--- /dev/null
+From 9ffad9263b467efd8f8dc7ae1941a0a655a2bab2 Mon Sep 17 00:00:00 2001
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Date: Sun, 28 Jun 2020 21:06:38 -0400
+Subject: cifs: Fix the target file was deleted when rename failed.
+
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+
+commit 9ffad9263b467efd8f8dc7ae1941a0a655a2bab2 upstream.
+
+When xfstest generic/035, we found the target file was deleted
+if the rename return -EACESS.
+
+In cifs_rename2, we unlink the positive target dentry if rename
+failed with EACESS or EEXIST, even if the target dentry is positived
+before rename. Then the existing file was deleted.
+
+We should just delete the target file which created during the
+rename.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/inode.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1791,6 +1791,7 @@ cifs_rename2(struct inode *source_dir, s
+ FILE_UNIX_BASIC_INFO *info_buf_target;
+ unsigned int xid;
+ int rc, tmprc;
++ bool new_target = d_really_is_negative(target_dentry);
+
+ if (flags & ~RENAME_NOREPLACE)
+ return -EINVAL;
+@@ -1867,8 +1868,13 @@ cifs_rename2(struct inode *source_dir, s
+ */
+
+ unlink_target:
+- /* Try unlinking the target dentry if it's not negative */
+- if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) {
++ /*
++ * If the target dentry was created during the rename, try
++ * unlinking it if it's not negative
++ */
++ if (new_target &&
++ d_really_is_positive(target_dentry) &&
++ (rc == -EACCES || rc == -EEXIST)) {
+ if (d_is_dir(target_dentry))
+ tmprc = cifs_rmdir(target_dir, target_dentry);
+ else
--- /dev/null
+From 4ab59c3c638c6c8952bf07739805d20eb6358a4d Mon Sep 17 00:00:00 2001
+From: Sumit Semwal <sumit.semwal@linaro.org>
+Date: Thu, 11 Jun 2020 17:14:18 +0530
+Subject: dma-buf: Move dma_buf_release() from fops to dentry_ops
+
+From: Sumit Semwal <sumit.semwal@linaro.org>
+
+commit 4ab59c3c638c6c8952bf07739805d20eb6358a4d upstream.
+
+Charan Teja reported a 'use-after-free' in dmabuffs_dname [1], which
+happens if the dma_buf_release() is called while the userspace is
+accessing the dma_buf pseudo fs's dmabuffs_dname() in another process,
+and dma_buf_release() releases the dmabuf object when the last reference
+to the struct file goes away.
+
+I discussed with Arnd Bergmann, and he suggested that rather than tying
+the dma_buf_release() to the file_operations' release(), we can tie it to
+the dentry_operations' d_release(), which will be called when the last ref
+to the dentry is removed.
+
+The path exercised by __fput() calls f_op->release() first, and then calls
+dput, which eventually calls d_op->d_release().
+
+In the 'normal' case, when no userspace access is happening via dma_buf
+pseudo fs, there should be exactly one fd, file, dentry and inode, so
+closing the fd will kill of everything right away.
+
+In the presented case, the dentry's d_release() will be called only when
+the dentry's last ref is released.
+
+Therefore, lets move dma_buf_release() from fops->release() to
+d_ops->d_release()
+
+Many thanks to Arnd for his FS insights :)
+
+[1]: https://lore.kernel.org/patchwork/patch/1238278/
+
+Fixes: bb2bb9030425 ("dma-buf: add DMA_BUF_SET_NAME ioctls")
+Reported-by: syzbot+3643a18836bce555bff6@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org> [5.3+]
+Cc: Arnd Bergmann <arnd@arndb.de>
+Reported-by: Charan Teja Reddy <charante@codeaurora.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
+Tested-by: Charan Teja Reddy <charante@codeaurora.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200611114418.19852-1-sumit.semwal@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma-buf/dma-buf.c | 54 +++++++++++++++++++++-------------------------
+ 1 file changed, 25 insertions(+), 29 deletions(-)
+
+--- a/drivers/dma-buf/dma-buf.c
++++ b/drivers/dma-buf/dma-buf.c
+@@ -54,37 +54,11 @@ static char *dmabuffs_dname(struct dentr
+ dentry->d_name.name, ret > 0 ? name : "");
+ }
+
+-static const struct dentry_operations dma_buf_dentry_ops = {
+- .d_dname = dmabuffs_dname,
+-};
+-
+-static struct vfsmount *dma_buf_mnt;
+-
+-static int dma_buf_fs_init_context(struct fs_context *fc)
+-{
+- struct pseudo_fs_context *ctx;
+-
+- ctx = init_pseudo(fc, DMA_BUF_MAGIC);
+- if (!ctx)
+- return -ENOMEM;
+- ctx->dops = &dma_buf_dentry_ops;
+- return 0;
+-}
+-
+-static struct file_system_type dma_buf_fs_type = {
+- .name = "dmabuf",
+- .init_fs_context = dma_buf_fs_init_context,
+- .kill_sb = kill_anon_super,
+-};
+-
+-static int dma_buf_release(struct inode *inode, struct file *file)
++static void dma_buf_release(struct dentry *dentry)
+ {
+ struct dma_buf *dmabuf;
+
+- if (!is_dma_buf_file(file))
+- return -EINVAL;
+-
+- dmabuf = file->private_data;
++ dmabuf = dentry->d_fsdata;
+
+ BUG_ON(dmabuf->vmapping_counter);
+
+@@ -110,9 +84,32 @@ static int dma_buf_release(struct inode
+ module_put(dmabuf->owner);
+ kfree(dmabuf->name);
+ kfree(dmabuf);
++}
++
++static const struct dentry_operations dma_buf_dentry_ops = {
++ .d_dname = dmabuffs_dname,
++ .d_release = dma_buf_release,
++};
++
++static struct vfsmount *dma_buf_mnt;
++
++static int dma_buf_fs_init_context(struct fs_context *fc)
++{
++ struct pseudo_fs_context *ctx;
++
++ ctx = init_pseudo(fc, DMA_BUF_MAGIC);
++ if (!ctx)
++ return -ENOMEM;
++ ctx->dops = &dma_buf_dentry_ops;
+ return 0;
+ }
+
++static struct file_system_type dma_buf_fs_type = {
++ .name = "dmabuf",
++ .init_fs_context = dma_buf_fs_init_context,
++ .kill_sb = kill_anon_super,
++};
++
+ static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma)
+ {
+ struct dma_buf *dmabuf;
+@@ -412,7 +409,6 @@ static void dma_buf_show_fdinfo(struct s
+ }
+
+ static const struct file_operations dma_buf_fops = {
+- .release = dma_buf_release,
+ .mmap = dma_buf_mmap_internal,
+ .llseek = dma_buf_llseek,
+ .poll = dma_buf_poll,
--- /dev/null
+From 6eb3cf2e06d22b2b08e6b0ab48cb9c05a8e1a107 Mon Sep 17 00:00:00 2001
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Date: Mon, 29 Jun 2020 13:03:52 -0400
+Subject: drm/amd/display: Only revalidate bandwidth on medium and fast updates
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+commit 6eb3cf2e06d22b2b08e6b0ab48cb9c05a8e1a107 upstream.
+
+[Why]
+Changes that are fast don't require updating DLG parameters making
+this call unnecessary. Considering this is an expensive call it should
+not be done on every flip.
+
+DML touches clocks, p-state support, DLG params and a few other DC
+internal flags and these aren't expected during fast. A hang has been
+reported with this change when called on every flip which suggests that
+modifying these fields is not recommended behavior on fast updates.
+
+[How]
+Guard the validation to only happen if update type isn't FAST.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1191
+Fixes: a24eaa5c51255b ("drm/amd/display: Revalidate bandwidth before commiting DC updates")
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Roman Li <Roman.Li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -2226,10 +2226,12 @@ void dc_commit_updates_for_stream(struct
+
+ copy_stream_update_to_stream(dc, context, stream, stream_update);
+
+- if (!dc->res_pool->funcs->validate_bandwidth(dc, context, false)) {
+- DC_ERROR("Mode validation failed for stream update!\n");
+- dc_release_state(context);
+- return;
++ if (update_type > UPDATE_TYPE_FAST) {
++ if (!dc->res_pool->funcs->validate_bandwidth(dc, context, false)) {
++ DC_ERROR("Mode validation failed for stream update!\n");
++ dc_release_state(context);
++ return;
++ }
+ }
+
+ commit_planes_for_stream(
--- /dev/null
+From d7a6634a4cfba073ff6a526cb4265d6e58ece234 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 25 Jun 2020 17:55:57 -0400
+Subject: drm/amdgpu/atomfirmware: fix vram_info fetching for renoir
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit d7a6634a4cfba073ff6a526cb4265d6e58ece234 upstream.
+
+Renoir uses integrated_system_info table v12. The table
+has the same layout as v11 with respect to this data. Just
+reuse the existing code for v12 for stable.
+
+Fixes incorrectly reported vram info in the driver output.
+
+Acked-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c
+@@ -150,6 +150,7 @@ int amdgpu_atomfirmware_get_vram_width(s
+ (mode_info->atom_context->bios + data_offset);
+ switch (crev) {
+ case 11:
++ case 12:
+ mem_channel_number = igp_info->v11.umachannelnumber;
+ /* channel width is 64 */
+ return mem_channel_number * 64;
--- /dev/null
+From beaf10efca64ac824240838ab1f054dfbefab5e6 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 1 Jul 2020 12:00:08 -0400
+Subject: drm/amdgpu: use %u rather than %d for sclk/mclk
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit beaf10efca64ac824240838ab1f054dfbefab5e6 upstream.
+
+Large clock values may overflow and show up as negative.
+
+Reported by prOMiNd on IRC.
+
+Acked-by: Nirmoy Das <nirmoy.das@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+@@ -2101,7 +2101,7 @@ static ssize_t amdgpu_hwmon_show_sclk(st
+ if (r)
+ return r;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", sclk * 10 * 1000);
++ return snprintf(buf, PAGE_SIZE, "%u\n", sclk * 10 * 1000);
+ }
+
+ static ssize_t amdgpu_hwmon_show_sclk_label(struct device *dev,
+@@ -2131,7 +2131,7 @@ static ssize_t amdgpu_hwmon_show_mclk(st
+ if (r)
+ return r;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", mclk * 10 * 1000);
++ return snprintf(buf, PAGE_SIZE, "%u\n", mclk * 10 * 1000);
+ }
+
+ static ssize_t amdgpu_hwmon_show_mclk_label(struct device *dev,
--- /dev/null
+From 005c34ae4b44f085120d7f371121ec7ded677761 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Sun, 21 Jun 2020 14:43:15 +0100
+Subject: irqchip/gic: Atomically update affinity
+
+From: Marc Zyngier <maz@kernel.org>
+
+commit 005c34ae4b44f085120d7f371121ec7ded677761 upstream.
+
+The GIC driver uses a RMW sequence to update the affinity, and
+relies on the gic_lock_irqsave/gic_unlock_irqrestore sequences
+to update it atomically.
+
+But these sequences only expand into anything meaningful if
+the BL_SWITCHER option is selected, which almost never happens.
+
+It also turns out that using a RMW and locks is just as silly,
+as the GIC distributor supports byte accesses for the GICD_TARGETRn
+registers, which when used make the update atomic by definition.
+
+Drop the terminally broken code and replace it by a byte write.
+
+Fixes: 04c8b0f82c7d ("irqchip/gic: Make locking a BL_SWITCHER only feature")
+Cc: stable@vger.kernel.org
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/irqchip/irq-gic.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+--- a/drivers/irqchip/irq-gic.c
++++ b/drivers/irqchip/irq-gic.c
+@@ -329,10 +329,8 @@ static int gic_irq_set_vcpu_affinity(str
+ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
+ bool force)
+ {
+- void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3);
+- unsigned int cpu, shift = (gic_irq(d) % 4) * 8;
+- u32 val, mask, bit;
+- unsigned long flags;
++ void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + gic_irq(d);
++ unsigned int cpu;
+
+ if (!force)
+ cpu = cpumask_any_and(mask_val, cpu_online_mask);
+@@ -342,13 +340,7 @@ static int gic_set_affinity(struct irq_d
+ if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
+ return -EINVAL;
+
+- gic_lock_irqsave(flags);
+- mask = 0xff << shift;
+- bit = gic_cpu_map[cpu] << shift;
+- val = readl_relaxed(reg) & ~mask;
+- writel_relaxed(val | bit, reg);
+- gic_unlock_irqrestore(flags);
+-
++ writeb_relaxed(gic_cpu_map[cpu], reg);
+ irq_data_update_effective_affinity(d, cpumask_of(cpu));
+
+ return IRQ_SET_MASK_OK_DONE;
--- /dev/null
+From fcec538ef8cca0ad0b84432235dccd9059c8e6f8 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Fri, 3 Jul 2020 00:53:34 +0200
+Subject: MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen
+
+From: Hauke Mehrtens <hauke@hauke-m.de>
+
+commit fcec538ef8cca0ad0b84432235dccd9059c8e6f8 upstream.
+
+This resolves the hazard between the mtc0 in the change_c0_status() and
+the mfc0 in configure_exception_vector(). Without resolving this hazard
+configure_exception_vector() could read an old value and would restore
+this old value again. This would revert the changes change_c0_status()
+did. I checked this by printing out the read_c0_status() at the end of
+per_cpu_trap_init() and the ST0_MX is not set without this patch.
+
+The hazard is documented in the MIPS Architecture Reference Manual Vol.
+III: MIPS32/microMIPS32 Privileged Resource Architecture (MD00088), rev
+6.03 table 8.1 which includes:
+
+ Producer | Consumer | Hazard
+ ----------|----------|----------------------------
+ mtc0 | mfc0 | any coprocessor 0 register
+
+I saw this hazard on an Atheros AR9344 rev 2 SoC with a MIPS 74Kc CPU.
+There the change_c0_status() function would activate the DSPen by
+setting ST0_MX in the c0_status register. This was reverted and then the
+system got a DSP exception when the DSP registers were saved in
+save_dsp() in the first process switch. The crash looks like this:
+
+[ 0.089999] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
+[ 0.097796] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
+[ 0.107070] Kernel panic - not syncing: Unexpected DSP exception
+[ 0.113470] Rebooting in 1 seconds..
+
+We saw this problem in OpenWrt only on the MIPS 74Kc based Atheros SoCs,
+not on the 24Kc based SoCs. We only saw it with kernel 5.4 not with
+kernel 4.19, in addition we had to use GCC 8.4 or 9.X, with GCC 8.3 it
+did not happen.
+
+In the kernel I bisected this problem to commit 9012d011660e ("compiler:
+allow all arches to enable CONFIG_OPTIMIZE_INLINING"), but when this was
+reverted it also happened after commit 172dcd935c34b ("MIPS: Always
+allocate exception vector for MIPSr2+").
+
+Commit 0b24cae4d535 ("MIPS: Add missing EHB in mtc0 -> mfc0 sequence.")
+does similar changes to a different file. I am not sure if there are
+more places affected by this problem.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/traps.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/mips/kernel/traps.c
++++ b/arch/mips/kernel/traps.c
+@@ -2126,6 +2126,7 @@ static void configure_status(void)
+
+ change_c0_status(ST0_CU|ST0_MX|ST0_RE|ST0_FR|ST0_BEV|ST0_TS|ST0_KX|ST0_SX|ST0_UX,
+ status_set);
++ back_to_back_c0_hazard();
+ }
+
+ unsigned int hwrena;
--- /dev/null
+From 03e62fd67d3ab33f39573fc8787d89dc9b4d7255 Mon Sep 17 00:00:00 2001
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Sun, 7 Jun 2020 15:10:23 +0200
+Subject: MIPS: lantiq: xway: sysctrl: fix the GPHY clock alias names
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+commit 03e62fd67d3ab33f39573fc8787d89dc9b4d7255 upstream.
+
+The dt-bindings for the GSWIP describe that the node should be named
+"switch". Use the same name in sysctrl.c so the GSWIP driver can
+actually find the "gphy0" and "gphy1" clocks.
+
+Fixes: 14fceff4771e51 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200")
+Cc: stable@vger.kernel.org
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/lantiq/xway/sysctrl.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -514,8 +514,8 @@ void __init ltq_soc_init(void)
+ clkdev_add_pmu("1e10b308.eth", NULL, 0, 0, PMU_SWITCH |
+ PMU_PPE_DP | PMU_PPE_TC);
+ clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF);
+- clkdev_add_pmu("1e108000.gswip", "gphy0", 0, 0, PMU_GPHY);
+- clkdev_add_pmu("1e108000.gswip", "gphy1", 0, 0, PMU_GPHY);
++ clkdev_add_pmu("1e108000.switch", "gphy0", 0, 0, PMU_GPHY);
++ clkdev_add_pmu("1e108000.switch", "gphy1", 0, 0, PMU_GPHY);
+ clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU);
+ clkdev_add_pmu("1e116000.mei", "afe", 1, 2, PMU_ANALOG_DSL_AFE);
+ clkdev_add_pmu("1e116000.mei", "dfe", 1, 0, PMU_DFE);
+@@ -538,8 +538,8 @@ void __init ltq_soc_init(void)
+ PMU_SWITCH | PMU_PPE_DPLUS | PMU_PPE_DPLUM |
+ PMU_PPE_EMA | PMU_PPE_TC | PMU_PPE_SLL01 |
+ PMU_PPE_QSB | PMU_PPE_TOP);
+- clkdev_add_pmu("1e108000.gswip", "gphy0", 0, 0, PMU_GPHY);
+- clkdev_add_pmu("1e108000.gswip", "gphy1", 0, 0, PMU_GPHY);
++ clkdev_add_pmu("1e108000.switch", "gphy0", 0, 0, PMU_GPHY);
++ clkdev_add_pmu("1e108000.switch", "gphy1", 0, 0, PMU_GPHY);
+ clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO);
+ clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU);
+ clkdev_add_pmu("1e116000.mei", "dfe", 1, 0, PMU_DFE);
--- /dev/null
+From 6467552ca64c4ddd2b83ed73192107d7145f533b Mon Sep 17 00:00:00 2001
+From: Vlastimil Babka <vbabka@suse.cz>
+Date: Wed, 1 Apr 2020 21:10:35 -0700
+Subject: mm, compaction: fully assume capture is not NULL in compact_zone_order()
+
+From: Vlastimil Babka <vbabka@suse.cz>
+
+commit 6467552ca64c4ddd2b83ed73192107d7145f533b upstream.
+
+Dan reports:
+
+The patch 5e1f0f098b46: "mm, compaction: capture a page under direct
+compaction" from Mar 5, 2019, leads to the following Smatch complaint:
+
+ mm/compaction.c:2321 compact_zone_order()
+ error: we previously assumed 'capture' could be null (see line 2313)
+
+mm/compaction.c
+ 2288 static enum compact_result compact_zone_order(struct zone *zone, int order,
+ 2289 gfp_t gfp_mask, enum compact_priority prio,
+ 2290 unsigned int alloc_flags, int classzone_idx,
+ 2291 struct page **capture)
+ ^^^^^^^
+
+ 2313 if (capture)
+ ^^^^^^^
+Check for NULL
+
+ 2314 current->capture_control = &capc;
+ 2315
+ 2316 ret = compact_zone(&cc, &capc);
+ 2317
+ 2318 VM_BUG_ON(!list_empty(&cc.freepages));
+ 2319 VM_BUG_ON(!list_empty(&cc.migratepages));
+ 2320
+ 2321 *capture = capc.page;
+ ^^^^^^^^
+Unchecked dereference.
+
+ 2322 current->capture_control = NULL;
+ 2323
+
+In practice this is not an issue, as the only caller path passes non-NULL
+capture:
+
+__alloc_pages_direct_compact()
+ struct page *page = NULL;
+ try_to_compact_pages(capture = &page);
+ compact_zone_order(capture = capture);
+
+So let's remove the unnecessary check, which should also make Smatch happy.
+
+Fixes: 5e1f0f098b46 ("mm, compaction: capture a page under direct compaction")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Suggested-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Mel Gorman <mgorman@techsingularity.net>
+Link: http://lkml.kernel.org/r/18b0df3c-0589-d96c-23fa-040798fee187@suse.cz
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/compaction.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -2310,8 +2310,7 @@ static enum compact_result compact_zone_
+ .page = NULL,
+ };
+
+- if (capture)
+- current->capture_control = &capc;
++ current->capture_control = &capc;
+
+ ret = compact_zone(&cc, &capc);
+
+@@ -2333,6 +2332,7 @@ int sysctl_extfrag_threshold = 500;
+ * @alloc_flags: The allocation flags of the current allocation
+ * @ac: The context of current allocation
+ * @prio: Determines how hard direct compaction should try to succeed
++ * @capture: Pointer to free page created by compaction will be stored here
+ *
+ * This is the main entry point for direct page compaction.
+ */
--- /dev/null
+From b9e20f0da1f5c9c68689450a8cb436c9486434c8 Mon Sep 17 00:00:00 2001
+From: Vlastimil Babka <vbabka@suse.cz>
+Date: Thu, 25 Jun 2020 20:29:24 -0700
+Subject: mm, compaction: make capture control handling safe wrt interrupts
+
+From: Vlastimil Babka <vbabka@suse.cz>
+
+commit b9e20f0da1f5c9c68689450a8cb436c9486434c8 upstream.
+
+Hugh reports:
+
+ "While stressing compaction, one run oopsed on NULL capc->cc in
+ __free_one_page()'s task_capc(zone): compact_zone_order() had been
+ interrupted, and a page was being freed in the return from interrupt.
+
+ Though you would not expect it from the source, both gccs I was using
+ (4.8.1 and 7.5.0) had chosen to compile compact_zone_order() with the
+ ".cc = &cc" implemented by mov %rbx,-0xb0(%rbp) immediately before
+ callq compact_zone - long after the "current->capture_control =
+ &capc". An interrupt in between those finds capc->cc NULL (zeroed by
+ an earlier rep stos).
+
+ This could presumably be fixed by a barrier() before setting
+ current->capture_control in compact_zone_order(); but would also need
+ more care on return from compact_zone(), in order not to risk leaking
+ a page captured by interrupt just before capture_control is reset.
+
+ Maybe that is the preferable fix, but I felt safer for task_capc() to
+ exclude the rather surprising possibility of capture at interrupt
+ time"
+
+I have checked that gcc10 also behaves the same.
+
+The advantage of fix in compact_zone_order() is that we don't add
+another test in the page freeing hot path, and that it might prevent
+future problems if we stop exposing pointers to uninitialized structures
+in current task.
+
+So this patch implements the suggestion for compact_zone_order() with
+barrier() (and WRITE_ONCE() to prevent store tearing) for setting
+current->capture_control, and prevents page leaking with
+WRITE_ONCE/READ_ONCE in the proper order.
+
+Link: http://lkml.kernel.org/r/20200616082649.27173-1-vbabka@suse.cz
+Fixes: 5e1f0f098b46 ("mm, compaction: capture a page under direct compaction")
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+Reported-by: Hugh Dickins <hughd@google.com>
+Suggested-by: Hugh Dickins <hughd@google.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Cc: Alex Shi <alex.shi@linux.alibaba.com>
+Cc: Li Wang <liwang@redhat.com>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Cc: <stable@vger.kernel.org> [5.1+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/compaction.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -2310,15 +2310,26 @@ static enum compact_result compact_zone_
+ .page = NULL,
+ };
+
+- current->capture_control = &capc;
++ /*
++ * Make sure the structs are really initialized before we expose the
++ * capture control, in case we are interrupted and the interrupt handler
++ * frees a page.
++ */
++ barrier();
++ WRITE_ONCE(current->capture_control, &capc);
+
+ ret = compact_zone(&cc, &capc);
+
+ VM_BUG_ON(!list_empty(&cc.freepages));
+ VM_BUG_ON(!list_empty(&cc.migratepages));
+
+- *capture = capc.page;
+- current->capture_control = NULL;
++ /*
++ * Make sure we hide capture control first before we read the captured
++ * page pointer, otherwise an interrupt could free and capture a page
++ * and we would leak it.
++ */
++ WRITE_ONCE(current->capture_control, NULL);
++ *capture = READ_ONCE(capc.page);
+
+ return ret;
+ }
--- /dev/null
+From 22cf8419f1319ff87ec759d0ebdff4cbafaee832 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 16 Jun 2020 16:43:18 -0400
+Subject: nfsd: apply umask on fs without ACL support
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+commit 22cf8419f1319ff87ec759d0ebdff4cbafaee832 upstream.
+
+The server is failing to apply the umask when creating new objects on
+filesystems without ACL support.
+
+To reproduce this, you need to use NFSv4.2 and a client and server
+recent enough to support umask, and you need to export a filesystem that
+lacks ACL support (for example, ext4 with the "noacl" mount option).
+
+Filesystems with ACL support are expected to take care of the umask
+themselves (usually by calling posix_acl_create).
+
+For filesystems without ACL support, this is up to the caller of
+vfs_create(), vfs_mknod(), or vfs_mkdir().
+
+Reported-by: Elliott Mitchell <ehem+debian@m5p.com>
+Reported-by: Salvatore Bonaccorso <carnil@debian.org>
+Tested-by: Salvatore Bonaccorso <carnil@debian.org>
+Fixes: 47057abde515 ("nfsd: add support for the umask attribute")
+Cc: stable@vger.kernel.org
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/vfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1184,6 +1184,9 @@ nfsd_create_locked(struct svc_rqst *rqst
+ iap->ia_mode = 0;
+ iap->ia_mode = (iap->ia_mode & S_IALLUGO) | type;
+
++ if (!IS_POSIXACL(dirp))
++ iap->ia_mode &= ~current_umask();
++
+ err = 0;
+ host_err = 0;
+ switch (type) {
+@@ -1416,6 +1419,9 @@ do_nfsd_create(struct svc_rqst *rqstp, s
+ goto out;
+ }
+
++ if (!IS_POSIXACL(dirp))
++ iap->ia_mode &= ~current_umask();
++
+ host_err = vfs_create(dirp, dchild, iap->ia_mode, true);
+ if (host_err < 0) {
+ fh_drop_write(fhp);
--- /dev/null
+From 22cfd031dc5354715bf1dd143f1e664d3f70febf Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Tue, 7 Jul 2020 14:42:38 +0200
+Subject: Revert "ALSA: usb-audio: Improve frames size computation"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+This reverts commit aba41867dd66939d336fdf604e4d73b805d8039f which is
+commit f0bd62b64016508938df9babe47f65c2c727d25c upstream.
+
+It causes a number of reported issues and a fix for it has not hit
+Linus's tree yet. Revert this to resolve those problems.
+
+Cc: Alexander Tsoy <alexander@tsoy.me>
+Cc: Takashi Iwai <tiwai@suse.de>
+Cc: Sasha Levin <sashal@kernel.org>
+Cc: Hans de Goede <jwrdegoede@fedoraproject.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/card.h | 4 ----
+ sound/usb/endpoint.c | 43 +++++--------------------------------------
+ sound/usb/endpoint.h | 1 -
+ sound/usb/pcm.c | 2 --
+ 4 files changed, 5 insertions(+), 45 deletions(-)
+
+--- a/sound/usb/card.h
++++ b/sound/usb/card.h
+@@ -84,10 +84,6 @@ struct snd_usb_endpoint {
+ dma_addr_t sync_dma; /* DMA address of syncbuf */
+
+ unsigned int pipe; /* the data i/o pipe */
+- unsigned int framesize[2]; /* small/large frame sizes in samples */
+- unsigned int sample_rem; /* remainder from division fs/fps */
+- unsigned int sample_accum; /* sample accumulator */
+- unsigned int fps; /* frames per second */
+ unsigned int freqn; /* nominal sampling rate in fs/fps in Q16.16 format */
+ unsigned int freqm; /* momentary sampling rate in fs/fps in Q16.16 format */
+ int freqshift; /* how much to shift the feedback value to get Q16.16 */
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -124,12 +124,12 @@ int snd_usb_endpoint_implicit_feedback_s
+
+ /*
+ * For streaming based on information derived from sync endpoints,
+- * prepare_outbound_urb_sizes() will call slave_next_packet_size() to
++ * prepare_outbound_urb_sizes() will call next_packet_size() to
+ * determine the number of samples to be sent in the next packet.
+ *
+- * For implicit feedback, slave_next_packet_size() is unused.
++ * For implicit feedback, next_packet_size() is unused.
+ */
+-int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep)
++int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
+ {
+ unsigned long flags;
+ int ret;
+@@ -146,29 +146,6 @@ int snd_usb_endpoint_slave_next_packet_s
+ return ret;
+ }
+
+-/*
+- * For adaptive and synchronous endpoints, prepare_outbound_urb_sizes()
+- * will call next_packet_size() to determine the number of samples to be
+- * sent in the next packet.
+- */
+-int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
+-{
+- int ret;
+-
+- if (ep->fill_max)
+- return ep->maxframesize;
+-
+- ep->sample_accum += ep->sample_rem;
+- if (ep->sample_accum >= ep->fps) {
+- ep->sample_accum -= ep->fps;
+- ret = ep->framesize[1];
+- } else {
+- ret = ep->framesize[0];
+- }
+-
+- return ret;
+-}
+-
+ static void retire_outbound_urb(struct snd_usb_endpoint *ep,
+ struct snd_urb_ctx *urb_ctx)
+ {
+@@ -213,8 +190,6 @@ static void prepare_silent_urb(struct sn
+
+ if (ctx->packet_size[i])
+ counts = ctx->packet_size[i];
+- else if (ep->sync_master)
+- counts = snd_usb_endpoint_slave_next_packet_size(ep);
+ else
+ counts = snd_usb_endpoint_next_packet_size(ep);
+
+@@ -1086,17 +1061,10 @@ int snd_usb_endpoint_set_params(struct s
+ ep->maxpacksize = fmt->maxpacksize;
+ ep->fill_max = !!(fmt->attributes & UAC_EP_CS_ATTR_FILL_MAX);
+
+- if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) {
++ if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL)
+ ep->freqn = get_usb_full_speed_rate(rate);
+- ep->fps = 1000;
+- } else {
++ else
+ ep->freqn = get_usb_high_speed_rate(rate);
+- ep->fps = 8000;
+- }
+-
+- ep->sample_rem = rate % ep->fps;
+- ep->framesize[0] = rate / ep->fps;
+- ep->framesize[1] = (rate + (ep->fps - 1)) / ep->fps;
+
+ /* calculate the frequency in 16.16 format */
+ ep->freqm = ep->freqn;
+@@ -1155,7 +1123,6 @@ int snd_usb_endpoint_start(struct snd_us
+ ep->active_mask = 0;
+ ep->unlink_mask = 0;
+ ep->phase = 0;
+- ep->sample_accum = 0;
+
+ snd_usb_endpoint_start_quirk(ep);
+
+--- a/sound/usb/endpoint.h
++++ b/sound/usb/endpoint.h
+@@ -28,7 +28,6 @@ void snd_usb_endpoint_release(struct snd
+ void snd_usb_endpoint_free(struct snd_usb_endpoint *ep);
+
+ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep);
+-int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep);
+ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep);
+
+ void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep,
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1581,8 +1581,6 @@ static void prepare_playback_urb(struct
+ for (i = 0; i < ctx->packets; i++) {
+ if (ctx->packet_size[i])
+ counts = ctx->packet_size[i];
+- else if (ep->sync_master)
+- counts = snd_usb_endpoint_slave_next_packet_size(ep);
+ else
+ counts = snd_usb_endpoint_next_packet_size(ep);
+
samples-vfs-avoid-warning-in-statx-override.patch
i2c-algo-pca-add-0x78-as-scl-stuck-low-status-for-pc.patch
i2c-mlxcpld-check-correct-size-of-maximum-recv_len-p.patch
+spi-spi-fsl-dspi-fix-external-abort-on-interrupt-in-resume-or-exit-paths.patch
+nfsd-apply-umask-on-fs-without-acl-support.patch
+revert-alsa-usb-audio-improve-frames-size-computation.patch
+smb3-honor-seal-flag-for-multiuser-mounts.patch
+smb3-honor-persistent-resilient-handle-flags-for-multiuser-mounts.patch
+smb3-honor-lease-disabling-for-multiuser-mounts.patch
+smb3-honor-handletimeout-flag-for-multiuser-mounts.patch
+cifs-fix-the-target-file-was-deleted-when-rename-failed.patch
+mips-lantiq-xway-sysctrl-fix-the-gphy-clock-alias-names.patch
+mips-add-missing-ehb-in-mtc0-mfc0-sequence-for-dspen.patch
+drm-amd-display-only-revalidate-bandwidth-on-medium-and-fast-updates.patch
+drm-amdgpu-use-u-rather-than-d-for-sclk-mclk.patch
+drm-amdgpu-atomfirmware-fix-vram_info-fetching-for-renoir.patch
+dma-buf-move-dma_buf_release-from-fops-to-dentry_ops.patch
+irqchip-gic-atomically-update-affinity.patch
+mm-compaction-fully-assume-capture-is-not-null-in-compact_zone_order.patch
+mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch
--- /dev/null
+From 6b356f6cf941d5054d7fab072cae4a5f8658e3db Mon Sep 17 00:00:00 2001
+From: Paul Aurich <paul@darkrain42.org>
+Date: Fri, 26 Jun 2020 12:58:08 -0700
+Subject: SMB3: Honor 'handletimeout' flag for multiuser mounts
+
+From: Paul Aurich <paul@darkrain42.org>
+
+commit 6b356f6cf941d5054d7fab072cae4a5f8658e3db upstream.
+
+Fixes: ca567eb2b3f0 ("SMB3: Allow persistent handle timeout to be configurable on mount")
+Signed-off-by: Paul Aurich <paul@darkrain42.org>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/connect.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -5284,6 +5284,7 @@ cifs_construct_tcon(struct cifs_sb_info
+ vol_info->no_lease = master_tcon->no_lease;
+ vol_info->resilient = master_tcon->use_resilient;
+ vol_info->persistent = master_tcon->use_persistent;
++ vol_info->handle_timeout = master_tcon->handle_timeout;
+ vol_info->no_linux_ext = !master_tcon->unix_ext;
+ vol_info->linux_ext = master_tcon->posix_extensions;
+ vol_info->sectype = master_tcon->ses->sectype;
--- /dev/null
+From ad35f169db6cd5a4c5c0a5a42fb0cad3efeccb83 Mon Sep 17 00:00:00 2001
+From: Paul Aurich <paul@darkrain42.org>
+Date: Fri, 26 Jun 2020 12:58:07 -0700
+Subject: SMB3: Honor lease disabling for multiuser mounts
+
+From: Paul Aurich <paul@darkrain42.org>
+
+commit ad35f169db6cd5a4c5c0a5a42fb0cad3efeccb83 upstream.
+
+Fixes: 3e7a02d47872 ("smb3: allow disabling requesting leases")
+Signed-off-by: Paul Aurich <paul@darkrain42.org>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/connect.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -5281,6 +5281,7 @@ cifs_construct_tcon(struct cifs_sb_info
+ vol_info->nocase = master_tcon->nocase;
+ vol_info->nohandlecache = master_tcon->nohandlecache;
+ vol_info->local_lease = master_tcon->local_lease;
++ vol_info->no_lease = master_tcon->no_lease;
+ vol_info->resilient = master_tcon->use_resilient;
+ vol_info->persistent = master_tcon->use_persistent;
+ vol_info->no_linux_ext = !master_tcon->unix_ext;
--- /dev/null
+From 00dfbc2f9c61185a2e662f27c45a0bb29b2a134f Mon Sep 17 00:00:00 2001
+From: Paul Aurich <paul@darkrain42.org>
+Date: Fri, 26 Jun 2020 12:58:06 -0700
+Subject: SMB3: Honor persistent/resilient handle flags for multiuser mounts
+
+From: Paul Aurich <paul@darkrain42.org>
+
+commit 00dfbc2f9c61185a2e662f27c45a0bb29b2a134f upstream.
+
+Without this:
+
+- persistent handles will only be enabled for per-user tcons if the
+ server advertises the 'Continuous Availabity' capability
+- resilient handles would never be enabled for per-user tcons
+
+Signed-off-by: Paul Aurich <paul@darkrain42.org>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/connect.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -5281,6 +5281,8 @@ cifs_construct_tcon(struct cifs_sb_info
+ vol_info->nocase = master_tcon->nocase;
+ vol_info->nohandlecache = master_tcon->nohandlecache;
+ vol_info->local_lease = master_tcon->local_lease;
++ vol_info->resilient = master_tcon->use_resilient;
++ vol_info->persistent = master_tcon->use_persistent;
+ vol_info->no_linux_ext = !master_tcon->unix_ext;
+ vol_info->linux_ext = master_tcon->posix_extensions;
+ vol_info->sectype = master_tcon->ses->sectype;
--- /dev/null
+From cc15461c73d7d044d56c47e869a215e49bd429c8 Mon Sep 17 00:00:00 2001
+From: Paul Aurich <paul@darkrain42.org>
+Date: Fri, 26 Jun 2020 12:58:05 -0700
+Subject: SMB3: Honor 'seal' flag for multiuser mounts
+
+From: Paul Aurich <paul@darkrain42.org>
+
+commit cc15461c73d7d044d56c47e869a215e49bd429c8 upstream.
+
+Ensure multiuser SMB3 mounts use encryption for all users' tcons if the
+mount options are configured to require encryption. Without this, only
+the primary tcon and IPC tcons are guaranteed to be encrypted. Per-user
+tcons would only be encrypted if the server was configured to require
+encryption.
+
+Signed-off-by: Paul Aurich <paul@darkrain42.org>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/connect.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -5285,6 +5285,7 @@ cifs_construct_tcon(struct cifs_sb_info
+ vol_info->linux_ext = master_tcon->posix_extensions;
+ vol_info->sectype = master_tcon->ses->sectype;
+ vol_info->sign = master_tcon->ses->sign;
++ vol_info->seal = master_tcon->seal;
+
+ rc = cifs_set_vol_auth(vol_info, master_tcon->ses);
+ if (rc) {
--- /dev/null
+From 3d87b613d6a3c6f0980e877ab0895785a2dde581 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Mon, 22 Jun 2020 13:05:42 +0200
+Subject: spi: spi-fsl-dspi: Fix external abort on interrupt in resume or exit paths
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit 3d87b613d6a3c6f0980e877ab0895785a2dde581 upstream.
+
+If shared interrupt comes late, during probe error path or device remove
+(could be triggered with CONFIG_DEBUG_SHIRQ), the interrupt handler
+dspi_interrupt() will access registers with the clock being disabled.
+This leads to external abort on non-linefetch on Toradex Colibri VF50
+module (with Vybrid VF5xx):
+
+ $ echo 4002d000.spi > /sys/devices/platform/soc/40000000.bus/4002d000.spi/driver/unbind
+
+ Unhandled fault: external abort on non-linefetch (0x1008) at 0x8887f02c
+ Internal error: : 1008 [#1] ARM
+ Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree)
+ Backtrace:
+ (regmap_mmio_read32le)
+ (regmap_mmio_read)
+ (_regmap_bus_reg_read)
+ (_regmap_read)
+ (regmap_read)
+ (dspi_interrupt)
+ (free_irq)
+ (devm_irq_release)
+ (release_nodes)
+ (devres_release_all)
+ (device_release_driver_internal)
+
+The resource-managed framework should not be used for shared interrupt
+handling, because the interrupt handler might be called after releasing
+other resources and disabling clocks.
+
+Similar bug could happen during suspend - the shared interrupt handler
+could be invoked after suspending the device. Each device sharing this
+interrupt line should disable the IRQ during suspend so handler will be
+invoked only in following cases:
+1. None suspended,
+2. All devices resumed.
+
+Fixes: 349ad66c0ab0 ("spi:Add Freescale DSPI driver for Vybrid VF610 platform")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200622110543.5035-3-krzk@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-fsl-dspi.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -901,6 +901,8 @@ static int dspi_suspend(struct device *d
+ struct spi_controller *ctlr = dev_get_drvdata(dev);
+ struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr);
+
++ if (dspi->irq)
++ disable_irq(dspi->irq);
+ spi_controller_suspend(ctlr);
+ clk_disable_unprepare(dspi->clk);
+
+@@ -921,6 +923,8 @@ static int dspi_resume(struct device *de
+ if (ret)
+ return ret;
+ spi_controller_resume(ctlr);
++ if (dspi->irq)
++ enable_irq(dspi->irq);
+
+ return 0;
+ }
+@@ -1108,8 +1112,8 @@ static int dspi_probe(struct platform_de
+ goto poll_mode;
+ }
+
+- ret = devm_request_irq(&pdev->dev, dspi->irq, dspi_interrupt,
+- IRQF_SHARED, pdev->name, dspi);
++ ret = request_threaded_irq(dspi->irq, dspi_interrupt, NULL,
++ IRQF_SHARED, pdev->name, dspi);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Unable to attach DSPI interrupt\n");
+ goto out_clk_put;
+@@ -1122,7 +1126,7 @@ poll_mode:
+ ret = dspi_request_dma(dspi, res->start);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "can't get dma channels\n");
+- goto out_clk_put;
++ goto out_free_irq;
+ }
+ }
+
+@@ -1134,11 +1138,14 @@ poll_mode:
+ ret = spi_register_controller(ctlr);
+ if (ret != 0) {
+ dev_err(&pdev->dev, "Problem registering DSPI ctlr\n");
+- goto out_clk_put;
++ goto out_free_irq;
+ }
+
+ return ret;
+
++out_free_irq:
++ if (dspi->irq)
++ free_irq(dspi->irq, dspi);
+ out_clk_put:
+ clk_disable_unprepare(dspi->clk);
+ out_ctlr_put:
+@@ -1154,6 +1161,8 @@ static int dspi_remove(struct platform_d
+
+ /* Disconnect from the SPI framework */
+ dspi_release_dma(dspi);
++ if (dspi->irq)
++ free_irq(dspi->irq, dspi);
+ clk_disable_unprepare(dspi->clk);
+ spi_unregister_controller(dspi->ctlr);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
