--- /dev/null
+From 328d2168ca524d501fc4b133d6be076142bd305c Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Tue, 27 Oct 2020 15:01:17 -0700
+Subject: ARC: stack unwinding: avoid indefinite looping
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit 328d2168ca524d501fc4b133d6be076142bd305c upstream.
+
+Currently stack unwinder is a while(1) loop which relies on the dwarf
+unwinder to signal termination, which in turn relies on dwarf info to do
+so. This in theory could cause an infinite loop if the dwarf info was
+somehow messed up or the register contents were etc.
+
+This fix thus detects the excessive looping and breaks the loop.
+
+| Mem: 26184K used, 1009136K free, 0K shrd, 0K buff, 14416K cached
+| CPU: 0.0% usr 72.8% sys 0.0% nic 27.1% idle 0.0% io 0.0% irq 0.0% sirq
+| Load average: 4.33 2.60 1.11 2/74 139
+| PID PPID USER STAT VSZ %VSZ CPU %CPU COMMAND
+| 133 2 root SWN 0 0.0 3 22.9 [rcu_torture_rea]
+| 132 2 root SWN 0 0.0 0 22.0 [rcu_torture_rea]
+| 131 2 root SWN 0 0.0 3 21.5 [rcu_torture_rea]
+| 126 2 root RW 0 0.0 2 5.4 [rcu_torture_wri]
+| 129 2 root SWN 0 0.0 0 0.2 [rcu_torture_fak]
+| 137 2 root SW 0 0.0 0 0.2 [rcu_torture_cbf]
+| 127 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak]
+| 138 115 root R 1464 0.1 2 0.1 top
+| 130 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak]
+| 128 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak]
+| 115 1 root S 1472 0.1 1 0.0 -/bin/sh
+| 104 1 root S 1464 0.1 0 0.0 inetd
+| 1 0 root S 1456 0.1 2 0.0 init
+| 78 1 root S 1456 0.1 0 0.0 syslogd -O /var/log/messages
+| 134 2 root SW 0 0.0 2 0.0 [rcu_torture_sta]
+| 10 2 root IW 0 0.0 1 0.0 [rcu_preempt]
+| 88 2 root IW 0 0.0 1 0.0 [kworker/1:1-eve]
+| 66 2 root IW 0 0.0 2 0.0 [kworker/2:2-eve]
+| 39 2 root IW 0 0.0 2 0.0 [kworker/2:1-eve]
+| unwinder looping too long, aborting !
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/kernel/stacktrace.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/arc/kernel/stacktrace.c
++++ b/arch/arc/kernel/stacktrace.c
+@@ -112,7 +112,7 @@ arc_unwind_core(struct task_struct *tsk,
+ int (*consumer_fn) (unsigned int, void *), void *arg)
+ {
+ #ifdef CONFIG_ARC_DW2_UNWIND
+- int ret = 0;
++ int ret = 0, cnt = 0;
+ unsigned int address;
+ struct unwind_frame_info frame_info;
+
+@@ -132,6 +132,11 @@ arc_unwind_core(struct task_struct *tsk,
+ break;
+
+ frame_info.regs.r63 = frame_info.regs.r31;
++
++ if (cnt++ > 128) {
++ printk("unwinder looping too long, aborting !\n");
++ return 0;
++ }
+ }
+
+ return address; /* return the last address it saw */
--- /dev/null
+From d9a57c853975742c8281f703b9e536d8aa016ec2 Mon Sep 17 00:00:00 2001
+From: Imre Deak <imre.deak@intel.com>
+Date: Tue, 27 Oct 2020 18:09:28 +0200
+Subject: drm/i915: Fix encoder lookup during PSR atomic check
+
+From: Imre Deak <imre.deak@intel.com>
+
+commit d9a57c853975742c8281f703b9e536d8aa016ec2 upstream.
+
+The atomic check hooks must look up the encoder to be used with a
+connector from the connector's atomic state, and not assume that it's
+the connector's current attached encoder. The latter one can change
+under the atomic check func, or can be unset yet as in the case of MST
+connectors.
+
+This fixes
+[ 7.940719] Oops: 0000 [#1] SMP NOPTI
+[ 7.944407] CPU: 2 PID: 143 Comm: kworker/2:2 Not tainted 5.6.0-1023-oem #23-Ubuntu
+[ 7.952102] Hardware name: Dell Inc. Latitude 7320/, BIOS 88.87.11 09/07/2020
+[ 7.959278] Workqueue: events output_poll_execute [drm_kms_helper]
+[ 7.965511] RIP: 0010:intel_psr_atomic_check+0x37/0xa0 [i915]
+[ 7.971327] Code: 80 2d 06 00 00 20 74 42 80 b8 34 71 00 00 00 74 39 48 8b 72 08 48 85 f6 74 30 80 b8 f8 71 00 00 00 74 27 4c 8b 87 80 04 00 00 <41> 8b 78 78 83 ff 08 77 19 31 c9 83 ff 05 77 19 48 81 c1 20 01 00
+[ 7.977541] input: PS/2 Generic Mouse as /devices/platform/i8042/serio1/input/input5
+[ 7.990154] RSP: 0018:ffffb864c073fac8 EFLAGS: 00010202
+[ 7.990155] RAX: ffff8c5d55ce0000 RBX: ffff8c5d54519000 RCX: 0000000000000000
+[ 7.990155] RDX: ffff8c5d55cb30c0 RSI: ffff8c5d89a0c800 RDI: ffff8c5d55fcf800
+[ 7.990156] RBP: ffffb864c073fac8 R08: 0000000000000000 R09: ffff8c5d55d9f3a0
+[ 7.990156] R10: ffff8c5d55cb30c0 R11: 0000000000000009 R12: ffff8c5d55fcf800
+[ 7.990156] R13: ffff8c5d55cb30c0 R14: ffff8c5d56989cc0 R15: ffff8c5d56989cc0
+[ 7.990158] FS: 0000000000000000(0000) GS:ffff8c5d8e480000(0000) knlGS:0000000000000000
+[ 8.047193] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 8.052970] CR2: 0000000000000078 CR3: 0000000856500005 CR4: 0000000000760ee0
+[ 8.060137] PKRU: 55555554
+[ 8.062867] Call Trace:
+[ 8.065361] intel_digital_connector_atomic_check+0x53/0x130 [i915]
+[ 8.071703] intel_dp_mst_atomic_check+0x5b/0x200 [i915]
+[ 8.077074] drm_atomic_helper_check_modeset+0x1db/0x790 [drm_kms_helper]
+[ 8.083942] intel_atomic_check+0x92/0xc50 [i915]
+[ 8.088705] ? drm_plane_check_pixel_format+0x4f/0xb0 [drm]
+[ 8.094345] ? drm_atomic_plane_check+0x7a/0x3a0 [drm]
+[ 8.099548] drm_atomic_check_only+0x2b1/0x450 [drm]
+[ 8.104573] drm_atomic_commit+0x18/0x50 [drm]
+[ 8.109070] drm_client_modeset_commit_atomic+0x1c9/0x200 [drm]
+[ 8.115056] drm_client_modeset_commit_force+0x55/0x160 [drm]
+[ 8.120866] drm_fb_helper_restore_fbdev_mode_unlocked+0x54/0xb0 [drm_kms_helper]
+[ 8.128415] drm_fb_helper_set_par+0x34/0x50 [drm_kms_helper]
+[ 8.134225] drm_fb_helper_hotplug_event.part.0+0xb4/0xe0 [drm_kms_helper]
+[ 8.141150] drm_fb_helper_hotplug_event+0x1c/0x30 [drm_kms_helper]
+[ 8.147481] intel_fbdev_output_poll_changed+0x6f/0xa0 [i915]
+[ 8.153287] drm_kms_helper_hotplug_event+0x2c/0x40 [drm_kms_helper]
+[ 8.159709] output_poll_execute+0x1aa/0x1c0 [drm_kms_helper]
+[ 8.165506] process_one_work+0x1e8/0x3b0
+[ 8.169561] worker_thread+0x4d/0x400
+[ 8.173249] kthread+0x104/0x140
+[ 8.176515] ? process_one_work+0x3b0/0x3b0
+[ 8.180726] ? kthread_park+0x90/0x90
+[ 8.184416] ret_from_fork+0x1f/0x40
+
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2361
+References: https://gitlab.freedesktop.org/drm/intel/-/issues/2486
+Reported-by: William Tseng <william.tseng@intel.com>
+Reported-by: Cooper Chiou <cooper.chiou@intel.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Anshuman Gupta <anshuman.gupta@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201027160928.3665377-1-imre.deak@intel.com
+(cherry picked from commit 00e5deb5c4f5fe367311465e720e65cfa1178792)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/display/intel_psr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_psr.c
++++ b/drivers/gpu/drm/i915/display/intel_psr.c
+@@ -1672,7 +1672,7 @@ void intel_psr_atomic_check(struct drm_c
+ return;
+
+ intel_connector = to_intel_connector(connector);
+- dig_port = enc_to_dig_port(intel_attached_encoder(intel_connector));
++ dig_port = enc_to_dig_port(to_intel_encoder(new_state->best_encoder));
+ if (dev_priv->psr.dp != &dig_port->dp)
+ return;
+
--- /dev/null
+From 8ce70996f759a37bac92e69ae0addd715227bfd1 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 22 Oct 2020 07:41:27 +0100
+Subject: drm/i915/gt: Use the local HWSP offset during submission
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 8ce70996f759a37bac92e69ae0addd715227bfd1 upstream.
+
+We wrap the timeline on construction of the next request, but there may
+still be requests in flight that have not yet finalized the breadcrumb.
+(The breadcrumb is delayed as we need engine-local offsets, and for the
+virtual engine that is not known until execution.) As such, by the time
+we write to the timeline's HWSP offset it may have changed, and we
+should use the value we preserved in the request instead.
+
+Though the window is small and infrequent (at full flow we can expect a
+timeline's seqno to wrap once every 30 minutes), the impact of writing
+the old seqno into the new HWSP is severe: the old requests are never
+completed, and the new requests are completed before they are even
+submitted.
+
+Fixes: ebece7539242 ("drm/i915: Keep timeline HWSP allocated until idle across the system")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.2+
+Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201022064127.10159-1-chris@chris-wilson.co.uk
+(cherry picked from commit c10f6019d0b2dc8a6a62b55459f3ada5bc4e5e1a)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/gt/intel_lrc.c | 27 +++++++++++++++++--------
+ drivers/gpu/drm/i915/gt/intel_timeline.c | 18 +++++++++-------
+ drivers/gpu/drm/i915/gt/intel_timeline_types.h | 2 +
+ 3 files changed, 31 insertions(+), 16 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gt/intel_lrc.c
++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c
+@@ -3539,6 +3539,19 @@ static const struct intel_context_ops ex
+ .destroy = execlists_context_destroy,
+ };
+
++static u32 hwsp_offset(const struct i915_request *rq)
++{
++ const struct intel_timeline_cacheline *cl;
++
++ /* Before the request is executed, the timeline/cachline is fixed */
++
++ cl = rcu_dereference_protected(rq->hwsp_cacheline, 1);
++ if (cl)
++ return cl->ggtt_offset;
++
++ return rcu_dereference_protected(rq->timeline, 1)->hwsp_offset;
++}
++
+ static int gen8_emit_init_breadcrumb(struct i915_request *rq)
+ {
+ u32 *cs;
+@@ -3561,7 +3574,7 @@ static int gen8_emit_init_breadcrumb(str
+ *cs++ = MI_NOOP;
+
+ *cs++ = MI_STORE_DWORD_IMM_GEN4 | MI_USE_GGTT;
+- *cs++ = i915_request_timeline(rq)->hwsp_offset;
++ *cs++ = hwsp_offset(rq);
+ *cs++ = 0;
+ *cs++ = rq->fence.seqno - 1;
+
+@@ -4865,11 +4878,9 @@ gen8_emit_fini_breadcrumb_tail(struct i9
+ return gen8_emit_wa_tail(request, cs);
+ }
+
+-static u32 *emit_xcs_breadcrumb(struct i915_request *request, u32 *cs)
++static u32 *emit_xcs_breadcrumb(struct i915_request *rq, u32 *cs)
+ {
+- u32 addr = i915_request_active_timeline(request)->hwsp_offset;
+-
+- return gen8_emit_ggtt_write(cs, request->fence.seqno, addr, 0);
++ return gen8_emit_ggtt_write(cs, rq->fence.seqno, hwsp_offset(rq), 0);
+ }
+
+ static u32 *gen8_emit_fini_breadcrumb(struct i915_request *rq, u32 *cs)
+@@ -4888,7 +4899,7 @@ static u32 *gen8_emit_fini_breadcrumb_rc
+ /* XXX flush+write+CS_STALL all in one upsets gem_concurrent_blt:kbl */
+ cs = gen8_emit_ggtt_write_rcs(cs,
+ request->fence.seqno,
+- i915_request_active_timeline(request)->hwsp_offset,
++ hwsp_offset(request),
+ PIPE_CONTROL_FLUSH_ENABLE |
+ PIPE_CONTROL_CS_STALL);
+
+@@ -4900,7 +4911,7 @@ gen11_emit_fini_breadcrumb_rcs(struct i9
+ {
+ cs = gen8_emit_ggtt_write_rcs(cs,
+ request->fence.seqno,
+- i915_request_active_timeline(request)->hwsp_offset,
++ hwsp_offset(request),
+ PIPE_CONTROL_CS_STALL |
+ PIPE_CONTROL_TILE_CACHE_FLUSH |
+ PIPE_CONTROL_RENDER_TARGET_CACHE_FLUSH |
+@@ -4970,7 +4981,7 @@ gen12_emit_fini_breadcrumb_rcs(struct i9
+ {
+ cs = gen12_emit_ggtt_write_rcs(cs,
+ request->fence.seqno,
+- i915_request_active_timeline(request)->hwsp_offset,
++ hwsp_offset(request),
+ PIPE_CONTROL0_HDC_PIPELINE_FLUSH,
+ PIPE_CONTROL_CS_STALL |
+ PIPE_CONTROL_TILE_CACHE_FLUSH |
+--- a/drivers/gpu/drm/i915/gt/intel_timeline.c
++++ b/drivers/gpu/drm/i915/gt/intel_timeline.c
+@@ -188,10 +188,14 @@ cacheline_alloc(struct intel_timeline_hw
+ return cl;
+ }
+
+-static void cacheline_acquire(struct intel_timeline_cacheline *cl)
++static void cacheline_acquire(struct intel_timeline_cacheline *cl,
++ u32 ggtt_offset)
+ {
+- if (cl)
+- i915_active_acquire(&cl->active);
++ if (!cl)
++ return;
++
++ cl->ggtt_offset = ggtt_offset;
++ i915_active_acquire(&cl->active);
+ }
+
+ static void cacheline_release(struct intel_timeline_cacheline *cl)
+@@ -332,7 +336,7 @@ int intel_timeline_pin(struct intel_time
+ GT_TRACE(tl->gt, "timeline:%llx using HWSP offset:%x\n",
+ tl->fence_context, tl->hwsp_offset);
+
+- cacheline_acquire(tl->hwsp_cacheline);
++ cacheline_acquire(tl->hwsp_cacheline, tl->hwsp_offset);
+ if (atomic_fetch_inc(&tl->pin_count)) {
+ cacheline_release(tl->hwsp_cacheline);
+ __i915_vma_unpin(tl->hwsp_ggtt);
+@@ -505,7 +509,7 @@ __intel_timeline_get_seqno(struct intel_
+ GT_TRACE(tl->gt, "timeline:%llx using HWSP offset:%x\n",
+ tl->fence_context, tl->hwsp_offset);
+
+- cacheline_acquire(cl);
++ cacheline_acquire(cl, tl->hwsp_offset);
+ tl->hwsp_cacheline = cl;
+
+ *seqno = timeline_advance(tl);
+@@ -563,9 +567,7 @@ int intel_timeline_read_hwsp(struct i915
+ if (err)
+ goto out;
+
+- *hwsp = i915_ggtt_offset(cl->hwsp->vma) +
+- ptr_unmask_bits(cl->vaddr, CACHELINE_BITS) * CACHELINE_BYTES;
+-
++ *hwsp = cl->ggtt_offset;
+ out:
+ i915_active_release(&cl->active);
+ return err;
+--- a/drivers/gpu/drm/i915/gt/intel_timeline_types.h
++++ b/drivers/gpu/drm/i915/gt/intel_timeline_types.h
+@@ -94,6 +94,8 @@ struct intel_timeline_cacheline {
+ struct intel_timeline_hwsp *hwsp;
+ void *vaddr;
+
++ u32 ggtt_offset;
++
+ struct rcu_head rcu;
+ };
+
--- /dev/null
+From 7d2d6d01293e6d9b42a6cb410be4158571f7fe9d Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@collabora.com>
+Date: Sun, 1 Nov 2020 18:40:16 +0100
+Subject: drm/panfrost: Fix a deadlock between the shrinker and madvise path
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+commit 7d2d6d01293e6d9b42a6cb410be4158571f7fe9d upstream.
+
+panfrost_ioctl_madvise() and panfrost_gem_purge() acquire the mappings
+and shmem locks in different orders, thus leading to a potential
+the mappings lock first.
+
+Fixes: bdefca2d8dc0 ("drm/panfrost: Add the panfrost_gem_mapping concept")
+Cc: <stable@vger.kernel.org>
+Cc: Christian Hewitt <christianshewitt@gmail.com>
+Reported-by: Christian Hewitt <christianshewitt@gmail.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201101174016.839110-1-boris.brezillon@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/panfrost/panfrost_gem.c | 4 +---
+ drivers/gpu/drm/panfrost/panfrost_gem.h | 2 +-
+ drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c | 14 +++++++++++---
+ 3 files changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/panfrost/panfrost_gem.c
++++ b/drivers/gpu/drm/panfrost/panfrost_gem.c
+@@ -105,14 +105,12 @@ void panfrost_gem_mapping_put(struct pan
+ kref_put(&mapping->refcount, panfrost_gem_mapping_release);
+ }
+
+-void panfrost_gem_teardown_mappings(struct panfrost_gem_object *bo)
++void panfrost_gem_teardown_mappings_locked(struct panfrost_gem_object *bo)
+ {
+ struct panfrost_gem_mapping *mapping;
+
+- mutex_lock(&bo->mappings.lock);
+ list_for_each_entry(mapping, &bo->mappings.list, node)
+ panfrost_gem_teardown_mapping(mapping);
+- mutex_unlock(&bo->mappings.lock);
+ }
+
+ int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv)
+--- a/drivers/gpu/drm/panfrost/panfrost_gem.h
++++ b/drivers/gpu/drm/panfrost/panfrost_gem.h
+@@ -82,7 +82,7 @@ struct panfrost_gem_mapping *
+ panfrost_gem_mapping_get(struct panfrost_gem_object *bo,
+ struct panfrost_file_priv *priv);
+ void panfrost_gem_mapping_put(struct panfrost_gem_mapping *mapping);
+-void panfrost_gem_teardown_mappings(struct panfrost_gem_object *bo);
++void panfrost_gem_teardown_mappings_locked(struct panfrost_gem_object *bo);
+
+ void panfrost_gem_shrinker_init(struct drm_device *dev);
+ void panfrost_gem_shrinker_cleanup(struct drm_device *dev);
+--- a/drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c
++++ b/drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c
+@@ -40,18 +40,26 @@ static bool panfrost_gem_purge(struct dr
+ {
+ struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj);
+ struct panfrost_gem_object *bo = to_panfrost_bo(obj);
++ bool ret = false;
+
+ if (atomic_read(&bo->gpu_usecount))
+ return false;
+
+- if (!mutex_trylock(&shmem->pages_lock))
++ if (!mutex_trylock(&bo->mappings.lock))
+ return false;
+
+- panfrost_gem_teardown_mappings(bo);
++ if (!mutex_trylock(&shmem->pages_lock))
++ goto unlock_mappings;
++
++ panfrost_gem_teardown_mappings_locked(bo);
+ drm_gem_shmem_purge_locked(obj);
++ ret = true;
+
+ mutex_unlock(&shmem->pages_lock);
+- return true;
++
++unlock_mappings:
++ mutex_unlock(&bo->mappings.lock);
++ return ret;
+ }
+
+ static unsigned long
--- /dev/null
+From 9a472ef7a3690ac0b77ebfb04c88fa795de2adea Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Thu, 5 Nov 2020 22:31:37 +0000
+Subject: io_uring: fix link lookup racing with link timeout
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit 9a472ef7a3690ac0b77ebfb04c88fa795de2adea upstream.
+
+We can't just go over linked requests because it may race with linked
+timeouts. Take ctx->completion_lock in that case.
+
+Cc: stable@vger.kernel.org # v5.7+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/io_uring.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -8176,7 +8176,21 @@ static bool io_timeout_remove_link(struc
+
+ static bool io_cancel_link_cb(struct io_wq_work *work, void *data)
+ {
+- return io_match_link(container_of(work, struct io_kiocb, work), data);
++ struct io_kiocb *req = container_of(work, struct io_kiocb, work);
++ bool ret;
++
++ if (req->flags & REQ_F_LINK_TIMEOUT) {
++ unsigned long flags;
++ struct io_ring_ctx *ctx = req->ctx;
++
++ /* protect against races with linked timeouts */
++ spin_lock_irqsave(&ctx->completion_lock, flags);
++ ret = io_match_link(req, data);
++ spin_unlock_irqrestore(&ctx->completion_lock, flags);
++ } else {
++ ret = io_match_link(req, data);
++ }
++ return ret;
+ }
+
+ static void io_attempt_cancel(struct io_ring_ctx *ctx, struct io_kiocb *req)
--- /dev/null
+From 804fc6a2931e692f50e8e317fcb0c8887331b405 Mon Sep 17 00:00:00 2001
+From: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
+Date: Mon, 19 Oct 2020 20:01:13 +0400
+Subject: mac80211: fix regression where EAPOL frames were sent in plaintext
+
+From: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
+
+commit 804fc6a2931e692f50e8e317fcb0c8887331b405 upstream.
+
+When sending EAPOL frames via NL80211 they are treated as injected
+frames in mac80211. Due to commit 1df2bdba528b ("mac80211: never drop
+injected frames even if normally not allowed") these injected frames
+were not assigned a sta context in the function ieee80211_tx_dequeue,
+causing certain wireless network cards to always send EAPOL frames in
+plaintext. This may cause compatibility issues with some clients or
+APs, which for instance can cause the group key handshake to fail and
+in turn would cause the station to get disconnected.
+
+This commit fixes this regression by assigning a sta context in
+ieee80211_tx_dequeue to injected frames as well.
+
+Note that sending EAPOL frames in plaintext is not a security issue
+since they contain their own encryption and authentication protection.
+
+Cc: stable@vger.kernel.org
+Fixes: 1df2bdba528b ("mac80211: never drop injected frames even if normally not allowed")
+Reported-by: Thomas Deutschmann <whissi@gentoo.org>
+Tested-by: Christian Hesse <list@eworm.de>
+Tested-by: Thomas Deutschmann <whissi@gentoo.org>
+Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
+Link: https://lore.kernel.org/r/20201019160113.350912-1-Mathy.Vanhoef@kuleuven.be
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/tx.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3613,13 +3613,14 @@ begin:
+ tx.skb = skb;
+ tx.sdata = vif_to_sdata(info->control.vif);
+
+- if (txq->sta && !(info->flags & IEEE80211_TX_CTL_INJECTED)) {
++ if (txq->sta) {
+ tx.sta = container_of(txq->sta, struct sta_info, sta);
+ /*
+ * Drop unicast frames to unauthorised stations unless they are
+- * EAPOL frames from the local station.
++ * injected frames or EAPOL frames from the local station.
+ */
+- if (unlikely(ieee80211_is_data(hdr->frame_control) &&
++ if (unlikely(!(info->flags & IEEE80211_TX_CTL_INJECTED) &&
++ ieee80211_is_data(hdr->frame_control) &&
+ !ieee80211_vif_is_mesh(&tx.sdata->vif) &&
+ tx.sdata->vif.type != NL80211_IFTYPE_OCB &&
+ !is_multicast_ether_addr(hdr->addr1) &&
--- /dev/null
+From d6e36668598154820177bfd78c1621d8e6c580a2 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Wed, 21 Oct 2020 21:13:10 +0200
+Subject: PM: runtime: Drop pm_runtime_clean_up_links()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit d6e36668598154820177bfd78c1621d8e6c580a2 upstream.
+
+After commit d12544fb2aa9 ("PM: runtime: Remove link state checks in
+rpm_get/put_supplier()") nothing prevents the consumer device's
+runtime PM from acquiring additional references to the supplier
+device after pm_runtime_clean_up_links() has run (or even while it
+is running), so calling this function from __device_release_driver()
+may be pointless (or even harmful).
+
+Moreover, it ignores stateless device links, so the runtime PM
+handling of managed and stateless device links is inconsistent
+because of it, so better get rid of it entirely.
+
+Fixes: d12544fb2aa9 ("PM: runtime: Remove link state checks in rpm_get/put_supplier()")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: 5.1+ <stable@vger.kernel.org> # 5.1+
+Tested-by: Xiang Chen <chenxiang66@hisilicon.com>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/dd.c | 1 -
+ drivers/base/power/runtime.c | 36 ------------------------------------
+ include/linux/pm_runtime.h | 2 --
+ 3 files changed, 39 deletions(-)
+
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -1133,7 +1133,6 @@ static void __device_release_driver(stru
+ }
+
+ pm_runtime_get_sync(dev);
+- pm_runtime_clean_up_links(dev);
+
+ driver_sysfs_remove(dev);
+
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1643,42 +1643,6 @@ void pm_runtime_remove(struct device *de
+ }
+
+ /**
+- * pm_runtime_clean_up_links - Prepare links to consumers for driver removal.
+- * @dev: Device whose driver is going to be removed.
+- *
+- * Check links from this device to any consumers and if any of them have active
+- * runtime PM references to the device, drop the usage counter of the device
+- * (as many times as needed).
+- *
+- * Links with the DL_FLAG_MANAGED flag unset are ignored.
+- *
+- * Since the device is guaranteed to be runtime-active at the point this is
+- * called, nothing else needs to be done here.
+- *
+- * Moreover, this is called after device_links_busy() has returned 'false', so
+- * the status of each link is guaranteed to be DL_STATE_SUPPLIER_UNBIND and
+- * therefore rpm_active can't be manipulated concurrently.
+- */
+-void pm_runtime_clean_up_links(struct device *dev)
+-{
+- struct device_link *link;
+- int idx;
+-
+- idx = device_links_read_lock();
+-
+- list_for_each_entry_rcu(link, &dev->links.consumers, s_node,
+- device_links_read_lock_held()) {
+- if (!(link->flags & DL_FLAG_MANAGED))
+- continue;
+-
+- while (refcount_dec_not_one(&link->rpm_active))
+- pm_runtime_put_noidle(dev);
+- }
+-
+- device_links_read_unlock(idx);
+-}
+-
+-/**
+ * pm_runtime_get_suppliers - Resume and reference-count supplier devices.
+ * @dev: Consumer device.
+ */
+--- a/include/linux/pm_runtime.h
++++ b/include/linux/pm_runtime.h
+@@ -54,7 +54,6 @@ extern u64 pm_runtime_autosuspend_expira
+ extern void pm_runtime_update_max_time_suspended(struct device *dev,
+ s64 delta_ns);
+ extern void pm_runtime_set_memalloc_noio(struct device *dev, bool enable);
+-extern void pm_runtime_clean_up_links(struct device *dev);
+ extern void pm_runtime_get_suppliers(struct device *dev);
+ extern void pm_runtime_put_suppliers(struct device *dev);
+ extern void pm_runtime_new_link(struct device *dev);
+@@ -276,7 +275,6 @@ static inline u64 pm_runtime_autosuspend
+ struct device *dev) { return 0; }
+ static inline void pm_runtime_set_memalloc_noio(struct device *dev,
+ bool enable){}
+-static inline void pm_runtime_clean_up_links(struct device *dev) {}
+ static inline void pm_runtime_get_suppliers(struct device *dev) {}
+ static inline void pm_runtime_put_suppliers(struct device *dev) {}
+ static inline void pm_runtime_new_link(struct device *dev) {}
--- /dev/null
+From e0e398e204634db8fb71bd89cf2f6e3e5bd09b51 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Wed, 21 Oct 2020 21:12:15 +0200
+Subject: PM: runtime: Drop runtime PM references to supplier on link removal
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit e0e398e204634db8fb71bd89cf2f6e3e5bd09b51 upstream.
+
+While removing a device link, drop the supplier device's runtime PM
+usage counter as many times as needed to drop all of the runtime PM
+references to it from the consumer in addition to dropping the
+consumer's link count.
+
+Fixes: baa8809f6097 ("PM / runtime: Optimize the use of device links")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: 5.1+ <stable@vger.kernel.org> # 5.1+
+Tested-by: Xiang Chen <chenxiang66@hisilicon.com>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/core.c | 6 ++----
+ drivers/base/power/runtime.c | 21 ++++++++++++++++++++-
+ include/linux/pm_runtime.h | 4 ++--
+ 3 files changed, 24 insertions(+), 7 deletions(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -763,8 +763,7 @@ static void __device_link_del(struct kre
+ dev_dbg(link->consumer, "Dropping the link to %s\n",
+ dev_name(link->supplier));
+
+- if (link->flags & DL_FLAG_PM_RUNTIME)
+- pm_runtime_drop_link(link->consumer);
++ pm_runtime_drop_link(link);
+
+ list_del_rcu(&link->s_node);
+ list_del_rcu(&link->c_node);
+@@ -778,8 +777,7 @@ static void __device_link_del(struct kre
+ dev_info(link->consumer, "Dropping the link to %s\n",
+ dev_name(link->supplier));
+
+- if (link->flags & DL_FLAG_PM_RUNTIME)
+- pm_runtime_drop_link(link->consumer);
++ pm_runtime_drop_link(link);
+
+ list_del(&link->s_node);
+ list_del(&link->c_node);
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1729,7 +1729,7 @@ void pm_runtime_new_link(struct device *
+ spin_unlock_irq(&dev->power.lock);
+ }
+
+-void pm_runtime_drop_link(struct device *dev)
++static void pm_runtime_drop_link_count(struct device *dev)
+ {
+ spin_lock_irq(&dev->power.lock);
+ WARN_ON(dev->power.links_count == 0);
+@@ -1737,6 +1737,25 @@ void pm_runtime_drop_link(struct device
+ spin_unlock_irq(&dev->power.lock);
+ }
+
++/**
++ * pm_runtime_drop_link - Prepare for device link removal.
++ * @link: Device link going away.
++ *
++ * Drop the link count of the consumer end of @link and decrement the supplier
++ * device's runtime PM usage counter as many times as needed to drop all of the
++ * PM runtime reference to it from the consumer.
++ */
++void pm_runtime_drop_link(struct device_link *link)
++{
++ if (!(link->flags & DL_FLAG_PM_RUNTIME))
++ return;
++
++ pm_runtime_drop_link_count(link->consumer);
++
++ while (refcount_dec_not_one(&link->rpm_active))
++ pm_runtime_put(link->supplier);
++}
++
+ static bool pm_runtime_need_not_resume(struct device *dev)
+ {
+ return atomic_read(&dev->power.usage_count) <= 1 &&
+--- a/include/linux/pm_runtime.h
++++ b/include/linux/pm_runtime.h
+@@ -58,7 +58,7 @@ extern void pm_runtime_clean_up_links(st
+ extern void pm_runtime_get_suppliers(struct device *dev);
+ extern void pm_runtime_put_suppliers(struct device *dev);
+ extern void pm_runtime_new_link(struct device *dev);
+-extern void pm_runtime_drop_link(struct device *dev);
++extern void pm_runtime_drop_link(struct device_link *link);
+
+ /**
+ * pm_runtime_get_if_in_use - Conditionally bump up runtime PM usage counter.
+@@ -280,7 +280,7 @@ static inline void pm_runtime_clean_up_l
+ static inline void pm_runtime_get_suppliers(struct device *dev) {}
+ static inline void pm_runtime_put_suppliers(struct device *dev) {}
+ static inline void pm_runtime_new_link(struct device *dev) {}
+-static inline void pm_runtime_drop_link(struct device *dev) {}
++static inline void pm_runtime_drop_link(struct device_link *link) {}
+
+ #endif /* !CONFIG_PM */
+
--- /dev/null
+From 9226c504e364158a17a68ff1fe9d67d266922f50 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 22 Oct 2020 17:38:22 +0200
+Subject: PM: runtime: Resume the device earlier in __device_release_driver()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 9226c504e364158a17a68ff1fe9d67d266922f50 upstream.
+
+Since the device is resumed from runtime-suspend in
+__device_release_driver() anyway, it is better to do that before
+looking for busy managed device links from it to consumers, because
+if there are any, device_links_unbind_consumers() will be called
+and it will cause the consumer devices' drivers to unbind, so the
+consumer devices will be runtime-resumed. In turn, resuming each
+consumer device will cause the supplier to be resumed and when the
+runtime PM references from the given consumer to it are dropped, it
+may be suspended. Then, the runtime-resume of the next consumer
+will cause the supplier to resume again and so on.
+
+Update the code accordingly.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support")
+Cc: All applicable <stable@vger.kernel.org> # All applicable
+Tested-by: Xiang Chen <chenxiang66@hisilicon.com>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/dd.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -1117,6 +1117,8 @@ static void __device_release_driver(stru
+
+ drv = dev->driver;
+ if (drv) {
++ pm_runtime_get_sync(dev);
++
+ while (device_links_busy(dev)) {
+ __device_driver_unlock(dev, parent);
+
+@@ -1128,12 +1130,12 @@ static void __device_release_driver(stru
+ * have released the driver successfully while this one
+ * was waiting, so check for that.
+ */
+- if (dev->driver != drv)
++ if (dev->driver != drv) {
++ pm_runtime_put(dev);
+ return;
++ }
+ }
+
+- pm_runtime_get_sync(dev);
+-
+ driver_sysfs_remove(dev);
+
+ if (dev->bus)
usb-serial-option-add-quectel-ec200t-module-support.patch
usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch
usb-serial-option-add-telit-fn980-composition-0x1055.patch
+usb-dwc3-ep0-fix-delay-status-handling.patch
+usb-add-no_lpm-quirk-for-kingston-flash-drive.patch
+usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch
+io_uring-fix-link-lookup-racing-with-link-timeout.patch
+mac80211-fix-regression-where-eapol-frames-were-sent-in-plaintext.patch
+drm-panfrost-fix-a-deadlock-between-the-shrinker-and-madvise-path.patch
+arc-stack-unwinding-avoid-indefinite-looping.patch
+pm-runtime-drop-runtime-pm-references-to-supplier-on-link-removal.patch
+pm-runtime-drop-pm_runtime_clean_up_links.patch
+pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch
+drm-i915-fix-encoder-lookup-during-psr-atomic-check.patch
+drm-i915-gt-use-the-local-hwsp-offset-during-submission.patch
--- /dev/null
+From afaa2e745a246c5ab95103a65b1ed00101e1bc63 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 2 Nov 2020 09:58:21 -0500
+Subject: USB: Add NO_LPM quirk for Kingston flash drive
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit afaa2e745a246c5ab95103a65b1ed00101e1bc63 upstream.
+
+In Bugzilla #208257, Julien Humbert reports that a 32-GB Kingston
+flash drive spontaneously disconnects and reconnects, over and over.
+Testing revealed that disabling Link Power Management for the drive
+fixed the problem.
+
+This patch adds a quirk entry for that drive to turn off LPM permanently.
+
+CC: Hans de Goede <jwrdegoede@fedoraproject.org>
+CC: <stable@vger.kernel.org>
+Reported-and-tested-by: Julien Humbert <julroy67@gmail.com>
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20201102145821.GA1478741@rowland.harvard.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -378,6 +378,9 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x0926, 0x3333), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
++ /* Kingston DataTraveler 3.0 */
++ { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
+ { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
+
--- /dev/null
+From fa27e2f6c5e674f3f1225f9ca7a7821faaf393bb Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Thu, 22 Oct 2020 15:44:59 -0700
+Subject: usb: dwc3: ep0: Fix delay status handling
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit fa27e2f6c5e674f3f1225f9ca7a7821faaf393bb upstream.
+
+If we want to send a control status on our own time (through
+delayed_status), make sure to handle a case where we may queue the
+delayed status before the host requesting for it (when XferNotReady
+is generated). Otherwise, the driver won't send anything because it's
+not EP0_STATUS_PHASE yet. To resolve this, regardless whether
+dwc->ep0state is EP0_STATUS_PHASE, make sure to clear the
+dwc->delayed_status flag if dwc3_ep0_send_delayed_status() is called.
+The control status can be sent when the host requests it later.
+
+Cc: <stable@vger.kernel.org>
+Fixes: d97c78a1908e ("usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command")
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/ep0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -1058,10 +1058,11 @@ void dwc3_ep0_send_delayed_status(struct
+ {
+ unsigned int direction = !dwc->ep0_expect_in;
+
++ dwc->delayed_status = false;
++
+ if (dwc->ep0state != EP0_STATUS_PHASE)
+ return;
+
+- dwc->delayed_status = false;
+ __dwc3_ep0_do_control_status(dwc, dwc->eps[direction]);
+ }
+
--- /dev/null
+From 20914919ad31849ee2b9cfe0428f4a20335c9e2a Mon Sep 17 00:00:00 2001
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+Date: Fri, 6 Nov 2020 13:54:29 +0800
+Subject: usb: mtu3: fix panic in mtu3_gadget_stop()
+
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+
+commit 20914919ad31849ee2b9cfe0428f4a20335c9e2a upstream.
+
+This patch fixes a possible issue when mtu3_gadget_stop()
+already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect().
+
+[<ffffff9008161974>] notifier_call_chain+0xa4/0x128
+[<ffffff9008161fd4>] __atomic_notifier_call_chain+0x84/0x138
+[<ffffff9008162ec0>] notify_die+0xb0/0x120
+[<ffffff900809e340>] die+0x1f8/0x5d0
+[<ffffff90080d03b4>] __do_kernel_fault+0x19c/0x280
+[<ffffff90080d04dc>] do_bad_area+0x44/0x140
+[<ffffff90080d0f9c>] do_translation_fault+0x4c/0x90
+[<ffffff9008080a78>] do_mem_abort+0xb8/0x258
+[<ffffff90080849d0>] el1_da+0x24/0x3c
+[<ffffff9009bde01c>] mtu3_gadget_disconnect+0xac/0x128
+[<ffffff9009bd576c>] mtu3_irq+0x34c/0xc18
+[<ffffff90082ac03c>] __handle_irq_event_percpu+0x2ac/0xcd0
+[<ffffff90082acae0>] handle_irq_event_percpu+0x80/0x138
+[<ffffff90082acc44>] handle_irq_event+0xac/0x148
+[<ffffff90082b71cc>] handle_fasteoi_irq+0x234/0x568
+[<ffffff90082a8708>] generic_handle_irq+0x48/0x68
+[<ffffff90082a96ac>] __handle_domain_irq+0x264/0x1740
+[<ffffff90080819f4>] gic_handle_irq+0x14c/0x250
+[<ffffff9008084cec>] el1_irq+0xec/0x194
+[<ffffff90085b985c>] dma_pool_alloc+0x6e4/0xae0
+[<ffffff9008d7f890>] cmdq_mbox_pool_alloc_impl+0xb0/0x238
+[<ffffff9008d80904>] cmdq_pkt_alloc_buf+0x2dc/0x7c0
+[<ffffff9008d80f60>] cmdq_pkt_add_cmd_buffer+0x178/0x270
+[<ffffff9008d82320>] cmdq_pkt_perf_begin+0x108/0x148
+[<ffffff9008d824d8>] cmdq_pkt_create+0x178/0x1f0
+[<ffffff9008f96230>] mtk_crtc_config_default_path+0x328/0x7a0
+[<ffffff90090246cc>] mtk_drm_idlemgr_kick+0xa6c/0x1460
+[<ffffff9008f9bbb4>] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68
+[<ffffff9008e8df9c>] drm_atomic_helper_commit_planes+0x154/0x878
+[<ffffff9008f2fb70>] mtk_atomic_complete.isra.16+0xe80/0x19c8
+[<ffffff9008f30910>] mtk_atomic_commit+0x258/0x898
+[<ffffff9008ef142c>] drm_atomic_commit+0xcc/0x108
+[<ffffff9008ef7cf0>] drm_mode_atomic_ioctl+0x1c20/0x2580
+[<ffffff9008ebc768>] drm_ioctl_kernel+0x118/0x1b0
+[<ffffff9008ebcde8>] drm_ioctl+0x5c0/0x920
+[<ffffff900863b030>] do_vfs_ioctl+0x188/0x1820
+[<ffffff900863c754>] SyS_ioctl+0x8c/0xa0
+
+Fixes: df2069acb005 ("usb: Add MediaTek USB3 DRD driver")
+Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Acked-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/1604642069-20961-1-git-send-email-macpaul.lin@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/mtu3/mtu3_gadget.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/mtu3/mtu3_gadget.c
++++ b/drivers/usb/mtu3/mtu3_gadget.c
+@@ -564,6 +564,7 @@ static int mtu3_gadget_stop(struct usb_g
+
+ spin_unlock_irqrestore(&mtu->lock, flags);
+
++ synchronize_irq(mtu->irq);
+ return 0;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
