From edba949093792dbf5b48a18712d271a3a5f1f279 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 30 May 2021 16:40:31 -0400 Subject: [PATCH] Fixes for 4.14 Signed-off-by: Sasha Levin --- ...omment-note-regarding-an-unused-poin.patch | 45 +++++++++ ...ror-code-in-ath6kl_wmi_set_roam_lrss.patch | 61 ++++++++++++ ...s-do-not-bug_on-in-link_to_fixup_dir.patch | 76 ++++++++++++++ ...pet-add-checks-after-calling-ioremap.patch | 46 +++++++++ ...idma-comment-platform_driver_registe.patch | 52 ++++++++++ .../drm-amdgpu-fix-a-use-after-free.patch | 52 ++++++++++ ...on-check-cleanup-ioremap-failure-cor.patch | 99 +++++++++++++++++++ ...ertas-register-sysfs-groups-properly.patch | 94 ++++++++++++++++++ ...b-add-check-on-sp8870_readreg-return.patch | 40 ++++++++ ...9m111-check-write_bridge-for-timeout.patch | 58 +++++++++++ ...erly-check-for-errors-in-po1030_prob.patch | 52 ++++++++++ ...-remove-bug_on-dev-null-in-caif_xmit.patch | 80 +++++++++++++++ ...fujitsu-fix-potential-null-ptr-deref.patch | 42 ++++++++ .../openrisc-define-memory-barrier-mb.patch | 48 +++++++++ ...wireless-add-amd-s-hardware-id-to-th.patch | 43 ++++++++ ...accel-avoid-invoking-_ini-to-speed-u.patch | 95 ++++++++++++++++++ ...el_punit_ipc-append-module_device_ta.patch | 38 +++++++ ...x-64-bit-system-enumeration-error-fo.patch | 65 ++++++++++++ ...nregister-uart-driver-in-case-of-fai.patch | 49 +++++++++ queue-4.14/series | 20 ++++ ...ile-id-in-requests-compounded-with-o.patch | 42 ++++++++ 21 files changed, 1197 insertions(+) create mode 100644 queue-4.14/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch create mode 100644 queue-4.14/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch create mode 100644 queue-4.14/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch create mode 100644 queue-4.14/char-hpet-add-checks-after-calling-ioremap.patch create mode 100644 queue-4.14/dmaengine-qcom_hidma-comment-platform_driver_registe.patch create mode 100644 queue-4.14/drm-amdgpu-fix-a-use-after-free.patch create mode 100644 queue-4.14/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch create mode 100644 queue-4.14/libertas-register-sysfs-groups-properly.patch create mode 100644 queue-4.14/media-dvb-add-check-on-sp8870_readreg-return.patch create mode 100644 queue-4.14/media-gspca-mt9m111-check-write_bridge-for-timeout.patch create mode 100644 queue-4.14/media-gspca-properly-check-for-errors-in-po1030_prob.patch create mode 100644 queue-4.14/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch create mode 100644 queue-4.14/net-fujitsu-fix-potential-null-ptr-deref.patch create mode 100644 queue-4.14/openrisc-define-memory-barrier-mb.patch create mode 100644 queue-4.14/platform-x86-hp-wireless-add-amd-s-hardware-id-to-th.patch create mode 100644 queue-4.14/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch create mode 100644 queue-4.14/platform-x86-intel_punit_ipc-append-module_device_ta.patch create mode 100644 queue-4.14/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch create mode 100644 queue-4.14/serial-max310x-unregister-uart-driver-in-case-of-fai.patch create mode 100644 queue-4.14/smb3-incorrect-file-id-in-requests-compounded-with-o.patch diff --git a/queue-4.14/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch b/queue-4.14/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch new file mode 100644 index 00000000000..a14e0256b7d --- /dev/null +++ b/queue-4.14/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch @@ -0,0 +1,45 @@ +From 7cbbe5db61e1c252555d43d17e9a8b765e37c724 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:02 +0200 +Subject: ALSA: sb8: Add a comment note regarding an unused pointer + +From: Atul Gopinathan + +[ Upstream commit a28591f61b60fac820c6de59826ffa710e5e314e ] + +The field "fm_res" of "struct snd_sb8" is never used/dereferenced +throughout the sb8.c code. Therefore there is no need for any null value +check after the "request_region()". + +Add a comment note to make developers know about this and prevent any +"NULL check" patches on this part of code. + +Cc: Takashi Iwai +Signed-off-by: Atul Gopinathan +Link: https://lore.kernel.org/r/20210503115736.2104747-36-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + sound/isa/sb/sb8.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c +index d77dcba276b5..b0ef47bc6521 100644 +--- a/sound/isa/sb/sb8.c ++++ b/sound/isa/sb/sb8.c +@@ -109,7 +109,11 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev) + acard = card->private_data; + card->private_free = snd_sb8_free; + +- /* block the 0x388 port to avoid PnP conflicts */ ++ /* ++ * Block the 0x388 port to avoid PnP conflicts. ++ * No need to check this value after request_region, ++ * as we never do anything with it. ++ */ + acard->fm_res = request_region(0x388, 4, "SoundBlaster FM"); + + if (port[dev] != SNDRV_AUTO_PORT) { +-- +2.30.2 + diff --git a/queue-4.14/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch b/queue-4.14/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch new file mode 100644 index 00000000000..5078bf8a393 --- /dev/null +++ b/queue-4.14/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch @@ -0,0 +1,61 @@ +From 9d5b6e56226c74cf0f81f8f3b867a0cfc5519af8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:10 +0200 +Subject: ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() + +From: Anirudh Rayabharam + +[ Upstream commit fc6a6521556c8250e356ddc6a3f2391aa62dc976 ] + +ath6kl_wmi_cmd_send could fail, so let's return its error code upstream. + +Signed-off-by: Kangjie Lu +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/debug.c | 5 ++++- + drivers/net/wireless/ath/ath6kl/wmi.c | 4 +--- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c +index 1eea6c23976f..19b005cc8b00 100644 +--- a/drivers/net/wireless/ath/ath6kl/debug.c ++++ b/drivers/net/wireless/ath/ath6kl/debug.c +@@ -1027,14 +1027,17 @@ static ssize_t ath6kl_lrssi_roam_write(struct file *file, + { + struct ath6kl *ar = file->private_data; + unsigned long lrssi_roam_threshold; ++ int ret; + + if (kstrtoul_from_user(user_buf, count, 0, &lrssi_roam_threshold)) + return -EINVAL; + + ar->lrssi_roam_threshold = lrssi_roam_threshold; + +- ath6kl_wmi_set_roam_lrssi_cmd(ar->wmi, ar->lrssi_roam_threshold); ++ ret = ath6kl_wmi_set_roam_lrssi_cmd(ar->wmi, ar->lrssi_roam_threshold); + ++ if (ret) ++ return ret; + return count; + } + +diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c +index f80f1757b58f..9deaeb72b2b4 100644 +--- a/drivers/net/wireless/ath/ath6kl/wmi.c ++++ b/drivers/net/wireless/ath/ath6kl/wmi.c +@@ -776,10 +776,8 @@ int ath6kl_wmi_set_roam_lrssi_cmd(struct wmi *wmi, u8 lrssi) + cmd->info.params.roam_rssi_floor = DEF_LRSSI_ROAM_FLOOR; + cmd->roam_ctrl = WMI_SET_LRSSI_SCAN_PARAMS; + +- ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID, ++ return ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID, + NO_SYNC_WMIFLAG); +- +- return 0; + } + + int ath6kl_wmi_force_roam_cmd(struct wmi *wmi, const u8 *bssid) +-- +2.30.2 + diff --git a/queue-4.14/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch b/queue-4.14/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch new file mode 100644 index 00000000000..dd094fa7f25 --- /dev/null +++ b/queue-4.14/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch @@ -0,0 +1,76 @@ +From b03c76be6313fbdf20af352903003fb8d482f92a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 10:56:16 -0400 +Subject: btrfs: do not BUG_ON in link_to_fixup_dir + +From: Josef Bacik + +[ Upstream commit 91df99a6eb50d5a1bc70fff4a09a0b7ae6aab96d ] + +While doing error injection testing I got the following panic + + kernel BUG at fs/btrfs/tree-log.c:1862! + invalid opcode: 0000 [#1] SMP NOPTI + CPU: 1 PID: 7836 Comm: mount Not tainted 5.13.0-rc1+ #305 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 + RIP: 0010:link_to_fixup_dir+0xd5/0xe0 + RSP: 0018:ffffb5800180fa30 EFLAGS: 00010216 + RAX: fffffffffffffffb RBX: 00000000fffffffb RCX: ffff8f595287faf0 + RDX: ffffb5800180fa37 RSI: ffff8f5954978800 RDI: 0000000000000000 + RBP: ffff8f5953af9450 R08: 0000000000000019 R09: 0000000000000001 + R10: 000151f408682970 R11: 0000000120021001 R12: ffff8f5954978800 + R13: ffff8f595287faf0 R14: ffff8f5953c77dd0 R15: 0000000000000065 + FS: 00007fc5284c8c40(0000) GS:ffff8f59bbd00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007fc5287f47c0 CR3: 000000011275e002 CR4: 0000000000370ee0 + Call Trace: + replay_one_buffer+0x409/0x470 + ? btree_read_extent_buffer_pages+0xd0/0x110 + walk_up_log_tree+0x157/0x1e0 + walk_log_tree+0xa6/0x1d0 + btrfs_recover_log_trees+0x1da/0x360 + ? replay_one_extent+0x7b0/0x7b0 + open_ctree+0x1486/0x1720 + btrfs_mount_root.cold+0x12/0xea + ? __kmalloc_track_caller+0x12f/0x240 + legacy_get_tree+0x24/0x40 + vfs_get_tree+0x22/0xb0 + vfs_kern_mount.part.0+0x71/0xb0 + btrfs_mount+0x10d/0x380 + ? vfs_parse_fs_string+0x4d/0x90 + legacy_get_tree+0x24/0x40 + vfs_get_tree+0x22/0xb0 + path_mount+0x433/0xa10 + __x64_sys_mount+0xe3/0x120 + do_syscall_64+0x3d/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +We can get -EIO or any number of legitimate errors from +btrfs_search_slot(), panicing here is not the appropriate response. The +error path for this code handles errors properly, simply return the +error. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/tree-log.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index e40c27aec949..035a2e2be156 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -1629,8 +1629,6 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans, + ret = btrfs_update_inode(trans, root, inode); + } else if (ret == -EEXIST) { + ret = 0; +- } else { +- BUG(); /* Logic Error */ + } + iput(inode); + +-- +2.30.2 + diff --git a/queue-4.14/char-hpet-add-checks-after-calling-ioremap.patch b/queue-4.14/char-hpet-add-checks-after-calling-ioremap.patch new file mode 100644 index 00000000000..a9ab6ffdcb4 --- /dev/null +++ b/queue-4.14/char-hpet-add-checks-after-calling-ioremap.patch @@ -0,0 +1,46 @@ +From bb7d2ec97789409a8b1fe7172aa4918110c6b1ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:56 +0200 +Subject: char: hpet: add checks after calling ioremap + +From: Tom Seewald + +[ Upstream commit b11701c933112d49b808dee01cb7ff854ba6a77a ] + +The function hpet_resources() calls ioremap() two times, but in both +cases it does not check if ioremap() returned a null pointer. Fix this +by adding null pointer checks and returning an appropriate error. + +Signed-off-by: Tom Seewald +Link: https://lore.kernel.org/r/20210503115736.2104747-30-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/hpet.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c +index 05ca269ddd05..b9935675085c 100644 +--- a/drivers/char/hpet.c ++++ b/drivers/char/hpet.c +@@ -977,6 +977,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data) + if (ACPI_SUCCESS(status)) { + hdp->hd_phys_address = addr.address.minimum; + hdp->hd_address = ioremap(addr.address.minimum, addr.address.address_length); ++ if (!hdp->hd_address) ++ return AE_ERROR; + + if (hpet_is_known(hdp)) { + iounmap(hdp->hd_address); +@@ -990,6 +992,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data) + hdp->hd_phys_address = fixmem32->address; + hdp->hd_address = ioremap(fixmem32->address, + HPET_RANGE_SIZE); ++ if (!hdp->hd_address) ++ return AE_ERROR; + + if (hpet_is_known(hdp)) { + iounmap(hdp->hd_address); +-- +2.30.2 + diff --git a/queue-4.14/dmaengine-qcom_hidma-comment-platform_driver_registe.patch b/queue-4.14/dmaengine-qcom_hidma-comment-platform_driver_registe.patch new file mode 100644 index 00000000000..64c50331757 --- /dev/null +++ b/queue-4.14/dmaengine-qcom_hidma-comment-platform_driver_registe.patch @@ -0,0 +1,52 @@ +From ea5ca8be43263f2caa84c2364d7b0dde10ed5da9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:18 +0200 +Subject: dmaengine: qcom_hidma: comment platform_driver_register call + +From: Phillip Potter + +[ Upstream commit 4df2a8b0ad634d98a67e540a4e18a60f943e7d9f ] + +Place a comment in hidma_mgmt_init explaining why success must +currently be assumed, due to the cleanup issue that would need to +be considered were this module ever to be unloadable or were this +platform_driver_register call ever to fail. + +Acked-By: Vinod Koul +Acked-By: Sinan Kaya +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20210503115736.2104747-52-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/dma/qcom/hidma_mgmt.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/dma/qcom/hidma_mgmt.c b/drivers/dma/qcom/hidma_mgmt.c +index 7335e2eb9b72..fd1b3a09de91 100644 +--- a/drivers/dma/qcom/hidma_mgmt.c ++++ b/drivers/dma/qcom/hidma_mgmt.c +@@ -454,6 +454,20 @@ static int __init hidma_mgmt_init(void) + hidma_mgmt_of_populate_channels(child); + } + #endif ++ /* ++ * We do not check for return value here, as it is assumed that ++ * platform_driver_register must not fail. The reason for this is that ++ * the (potential) hidma_mgmt_of_populate_channels calls above are not ++ * cleaned up if it does fail, and to do this work is quite ++ * complicated. In particular, various calls of of_address_to_resource, ++ * of_irq_to_resource, platform_device_register_full, of_dma_configure, ++ * and of_msi_configure which then call other functions and so on, must ++ * be cleaned up - this is not a trivial exercise. ++ * ++ * Currently, this module is not intended to be unloaded, and there is ++ * no module_exit function defined which does the needed cleanup. For ++ * this reason, we have to assume success here. ++ */ + platform_driver_register(&hidma_mgmt_driver); + + return 0; +-- +2.30.2 + diff --git a/queue-4.14/drm-amdgpu-fix-a-use-after-free.patch b/queue-4.14/drm-amdgpu-fix-a-use-after-free.patch new file mode 100644 index 00000000000..9e0f733ac2d --- /dev/null +++ b/queue-4.14/drm-amdgpu-fix-a-use-after-free.patch @@ -0,0 +1,52 @@ +From 5841180c84a31ae25335df4f18aa64da17d1ac8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 10:56:07 +0800 +Subject: drm/amdgpu: Fix a use-after-free +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: xinhui pan + +[ Upstream commit 1e5c37385097c35911b0f8a0c67ffd10ee1af9a2 ] + +looks like we forget to set ttm->sg to NULL. +Hit panic below + +[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI +[ 1235.989074] Call Trace: +[ 1235.991751] sg_free_table+0x17/0x20 +[ 1235.995667] amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu] +[ 1236.002288] amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu] +[ 1236.008464] ttm_tt_destroy+0x1e/0x30 [ttm] +[ 1236.013066] ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm] +[ 1236.018783] ttm_bo_release+0x262/0xa50 [ttm] +[ 1236.023547] ttm_bo_put+0x82/0xd0 [ttm] +[ 1236.027766] amdgpu_bo_unref+0x26/0x50 [amdgpu] +[ 1236.032809] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu] +[ 1236.040400] kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu] +[ 1236.046912] kfd_ioctl+0x463/0x690 [amdgpu] + +Signed-off-by: xinhui pan +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index d057bc29bf4c..b84ef2295d4f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -1010,6 +1010,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm) + + if (gtt && gtt->userptr) { + kfree(ttm->sg); ++ ttm->sg = NULL; + ttm->page_flags &= ~TTM_PAGE_FLAG_SG; + return; + } +-- +2.30.2 + diff --git a/queue-4.14/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch b/queue-4.14/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch new file mode 100644 index 00000000000..1f99d9f401c --- /dev/null +++ b/queue-4.14/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch @@ -0,0 +1,99 @@ +From 6db6a6d1e34c212cc7ab0579baa236b569eab383 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:08 +0200 +Subject: isdn: mISDNinfineon: check/cleanup ioremap failure correctly in + setup_io + +From: Phillip Potter + +[ Upstream commit c446f0d4702d316e1c6bf621f70e79678d28830a ] + +Move hw->cfg.mode and hw->addr.mode assignments from hw->ci->cfg_mode +and hw->ci->addr_mode respectively, to be before the subsequent checks +for memory IO mode (and possible ioremap calls in this case). + +Also introduce ioremap error checks at both locations. This allows +resources to be properly freed on ioremap failure, as when the caller +of setup_io then subsequently calls release_io via its error path, +release_io can now correctly determine the mode as it has been set +before the ioremap call. + +Finally, refactor release_io function so that it will call +release_mem_region in the memory IO case, regardless of whether or not +hw->cfg.p/hw->addr.p are NULL. This means resources are then properly +released on failure. + +This properly implements the original reverted commit (d721fe99f6ad) +from the University of Minnesota, whilst also implementing the ioremap +check for the hw->ci->cfg_mode if block as well. + +Cc: David S. Miller +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20210503115736.2104747-42-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/mISDNinfineon.c | 24 ++++++++++++++------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/isdn/hardware/mISDN/mISDNinfineon.c b/drivers/isdn/hardware/mISDN/mISDNinfineon.c +index d5bdbaf93a1a..d0b6377b9834 100644 +--- a/drivers/isdn/hardware/mISDN/mISDNinfineon.c ++++ b/drivers/isdn/hardware/mISDN/mISDNinfineon.c +@@ -645,17 +645,19 @@ static void + release_io(struct inf_hw *hw) + { + if (hw->cfg.mode) { +- if (hw->cfg.p) { ++ if (hw->cfg.mode == AM_MEMIO) { + release_mem_region(hw->cfg.start, hw->cfg.size); +- iounmap(hw->cfg.p); ++ if (hw->cfg.p) ++ iounmap(hw->cfg.p); + } else + release_region(hw->cfg.start, hw->cfg.size); + hw->cfg.mode = AM_NONE; + } + if (hw->addr.mode) { +- if (hw->addr.p) { ++ if (hw->addr.mode == AM_MEMIO) { + release_mem_region(hw->addr.start, hw->addr.size); +- iounmap(hw->addr.p); ++ if (hw->addr.p) ++ iounmap(hw->addr.p); + } else + release_region(hw->addr.start, hw->addr.size); + hw->addr.mode = AM_NONE; +@@ -685,9 +687,12 @@ setup_io(struct inf_hw *hw) + (ulong)hw->cfg.start, (ulong)hw->cfg.size); + return err; + } +- if (hw->ci->cfg_mode == AM_MEMIO) +- hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size); + hw->cfg.mode = hw->ci->cfg_mode; ++ if (hw->ci->cfg_mode == AM_MEMIO) { ++ hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size); ++ if (!hw->cfg.p) ++ return -ENOMEM; ++ } + if (debug & DEBUG_HW) + pr_notice("%s: IO cfg %lx (%lu bytes) mode%d\n", + hw->name, (ulong)hw->cfg.start, +@@ -712,9 +717,12 @@ setup_io(struct inf_hw *hw) + (ulong)hw->addr.start, (ulong)hw->addr.size); + return err; + } +- if (hw->ci->addr_mode == AM_MEMIO) +- hw->addr.p = ioremap(hw->addr.start, hw->addr.size); + hw->addr.mode = hw->ci->addr_mode; ++ if (hw->ci->addr_mode == AM_MEMIO) { ++ hw->addr.p = ioremap(hw->addr.start, hw->addr.size); ++ if (!hw->addr.p) ++ return -ENOMEM; ++ } + if (debug & DEBUG_HW) + pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n", + hw->name, (ulong)hw->addr.start, +-- +2.30.2 + diff --git a/queue-4.14/libertas-register-sysfs-groups-properly.patch b/queue-4.14/libertas-register-sysfs-groups-properly.patch new file mode 100644 index 00000000000..657ae4e0205 --- /dev/null +++ b/queue-4.14/libertas-register-sysfs-groups-properly.patch @@ -0,0 +1,94 @@ +From f51f076aeb9912f59ccc8f823f0822500611995a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:20 +0200 +Subject: libertas: register sysfs groups properly + +From: Greg Kroah-Hartman + +[ Upstream commit 7e79b38fe9a403b065ac5915465f620a8fb3de84 ] + +The libertas driver was trying to register sysfs groups "by hand" which +causes them to be created _after_ the device is initialized and +announced to userspace, which causes races and can prevent userspace +tools from seeing the sysfs files correctly. + +Fix this up by using the built-in sysfs_groups pointers in struct +net_device which were created for this very reason, fixing the race +condition, and properly allowing for any error that might have occured +to be handled properly. + +Cc: Kalle Valo +Link: https://lore.kernel.org/r/20210503115736.2104747-54-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/mesh.c | 28 +++----------------- + 1 file changed, 4 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/wireless/marvell/libertas/mesh.c b/drivers/net/wireless/marvell/libertas/mesh.c +index b0cb16ef8d1d..b313c78e2154 100644 +--- a/drivers/net/wireless/marvell/libertas/mesh.c ++++ b/drivers/net/wireless/marvell/libertas/mesh.c +@@ -793,19 +793,6 @@ static const struct attribute_group mesh_ie_group = { + .attrs = mesh_ie_attrs, + }; + +-static void lbs_persist_config_init(struct net_device *dev) +-{ +- int ret; +- ret = sysfs_create_group(&(dev->dev.kobj), &boot_opts_group); +- ret = sysfs_create_group(&(dev->dev.kobj), &mesh_ie_group); +-} +- +-static void lbs_persist_config_remove(struct net_device *dev) +-{ +- sysfs_remove_group(&(dev->dev.kobj), &boot_opts_group); +- sysfs_remove_group(&(dev->dev.kobj), &mesh_ie_group); +-} +- + + /*************************************************************************** + * Initializing and starting, stopping mesh +@@ -1005,6 +992,10 @@ static int lbs_add_mesh(struct lbs_private *priv) + SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent); + + mesh_dev->flags |= IFF_BROADCAST | IFF_MULTICAST; ++ mesh_dev->sysfs_groups[0] = &lbs_mesh_attr_group; ++ mesh_dev->sysfs_groups[1] = &boot_opts_group; ++ mesh_dev->sysfs_groups[2] = &mesh_ie_group; ++ + /* Register virtual mesh interface */ + ret = register_netdev(mesh_dev); + if (ret) { +@@ -1012,19 +1003,10 @@ static int lbs_add_mesh(struct lbs_private *priv) + goto err_free_netdev; + } + +- ret = sysfs_create_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group); +- if (ret) +- goto err_unregister; +- +- lbs_persist_config_init(mesh_dev); +- + /* Everything successful */ + ret = 0; + goto done; + +-err_unregister: +- unregister_netdev(mesh_dev); +- + err_free_netdev: + free_netdev(mesh_dev); + +@@ -1045,8 +1027,6 @@ void lbs_remove_mesh(struct lbs_private *priv) + + netif_stop_queue(mesh_dev); + netif_carrier_off(mesh_dev); +- sysfs_remove_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group); +- lbs_persist_config_remove(mesh_dev); + unregister_netdev(mesh_dev); + priv->mesh_dev = NULL; + kfree(mesh_dev->ieee80211_ptr); +-- +2.30.2 + diff --git a/queue-4.14/media-dvb-add-check-on-sp8870_readreg-return.patch b/queue-4.14/media-dvb-add-check-on-sp8870_readreg-return.patch new file mode 100644 index 00000000000..457798b9590 --- /dev/null +++ b/queue-4.14/media-dvb-add-check-on-sp8870_readreg-return.patch @@ -0,0 +1,40 @@ +From 48208a3f4e03635f761ef02d1fb596f82474e472 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:26 +0200 +Subject: media: dvb: Add check on sp8870_readreg return + +From: Alaa Emad + +[ Upstream commit c6d822c56e7fd29e6fa1b1bb91b98f6a1e942b3c ] + +The function sp8870_readreg returns a negative value when i2c_transfer +fails so properly check for this and return the error if it happens. + +Cc: Sean Young +Cc: Mauro Carvalho Chehab +Signed-off-by: Alaa Emad +Link: https://lore.kernel.org/r/20210503115736.2104747-60-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/sp8870.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-frontends/sp8870.c b/drivers/media/dvb-frontends/sp8870.c +index 04454cb78467..a5782d1133df 100644 +--- a/drivers/media/dvb-frontends/sp8870.c ++++ b/drivers/media/dvb-frontends/sp8870.c +@@ -293,7 +293,9 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe) + sp8870_writereg(state, 0xc05, reg0xc05); + + // read status reg in order to clear pending irqs +- sp8870_readreg(state, 0x200); ++ err = sp8870_readreg(state, 0x200); ++ if (err < 0) ++ return err; + + // system controller start + sp8870_microcontroller_start(state); +-- +2.30.2 + diff --git a/queue-4.14/media-gspca-mt9m111-check-write_bridge-for-timeout.patch b/queue-4.14/media-gspca-mt9m111-check-write_bridge-for-timeout.patch new file mode 100644 index 00000000000..036241d1732 --- /dev/null +++ b/queue-4.14/media-gspca-mt9m111-check-write_bridge-for-timeout.patch @@ -0,0 +1,58 @@ +From 1663366712ade866d5a8d9e447be0e560397107f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:28 +0200 +Subject: media: gspca: mt9m111: Check write_bridge for timeout + +From: Alaa Emad + +[ Upstream commit 656025850074f5c1ba2e05be37bda57ba2b8d491 ] + +In mt9m111_probe, m5602_write_bridge can timeout and return a negative +error value. The fix checks for this error and passes it upstream. + +Signed-off-by: Aditya Pakki +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/m5602/m5602_mt9m111.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c +index 7d01ddd7ed01..da17c384e64d 100644 +--- a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c ++++ b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c +@@ -199,7 +199,7 @@ static const struct v4l2_ctrl_config mt9m111_greenbal_cfg = { + int mt9m111_probe(struct sd *sd) + { + u8 data[2] = {0x00, 0x00}; +- int i; ++ int i, err; + struct gspca_dev *gspca_dev = (struct gspca_dev *)sd; + + if (force_sensor) { +@@ -217,15 +217,17 @@ int mt9m111_probe(struct sd *sd) + /* Do the preinit */ + for (i = 0; i < ARRAY_SIZE(preinit_mt9m111); i++) { + if (preinit_mt9m111[i][0] == BRIDGE) { +- m5602_write_bridge(sd, +- preinit_mt9m111[i][1], +- preinit_mt9m111[i][2]); ++ err = m5602_write_bridge(sd, ++ preinit_mt9m111[i][1], ++ preinit_mt9m111[i][2]); + } else { + data[0] = preinit_mt9m111[i][2]; + data[1] = preinit_mt9m111[i][3]; +- m5602_write_sensor(sd, +- preinit_mt9m111[i][1], data, 2); ++ err = m5602_write_sensor(sd, ++ preinit_mt9m111[i][1], data, 2); + } ++ if (err < 0) ++ return err; + } + + if (m5602_read_sensor(sd, MT9M111_SC_CHIPVER, data, 2)) +-- +2.30.2 + diff --git a/queue-4.14/media-gspca-properly-check-for-errors-in-po1030_prob.patch b/queue-4.14/media-gspca-properly-check-for-errors-in-po1030_prob.patch new file mode 100644 index 00000000000..045eb6aa237 --- /dev/null +++ b/queue-4.14/media-gspca-properly-check-for-errors-in-po1030_prob.patch @@ -0,0 +1,52 @@ +From 3b6cbc7b2205234a9165f6774b7d0b15646c913e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:30 +0200 +Subject: media: gspca: properly check for errors in po1030_probe() + +From: Greg Kroah-Hartman + +[ Upstream commit dacb408ca6f0e34df22b40d8dd5fae7f8e777d84 ] + +If m5602_write_sensor() or m5602_write_bridge() fail, do not continue to +initialize the device but return the error to the calling funtion. + +Cc: Mauro Carvalho Chehab +Link: https://lore.kernel.org/r/20210503115736.2104747-64-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/m5602/m5602_po1030.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/usb/gspca/m5602/m5602_po1030.c b/drivers/media/usb/gspca/m5602/m5602_po1030.c +index a0a90dd34ca8..a098aeb290c3 100644 +--- a/drivers/media/usb/gspca/m5602/m5602_po1030.c ++++ b/drivers/media/usb/gspca/m5602/m5602_po1030.c +@@ -159,6 +159,7 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = { + int po1030_probe(struct sd *sd) + { + u8 dev_id_h = 0, i; ++ int err; + struct gspca_dev *gspca_dev = (struct gspca_dev *)sd; + + if (force_sensor) { +@@ -177,10 +178,13 @@ int po1030_probe(struct sd *sd) + for (i = 0; i < ARRAY_SIZE(preinit_po1030); i++) { + u8 data = preinit_po1030[i][2]; + if (preinit_po1030[i][0] == SENSOR) +- m5602_write_sensor(sd, +- preinit_po1030[i][1], &data, 1); ++ err = m5602_write_sensor(sd, preinit_po1030[i][1], ++ &data, 1); + else +- m5602_write_bridge(sd, preinit_po1030[i][1], data); ++ err = m5602_write_bridge(sd, preinit_po1030[i][1], ++ data); ++ if (err < 0) ++ return err; + } + + if (m5602_read_sensor(sd, PO1030_DEVID_H, &dev_id_h, 1)) +-- +2.30.2 + diff --git a/queue-4.14/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch b/queue-4.14/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch new file mode 100644 index 00000000000..17f546c0296 --- /dev/null +++ b/queue-4.14/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch @@ -0,0 +1,80 @@ +From 7609624b59c288a668ef227ebd1ce2666c4054a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:46 +0200 +Subject: net: caif: remove BUG_ON(dev == NULL) in caif_xmit + +From: Du Cheng + +[ Upstream commit 65a67792e3416f7c5d7daa47d99334cbb19a7449 ] + +The condition of dev == NULL is impossible in caif_xmit(), hence it is +for the removal. + +Explanation: +The static caif_xmit() is only called upon via a function pointer +`ndo_start_xmit` defined in include/linux/netdevice.h: +``` +struct net_device_ops { + ... + netdev_tx_t (*ndo_start_xmit)(struct sk_buff *skb, struct net_device *dev); + ... +} +``` + +The exhausive list of call points are: +``` +drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c + dev->netdev_ops->ndo_start_xmit(skb, dev); + ^ ^ + +drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c + struct opa_vnic_adapter *adapter = opa_vnic_priv(netdev); + ^ ^ + return adapter->rn_ops->ndo_start_xmit(skb, netdev); // adapter would crash first + ^ ^ + +drivers/usb/gadget/function/f_ncm.c + ncm->netdev->netdev_ops->ndo_start_xmit(NULL, ncm->netdev); + ^ ^ + +include/linux/netdevice.h +static inline netdev_tx_t __netdev_start_xmit(... +{ + return ops->ndo_start_xmit(skb, dev); + ^ +} + + const struct net_device_ops *ops = dev->netdev_ops; + ^ + rc = __netdev_start_xmit(ops, skb, dev, more); + ^ +``` + +In each of the enumerated scenarios, it is impossible for the NULL-valued dev to +reach the caif_xmit() without crashing the kernel earlier, therefore `BUG_ON(dev == +NULL)` is rather useless, hence the removal. + +Cc: David S. Miller +Signed-off-by: Du Cheng +Link: https://lore.kernel.org/r/20210503115736.2104747-20-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/caif/caif_serial.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c +index 709838e4c062..ce76ed50a1a2 100644 +--- a/drivers/net/caif/caif_serial.c ++++ b/drivers/net/caif/caif_serial.c +@@ -279,7 +279,6 @@ static int caif_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct ser_device *ser; + +- BUG_ON(dev == NULL); + ser = netdev_priv(dev); + + /* Send flow off once, on high water mark */ +-- +2.30.2 + diff --git a/queue-4.14/net-fujitsu-fix-potential-null-ptr-deref.patch b/queue-4.14/net-fujitsu-fix-potential-null-ptr-deref.patch new file mode 100644 index 00000000000..2a7f4db236d --- /dev/null +++ b/queue-4.14/net-fujitsu-fix-potential-null-ptr-deref.patch @@ -0,0 +1,42 @@ +From 184d951cb612ac3987b9c97b3e99c2f6c0f29a77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:42 +0200 +Subject: net: fujitsu: fix potential null-ptr-deref + +From: Anirudh Rayabharam + +[ Upstream commit 52202be1cd996cde6e8969a128dc27ee45a7cb5e ] + +In fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer +deref. To fix this, check the return value of ioremap and return -1 +to the caller in case of failure. + +Cc: "David S. Miller" +Acked-by: Dominik Brodowski +Signed-off-by: Anirudh Rayabharam +Link: https://lore.kernel.org/r/20210503115736.2104747-16-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c +index a69cd19a55ae..b8fc9bbeca2c 100644 +--- a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c ++++ b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c +@@ -547,6 +547,11 @@ static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id) + return -1; + + base = ioremap(link->resource[2]->start, resource_size(link->resource[2])); ++ if (!base) { ++ pcmcia_release_window(link, link->resource[2]); ++ return -1; ++ } ++ + pcmcia_map_mem_page(link, link->resource[2], 0); + + /* +-- +2.30.2 + diff --git a/queue-4.14/openrisc-define-memory-barrier-mb.patch b/queue-4.14/openrisc-define-memory-barrier-mb.patch new file mode 100644 index 00000000000..920701821ab --- /dev/null +++ b/queue-4.14/openrisc-define-memory-barrier-mb.patch @@ -0,0 +1,48 @@ +From dac0957f928bebc1e237a7133418d18ae84fe768 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 14:45:43 +0200 +Subject: openrisc: Define memory barrier mb + +From: Peter Zijlstra + +[ Upstream commit 8b549c18ae81dbc36fb11e4aa08b8378c599ca95 ] + +This came up in the discussion of the requirements of qspinlock on an +architecture. OpenRISC uses qspinlock, but it was noticed that the +memmory barrier was not defined. + +Peter defined it in the mail thread writing: + + As near as I can tell this should do. The arch spec only lists + this one instruction and the text makes it sound like a completion + barrier. + +This is correct so applying this patch. + +Signed-off-by: Peter Zijlstra +[shorne@gmail.com:Turned the mail into a patch] +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/barrier.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + create mode 100644 arch/openrisc/include/asm/barrier.h + +diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h +new file mode 100644 +index 000000000000..7538294721be +--- /dev/null ++++ b/arch/openrisc/include/asm/barrier.h +@@ -0,0 +1,9 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef __ASM_BARRIER_H ++#define __ASM_BARRIER_H ++ ++#define mb() asm volatile ("l.msync" ::: "memory") ++ ++#include ++ ++#endif /* __ASM_BARRIER_H */ +-- +2.30.2 + diff --git a/queue-4.14/platform-x86-hp-wireless-add-amd-s-hardware-id-to-th.patch b/queue-4.14/platform-x86-hp-wireless-add-amd-s-hardware-id-to-th.patch new file mode 100644 index 00000000000..15c92fcdcf8 --- /dev/null +++ b/queue-4.14/platform-x86-hp-wireless-add-amd-s-hardware-id-to-th.patch @@ -0,0 +1,43 @@ +From cb4ac721f4614dd9d7ce88480c4b4899e9f0b151 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 23:30:47 +0530 +Subject: platform/x86: hp-wireless: add AMD's hardware id to the supported + list + +From: Shyam Sundar S K + +[ Upstream commit f048630bdd55eb5379ef35f971639fe52fabe499 ] + +Newer AMD based laptops uses AMDI0051 as the hardware id to support the +airplane mode button. Adding this to the supported list. + +Signed-off-by: Shyam Sundar S K +Link: https://lore.kernel.org/r/20210514180047.1697543-1-Shyam-sundar.S-k@amd.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/hp-wireless.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/platform/x86/hp-wireless.c b/drivers/platform/x86/hp-wireless.c +index d6ea5e998fb8..bb95bec0b110 100644 +--- a/drivers/platform/x86/hp-wireless.c ++++ b/drivers/platform/x86/hp-wireless.c +@@ -30,12 +30,14 @@ MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Alex Hung"); + MODULE_ALIAS("acpi*:HPQ6001:*"); + MODULE_ALIAS("acpi*:WSTADEF:*"); ++MODULE_ALIAS("acpi*:AMDI0051:*"); + + static struct input_dev *hpwl_input_dev; + + static const struct acpi_device_id hpwl_ids[] = { + {"HPQ6001", 0}, + {"WSTADEF", 0}, ++ {"AMDI0051", 0}, + {"", 0}, + }; + +-- +2.30.2 + diff --git a/queue-4.14/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch b/queue-4.14/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch new file mode 100644 index 00000000000..2ae43b21581 --- /dev/null +++ b/queue-4.14/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch @@ -0,0 +1,95 @@ +From 9b53c49140ffb15ab280260aef19d0d2cac5bb2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Apr 2021 14:07:35 +0800 +Subject: platform/x86: hp_accel: Avoid invoking _INI to speed up resume +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai-Heng Feng + +[ Upstream commit 79d341e26ebcdbc622348aaaab6f8f89b6fdb25f ] + +hp_accel can take almost two seconds to resume on some HP laptops. + +The bottleneck is on evaluating _INI, which is only needed to run once. + +Resolve the issue by only invoking _INI when it's necessary. Namely, on +probe and on hibernation restore. + +Signed-off-by: Kai-Heng Feng +Acked-by: Éric Piel +Link: https://lore.kernel.org/r/20210430060736.590321-1-kai.heng.feng@canonical.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/misc/lis3lv02d/lis3lv02d.h | 1 + + drivers/platform/x86/hp_accel.c | 22 +++++++++++++++++++++- + 2 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h +index c439c827eea8..0ef759671b54 100644 +--- a/drivers/misc/lis3lv02d/lis3lv02d.h ++++ b/drivers/misc/lis3lv02d/lis3lv02d.h +@@ -284,6 +284,7 @@ struct lis3lv02d { + int regs_size; + u8 *reg_cache; + bool regs_stored; ++ bool init_required; + u8 odr_mask; /* ODR bit mask */ + u8 whoami; /* indicates measurement precision */ + s16 (*read_data) (struct lis3lv02d *lis3, int reg); +diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c +index 7b12abe86b94..9c3c83ef445b 100644 +--- a/drivers/platform/x86/hp_accel.c ++++ b/drivers/platform/x86/hp_accel.c +@@ -101,6 +101,9 @@ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids); + static int lis3lv02d_acpi_init(struct lis3lv02d *lis3) + { + struct acpi_device *dev = lis3->bus_priv; ++ if (!lis3->init_required) ++ return 0; ++ + if (acpi_evaluate_object(dev->handle, METHOD_NAME__INI, + NULL, NULL) != AE_OK) + return -EINVAL; +@@ -367,6 +370,7 @@ static int lis3lv02d_add(struct acpi_device *device) + } + + /* call the core layer do its init */ ++ lis3_dev.init_required = true; + ret = lis3lv02d_init_device(&lis3_dev); + if (ret) + return ret; +@@ -414,11 +418,27 @@ static int lis3lv02d_suspend(struct device *dev) + + static int lis3lv02d_resume(struct device *dev) + { ++ lis3_dev.init_required = false; ++ lis3lv02d_poweron(&lis3_dev); ++ return 0; ++} ++ ++static int lis3lv02d_restore(struct device *dev) ++{ ++ lis3_dev.init_required = true; + lis3lv02d_poweron(&lis3_dev); + return 0; + } + +-static SIMPLE_DEV_PM_OPS(hp_accel_pm, lis3lv02d_suspend, lis3lv02d_resume); ++static const struct dev_pm_ops hp_accel_pm = { ++ .suspend = lis3lv02d_suspend, ++ .resume = lis3lv02d_resume, ++ .freeze = lis3lv02d_suspend, ++ .thaw = lis3lv02d_resume, ++ .poweroff = lis3lv02d_suspend, ++ .restore = lis3lv02d_restore, ++}; ++ + #define HP_ACCEL_PM (&hp_accel_pm) + #else + #define HP_ACCEL_PM NULL +-- +2.30.2 + diff --git a/queue-4.14/platform-x86-intel_punit_ipc-append-module_device_ta.patch b/queue-4.14/platform-x86-intel_punit_ipc-append-module_device_ta.patch new file mode 100644 index 00000000000..434bfa199b8 --- /dev/null +++ b/queue-4.14/platform-x86-intel_punit_ipc-append-module_device_ta.patch @@ -0,0 +1,38 @@ +From 87709a2be3eb29cddb78c7a821c0ba1ee5f9b7a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 13:15:21 +0300 +Subject: platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI + +From: Andy Shevchenko + +[ Upstream commit bc1eca606d8084465e6f89fd646cc71defbad490 ] + +The intel_punit_ipc driver might be compiled as a module. +When udev handles the event of the devices appearing +the intel_punit_ipc module is missing. + +Append MODULE_DEVICE_TABLE for ACPI case to fix the loading issue. + +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210519101521.79338-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel_punit_ipc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c +index b7dfe06261f1..9865d11eda75 100644 +--- a/drivers/platform/x86/intel_punit_ipc.c ++++ b/drivers/platform/x86/intel_punit_ipc.c +@@ -330,6 +330,7 @@ static const struct acpi_device_id punit_ipc_acpi_ids[] = { + { "INT34D4", 0 }, + { } + }; ++MODULE_DEVICE_TABLE(acpi, punit_ipc_acpi_ids); + + static struct platform_driver intel_punit_ipc_driver = { + .probe = intel_punit_ipc_probe, +-- +2.30.2 + diff --git a/queue-4.14/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch b/queue-4.14/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch new file mode 100644 index 00000000000..ea20c9ce159 --- /dev/null +++ b/queue-4.14/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch @@ -0,0 +1,65 @@ +From e2cb29ebe6121f7a204190c8edb2b3c7bd9d6954 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 03:04:37 +0000 +Subject: scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic + +From: Matt Wang + +[ Upstream commit 56f396146af278135c0ff958c79b5ee1bd22453d ] + +Commit 391e2f25601e ("[SCSI] BusLogic: Port driver to 64-bit") +introduced a serious issue for 64-bit systems. With this commit, +64-bit kernel will enumerate 8*15 non-existing disks. This is caused +by the broken CCB structure. The change from u32 data to void *data +increased CCB length on 64-bit system, which introduced an extra 4 +byte offset of the CDB. This leads to incorrect response to INQUIRY +commands during enumeration. + +Fix disk enumeration failure by reverting the portion of the commit +above which switched the data pointer from u32 to void. + +Link: https://lore.kernel.org/r/C325637F-1166-4340-8F0F-3BCCD59D4D54@vmware.com +Acked-by: Khalid Aziz +Signed-off-by: Matt Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/BusLogic.c | 6 +++--- + drivers/scsi/BusLogic.h | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c +index 35380a58d3f0..48c1b590415d 100644 +--- a/drivers/scsi/BusLogic.c ++++ b/drivers/scsi/BusLogic.c +@@ -3081,11 +3081,11 @@ static int blogic_qcmd_lck(struct scsi_cmnd *command, + ccb->opcode = BLOGIC_INITIATOR_CCB_SG; + ccb->datalen = count * sizeof(struct blogic_sg_seg); + if (blogic_multimaster_type(adapter)) +- ccb->data = (void *)((unsigned int) ccb->dma_handle + ++ ccb->data = (unsigned int) ccb->dma_handle + + ((unsigned long) &ccb->sglist - +- (unsigned long) ccb)); ++ (unsigned long) ccb); + else +- ccb->data = ccb->sglist; ++ ccb->data = virt_to_32bit_virt(ccb->sglist); + + scsi_for_each_sg(command, sg, count, i) { + ccb->sglist[i].segbytes = sg_dma_len(sg); +diff --git a/drivers/scsi/BusLogic.h b/drivers/scsi/BusLogic.h +index 8d47e2c88d24..1a33a4b28d45 100644 +--- a/drivers/scsi/BusLogic.h ++++ b/drivers/scsi/BusLogic.h +@@ -821,7 +821,7 @@ struct blogic_ccb { + unsigned char cdblen; /* Byte 2 */ + unsigned char sense_datalen; /* Byte 3 */ + u32 datalen; /* Bytes 4-7 */ +- void *data; /* Bytes 8-11 */ ++ u32 data; /* Bytes 8-11 */ + unsigned char:8; /* Byte 12 */ + unsigned char:8; /* Byte 13 */ + enum blogic_adapter_status adapter_status; /* Byte 14 */ +-- +2.30.2 + diff --git a/queue-4.14/serial-max310x-unregister-uart-driver-in-case-of-fai.patch b/queue-4.14/serial-max310x-unregister-uart-driver-in-case-of-fai.patch new file mode 100644 index 00000000000..7395acdfade --- /dev/null +++ b/queue-4.14/serial-max310x-unregister-uart-driver-in-case-of-fai.patch @@ -0,0 +1,49 @@ +From ba3a62e549d6ae398446c924d15cc4b65b12a39e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:38 +0200 +Subject: serial: max310x: unregister uart driver in case of failure and abort + +From: Atul Gopinathan + +[ Upstream commit 3890e3dea315f1a257d1b940a2a4e2fa16a7b095 ] + +The macro "spi_register_driver" invokes the function +"__spi_register_driver()" which has a return type of int and can fail, +returning a negative value in such a case. This is currently ignored and +the init() function yields success even if the spi driver failed to +register. + +Fix this by collecting the return value of "__spi_register_driver()" and +also unregister the uart driver in case of failure. + +Cc: Jiri Slaby +Signed-off-by: Atul Gopinathan +Link: https://lore.kernel.org/r/20210503115736.2104747-12-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index cec995ec11ea..454659544d35 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1385,10 +1385,12 @@ static int __init max310x_uart_init(void) + return ret; + + #ifdef CONFIG_SPI_MASTER +- spi_register_driver(&max310x_spi_driver); ++ ret = spi_register_driver(&max310x_spi_driver); ++ if (ret) ++ uart_unregister_driver(&max310x_uart); + #endif + +- return 0; ++ return ret; + } + module_init(max310x_uart_init); + +-- +2.30.2 + diff --git a/queue-4.14/series b/queue-4.14/series index f7f21e9dd6e..c8bc93688a4 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -42,3 +42,23 @@ tipc-skb_linearize-the-head-skb-when-reassembling-msgs.patch i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch perf-jevents-fix-getting-maximum-number-of-fds.patch +platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch +serial-max310x-unregister-uart-driver-in-case-of-fai.patch +net-fujitsu-fix-potential-null-ptr-deref.patch +net-caif-remove-bug_on-dev-null-in-caif_xmit.patch +char-hpet-add-checks-after-calling-ioremap.patch +alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch +isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch +ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch +dmaengine-qcom_hidma-comment-platform_driver_registe.patch +libertas-register-sysfs-groups-properly.patch +media-dvb-add-check-on-sp8870_readreg-return.patch +media-gspca-mt9m111-check-write_bridge-for-timeout.patch +media-gspca-properly-check-for-errors-in-po1030_prob.patch +scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch +openrisc-define-memory-barrier-mb.patch +btrfs-do-not-bug_on-in-link_to_fixup_dir.patch +platform-x86-hp-wireless-add-amd-s-hardware-id-to-th.patch +platform-x86-intel_punit_ipc-append-module_device_ta.patch +smb3-incorrect-file-id-in-requests-compounded-with-o.patch +drm-amdgpu-fix-a-use-after-free.patch diff --git a/queue-4.14/smb3-incorrect-file-id-in-requests-compounded-with-o.patch b/queue-4.14/smb3-incorrect-file-id-in-requests-compounded-with-o.patch new file mode 100644 index 00000000000..16ccb20f4fd --- /dev/null +++ b/queue-4.14/smb3-incorrect-file-id-in-requests-compounded-with-o.patch @@ -0,0 +1,42 @@ +From 4e8235eb42d9dab52814a851fd24178ad1dc1af5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 May 2021 09:52:22 -0500 +Subject: SMB3: incorrect file id in requests compounded with open + +From: Steve French + +[ Upstream commit c0d46717b95735b0eacfddbcca9df37a49de9c7a ] + +See MS-SMB2 3.2.4.1.4, file ids in compounded requests should be set to +0xFFFFFFFFFFFFFFFF (we were treating it as u32 not u64 and setting +it incorrectly). + +Signed-off-by: Steve French +Reported-by: Stefan Metzmacher +Reviewed-by: Shyam Prasad N +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2pdu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 2097b5fd51ba..77a9aeaf2cb1 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2518,10 +2518,10 @@ smb2_new_read_req(void **buf, unsigned int *total_len, + * Related requests use info from previous read request + * in chain. + */ +- shdr->SessionId = 0xFFFFFFFF; ++ shdr->SessionId = 0xFFFFFFFFFFFFFFFF; + shdr->TreeId = 0xFFFFFFFF; +- req->PersistentFileId = 0xFFFFFFFF; +- req->VolatileFileId = 0xFFFFFFFF; ++ req->PersistentFileId = 0xFFFFFFFFFFFFFFFF; ++ req->VolatileFileId = 0xFFFFFFFFFFFFFFFF; + } + } + if (remaining_bytes > io_parms->length) +-- +2.30.2 + -- 2.47.3