--- /dev/null
+From 5005bbef55c3425fc8bd9a808e24298096e7dedf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jun 2023 02:13:32 +0200
+Subject: Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
+
+From: Tobias Heider <me@tobhe.de>
+
+[ Upstream commit 046f753da6143ee16452966915087ec8b0de3c70 ]
+
+Fixes a bug where on the M1 mac mini initramfs-tools fails to
+include the necessary firmware into the initrd.
+
+Fixes: c4dab50697ff ("tg3: Download 57766 EEE service patch firmware")
+Signed-off-by: Tobias Heider <me@tobhe.de>
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://lore.kernel.org/r/ZJt7LKzjdz8+dClx@tobhe.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 613ca6124e3ce..d14f37be1eb3e 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -224,6 +224,7 @@ MODULE_AUTHOR("David S. Miller (davem@redhat.com) and Jeff Garzik (jgarzik@pobox
+ MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver");
+ MODULE_LICENSE("GPL");
+ MODULE_FIRMWARE(FIRMWARE_TG3);
++MODULE_FIRMWARE(FIRMWARE_TG357766);
+ MODULE_FIRMWARE(FIRMWARE_TG3TSO);
+ MODULE_FIRMWARE(FIRMWARE_TG3TSO5);
+
+--
+2.39.2
+
--- /dev/null
+From 83648bdd4f9ee3aa360ef100d1de10c6f6a9df47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 19:05:49 +0000
+Subject: apparmor: fix missing error check for rhashtable_insert_fast
+
+From: Danila Chernetsov <listdansp@mail.ru>
+
+[ Upstream commit 000518bc5aef25d3f703592a0296d578c98b1517 ]
+
+ rhashtable_insert_fast() could return err value when memory allocation is
+ failed. but unpack_profile() do not check values and this always returns
+ success value. This patch just adds error check code.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: e025be0f26d5 ("apparmor: support querying extended trusted helper extra data")
+
+Signed-off-by: Danila Chernetsov <listdansp@mail.ru>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/policy_unpack.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
+index 519656e685822..10896d69c442a 100644
+--- a/security/apparmor/policy_unpack.c
++++ b/security/apparmor/policy_unpack.c
+@@ -909,8 +909,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ goto fail;
+ }
+
+- rhashtable_insert_fast(profile->data, &data->head,
+- profile->data->p);
++ if (rhashtable_insert_fast(profile->data, &data->head,
++ profile->data->p)) {
++ kfree_sensitive(data->key);
++ kfree_sensitive(data);
++ info = "failed to insert data to table";
++ goto fail;
++ }
+ }
+
+ if (!unpack_nameX(e, AA_STRUCTEND, NULL)) {
+--
+2.39.2
+
--- /dev/null
+From 616a9b481908c95aa72b527b8960b589d3571e81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 12:11:49 +0300
+Subject: clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks
+
+From: Mantas Pucka <mantas@8devices.com>
+
+[ Upstream commit 56e5ae0116aef87273cf1812d608645b076e4f02 ]
+
+SDCC clocks must be rounded down to avoid overclocking the controller.
+
+Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support")
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/1682413909-24927-1-git-send-email-mantas@8devices.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq6018.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c
+index 3f9c2f61a5d93..5c5d1b04ea7af 100644
+--- a/drivers/clk/qcom/gcc-ipq6018.c
++++ b/drivers/clk/qcom/gcc-ipq6018.c
+@@ -1654,7 +1654,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = {
+ .name = "sdcc1_apps_clk_src",
+ .parent_data = gcc_xo_gpll0_gpll2_gpll0_out_main_div2,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_floor_ops,
+ },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 30c3209f3b0dcecdbf0f87eebc3da1f038037201 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 May 2023 21:08:55 +0200
+Subject: clk: qcom: ipq6018: fix networking resets
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 349b5bed539b491b7894a5186a895751fd8ba6c7 ]
+
+Networking resets in IPQ6018 all use bitmask as they require multiple
+bits to be set and cleared instead of a single bit.
+
+So, current networking resets have the same register and bit 0 set which
+is clearly incorrect.
+
+Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230526190855.2941291-2-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq6018.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c
+index 5c5d1b04ea7af..cde62a11f5736 100644
+--- a/drivers/clk/qcom/gcc-ipq6018.c
++++ b/drivers/clk/qcom/gcc-ipq6018.c
+@@ -4517,24 +4517,24 @@ static const struct qcom_reset_map gcc_ipq6018_resets[] = {
+ [GCC_PCIE0_AHB_ARES] = { 0x75040, 5 },
+ [GCC_PCIE0_AXI_MASTER_STICKY_ARES] = { 0x75040, 6 },
+ [GCC_PCIE0_AXI_SLAVE_STICKY_ARES] = { 0x75040, 7 },
+- [GCC_PPE_FULL_RESET] = { 0x68014, 0 },
+- [GCC_UNIPHY0_SOFT_RESET] = { 0x56004, 0 },
++ [GCC_PPE_FULL_RESET] = { .reg = 0x68014, .bitmask = 0xf0000 },
++ [GCC_UNIPHY0_SOFT_RESET] = { .reg = 0x56004, .bitmask = 0x3ff2 },
+ [GCC_UNIPHY0_XPCS_RESET] = { 0x56004, 2 },
+- [GCC_UNIPHY1_SOFT_RESET] = { 0x56104, 0 },
++ [GCC_UNIPHY1_SOFT_RESET] = { .reg = 0x56104, .bitmask = 0x32 },
+ [GCC_UNIPHY1_XPCS_RESET] = { 0x56104, 2 },
+- [GCC_EDMA_HW_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT1_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT2_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT3_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT4_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT5_RESET] = { 0x68014, 0 },
+- [GCC_UNIPHY0_PORT1_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT2_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT3_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT4_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT5_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT_4_5_RESET] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT_4_RESET] = { 0x56004, 0 },
++ [GCC_EDMA_HW_RESET] = { .reg = 0x68014, .bitmask = 0x300000 },
++ [GCC_NSSPORT1_RESET] = { .reg = 0x68014, .bitmask = 0x1000003 },
++ [GCC_NSSPORT2_RESET] = { .reg = 0x68014, .bitmask = 0x200000c },
++ [GCC_NSSPORT3_RESET] = { .reg = 0x68014, .bitmask = 0x4000030 },
++ [GCC_NSSPORT4_RESET] = { .reg = 0x68014, .bitmask = 0x8000300 },
++ [GCC_NSSPORT5_RESET] = { .reg = 0x68014, .bitmask = 0x10000c00 },
++ [GCC_UNIPHY0_PORT1_ARES] = { .reg = 0x56004, .bitmask = 0x30 },
++ [GCC_UNIPHY0_PORT2_ARES] = { .reg = 0x56004, .bitmask = 0xc0 },
++ [GCC_UNIPHY0_PORT3_ARES] = { .reg = 0x56004, .bitmask = 0x300 },
++ [GCC_UNIPHY0_PORT4_ARES] = { .reg = 0x56004, .bitmask = 0xc00 },
++ [GCC_UNIPHY0_PORT5_ARES] = { .reg = 0x56004, .bitmask = 0x3000 },
++ [GCC_UNIPHY0_PORT_4_5_RESET] = { .reg = 0x56004, .bitmask = 0x3c02 },
++ [GCC_UNIPHY0_PORT_4_RESET] = { .reg = 0x56004, .bitmask = 0xc02 },
+ [GCC_LPASS_BCR] = {0x1F000, 0},
+ [GCC_UBI32_TBU_BCR] = {0x65000, 0},
+ [GCC_LPASS_TBU_BCR] = {0x6C000, 0},
+--
+2.39.2
+
--- /dev/null
+From a61d6636e9c81471b461bc65293107701b097419 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jul 2022 15:41:29 +0200
+Subject: clk: qcom: reset: Allow specifying custom reset delay
+
+From: Stephan Gerhold <stephan.gerhold@kernkonzept.com>
+
+[ Upstream commit 2cb8a39b6781ea23accd1fa93b3ad000d0948aec ]
+
+The amount of time required between asserting and deasserting the reset
+signal can vary depending on the involved hardware component. Sometimes
+1 us might not be enough and a larger delay is necessary to conform to
+the specifications.
+
+Usually this is worked around in the consuming drivers, by replacing
+reset_control_reset() with a sequence of reset_control_assert(), waiting
+for a custom delay, followed by reset_control_deassert().
+
+However, in some cases the driver making use of the reset is generic and
+can be used with different reset controllers. In this case the reset
+time requirement is better handled directly by the reset controller
+driver.
+
+Make this possible by adding an "udelay" field to the qcom_reset_map
+that allows setting a different reset delay (in microseconds).
+
+Signed-off-by: Stephan Gerhold <stephan.gerhold@kernkonzept.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220706134132.3623415-4-stephan.gerhold@kernkonzept.com
+Stable-dep-of: 349b5bed539b ("clk: qcom: ipq6018: fix networking resets")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/reset.c | 4 +++-
+ drivers/clk/qcom/reset.h | 1 +
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c
+index 819d194be8f7b..2a16adb572d2b 100644
+--- a/drivers/clk/qcom/reset.c
++++ b/drivers/clk/qcom/reset.c
+@@ -13,8 +13,10 @@
+
+ static int qcom_reset(struct reset_controller_dev *rcdev, unsigned long id)
+ {
++ struct qcom_reset_controller *rst = to_qcom_reset_controller(rcdev);
++
+ rcdev->ops->assert(rcdev, id);
+- udelay(1);
++ udelay(rst->reset_map[id].udelay ?: 1); /* use 1 us as default */
+ rcdev->ops->deassert(rcdev, id);
+ return 0;
+ }
+diff --git a/drivers/clk/qcom/reset.h b/drivers/clk/qcom/reset.h
+index 2a08b5e282c77..b8c113582072b 100644
+--- a/drivers/clk/qcom/reset.h
++++ b/drivers/clk/qcom/reset.h
+@@ -11,6 +11,7 @@
+ struct qcom_reset_map {
+ unsigned int reg;
+ u8 bit;
++ u8 udelay;
+ };
+
+ struct regmap;
+--
+2.39.2
+
--- /dev/null
+From a87dfe9a16eb2c2197d067716bc5e4ed5ed3075b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Nov 2022 14:28:59 +0100
+Subject: clk: qcom: reset: support resetting multiple bits
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 4a5210893625f89723ea210d7c630b730abb37ad ]
+
+This patch adds the support for giving the complete bitmask
+in reset structure and reset operation will use this bitmask
+for all reset operations.
+
+Currently, reset structure only takes a single bit for each reset
+and then calculates the bitmask by using the BIT() macro.
+
+However, this is not sufficient anymore for newer SoC-s like IPQ8074,
+IPQ6018 and more, since their networking resets require multiple bits
+to be asserted in order to properly reset the HW block completely.
+
+So, in order to allow asserting multiple bits add "bitmask" field to
+qcom_reset_map, and then use that bitmask value if its populated in the
+driver, if its not populated, then we just default to existing behaviour
+and calculate the bitmask on the fly.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221107132901.489240-1-robimarko@gmail.com
+Stable-dep-of: 349b5bed539b ("clk: qcom: ipq6018: fix networking resets")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/reset.c | 4 ++--
+ drivers/clk/qcom/reset.h | 1 +
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c
+index 2a16adb572d2b..0e914ec7aeae1 100644
+--- a/drivers/clk/qcom/reset.c
++++ b/drivers/clk/qcom/reset.c
+@@ -30,7 +30,7 @@ qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
+
+ rst = to_qcom_reset_controller(rcdev);
+ map = &rst->reset_map[id];
+- mask = BIT(map->bit);
++ mask = map->bitmask ? map->bitmask : BIT(map->bit);
+
+ return regmap_update_bits(rst->regmap, map->reg, mask, mask);
+ }
+@@ -44,7 +44,7 @@ qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id)
+
+ rst = to_qcom_reset_controller(rcdev);
+ map = &rst->reset_map[id];
+- mask = BIT(map->bit);
++ mask = map->bitmask ? map->bitmask : BIT(map->bit);
+
+ return regmap_update_bits(rst->regmap, map->reg, mask, 0);
+ }
+diff --git a/drivers/clk/qcom/reset.h b/drivers/clk/qcom/reset.h
+index b8c113582072b..9a47c838d9b1b 100644
+--- a/drivers/clk/qcom/reset.h
++++ b/drivers/clk/qcom/reset.h
+@@ -12,6 +12,7 @@ struct qcom_reset_map {
+ unsigned int reg;
+ u8 bit;
+ u8 udelay;
++ u32 bitmask;
+ };
+
+ struct regmap;
+--
+2.39.2
+
--- /dev/null
+From 61f796fd8aa474d8168da226aa04ea505203440b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 15:35:28 +0100
+Subject: coresight: Fix loss of connection info when a module is unloaded
+
+From: James Clark <james.clark@arm.com>
+
+[ Upstream commit c45b2835e7b205783bdfe08cc98fa86a7c5eeb74 ]
+
+child_fwnode should be a read only property based on the DT or ACPI. If
+it's cleared on the parent device when a child is unloaded, then when
+the child is loaded again the connection won't be remade.
+
+child_dev should be cleared instead which signifies that the connection
+should be remade when the child_fwnode registers a new coresight_device.
+
+Similarly the reference count shouldn't be decremented as long as the
+parent device exists. The correct place to drop the reference is in
+coresight_release_platform_data() which is already done.
+
+Reproducible on Juno with the following steps:
+
+ # load all coresight modules.
+ $ cd /sys/bus/coresight/devices/
+ $ echo 1 > tmc_etr0/enable_sink
+ $ echo 1 > etm0/enable_source
+ # Works fine ^
+
+ $ echo 0 > etm0/enable_source
+ $ rmmod coresight-funnel
+ $ modprobe coresight-funnel
+ $ echo 1 > etm0/enable_source
+ -bash: echo: write error: Invalid argument
+
+Fixes: 37ea1ffddffa ("coresight: Use fwnode handle instead of device names")
+Fixes: 2af89ebacf29 ("coresight: Clear the connection field properly")
+Tested-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Reviewed-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: James Clark <james.clark@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20230425143542.2305069-2-james.clark@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-core.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
+index 5ddc8103503b5..c4b805b045316 100644
+--- a/drivers/hwtracing/coresight/coresight-core.c
++++ b/drivers/hwtracing/coresight/coresight-core.c
+@@ -1376,13 +1376,8 @@ static int coresight_remove_match(struct device *dev, void *data)
+ if (csdev->dev.fwnode == conn->child_fwnode) {
+ iterator->orphan = true;
+ coresight_remove_links(iterator, conn);
+- /*
+- * Drop the reference to the handle for the remote
+- * device acquired in parsing the connections from
+- * platform data.
+- */
+- fwnode_handle_put(conn->child_fwnode);
+- conn->child_fwnode = NULL;
++
++ conn->child_dev = NULL;
+ /* No need to continue */
+ break;
+ }
+--
+2.39.2
+
--- /dev/null
+From d0256185a10ef07d2369178e0bbe9cd76428a72a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 16:39:53 +0200
+Subject: extcon: Fix kernel doc of property capability fields to avoid
+ warnings
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 73346b9965ebda2feb7fef8629e9b28baee820e3 ]
+
+Kernel documentation has to be synchronized with a code, otherwise
+the validator is not happy:
+
+ Function parameter or member 'usb_bits' not described in 'extcon_cable'
+ Function parameter or member 'chg_bits' not described in 'extcon_cable'
+ Function parameter or member 'jack_bits' not described in 'extcon_cable'
+ Function parameter or member 'disp_bits' not described in 'extcon_cable'
+
+Describe the fields added in the past.
+
+Fixes: ceaa98f442cf ("extcon: Add the support for the capability of each property")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
+index 3bc83feb5a34b..fa08dec389dc1 100644
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -200,6 +200,10 @@ static const struct __extcon_info {
+ * @chg_propval: the array of charger connector properties
+ * @jack_propval: the array of jack connector properties
+ * @disp_propval: the array of display connector properties
++ * @usb_bits: the bit array of the USB connector property capabilities
++ * @chg_bits: the bit array of the charger connector property capabilities
++ * @jack_bits: the bit array of the jack connector property capabilities
++ * @disp_bits: the bit array of the display connector property capabilities
+ */
+ struct extcon_cable {
+ struct extcon_dev *edev;
+--
+2.39.2
+
--- /dev/null
+From 39bb19587e6471cc482bc008fbad593413305ddc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 16:39:52 +0200
+Subject: extcon: Fix kernel doc of property fields to avoid warnings
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 7e77e0b7a9f4cdf91cb0950749b40c840ea63efc ]
+
+Kernel documentation has to be synchronized with a code, otherwise
+the validator is not happy:
+
+ Function parameter or member 'usb_propval' not described in 'extcon_cable'
+ Function parameter or member 'chg_propval' not described in 'extcon_cable'
+ Function parameter or member 'jack_propval' not described in 'extcon_cable'
+ Function parameter or member 'disp_propval' not described in 'extcon_cable'
+
+Describe the fields added in the past.
+
+Fixes: 067c1652e7a7 ("extcon: Add the support for extcon property according to extcon type")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
+index 356610404bb40..3bc83feb5a34b 100644
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -196,6 +196,10 @@ static const struct __extcon_info {
+ * @attr_name: "name" sysfs entry
+ * @attr_state: "state" sysfs entry
+ * @attrs: the array pointing to attr_name and attr_state for attr_g
++ * @usb_propval: the array of USB connector properties
++ * @chg_propval: the array of charger connector properties
++ * @jack_propval: the array of jack connector properties
++ * @disp_propval: the array of display connector properties
+ */
+ struct extcon_cable {
+ struct extcon_dev *edev;
+--
+2.39.2
+
--- /dev/null
+From 4bba5c228b9251a0bb28340d8473b289614df26d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 09:41:02 +0800
+Subject: f2fs: fix error path handling in truncate_dnode()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 0135c482fa97e2fd8245cb462784112a00ed1211 ]
+
+If truncate_node() fails in truncate_dnode(), it missed to call
+f2fs_put_page(), fix it.
+
+Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index c63274d4b74b0..02cb1c806c3ed 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -884,8 +884,10 @@ static int truncate_dnode(struct dnode_of_data *dn)
+ dn->ofs_in_node = 0;
+ f2fs_truncate_data_blocks(dn);
+ err = truncate_node(dn);
+- if (err)
++ if (err) {
++ f2fs_put_page(page, 1);
+ return err;
++ }
+
+ return 1;
+ }
+--
+2.39.2
+
--- /dev/null
+From 76c2ad598eae18e59b499f84abc748ad2b4dcee8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Aug 2021 23:41:42 +0200
+Subject: i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in
+ xiic_process()
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 743e227a895923c37a333eb2ebf3e391f00c406d ]
+
+The __xiic_start_xfer() manipulates the interrupt flags, xiic_wakeup()
+may result in return from xiic_xfer() early. Defer both to the end of
+the xiic_process() interrupt thread, so that they are executed after
+all the other interrupt bits handling completed and once it completely
+safe to perform changes to the interrupt bits in the hardware.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Acked-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Stable-dep-of: cb6e45c9a0ad ("i2c: xiic: Don't try to handle more interrupt events after error")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 37 ++++++++++++++++++++++++-----------
+ 1 file changed, 26 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 3b564e68130b5..8b93c22f3c400 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -375,6 +375,9 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ struct xiic_i2c *i2c = dev_id;
+ u32 pend, isr, ier;
+ u32 clr = 0;
++ int xfer_more = 0;
++ int wakeup_req = 0;
++ int wakeup_code = 0;
+
+ /* Get the interrupt Status from the IPIF. There is no clearing of
+ * interrupts in the IPIF. Interrupts must be cleared at the source.
+@@ -411,10 +414,14 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ */
+ xiic_reinit(i2c);
+
+- if (i2c->rx_msg)
+- xiic_wakeup(i2c, STATE_ERROR);
+- if (i2c->tx_msg)
+- xiic_wakeup(i2c, STATE_ERROR);
++ if (i2c->rx_msg) {
++ wakeup_req = 1;
++ wakeup_code = STATE_ERROR;
++ }
++ if (i2c->tx_msg) {
++ wakeup_req = 1;
++ wakeup_code = STATE_ERROR;
++ }
+ }
+ if (pend & XIIC_INTR_RX_FULL_MASK) {
+ /* Receive register/FIFO is full */
+@@ -448,8 +455,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ i2c->tx_msg++;
+ dev_dbg(i2c->adap.dev.parent,
+ "%s will start next...\n", __func__);
+-
+- __xiic_start_xfer(i2c);
++ xfer_more = 1;
+ }
+ }
+ }
+@@ -463,11 +469,13 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ if (!i2c->tx_msg)
+ goto out;
+
+- if ((i2c->nmsgs == 1) && !i2c->rx_msg &&
+- xiic_tx_space(i2c) == 0)
+- xiic_wakeup(i2c, STATE_DONE);
++ wakeup_req = 1;
++
++ if (i2c->nmsgs == 1 && !i2c->rx_msg &&
++ xiic_tx_space(i2c) == 0)
++ wakeup_code = STATE_DONE;
+ else
+- xiic_wakeup(i2c, STATE_ERROR);
++ wakeup_code = STATE_ERROR;
+ }
+ if (pend & (XIIC_INTR_TX_EMPTY_MASK | XIIC_INTR_TX_HALF_MASK)) {
+ /* Transmit register/FIFO is empty or ½ empty */
+@@ -491,7 +499,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ if (i2c->nmsgs > 1) {
+ i2c->nmsgs--;
+ i2c->tx_msg++;
+- __xiic_start_xfer(i2c);
++ xfer_more = 1;
+ } else {
+ xiic_irq_dis(i2c, XIIC_INTR_TX_HALF_MASK);
+
+@@ -509,6 +517,13 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ dev_dbg(i2c->adap.dev.parent, "%s clr: 0x%x\n", __func__, clr);
+
+ xiic_setreg32(i2c, XIIC_IISR_OFFSET, clr);
++ if (xfer_more)
++ __xiic_start_xfer(i2c);
++ if (wakeup_req)
++ xiic_wakeup(i2c, wakeup_code);
++
++ WARN_ON(xfer_more && wakeup_req);
++
+ mutex_unlock(&i2c->lock);
+ return IRQ_HANDLED;
+ }
+--
+2.39.2
+
--- /dev/null
+From 513d8061c71348ce38424f08942004a1c7dca1bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 12:25:58 -0600
+Subject: i2c: xiic: Don't try to handle more interrupt events after error
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit cb6e45c9a0ad9e0f8664fd06db0227d185dc76ab ]
+
+In xiic_process, it is possible that error events such as arbitration
+lost or TX error can be raised in conjunction with other interrupt flags
+such as TX FIFO empty or bus not busy. Error events result in the
+controller being reset and the error returned to the calling request,
+but the function could potentially try to keep handling the other
+events, such as by writing more messages into the TX FIFO. Since the
+transaction has already failed, this is not helpful and will just cause
+issues.
+
+This problem has been present ever since:
+
+commit 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr")
+
+which allowed non-error events to be handled after errors, but became
+more obvious after:
+
+commit 743e227a8959 ("i2c: xiic: Defer xiic_wakeup() and
+__xiic_start_xfer() in xiic_process()")
+
+which reworked the code to add a WARN_ON which triggers if both the
+xfer_more and wakeup_req flags were set, since this combination is
+not supposed to happen, but was occurring in this scenario.
+
+Skip further interrupt handling after error flags are detected to avoid
+this problem.
+
+Fixes: 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Acked-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 8b93c22f3c400..568e97c3896d1 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -422,6 +422,8 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ wakeup_req = 1;
+ wakeup_code = STATE_ERROR;
+ }
++ /* don't try to handle other events */
++ goto out;
+ }
+ if (pend & XIIC_INTR_RX_FULL_MASK) {
+ /* Receive register/FIFO is full */
+--
+2.39.2
+
--- /dev/null
+From 85f37765b34fefa7c7fa4b3b2a210c953058985f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 10:40:17 +0800
+Subject: kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR
+
+From: Muchun Song <songmuchun@bytedance.com>
+
+[ Upstream commit 30480b988f88c279752f3202a26b6fee5f586aef ]
+
+The root->ino_idr is supposed to be protected by kernfs_idr_lock, fix
+it.
+
+Fixes: 488dee96bb62 ("kernfs: allow creating kernfs objects with arbitrary uid/gid")
+Signed-off-by: Muchun Song <songmuchun@bytedance.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20230523024017.24851-1-songmuchun@bytedance.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/kernfs/dir.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
+index 8b3c86a502daa..c91ee05cce74f 100644
+--- a/fs/kernfs/dir.c
++++ b/fs/kernfs/dir.c
+@@ -679,7 +679,9 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
+ return kn;
+
+ err_out3:
++ spin_lock(&kernfs_idr_lock);
+ idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
++ spin_unlock(&kernfs_idr_lock);
+ err_out2:
+ kmem_cache_free(kernfs_node_cache, kn);
+ err_out1:
+--
+2.39.2
+
--- /dev/null
+From f23a34647b05c14ae2a46511c53c8ac0d9274a38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 15:54:23 +0100
+Subject: KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
+
+From: Nico Boehr <nrb@linux.ibm.com>
+
+[ Upstream commit 285cff4c0454340a4dc53f46e67f2cb1c293bd74 ]
+
+The KVM_S390_GET_CMMA_BITS ioctl may return incorrect values when userspace
+specifies a start_gfn outside of memslots.
+
+This can occur when a VM has multiple memslots with a hole in between:
+
++-----+----------+--------+--------+
+| ... | Slot N-1 | <hole> | Slot N |
++-----+----------+--------+--------+
+ ^ ^ ^ ^
+ | | | |
+GFN A A+B | |
+ A+B+C |
+ A+B+C+D
+
+When userspace specifies a GFN in [A+B, A+B+C), it would expect to get the
+CMMA values of the first dirty page in Slot N. However, userspace may get a
+start_gfn of A+B+C+D with a count of 0, hence completely skipping over any
+dirty pages in slot N.
+
+The error is in kvm_s390_next_dirty_cmma(), which assumes
+gfn_to_memslot_approx() will return the memslot _below_ the specified GFN
+when the specified GFN lies outside a memslot. In reality it may return
+either the memslot below or above the specified GFN.
+
+When a memslot above the specified GFN is returned this happens:
+
+- ofs is calculated, but since the memslot's base_gfn is larger than the
+ specified cur_gfn, ofs will underflow to a huge number.
+- ofs is passed to find_next_bit(). Since ofs will exceed the memslot's
+ number of pages, the number of pages in the memslot is returned,
+ completely skipping over all bits in the memslot userspace would be
+ interested in.
+
+Fix this by resetting ofs to zero when a memslot _above_ cur_gfn is
+returned (cur_gfn < ms->base_gfn).
+
+Signed-off-by: Nico Boehr <nrb@linux.ibm.com>
+Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Fixes: afdad61615cc ("KVM: s390: Fix storage attributes migration with memory slots")
+Message-Id: <20230324145424.293889-2-nrb@linux.ibm.com>
+Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/kvm-s390.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 7ffc73ba220fb..7a326d03087ab 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -2005,6 +2005,10 @@ static unsigned long kvm_s390_next_dirty_cmma(struct kvm_memslots *slots,
+ ms = slots->memslots + slotidx;
+ ofs = 0;
+ }
++
++ if (cur_gfn < ms->base_gfn)
++ ofs = 0;
++
+ ofs = find_next_bit(kvm_second_dirty_bitmap(ms), ms->npages, ofs);
+ while ((slotidx > 0) && (ofs >= ms->npages)) {
+ slotidx--;
+--
+2.39.2
+
--- /dev/null
+From f97c4c8574cf7668e778f8caad7b0f8b83e75af4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 May 2023 17:42:58 +0200
+Subject: KVM: s390: vsie: fix the length of APCB bitmap
+
+From: Pierre Morel <pmorel@linux.ibm.com>
+
+[ Upstream commit 246be7d2720ea9a795b576067ecc5e5c7a1e7848 ]
+
+bit_and() uses the count of bits as the woking length.
+Fix the previous implementation and effectively use
+the right bitmap size.
+
+Fixes: 19fd83a64718 ("KVM: s390: vsie: allow CRYCB FORMAT-1")
+Fixes: 56019f9aca22 ("KVM: s390: vsie: Allow CRYCB FORMAT-2")
+
+Signed-off-by: Pierre Morel <pmorel@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Link: https://lore.kernel.org/kvm/20230511094719.9691-1-pmorel@linux.ibm.com/
+Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/vsie.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
+index ff58decfef5e8..192eacc8fbb7a 100644
+--- a/arch/s390/kvm/vsie.c
++++ b/arch/s390/kvm/vsie.c
+@@ -168,7 +168,8 @@ static int setup_apcb00(struct kvm_vcpu *vcpu, unsigned long *apcb_s,
+ sizeof(struct kvm_s390_apcb0)))
+ return -EFAULT;
+
+- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb0));
++ bitmap_and(apcb_s, apcb_s, apcb_h,
++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb0));
+
+ return 0;
+ }
+@@ -190,7 +191,8 @@ static int setup_apcb11(struct kvm_vcpu *vcpu, unsigned long *apcb_s,
+ sizeof(struct kvm_s390_apcb1)))
+ return -EFAULT;
+
+- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb1));
++ bitmap_and(apcb_s, apcb_s, apcb_h,
++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb1));
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From fa372120604ab979ca8e1579a6a76715f8d63feb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 20:00:22 -0500
+Subject: mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 1b712f18c461bd75f018033a15cf381e712806b5 ]
+
+Sec proxy/message manager data buffer is 60 bytes with the last of the
+registers indicating transmission completion. This however poses a bit
+of a challenge.
+
+The backing memory for sec_proxy / message manager is regular memory,
+and all sec proxy does is to trigger a burst of all 60 bytes of data
+over to the target thread backing ring accelerator. It doesn't do a
+memory scrub when it moves data out in the burst. When we transmit
+multiple messages, remnants of previous message is also transmitted
+which results in some random data being set in TISCI fields of
+messages that have been expanded forward.
+
+The entire concept of backward compatibility hinges on the fact that
+the unused message fields remain 0x0 allowing for 0x0 value to be
+specially considered when backward compatibility of message extension
+is done.
+
+So, instead of just writing the completion register, we continue
+to fill the message buffer up with 0x0 (note: for partial message
+involving completion, we already do this).
+
+This allows us to scale and introduce ABI changes back also work with
+other boot stages that may have left data in the internal memory.
+
+While at this, be consistent and explicit with the data_reg pointer
+increment.
+
+Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/ti-msgmgr.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c
+index 0130628f4d9db..535fe73ce3109 100644
+--- a/drivers/mailbox/ti-msgmgr.c
++++ b/drivers/mailbox/ti-msgmgr.c
+@@ -385,14 +385,20 @@ static int ti_msgmgr_send_data(struct mbox_chan *chan, void *data)
+ /* Ensure all unused data is 0 */
+ data_trail &= 0xFFFFFFFF >> (8 * (sizeof(u32) - trail_bytes));
+ writel(data_trail, data_reg);
+- data_reg++;
++ data_reg += sizeof(u32);
+ }
++
+ /*
+ * 'data_reg' indicates next register to write. If we did not already
+ * write on tx complete reg(last reg), we must do so for transmit
++ * In addition, we also need to make sure all intermediate data
++ * registers(if any required), are reset to 0 for TISCI backward
++ * compatibility to be maintained.
+ */
+- if (data_reg <= qinst->queue_buff_end)
+- writel(0, qinst->queue_buff_end);
++ while (data_reg <= qinst->queue_buff_end) {
++ writel(0, data_reg);
++ data_reg += sizeof(u32);
++ }
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 24f37a094cda6fdd619038c997a39f2bd01ef57b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 May 2023 12:53:23 +0100
+Subject: media: atomisp: gmin_platform: fix out_len in
+ gmin_get_config_dsm_var()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 1657f2934daf89e8d9fa4b2697008909eb22c73e ]
+
+Ideally, strlen(cur->string.pointer) and strlen(out) would be the same.
+But this code is using strscpy() to avoid a potential buffer overflow.
+So in the same way we should take the strlen() of the smaller string to
+avoid a buffer overflow in the caller, gmin_get_var_int().
+
+Link: https://lore.kernel.org/r/26124bcd-8132-4483-9d67-225c87d424e8@kili.mountain
+
+Fixes: 387041cda44e ("media: atomisp: improve sensor detection code to use _DSM table")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+index c9ee85037644f..f0387486eb174 100644
+--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+@@ -1198,7 +1198,7 @@ static int gmin_get_config_dsm_var(struct device *dev,
+ dev_info(dev, "found _DSM entry for '%s': %s\n", var,
+ cur->string.pointer);
+ strscpy(out, cur->string.pointer, *out_len);
+- *out_len = strlen(cur->string.pointer);
++ *out_len = strlen(out);
+
+ ACPI_FREE(obj);
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 5e051363fb7b1b7787d0243ced8a391a95c0a79a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jun 2023 04:54:35 +0200
+Subject: media: cec: i2c: ch7322: also select REGMAP
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 29f96ac23648b2259f42d40703c47dd18fd172ca ]
+
+Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors,
+so also select REGMAP to prevent the build errors.
+
+../drivers/media/cec/i2c/ch7322.c:158:21: error: variable 'ch7322_regmap' has initializer but incomplete type
+ 158 | static const struct regmap_config ch7322_regmap = {
+../drivers/media/cec/i2c/ch7322.c:159:10: error: 'const struct regmap_config' has no member named 'reg_bits'
+ 159 | .reg_bits = 8,
+../drivers/media/cec/i2c/ch7322.c:159:21: warning: excess elements in struct initializer
+ 159 | .reg_bits = 8,
+../drivers/media/cec/i2c/ch7322.c:160:10: error: 'const struct regmap_config' has no member named 'val_bits'
+ 160 | .val_bits = 8,
+../drivers/media/cec/i2c/ch7322.c:160:21: warning: excess elements in struct initializer
+ 160 | .val_bits = 8,
+../drivers/media/cec/i2c/ch7322.c:161:10: error: 'const struct regmap_config' has no member named 'max_register'
+ 161 | .max_register = 0x7f,
+../drivers/media/cec/i2c/ch7322.c:161:25: warning: excess elements in struct initializer
+ 161 | .max_register = 0x7f,
+../drivers/media/cec/i2c/ch7322.c:162:10: error: 'const struct regmap_config' has no member named 'disable_locking'
+ 162 | .disable_locking = true,
+../drivers/media/cec/i2c/ch7322.c:162:28: warning: excess elements in struct initializer
+ 162 | .disable_locking = true,
+../drivers/media/cec/i2c/ch7322.c: In function 'ch7322_probe':
+../drivers/media/cec/i2c/ch7322.c:468:26: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration]
+ 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap);
+../drivers/media/cec/i2c/ch7322.c:468:24: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
+ 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap);
+../drivers/media/cec/i2c/ch7322.c: At top level:
+../drivers/media/cec/i2c/ch7322.c:158:35: error: storage size of 'ch7322_regmap' isn't known
+ 158 | static const struct regmap_config ch7322_regmap = {
+
+Link: https://lore.kernel.org/linux-media/20230608025435.29249-1-rdunlap@infradead.org
+Fixes: 21b9a47e0ec7 ("media: cec: i2c: ch7322: Add ch7322 CEC controller driver")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Jeff Chase <jnchase@google.com>
+Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Cc: Joe Tessler <jrt@google.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/i2c/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/cec/i2c/Kconfig b/drivers/media/cec/i2c/Kconfig
+index 70432a1d69186..d912d143fb312 100644
+--- a/drivers/media/cec/i2c/Kconfig
++++ b/drivers/media/cec/i2c/Kconfig
+@@ -5,6 +5,7 @@
+ config CEC_CH7322
+ tristate "Chrontel CH7322 CEC controller"
+ depends on I2C
++ select REGMAP
+ select REGMAP_I2C
+ select CEC_CORE
+ help
+--
+2.39.2
+
--- /dev/null
+From c6af9662d3d6edf3d2bbc10fa5c62fdba365f6b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 10:04:49 -0700
+Subject: media: usb: Check az6007_read() return value
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit fdaca63186f59fc664b346c45b76576624b48e57 ]
+
+If az6007_read() returns error, there is no sence to continue.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 3af2f4f15a61 ("[media] az6007: Change the az6007 read/write routine parameter")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb-v2/az6007.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c
+index 62ee09f28a0bc..7524c90f5da61 100644
+--- a/drivers/media/usb/dvb-usb-v2/az6007.c
++++ b/drivers/media/usb/dvb-usb-v2/az6007.c
+@@ -202,7 +202,8 @@ static int az6007_rc_query(struct dvb_usb_device *d)
+ unsigned code;
+ enum rc_proto proto;
+
+- az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10);
++ if (az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10) < 0)
++ return -EIO;
+
+ if (st->data[1] == 0x44)
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From eef4166ddd9baaece342e36420631e4910a5914b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 07:59:32 +0800
+Subject: media: usb: siano: Fix warning due to null work_func_t function
+ pointer
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 6f489a966fbeb0da63d45c2c66a8957eab604bf6 ]
+
+The previous commit ebad8e731c1c ("media: usb: siano: Fix use after
+free bugs caused by do_submit_urb") adds cancel_work_sync() in
+smsusb_stop_streaming(). But smsusb_stop_streaming() may be called,
+even if the work_struct surb->wq has not been initialized. As a result,
+the warning will occur. One of the processes that could lead to warning
+is shown below:
+
+smsusb_probe()
+ smsusb_init_device()
+ if (!dev->in_ep || !dev->out_ep || align < 0) {
+ smsusb_term_device(intf);
+ smsusb_stop_streaming()
+ cancel_work_sync(&dev->surbs[i].wq);
+ __cancel_work_timer()
+ __flush_work()
+ if (WARN_ON(!work->func)) // work->func is null
+
+The log reported by syzbot is shown below:
+
+WARNING: CPU: 0 PID: 897 at kernel/workqueue.c:3066 __flush_work+0x798/0xa80 kernel/workqueue.c:3063
+Modules linked in:
+CPU: 0 PID: 897 Comm: kworker/0:2 Not tainted 6.2.0-rc1-syzkaller #0
+RIP: 0010:__flush_work+0x798/0xa80 kernel/workqueue.c:3066
+...
+RSP: 0018:ffffc9000464ebf8 EFLAGS: 00010246
+RAX: 1ffff11002dbb420 RBX: 0000000000000021 RCX: 1ffffffff204fa4e
+RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888016dda0e8
+RBP: ffffc9000464ed98 R08: 0000000000000001 R09: ffffffff90253b2f
+R10: 0000000000000001 R11: 0000000000000000 R12: ffff888016dda0e8
+R13: ffff888016dda0e8 R14: ffff888016dda100 R15: 0000000000000001
+FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007ffd4331efe8 CR3: 000000000b48e000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ __cancel_work_timer+0x315/0x460 kernel/workqueue.c:3160
+ smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline]
+ smsusb_term_device+0xda/0x2d0 drivers/media/usb/siano/smsusb.c:344
+ smsusb_init_device+0x400/0x9ce drivers/media/usb/siano/smsusb.c:419
+ smsusb_probe+0xbbd/0xc55 drivers/media/usb/siano/smsusb.c:567
+...
+
+This patch adds check before cancel_work_sync(). If surb->wq has not
+been initialized, the cancel_work_sync() will not be executed.
+
+Reported-by: syzbot+27b0b464864741b18b99@syzkaller.appspotmail.com
+Fixes: ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/siano/smsusb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
+index 1babfe6e2c361..5c223b5498b4b 100644
+--- a/drivers/media/usb/siano/smsusb.c
++++ b/drivers/media/usb/siano/smsusb.c
+@@ -179,7 +179,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev)
+
+ for (i = 0; i < MAX_URBS; i++) {
+ usb_kill_urb(&dev->surbs[i].urb);
+- cancel_work_sync(&dev->surbs[i].wq);
++ if (dev->surbs[i].wq.func)
++ cancel_work_sync(&dev->surbs[i].wq);
+
+ if (dev->surbs[i].cb) {
+ smscore_putbuffer(dev->coredev, dev->surbs[i].cb);
+--
+2.39.2
+
--- /dev/null
+From 68795b78a6685f75fa9962152a32f9bac8065db6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Sep 2020 20:03:01 +0100
+Subject: media: venus: helpers: Fix ALIGN() of non power of two
+
+From: Rikard Falkeborn <rikard.falkeborn@gmail.com>
+
+[ Upstream commit 927e78ac8bc58155316cf6f46026e1912bbbbcfc ]
+
+ALIGN() expects its second argument to be a power of 2, otherwise
+incorrect results are produced for some inputs. The output can be
+both larger or smaller than what is expected.
+
+For example, ALIGN(304, 192) equals 320 instead of 384, and
+ALIGN(65, 192) equals 256 instead of 192.
+
+However, nestling two ALIGN() as is done in this case seem to only
+produce results equal to or bigger than the expected result if ALIGN()
+had handled non powers of two, and that in turn results in framesizes
+that are either the correct size or too large.
+
+Fortunately, since 192 * 4 / 3 equals 256, it turns out that one ALIGN()
+is sufficient.
+
+Fixes: ab1eda449c6e ("media: venus: vdec: handle 10bit bitstreams")
+Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
+Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/helpers.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c
+index 5ca3920237c5a..5fdce5f07364e 100644
+--- a/drivers/media/platform/qcom/venus/helpers.c
++++ b/drivers/media/platform/qcom/venus/helpers.c
+@@ -917,8 +917,8 @@ static u32 get_framesize_raw_yuv420_tp10_ubwc(u32 width, u32 height)
+ u32 extradata = SZ_16K;
+ u32 size;
+
+- y_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256);
+- uv_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256);
++ y_stride = ALIGN(width * 4 / 3, 256);
++ uv_stride = ALIGN(width * 4 / 3, 256);
+ y_sclines = ALIGN(height, 16);
+ uv_sclines = ALIGN((height + 1) >> 1, 16);
+
+--
+2.39.2
+
--- /dev/null
+From 5587bb26600eadc5dcc5590b653d602fe4a3ba24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 15:36:49 +0200
+Subject: media: videodev2.h: Fix struct v4l2_input tuner index comment
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 26ae58f65e64fa7ba61d64bae752e59e08380c6a ]
+
+VIDIOC_ENUMINPUT documentation describes the tuner field of
+struct v4l2_input as index:
+
+Documentation/userspace-api/media/v4l/vidioc-enuminput.rst
+"
+* - __u32
+ - ``tuner``
+ - Capture devices can have zero or more tuners (RF demodulators).
+ When the ``type`` is set to ``V4L2_INPUT_TYPE_TUNER`` this is an
+ RF connector and this field identifies the tuner. It corresponds
+ to struct :c:type:`v4l2_tuner` field ``index``. For
+ details on tuners see :ref:`tuner`.
+"
+
+Drivers I could find also use the 'tuner' field as an index, e.g.:
+drivers/media/pci/bt8xx/bttv-driver.c bttv_enum_input()
+drivers/media/usb/go7007/go7007-v4l2.c vidioc_enum_input()
+
+However, the UAPI comment claims this field is 'enum v4l2_tuner_type':
+include/uapi/linux/videodev2.h
+
+This field being 'enum v4l2_tuner_type' is unlikely as it seems to be
+never used that way in drivers, and documentation confirms it. It seem
+this comment got in accidentally in the commit which this patch fixes.
+Fix the UAPI comment to stop confusion.
+
+This was pointed out by Dmitry while reviewing VIDIOC_ENUMINPUT
+support for strace.
+
+Fixes: 6016af82eafc ("[media] v4l2: use __u32 rather than enums in ioctl() structs")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/videodev2.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
+index b28817c59fdf2..55b8c4b824797 100644
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -1644,7 +1644,7 @@ struct v4l2_input {
+ __u8 name[32]; /* Label */
+ __u32 type; /* Type of input */
+ __u32 audioset; /* Associated audios (bitfield) */
+- __u32 tuner; /* enum v4l2_tuner_type */
++ __u32 tuner; /* Tuner index */
+ v4l2_std_id std;
+ __u32 status;
+ __u32 capabilities;
+--
+2.39.2
+
--- /dev/null
+From d404583f6cd336dbfd1430dc204f1eb214fffb12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 09:48:18 +0800
+Subject: mfd: intel-lpss: Add missing check for platform_get_resource
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit d918e0d5824495a75d00b879118b098fcab36fdb ]
+
+Add the missing check for platform_get_resource and return error
+if it fails.
+
+Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230609014818.28475-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-acpi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c
+index 045cbf0cbe53a..993e305a232c5 100644
+--- a/drivers/mfd/intel-lpss-acpi.c
++++ b/drivers/mfd/intel-lpss-acpi.c
+@@ -114,6 +114,9 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!info->mem)
++ return -ENODEV;
++
+ info->irq = platform_get_irq(pdev, 0);
+
+ ret = intel_lpss_probe(&pdev->dev, info);
+--
+2.39.2
+
--- /dev/null
+From 5b2a92f9c5a87bb052b40b8e0c6a51e7c0bed49a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 22:57:10 +0200
+Subject: mfd: rt5033: Drop rt5033-battery sub-device
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 43db1344e0f8c1eb687a1d6cd5b0de3009ab66cb ]
+
+The fuel gauge in the RT5033 PMIC (rt5033-battery) has its own I2C bus
+and interrupt lines. Therefore, it is not part of the MFD device
+and needs to be specified separately in the device tree.
+
+Fixes: 0b271258544b ("mfd: rt5033: Add Richtek RT5033 driver core.")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Signed-off-by: Jakob Hauser <jahau@rocketmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/6a8a19bc67b5be3732882e8131ad2ffcb546ac03.1684182964.git.jahau@rocketmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/rt5033.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/mfd/rt5033.c b/drivers/mfd/rt5033.c
+index 48381d9bf7403..302115dabff4b 100644
+--- a/drivers/mfd/rt5033.c
++++ b/drivers/mfd/rt5033.c
+@@ -41,9 +41,6 @@ static const struct mfd_cell rt5033_devs[] = {
+ {
+ .name = "rt5033-charger",
+ .of_compatible = "richtek,rt5033-charger",
+- }, {
+- .name = "rt5033-battery",
+- .of_compatible = "richtek,rt5033-battery",
+ }, {
+ .name = "rt5033-led",
+ .of_compatible = "richtek,rt5033-led",
+--
+2.39.2
+
--- /dev/null
+From df6968cf625def84233379d22cf75bf1e74df765 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 11:28:03 +0200
+Subject: mfd: stmfx: Fix error path in stmfx_chip_init
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit f592cf624531286f8b52e40dcfc157a5a7fb115c ]
+
+In error path, disable vdd regulator if it exists, but don't overload ret.
+Because if regulator_disable() is successful, stmfx_chip_init will exit
+successfully while chip init failed.
+
+Fixes: 06252ade9156 ("mfd: Add ST Multi-Function eXpander (STMFX) core driver")
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://lore.kernel.org/r/20230609092804.793100-1-amelie.delaunay@foss.st.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmfx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
+index 988e2ba6dd0f3..41e74b5dd9901 100644
+--- a/drivers/mfd/stmfx.c
++++ b/drivers/mfd/stmfx.c
+@@ -387,7 +387,7 @@ static int stmfx_chip_init(struct i2c_client *client)
+
+ err:
+ if (stmfx->vdd)
+- return regulator_disable(stmfx->vdd);
++ regulator_disable(stmfx->vdd);
+
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From f98af3b172ee75a7ec19d3f8a42bc0ee525221b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 11:28:04 +0200
+Subject: mfd: stmfx: Nullify stmfx->vdd in case of error
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit 7c81582c0bccb4757186176f0ee12834597066ad ]
+
+Nullify stmfx->vdd in case devm_regulator_get_optional() returns an error.
+And simplify code by returning an error only if return code is not -ENODEV,
+which means there is no vdd regulator and it is not an issue.
+
+Fixes: d75846ed08e6 ("mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()")
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://lore.kernel.org/r/20230609092804.793100-2-amelie.delaunay@foss.st.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmfx.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
+index 41e74b5dd9901..b45d7b0b842c5 100644
+--- a/drivers/mfd/stmfx.c
++++ b/drivers/mfd/stmfx.c
+@@ -330,9 +330,8 @@ static int stmfx_chip_init(struct i2c_client *client)
+ stmfx->vdd = devm_regulator_get_optional(&client->dev, "vdd");
+ ret = PTR_ERR_OR_ZERO(stmfx->vdd);
+ if (ret) {
+- if (ret == -ENODEV)
+- stmfx->vdd = NULL;
+- else
++ stmfx->vdd = NULL;
++ if (ret != -ENODEV)
+ return dev_err_probe(&client->dev, ret, "Failed to get VDD regulator\n");
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 7ec1dce25fc5e8d18cc84cc256ba978368c5ac15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jun 2023 12:43:16 +0200
+Subject: mfd: stmpe: Only disable the regulators if they are enabled
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 104d32bd81f620bb9f67fbf7d1159c414e89f05f ]
+
+In stmpe_probe(), if some regulator_enable() calls fail, probing continues
+and there is only a dev_warn().
+
+So, if stmpe_probe() is called the regulator may not be enabled. It is
+cleaner to test it before calling regulator_disable() in the remove
+function.
+
+Fixes: 9c9e321455fb ("mfd: stmpe: add optional regulators")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/8de3aaf297931d655b9ad6aed548f4de8b85425a.1686998575.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 508349399f8af..7f758fb60c1fa 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1494,9 +1494,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+
+ int stmpe_remove(struct stmpe *stmpe)
+ {
+- if (!IS_ERR(stmpe->vio))
++ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ regulator_disable(stmpe->vio);
+- if (!IS_ERR(stmpe->vcc))
++ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+ regulator_disable(stmpe->vcc);
+
+ __stmpe_disable(stmpe, STMPE_BLOCK_ADC);
+--
+2.39.2
+
--- /dev/null
+From 03d40a655ae7abb7e0093c64f3728edb3b15c053 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 19:41:18 +0300
+Subject: net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 6ca3c005d0604e8d2b439366e3923ea58db99641 ]
+
+According to the synchronization rules for .ndo_get_stats() as seen in
+Documentation/networking/netdevices.rst, acquiring a plain spin_lock()
+should not be illegal, but the bridge driver implementation makes it so.
+
+After running these commands, I am being faced with the following
+lockdep splat:
+
+$ ip link add link swp0 name macsec0 type macsec encrypt on && ip link set swp0 up
+$ ip link add dev br0 type bridge vlan_filtering 1 && ip link set br0 up
+$ ip link set macsec0 master br0 && ip link set macsec0 up
+
+ ========================================================
+ WARNING: possible irq lock inversion dependency detected
+ 6.4.0-04295-g31b577b4bd4a #603 Not tainted
+ --------------------------------------------------------
+ swapper/1/0 just changed the state of lock:
+ ffff6bd348724cd8 (&br->lock){+.-.}-{3:3}, at: br_forward_delay_timer_expired+0x34/0x198
+ but this lock took another, SOFTIRQ-unsafe lock in the past:
+ (&ocelot->stats_lock){+.+.}-{3:3}
+
+ and interrupts could create inverse lock ordering between them.
+
+ other info that might help us debug this:
+ Chain exists of:
+ &br->lock --> &br->hash_lock --> &ocelot->stats_lock
+
+ Possible interrupt unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&ocelot->stats_lock);
+ local_irq_disable();
+ lock(&br->lock);
+ lock(&br->hash_lock);
+ <Interrupt>
+ lock(&br->lock);
+
+ *** DEADLOCK ***
+
+(details about the 3 locks skipped)
+
+swp0 is instantiated by drivers/net/dsa/ocelot/felix.c, and this
+only matters to the extent that its .ndo_get_stats64() method calls
+spin_lock(&ocelot->stats_lock).
+
+Documentation/locking/lockdep-design.rst says:
+
+| A lock is irq-safe means it was ever used in an irq context, while a lock
+| is irq-unsafe means it was ever acquired with irq enabled.
+
+(...)
+
+| Furthermore, the following usage based lock dependencies are not allowed
+| between any two lock-classes::
+|
+| <hardirq-safe> -> <hardirq-unsafe>
+| <softirq-safe> -> <softirq-unsafe>
+
+Lockdep marks br->hash_lock as softirq-safe, because it is sometimes
+taken in softirq context (for example br_fdb_update() which runs in
+NET_RX softirq), and when it's not in softirq context it blocks softirqs
+by using spin_lock_bh().
+
+Lockdep marks ocelot->stats_lock as softirq-unsafe, because it never
+blocks softirqs from running, and it is never taken from softirq
+context. So it can always be interrupted by softirqs.
+
+There is a call path through which a function that holds br->hash_lock:
+fdb_add_hw_addr() will call a function that acquires ocelot->stats_lock:
+ocelot_port_get_stats64(). This can be seen below:
+
+ocelot_port_get_stats64+0x3c/0x1e0
+felix_get_stats64+0x20/0x38
+dsa_slave_get_stats64+0x3c/0x60
+dev_get_stats+0x74/0x2c8
+rtnl_fill_stats+0x4c/0x150
+rtnl_fill_ifinfo+0x5cc/0x7b8
+rtmsg_ifinfo_build_skb+0xe4/0x150
+rtmsg_ifinfo+0x5c/0xb0
+__dev_notify_flags+0x58/0x200
+__dev_set_promiscuity+0xa0/0x1f8
+dev_set_promiscuity+0x30/0x70
+macsec_dev_change_rx_flags+0x68/0x88
+__dev_set_promiscuity+0x1a8/0x1f8
+__dev_set_rx_mode+0x74/0xa8
+dev_uc_add+0x74/0xa0
+fdb_add_hw_addr+0x68/0xd8
+fdb_add_local+0xc4/0x110
+br_fdb_add_local+0x54/0x88
+br_add_if+0x338/0x4a0
+br_add_slave+0x20/0x38
+do_setlink+0x3a4/0xcb8
+rtnl_newlink+0x758/0x9d0
+rtnetlink_rcv_msg+0x2f0/0x550
+netlink_rcv_skb+0x128/0x148
+rtnetlink_rcv+0x24/0x38
+
+the plain English explanation for it is:
+
+The macsec0 bridge port is created without p->flags & BR_PROMISC,
+because it is what br_manage_promisc() decides for a VLAN filtering
+bridge with a single auto port.
+
+As part of the br_add_if() procedure, br_fdb_add_local() is called for
+the MAC address of the device, and this results in a call to
+dev_uc_add() for macsec0 while the softirq-safe br->hash_lock is taken.
+
+Because macsec0 does not have IFF_UNICAST_FLT, dev_uc_add() ends up
+calling __dev_set_promiscuity() for macsec0, which is propagated by its
+implementation, macsec_dev_change_rx_flags(), to the lower device: swp0.
+This triggers the call path:
+
+dev_set_promiscuity(swp0)
+-> rtmsg_ifinfo()
+ -> dev_get_stats()
+ -> ocelot_port_get_stats64()
+
+with a calling context that lockdep doesn't like (br->hash_lock held).
+
+Normally we don't see this, because even though many drivers that can be
+bridge ports don't support IFF_UNICAST_FLT, we need a driver that
+
+(a) doesn't support IFF_UNICAST_FLT, *and*
+(b) it forwards the IFF_PROMISC flag to another driver, and
+(c) *that* driver implements ndo_get_stats64() using a softirq-unsafe
+ spinlock.
+
+Condition (b) is necessary because the first __dev_set_rx_mode() calls
+__dev_set_promiscuity() with "bool notify=false", and thus, the
+rtmsg_ifinfo() code path won't be entered.
+
+The same criteria also hold true for DSA switches which don't report
+IFF_UNICAST_FLT. When the DSA master uses a spin_lock() in its
+ndo_get_stats64() method, the same lockdep splat can be seen.
+
+I think the deadlock possibility is real, even though I didn't reproduce
+it, and I'm thinking of the following situation to support that claim:
+
+fdb_add_hw_addr() runs on a CPU A, in a context with softirqs locally
+disabled and br->hash_lock held, and may end up attempting to acquire
+ocelot->stats_lock.
+
+In parallel, ocelot->stats_lock is currently held by a thread B (say,
+ocelot_check_stats_work()), which is interrupted while holding it by a
+softirq which attempts to lock br->hash_lock.
+
+Thread B cannot make progress because br->hash_lock is held by A. Whereas
+thread A cannot make progress because ocelot->stats_lock is held by B.
+
+When taking the issue at face value, the bridge can avoid that problem
+by simply making the ports promiscuous from a code path with a saner
+calling context (br->hash_lock not held). A bridge port without
+IFF_UNICAST_FLT is going to become promiscuous as soon as we call
+dev_uc_add() on it (which we do unconditionally), so why not be
+preemptive and make it promiscuous right from the beginning, so as to
+not be taken by surprise.
+
+With this, we've broken the links between code that holds br->hash_lock
+or br->lock and code that calls into the ndo_change_rx_flags() or
+ndo_get_stats64() ops of the bridge port.
+
+Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_if.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
+index 1d87bf51f3840..e35488fde9c85 100644
+--- a/net/bridge/br_if.c
++++ b/net/bridge/br_if.c
+@@ -157,8 +157,9 @@ void br_manage_promisc(struct net_bridge *br)
+ * This lets us disable promiscuous mode and write
+ * this config to hw.
+ */
+- if (br->auto_cnt == 0 ||
+- (br->auto_cnt == 1 && br_auto_port(p)))
++ if ((p->dev->priv_flags & IFF_UNICAST_FLT) &&
++ (br->auto_cnt == 0 ||
++ (br->auto_cnt == 1 && br_auto_port(p))))
+ br_port_clear_promisc(p);
+ else
+ br_port_set_promisc(p);
+--
+2.39.2
+
--- /dev/null
+From 12c6d660a05c41a708a70408521a91b7812f553f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 01:05:44 +0300
+Subject: net: dsa: tag_sja1105: fix MAC DA patching from meta frames
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 1dcf6efd5f0c1f4496b3ef7ec5a7db104a53b38c ]
+
+The SJA1105 manual says that at offset 4 into the meta frame payload we
+have "MAC destination byte 2" and at offset 5 we have "MAC destination
+byte 1". These are counted from the LSB, so byte 1 is h_dest[ETH_HLEN-2]
+aka h_dest[4] and byte 2 is h_dest[ETH_HLEN-3] aka h_dest[3].
+
+The sja1105_meta_unpack() function decodes these the other way around,
+so a frame with MAC DA 01:80:c2:11:22:33 is received by the network
+stack as having 01:80:c2:22:11:33.
+
+Fixes: e53e18a6fe4d ("net: dsa: sja1105: Receive and decode meta frames")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/tag_sja1105.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
+index 50496013cdb7f..07876160edd2b 100644
+--- a/net/dsa/tag_sja1105.c
++++ b/net/dsa/tag_sja1105.c
+@@ -48,8 +48,8 @@ static void sja1105_meta_unpack(const struct sk_buff *skb,
+ * a unified unpacking command for both device series.
+ */
+ packing(buf, &meta->tstamp, 31, 0, 4, UNPACK, 0);
+- packing(buf + 4, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0);
+- packing(buf + 5, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0);
++ packing(buf + 4, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0);
++ packing(buf + 5, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0);
+ packing(buf + 6, &meta->source_port, 7, 0, 1, UNPACK, 0);
+ packing(buf + 7, &meta->switch_id, 7, 0, 1, UNPACK, 0);
+ }
+--
+2.39.2
+
--- /dev/null
+From 3985b7a568cad244f30ac210a9af01ff58c280f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jun 2023 21:43:27 +0200
+Subject: net: dsa: vsc73xx: fix MTU configuration
+
+From: Pawel Dembicki <paweldembicki@gmail.com>
+
+[ Upstream commit 3cf62c8177adb0db9e15c8b898c44f997acf3ebf ]
+
+Switch in MAXLEN register stores the maximum size of a data frame.
+The MTU size is 18 bytes smaller than the frame size.
+
+The current settings are causing problems with packet forwarding.
+This patch fixes the MTU settings to proper values.
+
+Fixes: fb77ffc6ec86 ("net: dsa: vsc73xx: make the MTU configurable")
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://lore.kernel.org/r/20230628194327.1765644-1-paweldembicki@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/vitesse-vsc73xx-core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c
+index 19ce4aa0973b4..80eadf509c0a9 100644
+--- a/drivers/net/dsa/vitesse-vsc73xx-core.c
++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c
+@@ -1025,17 +1025,17 @@ static int vsc73xx_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
+ struct vsc73xx *vsc = ds->priv;
+
+ return vsc73xx_write(vsc, VSC73XX_BLOCK_MAC, port,
+- VSC73XX_MAXLEN, new_mtu);
++ VSC73XX_MAXLEN, new_mtu + ETH_HLEN + ETH_FCS_LEN);
+ }
+
+ /* According to application not "VSC7398 Jumbo Frames" setting
+- * up the MTU to 9.6 KB does not affect the performance on standard
++ * up the frame size to 9.6 KB does not affect the performance on standard
+ * frames. It is clear from the application note that
+ * "9.6 kilobytes" == 9600 bytes.
+ */
+ static int vsc73xx_get_max_mtu(struct dsa_switch *ds, int port)
+ {
+- return 9600;
++ return 9600 - ETH_HLEN - ETH_FCS_LEN;
+ }
+
+ static const struct dsa_switch_ops vsc73xx_ds_ops = {
+--
+2.39.2
+
--- /dev/null
+From e1a0c6f3b277986e3b359681e7e6609ebc1a156c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 19:08:42 +0800
+Subject: net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit 30c45b5361d39b4b793780ffac5538090b9e2eb1 ]
+
+The attribute TCA_PEDIT_PARMS_EX is not be included in pedit_policy and
+one malicious user could fake a TCA_PEDIT_PARMS_EX whose length is
+smaller than the intended sizeof(struct tc_pedit). Hence, the
+dereference in tcf_pedit_init() could access dirty heap data.
+
+static int tcf_pedit_init(...)
+{
+ // ...
+ pattr = tb[TCA_PEDIT_PARMS]; // TCA_PEDIT_PARMS is included
+ if (!pattr)
+ pattr = tb[TCA_PEDIT_PARMS_EX]; // but this is not
+
+ // ...
+ parm = nla_data(pattr);
+
+ index = parm->index; // parm is able to be smaller than 4 bytes
+ // and this dereference gets dirty skb_buff
+ // data created in netlink_sendmsg
+}
+
+This commit adds TCA_PEDIT_PARMS_EX length in pedit_policy which avoid
+the above case, just like the TCA_PEDIT_PARMS.
+
+Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
+Link: https://lore.kernel.org/r/20230703110842.590282-1-linma@zju.edu.cn
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_pedit.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index db0d3bff19eba..a44101b2f4419 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -26,6 +26,7 @@ static struct tc_action_ops act_pedit_ops;
+
+ static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
+ [TCA_PEDIT_PARMS] = { .len = sizeof(struct tc_pedit) },
++ [TCA_PEDIT_PARMS_EX] = { .len = sizeof(struct tc_pedit) },
+ [TCA_PEDIT_KEYS_EX] = { .type = NLA_NESTED },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From bb16ae2faa353f02be59aff76b3e99415779429e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 11:58:43 +0530
+Subject: octeontx2-af: Fix mapping for NIX block from CGX connection
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 2e7bc57b976bb016c6569a54d95c1b8d88f9450a ]
+
+Firmware configures NIX block mapping for all MAC blocks.
+The current implementation reads the configuration and
+creates the mapping between RVU PF and NIX blocks. But
+this configuration is only valid for silicons that support
+multiple blocks. For all other silicons, all MAC blocks
+map to NIX0.
+
+This patch corrects the mapping by adding a check for the same.
+
+Fixes: c5a73b632b90 ("octeontx2-af: Map NIX block from CGX connection")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 11 +++++++++++
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +-
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+index fc6d785b98ddd..ec9a291e866c7 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+@@ -20,6 +20,7 @@
+ #define PCI_DEVID_OCTEONTX2_RVU_AF 0xA065
+
+ /* Subsystem Device ID */
++#define PCI_SUBSYS_DEVID_98XX 0xB100
+ #define PCI_SUBSYS_DEVID_96XX 0xB200
+
+ /* PCI BAR nos */
+@@ -403,6 +404,16 @@ static inline bool is_rvu_96xx_B0(struct rvu *rvu)
+ (pdev->subsystem_device == PCI_SUBSYS_DEVID_96XX);
+ }
+
++static inline bool is_rvu_supports_nix1(struct rvu *rvu)
++{
++ struct pci_dev *pdev = rvu->pdev;
++
++ if (pdev->subsystem_device == PCI_SUBSYS_DEVID_98XX)
++ return true;
++
++ return false;
++}
++
+ /* Function Prototypes
+ * RVU
+ */
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+index 6c6b411e78fd8..83743e15326d7 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+@@ -84,7 +84,7 @@ static void rvu_map_cgx_nix_block(struct rvu *rvu, int pf,
+ p2x = cgx_lmac_get_p2x(cgx_id, lmac_id);
+ /* Firmware sets P2X_SELECT as either NIX0 or NIX1 */
+ pfvf->nix_blkaddr = BLKADDR_NIX0;
+- if (p2x == CMR_P2X_SEL_NIX1)
++ if (is_rvu_supports_nix1(rvu) && p2x == CMR_P2X_SEL_NIX1)
+ pfvf->nix_blkaddr = BLKADDR_NIX1;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 9152640949d6706d102e5bf745dfee50d395f878 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 10:39:50 +0300
+Subject: phy: tegra: xusb: check return value of devm_kzalloc()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 44faada0f38fc333d392af04c343b0e23f8f5d81 ]
+
+devm_kzalloc() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: f67213cee2b3 ("phy: tegra: xusb: Add usb-role-switch support")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20230531073950.145339-1-claudiu.beznea@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/tegra/xusb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index f93be3c4a4a6e..8f11b293c48d1 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -663,6 +663,9 @@ static int tegra_xusb_setup_usb_role_switch(struct tegra_xusb_port *port)
+ port->dev.driver = devm_kzalloc(&port->dev,
+ sizeof(struct device_driver),
+ GFP_KERNEL);
++ if (!port->dev.driver)
++ return -ENOMEM;
++
+ port->dev.driver->owner = THIS_MODULE;
+
+ port->usb_role_sw = usb_role_switch_register(&port->dev,
+--
+2.39.2
+
--- /dev/null
+From 0f240778bab757a888333add6ecfa11edfa1d07d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 22:47:12 -0700
+Subject: powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 39f49684036d24af800ff194c33c7b2653c591d7 ]
+
+In a randconfig with CONFIG_SERIAL_CPM=m and
+CONFIG_PPC_EARLY_DEBUG_CPM=y, there is a build error:
+ERROR: modpost: "udbg_putc" [drivers/tty/serial/cpm_uart/cpm_uart.ko] undefined!
+
+Prevent the build error by allowing PPC_EARLY_DEBUG_CPM only when
+SERIAL_CPM=y.
+
+Fixes: c374e00e17f1 ("[POWERPC] Add early debug console for CPM serial ports.")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Pali Rohár <pali@kernel.org>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230701054714.30512-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
+index 52abca88b5b2b..e03fb91544206 100644
+--- a/arch/powerpc/Kconfig.debug
++++ b/arch/powerpc/Kconfig.debug
+@@ -234,7 +234,7 @@ config PPC_EARLY_DEBUG_40x
+
+ config PPC_EARLY_DEBUG_CPM
+ bool "Early serial debugging for Freescale CPM-based serial ports"
+- depends on SERIAL_CPM
++ depends on SERIAL_CPM=y
+ help
+ Select this to enable early debugging for Freescale chips
+ using a CPM-based serial port. This assumes that the bootwrapper
+--
+2.39.2
+
--- /dev/null
+From 1b82f8063aceae2163cf6b762c67068e8ba9b803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 19:14:46 +0200
+Subject: pptp: Fix fib lookup calls.
+
+From: Guillaume Nault <gnault@redhat.com>
+
+[ Upstream commit 84bef5b6037c15180ef88ac4216dc621d16df1a6 ]
+
+PPTP uses pppox sockets (struct pppox_sock). These sockets don't embed
+an inet_sock structure, so it's invalid to call inet_sk() on them.
+
+Therefore, the ip_route_output_ports() call in pptp_connect() has two
+problems:
+
+ * The tos variable is set with RT_CONN_FLAGS(sk), which calls
+ inet_sk() on the pppox socket.
+
+ * ip_route_output_ports() tries to retrieve routing flags using
+ inet_sk_flowi_flags(), which is also going to call inet_sk() on the
+ pppox socket.
+
+While PPTP doesn't use inet sockets, it's actually really layered on
+top of IP and therefore needs a proper way to do fib lookups. So let's
+define pptp_route_output() to get a struct rtable from a pptp socket.
+Let's also replace the ip_route_output_ports() call of pptp_xmit() for
+consistency.
+
+In practice, this means that:
+
+ * pptp_connect() sets ->flowi4_tos and ->flowi4_flags to zero instead
+ of using bits of unrelated struct pppox_sock fields.
+
+ * pptp_xmit() now respects ->sk_mark and ->sk_uid.
+
+ * pptp_xmit() now calls the security_sk_classify_flow() security
+ hook, thus allowing to set ->flowic_secid.
+
+ * pptp_xmit() now passes the pppox socket to xfrm_lookup_route().
+
+Found by code inspection.
+
+Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ppp/pptp.c | 31 ++++++++++++++++++++-----------
+ 1 file changed, 20 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
+index ee5058445d06e..05a75b5a8b680 100644
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -24,6 +24,7 @@
+ #include <linux/in.h>
+ #include <linux/ip.h>
+ #include <linux/rcupdate.h>
++#include <linux/security.h>
+ #include <linux/spinlock.h>
+
+ #include <net/sock.h>
+@@ -128,6 +129,23 @@ static void del_chan(struct pppox_sock *sock)
+ spin_unlock(&chan_lock);
+ }
+
++static struct rtable *pptp_route_output(struct pppox_sock *po,
++ struct flowi4 *fl4)
++{
++ struct sock *sk = &po->sk;
++ struct net *net;
++
++ net = sock_net(sk);
++ flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark, 0,
++ RT_SCOPE_UNIVERSE, IPPROTO_GRE, 0,
++ po->proto.pptp.dst_addr.sin_addr.s_addr,
++ po->proto.pptp.src_addr.sin_addr.s_addr,
++ 0, 0, sock_net_uid(net, sk));
++ security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4));
++
++ return ip_route_output_flow(net, fl4, sk);
++}
++
+ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ {
+ struct sock *sk = (struct sock *) chan->private;
+@@ -151,11 +169,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ if (sk_pppox(po)->sk_state & PPPOX_DEAD)
+ goto tx_error;
+
+- rt = ip_route_output_ports(net, &fl4, NULL,
+- opt->dst_addr.sin_addr.s_addr,
+- opt->src_addr.sin_addr.s_addr,
+- 0, 0, IPPROTO_GRE,
+- RT_TOS(0), sk->sk_bound_dev_if);
++ rt = pptp_route_output(po, &fl4);
+ if (IS_ERR(rt))
+ goto tx_error;
+
+@@ -440,12 +454,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ po->chan.private = sk;
+ po->chan.ops = &pptp_chan_ops;
+
+- rt = ip_route_output_ports(sock_net(sk), &fl4, sk,
+- opt->dst_addr.sin_addr.s_addr,
+- opt->src_addr.sin_addr.s_addr,
+- 0, 0,
+- IPPROTO_GRE, RT_CONN_FLAGS(sk),
+- sk->sk_bound_dev_if);
++ rt = pptp_route_output(po, &fl4);
+ if (IS_ERR(rt)) {
+ error = -EHOSTUNREACH;
+ goto end;
+--
+2.39.2
+
--- /dev/null
+From 4592e1dab1571866f9190655b7b95d5e4b005f8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 14:58:39 +0800
+Subject: pwm: imx-tpm: force 'real_period' to be zero in suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fancy Fang <chen.fang@nxp.com>
+
+[ Upstream commit 661dfb7f46298e53f6c3deaa772fa527aae86193 ]
+
+During suspend, all the tpm registers will lose values.
+So the 'real_period' value of struct 'imx_tpm_pwm_chip'
+should be forced to be zero to force the period update
+code can be executed after system resume back.
+
+Signed-off-by: Fancy Fang <chen.fang@nxp.com>
+Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Fixes: 738a1cfec2ed ("pwm: Add i.MX TPM PWM driver support")
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-imx-tpm.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/pwm/pwm-imx-tpm.c b/drivers/pwm/pwm-imx-tpm.c
+index fcdf6befb8389..871527b78aa46 100644
+--- a/drivers/pwm/pwm-imx-tpm.c
++++ b/drivers/pwm/pwm-imx-tpm.c
+@@ -403,6 +403,13 @@ static int __maybe_unused pwm_imx_tpm_suspend(struct device *dev)
+ if (tpm->enable_count > 0)
+ return -EBUSY;
+
++ /*
++ * Force 'real_period' to be zero to force period update code
++ * can be executed after system resume back, since suspend causes
++ * the period related registers to become their reset values.
++ */
++ tpm->real_period = 0;
++
+ clk_disable_unprepare(tpm->clk);
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From d56d21af6bf877d438e82645843f9c44de95ebea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 18:47:36 +0200
+Subject: pwm: sysfs: Do not apply state to already disabled PWMs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 38ba83598633373f47951384cfc389181c8d1bed ]
+
+If the PWM is exported but not enabled, do not call pwm_class_apply_state().
+First of all, in this case, period may still be unconfigured and this would
+make pwm_class_apply_state() return -EINVAL, and then suspend would fail.
+Second, it makes little sense to apply state onto PWM that is not enabled
+before suspend.
+
+Failing case:
+"
+$ echo 1 > /sys/class/pwm/pwmchip4/export
+$ echo mem > /sys/power/state
+...
+pwm pwmchip4: PM: dpm_run_callback(): pwm_class_suspend+0x1/0xa8 returns -22
+pwm pwmchip4: PM: failed to suspend: error -22
+PM: Some devices failed to suspend, or early wake event detected
+"
+
+Working case:
+"
+$ echo 1 > /sys/class/pwm/pwmchip4/export
+$ echo 100 > /sys/class/pwm/pwmchip4/pwm1/period
+$ echo 10 > /sys/class/pwm/pwmchip4/pwm1/duty_cycle
+$ echo mem > /sys/power/state
+...
+"
+
+Do not call pwm_class_apply_state() in case the PWM is disabled
+to fix this issue.
+
+Fixes: 7fd4edc57bbae ("pwm: sysfs: Add suspend/resume support")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Fixes: ef2bf4997f7d ("pwm: Improve args checking in pwm_apply_state()")
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/sysfs.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
+index 9903c3a7ecedc..b8417a8d2ef97 100644
+--- a/drivers/pwm/sysfs.c
++++ b/drivers/pwm/sysfs.c
+@@ -424,6 +424,13 @@ static int pwm_class_resume_npwm(struct device *parent, unsigned int npwm)
+ if (!export)
+ continue;
+
++ /* If pwmchip was not enabled before suspend, do nothing. */
++ if (!export->suspend.enabled) {
++ /* release lock taken in pwm_class_get_state */
++ mutex_unlock(&export->lock);
++ continue;
++ }
++
+ state.enabled = export->suspend.enabled;
+ ret = pwm_class_apply_state(export, pwm, &state);
+ if (ret < 0)
+@@ -448,7 +455,17 @@ static int __maybe_unused pwm_class_suspend(struct device *parent)
+ if (!export)
+ continue;
+
++ /*
++ * If pwmchip was not enabled before suspend, save
++ * state for resume time and do nothing else.
++ */
+ export->suspend = state;
++ if (!state.enabled) {
++ /* release lock taken in pwm_class_get_state */
++ mutex_unlock(&export->lock);
++ continue;
++ }
++
+ state.enabled = false;
+ ret = pwm_class_apply_state(export, pwm, &state);
+ if (ret < 0) {
+--
+2.39.2
+
--- /dev/null
+From 5378cc17c09e9dfef20e89a34d6051dbc80a0651 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jun 2023 11:30:35 +0200
+Subject: Revert "usb: common: usb-conn-gpio: Set last role to unknown before
+ initial detection"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit df49f2a0ac4a34c0cb4b5c233fcfa0add644c43c ]
+
+This reverts commit edd60d24bd858cef165274e4cd6cab43bdc58d15.
+
+Heikki reports that this should not be a global flag just to work around
+one broken driver and should be fixed differently, so revert it.
+
+Reported-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Fixes: edd60d24bd85 ("usb: common: usb-conn-gpio: Set last role to unknown before initial detection")
+Link: https://lore.kernel.org/r/ZImE4L3YgABnCIsP@kuha.fi.intel.com
+Cc: Prashanth K <quic_prashk@quicinc.com>
+Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/core.c | 2 --
+ drivers/usb/common/usb-conn-gpio.c | 3 ---
+ drivers/usb/musb/jz4740.c | 2 --
+ drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 --
+ include/linux/usb/role.h | 1 -
+ 5 files changed, 10 deletions(-)
+
+diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
+index e5fe640b2bb01..8fe7420de033d 100644
+--- a/drivers/usb/cdns3/core.c
++++ b/drivers/usb/cdns3/core.c
+@@ -243,8 +243,6 @@ static enum usb_role cdns3_hw_role_state_machine(struct cdns3 *cdns)
+ if (!vbus)
+ role = USB_ROLE_NONE;
+ break;
+- default:
+- break;
+ }
+
+ dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role);
+diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c
+index 5754e467c16a8..c9545a4eff664 100644
+--- a/drivers/usb/common/usb-conn-gpio.c
++++ b/drivers/usb/common/usb-conn-gpio.c
+@@ -276,9 +276,6 @@ static int usb_conn_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, info);
+
+- /* Set last role to unknown before performing the initial detection */
+- info->last_role = USB_ROLE_UNKNOWN;
+-
+ /* Perform initial detection */
+ usb_conn_queue_dwork(info, 0);
+
+diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c
+index f283629091ec4..c4fe1f4cd17a3 100644
+--- a/drivers/usb/musb/jz4740.c
++++ b/drivers/usb/musb/jz4740.c
+@@ -91,8 +91,6 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw,
+ case USB_ROLE_HOST:
+ atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy);
+ break;
+- default:
+- break;
+ }
+
+ return 0;
+diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c
+index 4d6a3dd06e011..5c96e929acea0 100644
+--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c
++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c
+@@ -97,8 +97,6 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw,
+ val |= SW_VBUS_VALID;
+ drd_config = DRD_CONFIG_STATIC_DEVICE;
+ break;
+- default:
+- break;
+ }
+ val |= SW_IDPIN_EN;
+ if (data->enable_sw_switch) {
+diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h
+index aecfce46d3544..b9ccaeb8a4aef 100644
+--- a/include/linux/usb/role.h
++++ b/include/linux/usb/role.h
+@@ -11,7 +11,6 @@ enum usb_role {
+ USB_ROLE_NONE,
+ USB_ROLE_HOST,
+ USB_ROLE_DEVICE,
+- USB_ROLE_UNKNOWN,
+ };
+
+ typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw,
+--
+2.39.2
+
--- /dev/null
+From 4b0af61a4ee065f767f031ad661c1d87dfca9472 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jun 2023 21:11:42 +0200
+Subject: rtc: st-lpc: Release some resources in st_rtc_probe() in case of
+ error
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 06c6e1b01d9261f03629cefd1f3553503291e6cf ]
+
+If an error occurs after clk_get(), the corresponding resources should be
+released.
+
+Use devm_clk_get() to fix it.
+
+Fixes: b5b2bdfc2893 ("rtc: st: Add new driver for ST's LPC RTC")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/866af6adbc7454a7b4505eb6c28fbdc86ccff39e.1686251455.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-st-lpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c
+index 7d53f7e2febcc..c4ea3f3f08844 100644
+--- a/drivers/rtc/rtc-st-lpc.c
++++ b/drivers/rtc/rtc-st-lpc.c
+@@ -228,7 +228,7 @@ static int st_rtc_probe(struct platform_device *pdev)
+ enable_irq_wake(rtc->irq);
+ disable_irq(rtc->irq);
+
+- rtc->clk = clk_get(&pdev->dev, NULL);
++ rtc->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(rtc->clk)) {
+ dev_err(&pdev->dev, "Unable to request clock\n");
+ return PTR_ERR(rtc->clk);
+--
+2.39.2
+
--- /dev/null
+From a23164cf3031718aad56a1992d2079b9551e1e6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 16:41:21 +0200
+Subject: s390/qeth: Fix vipa deletion
+
+From: Thorsten Winkler <twinkler@linux.ibm.com>
+
+[ Upstream commit 80de809bd35e2a8999edf9f5aaa2d8de18921f11 ]
+
+Change boolean parameter of function "qeth_l3_vipa_store" inside the
+"qeth_l3_dev_vipa_del4_store" function from "true" to "false" because
+"true" is used for adding a virtual ip address and "false" for deleting.
+
+Fixes: 2390166a6b45 ("s390/qeth: clean up L3 sysfs code")
+
+Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
+Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
+Signed-off-by: Thorsten Winkler <twinkler@linux.ibm.com>
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l3_sys.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
+index 997fbb7006a7c..316f8622f3ccb 100644
+--- a/drivers/s390/net/qeth_l3_sys.c
++++ b/drivers/s390/net/qeth_l3_sys.c
+@@ -652,7 +652,7 @@ static QETH_DEVICE_ATTR(vipa_add4, add4, 0644,
+ static ssize_t qeth_l3_dev_vipa_del4_store(struct device *dev,
+ struct device_attribute *attr, const char *buf, size_t count)
+ {
+- return qeth_l3_vipa_store(dev, buf, true, count, QETH_PROT_IPV4);
++ return qeth_l3_vipa_store(dev, buf, false, count, QETH_PROT_IPV4);
+ }
+
+ static QETH_DEVICE_ATTR(vipa_del4, del4, 0200, NULL,
+--
+2.39.2
+
--- /dev/null
+From 1cc4ab56e1d27a0d6137a81c1e74445de942045f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 12:03:40 +0000
+Subject: sctp: fix potential deadlock on &net->sctp.addr_wq_lock
+
+From: Chengfeng Ye <dg573847474@gmail.com>
+
+[ Upstream commit 6feb37b3b06e9049e20dcf7e23998f92c9c5be9a ]
+
+As &net->sctp.addr_wq_lock is also acquired by the timer
+sctp_addr_wq_timeout_handler() in protocal.c, the same lock acquisition
+at sctp_auto_asconf_init() seems should disable irq since it is called
+from sctp_accept() under process context.
+
+Possible deadlock scenario:
+sctp_accept()
+ -> sctp_sock_migrate()
+ -> sctp_auto_asconf_init()
+ -> spin_lock(&net->sctp.addr_wq_lock)
+ <timer interrupt>
+ -> sctp_addr_wq_timeout_handler()
+ -> spin_lock_bh(&net->sctp.addr_wq_lock); (deadlock here)
+
+This flaw was found using an experimental static analysis tool we are
+developing for irq-related deadlock.
+
+The tentative patch fix the potential deadlock by spin_lock_bh().
+
+Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
+Fixes: 34e5b0118685 ("sctp: delay auto_asconf init until binding the first addr")
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Link: https://lore.kernel.org/r/20230627120340.19432-1-dg573847474@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/socket.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 4a7f811abae4e..534364bb871a3 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -362,9 +362,9 @@ static void sctp_auto_asconf_init(struct sctp_sock *sp)
+ struct net *net = sock_net(&sp->inet.sk);
+
+ if (net->sctp.default_auto_asconf) {
+- spin_lock(&net->sctp.addr_wq_lock);
++ spin_lock_bh(&net->sctp.addr_wq_lock);
+ list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist);
+- spin_unlock(&net->sctp.addr_wq_lock);
++ spin_unlock_bh(&net->sctp.addr_wq_lock);
+ sp->do_auto_asconf = 1;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From e04546ffa851be423fd130d38c68ef1fb1b77508 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 11:37:54 +0206
+Subject: serial: 8250: lock port for stop_rx() in omap8250_irq()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit ca73a892c5bec4b08a2fa22b3015e98ed905abb7 ]
+
+The uarts_ops stop_rx() callback expects that the port->lock is
+taken and interrupts are disabled.
+
+Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20230525093159.223817-4-john.ogness@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 6b255e1633fd4..6043d4fa08cc2 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -655,7 +655,9 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
+
+ up->ier = port->serial_in(port, UART_IER);
+ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
++ spin_lock(&port->lock);
+ port->ops->stop_rx(port);
++ spin_unlock(&port->lock);
+ } else {
+ /* Keep restarting the timer until
+ * the input overrun subsides.
+--
+2.39.2
+
--- /dev/null
+From 1935ecdb4cad47562049cf28d628af768af28a5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 11:37:58 +0206
+Subject: serial: 8250: lock port for UART_IER access in omap8250_irq()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit 25614735a647693c1260f253dc3ab32127697806 ]
+
+omap8250_irq() accesses UART_IER. This register is modified twice
+by each console write (serial8250_console_write()) under the port
+lock. omap8250_irq() must also take the port lock to guanentee
+synchronized access to UART_IER.
+
+Since the port lock is already being taken for the stop_rx() callback
+and since it is safe to call cancel_delayed_work() while holding the
+port lock, simply extend the port lock region to include UART_IER
+access.
+
+Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20230525093159.223817-8-john.ogness@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 6043d4fa08cc2..af39a2c4c2eee 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -653,17 +653,18 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
+ if ((lsr & UART_LSR_OE) && up->overrun_backoff_time_ms > 0) {
+ unsigned long delay;
+
++ /* Synchronize UART_IER access against the console. */
++ spin_lock(&port->lock);
+ up->ier = port->serial_in(port, UART_IER);
+ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
+- spin_lock(&port->lock);
+ port->ops->stop_rx(port);
+- spin_unlock(&port->lock);
+ } else {
+ /* Keep restarting the timer until
+ * the input overrun subsides.
+ */
+ cancel_delayed_work(&up->overrun_backoff);
+ }
++ spin_unlock(&port->lock);
+
+ delay = msecs_to_jiffies(up->overrun_backoff_time_ms);
+ schedule_delayed_work(&up->overrun_backoff, delay);
+--
+2.39.2
+
--- /dev/null
+From 1ceb0cfae3f147ed45511758f1bc7e136eee2fdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 11:20:11 +0300
+Subject: serial: 8250: omap: Fix freeing of resources on failed register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit b9ab22c2bc8652324a803b3e2be69838920b4025 ]
+
+If serial8250_register_8250_port() fails, the SoC can hang as the
+deferred PMQoS work will still run as is not flushed and removed.
+
+Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20230508082014.23083-2-tony@atomide.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 483fff3a95c9e..6b255e1633fd4 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -1469,7 +1469,9 @@ static int omap8250_probe(struct platform_device *pdev)
+ err:
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
+ pm_runtime_put_sync(&pdev->dev);
++ flush_work(&priv->qos_work);
+ pm_runtime_disable(&pdev->dev);
++ cpu_latency_qos_remove_request(&priv->pm_qos_request);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 781c0a0ccf31f9b540f2b9b464dff8229c4ee2d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jun 2023 07:59:19 +0300
+Subject: serial: 8250_omap: Use force_suspend and resume for system suspend
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 20a41a62618df85f3a2981008edec5cadd785e0a ]
+
+We should not rely on autosuspend timeout for system suspend. Instead,
+let's use force_suspend and force_resume functions. Otherwise the serial
+port controller device may not be idled on suspend.
+
+As we are doing a register write on suspend to configure the serial port,
+we still need to runtime PM resume the port on suspend.
+
+While at it, let's switch to pm_runtime_resume_and_get() and check for
+errors returned. And let's add the missing line break before return to the
+suspend function while at it.
+
+Fixes: 09d8b2bdbc5c ("serial: 8250: omap: Provide ability to enable/disable UART as wakeup source")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Tested-by: Dhruva Gole <d-gole@ti.com>
+Message-ID: <20230614045922.4798-1-tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index af39a2c4c2eee..e26ac3f42e05c 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -1521,25 +1521,35 @@ static int omap8250_suspend(struct device *dev)
+ {
+ struct omap8250_priv *priv = dev_get_drvdata(dev);
+ struct uart_8250_port *up = serial8250_get_port(priv->line);
++ int err;
+
+ serial8250_suspend_port(priv->line);
+
+- pm_runtime_get_sync(dev);
++ err = pm_runtime_resume_and_get(dev);
++ if (err)
++ return err;
+ if (!device_may_wakeup(dev))
+ priv->wer = 0;
+ serial_out(up, UART_OMAP_WER, priv->wer);
+- pm_runtime_mark_last_busy(dev);
+- pm_runtime_put_autosuspend(dev);
+-
++ err = pm_runtime_force_suspend(dev);
+ flush_work(&priv->qos_work);
+- return 0;
++
++ return err;
+ }
+
+ static int omap8250_resume(struct device *dev)
+ {
+ struct omap8250_priv *priv = dev_get_drvdata(dev);
++ int err;
+
++ err = pm_runtime_force_resume(dev);
++ if (err)
++ return err;
+ serial8250_resume_port(priv->line);
++ /* Paired with pm_runtime_resume_and_get() in omap8250_suspend() */
++ pm_runtime_mark_last_busy(dev);
++ pm_runtime_put_autosuspend(dev);
++
+ return 0;
+ }
+ #else
+--
+2.39.2
+
block-fix-signed-int-overflow-in-amiga-partition-support.patch
block-change-all-__u32-annotations-to-__be32-in-affs_hardblocks.h.patch
sunrpc-fix-uaf-in-svc_tcp_listen_data_ready.patch
+w1-w1_therm-fix-locking-behavior-in-convert_t.patch
+w1-fix-loop-in-w1_fini.patch
+sh-j2-use-ioremap-to-translate-device-tree-address-i.patch
+serial-8250-omap-fix-freeing-of-resources-on-failed-.patch
+clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch
+media-usb-check-az6007_read-return-value.patch
+media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch
+media-usb-siano-fix-warning-due-to-null-work_func_t-.patch
+clk-qcom-reset-allow-specifying-custom-reset-delay.patch
+clk-qcom-reset-support-resetting-multiple-bits.patch
+clk-qcom-ipq6018-fix-networking-resets.patch
+usb-dwc3-qcom-fix-potential-memory-leak.patch
+usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch
+extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch
+extcon-fix-kernel-doc-of-property-capability-fields-.patch
+usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch
+usb-hide-unused-usbfs_notify_suspend-resume-function.patch
+serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch
+serial-8250-lock-port-for-uart_ier-access-in-omap825.patch
+kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch
+coresight-fix-loss-of-connection-info-when-a-module-.patch
+mfd-rt5033-drop-rt5033-battery-sub-device.patch
+media-venus-helpers-fix-align-of-non-power-of-two.patch
+media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch
+kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch
+software-node-introduce-device_add_software_node.patch
+usb-dwc3-qcom-constify-the-software-node.patch
+usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch
+usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch
+usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch
+usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch
+mfd-intel-lpss-add-missing-check-for-platform_get_re.patch
+revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch
+serial-8250_omap-use-force_suspend-and-resume-for-sy.patch
+test_firmware-return-enomem-instead-of-enospc-on-fai.patch
+mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch
+mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch
+kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch
+mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch
+phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch
+pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch
+pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch
+rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch
+media-cec-i2c-ch7322-also-select-regmap.patch
+sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch
+add-module_firmware-for-firmware_tg357766.patch
+net-dsa-vsc73xx-fix-mtu-configuration.patch
+spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch
+mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch
+f2fs-fix-error-path-handling-in-truncate_dnode.patch
+octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch
+powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch
+net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch
+tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch
+xsk-honor-so_bindtodevice-on-bind.patch
+net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch
+pptp-fix-fib-lookup-calls.patch
+net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch
+s390-qeth-fix-vipa-deletion.patch
+sh-dma-fix-dma-channel-offset-calculation.patch
+apparmor-fix-missing-error-check-for-rhashtable_inse.patch
+i2c-xiic-defer-xiic_wakeup-and-__xiic_start_xfer-in-.patch
+i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch
--- /dev/null
+From 731a521c132fa62459bfe6c23768a5c7485f3f77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 May 2023 18:44:50 +0200
+Subject: sh: dma: Fix DMA channel offset calculation
+
+From: Artur Rojek <contact@artur-rojek.eu>
+
+[ Upstream commit e82e47584847129a20b8c9f4a1dcde09374fb0e0 ]
+
+Various SoCs of the SH3, SH4 and SH4A family, which use this driver,
+feature a differing number of DMA channels, which can be distributed
+between up to two DMAC modules. The existing implementation fails to
+correctly accommodate for all those variations, resulting in wrong
+channel offset calculations and leading to kernel panics.
+
+Rewrite dma_base_addr() in order to properly calculate channel offsets
+in a DMAC module. Fix dmaor_read_reg() and dmaor_write_reg(), so that
+the correct DMAC module base is selected for the DMAOR register.
+
+Fixes: 7f47c7189b3e8f19 ("sh: dma: More legacy cpu dma chainsawing.")
+Signed-off-by: Artur Rojek <contact@artur-rojek.eu>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20230527164452.64797-2-contact@artur-rojek.eu
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/drivers/dma/dma-sh.c | 37 +++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/arch/sh/drivers/dma/dma-sh.c b/arch/sh/drivers/dma/dma-sh.c
+index 96c626c2cd0a4..306fba1564e5e 100644
+--- a/arch/sh/drivers/dma/dma-sh.c
++++ b/arch/sh/drivers/dma/dma-sh.c
+@@ -18,6 +18,18 @@
+ #include <cpu/dma-register.h>
+ #include <cpu/dma.h>
+
++/*
++ * Some of the SoCs feature two DMAC modules. In such a case, the channels are
++ * distributed equally among them.
++ */
++#ifdef SH_DMAC_BASE1
++#define SH_DMAC_NR_MD_CH (CONFIG_NR_ONCHIP_DMA_CHANNELS / 2)
++#else
++#define SH_DMAC_NR_MD_CH CONFIG_NR_ONCHIP_DMA_CHANNELS
++#endif
++
++#define SH_DMAC_CH_SZ 0x10
++
+ /*
+ * Define the default configuration for dual address memory-memory transfer.
+ * The 0x400 value represents auto-request, external->external.
+@@ -29,7 +41,7 @@ static unsigned long dma_find_base(unsigned int chan)
+ unsigned long base = SH_DMAC_BASE0;
+
+ #ifdef SH_DMAC_BASE1
+- if (chan >= 6)
++ if (chan >= SH_DMAC_NR_MD_CH)
+ base = SH_DMAC_BASE1;
+ #endif
+
+@@ -40,13 +52,13 @@ static unsigned long dma_base_addr(unsigned int chan)
+ {
+ unsigned long base = dma_find_base(chan);
+
+- /* Normalize offset calculation */
+- if (chan >= 9)
+- chan -= 6;
+- if (chan >= 4)
+- base += 0x10;
++ chan = (chan % SH_DMAC_NR_MD_CH) * SH_DMAC_CH_SZ;
++
++ /* DMAOR is placed inside the channel register space. Step over it. */
++ if (chan >= DMAOR)
++ base += SH_DMAC_CH_SZ;
+
+- return base + (chan * 0x10);
++ return base + chan;
+ }
+
+ #ifdef CONFIG_SH_DMA_IRQ_MULTI
+@@ -250,12 +262,11 @@ static int sh_dmac_get_dma_residue(struct dma_channel *chan)
+ #define NR_DMAOR 1
+ #endif
+
+-/*
+- * DMAOR bases are broken out amongst channel groups. DMAOR0 manages
+- * channels 0 - 5, DMAOR1 6 - 11 (optional).
+- */
+-#define dmaor_read_reg(n) __raw_readw(dma_find_base((n)*6))
+-#define dmaor_write_reg(n, data) __raw_writew(data, dma_find_base(n)*6)
++#define dmaor_read_reg(n) __raw_readw(dma_find_base((n) * \
++ SH_DMAC_NR_MD_CH) + DMAOR)
++#define dmaor_write_reg(n, data) __raw_writew(data, \
++ dma_find_base((n) * \
++ SH_DMAC_NR_MD_CH) + DMAOR)
+
+ static inline int dmaor_reset(int no)
+ {
+--
+2.39.2
+
--- /dev/null
+From 97fe66e0c7b29b04014c904df6bcdf68cb49dc7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 14:57:41 +0200
+Subject: sh: j2: Use ioremap() to translate device tree address into kernel
+ memory
+
+From: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+
+[ Upstream commit bc9d1f0cecd2407cfb2364a7d4be2f52d1d46a9d ]
+
+Addresses the following warning when building j2_defconfig:
+
+arch/sh/kernel/cpu/sh2/probe.c: In function 'scan_cache':
+arch/sh/kernel/cpu/sh2/probe.c:24:16: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+ 24 | j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node);
+ |
+
+Fixes: 5a846abad07f ("sh: add support for J-Core J2 processor")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Rob Landley <rob@landley.net>
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20230503125746.331835-1-glaubitz@physik.fu-berlin.de
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/kernel/cpu/sh2/probe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c
+index d342ea08843f6..70a07f4f2142f 100644
+--- a/arch/sh/kernel/cpu/sh2/probe.c
++++ b/arch/sh/kernel/cpu/sh2/probe.c
+@@ -21,7 +21,7 @@ static int __init scan_cache(unsigned long node, const char *uname,
+ if (!of_flat_dt_is_compatible(node, "jcore,cache"))
+ return 0;
+
+- j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node);
++ j2_ccr_base = ioremap(of_flat_dt_translate_address(node), 4);
+
+ return 1;
+ }
+--
+2.39.2
+
--- /dev/null
+From 70ebfaf109149b9931cae59d35f6de74b7d25592 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 12:49:11 +0300
+Subject: software node: Introduce device_add_software_node()
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit e68d0119e3284334de5650a1ac42ef4e179f895e ]
+
+This helper will register a software node and then assign
+it to device at the same time. The function will also make
+sure that the device can't have more than one software node.
+
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115094914.88401-2-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 8fd95da2cfb5 ("usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/swnode.c | 71 +++++++++++++++++++++++++++++++++++-----
+ include/linux/property.h | 3 ++
+ 2 files changed, 65 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
+index d2fb3eb5816c3..572a53e6f2e88 100644
+--- a/drivers/base/swnode.c
++++ b/drivers/base/swnode.c
+@@ -48,6 +48,19 @@ EXPORT_SYMBOL_GPL(is_software_node);
+ struct swnode, fwnode) : NULL; \
+ })
+
++static inline struct swnode *dev_to_swnode(struct device *dev)
++{
++ struct fwnode_handle *fwnode = dev_fwnode(dev);
++
++ if (!fwnode)
++ return NULL;
++
++ if (!is_software_node(fwnode))
++ fwnode = fwnode->secondary;
++
++ return to_swnode(fwnode);
++}
++
+ static struct swnode *
+ software_node_to_swnode(const struct software_node *node)
+ {
+@@ -850,22 +863,62 @@ void fwnode_remove_software_node(struct fwnode_handle *fwnode)
+ }
+ EXPORT_SYMBOL_GPL(fwnode_remove_software_node);
+
++/**
++ * device_add_software_node - Assign software node to a device
++ * @dev: The device the software node is meant for.
++ * @swnode: The software node.
++ *
++ * This function will register @swnode and make it the secondary firmware node
++ * pointer of @dev. If @dev has no primary node, then @swnode will become the primary
++ * node.
++ */
++int device_add_software_node(struct device *dev, const struct software_node *swnode)
++{
++ int ret;
++
++ /* Only one software node per device. */
++ if (dev_to_swnode(dev))
++ return -EBUSY;
++
++ ret = software_node_register(swnode);
++ if (ret)
++ return ret;
++
++ set_secondary_fwnode(dev, software_node_fwnode(swnode));
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(device_add_software_node);
++
++/**
++ * device_remove_software_node - Remove device's software node
++ * @dev: The device with the software node.
++ *
++ * This function will unregister the software node of @dev.
++ */
++void device_remove_software_node(struct device *dev)
++{
++ struct swnode *swnode;
++
++ swnode = dev_to_swnode(dev);
++ if (!swnode)
++ return;
++
++ software_node_notify(dev, KOBJ_REMOVE);
++ set_secondary_fwnode(dev, NULL);
++ kobject_put(&swnode->kobj);
++}
++EXPORT_SYMBOL_GPL(device_remove_software_node);
++
+ int software_node_notify(struct device *dev, unsigned long action)
+ {
+- struct fwnode_handle *fwnode = dev_fwnode(dev);
+ struct swnode *swnode;
+ int ret;
+
+- if (!fwnode)
+- return 0;
+-
+- if (!is_software_node(fwnode))
+- fwnode = fwnode->secondary;
+- if (!is_software_node(fwnode))
++ swnode = dev_to_swnode(dev);
++ if (!swnode)
+ return 0;
+
+- swnode = to_swnode(fwnode);
+-
+ switch (action) {
+ case KOBJ_ADD:
+ ret = sysfs_create_link(&dev->kobj, &swnode->kobj,
+diff --git a/include/linux/property.h b/include/linux/property.h
+index 2d4542629d80b..3b6093f6bd04c 100644
+--- a/include/linux/property.h
++++ b/include/linux/property.h
+@@ -485,4 +485,7 @@ fwnode_create_software_node(const struct property_entry *properties,
+ const struct fwnode_handle *parent);
+ void fwnode_remove_software_node(struct fwnode_handle *fwnode);
+
++int device_add_software_node(struct device *dev, const struct software_node *swnode);
++void device_remove_software_node(struct device *dev);
++
+ #endif /* _LINUX_PROPERTY_H_ */
+--
+2.39.2
+
--- /dev/null
+From a7692e53092aedda2ec73543a8ad9107b6f98caf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 15:43:05 +0200
+Subject: spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 7c1f23ad34fcdace50275a6aa1e1969b41c6233f ]
+
+If neither a "hif_mspi" nor "mspi" resource is present, the driver will
+just early exit in probe but still return success. Apart from not doing
+anything meaningful, this would then also lead to a null pointer access
+on removal, as platform_get_drvdata() would return NULL, which it would
+then try to dereference when trying to unregister the spi master.
+
+Fix this by unconditionally calling devm_ioremap_resource(), as it can
+handle a NULL res and will then return a viable ERR_PTR() if we get one.
+
+The "return 0;" was previously a "goto qspi_resource_err;" where then
+ret was returned, but since ret was still initialized to 0 at this place
+this was a valid conversion in 63c5395bb7a9 ("spi: bcm-qspi: Fix
+use-after-free on unbind"). The issue was not introduced by this commit,
+only made more obvious.
+
+Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Reviewed-by: Kamal Dasu <kamal.dasu@broadcom.com>
+Link: https://lore.kernel.org/r/20230629134306.95823-1-jonas.gorski@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm-qspi.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 766b00350e391..2c734ea0784b7 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -1369,13 +1369,9 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+ "mspi");
+
+- if (res) {
+- qspi->base[MSPI] = devm_ioremap_resource(dev, res);
+- if (IS_ERR(qspi->base[MSPI]))
+- return PTR_ERR(qspi->base[MSPI]);
+- } else {
+- return 0;
+- }
++ qspi->base[MSPI] = devm_ioremap_resource(dev, res);
++ if (IS_ERR(qspi->base[MSPI]))
++ return PTR_ERR(qspi->base[MSPI]);
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi");
+ if (res) {
+--
+2.39.2
+
--- /dev/null
+From f25d79666df40516251a72a68221c1bfe512a836 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 16:41:50 +0000
+Subject: tcp: annotate data races in __tcp_oow_rate_limited()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 998127cdb4699b9d470a9348ffe9f1154346be5f ]
+
+request sockets are lockless, __tcp_oow_rate_limited() could be called
+on the same object from different cpus. This is harmless.
+
+Add READ_ONCE()/WRITE_ONCE() annotations to avoid a KCSAN report.
+
+Fixes: 4ce7e93cb3fe ("tcp: rate limit ACK sent by SYN_RECV request sockets")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index b98b7920c4029..d6dfbb88dcf5b 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3560,8 +3560,11 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32
+ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
+ u32 *last_oow_ack_time)
+ {
+- if (*last_oow_ack_time) {
+- s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time);
++ /* Paired with the WRITE_ONCE() in this function. */
++ u32 val = READ_ONCE(*last_oow_ack_time);
++
++ if (val) {
++ s32 elapsed = (s32)(tcp_jiffies32 - val);
+
+ if (0 <= elapsed &&
+ elapsed < READ_ONCE(net->ipv4.sysctl_tcp_invalid_ratelimit)) {
+@@ -3570,7 +3573,10 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
+ }
+ }
+
+- *last_oow_ack_time = tcp_jiffies32;
++ /* Paired with the prior READ_ONCE() and with itself,
++ * as we might be lockless.
++ */
++ WRITE_ONCE(*last_oow_ack_time, tcp_jiffies32);
+
+ return false; /* not rate-limited: go ahead, send dupack now! */
+ }
+--
+2.39.2
+
--- /dev/null
+From 17797b7cf019961cd918bb457acf44a6137aec70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 09:08:10 +0200
+Subject: test_firmware: return ENOMEM instead of ENOSPC on failed memory
+ allocation
+
+From: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
+
+[ Upstream commit 7dae593cd226a0bca61201cf85ceb9335cf63682 ]
+
+In a couple of situations like
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+ return -ENOSPC;
+
+the error is not actually "No space left on device", but "Out of memory".
+
+It is semantically correct to return -ENOMEM in all failed kstrndup()
+and kzalloc() cases in this driver, as it is not a problem with disk
+space, but with kernel memory allocator failing allocation.
+
+The semantically correct should be:
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+ return -ENOMEM;
+
+Cc: Dan Carpenter <error27@gmail.com>
+Cc: Takashi Iwai <tiwai@suse.de>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: "Luis R. Rodriguez" <mcgrof@ruslug.rutgers.edu>
+Cc: Scott Branden <sbranden@broadcom.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Brian Norris <briannorris@chromium.org>
+Fixes: c92316bf8e948 ("test_firmware: add batched firmware tests")
+Fixes: 0a8adf584759c ("test: add firmware_class loader test")
+Fixes: 548193cba2a7d ("test_firmware: add support for firmware_request_platform")
+Fixes: eb910947c82f9 ("test: firmware_class: add asynchronous request trigger")
+Fixes: 061132d2b9c95 ("test_firmware: add test custom fallback trigger")
+Fixes: 7feebfa487b92 ("test_firmware: add support for request_firmware_into_buf")
+Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Message-ID: <20230606070808.9300-1-mirsad.todorovac@alu.unizg.hr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_firmware.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/lib/test_firmware.c b/lib/test_firmware.c
+index ed0455a9ded87..25dc9eb6c902b 100644
+--- a/lib/test_firmware.c
++++ b/lib/test_firmware.c
+@@ -183,7 +183,7 @@ static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
+ {
+ *dst = kstrndup(name, count, gfp);
+ if (!*dst)
+- return -ENOSPC;
++ return -ENOMEM;
+ return count;
+ }
+
+@@ -606,7 +606,7 @@ static ssize_t trigger_request_store(struct device *dev,
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ pr_info("loading '%s'\n", name);
+
+@@ -654,7 +654,7 @@ static ssize_t trigger_request_platform_store(struct device *dev,
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ pr_info("inserting test platform fw '%s'\n", name);
+ efi_embedded_fw.name = name;
+@@ -707,7 +707,7 @@ static ssize_t trigger_async_request_store(struct device *dev,
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ pr_info("loading '%s'\n", name);
+
+@@ -752,7 +752,7 @@ static ssize_t trigger_custom_fallback_store(struct device *dev,
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ pr_info("loading '%s' using custom fallback mechanism\n", name);
+
+@@ -803,7 +803,7 @@ static int test_fw_run_batch_request(void *data)
+
+ test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL);
+ if (!test_buf)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ if (test_fw_config->partial)
+ req->rc = request_partial_firmware_into_buf
+--
+2.39.2
+
--- /dev/null
+From eb8fc2a64847dbcfd11c88be40942375df3c5293 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 20:11:14 +0530
+Subject: usb: common: usb-conn-gpio: Set last role to unknown before initial
+ detection
+
+From: Prashanth K <quic_prashk@quicinc.com>
+
+[ Upstream commit edd60d24bd858cef165274e4cd6cab43bdc58d15 ]
+
+Currently if we bootup a device without cable connected, then
+usb-conn-gpio won't call set_role() since last_role is same as
+current role. This happens because during probe last_role gets
+initialised to zero.
+
+To avoid this, added a new constant in enum usb_role, last_role
+is set to USB_ROLE_UNKNOWN before performing initial detection.
+
+While at it, also handle default case for the usb_role switch
+in cdns3, intel-xhci-usb-role-switch & musb/jz4740 to avoid
+build warnings.
+
+Fixes: 4602f3bff266 ("usb: common: add USB GPIO based connection detection driver")
+Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Message-ID: <1685544074-17337-1-git-send-email-quic_prashk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/core.c | 2 ++
+ drivers/usb/common/usb-conn-gpio.c | 3 +++
+ drivers/usb/musb/jz4740.c | 2 ++
+ drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 ++
+ include/linux/usb/role.h | 1 +
+ 5 files changed, 10 insertions(+)
+
+diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
+index 8fe7420de033d..e5fe640b2bb01 100644
+--- a/drivers/usb/cdns3/core.c
++++ b/drivers/usb/cdns3/core.c
+@@ -243,6 +243,8 @@ static enum usb_role cdns3_hw_role_state_machine(struct cdns3 *cdns)
+ if (!vbus)
+ role = USB_ROLE_NONE;
+ break;
++ default:
++ break;
+ }
+
+ dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role);
+diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c
+index c9545a4eff664..5754e467c16a8 100644
+--- a/drivers/usb/common/usb-conn-gpio.c
++++ b/drivers/usb/common/usb-conn-gpio.c
+@@ -276,6 +276,9 @@ static int usb_conn_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, info);
+
++ /* Set last role to unknown before performing the initial detection */
++ info->last_role = USB_ROLE_UNKNOWN;
++
+ /* Perform initial detection */
+ usb_conn_queue_dwork(info, 0);
+
+diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c
+index c4fe1f4cd17a3..f283629091ec4 100644
+--- a/drivers/usb/musb/jz4740.c
++++ b/drivers/usb/musb/jz4740.c
+@@ -91,6 +91,8 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw,
+ case USB_ROLE_HOST:
+ atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy);
+ break;
++ default:
++ break;
+ }
+
+ return 0;
+diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c
+index 5c96e929acea0..4d6a3dd06e011 100644
+--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c
++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c
+@@ -97,6 +97,8 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw,
+ val |= SW_VBUS_VALID;
+ drd_config = DRD_CONFIG_STATIC_DEVICE;
+ break;
++ default:
++ break;
+ }
+ val |= SW_IDPIN_EN;
+ if (data->enable_sw_switch) {
+diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h
+index b9ccaeb8a4aef..aecfce46d3544 100644
+--- a/include/linux/usb/role.h
++++ b/include/linux/usb/role.h
+@@ -11,6 +11,7 @@ enum usb_role {
+ USB_ROLE_NONE,
+ USB_ROLE_HOST,
+ USB_ROLE_DEVICE,
++ USB_ROLE_UNKNOWN,
+ };
+
+ typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw,
+--
+2.39.2
+
--- /dev/null
+From fd910a041cf4e6fc1c4440671fb6c4bd11fb9ccd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jun 2023 15:32:52 +0200
+Subject: usb: dwc3-meson-g12a: Fix an error handling path in
+ dwc3_meson_g12a_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 01052b91c9808e3c3b068ae2721cb728ec9aa4c0 ]
+
+If dwc3_meson_g12a_otg_init() fails, resources allocated by the previous
+of_platform_populate() call should be released, as already done in the
+error handling path.
+
+Fixes: 1e355f21d3fb ("usb: dwc3: Add Amlogic A1 DWC3 glue")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Message-ID: <9d28466de1808ccc756b4cc25fc72c482d133d13.1686403934.git.christophe.jaillet@wanadoo.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-meson-g12a.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c
+index d0f9b7c296b0d..69ec06efd7f25 100644
+--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
+@@ -805,7 +805,7 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)
+
+ ret = dwc3_meson_g12a_otg_init(pdev, priv);
+ if (ret)
+- goto err_phys_power;
++ goto err_plat_depopulate;
+
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+@@ -813,6 +813,9 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)
+
+ return 0;
+
++err_plat_depopulate:
++ of_platform_depopulate(dev);
++
+ err_phys_power:
+ for (i = 0 ; i < PHY_COUNT ; ++i)
+ phy_power_off(priv->phys[i]);
+--
+2.39.2
+
--- /dev/null
+From dc547ccf99a61723e5321c95077dc9e40eeb205e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 17:17:09 +0300
+Subject: usb: dwc3: qcom: Constify the software node
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit 8dc6e6dd1bee39cd65a232a17d51240fc65a0f4a ]
+
+What platform_device_add_properties() does is it allocates
+dynamically a software node that will contain the device
+properties supplied to it, and then couples that node with
+the device. If the properties are constant, the node can be
+constant as well.
+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20210204141711.53775-5-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 8fd95da2cfb5 ("usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 5c66efb05d7f7..d7222c8cb0060 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -592,6 +592,10 @@ static const struct property_entry dwc3_qcom_acpi_properties[] = {
+ {}
+ };
+
++static const struct software_node dwc3_qcom_swnode = {
++ .properties = dwc3_qcom_acpi_properties,
++};
++
+ static int dwc3_qcom_acpi_register_core(struct platform_device *pdev)
+ {
+ struct dwc3_qcom *qcom = platform_get_drvdata(pdev);
+@@ -642,16 +646,17 @@ static int dwc3_qcom_acpi_register_core(struct platform_device *pdev)
+ goto out;
+ }
+
+- ret = platform_device_add_properties(qcom->dwc3,
+- dwc3_qcom_acpi_properties);
++ ret = device_add_software_node(&qcom->dwc3->dev, &dwc3_qcom_swnode);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to add properties\n");
+ goto out;
+ }
+
+ ret = platform_device_add(qcom->dwc3);
+- if (ret)
++ if (ret) {
+ dev_err(&pdev->dev, "failed to add device\n");
++ device_remove_software_node(&qcom->dwc3->dev);
++ }
+
+ out:
+ kfree(child_res);
+@@ -872,6 +877,7 @@ static int dwc3_qcom_remove(struct platform_device *pdev)
+ struct device *dev = &pdev->dev;
+ int i;
+
++ device_remove_software_node(&qcom->dwc3->dev);
+ of_platform_depopulate(dev);
+
+ for (i = qcom->num_clocks - 1; i >= 0; i--) {
+--
+2.39.2
+
--- /dev/null
+From 7dc8d5747ba55a0b0f530c77546a57589a944efd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jun 2023 16:56:34 +0200
+Subject: usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 4a944da707123686d372ec01ea60056902fadf35 ]
+
+If dwc3_qcom_create_urs_usb_platdev() fails, some resources still need to
+be released, as already done in the other error handling path of the
+probe.
+
+Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Message-ID: <b69fa8dd68d816e7d24c88d3eda776ceb28c5dc5.1685890571.git.christophe.jaillet@wanadoo.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index a699986b56c4b..7cfb2c016f99c 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -791,9 +791,10 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ if (IS_ERR_OR_NULL(qcom->urs_usb)) {
+ dev_err(dev, "failed to create URS USB platdev\n");
+ if (!qcom->urs_usb)
+- return -ENODEV;
++ ret = -ENODEV;
+ else
+- return PTR_ERR(qcom->urs_usb);
++ ret = PTR_ERR(qcom->urs_usb);
++ goto clk_disable;
+ }
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From fb8aa9d3e968fd937733b98fc8e1f4e697d276c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 20:25:18 +0300
+Subject: usb: dwc3: qcom: Fix potential memory leak
+
+From: Vladislav Efanov <VEfanov@ispras.ru>
+
+[ Upstream commit 097fb3ee710d4de83b8d4f5589e8ee13e0f0541e ]
+
+Function dwc3_qcom_probe() allocates memory for resource structure
+which is pointed by parent_res pointer. This memory is not
+freed. This leads to memory leak. Use stack memory to prevent
+memory leak.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
+Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Link: https://lore.kernel.org/r/20230517172518.442591-1-VEfanov@ispras.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index dac13fe978110..5c66efb05d7f7 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -722,6 +722,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ struct device *dev = &pdev->dev;
+ struct dwc3_qcom *qcom;
+ struct resource *res, *parent_res = NULL;
++ struct resource local_res;
+ int ret, i;
+ bool ignore_pipe_clk;
+
+@@ -772,9 +773,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ if (np) {
+ parent_res = res;
+ } else {
+- parent_res = kmemdup(res, sizeof(struct resource), GFP_KERNEL);
+- if (!parent_res)
+- return -ENOMEM;
++ memcpy(&local_res, res, sizeof(struct resource));
++ parent_res = &local_res;
+
+ parent_res->start = res->start +
+ qcom->acpi_pdata->qscratch_base_offset;
+--
+2.39.2
+
--- /dev/null
+From 60f2f5faedb22fb1ad6fa5d30d485b819d00dd67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jun 2023 17:04:37 +0200
+Subject: usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 8fd95da2cfb5046c4bb5a3cdc9eb7963ba8b10dd ]
+
+In the probe, some resources are allocated with
+dwc3_qcom_of_register_core() or dwc3_qcom_acpi_register_core(). The
+corresponding resources are already coorectly freed in the error handling
+path of the probe, but not in the remove function.
+
+Fix it.
+
+Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Message-ID: <c0215a84cdf18fb3514c81842783ec53cf149deb.1685891059.git.christophe.jaillet@wanadoo.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index d7222c8cb0060..a699986b56c4b 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -874,11 +874,15 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ static int dwc3_qcom_remove(struct platform_device *pdev)
+ {
+ struct dwc3_qcom *qcom = platform_get_drvdata(pdev);
++ struct device_node *np = pdev->dev.of_node;
+ struct device *dev = &pdev->dev;
+ int i;
+
+ device_remove_software_node(&qcom->dwc3->dev);
+- of_platform_depopulate(dev);
++ if (np)
++ of_platform_depopulate(&pdev->dev);
++ else
++ platform_device_put(pdev);
+
+ for (i = qcom->num_clocks - 1; i >= 0; i--) {
+ clk_disable_unprepare(qcom->clks[i]);
+--
+2.39.2
+
--- /dev/null
+From 9c6603d6c648bb23a9361fded55c17f0d9564702 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 14:48:37 +0530
+Subject: usb: gadget: u_serial: Add null pointer check in gserial_suspend
+
+From: Prashanth K <quic_prashk@quicinc.com>
+
+[ Upstream commit 2f6ecb89fe8feb2b60a53325b0eeb9866d88909a ]
+
+Consider a case where gserial_disconnect has already cleared
+gser->ioport. And if gserial_suspend gets called afterwards,
+it will lead to accessing of gser->ioport and thus causing
+null pointer dereference.
+
+Avoid this by adding a null pointer check. Added a static
+spinlock to prevent gser->ioport from becoming null after
+the newly added null pointer check.
+
+Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks")
+Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
+Link: https://lore.kernel.org/r/1683278317-11774-1-git-send-email-quic_prashk@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/u_serial.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
+index 7b54e814aefb1..3b5a6430e2418 100644
+--- a/drivers/usb/gadget/function/u_serial.c
++++ b/drivers/usb/gadget/function/u_serial.c
+@@ -1421,10 +1421,19 @@ EXPORT_SYMBOL_GPL(gserial_disconnect);
+
+ void gserial_suspend(struct gserial *gser)
+ {
+- struct gs_port *port = gser->ioport;
++ struct gs_port *port;
+ unsigned long flags;
+
+- spin_lock_irqsave(&port->port_lock, flags);
++ spin_lock_irqsave(&serial_port_lock, flags);
++ port = gser->ioport;
++
++ if (!port) {
++ spin_unlock_irqrestore(&serial_port_lock, flags);
++ return;
++ }
++
++ spin_lock(&port->port_lock);
++ spin_unlock(&serial_port_lock);
+ port->suspended = true;
+ spin_unlock_irqrestore(&port->port_lock, flags);
+ }
+--
+2.39.2
+
--- /dev/null
+From ea33f695609edcb6ffaa9fcb8469a48a4f6a1dff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 May 2023 22:17:42 +0200
+Subject: usb: hide unused usbfs_notify_suspend/resume functions
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 8e6bd945e6dde64fbc60ec3fe252164493a8d3a2 ]
+
+The declaration is in an #ifdef, which causes warnings when building
+with 'make W=1' and without CONFIG_PM:
+
+drivers/usb/core/devio.c:742:6: error: no previous prototype for 'usbfs_notify_suspend'
+drivers/usb/core/devio.c:747:6: error: no previous prototype for 'usbfs_notify_resume'
+
+Use the same #ifdef check around the function definitions to avoid
+the warnings and slightly shrink the USB core.
+
+Fixes: 7794f486ed0b ("usbfs: Add ioctls for runtime power management")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20230516202103.558301-1-arnd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/devio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 2fe29319de441..1b95035d179f3 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -734,6 +734,7 @@ static int driver_resume(struct usb_interface *intf)
+ return 0;
+ }
+
++#ifdef CONFIG_PM
+ /* The following routines apply to the entire device, not interfaces */
+ void usbfs_notify_suspend(struct usb_device *udev)
+ {
+@@ -752,6 +753,7 @@ void usbfs_notify_resume(struct usb_device *udev)
+ }
+ mutex_unlock(&usbfs_mutex);
+ }
++#endif
+
+ struct usb_driver usbfs_driver = {
+ .name = "usbfs",
+--
+2.39.2
+
--- /dev/null
+From 6b2333021ee64e7c9925f344fb751a65056f36ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 22:08:31 +0800
+Subject: usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
+
+From: Li Yang <lidaxian@hust.edu.cn>
+
+[ Upstream commit 342161c11403ea00e9febc16baab1d883d589d04 ]
+
+Smatch reports:
+drivers/usb/phy/phy-tahvo.c: tahvo_usb_probe()
+warn: missing unwind goto?
+
+After geting irq, if ret < 0, it will return without error handling to
+free memory.
+Just add error handling to fix this problem.
+
+Fixes: 0d45a1373e66 ("usb: phy: tahvo: add IRQ check")
+Signed-off-by: Li Yang <lidaxian@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230420140832.9110-1-lidaxian@hust.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-tahvo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c
+index a3e043e3e4aae..d0672b6712985 100644
+--- a/drivers/usb/phy/phy-tahvo.c
++++ b/drivers/usb/phy/phy-tahvo.c
+@@ -395,7 +395,7 @@ static int tahvo_usb_probe(struct platform_device *pdev)
+
+ tu->irq = ret = platform_get_irq(pdev, 0);
+ if (ret < 0)
+- return ret;
++ goto err_remove_phy;
+ ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt,
+ IRQF_ONESHOT,
+ "tahvo-vbus", tu);
+--
+2.39.2
+
--- /dev/null
+From 6bee1697e281acc3d0c4de3284ec3d2472adb45c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 May 2021 17:17:45 +0300
+Subject: w1: fix loop in w1_fini()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 83f3fcf96fcc7e5405b37d9424c7ef26bfa203f8 ]
+
+The __w1_remove_master_device() function calls:
+
+ list_del(&dev->w1_master_entry);
+
+So presumably this can cause an endless loop.
+
+Fixes: 7785925dd8e0 ("[PATCH] w1: cleanups.")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/w1/w1.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
+index 15842377c8d2c..1c1a9438f4b6b 100644
+--- a/drivers/w1/w1.c
++++ b/drivers/w1/w1.c
+@@ -1228,10 +1228,10 @@ static int __init w1_init(void)
+
+ static void __exit w1_fini(void)
+ {
+- struct w1_master *dev;
++ struct w1_master *dev, *n;
+
+ /* Set netlink removal messages and some cleanup */
+- list_for_each_entry(dev, &w1_masters, w1_master_entry)
++ list_for_each_entry_safe(dev, n, &w1_masters, w1_master_entry)
+ __w1_remove_master_device(dev);
+
+ w1_fini_netlink();
+--
+2.39.2
+
--- /dev/null
+From 8d664d6b584cd915e2e90b7653d530af1fc89e86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 13:21:52 +0200
+Subject: w1: w1_therm: fix locking behavior in convert_t
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit dca5480ab7b77a889088ab7cac81934604510ac7 ]
+
+The commit 67b392f7b8ed ("w1_therm: optimizing temperature read timings")
+accidentially inverted the logic for lock handling of the bus mutex.
+
+Before:
+ pullup -> release lock before sleep
+ no pullup -> release lock after sleep
+
+After:
+ pullup -> release lock after sleep
+ no pullup -> release lock before sleep
+
+This cause spurious measurements of 85 degree (powerup value) on the
+Tarragon board with connected 1-w temperature sensor
+(w1_therm.w1_strong_pull=0).
+
+In the meantime a new feature for polling the conversion
+completion has been integrated in these branches with
+commit 021da53e65fd ("w1: w1_therm: Add sysfs entries to control
+conversion time and driver features"). But this feature isn't
+available for parasite power mode, so handle this separately.
+
+Link: https://lore.kernel.org/regressions/2023042645-attentive-amends-7b0b@gregkh/T/
+Fixes: 67b392f7b8ed ("w1_therm: optimizing temperature read timings")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Link: https://lore.kernel.org/r/20230427112152.12313-1-stefan.wahren@i2se.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/w1/slaves/w1_therm.c | 31 ++++++++++++++-----------------
+ 1 file changed, 14 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
+index 6546d029c7fd6..3888643a22f60 100644
+--- a/drivers/w1/slaves/w1_therm.c
++++ b/drivers/w1/slaves/w1_therm.c
+@@ -1094,29 +1094,26 @@ static int convert_t(struct w1_slave *sl, struct therm_info *info)
+
+ w1_write_8(dev_master, W1_CONVERT_TEMP);
+
+- if (strong_pullup) { /*some device need pullup */
++ if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) {
++ ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP);
++ if (ret) {
++ dev_dbg(&sl->dev, "%s: Timeout\n", __func__);
++ goto mt_unlock;
++ }
++ mutex_unlock(&dev_master->bus_mutex);
++ } else if (!strong_pullup) { /*no device need pullup */
+ sleep_rem = msleep_interruptible(t_conv);
+ if (sleep_rem != 0) {
+ ret = -EINTR;
+ goto mt_unlock;
+ }
+ mutex_unlock(&dev_master->bus_mutex);
+- } else { /*no device need pullup */
+- if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) {
+- ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP);
+- if (ret) {
+- dev_dbg(&sl->dev, "%s: Timeout\n", __func__);
+- goto mt_unlock;
+- }
+- mutex_unlock(&dev_master->bus_mutex);
+- } else {
+- /* Fixed delay */
+- mutex_unlock(&dev_master->bus_mutex);
+- sleep_rem = msleep_interruptible(t_conv);
+- if (sleep_rem != 0) {
+- ret = -EINTR;
+- goto dec_refcnt;
+- }
++ } else { /*some device need pullup */
++ mutex_unlock(&dev_master->bus_mutex);
++ sleep_rem = msleep_interruptible(t_conv);
++ if (sleep_rem != 0) {
++ ret = -EINTR;
++ goto dec_refcnt;
+ }
+ }
+ ret = read_scratchpad(sl, info);
+--
+2.39.2
+
--- /dev/null
+From 198b68b22a3059cfd752bbf523e80136a6ac56af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 19:53:29 +0200
+Subject: xsk: Honor SO_BINDTODEVICE on bind
+
+From: Ilya Maximets <i.maximets@ovn.org>
+
+[ Upstream commit f7306acec9aae9893d15e745c8791124d42ab10a ]
+
+Initial creation of an AF_XDP socket requires CAP_NET_RAW capability. A
+privileged process might create the socket and pass it to a non-privileged
+process for later use. However, that process will be able to bind the socket
+to any network interface. Even though it will not be able to receive any
+traffic without modification of the BPF map, the situation is not ideal.
+
+Sockets already have a mechanism that can be used to restrict what interface
+they can be attached to. That is SO_BINDTODEVICE.
+
+To change the SO_BINDTODEVICE binding the process will need CAP_NET_RAW.
+
+Make xsk_bind() honor the SO_BINDTODEVICE in order to allow safer workflow
+when non-privileged process is using AF_XDP.
+
+The intended workflow is following:
+
+ 1. First process creates a bare socket with socket(AF_XDP, ...).
+ 2. First process loads the XSK program to the interface.
+ 3. First process adds the socket fd to a BPF map.
+ 4. First process ties socket fd to a particular interface using
+ SO_BINDTODEVICE.
+ 5. First process sends socket fd to a second process.
+ 6. Second process allocates UMEM.
+ 7. Second process binds socket to the interface with bind(...).
+ 8. Second process sends/receives the traffic.
+
+All the steps above are possible today if the first process is privileged
+and the second one has sufficient RLIMIT_MEMLOCK and no capabilities.
+However, the second process will be able to bind the socket to any interface
+it wants on step 7 and send traffic from it. With the proposed change, the
+second process will be able to bind the socket only to a specific interface
+chosen by the first process at step 4.
+
+Fixes: 965a99098443 ("xsk: add support for bind for Rx")
+Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/bpf/20230703175329.3259672-1-i.maximets@ovn.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/af_xdp.rst | 9 +++++++++
+ net/xdp/xsk.c | 5 +++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/Documentation/networking/af_xdp.rst b/Documentation/networking/af_xdp.rst
+index 2ccc5644cc98a..70623cb135d3c 100644
+--- a/Documentation/networking/af_xdp.rst
++++ b/Documentation/networking/af_xdp.rst
+@@ -433,6 +433,15 @@ start N bytes into the buffer leaving the first N bytes for the
+ application to use. The final option is the flags field, but it will
+ be dealt with in separate sections for each UMEM flag.
+
++SO_BINDTODEVICE setsockopt
++--------------------------
++
++This is a generic SOL_SOCKET option that can be used to tie AF_XDP
++socket to a particular network interface. It is useful when a socket
++is created by a privileged process and passed to a non-privileged one.
++Once the option is set, kernel will refuse attempts to bind that socket
++to a different interface. Updating the value requires CAP_NET_RAW.
++
+ XDP_STATISTICS getsockopt
+ -------------------------
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index 691841dc6d334..d04f91f4d09df 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -667,6 +667,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+ struct sock *sk = sock->sk;
+ struct xdp_sock *xs = xdp_sk(sk);
+ struct net_device *dev;
++ int bound_dev_if;
+ u32 flags, qid;
+ int err = 0;
+
+@@ -680,6 +681,10 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+ XDP_USE_NEED_WAKEUP))
+ return -EINVAL;
+
++ bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);
++ if (bound_dev_if && bound_dev_if != sxdp->sxdp_ifindex)
++ return -EINVAL;
++
+ rtnl_lock();
+ mutex_lock(&xs->mutex);
+ if (xs->state != XSK_READY) {
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
