--- /dev/null
+From f902b216501094495ff75834035656e8119c537f Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 18 Nov 2020 16:30:32 +0100
+Subject: ext4: fix bogus warning in ext4_update_dx_flag()
+
+From: Jan Kara <jack@suse.cz>
+
+commit f902b216501094495ff75834035656e8119c537f upstream.
+
+The idea of the warning in ext4_update_dx_flag() is that we should warn
+when we are clearing EXT4_INODE_INDEX on a filesystem with metadata
+checksums enabled since after clearing the flag, checksums for internal
+htree nodes will become invalid. So there's no need to warn (or actually
+do anything) when EXT4_INODE_INDEX is not set.
+
+Link: https://lore.kernel.org/r/20201118153032.17281-1-jack@suse.cz
+Fixes: 48a34311953d ("ext4: fix checksum errors with indexed dirs")
+Reported-by: Eric Biggers <ebiggers@kernel.org>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/ext4.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -2496,7 +2496,8 @@ void ext4_insert_dentry(struct inode *in
+ struct ext4_filename *fname);
+ static inline void ext4_update_dx_flag(struct inode *inode)
+ {
+- if (!ext4_has_feature_dir_index(inode->i_sb)) {
++ if (!ext4_has_feature_dir_index(inode->i_sb) &&
++ ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) {
+ /* ext4_iget() should have caught this... */
+ WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb));
+ ext4_clear_inode_flag(inode, EXT4_INODE_INDEX);
--- /dev/null
+From e5b1032a656e9aa4c7a4df77cb9156a2a651a5f9 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 10 Nov 2020 14:38:35 +0100
+Subject: iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit e5b1032a656e9aa4c7a4df77cb9156a2a651a5f9 upstream.
+
+Some 360 degree hinges (yoga) style 2-in-1 devices use 2 KXCJ91008-s
+to allow the OS to determine the angle between the display and the base
+of the device, so that the OS can determine if the 2-in-1 is in laptop
+or in tablet-mode.
+
+On Windows both accelerometers are read by a special HingeAngleService
+process; and this process calls a DSM (Device Specific Method) on the
+ACPI KIOX010A device node for the sensor in the display, to let the
+embedded-controller (EC) know about the mode so that it can disable the
+kbd and touchpad to avoid spurious input while folded into tablet-mode.
+
+This notifying of the EC is problematic because sometimes the EC comes up
+thinking that device is in tablet-mode and the kbd and touchpad do not
+work. This happens for example on Irbis NB111 devices after a suspend /
+resume cycle (after a complete battery drain / hard reset without having
+booted Windows at least once). Other 2-in-1s which are likely affected
+too are e.g. the Teclast F5 and F6 series.
+
+The kxcjk-1013 driver may seem like a strange place to deal with this,
+but since it is *the* driver for the ACPI KIOX010A device, it is also
+the driver which has access to the ACPI handle needed by the DSM.
+
+Add support for calling the DSM and on probe unconditionally tell the
+EC that the device is laptop mode, fixing the kbd and touchpad sometimes
+not working.
+
+Fixes: 7f6232e69539 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID")
+Reported-and-tested-by: russianneuromancer <russianneuromancer@ya.ru>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201110133835.129080-3-hdegoede@redhat.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/kxcjk-1013.c | 36 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/iio/accel/kxcjk-1013.c
++++ b/drivers/iio/accel/kxcjk-1013.c
+@@ -129,6 +129,7 @@ enum kx_chipset {
+ enum kx_acpi_type {
+ ACPI_GENERIC,
+ ACPI_SMO8500,
++ ACPI_KIOX010A,
+ };
+
+ struct kxcjk1013_data {
+@@ -274,6 +275,32 @@ static const struct {
+ {19163, 1, 0},
+ {38326, 0, 1} };
+
++#ifdef CONFIG_ACPI
++enum kiox010a_fn_index {
++ KIOX010A_SET_LAPTOP_MODE = 1,
++ KIOX010A_SET_TABLET_MODE = 2,
++};
++
++static int kiox010a_dsm(struct device *dev, int fn_index)
++{
++ acpi_handle handle = ACPI_HANDLE(dev);
++ guid_t kiox010a_dsm_guid;
++ union acpi_object *obj;
++
++ if (!handle)
++ return -ENODEV;
++
++ guid_parse("1f339696-d475-4e26-8cad-2e9f8e6d7a91", &kiox010a_dsm_guid);
++
++ obj = acpi_evaluate_dsm(handle, &kiox010a_dsm_guid, 1, fn_index, NULL);
++ if (!obj)
++ return -EIO;
++
++ ACPI_FREE(obj);
++ return 0;
++}
++#endif
++
+ static int kxcjk1013_set_mode(struct kxcjk1013_data *data,
+ enum kxcjk1013_mode mode)
+ {
+@@ -351,6 +378,13 @@ static int kxcjk1013_chip_init(struct kx
+ {
+ int ret;
+
++#ifdef CONFIG_ACPI
++ if (data->acpi_type == ACPI_KIOX010A) {
++ /* Make sure the kbd and touchpad on 2-in-1s using 2 KXCJ91008-s work */
++ kiox010a_dsm(&data->client->dev, KIOX010A_SET_LAPTOP_MODE);
++ }
++#endif
++
+ ret = i2c_smbus_read_byte_data(data->client, KXCJK1013_REG_WHO_AM_I);
+ if (ret < 0) {
+ dev_err(&data->client->dev, "Error reading who_am_i\n");
+@@ -1248,6 +1282,8 @@ static const char *kxcjk1013_match_acpi_
+
+ if (strcmp(id->id, "SMO8500") == 0)
+ *acpi_type = ACPI_SMO8500;
++ else if (strcmp(id->id, "KIOX010A") == 0)
++ *acpi_type = ACPI_KIOX010A;
+
+ *chipset = (enum kx_chipset)id->driver_data;
+
--- /dev/null
+From 11e94f28c3de35d5ad1ac6a242a5b30f4378991a Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 10 Nov 2020 14:38:34 +0100
+Subject: iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 11e94f28c3de35d5ad1ac6a242a5b30f4378991a upstream.
+
+Replace the boolean is_smo8500_device variable with an acpi_type enum.
+
+For now this can be either ACPI_GENERIC or ACPI_SMO8500, this is a
+preparation patch for adding special handling for the KIOX010A ACPI HID,
+which will add a ACPI_KIOX010A acpi_type to the introduced enum.
+
+For stable as needed as precursor for next patch.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Fixes: 7f6232e69539 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID")
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201110133835.129080-2-hdegoede@redhat.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/kxcjk-1013.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/iio/accel/kxcjk-1013.c
++++ b/drivers/iio/accel/kxcjk-1013.c
+@@ -126,6 +126,11 @@ enum kx_chipset {
+ KX_MAX_CHIPS /* this must be last */
+ };
+
++enum kx_acpi_type {
++ ACPI_GENERIC,
++ ACPI_SMO8500,
++};
++
+ struct kxcjk1013_data {
+ struct i2c_client *client;
+ struct iio_trigger *dready_trig;
+@@ -142,7 +147,7 @@ struct kxcjk1013_data {
+ bool motion_trigger_on;
+ int64_t timestamp;
+ enum kx_chipset chipset;
+- bool is_smo8500_device;
++ enum kx_acpi_type acpi_type;
+ };
+
+ enum kxcjk1013_axis {
+@@ -1233,7 +1238,7 @@ static irqreturn_t kxcjk1013_data_rdy_tr
+
+ static const char *kxcjk1013_match_acpi_device(struct device *dev,
+ enum kx_chipset *chipset,
+- bool *is_smo8500_device)
++ enum kx_acpi_type *acpi_type)
+ {
+ const struct acpi_device_id *id;
+
+@@ -1242,7 +1247,7 @@ static const char *kxcjk1013_match_acpi_
+ return NULL;
+
+ if (strcmp(id->id, "SMO8500") == 0)
+- *is_smo8500_device = true;
++ *acpi_type = ACPI_SMO8500;
+
+ *chipset = (enum kx_chipset)id->driver_data;
+
+@@ -1278,7 +1283,7 @@ static int kxcjk1013_probe(struct i2c_cl
+ } else if (ACPI_HANDLE(&client->dev)) {
+ name = kxcjk1013_match_acpi_device(&client->dev,
+ &data->chipset,
+- &data->is_smo8500_device);
++ &data->acpi_type);
+ } else
+ return -ENODEV;
+
+@@ -1296,7 +1301,7 @@ static int kxcjk1013_probe(struct i2c_cl
+ indio_dev->modes = INDIO_DIRECT_MODE;
+ indio_dev->info = &kxcjk1013_info;
+
+- if (client->irq > 0 && !data->is_smo8500_device) {
++ if (client->irq > 0 && data->acpi_type != ACPI_SMO8500) {
+ ret = devm_request_threaded_irq(&client->dev, client->irq,
+ kxcjk1013_data_rdy_trig_poll,
+ kxcjk1013_event_handler,
--- /dev/null
+From 15207a92e019803d62687455d8aa2ff9eb3dc82c Mon Sep 17 00:00:00 2001
+From: Fabien Parent <fparent@baylibre.com>
+Date: Sun, 18 Oct 2020 21:46:44 +0200
+Subject: iio: adc: mediatek: fix unset field
+
+From: Fabien Parent <fparent@baylibre.com>
+
+commit 15207a92e019803d62687455d8aa2ff9eb3dc82c upstream.
+
+dev_comp field is used in a couple of places but it is never set. This
+results in kernel oops when dereferencing a NULL pointer. Set the
+`dev_comp` field correctly in the probe function.
+
+Fixes: 6d97024dce23 ("iio: adc: mediatek: mt6577-auxadc, add mt6765 support")
+Signed-off-by: Fabien Parent <fparent@baylibre.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201018194644.3366846-1-fparent@baylibre.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/mt6577_auxadc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/adc/mt6577_auxadc.c
++++ b/drivers/iio/adc/mt6577_auxadc.c
+@@ -9,9 +9,9 @@
+ #include <linux/err.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+-#include <linux/of.h>
+-#include <linux/of_device.h>
++#include <linux/mod_devicetable.h>
+ #include <linux/platform_device.h>
++#include <linux/property.h>
+ #include <linux/iopoll.h>
+ #include <linux/io.h>
+ #include <linux/iio/iio.h>
+@@ -279,6 +279,8 @@ static int mt6577_auxadc_probe(struct pl
+ goto err_disable_clk;
+ }
+
++ adc_dev->dev_comp = device_get_match_data(&pdev->dev);
++
+ mutex_init(&adc_dev->lock);
+
+ mt6577_auxadc_mod_reg(adc_dev->reg_base + MT6577_AUXADC_MISC,
--- /dev/null
+From 4b639e254d3d4f15ee4ff2b890a447204cfbeea9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Fri, 13 Nov 2020 01:20:28 +0100
+Subject: regulator: avoid resolve_supply() infinite recursion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit 4b639e254d3d4f15ee4ff2b890a447204cfbeea9 upstream.
+
+When a regulator's name equals its supply's name the
+regulator_resolve_supply() recurses indefinitely. Add a check
+so that debugging the problem is easier. The "fixed" commit
+just exposed the problem.
+
+Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator")
+Cc: stable@vger.kernel.org
+Reported-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de> # stpmic1
+Link: https://lore.kernel.org/r/c6171057cfc0896f950c4d8cb82df0f9f1b89ad9.1605226675.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1800,6 +1800,12 @@ static int regulator_resolve_supply(stru
+ }
+ }
+
++ if (r == rdev) {
++ dev_err(dev, "Supply for %s (%s) resolved to itself\n",
++ rdev->desc->name, rdev->supply_name);
++ return -EINVAL;
++ }
++
+ /*
+ * If the supply's parent device is not the same as the
+ * regulator's parent device, then ensure the parent device
--- /dev/null
+From 57a6ad482af256b2a13de14194fb8f67c1a65f10 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Fri, 13 Nov 2020 01:20:27 +0100
+Subject: regulator: fix memory leak with repeated set_machine_constraints()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit 57a6ad482af256b2a13de14194fb8f67c1a65f10 upstream.
+
+Fixed commit introduced a possible second call to
+set_machine_constraints() and that allocates memory for
+rdev->constraints. Move the allocation to the caller so
+it's easier to manage and done once.
+
+Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator")
+Cc: stable@vger.kernel.org
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de> # stpmic1
+Link: https://lore.kernel.org/r/78c3d4016cebc08d441aad18cb924b4e4d9cf9df.1605226675.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 29 +++++++++++++----------------
+ 1 file changed, 13 insertions(+), 16 deletions(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1275,7 +1275,6 @@ static int _regulator_do_enable(struct r
+ /**
+ * set_machine_constraints - sets regulator constraints
+ * @rdev: regulator source
+- * @constraints: constraints to apply
+ *
+ * Allows platform initialisation code to define and constrain
+ * regulator circuits e.g. valid voltage/current ranges, etc. NOTE:
+@@ -1283,21 +1282,11 @@ static int _regulator_do_enable(struct r
+ * regulator operations to proceed i.e. set_voltage, set_current_limit,
+ * set_mode.
+ */
+-static int set_machine_constraints(struct regulator_dev *rdev,
+- const struct regulation_constraints *constraints)
++static int set_machine_constraints(struct regulator_dev *rdev)
+ {
+ int ret = 0;
+ const struct regulator_ops *ops = rdev->desc->ops;
+
+- if (constraints)
+- rdev->constraints = kmemdup(constraints, sizeof(*constraints),
+- GFP_KERNEL);
+- else
+- rdev->constraints = kzalloc(sizeof(*constraints),
+- GFP_KERNEL);
+- if (!rdev->constraints)
+- return -ENOMEM;
+-
+ ret = machine_constraints_voltage(rdev, rdev->constraints);
+ if (ret != 0)
+ return ret;
+@@ -5014,7 +5003,6 @@ struct regulator_dev *
+ regulator_register(const struct regulator_desc *regulator_desc,
+ const struct regulator_config *cfg)
+ {
+- const struct regulation_constraints *constraints = NULL;
+ const struct regulator_init_data *init_data;
+ struct regulator_config *config = NULL;
+ static atomic_t regulator_no = ATOMIC_INIT(-1);
+@@ -5153,14 +5141,23 @@ regulator_register(const struct regulato
+
+ /* set regulator constraints */
+ if (init_data)
+- constraints = &init_data->constraints;
++ rdev->constraints = kmemdup(&init_data->constraints,
++ sizeof(*rdev->constraints),
++ GFP_KERNEL);
++ else
++ rdev->constraints = kzalloc(sizeof(*rdev->constraints),
++ GFP_KERNEL);
++ if (!rdev->constraints) {
++ ret = -ENOMEM;
++ goto wash;
++ }
+
+ if (init_data && init_data->supply_regulator)
+ rdev->supply_name = init_data->supply_regulator;
+ else if (regulator_desc->supply_name)
+ rdev->supply_name = regulator_desc->supply_name;
+
+- ret = set_machine_constraints(rdev, constraints);
++ ret = set_machine_constraints(rdev);
+ if (ret == -EPROBE_DEFER) {
+ /* Regulator might be in bypass mode and so needs its supply
+ * to set the constraints */
+@@ -5169,7 +5166,7 @@ regulator_register(const struct regulato
+ * that is just being created */
+ ret = regulator_resolve_supply(rdev);
+ if (!ret)
+- ret = set_machine_constraints(rdev, constraints);
++ ret = set_machine_constraints(rdev);
+ else
+ rdev_dbg(rdev, "unable to resolve supply early: %pe\n",
+ ERR_PTR(ret));
--- /dev/null
+From 365ec8b61689bd64d6a61e129e0319bf71336407 Mon Sep 17 00:00:00 2001
+From: Sean Nyekjaer <sean@geanix.com>
+Date: Tue, 10 Nov 2020 18:41:13 +0100
+Subject: regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200}
+
+From: Sean Nyekjaer <sean@geanix.com>
+
+commit 365ec8b61689bd64d6a61e129e0319bf71336407 upstream.
+
+Limit the fsl,pfuze-support-disable-sw to the pfuze100 and pfuze200
+variants.
+When enabling fsl,pfuze-support-disable-sw and using a pfuze3000 or
+pfuze3001, the driver would choose pfuze100_sw_disable_regulator_ops
+instead of the newly introduced and correct pfuze3000_sw_regulator_ops.
+
+Signed-off-by: Sean Nyekjaer <sean@geanix.com>
+Fixes: 6f1cf5257acc ("regualtor: pfuze100: correct sw1a/sw2 on pfuze3000")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20201110174113.2066534-1-sean@geanix.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/pfuze100-regulator.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/regulator/pfuze100-regulator.c
++++ b/drivers/regulator/pfuze100-regulator.c
+@@ -833,11 +833,14 @@ static int pfuze100_regulator_probe(stru
+ * the switched regulator till yet.
+ */
+ if (pfuze_chip->flags & PFUZE_FLAG_DISABLE_SW) {
+- if (pfuze_chip->regulator_descs[i].sw_reg) {
+- desc->ops = &pfuze100_sw_disable_regulator_ops;
+- desc->enable_val = 0x8;
+- desc->disable_val = 0x0;
+- desc->enable_time = 500;
++ if (pfuze_chip->chip_id == PFUZE100 ||
++ pfuze_chip->chip_id == PFUZE200) {
++ if (pfuze_chip->regulator_descs[i].sw_reg) {
++ desc->ops = &pfuze100_sw_disable_regulator_ops;
++ desc->enable_val = 0x8;
++ desc->disable_val = 0x0;
++ desc->enable_time = 500;
++ }
+ }
+ }
+
--- /dev/null
+From f5c042b23f7429e5c2ac987b01a31c69059a978b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Fri, 13 Nov 2020 01:20:28 +0100
+Subject: regulator: workaround self-referent regulators
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit f5c042b23f7429e5c2ac987b01a31c69059a978b upstream.
+
+Workaround regulators whose supply name happens to be the same as its
+own name. This fixes boards that used to work before the early supply
+resolving was removed. The error message is left in place so that
+offending drivers can be detected.
+
+Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator")
+Cc: stable@vger.kernel.org
+Reported-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de> # stpmic1
+Link: https://lore.kernel.org/r/d703acde2a93100c3c7a81059d716c50ad1b1f52.1605226675.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1803,7 +1803,10 @@ static int regulator_resolve_supply(stru
+ if (r == rdev) {
+ dev_err(dev, "Supply for %s (%s) resolved to itself\n",
+ rdev->desc->name, rdev->supply_name);
+- return -EINVAL;
++ if (!have_full_constraints())
++ return -EINVAL;
++ r = dummy_regulator_rdev;
++ get_device(&r->dev);
+ }
+
+ /*
efivarfs-fix-memory-leak-in-efivarfs_create.patch
staging-rtl8723bs-add-024c-0627-to-the-list-of-sdio-device-ids.patch
iio-light-fix-kconfig-dependency-bug-for-vcnl4035.patch
+ext4-fix-bogus-warning-in-ext4_update_dx_flag.patch
+iio-accel-kxcjk1013-replace-is_smo8500_device-with-an-acpi_type-enum.patch
+iio-accel-kxcjk1013-add-support-for-kiox010a-acpi-dsm-for-setting-tablet-mode.patch
+iio-adc-mediatek-fix-unset-field.patch
+spi-lpspi-fix-use-after-free-on-unbind.patch
+spi-introduce-device-managed-spi-controller-allocation.patch
+spi-npcm-fiu-don-t-leak-spi-master-in-probe-error-path.patch
+spi-bcm2835aux-fix-use-after-free-on-unbind.patch
+regulator-pfuze100-limit-pfuze-support-disable-sw-to-pfuze-100-200.patch
+regulator-fix-memory-leak-with-repeated-set_machine_constraints.patch
+regulator-avoid-resolve_supply-infinite-recursion.patch
+regulator-workaround-self-referent-regulators.patch
--- /dev/null
+From e13ee6cc4781edaf8c7321bee19217e3702ed481 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Wed, 11 Nov 2020 20:07:30 +0100
+Subject: spi: bcm2835aux: Fix use-after-free on unbind
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit e13ee6cc4781edaf8c7321bee19217e3702ed481 upstream.
+
+bcm2835aux_spi_remove() accesses the driver's private data after calling
+spi_unregister_master() even though that function releases the last
+reference on the spi_master and thereby frees the private data.
+
+Fix by switching over to the new devm_spi_alloc_master() helper which
+keeps the private data accessible until the driver has unbound.
+
+Fixes: b9dd3f6d4172 ("spi: bcm2835aux: Fix controller unregister order")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: <stable@vger.kernel.org> # v4.4+: 123456789abc: spi: Introduce device-managed SPI controller allocation
+Cc: <stable@vger.kernel.org> # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order
+Cc: <stable@vger.kernel.org> # v4.4+
+Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-bcm2835aux.c | 21 +++++++--------------
+ 1 file changed, 7 insertions(+), 14 deletions(-)
+
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -494,7 +494,7 @@ static int bcm2835aux_spi_probe(struct p
+ unsigned long clk_hz;
+ int err;
+
+- master = spi_alloc_master(&pdev->dev, sizeof(*bs));
++ master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
+ if (!master)
+ return -ENOMEM;
+
+@@ -524,29 +524,24 @@ static int bcm2835aux_spi_probe(struct p
+
+ /* the main area */
+ bs->regs = devm_platform_ioremap_resource(pdev, 0);
+- if (IS_ERR(bs->regs)) {
+- err = PTR_ERR(bs->regs);
+- goto out_master_put;
+- }
++ if (IS_ERR(bs->regs))
++ return PTR_ERR(bs->regs);
+
+ bs->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(bs->clk)) {
+- err = PTR_ERR(bs->clk);
+ dev_err(&pdev->dev, "could not get clk: %d\n", err);
+- goto out_master_put;
++ return PTR_ERR(bs->clk);
+ }
+
+ bs->irq = platform_get_irq(pdev, 0);
+- if (bs->irq <= 0) {
+- err = bs->irq ? bs->irq : -ENODEV;
+- goto out_master_put;
+- }
++ if (bs->irq <= 0)
++ return bs->irq ? bs->irq : -ENODEV;
+
+ /* this also enables the HW block */
+ err = clk_prepare_enable(bs->clk);
+ if (err) {
+ dev_err(&pdev->dev, "could not prepare clock: %d\n", err);
+- goto out_master_put;
++ return err;
+ }
+
+ /* just checking if the clock returns a sane value */
+@@ -581,8 +576,6 @@ static int bcm2835aux_spi_probe(struct p
+
+ out_clk_disable:
+ clk_disable_unprepare(bs->clk);
+-out_master_put:
+- spi_master_put(master);
+ return err;
+ }
+
--- /dev/null
+From 5e844cc37a5cbaa460e68f9a989d321d63088a89 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Wed, 11 Nov 2020 20:07:10 +0100
+Subject: spi: Introduce device-managed SPI controller allocation
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 5e844cc37a5cbaa460e68f9a989d321d63088a89 upstream.
+
+SPI driver probing currently comprises two steps, whereas removal
+comprises only one step:
+
+ spi_alloc_master()
+ spi_register_controller()
+
+ spi_unregister_controller()
+
+That's because spi_unregister_controller() calls device_unregister()
+instead of device_del(), thereby releasing the reference on the
+spi_controller which was obtained by spi_alloc_master().
+
+An SPI driver's private data is contained in the same memory allocation
+as the spi_controller struct. Thus, once spi_unregister_controller()
+has been called, the private data is inaccessible. But some drivers
+need to access it after spi_unregister_controller() to perform further
+teardown steps.
+
+Introduce devm_spi_alloc_master() and devm_spi_alloc_slave(), which
+release a reference on the spi_controller struct only after the driver
+has unbound, thereby keeping the memory allocation accessible. Change
+spi_unregister_controller() to not release a reference if the
+spi_controller was allocated by one of these new devm functions.
+
+The present commit is small enough to be backportable to stable.
+It allows fixing drivers which use the private data in their ->remove()
+hook after it's been freed. It also allows fixing drivers which neglect
+to release a reference on the spi_controller in the probe error path.
+
+Long-term, most SPI drivers shall be moved over to the devm functions
+introduced herein. The few that can't shall be changed in a treewide
+commit to explicitly release the last reference on the controller.
+That commit shall amend spi_unregister_controller() to no longer release
+a reference, thereby completing the migration.
+
+As a result, the behaviour will be less surprising and more consistent
+with subsystems such as IIO, which also includes the private data in the
+allocation of the generic iio_dev struct, but calls device_del() in
+iio_device_unregister().
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Link: https://lore.kernel.org/r/272bae2ef08abd21388c98e23729886663d19192.1605121038.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++-
+ include/linux/spi/spi.h | 19 +++++++++++++++
+ 2 files changed, 76 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2257,6 +2257,49 @@ struct spi_controller *__spi_alloc_contr
+ }
+ EXPORT_SYMBOL_GPL(__spi_alloc_controller);
+
++static void devm_spi_release_controller(struct device *dev, void *ctlr)
++{
++ spi_controller_put(*(struct spi_controller **)ctlr);
++}
++
++/**
++ * __devm_spi_alloc_controller - resource-managed __spi_alloc_controller()
++ * @dev: physical device of SPI controller
++ * @size: how much zeroed driver-private data to allocate
++ * @slave: whether to allocate an SPI master (false) or SPI slave (true)
++ * Context: can sleep
++ *
++ * Allocate an SPI controller and automatically release a reference on it
++ * when @dev is unbound from its driver. Drivers are thus relieved from
++ * having to call spi_controller_put().
++ *
++ * The arguments to this function are identical to __spi_alloc_controller().
++ *
++ * Return: the SPI controller structure on success, else NULL.
++ */
++struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
++ unsigned int size,
++ bool slave)
++{
++ struct spi_controller **ptr, *ctlr;
++
++ ptr = devres_alloc(devm_spi_release_controller, sizeof(*ptr),
++ GFP_KERNEL);
++ if (!ptr)
++ return NULL;
++
++ ctlr = __spi_alloc_controller(dev, size, slave);
++ if (ctlr) {
++ *ptr = ctlr;
++ devres_add(dev, ptr);
++ } else {
++ devres_free(ptr);
++ }
++
++ return ctlr;
++}
++EXPORT_SYMBOL_GPL(__devm_spi_alloc_controller);
++
+ #ifdef CONFIG_OF
+ static int of_spi_get_gpio_numbers(struct spi_controller *ctlr)
+ {
+@@ -2576,6 +2619,11 @@ int devm_spi_register_controller(struct
+ }
+ EXPORT_SYMBOL_GPL(devm_spi_register_controller);
+
++static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr)
++{
++ return *(struct spi_controller **)res == ctlr;
++}
++
+ static int __unregister(struct device *dev, void *null)
+ {
+ spi_unregister_device(to_spi_device(dev));
+@@ -2617,7 +2665,15 @@ void spi_unregister_controller(struct sp
+ list_del(&ctlr->list);
+ mutex_unlock(&board_lock);
+
+- device_unregister(&ctlr->dev);
++ device_del(&ctlr->dev);
++
++ /* Release the last reference on the controller if its driver
++ * has not yet been converted to devm_spi_alloc_master/slave().
++ */
++ if (!devres_find(ctlr->dev.parent, devm_spi_release_controller,
++ devm_spi_match_controller, ctlr))
++ put_device(&ctlr->dev);
++
+ /* free bus id */
+ mutex_lock(&board_lock);
+ if (found == ctlr)
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -663,6 +663,25 @@ static inline struct spi_controller *spi
+ return __spi_alloc_controller(host, size, true);
+ }
+
++struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
++ unsigned int size,
++ bool slave);
++
++static inline struct spi_controller *devm_spi_alloc_master(struct device *dev,
++ unsigned int size)
++{
++ return __devm_spi_alloc_controller(dev, size, false);
++}
++
++static inline struct spi_controller *devm_spi_alloc_slave(struct device *dev,
++ unsigned int size)
++{
++ if (!IS_ENABLED(CONFIG_SPI_SLAVE))
++ return NULL;
++
++ return __devm_spi_alloc_controller(dev, size, true);
++}
++
+ extern int spi_register_controller(struct spi_controller *ctlr);
+ extern int devm_spi_register_controller(struct device *dev,
+ struct spi_controller *ctlr);
--- /dev/null
+From 4def49da620c84a682d9361d6bef0a97eed46fe0 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sun, 8 Nov 2020 23:41:00 +0100
+Subject: spi: lpspi: Fix use-after-free on unbind
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 4def49da620c84a682d9361d6bef0a97eed46fe0 upstream.
+
+Normally the last reference on an spi_controller is released by
+spi_unregister_controller(). In the case of the i.MX lpspi driver,
+the spi_controller is registered with devm_spi_register_controller(),
+so spi_unregister_controller() is invoked automatically after the driver
+has unbound.
+
+However the driver already releases the last reference in
+fsl_lpspi_remove() through a gratuitous call to spi_master_put(),
+causing a use-after-free when spi_unregister_controller() is
+subsequently invoked by the devres framework.
+
+Fix by dropping the superfluous spi_master_put().
+
+Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: <stable@vger.kernel.org> # v5.2+
+Cc: Han Xu <han.xu@nxp.com>
+Link: https://lore.kernel.org/r/ab3c0b18bd820501a12c85e440006e09ec0e275f.1604874488.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-fsl-lpspi.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -973,9 +973,6 @@ static int fsl_lpspi_remove(struct platf
+ spi_controller_get_devdata(controller);
+
+ pm_runtime_disable(fsl_lpspi->dev);
+-
+- spi_master_put(controller);
+-
+ return 0;
+ }
+
--- /dev/null
+From 04a9cd51d3f3308a98cbc6adc07acb12fbade011 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Mon, 16 Nov 2020 09:23:10 +0100
+Subject: spi: npcm-fiu: Don't leak SPI master in probe error path
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 04a9cd51d3f3308a98cbc6adc07acb12fbade011 upstream.
+
+If the calls to of_match_device(), of_alias_get_id(),
+devm_ioremap_resource(), devm_regmap_init_mmio() or devm_clk_get()
+fail on probe of the NPCM FIU SPI driver, the spi_controller struct is
+erroneously not freed.
+
+Fix by switching over to the new devm_spi_alloc_master() helper.
+
+Fixes: ace55c411b11 ("spi: npcm-fiu: add NPCM FIU controller driver")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: <stable@vger.kernel.org> # v5.4+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
+Cc: <stable@vger.kernel.org> # v5.4+
+Cc: Tomer Maimon <tmaimon77@gmail.com>
+Link: https://lore.kernel.org/r/a420c23a363a3bc9aa684c6e790c32a8af106d17.1605512876.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-npcm-fiu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-npcm-fiu.c
++++ b/drivers/spi/spi-npcm-fiu.c
+@@ -680,7 +680,7 @@ static int npcm_fiu_probe(struct platfor
+ int ret;
+ int id;
+
+- ctrl = spi_alloc_master(dev, sizeof(*fiu));
++ ctrl = devm_spi_alloc_master(dev, sizeof(*fiu));
+ if (!ctrl)
+ return -ENOMEM;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
