--- /dev/null
+From 60858c00e5f018eda711a3aa84cf62214ef62d61 Mon Sep 17 00:00:00 2001
+From: David Hildenbrand <david@redhat.com>
+Date: Fri, 22 May 2020 22:22:42 -0700
+Subject: device-dax: don't leak kernel memory to user space after unloading kmem
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Hildenbrand <david@redhat.com>
+
+commit 60858c00e5f018eda711a3aa84cf62214ef62d61 upstream.
+
+Assume we have kmem configured and loaded:
+
+ [root@localhost ~]# cat /proc/iomem
+ ...
+ 140000000-33fffffff : Persistent Memory$
+ 140000000-1481fffff : namespace0.0
+ 150000000-33fffffff : dax0.0
+ 150000000-33fffffff : System RAM
+
+Assume we try to unload kmem. This force-unloading will work, even if
+memory cannot get removed from the system.
+
+ [root@localhost ~]# rmmod kmem
+ [ 86.380228] removing memory fails, because memory [0x0000000150000000-0x0000000157ffffff] is onlined
+ ...
+ [ 86.431225] kmem dax0.0: DAX region [mem 0x150000000-0x33fffffff] cannot be hotremoved until the next reboot
+
+Now, we can reconfigure the namespace:
+
+ [root@localhost ~]# ndctl create-namespace --force --reconfig=namespace0.0 --mode=devdax
+ [ 131.409351] nd_pmem namespace0.0: could not reserve region [mem 0x140000000-0x33fffffff]dax
+ [ 131.410147] nd_pmem: probe of namespace0.0 failed with error -16namespace0.0 --mode=devdax
+ ...
+
+This fails as expected due to the busy memory resource, and the memory
+cannot be used. However, the dax0.0 device is removed, and along its
+name.
+
+The name of the memory resource now points at freed memory (name of the
+device):
+
+ [root@localhost ~]# cat /proc/iomem
+ ...
+ 140000000-33fffffff : Persistent Memory
+ 140000000-1481fffff : namespace0.0
+ 150000000-33fffffff : �_�^7_��/_��wR��WQ���^��� ...
+ 150000000-33fffffff : System RAM
+
+We have to make sure to duplicate the string. While at it, remove the
+superfluous setting of the name and fixup a stale comment.
+
+Fixes: 9f960da72b25 ("device-dax: "Hotremove" persistent memory that is used like normal RAM")
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: Vishal Verma <vishal.l.verma@intel.com>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Pavel Tatashin <pasha.tatashin@soleen.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: <stable@vger.kernel.org> [5.3]
+Link: http://lkml.kernel.org/r/20200508084217.9160-2-david@redhat.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dax/kmem.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/dax/kmem.c
++++ b/drivers/dax/kmem.c
+@@ -22,6 +22,7 @@ int dev_dax_kmem_probe(struct device *de
+ resource_size_t kmem_size;
+ resource_size_t kmem_end;
+ struct resource *new_res;
++ const char *new_res_name;
+ int numa_node;
+ int rc;
+
+@@ -48,11 +49,16 @@ int dev_dax_kmem_probe(struct device *de
+ kmem_size &= ~(memory_block_size_bytes() - 1);
+ kmem_end = kmem_start + kmem_size;
+
+- /* Region is permanently reserved. Hot-remove not yet implemented. */
+- new_res = request_mem_region(kmem_start, kmem_size, dev_name(dev));
++ new_res_name = kstrdup(dev_name(dev), GFP_KERNEL);
++ if (!new_res_name)
++ return -ENOMEM;
++
++ /* Region is permanently reserved if hotremove fails. */
++ new_res = request_mem_region(kmem_start, kmem_size, new_res_name);
+ if (!new_res) {
+ dev_warn(dev, "could not reserve region [%pa-%pa]\n",
+ &kmem_start, &kmem_end);
++ kfree(new_res_name);
+ return -EBUSY;
+ }
+
+@@ -63,12 +69,12 @@ int dev_dax_kmem_probe(struct device *de
+ * unknown to us that will break add_memory() below.
+ */
+ new_res->flags = IORESOURCE_SYSTEM_RAM;
+- new_res->name = dev_name(dev);
+
+ rc = add_memory(numa_node, new_res->start, resource_size(new_res));
+ if (rc) {
+ release_resource(new_res);
+ kfree(new_res);
++ kfree(new_res_name);
+ return rc;
+ }
+ dev_dax->dax_kmem_res = new_res;
+@@ -83,6 +89,7 @@ static int dev_dax_kmem_remove(struct de
+ struct resource *res = dev_dax->dax_kmem_res;
+ resource_size_t kmem_start = res->start;
+ resource_size_t kmem_size = resource_size(res);
++ const char *res_name = res->name;
+ int rc;
+
+ /*
+@@ -102,6 +109,7 @@ static int dev_dax_kmem_remove(struct de
+ /* Release and free dax resources */
+ release_resource(res);
+ kfree(res);
++ kfree(res_name);
+ dev_dax->dax_kmem_res = NULL;
+
+ return 0;
--- /dev/null
+From bcfa1e253d2e329e1ebab5c89f3c73f6dd17606c Mon Sep 17 00:00:00 2001
+From: Gregory CLEMENT <gregory.clement@bootlin.com>
+Date: Thu, 30 Apr 2020 15:05:47 +0200
+Subject: iio: adc: ti-ads8344: Fix channel selection
+
+From: Gregory CLEMENT <gregory.clement@bootlin.com>
+
+commit bcfa1e253d2e329e1ebab5c89f3c73f6dd17606c upstream.
+
+During initial submission the selection of the channel was done using
+the scan_index member of the iio_chan_spec structure. It was an abuse
+because this member is supposed to be used with a buffer so it was
+removed.
+
+However there was still the need to be able to known how to select a
+channel, the correct member to store this information is address.
+
+Thanks to this it is possible to select any other channel than the
+channel 0.
+
+Fixes: 8dd2d7c0fed7 ("iio: adc: Add driver for the TI ADS8344 A/DC chips")
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/ti-ads8344.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/adc/ti-ads8344.c
++++ b/drivers/iio/adc/ti-ads8344.c
+@@ -32,16 +32,17 @@ struct ads8344 {
+ u8 rx_buf[3];
+ };
+
+-#define ADS8344_VOLTAGE_CHANNEL(chan, si) \
++#define ADS8344_VOLTAGE_CHANNEL(chan, addr) \
+ { \
+ .type = IIO_VOLTAGE, \
+ .indexed = 1, \
+ .channel = chan, \
+ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \
+ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), \
++ .address = addr, \
+ }
+
+-#define ADS8344_VOLTAGE_CHANNEL_DIFF(chan1, chan2, si) \
++#define ADS8344_VOLTAGE_CHANNEL_DIFF(chan1, chan2, addr) \
+ { \
+ .type = IIO_VOLTAGE, \
+ .indexed = 1, \
+@@ -50,6 +51,7 @@ struct ads8344 {
+ .differential = 1, \
+ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \
+ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), \
++ .address = addr, \
+ }
+
+ static const struct iio_chan_spec ads8344_channels[] = {
+@@ -105,7 +107,7 @@ static int ads8344_read_raw(struct iio_d
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
+ mutex_lock(&adc->lock);
+- *value = ads8344_adc_conversion(adc, channel->scan_index,
++ *value = ads8344_adc_conversion(adc, channel->address,
+ channel->differential);
+ mutex_unlock(&adc->lock);
+ if (*value < 0)
--- /dev/null
+From aad4742fbf0a560c25827adb58695a4497ffc204 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 26 Apr 2020 21:44:03 +0200
+Subject: iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit aad4742fbf0a560c25827adb58695a4497ffc204 upstream.
+
+A call to 'vf610_dac_exit()' is missing in an error handling path.
+
+Fixes: 1b983bf42fad ("iio: dac: vf610_dac: Add IIO DAC driver for Vybrid SoC")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/dac/vf610_dac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/dac/vf610_dac.c
++++ b/drivers/iio/dac/vf610_dac.c
+@@ -225,6 +225,7 @@ static int vf610_dac_probe(struct platfo
+ return 0;
+
+ error_iio_device_register:
++ vf610_dac_exit(info);
+ clk_disable_unprepare(info->clk);
+
+ return ret;
--- /dev/null
+From 928edefbc18cd8433f7df235c6e09a9306e7d580 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Wed, 6 May 2020 05:52:06 +0200
+Subject: iio: sca3000: Remove an erroneous 'get_device()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 928edefbc18cd8433f7df235c6e09a9306e7d580 upstream.
+
+This looks really unusual to have a 'get_device()' hidden in a 'dev_err()'
+call.
+Remove it.
+
+While at it add a missing \n at the end of the message.
+
+Fixes: 574fb258d636 ("Staging: IIO: VTI sca3000 series accelerometer driver (spi)")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/sca3000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/accel/sca3000.c
++++ b/drivers/iio/accel/sca3000.c
+@@ -980,7 +980,7 @@ static int sca3000_read_data(struct sca3
+ st->tx[0] = SCA3000_READ_REG(reg_address_high);
+ ret = spi_sync_transfer(st->us, xfer, ARRAY_SIZE(xfer));
+ if (ret) {
+- dev_err(get_device(&st->us->dev), "problem reading register");
++ dev_err(&st->us->dev, "problem reading register\n");
+ return ret;
+ }
+
--- /dev/null
+From 133317479f0324f6faaf797c4f5f3e9b1b36ce35 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Thu, 7 May 2020 09:42:37 +0000
+Subject: ipack: tpci200: fix error return code in tpci200_register()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit 133317479f0324f6faaf797c4f5f3e9b1b36ce35 upstream.
+
+Fix to return negative error code -ENOMEM from the ioremap() error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 43986798fd50 ("ipack: add error handling for ioremap_nocache")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Samuel Iglesias Gonsalvez <siglesias@igalia.com>
+Link: https://lore.kernel.org/r/20200507094237.13599-1-weiyongjun1@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ipack/carriers/tpci200.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ipack/carriers/tpci200.c
++++ b/drivers/ipack/carriers/tpci200.c
+@@ -306,6 +306,7 @@ static int tpci200_register(struct tpci2
+ "(bn 0x%X, sn 0x%X) failed to map driver user space!",
+ tpci200->info->pdev->bus->number,
+ tpci200->info->pdev->devfn);
++ res = -ENOMEM;
+ goto out_release_mem8_space;
+ }
+
--- /dev/null
+From 33cd65e73abd693c00c4156cf23677c453b41b3b Mon Sep 17 00:00:00 2001
+From: Marco Elver <elver@google.com>
+Date: Fri, 22 May 2020 22:22:59 -0700
+Subject: kasan: disable branch tracing for core runtime
+
+From: Marco Elver <elver@google.com>
+
+commit 33cd65e73abd693c00c4156cf23677c453b41b3b upstream.
+
+During early boot, while KASAN is not yet initialized, it is possible to
+enter reporting code-path and end up in kasan_report().
+
+While uninitialized, the branch there prevents generating any reports,
+however, under certain circumstances when branches are being traced
+(TRACE_BRANCH_PROFILING), we may recurse deep enough to cause kernel
+reboots without warning.
+
+To prevent similar issues in future, we should disable branch tracing
+for the core runtime.
+
+[elver@google.com: remove duplicate DISABLE_BRANCH_PROFILING, per Qian Cai]
+ Link: https://lore.kernel.org/lkml/20200517011732.GE24705@shao2-debian/
+ Link: http://lkml.kernel.org/r/20200522075207.157349-1-elver@google.com
+Reported-by: kernel test robot <rong.a.chen@intel.com>
+Signed-off-by: Marco Elver <elver@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: Qian Cai <cai@lca.pw>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r//20200517011732.GE24705@shao2-debian/
+Link: http://lkml.kernel.org/r/20200519182459.87166-1-elver@google.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/kasan/Makefile | 8 ++++----
+ mm/kasan/generic.c | 1 -
+ mm/kasan/tags.c | 1 -
+ 3 files changed, 4 insertions(+), 6 deletions(-)
+
+--- a/mm/kasan/Makefile
++++ b/mm/kasan/Makefile
+@@ -14,10 +14,10 @@ CFLAGS_REMOVE_tags.o = $(CC_FLAGS_FTRACE
+ # Function splitter causes unnecessary splits in __asan_load1/__asan_store1
+ # see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63533
+
+-CFLAGS_common.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector)
+-CFLAGS_generic.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector)
+-CFLAGS_generic_report.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector)
+-CFLAGS_tags.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector)
++CFLAGS_common.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING
++CFLAGS_generic.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING
++CFLAGS_generic_report.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING
++CFLAGS_tags.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING
+
+ obj-$(CONFIG_KASAN) := common.o init.o report.o
+ obj-$(CONFIG_KASAN_GENERIC) += generic.o generic_report.o quarantine.o
+--- a/mm/kasan/generic.c
++++ b/mm/kasan/generic.c
+@@ -15,7 +15,6 @@
+ */
+
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+-#define DISABLE_BRANCH_PROFILING
+
+ #include <linux/export.h>
+ #include <linux/interrupt.h>
+--- a/mm/kasan/tags.c
++++ b/mm/kasan/tags.c
+@@ -12,7 +12,6 @@
+ */
+
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+-#define DISABLE_BRANCH_PROFILING
+
+ #include <linux/export.h>
+ #include <linux/interrupt.h>
--- /dev/null
+From fc9c03ce30f79b71807961bfcb42be191af79873 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Wed, 13 May 2020 01:31:40 +0300
+Subject: mei: release me_cl object reference
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit fc9c03ce30f79b71807961bfcb42be191af79873 upstream.
+
+Allow me_cl object to be freed by releasing the reference
+that was acquired by one of the search functions:
+__mei_me_cl_by_uuid_id() or __mei_me_cl_by_uuid()
+
+Cc: <stable@vger.kernel.org>
+Reported-by: 亿一 <teroincn@gmail.com>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20200512223140.32186-1-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/client.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -266,6 +266,7 @@ void mei_me_cl_rm_by_uuid(struct mei_dev
+ down_write(&dev->me_clients_rwsem);
+ me_cl = __mei_me_cl_by_uuid(dev, uuid);
+ __mei_me_cl_del(dev, me_cl);
++ mei_me_cl_put(me_cl);
+ up_write(&dev->me_clients_rwsem);
+ }
+
+@@ -287,6 +288,7 @@ void mei_me_cl_rm_by_uuid_id(struct mei_
+ down_write(&dev->me_clients_rwsem);
+ me_cl = __mei_me_cl_by_uuid_id(dev, uuid, id);
+ __mei_me_cl_del(dev, me_cl);
++ mei_me_cl_put(me_cl);
+ up_write(&dev->me_clients_rwsem);
+ }
+
--- /dev/null
+From 7a839dbab1be59f5ed3b3b046de29e166784c9b4 Mon Sep 17 00:00:00 2001
+From: Klaus Doth <kdlnx@doth.eu>
+Date: Fri, 22 May 2020 12:56:04 +0200
+Subject: misc: rtsx: Add short delay after exit from ASPM
+
+From: Klaus Doth <kdlnx@doth.eu>
+
+commit 7a839dbab1be59f5ed3b3b046de29e166784c9b4 upstream.
+
+DMA transfers to and from the SD card stall for 10 seconds and run into
+timeout on RTS5260 card readers after ASPM was enabled.
+
+Adding a short msleep after disabling ASPM fixes the issue on several
+Dell Precision 7530/7540 systems I tested.
+
+This function is only called when waking up after the chip went into
+power-save after not transferring data for a few seconds. The added
+msleep does therefore not change anything in data transfer speed or
+induce any excessive waiting while data transfers are running, or the
+chip is sleeping. Only the transition from sleep to active is affected.
+
+Signed-off-by: Klaus Doth <kdlnx@doth.eu>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/4434eaa7-2ee3-a560-faee-6cee63ebd6d4@doth.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/cardreader/rtsx_pcr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/misc/cardreader/rtsx_pcr.c
++++ b/drivers/misc/cardreader/rtsx_pcr.c
+@@ -143,6 +143,9 @@ static void rtsx_comm_pm_full_on(struct
+
+ rtsx_disable_aspm(pcr);
+
++ /* Fixes DMA transfer timout issue after disabling ASPM on RTS5260 */
++ msleep(1);
++
+ if (option->ltr_enabled)
+ rtsx_set_ltr_latency(pcr, option->ltr_active_latency);
+
--- /dev/null
+From ffca476a0a8d26de767cc41d62b8ca7f540ecfdd Mon Sep 17 00:00:00 2001
+From: John Hubbard <jhubbard@nvidia.com>
+Date: Fri, 22 May 2020 22:22:48 -0700
+Subject: rapidio: fix an error in get_user_pages_fast() error handling
+
+From: John Hubbard <jhubbard@nvidia.com>
+
+commit ffca476a0a8d26de767cc41d62b8ca7f540ecfdd upstream.
+
+In the case of get_user_pages_fast() returning fewer pages than
+requested, rio_dma_transfer() does not quite do the right thing. It
+attempts to release all the pages that were requested, rather than just
+the pages that were pinned.
+
+Fix the error handling so that only the pages that were successfully
+pinned are released.
+
+Fixes: e8de370188d0 ("rapidio: add mport char device driver")
+Signed-off-by: John Hubbard <jhubbard@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Matt Porter <mporter@kernel.crashing.org>
+Cc: Alexandre Bounine <alex.bou9@gmail.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20200517235620.205225-2-jhubbard@nvidia.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rapidio/devices/rio_mport_cdev.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/rapidio/devices/rio_mport_cdev.c
++++ b/drivers/rapidio/devices/rio_mport_cdev.c
+@@ -877,6 +877,11 @@ rio_dma_transfer(struct file *filp, u32
+ rmcd_error("pinned %ld out of %ld pages",
+ pinned, nr_pages);
+ ret = -EFAULT;
++ /*
++ * Set nr_pages up to mean "how many pages to unpin, in
++ * the error handler:
++ */
++ nr_pages = pinned;
+ goto err_pg;
+ }
+
--- /dev/null
+From 4c1cbcbd6c56c79de2c07159be4f55386bb0bef2 Mon Sep 17 00:00:00 2001
+From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Date: Wed, 6 May 2020 13:45:52 +0200
+Subject: s390/kaslr: add support for R_390_JMP_SLOT relocation type
+
+From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+
+commit 4c1cbcbd6c56c79de2c07159be4f55386bb0bef2 upstream.
+
+With certain kernel configurations, the R_390_JMP_SLOT relocation type
+might be generated, which is not expected by the KASLR relocation code,
+and the kernel stops with the message "Unknown relocation type".
+
+This was found with a zfcpdump kernel config, where CONFIG_MODULES=n
+and CONFIG_VFIO=n. In that case, symbol_get() is used on undefined
+__weak symbols in virt/kvm/vfio.c, which results in the generation
+of R_390_JMP_SLOT relocation types.
+
+Fix this by handling R_390_JMP_SLOT similar to R_390_GLOB_DAT.
+
+Fixes: 805bc0bc238f ("s390/kernel: build a relocatable kernel")
+Cc: <stable@vger.kernel.org> # v5.2+
+Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kernel/machine_kexec_reloc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/s390/kernel/machine_kexec_reloc.c
++++ b/arch/s390/kernel/machine_kexec_reloc.c
+@@ -28,6 +28,7 @@ int arch_kexec_do_relocs(int r_type, voi
+ break;
+ case R_390_64: /* Direct 64 bit. */
+ case R_390_GLOB_DAT:
++ case R_390_JMP_SLOT:
+ *(u64 *)loc = val;
+ break;
+ case R_390_PC16: /* PC relative 16 bit. */
--- /dev/null
+From f058599e22d59e594e5aae1dc10560568d8f4a8b Mon Sep 17 00:00:00 2001
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+Date: Thu, 26 Mar 2020 12:22:50 +0100
+Subject: s390/pci: Fix s390_mmio_read/write with MIO
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+commit f058599e22d59e594e5aae1dc10560568d8f4a8b upstream.
+
+The s390_mmio_read/write syscalls are currently broken when running with
+MIO.
+
+The new pcistb_mio/pcstg_mio/pcilg_mio instructions are executed
+similiarly to normal load/store instructions and do address translation
+in the current address space. That means inside the kernel they are
+aware of mappings into kernel address space while outside the kernel
+they use user space mappings (usually created through mmap'ing a PCI
+device file).
+
+Now when existing user space applications use the s390_pci_mmio_write
+and s390_pci_mmio_read syscalls, they pass I/O addresses that are mapped
+into user space so as to be usable with the new instructions without
+needing a syscall. Accessing these addresses with the old instructions
+as done currently leads to a kernel panic.
+
+Also, for such a user space mapping there may not exist an equivalent
+kernel space mapping which means we can't just use the new instructions
+in kernel space.
+
+Instead of replicating user mappings in the kernel which then might
+collide with other mappings, we can conceptually execute the new
+instructions as if executed by the user space application using the
+secondary address space. This even allows us to directly store to the
+user pointer without the need for copy_to/from_user().
+
+Cc: stable@vger.kernel.org
+Fixes: 71ba41c9b1d9 ("s390/pci: provide support for MIO instructions")
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/include/asm/pci_io.h | 10 +
+ arch/s390/pci/pci_mmio.c | 213 ++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 219 insertions(+), 4 deletions(-)
+
+--- a/arch/s390/include/asm/pci_io.h
++++ b/arch/s390/include/asm/pci_io.h
+@@ -8,6 +8,10 @@
+ #include <linux/slab.h>
+ #include <asm/pci_insn.h>
+
++/* I/O size constraints */
++#define ZPCI_MAX_READ_SIZE 8
++#define ZPCI_MAX_WRITE_SIZE 128
++
+ /* I/O Map */
+ #define ZPCI_IOMAP_SHIFT 48
+ #define ZPCI_IOMAP_ADDR_BASE 0x8000000000000000UL
+@@ -140,7 +144,8 @@ static inline int zpci_memcpy_fromio(voi
+
+ while (n > 0) {
+ size = zpci_get_max_write_size((u64 __force) src,
+- (u64) dst, n, 8);
++ (u64) dst, n,
++ ZPCI_MAX_READ_SIZE);
+ rc = zpci_read_single(dst, src, size);
+ if (rc)
+ break;
+@@ -161,7 +166,8 @@ static inline int zpci_memcpy_toio(volat
+
+ while (n > 0) {
+ size = zpci_get_max_write_size((u64 __force) dst,
+- (u64) src, n, 128);
++ (u64) src, n,
++ ZPCI_MAX_WRITE_SIZE);
+ if (size > 8) /* main path */
+ rc = zpci_write_block(dst, src, size);
+ else
+--- a/arch/s390/pci/pci_mmio.c
++++ b/arch/s390/pci/pci_mmio.c
+@@ -11,6 +11,113 @@
+ #include <linux/mm.h>
+ #include <linux/errno.h>
+ #include <linux/pci.h>
++#include <asm/pci_io.h>
++#include <asm/pci_debug.h>
++
++static inline void zpci_err_mmio(u8 cc, u8 status, u64 offset)
++{
++ struct {
++ u64 offset;
++ u8 cc;
++ u8 status;
++ } data = {offset, cc, status};
++
++ zpci_err_hex(&data, sizeof(data));
++}
++
++static inline int __pcistb_mio_inuser(
++ void __iomem *ioaddr, const void __user *src,
++ u64 len, u8 *status)
++{
++ int cc = -ENXIO;
++
++ asm volatile (
++ " sacf 256\n"
++ "0: .insn rsy,0xeb00000000d4,%[len],%[ioaddr],%[src]\n"
++ "1: ipm %[cc]\n"
++ " srl %[cc],28\n"
++ "2: sacf 768\n"
++ EX_TABLE(0b, 2b) EX_TABLE(1b, 2b)
++ : [cc] "+d" (cc), [len] "+d" (len)
++ : [ioaddr] "a" (ioaddr), [src] "Q" (*((u8 __force *)src))
++ : "cc", "memory");
++ *status = len >> 24 & 0xff;
++ return cc;
++}
++
++static inline int __pcistg_mio_inuser(
++ void __iomem *ioaddr, const void __user *src,
++ u64 ulen, u8 *status)
++{
++ register u64 addr asm("2") = (u64 __force) ioaddr;
++ register u64 len asm("3") = ulen;
++ int cc = -ENXIO;
++ u64 val = 0;
++ u64 cnt = ulen;
++ u8 tmp;
++
++ /*
++ * copy 0 < @len <= 8 bytes from @src into the right most bytes of
++ * a register, then store it to PCI at @ioaddr while in secondary
++ * address space. pcistg then uses the user mappings.
++ */
++ asm volatile (
++ " sacf 256\n"
++ "0: llgc %[tmp],0(%[src])\n"
++ " sllg %[val],%[val],8\n"
++ " aghi %[src],1\n"
++ " ogr %[val],%[tmp]\n"
++ " brctg %[cnt],0b\n"
++ "1: .insn rre,0xb9d40000,%[val],%[ioaddr]\n"
++ "2: ipm %[cc]\n"
++ " srl %[cc],28\n"
++ "3: sacf 768\n"
++ EX_TABLE(0b, 3b) EX_TABLE(1b, 3b) EX_TABLE(2b, 3b)
++ :
++ [src] "+a" (src), [cnt] "+d" (cnt),
++ [val] "+d" (val), [tmp] "=d" (tmp),
++ [len] "+d" (len), [cc] "+d" (cc),
++ [ioaddr] "+a" (addr)
++ :: "cc", "memory");
++ *status = len >> 24 & 0xff;
++
++ /* did we read everything from user memory? */
++ if (!cc && cnt != 0)
++ cc = -EFAULT;
++
++ return cc;
++}
++
++static inline int __memcpy_toio_inuser(void __iomem *dst,
++ const void __user *src, size_t n)
++{
++ int size, rc = 0;
++ u8 status = 0;
++ mm_segment_t old_fs;
++
++ if (!src)
++ return -EINVAL;
++
++ old_fs = enable_sacf_uaccess();
++ while (n > 0) {
++ size = zpci_get_max_write_size((u64 __force) dst,
++ (u64 __force) src, n,
++ ZPCI_MAX_WRITE_SIZE);
++ if (size > 8) /* main path */
++ rc = __pcistb_mio_inuser(dst, src, size, &status);
++ else
++ rc = __pcistg_mio_inuser(dst, src, size, &status);
++ if (rc)
++ break;
++ src += size;
++ dst += size;
++ n -= size;
++ }
++ disable_sacf_uaccess(old_fs);
++ if (rc)
++ zpci_err_mmio(rc, status, (__force u64) dst);
++ return rc;
++}
+
+ static long get_pfn(unsigned long user_addr, unsigned long access,
+ unsigned long *pfn)
+@@ -46,6 +153,20 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, uns
+
+ if (length <= 0 || PAGE_SIZE - (mmio_addr & ~PAGE_MASK) < length)
+ return -EINVAL;
++
++ /*
++ * Only support read access to MIO capable devices on a MIO enabled
++ * system. Otherwise we would have to check for every address if it is
++ * a special ZPCI_ADDR and we would have to do a get_pfn() which we
++ * don't need for MIO capable devices.
++ */
++ if (static_branch_likely(&have_mio)) {
++ ret = __memcpy_toio_inuser((void __iomem *) mmio_addr,
++ user_buffer,
++ length);
++ return ret;
++ }
++
+ if (length > 64) {
+ buf = kmalloc(length, GFP_KERNEL);
+ if (!buf)
+@@ -56,7 +177,8 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, uns
+ ret = get_pfn(mmio_addr, VM_WRITE, &pfn);
+ if (ret)
+ goto out;
+- io_addr = (void __iomem *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK));
++ io_addr = (void __iomem *)((pfn << PAGE_SHIFT) |
++ (mmio_addr & ~PAGE_MASK));
+
+ ret = -EFAULT;
+ if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE)
+@@ -72,6 +194,78 @@ out:
+ return ret;
+ }
+
++static inline int __pcilg_mio_inuser(
++ void __user *dst, const void __iomem *ioaddr,
++ u64 ulen, u8 *status)
++{
++ register u64 addr asm("2") = (u64 __force) ioaddr;
++ register u64 len asm("3") = ulen;
++ u64 cnt = ulen;
++ int shift = ulen * 8;
++ int cc = -ENXIO;
++ u64 val, tmp;
++
++ /*
++ * read 0 < @len <= 8 bytes from the PCI memory mapped at @ioaddr (in
++ * user space) into a register using pcilg then store these bytes at
++ * user address @dst
++ */
++ asm volatile (
++ " sacf 256\n"
++ "0: .insn rre,0xb9d60000,%[val],%[ioaddr]\n"
++ "1: ipm %[cc]\n"
++ " srl %[cc],28\n"
++ " ltr %[cc],%[cc]\n"
++ " jne 4f\n"
++ "2: ahi %[shift],-8\n"
++ " srlg %[tmp],%[val],0(%[shift])\n"
++ "3: stc %[tmp],0(%[dst])\n"
++ " aghi %[dst],1\n"
++ " brctg %[cnt],2b\n"
++ "4: sacf 768\n"
++ EX_TABLE(0b, 4b) EX_TABLE(1b, 4b) EX_TABLE(3b, 4b)
++ :
++ [cc] "+d" (cc), [val] "=d" (val), [len] "+d" (len),
++ [dst] "+a" (dst), [cnt] "+d" (cnt), [tmp] "=d" (tmp),
++ [shift] "+d" (shift)
++ :
++ [ioaddr] "a" (addr)
++ : "cc", "memory");
++
++ /* did we write everything to the user space buffer? */
++ if (!cc && cnt != 0)
++ cc = -EFAULT;
++
++ *status = len >> 24 & 0xff;
++ return cc;
++}
++
++static inline int __memcpy_fromio_inuser(void __user *dst,
++ const void __iomem *src,
++ unsigned long n)
++{
++ int size, rc = 0;
++ u8 status;
++ mm_segment_t old_fs;
++
++ old_fs = enable_sacf_uaccess();
++ while (n > 0) {
++ size = zpci_get_max_write_size((u64 __force) src,
++ (u64 __force) dst, n,
++ ZPCI_MAX_READ_SIZE);
++ rc = __pcilg_mio_inuser(dst, src, size, &status);
++ if (rc)
++ break;
++ src += size;
++ dst += size;
++ n -= size;
++ }
++ disable_sacf_uaccess(old_fs);
++ if (rc)
++ zpci_err_mmio(rc, status, (__force u64) dst);
++ return rc;
++}
++
+ SYSCALL_DEFINE3(s390_pci_mmio_read, unsigned long, mmio_addr,
+ void __user *, user_buffer, size_t, length)
+ {
+@@ -86,12 +280,27 @@ SYSCALL_DEFINE3(s390_pci_mmio_read, unsi
+
+ if (length <= 0 || PAGE_SIZE - (mmio_addr & ~PAGE_MASK) < length)
+ return -EINVAL;
++
++ /*
++ * Only support write access to MIO capable devices on a MIO enabled
++ * system. Otherwise we would have to check for every address if it is
++ * a special ZPCI_ADDR and we would have to do a get_pfn() which we
++ * don't need for MIO capable devices.
++ */
++ if (static_branch_likely(&have_mio)) {
++ ret = __memcpy_fromio_inuser(
++ user_buffer, (const void __iomem *)mmio_addr,
++ length);
++ return ret;
++ }
++
+ if (length > 64) {
+ buf = kmalloc(length, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+- } else
++ } else {
+ buf = local_buf;
++ }
+
+ ret = get_pfn(mmio_addr, VM_READ, &pfn);
+ if (ret)
kbuild-remove-debug-info-from-kallsyms-linking.patch
revert-gfs2-don-t-demote-a-glock-until-its-revokes-a.patch
media-fdp1-fix-r-car-m3-n-naming-in-debug-message.patch
+staging-iio-ad2s1210-fix-spi-reading.patch
+staging-kpc2000-fix-error-return-code-in-kp2000_pcie_probe.patch
+staging-greybus-fix-uninitialized-scalar-variable.patch
+iio-sca3000-remove-an-erroneous-get_device.patch
+iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch
+iio-adc-ti-ads8344-fix-channel-selection.patch
+misc-rtsx-add-short-delay-after-exit-from-aspm.patch
+tty-serial-add-missing-spin_lock_init-for-sifive-serial-console.patch
+mei-release-me_cl-object-reference.patch
+ipack-tpci200-fix-error-return-code-in-tpci200_register.patch
+s390-pci-fix-s390_mmio_read-write-with-mio.patch
+s390-kaslr-add-support-for-r_390_jmp_slot-relocation-type.patch
+device-dax-don-t-leak-kernel-memory-to-user-space-after-unloading-kmem.patch
+rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch
+kasan-disable-branch-tracing-for-core-runtime.patch
+sh-include-linux-time_types.h-for-sockios.patch
--- /dev/null
+From fc94cf2092c7c1267fa2deb8388d624f50eba808 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 22 May 2020 22:23:02 -0700
+Subject: sh: include linux/time_types.h for sockios
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit fc94cf2092c7c1267fa2deb8388d624f50eba808 upstream.
+
+Using the socket ioctls on arch/sh (and only there) causes build time
+problems when __kernel_old_timeval/__kernel_old_timespec are not already
+visible to the compiler.
+
+Add an explict include line for the header that defines these
+structures.
+
+Fixes: 8c709f9a0693 ("y2038: sh: remove timeval/timespec usage from headers")
+Fixes: 0768e17073dc ("net: socket: implement 64-bit timestamps")
+Reported-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
+Cc: Rich Felker <dalias@libc.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20200519131327.1836482-1-arnd@arndb.de
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sh/include/uapi/asm/sockios.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/sh/include/uapi/asm/sockios.h
++++ b/arch/sh/include/uapi/asm/sockios.h
+@@ -2,6 +2,8 @@
+ #ifndef __ASM_SH_SOCKIOS_H
+ #define __ASM_SH_SOCKIOS_H
+
++#include <linux/time_types.h>
++
+ /* Socket-level I/O control calls. */
+ #define FIOGETOWN _IOR('f', 123, int)
+ #define FIOSETOWN _IOW('f', 124, int)
--- /dev/null
+From 34625c1931f8204c234c532b446b9f53c69f4b68 Mon Sep 17 00:00:00 2001
+From: Oscar Carter <oscar.carter@gmx.com>
+Date: Sun, 10 May 2020 12:14:26 +0200
+Subject: staging: greybus: Fix uninitialized scalar variable
+
+From: Oscar Carter <oscar.carter@gmx.com>
+
+commit 34625c1931f8204c234c532b446b9f53c69f4b68 upstream.
+
+In the "gb_tty_set_termios" function the "newline" variable is declared
+but not initialized. So the "flow_control" member is not initialized and
+the OR / AND operations with itself results in an undefined value in
+this member.
+
+The purpose of the code is to set the flow control type, so remove the
+OR / AND self operator and set the value directly.
+
+Addresses-Coverity-ID: 1374016 ("Uninitialized scalar variable")
+Fixes: e55c25206d5c9 ("greybus: uart: Handle CRTSCTS flag in termios")
+Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200510101426.23631-1-oscar.carter@gmx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/greybus/uart.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/greybus/uart.c
++++ b/drivers/staging/greybus/uart.c
+@@ -537,9 +537,9 @@ static void gb_tty_set_termios(struct tt
+ }
+
+ if (C_CRTSCTS(tty) && C_BAUD(tty) != B0)
+- newline.flow_control |= GB_SERIAL_AUTO_RTSCTS_EN;
++ newline.flow_control = GB_SERIAL_AUTO_RTSCTS_EN;
+ else
+- newline.flow_control &= ~GB_SERIAL_AUTO_RTSCTS_EN;
++ newline.flow_control = 0;
+
+ if (memcmp(&gb_tty->line_coding, &newline, sizeof(newline))) {
+ memcpy(&gb_tty->line_coding, &newline, sizeof(newline));
--- /dev/null
+From 5e4f99a6b788047b0b8a7496c2e0c8f372f6edf2 Mon Sep 17 00:00:00 2001
+From: Dragos Bogdan <dragos.bogdan@analog.com>
+Date: Wed, 29 Apr 2020 10:21:29 +0300
+Subject: staging: iio: ad2s1210: Fix SPI reading
+
+From: Dragos Bogdan <dragos.bogdan@analog.com>
+
+commit 5e4f99a6b788047b0b8a7496c2e0c8f372f6edf2 upstream.
+
+If the serial interface is used, the 8-bit address should be latched using
+the rising edge of the WR/FSYNC signal.
+
+This basically means that a CS change is required between the first byte
+sent, and the second one.
+This change splits the single-transfer transfer of 2 bytes into 2 transfers
+with a single byte, and CS change in-between.
+
+Note fixes tag is not accurate, but reflects a point beyond which there
+are too many refactors to make backporting straight forward.
+
+Fixes: b19e9ad5e2cb ("staging:iio:resolver:ad2s1210 general driver cleanup.")
+Signed-off-by: Dragos Bogdan <dragos.bogdan@analog.com>
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/iio/resolver/ad2s1210.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/iio/resolver/ad2s1210.c
++++ b/drivers/staging/iio/resolver/ad2s1210.c
+@@ -130,17 +130,24 @@ static int ad2s1210_config_write(struct
+ static int ad2s1210_config_read(struct ad2s1210_state *st,
+ unsigned char address)
+ {
+- struct spi_transfer xfer = {
+- .len = 2,
+- .rx_buf = st->rx,
+- .tx_buf = st->tx,
++ struct spi_transfer xfers[] = {
++ {
++ .len = 1,
++ .rx_buf = &st->rx[0],
++ .tx_buf = &st->tx[0],
++ .cs_change = 1,
++ }, {
++ .len = 1,
++ .rx_buf = &st->rx[1],
++ .tx_buf = &st->tx[1],
++ },
+ };
+ int ret = 0;
+
+ ad2s1210_set_mode(MOD_CONFIG, st);
+ st->tx[0] = address | AD2S1210_MSB_IS_HIGH;
+ st->tx[1] = AD2S1210_REG_FAULT;
+- ret = spi_sync_transfer(st->sdev, &xfer, 1);
++ ret = spi_sync_transfer(st->sdev, xfers, 2);
+ if (ret < 0)
+ return ret;
+
--- /dev/null
+From b17884ccf29e127b16bba6aea1438c851c9f5af1 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Wed, 6 May 2020 13:47:35 +0000
+Subject: staging: kpc2000: fix error return code in kp2000_pcie_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit b17884ccf29e127b16bba6aea1438c851c9f5af1 upstream.
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function. Also
+removed var 'rv' since we can use 'err' instead.
+
+Fixes: 7dc7967fc39a ("staging: kpc2000: add initial set of Daktronics drivers")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20200506134735.102041-1-weiyongjun1@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/kpc2000/kpc2000/core.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/kpc2000/kpc2000/core.c
++++ b/drivers/staging/kpc2000/kpc2000/core.c
+@@ -298,7 +298,6 @@ static int kp2000_pcie_probe(struct pci_
+ {
+ int err = 0;
+ struct kp2000_device *pcard;
+- int rv;
+ unsigned long reg_bar_phys_addr;
+ unsigned long reg_bar_phys_len;
+ unsigned long dma_bar_phys_addr;
+@@ -445,11 +444,11 @@ static int kp2000_pcie_probe(struct pci_
+ if (err < 0)
+ goto err_release_dma;
+
+- rv = request_irq(pcard->pdev->irq, kp2000_irq_handler, IRQF_SHARED,
+- pcard->name, pcard);
+- if (rv) {
++ err = request_irq(pcard->pdev->irq, kp2000_irq_handler, IRQF_SHARED,
++ pcard->name, pcard);
++ if (err) {
+ dev_err(&pcard->pdev->dev,
+- "%s: failed to request_irq: %d\n", __func__, rv);
++ "%s: failed to request_irq: %d\n", __func__, err);
+ goto err_disable_msi;
+ }
+
--- /dev/null
+From 17b4efdf4e4867079012a48ca10d965fe9d68822 Mon Sep 17 00:00:00 2001
+From: Sagar Shrikant Kadam <sagar.kadam@sifive.com>
+Date: Sat, 9 May 2020 03:24:12 -0700
+Subject: tty: serial: add missing spin_lock_init for SiFive serial console
+
+From: Sagar Shrikant Kadam <sagar.kadam@sifive.com>
+
+commit 17b4efdf4e4867079012a48ca10d965fe9d68822 upstream.
+
+An uninitialised spin lock for sifive serial console raises a bad
+magic spin_lock error as reported and discussed here [1].
+Initialising the spin lock resolves the issue.
+
+The fix is tested on HiFive Unleashed A00 board with Linux 5.7-rc4
+and OpenSBI v0.7
+
+[1] https://lore.kernel.org/linux-riscv/b9fe49483a903f404e7acc15a6efbef756db28ae.camel@wdc.com
+
+Fixes: 45c054d0815b ("tty: serial: add driver for the SiFive UART")
+Reported-by: Atish Patra <Atish.Patra@wdc.com>
+Signed-off-by: Sagar Shrikant Kadam <sagar.kadam@sifive.com>
+Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Acked-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/1589019852-21505-2-git-send-email-sagar.kadam@sifive.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/sifive.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/tty/serial/sifive.c
++++ b/drivers/tty/serial/sifive.c
+@@ -840,6 +840,7 @@ console_initcall(sifive_console_init);
+
+ static void __ssp_add_console_port(struct sifive_serial_port *ssp)
+ {
++ spin_lock_init(&ssp->port.lock);
+ sifive_serial_console_ports[ssp->port.line] = ssp;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
