From d5eaed9a4f62561243cd009bf62a34ddae273572 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 15 Jun 2020 20:41:37 +0200 Subject: [PATCH] 4.19-stable patches added patches: acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch alsa-es1688-add-the-missed-snd_card_free.patch alsa-hda-realtek-add-a-pintbl-quirk-for-several-lenovo-machines.patch alsa-usb-audio-add-vendor-product-and-profile-name-for-hp-thunderbolt-dock.patch alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch cgroup-blkcg-prepare-some-symbols-for-module-and-config_cgroup-usages.patch nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch pm-runtime-clk-fix-clk_pm_runtime_get-error-path.patch spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch spi-bcm2835aux-fix-controller-unregister-order.patch spi-dw-fix-controller-unregister-order.patch --- ...nt-leak-in-acpi_cppc_processor_probe.patch | 34 ++++ ...upport-for-_exx-_lxx-handler-methods.patch | 68 ++++++++ ...r-resources-if-there-are-none-for-d0.patch | 121 +++++++++++++ ...ak-in-acpi_sysfs_add_hotplug_profile.patch | 37 ++++ ...-es1688-add-the-missed-snd_card_free.patch | 37 ++++ ...bl-quirk-for-several-lenovo-machines.patch | 39 +++++ ...profile-name-for-hp-thunderbolt-dock.patch | 52 ++++++ ...onsistent-card-pm-state-after-resume.patch | 126 ++++++++++++++ ...-for-module-and-config_cgroup-usages.patch | 35 ++++ ...-x86-fix-apic-page-invalidation-race.patch | 163 ------------------ ...erence-at-nilfs_segctor_do_construct.patch | 67 +++++++ ...lk-fix-clk_pm_runtime_get-error-path.patch | 42 +++++ queue-4.19/series | 15 +- ...i-when-tx-rx-buffer-is-null-set-to-0.patch | 62 +++++++ ...5aux-fix-controller-unregister-order.patch | 62 +++++++ ...i-dw-fix-controller-unregister-order.patch | 65 +++++++ 16 files changed, 861 insertions(+), 164 deletions(-) create mode 100644 queue-4.19/acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch create mode 100644 queue-4.19/acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch create mode 100644 queue-4.19/acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch create mode 100644 queue-4.19/acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch create mode 100644 queue-4.19/alsa-es1688-add-the-missed-snd_card_free.patch create mode 100644 queue-4.19/alsa-hda-realtek-add-a-pintbl-quirk-for-several-lenovo-machines.patch create mode 100644 queue-4.19/alsa-usb-audio-add-vendor-product-and-profile-name-for-hp-thunderbolt-dock.patch create mode 100644 queue-4.19/alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch create mode 100644 queue-4.19/cgroup-blkcg-prepare-some-symbols-for-module-and-config_cgroup-usages.patch delete mode 100644 queue-4.19/kvm-x86-fix-apic-page-invalidation-race.patch create mode 100644 queue-4.19/nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch create mode 100644 queue-4.19/pm-runtime-clk-fix-clk_pm_runtime_get-error-path.patch create mode 100644 queue-4.19/spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch create mode 100644 queue-4.19/spi-bcm2835aux-fix-controller-unregister-order.patch create mode 100644 queue-4.19/spi-dw-fix-controller-unregister-order.patch diff --git a/queue-4.19/acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch b/queue-4.19/acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch new file mode 100644 index 00000000000..3fa01c561f2 --- /dev/null +++ b/queue-4.19/acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch @@ -0,0 +1,34 @@ +From 4d8be4bc94f74bb7d096e1c2e44457b530d5a170 Mon Sep 17 00:00:00 2001 +From: Qiushi Wu +Date: Wed, 27 May 2020 17:35:51 -0500 +Subject: ACPI: CPPC: Fix reference count leak in acpi_cppc_processor_probe() + +From: Qiushi Wu + +commit 4d8be4bc94f74bb7d096e1c2e44457b530d5a170 upstream. + +kobject_init_and_add() takes reference even when it fails. +If this function returns an error, kobject_put() must be called to +properly clean up the memory associated with the object. Previous +commit "b8eb718348b8" fixed a similar problem. + +Fixes: 158c998ea44b ("ACPI / CPPC: add sysfs support to compute delivered performance") +Signed-off-by: Qiushi Wu +Cc: 4.10+ # 4.10+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/cppc_acpi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -869,6 +869,7 @@ int acpi_cppc_processor_probe(struct acp + "acpi_cppc"); + if (ret) { + per_cpu(cpc_desc_ptr, pr->id) = NULL; ++ kobject_put(&cpc_ptr->kobj); + goto out_free; + } + diff --git a/queue-4.19/acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch b/queue-4.19/acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch new file mode 100644 index 00000000000..84929c70d25 --- /dev/null +++ b/queue-4.19/acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch @@ -0,0 +1,68 @@ +From ea6f3af4c5e63f6981c0b0ab8ebec438e2d5ef40 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Fri, 15 May 2020 11:36:13 +0200 +Subject: ACPI: GED: add support for _Exx / _Lxx handler methods + +From: Ard Biesheuvel + +commit ea6f3af4c5e63f6981c0b0ab8ebec438e2d5ef40 upstream. + +Per the ACPI spec, interrupts in the range [0, 255] may be handled +in AML using individual methods whose naming is based on the format +_Exx or _Lxx, where xx is the hex representation of the interrupt +index. + +Add support for this missing feature to our ACPI GED driver. + +Cc: v4.9+ # v4.9+ +Signed-off-by: Ard Biesheuvel +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/evged.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +--- a/drivers/acpi/evged.c ++++ b/drivers/acpi/evged.c +@@ -88,6 +88,8 @@ static acpi_status acpi_ged_request_inte + struct resource r; + struct acpi_resource_irq *p = &ares->data.irq; + struct acpi_resource_extended_irq *pext = &ares->data.extended_irq; ++ char ev_name[5]; ++ u8 trigger; + + if (ares->type == ACPI_RESOURCE_TYPE_END_TAG) + return AE_OK; +@@ -96,14 +98,28 @@ static acpi_status acpi_ged_request_inte + dev_err(dev, "unable to parse IRQ resource\n"); + return AE_ERROR; + } +- if (ares->type == ACPI_RESOURCE_TYPE_IRQ) ++ if (ares->type == ACPI_RESOURCE_TYPE_IRQ) { + gsi = p->interrupts[0]; +- else ++ trigger = p->triggering; ++ } else { + gsi = pext->interrupts[0]; ++ trigger = p->triggering; ++ } + + irq = r.start; + +- if (ACPI_FAILURE(acpi_get_handle(handle, "_EVT", &evt_handle))) { ++ switch (gsi) { ++ case 0 ... 255: ++ sprintf(ev_name, "_%c%02hhX", ++ trigger == ACPI_EDGE_SENSITIVE ? 'E' : 'L', gsi); ++ ++ if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle))) ++ break; ++ /* fall through */ ++ default: ++ if (ACPI_SUCCESS(acpi_get_handle(handle, "_EVT", &evt_handle))) ++ break; ++ + dev_err(dev, "cannot locate _EVT method\n"); + return AE_ERROR; + } diff --git a/queue-4.19/acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch b/queue-4.19/acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch new file mode 100644 index 00000000000..7988f341ca2 --- /dev/null +++ b/queue-4.19/acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch @@ -0,0 +1,121 @@ +From 956ad9d98b73f59e442cc119c98ba1e04e94fe6d Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 4 Jun 2020 19:22:26 +0200 +Subject: ACPI: PM: Avoid using power resources if there are none for D0 + +From: Rafael J. Wysocki + +commit 956ad9d98b73f59e442cc119c98ba1e04e94fe6d upstream. + +As recently reported, some platforms provide a list of power +resources for device power state D3hot, through the _PR3 object, +but they do not provide a list of power resources for device power +state D0. + +Among other things, this causes acpi_device_get_power() to return +D3hot as the current state of the device in question if all of the +D3hot power resources are "on", because it sees the power_resources +flag set and calls acpi_power_get_inferred_state() which finds that +D3hot is the shallowest power state with all of the associated power +resources turned "on", so that's what it returns. Moreover, that +value takes precedence over the acpi_dev_pm_explicit_get() return +value, because it means a deeper power state. The device may very +well be in D0 physically at that point, however. + +Moreover, the presence of _PR3 without _PR0 for a given device +means that only one D3-level power state can be supported by it. +Namely, because there are no power resources to turn "off" when +transitioning the device from D0 into D3cold (which should be +supported since _PR3 is present), the evaluation of _PS3 should +be sufficient to put it straight into D3cold, but this means that +the effect of turning "on" the _PR3 power resources is unclear, +so it is better to avoid doing that altogether. Consequently, +there is no practical way do distinguish D3cold from D3hot for +the device in question and the power states of it can be labeled +so that D3hot is the deepest supported one (and Linux assumes +that putting a device into D3hot via ACPI may cause power to be +removed from it anyway, for legacy reasons). + +To work around the problem described above modify the ACPI +enumeration of devices so that power resources are only used +for device power management if the list of D0 power resources +is not empty and make it mart D3cold as supported only if that +is the case and the D3hot list of power resources is not empty +too. + +Fixes: ef85bdbec444 ("ACPI / scan: Consolidate extraction of power resources lists") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=205057 +Link: https://lore.kernel.org/linux-acpi/20200603194659.185757-1-hdegoede@redhat.com/ +Reported-by: Hans de Goede +Tested-by: Hans de Goede +Tested-by: youling257@gmail.com +Cc: 3.10+ # 3.10+ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/device_pm.c | 2 +- + drivers/acpi/scan.c | 28 +++++++++++++++++++--------- + 2 files changed, 20 insertions(+), 10 deletions(-) + +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -172,7 +172,7 @@ int acpi_device_set_power(struct acpi_de + * possibly drop references to the power resources in use. + */ + state = ACPI_STATE_D3_HOT; +- /* If _PR3 is not available, use D3hot as the target state. */ ++ /* If D3cold is not supported, use D3hot as the target state. */ + if (!device->power.states[ACPI_STATE_D3_COLD].flags.valid) + target_state = state; + } else if (!device->power.states[state].flags.valid) { +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -921,12 +921,9 @@ static void acpi_bus_init_power_state(st + + if (buffer.length && package + && package->type == ACPI_TYPE_PACKAGE +- && package->package.count) { +- int err = acpi_extract_power_resources(package, 0, +- &ps->resources); +- if (!err) +- device->power.flags.power_resources = 1; +- } ++ && package->package.count) ++ acpi_extract_power_resources(package, 0, &ps->resources); ++ + ACPI_FREE(buffer.pointer); + } + +@@ -973,14 +970,27 @@ static void acpi_bus_get_power_flags(str + acpi_bus_init_power_state(device, i); + + INIT_LIST_HEAD(&device->power.states[ACPI_STATE_D3_COLD].resources); +- if (!list_empty(&device->power.states[ACPI_STATE_D3_HOT].resources)) +- device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1; + +- /* Set defaults for D0 and D3hot states (always valid) */ ++ /* Set the defaults for D0 and D3hot (always supported). */ + device->power.states[ACPI_STATE_D0].flags.valid = 1; + device->power.states[ACPI_STATE_D0].power = 100; + device->power.states[ACPI_STATE_D3_HOT].flags.valid = 1; + ++ /* ++ * Use power resources only if the D0 list of them is populated, because ++ * some platforms may provide _PR3 only to indicate D3cold support and ++ * in those cases the power resources list returned by it may be bogus. ++ */ ++ if (!list_empty(&device->power.states[ACPI_STATE_D0].resources)) { ++ device->power.flags.power_resources = 1; ++ /* ++ * D3cold is supported if the D3hot list of power resources is ++ * not empty. ++ */ ++ if (!list_empty(&device->power.states[ACPI_STATE_D3_HOT].resources)) ++ device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1; ++ } ++ + if (acpi_bus_init_power(device)) + device->flags.power_manageable = 0; + } diff --git a/queue-4.19/acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch b/queue-4.19/acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch new file mode 100644 index 00000000000..e079dd85aaf --- /dev/null +++ b/queue-4.19/acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch @@ -0,0 +1,37 @@ +From 6e6c25283dff866308c87b49434c7dbad4774cc0 Mon Sep 17 00:00:00 2001 +From: Qiushi Wu +Date: Wed, 27 May 2020 16:17:17 -0500 +Subject: ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile() + +From: Qiushi Wu + +commit 6e6c25283dff866308c87b49434c7dbad4774cc0 upstream. + +kobject_init_and_add() takes reference even when it fails. +Thus, when kobject_init_and_add() returns an error, +kobject_put() must be called to properly clean up the kobject. + +Fixes: 3f8055c35836 ("ACPI / hotplug: Introduce user space interface for hotplug profiles") +Signed-off-by: Qiushi Wu +Cc: 3.10+ # 3.10+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/sysfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/sysfs.c ++++ b/drivers/acpi/sysfs.c +@@ -990,8 +990,10 @@ void acpi_sysfs_add_hotplug_profile(stru + + error = kobject_init_and_add(&hotplug->kobj, + &acpi_hotplug_profile_ktype, hotplug_kobj, "%s", name); +- if (error) ++ if (error) { ++ kobject_put(&hotplug->kobj); + goto err_out; ++ } + + kobject_uevent(&hotplug->kobj, KOBJ_ADD); + return; diff --git a/queue-4.19/alsa-es1688-add-the-missed-snd_card_free.patch b/queue-4.19/alsa-es1688-add-the-missed-snd_card_free.patch new file mode 100644 index 00000000000..5db95797dc5 --- /dev/null +++ b/queue-4.19/alsa-es1688-add-the-missed-snd_card_free.patch @@ -0,0 +1,37 @@ +From d9b8fbf15d05350b36081eddafcf7b15aa1add50 Mon Sep 17 00:00:00 2001 +From: Chuhong Yuan +Date: Wed, 3 Jun 2020 17:24:59 +0800 +Subject: ALSA: es1688: Add the missed snd_card_free() + +From: Chuhong Yuan + +commit d9b8fbf15d05350b36081eddafcf7b15aa1add50 upstream. + +snd_es968_pnp_detect() misses a snd_card_free() in a failed path. +Add the missed function call to fix it. + +Fixes: a20971b201ac ("ALSA: Merge es1688 and es968 drivers") +Signed-off-by: Chuhong Yuan +Cc: +Link: https://lore.kernel.org/r/20200603092459.1424093-1-hslester96@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/isa/es1688/es1688.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/isa/es1688/es1688.c ++++ b/sound/isa/es1688/es1688.c +@@ -282,8 +282,10 @@ static int snd_es968_pnp_detect(struct p + return error; + } + error = snd_es1688_probe(card, dev); +- if (error < 0) ++ if (error < 0) { ++ snd_card_free(card); + return error; ++ } + pnp_set_card_drvdata(pcard, card); + snd_es968_pnp_is_probed = 1; + return 0; diff --git a/queue-4.19/alsa-hda-realtek-add-a-pintbl-quirk-for-several-lenovo-machines.patch b/queue-4.19/alsa-hda-realtek-add-a-pintbl-quirk-for-several-lenovo-machines.patch new file mode 100644 index 00000000000..3d490a55249 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-add-a-pintbl-quirk-for-several-lenovo-machines.patch @@ -0,0 +1,39 @@ +From 573fcbfd319ccef26caa3700320242accea7fd5c Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Mon, 8 Jun 2020 19:55:41 +0800 +Subject: ALSA: hda/realtek - add a pintbl quirk for several Lenovo machines + +From: Hui Wang + +commit 573fcbfd319ccef26caa3700320242accea7fd5c upstream. + +A couple of Lenovo ThinkCentre machines all have 2 front mics and they +use the same codec alc623 and have the same pin config, so add a +pintbl entry for those machines to apply the fixup +ALC283_FIXUP_HEADSET_MIC. + +Cc: +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20200608115541.9531-1-hui.wang@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7694,6 +7694,12 @@ static const struct snd_hda_pin_quirk al + ALC225_STANDARD_PINS, + {0x12, 0xb7a60130}, + {0x17, 0x90170110}), ++ SND_HDA_PIN_QUIRK(0x10ec0623, 0x17aa, "Lenovo", ALC283_FIXUP_HEADSET_MIC, ++ {0x14, 0x01014010}, ++ {0x17, 0x90170120}, ++ {0x18, 0x02a11030}, ++ {0x19, 0x02a1103f}, ++ {0x21, 0x0221101f}), + {} + }; + diff --git a/queue-4.19/alsa-usb-audio-add-vendor-product-and-profile-name-for-hp-thunderbolt-dock.patch b/queue-4.19/alsa-usb-audio-add-vendor-product-and-profile-name-for-hp-thunderbolt-dock.patch new file mode 100644 index 00000000000..38c9abf90c6 --- /dev/null +++ b/queue-4.19/alsa-usb-audio-add-vendor-product-and-profile-name-for-hp-thunderbolt-dock.patch @@ -0,0 +1,52 @@ +From 0c5086f5699906ec8e31ea6509239489f060f2dc Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Mon, 8 Jun 2020 14:26:28 +0800 +Subject: ALSA: usb-audio: Add vendor, product and profile name for HP Thunderbolt Dock + +From: Kai-Heng Feng + +commit 0c5086f5699906ec8e31ea6509239489f060f2dc upstream. + +The HP Thunderbolt Dock has two separate USB devices, one is for speaker +and one is for headset. Add names for them so userspace can apply UCM +settings. + +Signed-off-by: Kai-Heng Feng +Cc: +Link: https://lore.kernel.org/r/20200608062630.10806-1-kai.heng.feng@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks-table.h | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -39,6 +39,26 @@ + .idProduct = prod, \ + .bInterfaceClass = USB_CLASS_VENDOR_SPEC + ++/* HP Thunderbolt Dock Audio Headset */ ++{ ++ USB_DEVICE(0x03f0, 0x0269), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .vendor_name = "HP", ++ .product_name = "Thunderbolt Dock Audio Headset", ++ .profile_name = "HP-Thunderbolt-Dock-Audio-Headset", ++ .ifnum = QUIRK_NO_INTERFACE ++ } ++}, ++/* HP Thunderbolt Dock Audio Module */ ++{ ++ USB_DEVICE(0x03f0, 0x0567), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .vendor_name = "HP", ++ .product_name = "Thunderbolt Dock Audio Module", ++ .profile_name = "HP-Thunderbolt-Dock-Audio-Module", ++ .ifnum = QUIRK_NO_INTERFACE ++ } ++}, + /* FTDI devices */ + { + USB_DEVICE(0x0403, 0xb8d8), diff --git a/queue-4.19/alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch b/queue-4.19/alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch new file mode 100644 index 00000000000..30fa20d68a7 --- /dev/null +++ b/queue-4.19/alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch @@ -0,0 +1,126 @@ +From 862b2509d157c629dd26d7ac6c6cdbf043d332eb Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 3 Jun 2020 17:37:08 +0200 +Subject: ALSA: usb-audio: Fix inconsistent card PM state after resume + +From: Takashi Iwai + +commit 862b2509d157c629dd26d7ac6c6cdbf043d332eb upstream. + +When a USB-audio interface gets runtime-suspended via auto-pm feature, +the driver suspends all functionality and increment +chip->num_suspended_intf. Later on, when the system gets suspended to +S3, the driver increments chip->num_suspended_intf again, skips the +device changes, and sets the card power state to +SNDRV_CTL_POWER_D3hot. In return, when the system gets resumed from +S3, the resume callback decrements chip->num_suspended_intf. Since +this refcount is still not zero (it's been runtime-suspended), the +whole resume is skipped. But there is a small pitfall here. + +The problem is that the driver doesn't restore the card power state +after this resume call, leaving it as SNDRV_CTL_POWER_D3hot. So, +even after the system resume finishes, the card instance still appears +as if it were system-suspended, and this confuses many ioctl accesses +that are blocked unexpectedly. + +In details, we have two issues behind the scene: one is that the card +power state is changed only when the refcount becomes zero, and +another is that the prior auto-suspend check is kept in a boolean +flag. Although the latter problem is almost negligible since the +auto-pm feature is imposed only on the primary interface, but this can +be a potential problem on the devices with multiple interfaces. + +This patch addresses those issues by the following: + +- Replace chip->autosuspended boolean flag with chip->system_suspend + counter + +- At the first system-suspend, chip->num_suspended_intf is recorded to + chip->system_suspend + +- At system-resume, the card power state is restored when the + chip->num_suspended_intf refcount reaches to chip->system_suspend, + i.e. the state returns to the auto-suspended + +Also, the patch fixes yet another hidden problem by the code +refactoring along with the fixes above: namely, when some resume +procedure failed, the driver left chip->num_suspended_intf that was +already decreased, and it might lead to the refcount unbalance. +In the new code, the refcount decrement is done after the whole resume +procedure, and the problem is avoided as well. + +Fixes: 0662292aec05 ("ALSA: usb-audio: Handle normal and auto-suspend equally") +Reported-and-tested-by: Macpaul Lin +Cc: +Link: https://lore.kernel.org/r/20200603153709.6293-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/card.c | 19 ++++++++++++------- + sound/usb/usbaudio.h | 2 +- + 2 files changed, 13 insertions(+), 8 deletions(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -806,9 +806,6 @@ static int usb_audio_suspend(struct usb_ + if (chip == (void *)-1L) + return 0; + +- chip->autosuspended = !!PMSG_IS_AUTO(message); +- if (!chip->autosuspended) +- snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot); + if (!chip->num_suspended_intf++) { + list_for_each_entry(as, &chip->pcm_list, list) { + snd_pcm_suspend_all(as->pcm); +@@ -822,6 +819,11 @@ static int usb_audio_suspend(struct usb_ + snd_usb_mixer_suspend(mixer); + } + ++ if (!PMSG_IS_AUTO(message) && !chip->system_suspend) { ++ snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot); ++ chip->system_suspend = chip->num_suspended_intf; ++ } ++ + return 0; + } + +@@ -835,10 +837,10 @@ static int __usb_audio_resume(struct usb + + if (chip == (void *)-1L) + return 0; +- if (--chip->num_suspended_intf) +- return 0; + + atomic_inc(&chip->active); /* avoid autopm */ ++ if (chip->num_suspended_intf > 1) ++ goto out; + + list_for_each_entry(as, &chip->pcm_list, list) { + err = snd_usb_pcm_resume(as); +@@ -860,9 +862,12 @@ static int __usb_audio_resume(struct usb + snd_usbmidi_resume(p); + } + +- if (!chip->autosuspended) ++ out: ++ if (chip->num_suspended_intf == chip->system_suspend) { + snd_power_change_state(chip->card, SNDRV_CTL_POWER_D0); +- chip->autosuspended = 0; ++ chip->system_suspend = 0; ++ } ++ chip->num_suspended_intf--; + + err_out: + atomic_dec(&chip->active); /* allow autopm after this point */ +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -37,7 +37,7 @@ struct snd_usb_audio { + struct usb_interface *pm_intf; + u32 usb_id; + struct mutex mutex; +- unsigned int autosuspended:1; ++ unsigned int system_suspend; + atomic_t active; + atomic_t shutdown; + atomic_t usage_count; diff --git a/queue-4.19/cgroup-blkcg-prepare-some-symbols-for-module-and-config_cgroup-usages.patch b/queue-4.19/cgroup-blkcg-prepare-some-symbols-for-module-and-config_cgroup-usages.patch new file mode 100644 index 00000000000..b5f187f0940 --- /dev/null +++ b/queue-4.19/cgroup-blkcg-prepare-some-symbols-for-module-and-config_cgroup-usages.patch @@ -0,0 +1,35 @@ +From 9b0eb69b75bccada2d341d7e7ca342f0cb1c9a6a Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Thu, 27 Jun 2019 13:39:48 -0700 +Subject: cgroup, blkcg: Prepare some symbols for module and !CONFIG_CGROUP usages + +From: Tejun Heo + +commit 9b0eb69b75bccada2d341d7e7ca342f0cb1c9a6a upstream. + +btrfs is going to use css_put() and wbc helpers to improve cgroup +writeback support. Add dummy css_get() definition and export wbc +helpers to prepare for module and !CONFIG_CGROUP builds. + +[only backport the export of __inode_attach_wb for stable kernels - gregkh] + +Reported-by: kbuild test robot +Reviewed-by: Jan Kara +Signed-off-by: Tejun Heo +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fs-writeback.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -269,6 +269,7 @@ void __inode_attach_wb(struct inode *ino + if (unlikely(cmpxchg(&inode->i_wb, NULL, wb))) + wb_put(wb); + } ++EXPORT_SYMBOL_GPL(__inode_attach_wb); + + /** + * locked_inode_to_wb_and_lock_list - determine a locked inode's wb and lock it diff --git a/queue-4.19/kvm-x86-fix-apic-page-invalidation-race.patch b/queue-4.19/kvm-x86-fix-apic-page-invalidation-race.patch deleted file mode 100644 index 4f0c8b80cea..00000000000 --- a/queue-4.19/kvm-x86-fix-apic-page-invalidation-race.patch +++ /dev/null @@ -1,163 +0,0 @@ -From e649b3f0188f8fd34dd0dde8d43fd3312b902fb2 Mon Sep 17 00:00:00 2001 -From: Eiichi Tsukata -Date: Sat, 6 Jun 2020 13:26:27 +0900 -Subject: KVM: x86: Fix APIC page invalidation race - -From: Eiichi Tsukata - -commit e649b3f0188f8fd34dd0dde8d43fd3312b902fb2 upstream. - -Commit b1394e745b94 ("KVM: x86: fix APIC page invalidation") tried -to fix inappropriate APIC page invalidation by re-introducing arch -specific kvm_arch_mmu_notifier_invalidate_range() and calling it from -kvm_mmu_notifier_invalidate_range_start. However, the patch left a -possible race where the VMCS APIC address cache is updated *before* -it is unmapped: - - (Invalidator) kvm_mmu_notifier_invalidate_range_start() - (Invalidator) kvm_make_all_cpus_request(kvm, KVM_REQ_APIC_PAGE_RELOAD) - (KVM VCPU) vcpu_enter_guest() - (KVM VCPU) kvm_vcpu_reload_apic_access_page() - (Invalidator) actually unmap page - -Because of the above race, there can be a mismatch between the -host physical address stored in the APIC_ACCESS_PAGE VMCS field and -the host physical address stored in the EPT entry for the APIC GPA -(0xfee0000). When this happens, the processor will not trap APIC -accesses, and will instead show the raw contents of the APIC-access page. -Because Windows OS periodically checks for unexpected modifications to -the LAPIC register, this will show up as a BSOD crash with BugCheck -CRITICAL_STRUCTURE_CORRUPTION (109) we are currently seeing in -https://bugzilla.redhat.com/show_bug.cgi?id=1751017. - -The root cause of the issue is that kvm_arch_mmu_notifier_invalidate_range() -cannot guarantee that no additional references are taken to the pages in -the range before kvm_mmu_notifier_invalidate_range_end(). Fortunately, -this case is supported by the MMU notifier API, as documented in -include/linux/mmu_notifier.h: - - * If the subsystem - * can't guarantee that no additional references are taken to - * the pages in the range, it has to implement the - * invalidate_range() notifier to remove any references taken - * after invalidate_range_start(). - -The fix therefore is to reload the APIC-access page field in the VMCS -from kvm_mmu_notifier_invalidate_range() instead of ..._range_start(). - -Cc: stable@vger.kernel.org -Fixes: b1394e745b94 ("KVM: x86: fix APIC page invalidation") -Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=197951 -Signed-off-by: Eiichi Tsukata -Message-Id: <20200606042627.61070-1-eiichi.tsukata@nutanix.com> -Signed-off-by: Paolo Bonzini -Signed-off-by: Greg Kroah-Hartman - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index c26dd1363151..24de847af52e 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -8270,9 +8270,8 @@ static void vcpu_load_eoi_exitmap(struct kvm_vcpu *vcpu) - kvm_x86_ops.load_eoi_exitmap(vcpu, eoi_exit_bitmap); - } - --int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, -- unsigned long start, unsigned long end, -- bool blockable) -+void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, -+ unsigned long start, unsigned long end) - { - unsigned long apic_address; - -@@ -8283,8 +8282,6 @@ int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, - apic_address = gfn_to_hva(kvm, APIC_DEFAULT_PHYS_BASE >> PAGE_SHIFT); - if (start <= apic_address && apic_address < end) - kvm_make_all_cpus_request(kvm, KVM_REQ_APIC_PAGE_RELOAD); -- -- return 0; - } - - void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu) -diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h -index d38d6b9c24be..e2f82131bb3e 100644 ---- a/include/linux/kvm_host.h -+++ b/include/linux/kvm_host.h -@@ -1420,8 +1420,8 @@ static inline long kvm_arch_vcpu_async_ioctl(struct file *filp, - } - #endif /* CONFIG_HAVE_KVM_VCPU_ASYNC_IOCTL */ - --int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, -- unsigned long start, unsigned long end, bool blockable); -+void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, -+ unsigned long start, unsigned long end); - - #ifdef CONFIG_HAVE_KVM_VCPU_RUN_PID_CHANGE - int kvm_arch_vcpu_run_pid_change(struct kvm_vcpu *vcpu); -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index 4db151f6101e..7b6013f2ba19 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -155,10 +155,9 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm); - static unsigned long long kvm_createvm_count; - static unsigned long long kvm_active_vms; - --__weak int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, -- unsigned long start, unsigned long end, bool blockable) -+__weak void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, -+ unsigned long start, unsigned long end) - { -- return 0; - } - - bool kvm_is_zone_device_pfn(kvm_pfn_t pfn) -@@ -384,6 +383,18 @@ static inline struct kvm *mmu_notifier_to_kvm(struct mmu_notifier *mn) - return container_of(mn, struct kvm, mmu_notifier); - } - -+static void kvm_mmu_notifier_invalidate_range(struct mmu_notifier *mn, -+ struct mm_struct *mm, -+ unsigned long start, unsigned long end) -+{ -+ struct kvm *kvm = mmu_notifier_to_kvm(mn); -+ int idx; -+ -+ idx = srcu_read_lock(&kvm->srcu); -+ kvm_arch_mmu_notifier_invalidate_range(kvm, start, end); -+ srcu_read_unlock(&kvm->srcu, idx); -+} -+ - static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn, - struct mm_struct *mm, - unsigned long address, -@@ -408,7 +419,6 @@ static int kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn, - { - struct kvm *kvm = mmu_notifier_to_kvm(mn); - int need_tlb_flush = 0, idx; -- int ret; - - idx = srcu_read_lock(&kvm->srcu); - spin_lock(&kvm->mmu_lock); -@@ -425,14 +435,9 @@ static int kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn, - kvm_flush_remote_tlbs(kvm); - - spin_unlock(&kvm->mmu_lock); -- -- ret = kvm_arch_mmu_notifier_invalidate_range(kvm, range->start, -- range->end, -- mmu_notifier_range_blockable(range)); -- - srcu_read_unlock(&kvm->srcu, idx); - -- return ret; -+ return 0; - } - - static void kvm_mmu_notifier_invalidate_range_end(struct mmu_notifier *mn, -@@ -538,6 +543,7 @@ static void kvm_mmu_notifier_release(struct mmu_notifier *mn, - } - - static const struct mmu_notifier_ops kvm_mmu_notifier_ops = { -+ .invalidate_range = kvm_mmu_notifier_invalidate_range, - .invalidate_range_start = kvm_mmu_notifier_invalidate_range_start, - .invalidate_range_end = kvm_mmu_notifier_invalidate_range_end, - .clear_flush_young = kvm_mmu_notifier_clear_flush_young, diff --git a/queue-4.19/nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch b/queue-4.19/nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch new file mode 100644 index 00000000000..219c71ee4d2 --- /dev/null +++ b/queue-4.19/nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch @@ -0,0 +1,67 @@ +From 8301c719a2bd131436438e49130ee381d30933f5 Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Wed, 10 Jun 2020 18:41:35 -0700 +Subject: nilfs2: fix null pointer dereference at nilfs_segctor_do_construct() + +From: Ryusuke Konishi + +commit 8301c719a2bd131436438e49130ee381d30933f5 upstream. + +After commit c3aab9a0bd91 ("mm/filemap.c: don't initiate writeback if +mapping has no dirty pages"), the following null pointer dereference has +been reported on nilfs2: + + BUG: kernel NULL pointer dereference, address: 00000000000000a8 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] SMP PTI + ... + RIP: 0010:percpu_counter_add_batch+0xa/0x60 + ... + Call Trace: + __test_set_page_writeback+0x2d3/0x330 + nilfs_segctor_do_construct+0x10d3/0x2110 [nilfs2] + nilfs_segctor_construct+0x168/0x260 [nilfs2] + nilfs_segctor_thread+0x127/0x3b0 [nilfs2] + kthread+0xf8/0x130 + ... + +This crash turned out to be caused by set_page_writeback() call for +segment summary buffers at nilfs_segctor_prepare_write(). + +set_page_writeback() can call inc_wb_stat(inode_to_wb(inode), +WB_WRITEBACK) where inode_to_wb(inode) is NULL if the inode of +underlying block device does not have an associated wb. + +This fixes the issue by calling inode_attach_wb() in advance to ensure +to associate the bdev inode with its wb. + +Fixes: c3aab9a0bd91 ("mm/filemap.c: don't initiate writeback if mapping has no dirty pages") +Reported-by: Walton Hoops +Reported-by: Tomas Hlavaty +Reported-by: ARAI Shun-ichi +Reported-by: Hideki EIRAKU +Signed-off-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Tested-by: Ryusuke Konishi +Cc: [5.4+] +Link: http://lkml.kernel.org/r/20200608.011819.1399059588922299158.konishi.ryusuke@gmail.com +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/segment.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -2780,6 +2780,8 @@ int nilfs_attach_log_writer(struct super + if (!nilfs->ns_writer) + return -ENOMEM; + ++ inode_attach_wb(nilfs->ns_bdev->bd_inode, NULL); ++ + err = nilfs_segctor_start_thread(nilfs->ns_writer); + if (err) { + kfree(nilfs->ns_writer); diff --git a/queue-4.19/pm-runtime-clk-fix-clk_pm_runtime_get-error-path.patch b/queue-4.19/pm-runtime-clk-fix-clk_pm_runtime_get-error-path.patch new file mode 100644 index 00000000000..f22f5597684 --- /dev/null +++ b/queue-4.19/pm-runtime-clk-fix-clk_pm_runtime_get-error-path.patch @@ -0,0 +1,42 @@ +From 64c7d7ea22d86cacb65d0c097cc447bc0e6d8abd Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 21 May 2020 19:08:09 +0200 +Subject: PM: runtime: clk: Fix clk_pm_runtime_get() error path + +From: Rafael J. Wysocki + +commit 64c7d7ea22d86cacb65d0c097cc447bc0e6d8abd upstream. + +clk_pm_runtime_get() assumes that the PM-runtime usage counter will +be dropped by pm_runtime_get_sync() on errors, which is not the case, +so PM-runtime references to devices acquired by the former are leaked +on errors returned by the latter. + +Fix this by modifying clk_pm_runtime_get() to drop the reference if +pm_runtime_get_sync() returns an error. + +Fixes: 9a34b45397e5 clk: Add support for runtime PM +Cc: 4.15+ # 4.15+ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clk.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -101,7 +101,11 @@ static int clk_pm_runtime_get(struct clk + return 0; + + ret = pm_runtime_get_sync(core->dev); +- return ret < 0 ? ret : 0; ++ if (ret < 0) { ++ pm_runtime_put_noidle(core->dev); ++ return ret; ++ } ++ return 0; + } + + static void clk_pm_runtime_put(struct clk_core *core) diff --git a/queue-4.19/series b/queue-4.19/series index d9d0673f570..955e978d7e7 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -30,4 +30,17 @@ x86-pci-mark-intel-c620-mroms-as-having-non-compliant-bars.patch x86-speculation-prevent-rogue-cross-process-ssbd-shutdown.patch x86-reboot-quirks-add-macbook6-1-reboot-quirk.patch efi-efivars-add-missing-kobject_put-in-sysfs-entry-creation-error-path.patch -kvm-x86-fix-apic-page-invalidation-race.patch +alsa-es1688-add-the-missed-snd_card_free.patch +alsa-hda-realtek-add-a-pintbl-quirk-for-several-lenovo-machines.patch +alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch +alsa-usb-audio-add-vendor-product-and-profile-name-for-hp-thunderbolt-dock.patch +acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch +acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch +acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch +acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch +cgroup-blkcg-prepare-some-symbols-for-module-and-config_cgroup-usages.patch +nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch +spi-dw-fix-controller-unregister-order.patch +spi-bcm2835aux-fix-controller-unregister-order.patch +spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch +pm-runtime-clk-fix-clk_pm_runtime_get-error-path.patch diff --git a/queue-4.19/spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch b/queue-4.19/spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch new file mode 100644 index 00000000000..8a1e7ac4818 --- /dev/null +++ b/queue-4.19/spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch @@ -0,0 +1,62 @@ +From 4df3bea7f9d2ddd9ac2c29ba945c7c4db2def29c Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Mon, 20 Apr 2020 15:08:49 -0400 +Subject: spi: bcm-qspi: when tx/rx buffer is NULL set to 0 + +From: Justin Chen + +commit 4df3bea7f9d2ddd9ac2c29ba945c7c4db2def29c upstream. + +Currently we set the tx/rx buffer to 0xff when NULL. This causes +problems with some spi slaves where 0xff is a valid command. Looking +at other drivers, the tx/rx buffer is usually set to 0x00 when NULL. +Following this convention solves the issue. + +Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver") +Signed-off-by: Justin Chen +Signed-off-by: Kamal Dasu +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200420190853.45614-6-kdasu.kdev@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bcm-qspi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -681,7 +681,7 @@ static void read_from_hw(struct bcm_qspi + if (buf) + buf[tp.byte] = read_rxram_slot_u8(qspi, slot); + dev_dbg(&qspi->pdev->dev, "RD %02x\n", +- buf ? buf[tp.byte] : 0xff); ++ buf ? buf[tp.byte] : 0x0); + } else { + u16 *buf = tp.trans->rx_buf; + +@@ -689,7 +689,7 @@ static void read_from_hw(struct bcm_qspi + buf[tp.byte / 2] = read_rxram_slot_u16(qspi, + slot); + dev_dbg(&qspi->pdev->dev, "RD %04x\n", +- buf ? buf[tp.byte] : 0xffff); ++ buf ? buf[tp.byte / 2] : 0x0); + } + + update_qspi_trans_byte_count(qspi, &tp, +@@ -744,13 +744,13 @@ static int write_to_hw(struct bcm_qspi * + while (!tstatus && slot < MSPI_NUM_CDRAM) { + if (tp.trans->bits_per_word <= 8) { + const u8 *buf = tp.trans->tx_buf; +- u8 val = buf ? buf[tp.byte] : 0xff; ++ u8 val = buf ? buf[tp.byte] : 0x00; + + write_txram_slot_u8(qspi, slot, val); + dev_dbg(&qspi->pdev->dev, "WR %02x\n", val); + } else { + const u16 *buf = tp.trans->tx_buf; +- u16 val = buf ? buf[tp.byte / 2] : 0xffff; ++ u16 val = buf ? buf[tp.byte / 2] : 0x0000; + + write_txram_slot_u16(qspi, slot, val); + dev_dbg(&qspi->pdev->dev, "WR %04x\n", val); diff --git a/queue-4.19/spi-bcm2835aux-fix-controller-unregister-order.patch b/queue-4.19/spi-bcm2835aux-fix-controller-unregister-order.patch new file mode 100644 index 00000000000..f455b6093af --- /dev/null +++ b/queue-4.19/spi-bcm2835aux-fix-controller-unregister-order.patch @@ -0,0 +1,62 @@ +From b9dd3f6d417258ad0beeb292a1bc74200149f15d Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Fri, 15 May 2020 17:58:03 +0200 +Subject: spi: bcm2835aux: Fix controller unregister order + +From: Lukas Wunner + +commit b9dd3f6d417258ad0beeb292a1bc74200149f15d upstream. + +The BCM2835aux SPI driver uses devm_spi_register_master() on bind. +As a consequence, on unbind, __device_release_driver() first invokes +bcm2835aux_spi_remove() before unregistering the SPI controller via +devres_release_all(). + +This order is incorrect: bcm2835aux_spi_remove() turns off the SPI +controller, including its interrupts and clock. The SPI controller +is thus no longer usable. + +When the SPI controller is subsequently unregistered, it unbinds all +its slave devices. If their drivers need to access the SPI bus, +e.g. to quiesce their interrupts, unbinding will fail. + +As a rule, devm_spi_register_master() must not be used if the +->remove() hook performs teardown steps which shall be performed +after unbinding of slaves. + +Fix by using the non-devm variant spi_register_master(). Note that the +struct spi_master as well as the driver-private data are not freed until +after bcm2835aux_spi_remove() has finished, so accessing them is safe. + +Fixes: 1ea29b39f4c8 ("spi: bcm2835aux: add bcm2835 auxiliary spi device driver") +Signed-off-by: Lukas Wunner +Cc: stable@vger.kernel.org # v4.4+ +Cc: Martin Sperl +Link: https://lore.kernel.org/r/32f27f4d8242e4d75f9a53f7e8f1f77483b08669.1589557526.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bcm2835aux.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-bcm2835aux.c ++++ b/drivers/spi/spi-bcm2835aux.c +@@ -485,7 +485,7 @@ static int bcm2835aux_spi_probe(struct p + goto out_clk_disable; + } + +- err = devm_spi_register_master(&pdev->dev, master); ++ err = spi_register_master(master); + if (err) { + dev_err(&pdev->dev, "could not register SPI master: %d\n", err); + goto out_clk_disable; +@@ -505,6 +505,8 @@ static int bcm2835aux_spi_remove(struct + struct spi_master *master = platform_get_drvdata(pdev); + struct bcm2835aux_spi *bs = spi_master_get_devdata(master); + ++ spi_unregister_master(master); ++ + bcm2835aux_spi_reset_hw(bs); + + /* disable the HW block by releasing the clock */ diff --git a/queue-4.19/spi-dw-fix-controller-unregister-order.patch b/queue-4.19/spi-dw-fix-controller-unregister-order.patch new file mode 100644 index 00000000000..3c9c124a351 --- /dev/null +++ b/queue-4.19/spi-dw-fix-controller-unregister-order.patch @@ -0,0 +1,65 @@ +From ca8b19d61e3fce5d2d7790cde27a0b57bcb3f341 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Mon, 25 May 2020 14:25:01 +0200 +Subject: spi: dw: Fix controller unregister order + +From: Lukas Wunner + +commit ca8b19d61e3fce5d2d7790cde27a0b57bcb3f341 upstream. + +The Designware SPI driver uses devm_spi_register_controller() on bind. +As a consequence, on unbind, __device_release_driver() first invokes +dw_spi_remove_host() before unregistering the SPI controller via +devres_release_all(). + +This order is incorrect: dw_spi_remove_host() shuts down the chip, +rendering the SPI bus inaccessible even though the SPI controller is +still registered. When the SPI controller is subsequently unregistered, +it unbinds all its slave devices. Because their drivers cannot access +the SPI bus, e.g. to quiesce interrupts, the slave devices may be left +in an improper state. + +As a rule, devm_spi_register_controller() must not be used if the +->remove() hook performs teardown steps which shall be performed after +unregistering the controller and specifically after unbinding of slaves. + +Fix by reverting to the non-devm variant of spi_register_controller(). + +An alternative approach would be to use device-managed functions for all +steps in dw_spi_remove_host(), e.g. by calling devm_add_action_or_reset() +on probe. However that approach would add more LoC to the driver and +it wouldn't lend itself as well to backporting to stable. + +Fixes: 04f421e7b0b1 ("spi: dw: use managed resources") +Signed-off-by: Lukas Wunner +Reviewed-by: Andy Shevchenko +Cc: stable@vger.kernel.org # v3.14+ +Cc: Baruch Siach +Link: https://lore.kernel.org/r/3fff8cb8ae44a9893840d0688be15bb88c090a14.1590408496.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-dw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-dw.c ++++ b/drivers/spi/spi-dw.c +@@ -536,7 +536,7 @@ int dw_spi_add_host(struct device *dev, + } + } + +- ret = devm_spi_register_controller(dev, master); ++ ret = spi_register_controller(master); + if (ret) { + dev_err(&master->dev, "problem registering spi master\n"); + goto err_dma_exit; +@@ -560,6 +560,8 @@ void dw_spi_remove_host(struct dw_spi *d + { + dw_spi_debugfs_remove(dws); + ++ spi_unregister_controller(dws->master); ++ + if (dws->dma_ops && dws->dma_ops->dma_exit) + dws->dma_ops->dma_exit(dws); + -- 2.47.3