgr.h ++++ b/drivers/crypto/ccree/cc_request_mgr.h +@@ -40,12 +40,4 @@ void complete_request(struct cc_drvdata + + void cc_req_mgr_fini(struct cc_drvdata *drvdata); + +-#if defined(CONFIG_PM) +-int cc_resume_req_queue(struct cc_drvdata *drvdata); +- +-int cc_suspend_req_queue(struct cc_drvdata *drvdata); +- +-bool cc_req_queue_suspended(struct cc_drvdata *drvdata); +-#endif +- + #endif /*__REQUEST_MGR_H__*/ diff --git a/queue-5.4/crypto-ccree-fix-pm-wrongful-error-reporting.patch b/queue-5.4/crypto-ccree-fix-pm-wrongful-error-reporting.patch new file mode 100644 index 00000000000..350f724f3f4 --- /dev/null +++ b/queue-5.4/crypto-ccree-fix-pm-wrongful-error-reporting.patch @@ -0,0 +1,32 @@ +From cedca59fae5834af8445b403c66c9953754375d7 Mon Sep 17 00:00:00 2001 +From: Gilad Ben-Yossef +Date: Thu, 16 Jan 2020 12:14:40 +0200 +Subject: crypto: ccree - fix pm wrongful error reporting + +From: Gilad Ben-Yossef + +commit cedca59fae5834af8445b403c66c9953754375d7 upstream. + +pm_runtime_get_sync() can return 1 as a valid (none error) return +code. Treat it as such. + +Signed-off-by: Gilad Ben-Yossef +Cc: stable@vger.kernel.org # v4.19+ +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/ccree/cc_pm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/ccree/cc_pm.c ++++ b/drivers/crypto/ccree/cc_pm.c +@@ -85,7 +85,7 @@ int cc_pm_get(struct device *dev) + else + pm_runtime_get_noresume(dev); + +- return rc; ++ return (rc == 1 ? 0 : rc); + } + + int cc_pm_put_suspend(struct device *dev) diff --git a/queue-5.4/erofs-fix-out-of-bound-read-for-shifted-uncompressed-block.patch b/queue-5.4/erofs-fix-out-of-bound-read-for-shifted-uncompressed-block.patch new file mode 100644 index 00000000000..d88eedcc15b --- /dev/null +++ b/queue-5.4/erofs-fix-out-of-bound-read-for-shifted-uncompressed-block.patch @@ -0,0 +1,61 @@ +From 4d2024370d877f9ac8b98694bcff666da6a5d333 Mon Sep 17 00:00:00 2001 +From: Gao Xiang +Date: Tue, 7 Jan 2020 10:25:46 +0800 +Subject: erofs: fix out-of-bound read for shifted uncompressed block + +From: Gao Xiang + +commit 4d2024370d877f9ac8b98694bcff666da6a5d333 upstream. + +rq->out[1] should be valid before accessing. Otherwise, +in very rare cases, out-of-bound dirty onstack rq->out[1] +can equal to *in and lead to unintended memmove behavior. + +Link: https://lore.kernel.org/r/20200107022546.19432-1-gaoxiang25@huawei.com +Fixes: 7fc45dbc938a ("staging: erofs: introduce generic decompression backend") +Cc: # 5.3+ +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Signed-off-by: Greg Kroah-Hartman + +--- + fs/erofs/decompressor.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +--- a/fs/erofs/decompressor.c ++++ b/fs/erofs/decompressor.c +@@ -306,24 +306,22 @@ static int z_erofs_shifted_transform(con + } + + src = kmap_atomic(*rq->in); +- if (!rq->out[0]) { +- dst = NULL; +- } else { ++ if (rq->out[0]) { + dst = kmap_atomic(rq->out[0]); + memcpy(dst + rq->pageofs_out, src, righthalf); ++ kunmap_atomic(dst); + } + +- if (rq->out[1] == *rq->in) { +- memmove(src, src + righthalf, rq->pageofs_out); +- } else if (nrpages_out == 2) { +- if (dst) +- kunmap_atomic(dst); ++ if (nrpages_out == 2) { + DBG_BUGON(!rq->out[1]); +- dst = kmap_atomic(rq->out[1]); +- memcpy(dst, src + righthalf, rq->pageofs_out); ++ if (rq->out[1] == *rq->in) { ++ memmove(src, src + righthalf, rq->pageofs_out); ++ } else { ++ dst = kmap_atomic(rq->out[1]); ++ memcpy(dst, src + righthalf, rq->pageofs_out); ++ kunmap_atomic(dst); ++ } + } +- if (dst) +- kunmap_atomic(dst); + kunmap_atomic(src); + return 0; + } diff --git a/queue-5.4/fs-allow-deduplication-of-eof-block-into-the-end-of-the-destination-file.patch b/queue-5.4/fs-allow-deduplication-of-eof-block-into-the-end-of-the-destination-file.patch new file mode 100644 index 00000000000..cabee44911a --- /dev/null +++ b/queue-5.4/fs-allow-deduplication-of-eof-block-into-the-end-of-the-destination-file.patch @@ -0,0 +1,68 @@ +From a5e6ea18e3d132be4716eb5fdd520c2c234e3003 Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Mon, 16 Dec 2019 18:26:55 +0000 +Subject: fs: allow deduplication of eof block into the end of the destination file + +From: Filipe Manana + +commit a5e6ea18e3d132be4716eb5fdd520c2c234e3003 upstream. + +We always round down, to a multiple of the filesystem's block size, the +length to deduplicate at generic_remap_check_len(). However this is only +needed if an attempt to deduplicate the last block into the middle of the +destination file is requested, since that leads into a corruption if the +length of the source file is not block size aligned. When an attempt to +deduplicate the last block into the end of the destination file is +requested, we should allow it because it is safe to do it - there's no +stale data exposure and we are prepared to compare the data ranges for +a length not aligned to the block (or page) size - in fact we even do +the data compare before adjusting the deduplication length. + +After btrfs was updated to use the generic helpers from VFS (by commit +34a28e3d77535e ("Btrfs: use generic_remap_file_range_prep() for cloning +and deduplication")) we started to have user reports of deduplication +not reflinking the last block anymore, and whence users getting lower +deduplication scores. The main use case is deduplication of entire +files that have a size not aligned to the block size of the filesystem. + +We already allow cloning the last block to the end (and beyond) of the +destination file, so allow for deduplication as well. + +Link: https://lore.kernel.org/linux-btrfs/2019-1576167349.500456@svIo.N5dq.dFFD/ +CC: stable@vger.kernel.org # 5.1+ +Reviewed-by: Josef Bacik +Reviewed-by: Darrick J. Wong +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/read_write.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/fs/read_write.c ++++ b/fs/read_write.c +@@ -1777,10 +1777,9 @@ static int remap_verify_area(struct file + * else. Assume that the offsets have already been checked for block + * alignment. + * +- * For deduplication we always scale down to the previous block because we +- * can't meaningfully compare post-EOF contents. +- * +- * For clone we only link a partial EOF block above the destination file's EOF. ++ * For clone we only link a partial EOF block above or at the destination file's ++ * EOF. For deduplication we accept a partial EOF block only if it ends at the ++ * destination file's EOF (can not link it into the middle of a file). + * + * Shorten the request if possible. + */ +@@ -1796,8 +1795,7 @@ static int generic_remap_check_len(struc + if ((*len & blkmask) == 0) + return 0; + +- if ((remap_flags & REMAP_FILE_DEDUP) || +- pos_out + *len < i_size_read(inode_out)) ++ if (pos_out + *len < i_size_read(inode_out)) + new_len &= ~blkmask; + + if (new_len == *len) diff --git a/queue-5.4/hv_balloon-balloon-up-according-to-request-page-number.patch b/queue-5.4/hv_balloon-balloon-up-according-to-request-page-number.patch new file mode 100644 index 00000000000..f4d2200536e --- /dev/null +++ b/queue-5.4/hv_balloon-balloon-up-according-to-request-page-number.patch @@ -0,0 +1,77 @@ +From d33c240d47dab4fd15123d9e73fc8810cbc6ed6a Mon Sep 17 00:00:00 2001 +From: Tianyu Lan +Date: Sat, 25 Jan 2020 16:50:47 -0500 +Subject: hv_balloon: Balloon up according to request page number + +From: Tianyu Lan + +commit d33c240d47dab4fd15123d9e73fc8810cbc6ed6a upstream. + +Current code has assumption that balloon request memory size aligns +with 2MB. But actually Hyper-V doesn't guarantee such alignment. When +balloon driver receives non-aligned balloon request, it produces warning +and balloon up more memory than requested in order to keep 2MB alignment. +Remove the warning and balloon up memory according to actual requested +memory size. + +Fixes: f6712238471a ("hv: hv_balloon: avoid memory leak on alloc_error of 2MB memory block") +Cc: stable@vger.kernel.org +Reviewed-by: Vitaly Kuznetsov +Signed-off-by: Tianyu Lan +Reviewed-by: Michael Kelley +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hv/hv_balloon.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +--- a/drivers/hv/hv_balloon.c ++++ b/drivers/hv/hv_balloon.c +@@ -1213,10 +1213,7 @@ static unsigned int alloc_balloon_pages( + unsigned int i, j; + struct page *pg; + +- if (num_pages < alloc_unit) +- return 0; +- +- for (i = 0; (i * alloc_unit) < num_pages; i++) { ++ for (i = 0; i < num_pages / alloc_unit; i++) { + if (bl_resp->hdr.size + sizeof(union dm_mem_page_range) > + PAGE_SIZE) + return i * alloc_unit; +@@ -1254,7 +1251,7 @@ static unsigned int alloc_balloon_pages( + + } + +- return num_pages; ++ return i * alloc_unit; + } + + static void balloon_up(struct work_struct *dummy) +@@ -1269,9 +1266,6 @@ static void balloon_up(struct work_struc + long avail_pages; + unsigned long floor; + +- /* The host balloons pages in 2M granularity. */ +- WARN_ON_ONCE(num_pages % PAGES_IN_2M != 0); +- + /* + * We will attempt 2M allocations. However, if we fail to + * allocate 2M chunks, we will go back to 4k allocations. +@@ -1281,14 +1275,13 @@ static void balloon_up(struct work_struc + avail_pages = si_mem_available(); + floor = compute_balloon_floor(); + +- /* Refuse to balloon below the floor, keep the 2M granularity. */ ++ /* Refuse to balloon below the floor. */ + if (avail_pages < num_pages || avail_pages - num_pages < floor) { + pr_warn("Balloon request will be partially fulfilled. %s\n", + avail_pages < num_pages ? "Not enough memory." : + "Balloon floor reached."); + + num_pages = avail_pages > floor ? (avail_pages - floor) : 0; +- num_pages -= num_pages % PAGES_IN_2M; + } + + while (!done) { diff --git a/queue-5.4/mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch b/queue-5.4/mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch new file mode 100644 index 00000000000..71fc0531721 --- /dev/null +++ b/queue-5.4/mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch @@ -0,0 +1,39 @@ +From dc91c3b6fe66a13ac76f6cb3b2100c0779cd3350 Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Sat, 4 Jan 2020 19:24:08 -0600 +Subject: mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile + +From: Samuel Holland + +commit dc91c3b6fe66a13ac76f6cb3b2100c0779cd3350 upstream. + +On AXP288 and newer PMICs, bit 7 of AXP20X_VBUS_IPSOUT_MGMT can be set +to prevent using the VBUS input. However, when the VBUS unplugged and +plugged back in, the bit automatically resets to zero. + +We need to set the register as volatile to prevent regmap from caching +that bit. Otherwise, regcache will think the bit is already set and not +write the register. + +Fixes: cd53216625a0 ("mfd: axp20x: Fix axp288 volatile ranges") +Cc: stable@vger.kernel.org +Signed-off-by: Samuel Holland +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/axp20x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mfd/axp20x.c ++++ b/drivers/mfd/axp20x.c +@@ -126,7 +126,7 @@ static const struct regmap_range axp288_ + static const struct regmap_range axp288_volatile_ranges[] = { + regmap_reg_range(AXP20X_PWR_INPUT_STATUS, AXP288_POWER_REASON), + regmap_reg_range(AXP288_BC_GLOBAL, AXP288_BC_GLOBAL), +- regmap_reg_range(AXP288_BC_DET_STAT, AXP288_BC_DET_STAT), ++ regmap_reg_range(AXP288_BC_DET_STAT, AXP20X_VBUS_IPSOUT_MGMT), + regmap_reg_range(AXP20X_CHRG_BAK_CTRL, AXP20X_CHRG_BAK_CTRL), + regmap_reg_range(AXP20X_IRQ1_EN, AXP20X_IPSOUT_V_HIGH_L), + regmap_reg_range(AXP20X_TIMER_CTRL, AXP20X_TIMER_CTRL), diff --git a/queue-5.4/nvmem-core-fix-memory-abort-in-cleanup-path.patch b/queue-5.4/nvmem-core-fix-memory-abort-in-cleanup-path.patch new file mode 100644 index 00000000000..6d6e7370346 --- /dev/null +++ b/queue-5.4/nvmem-core-fix-memory-abort-in-cleanup-path.patch @@ -0,0 +1,115 @@ +From 16bb7abc4a6b9defffa294e4dc28383e62a1dbcf Mon Sep 17 00:00:00 2001 +From: Bitan Biswas +Date: Thu, 9 Jan 2020 10:40:17 +0000 +Subject: nvmem: core: fix memory abort in cleanup path + +From: Bitan Biswas + +commit 16bb7abc4a6b9defffa294e4dc28383e62a1dbcf upstream. + +nvmem_cell_info_to_nvmem_cell implementation has static +allocation of name. nvmem_add_cells_from_of() call may +return error and kfree name results in memory abort. Use +kstrdup_const() and kfree_const calls for name alloc and free. + +Unable to handle kernel paging request at virtual address ffffffffffe44888 +Mem abort info: + ESR = 0x96000006 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 +Data abort info: + ISV = 0, ISS = 0x00000006 + CM = 0, WnR = 0 +swapper pgtable: 64k pages, 48-bit VAs, pgdp=00000000815d0000 +[ffffffffffe44888] pgd=0000000081d30803, pud=0000000081d30803, +pmd=0000000000000000 +Internal error: Oops: 96000006 [#1] PREEMPT SMP +Modules linked in: +CPU: 2 PID: 43 Comm: kworker/2:1 Tainted +Hardware name: quill (DT) +Workqueue: events deferred_probe_work_func +pstate: a0000005 (NzCv daif -PAN -UAO) +pc : kfree+0x38/0x278 +lr : nvmem_cell_drop+0x68/0x80 +sp : ffff80001284f9d0 +x29: ffff80001284f9d0 x28: ffff0001f677e830 +x27: ffff800011b0b000 x26: ffff0001c36e1008 +x25: ffff8000112ad000 x24: ffff8000112c9000 +x23: ffffffffffffffea x22: ffff800010adc7f0 +x21: ffffffffffe44880 x20: ffff800011b0b068 +x19: ffff80001122d380 x18: ffffffffffffffff +x17: 00000000d5cb4756 x16: 0000000070b193b8 +x15: ffff8000119538c8 x14: 0720072007200720 +x13: 07200720076e0772 x12: 07750762072d0765 +x11: 0773077507660765 x10: 072f073007300730 +x9 : 0730073207380733 x8 : 0000000000000151 +x7 : 07660765072f0720 x6 : ffff0001c00e0f00 +x5 : 0000000000000000 x4 : ffff0001c0b43800 +x3 : ffff800011b0b068 x2 : 0000000000000000 +x1 : 0000000000000000 x0 : ffffffdfffe00000 +Call trace: + kfree+0x38/0x278 + nvmem_cell_drop+0x68/0x80 + nvmem_device_remove_all_cells+0x2c/0x50 + nvmem_register.part.9+0x520/0x628 + devm_nvmem_register+0x48/0xa0 + tegra_fuse_probe+0x140/0x1f0 + platform_drv_probe+0x50/0xa0 + really_probe+0x108/0x348 + driver_probe_device+0x58/0x100 + __device_attach_driver+0x90/0xb0 + bus_for_each_drv+0x64/0xc8 + __device_attach+0xd8/0x138 + device_initial_probe+0x10/0x18 + bus_probe_device+0x90/0x98 + deferred_probe_work_func+0x74/0xb0 + process_one_work+0x1e0/0x358 + worker_thread+0x208/0x488 + kthread+0x118/0x120 + ret_from_fork+0x10/0x18 +Code: d350feb5 f2dffbe0 aa1e03f6 8b151815 (f94006a0) +---[ end trace 49b1303c6b83198e ]--- + +Fixes: badcdff107cbf ("nvmem: Convert to using %pOFn instead of device_node.name") +Signed-off-by: Bitan Biswas +Cc: stable +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20200109104017.6249-5-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvmem/core.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -110,7 +110,7 @@ static void nvmem_cell_drop(struct nvmem + list_del(&cell->node); + mutex_unlock(&nvmem_mutex); + of_node_put(cell->np); +- kfree(cell->name); ++ kfree_const(cell->name); + kfree(cell); + } + +@@ -137,7 +137,9 @@ static int nvmem_cell_info_to_nvmem_cell + cell->nvmem = nvmem; + cell->offset = info->offset; + cell->bytes = info->bytes; +- cell->name = info->name; ++ cell->name = kstrdup_const(info->name, GFP_KERNEL); ++ if (!cell->name) ++ return -ENOMEM; + + cell->bit_offset = info->bit_offset; + cell->nbits = info->nbits; +@@ -327,7 +329,7 @@ static int nvmem_add_cells_from_of(struc + dev_err(dev, "cell %s unaligned to nvmem stride %d\n", + cell->name, nvmem->stride); + /* Cells already added will be freed later. */ +- kfree(cell->name); ++ kfree_const(cell->name); + kfree(cell); + return -EINVAL; + } diff --git a/queue-5.4/padata-remove-broken-queue-flushing.patch b/queue-5.4/padata-remove-broken-queue-flushing.patch new file mode 100644 index 00000000000..ec5eca5b854 --- /dev/null +++ b/queue-5.4/padata-remove-broken-queue-flushing.patch @@ -0,0 +1,137 @@ +From 07928d9bfc81640bab36f5190e8725894d93b659 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Tue, 19 Nov 2019 13:17:31 +0800 +Subject: padata: Remove broken queue flushing + +From: Herbert Xu + +commit 07928d9bfc81640bab36f5190e8725894d93b659 upstream. + +The function padata_flush_queues is fundamentally broken because +it cannot force padata users to complete the request that is +underway. IOW padata has to passively wait for the completion +of any outstanding work. + +As it stands flushing is used in two places. Its use in padata_stop +is simply unnecessary because nothing depends on the queues to +be flushed afterwards. + +The other use in padata_replace is more substantial as we depend +on it to free the old pd structure. This patch instead uses the +pd->refcnt to dynamically free the pd structure once all requests +are complete. + +Fixes: 2b73b07ab8a4 ("padata: Flush the padata queues actively") +Cc: +Signed-off-by: Herbert Xu +Reviewed-by: Daniel Jordan +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/padata.c | 43 ++++++++++++------------------------------- + 1 file changed, 12 insertions(+), 31 deletions(-) + +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -35,6 +35,8 @@ + + #define MAX_OBJ_NUM 1000 + ++static void padata_free_pd(struct parallel_data *pd); ++ + static int padata_index_to_cpu(struct parallel_data *pd, int cpu_index) + { + int cpu, target_cpu; +@@ -283,6 +285,7 @@ static void padata_serial_worker(struct + struct padata_serial_queue *squeue; + struct parallel_data *pd; + LIST_HEAD(local_list); ++ int cnt; + + local_bh_disable(); + squeue = container_of(serial_work, struct padata_serial_queue, work); +@@ -292,6 +295,8 @@ static void padata_serial_worker(struct + list_replace_init(&squeue->serial.list, &local_list); + spin_unlock(&squeue->serial.lock); + ++ cnt = 0; ++ + while (!list_empty(&local_list)) { + struct padata_priv *padata; + +@@ -301,9 +306,12 @@ static void padata_serial_worker(struct + list_del_init(&padata->list); + + padata->serial(padata); +- atomic_dec(&pd->refcnt); ++ cnt++; + } + local_bh_enable(); ++ ++ if (atomic_sub_and_test(cnt, &pd->refcnt)) ++ padata_free_pd(pd); + } + + /** +@@ -440,7 +448,7 @@ static struct parallel_data *padata_allo + padata_init_squeues(pd); + atomic_set(&pd->seq_nr, -1); + atomic_set(&pd->reorder_objects, 0); +- atomic_set(&pd->refcnt, 0); ++ atomic_set(&pd->refcnt, 1); + spin_lock_init(&pd->lock); + pd->cpu = cpumask_first(pd->cpumask.pcpu); + INIT_WORK(&pd->reorder_work, invoke_padata_reorder); +@@ -466,29 +474,6 @@ static void padata_free_pd(struct parall + kfree(pd); + } + +-/* Flush all objects out of the padata queues. */ +-static void padata_flush_queues(struct parallel_data *pd) +-{ +- int cpu; +- struct padata_parallel_queue *pqueue; +- struct padata_serial_queue *squeue; +- +- for_each_cpu(cpu, pd->cpumask.pcpu) { +- pqueue = per_cpu_ptr(pd->pqueue, cpu); +- flush_work(&pqueue->work); +- } +- +- if (atomic_read(&pd->reorder_objects)) +- padata_reorder(pd); +- +- for_each_cpu(cpu, pd->cpumask.cbcpu) { +- squeue = per_cpu_ptr(pd->squeue, cpu); +- flush_work(&squeue->work); +- } +- +- BUG_ON(atomic_read(&pd->refcnt) != 0); +-} +- + static void __padata_start(struct padata_instance *pinst) + { + pinst->flags |= PADATA_INIT; +@@ -502,10 +487,6 @@ static void __padata_stop(struct padata_ + pinst->flags &= ~PADATA_INIT; + + synchronize_rcu(); +- +- get_online_cpus(); +- padata_flush_queues(pinst->pd); +- put_online_cpus(); + } + + /* Replace the internal control structure with a new one. */ +@@ -526,8 +507,8 @@ static void padata_replace(struct padata + if (!cpumask_equal(pd_old->cpumask.cbcpu, pd_new->cpumask.cbcpu)) + notification_mask |= PADATA_CPU_SERIAL; + +- padata_flush_queues(pd_old); +- padata_free_pd(pd_old); ++ if (atomic_dec_and_test(&pd_old->refcnt)) ++ padata_free_pd(pd_old); + + if (notification_mask) + blocking_notifier_call_chain(&pinst->cpumask_change_notifier, diff --git a/queue-5.4/power-supply-axp20x_ac_power-fix-reporting-online-status.patch b/queue-5.4/power-supply-axp20x_ac_power-fix-reporting-online-status.patch new file mode 100644 index 00000000000..22d3b6cdf36 --- /dev/null +++ b/queue-5.4/power-supply-axp20x_ac_power-fix-reporting-online-status.patch @@ -0,0 +1,106 @@ +From 1c51aad8475d670ad58ae60adc9d32342381df8d Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Sun, 12 Jan 2020 21:53:03 -0600 +Subject: power: supply: axp20x_ac_power: Fix reporting online status + +From: Samuel Holland + +commit 1c51aad8475d670ad58ae60adc9d32342381df8d upstream. + +AXP803/AXP813 have a flag that enables/disables the AC power supply +input. This flag does not affect the status bits in PWR_INPUT_STATUS. +Its effect can be verified by checking the battery charge/discharge +state (bit 2 of PWR_INPUT_STATUS), or by examining the current draw on +the AC input. + +Take this flag into account when getting the ONLINE property of the AC +input, on PMICs where this flag is present. + +Fixes: 7693b5643fd2 ("power: supply: add AC power supply driver for AXP813") +Cc: stable@vger.kernel.org +Signed-off-by: Samuel Holland +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/supply/axp20x_ac_power.c | 31 +++++++++++++++++++++++++------ + 1 file changed, 25 insertions(+), 6 deletions(-) + +--- a/drivers/power/supply/axp20x_ac_power.c ++++ b/drivers/power/supply/axp20x_ac_power.c +@@ -23,6 +23,8 @@ + #define AXP20X_PWR_STATUS_ACIN_PRESENT BIT(7) + #define AXP20X_PWR_STATUS_ACIN_AVAIL BIT(6) + ++#define AXP813_ACIN_PATH_SEL BIT(7) ++ + #define AXP813_VHOLD_MASK GENMASK(5, 3) + #define AXP813_VHOLD_UV_TO_BIT(x) ((((x) / 100000) - 40) << 3) + #define AXP813_VHOLD_REG_TO_UV(x) \ +@@ -40,6 +42,7 @@ struct axp20x_ac_power { + struct power_supply *supply; + struct iio_channel *acin_v; + struct iio_channel *acin_i; ++ bool has_acin_path_sel; + }; + + static irqreturn_t axp20x_ac_power_irq(int irq, void *devid) +@@ -86,6 +89,17 @@ static int axp20x_ac_power_get_property( + return ret; + + val->intval = !!(reg & AXP20X_PWR_STATUS_ACIN_AVAIL); ++ ++ /* ACIN_PATH_SEL disables ACIN even if ACIN_AVAIL is set. */ ++ if (val->intval && power->has_acin_path_sel) { ++ ret = regmap_read(power->regmap, AXP813_ACIN_PATH_CTRL, ++ ®); ++ if (ret) ++ return ret; ++ ++ val->intval = !!(reg & AXP813_ACIN_PATH_SEL); ++ } ++ + return 0; + + case POWER_SUPPLY_PROP_VOLTAGE_NOW: +@@ -224,21 +238,25 @@ static const struct power_supply_desc ax + struct axp_data { + const struct power_supply_desc *power_desc; + bool acin_adc; ++ bool acin_path_sel; + }; + + static const struct axp_data axp20x_data = { +- .power_desc = &axp20x_ac_power_desc, +- .acin_adc = true, ++ .power_desc = &axp20x_ac_power_desc, ++ .acin_adc = true, ++ .acin_path_sel = false, + }; + + static const struct axp_data axp22x_data = { +- .power_desc = &axp22x_ac_power_desc, +- .acin_adc = false, ++ .power_desc = &axp22x_ac_power_desc, ++ .acin_adc = false, ++ .acin_path_sel = false, + }; + + static const struct axp_data axp813_data = { +- .power_desc = &axp813_ac_power_desc, +- .acin_adc = false, ++ .power_desc = &axp813_ac_power_desc, ++ .acin_adc = false, ++ .acin_path_sel = true, + }; + + static int axp20x_ac_power_probe(struct platform_device *pdev) +@@ -282,6 +300,7 @@ static int axp20x_ac_power_probe(struct + } + + power->regmap = dev_get_regmap(pdev->dev.parent, NULL); ++ power->has_acin_path_sel = axp_data->acin_path_sel; + + platform_set_drvdata(pdev, power); + diff --git a/queue-5.4/power-supply-ltc2941-battery-gauge-fix-use-after-free.patch b/queue-5.4/power-supply-ltc2941-battery-gauge-fix-use-after-free.patch new file mode 100644 index 00000000000..faa6146de79 --- /dev/null +++ b/queue-5.4/power-supply-ltc2941-battery-gauge-fix-use-after-free.patch @@ -0,0 +1,41 @@ +From a60ec78d306c6548d4adbc7918b587a723c555cc Mon Sep 17 00:00:00 2001 +From: Sven Van Asbroeck +Date: Thu, 19 Sep 2019 11:11:37 -0400 +Subject: power: supply: ltc2941-battery-gauge: fix use-after-free + +From: Sven Van Asbroeck + +commit a60ec78d306c6548d4adbc7918b587a723c555cc upstream. + +This driver's remove path calls cancel_delayed_work(). +However, that function does not wait until the work function +finishes. This could mean that the work function is still +running after the driver's remove function has finished, +which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +that the work is properly cancelled, no longer running, and +unable to re-schedule itself. + +This issue was detected with the help of Coccinelle. + +Cc: stable +Signed-off-by: Sven Van Asbroeck +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/supply/ltc2941-battery-gauge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/power/supply/ltc2941-battery-gauge.c ++++ b/drivers/power/supply/ltc2941-battery-gauge.c +@@ -449,7 +449,7 @@ static int ltc294x_i2c_remove(struct i2c + { + struct ltc294x_info *info = i2c_get_clientdata(client); + +- cancel_delayed_work(&info->work); ++ cancel_delayed_work_sync(&info->work); + power_supply_unregister(info->supply); + return 0; + } diff --git a/queue-5.4/scripts-find-unused-docs-fix-massive-false-positives.patch b/queue-5.4/scripts-find-unused-docs-fix-massive-false-positives.patch new file mode 100644 index 00000000000..7eb9b7338b5 --- /dev/null +++ b/queue-5.4/scripts-find-unused-docs-fix-massive-false-positives.patch @@ -0,0 +1,41 @@ +From 1630146db2111412e7524d05d812ff8f2c75977e Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 27 Jan 2020 10:31:07 +0100 +Subject: scripts/find-unused-docs: Fix massive false positives + +From: Geert Uytterhoeven + +commit 1630146db2111412e7524d05d812ff8f2c75977e upstream. + +scripts/find-unused-docs.sh invokes scripts/kernel-doc to find out if a +source file contains kerneldoc or not. + +However, as it passes the no longer supported "-text" option to +scripts/kernel-doc, the latter prints out its help text, causing all +files to be considered containing kerneldoc. + +Get rid of these false positives by removing the no longer supported +"-text" option from the scripts/kernel-doc invocation. + +Cc: stable@vger.kernel.org # 4.16+ +Fixes: b05142675310d2ac ("scripts: kernel-doc: get rid of unused output formats") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20200127093107.26401-1-geert+renesas@glider.be +Signed-off-by: Jonathan Corbet +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/find-unused-docs.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/find-unused-docs.sh ++++ b/scripts/find-unused-docs.sh +@@ -54,7 +54,7 @@ for file in `find $1 -name '*.c'`; do + if [[ ${FILES_INCLUDED[$file]+_} ]]; then + continue; + fi +- str=$(scripts/kernel-doc -text -export "$file" 2>/dev/null) ++ str=$(scripts/kernel-doc -export "$file" 2>/dev/null) + if [[ -n "$str" ]]; then + echo "$file" + fi diff --git a/queue-5.4/scsi-megaraid_sas-do-not-initiate-ocr-if-controller-is-not-in-ready-state.patch b/queue-5.4/scsi-megaraid_sas-do-not-initiate-ocr-if-controller-is-not-in-ready-state.patch new file mode 100644 index 00000000000..3a78d68c936 --- /dev/null +++ b/queue-5.4/scsi-megaraid_sas-do-not-initiate-ocr-if-controller-is-not-in-ready-state.patch @@ -0,0 +1,70 @@ +From 6d7537270e3283b92f9b327da9d58a4de40fe8d0 Mon Sep 17 00:00:00 2001 +From: Anand Lodnoor +Date: Tue, 14 Jan 2020 16:51:19 +0530 +Subject: scsi: megaraid_sas: Do not initiate OCR if controller is not in ready state + +From: Anand Lodnoor + +commit 6d7537270e3283b92f9b327da9d58a4de40fe8d0 upstream. + +Driver initiates OCR if a DCMD command times out. But there is a deadlock +if the driver attempts to invoke another OCR before the mutex lock +(reset_mutex) is released from the previous session of OCR. + +This patch takes care of the above scenario using new flag +MEGASAS_FUSION_OCR_NOT_POSSIBLE to indicate if OCR is possible. + +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/1579000882-20246-9-git-send-email-anand.lodnoor@broadcom.com +Signed-off-by: Shivasharan S +Signed-off-by: Anand Lodnoor +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 3 ++- + drivers/scsi/megaraid/megaraid_sas_fusion.c | 3 ++- + drivers/scsi/megaraid/megaraid_sas_fusion.h | 1 + + 3 files changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -4392,7 +4392,8 @@ dcmd_timeout_ocr_possible(struct megasas + if (instance->adapter_type == MFI_SERIES) + return KILL_ADAPTER; + else if (instance->unload || +- test_bit(MEGASAS_FUSION_IN_RESET, &instance->reset_flags)) ++ test_bit(MEGASAS_FUSION_OCR_NOT_POSSIBLE, ++ &instance->reset_flags)) + return IGNORE_TIMEOUT; + else + return INITIATE_OCR; +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -4847,6 +4847,7 @@ int megasas_reset_fusion(struct Scsi_Hos + if (instance->requestorId && !instance->skip_heartbeat_timer_del) + del_timer_sync(&instance->sriov_heartbeat_timer); + set_bit(MEGASAS_FUSION_IN_RESET, &instance->reset_flags); ++ set_bit(MEGASAS_FUSION_OCR_NOT_POSSIBLE, &instance->reset_flags); + atomic_set(&instance->adprecovery, MEGASAS_ADPRESET_SM_POLLING); + instance->instancet->disable_intr(instance); + megasas_sync_irqs((unsigned long)instance); +@@ -5046,7 +5047,7 @@ kill_hba: + instance->skip_heartbeat_timer_del = 1; + retval = FAILED; + out: +- clear_bit(MEGASAS_FUSION_IN_RESET, &instance->reset_flags); ++ clear_bit(MEGASAS_FUSION_OCR_NOT_POSSIBLE, &instance->reset_flags); + mutex_unlock(&instance->reset_mutex); + return retval; + } +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.h ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.h +@@ -89,6 +89,7 @@ enum MR_RAID_FLAGS_IO_SUB_TYPE { + + #define MEGASAS_FP_CMD_LEN 16 + #define MEGASAS_FUSION_IN_RESET 0 ++#define MEGASAS_FUSION_OCR_NOT_POSSIBLE 1 + #define RAID_1_PEER_CMDS 2 + #define JBOD_MAPS_COUNT 2 + #define MEGASAS_REDUCE_QD_COUNT 64 diff --git a/queue-5.4/scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch b/queue-5.4/scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch new file mode 100644 index 00000000000..a0325fc9eb0 --- /dev/null +++ b/queue-5.4/scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch @@ -0,0 +1,37 @@ +From 641e0efddcbde52461e017136acd3ce7f2ef0c14 Mon Sep 17 00:00:00 2001 +From: Quinn Tran +Date: Tue, 17 Dec 2019 14:06:16 -0800 +Subject: scsi: qla2xxx: Fix mtcp dump collection failure + +From: Quinn Tran + +commit 641e0efddcbde52461e017136acd3ce7f2ef0c14 upstream. + +MTCP dump failed due to MB Reg 10 was picking garbage data from stack +memory. + +Fixes: 81178772b636a ("[SCSI] qla2xxx: Implemetation of mctp.") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20191217220617.28084-14-hmadhani@marvell.com +Signed-off-by: Quinn Tran +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_mbx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -6151,9 +6151,8 @@ qla2x00_dump_mctp_data(scsi_qla_host_t * + mcp->mb[7] = LSW(MSD(req_dma)); + mcp->mb[8] = MSW(addr); + /* Setting RAM ID to valid */ +- mcp->mb[10] |= BIT_7; + /* For MCTP RAM ID is 0x40 */ +- mcp->mb[10] |= 0x40; ++ mcp->mb[10] = BIT_7 | 0x40; + + mcp->out_mb |= MBX_10|MBX_8|MBX_7|MBX_6|MBX_5|MBX_4|MBX_3|MBX_2|MBX_1| + MBX_0; diff --git a/queue-5.4/series b/queue-5.4/series index cae50ceaf1f..a993d046d45 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -94,3 +94,22 @@ ubifs-fix-wrong-memory-allocation.patch ubifs-fix-fs_ioc_setflags-unexpectedly-clearing-encrypt-flag.patch ubifs-fix-deadlock-in-concurrent-bulk-read-and-writepage.patch mmc-sdhci-of-at91-fix-memleak-on-clk_get-failure.patch +asoc-sof-core-free-trace-on-errors.patch +hv_balloon-balloon-up-according-to-request-page-number.patch +mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch +nvmem-core-fix-memory-abort-in-cleanup-path.patch +crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch +crypto-ccree-fix-backlog-memory-leak.patch +crypto-ccree-fix-aead-decrypt-auth-fail.patch +crypto-ccree-fix-pm-wrongful-error-reporting.patch +crypto-ccree-fix-fde-descriptor-sequence.patch +crypto-ccree-fix-pm-race-condition.patch +padata-remove-broken-queue-flushing.patch +fs-allow-deduplication-of-eof-block-into-the-end-of-the-destination-file.patch +scripts-find-unused-docs-fix-massive-false-positives.patch +erofs-fix-out-of-bound-read-for-shifted-uncompressed-block.patch +scsi-megaraid_sas-do-not-initiate-ocr-if-controller-is-not-in-ready-state.patch +scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch +cpupower-revert-library-abi-changes-from-commit-ae2917093fb60bdc1ed3e.patch +power-supply-axp20x_ac_power-fix-reporting-online-status.patch +power-supply-ltc2941-battery-gauge-fix-use-after-free.patch -- 2.47.3