--- /dev/null
+From 59ba66346609fced64cd32721c8393318774d236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:02 +0200
+Subject: ALSA: sb8: Add a comment note regarding an unused pointer
+
+From: Atul Gopinathan <atulgopinathan@gmail.com>
+
+[ Upstream commit a28591f61b60fac820c6de59826ffa710e5e314e ]
+
+The field "fm_res" of "struct snd_sb8" is never used/dereferenced
+throughout the sb8.c code. Therefore there is no need for any null value
+check after the "request_region()".
+
+Add a comment note to make developers know about this and prevent any
+"NULL check" patches on this part of code.
+
+Cc: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Atul Gopinathan <atulgopinathan@gmail.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-36-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/isa/sb/sb8.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c
+index d77dcba276b5..b0ef47bc6521 100644
+--- a/sound/isa/sb/sb8.c
++++ b/sound/isa/sb/sb8.c
+@@ -109,7 +109,11 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev)
+ acard = card->private_data;
+ card->private_free = snd_sb8_free;
+
+- /* block the 0x388 port to avoid PnP conflicts */
++ /*
++ * Block the 0x388 port to avoid PnP conflicts.
++ * No need to check this value after request_region,
++ * as we never do anything with it.
++ */
+ acard->fm_res = request_region(0x388, 4, "SoundBlaster FM");
+
+ if (port[dev] != SNDRV_AUTO_PORT) {
+--
+2.30.2
+
--- /dev/null
+From 2bbaa16f0814013b8e9a98ec3d04ac5a9080dbd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:24 +0200
+Subject: ASoC: cs43130: handle errors in cs43130_probe() properly
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 2da441a6491d93eff8ffff523837fd621dc80389 ]
+
+cs43130_probe() does not do any valid error checking of things it
+initializes, OR what it does, it does not unwind properly if there are
+errors.
+
+Fix this up by moving the sysfs files to an attribute group so the
+driver core will correctly add/remove them all at once and handle errors
+with them, and correctly check for creating a new workqueue and
+unwinding if that fails.
+
+Cc: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-58-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs43130.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c
+index 80dc42197154..cf29dec28b5e 100644
+--- a/sound/soc/codecs/cs43130.c
++++ b/sound/soc/codecs/cs43130.c
+@@ -1738,6 +1738,14 @@ static DEVICE_ATTR(hpload_dc_r, 0444, cs43130_show_dc_r, NULL);
+ static DEVICE_ATTR(hpload_ac_l, 0444, cs43130_show_ac_l, NULL);
+ static DEVICE_ATTR(hpload_ac_r, 0444, cs43130_show_ac_r, NULL);
+
++static struct attribute *hpload_attrs[] = {
++ &dev_attr_hpload_dc_l.attr,
++ &dev_attr_hpload_dc_r.attr,
++ &dev_attr_hpload_ac_l.attr,
++ &dev_attr_hpload_ac_r.attr,
++};
++ATTRIBUTE_GROUPS(hpload);
++
+ static struct reg_sequence hp_en_cal_seq[] = {
+ {CS43130_INT_MASK_4, CS43130_INT_MASK_ALL},
+ {CS43130_HP_MEAS_LOAD_1, 0},
+@@ -2305,23 +2313,15 @@ static int cs43130_probe(struct snd_soc_component *component)
+
+ cs43130->hpload_done = false;
+ if (cs43130->dc_meas) {
+- ret = device_create_file(component->dev, &dev_attr_hpload_dc_l);
+- if (ret < 0)
+- return ret;
+-
+- ret = device_create_file(component->dev, &dev_attr_hpload_dc_r);
+- if (ret < 0)
+- return ret;
+-
+- ret = device_create_file(component->dev, &dev_attr_hpload_ac_l);
+- if (ret < 0)
+- return ret;
+-
+- ret = device_create_file(component->dev, &dev_attr_hpload_ac_r);
+- if (ret < 0)
++ ret = sysfs_create_groups(&component->dev->kobj, hpload_groups);
++ if (ret)
+ return ret;
+
+ cs43130->wq = create_singlethread_workqueue("cs43130_hp");
++ if (!cs43130->wq) {
++ sysfs_remove_groups(&component->dev->kobj, hpload_groups);
++ return -ENOMEM;
++ }
+ INIT_WORK(&cs43130->work, cs43130_imp_meas);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 87580fefb4311541196a4b8d3adb09fe6952e627 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:10 +0200
+Subject: ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd()
+
+From: Anirudh Rayabharam <mail@anirudhrb.com>
+
+[ Upstream commit fc6a6521556c8250e356ddc6a3f2391aa62dc976 ]
+
+ath6kl_wmi_cmd_send could fail, so let's return its error code upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/debug.c | 5 ++++-
+ drivers/net/wireless/ath/ath6kl/wmi.c | 4 +---
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c
+index 4e94b22eaada..4d1f6d44e88c 100644
+--- a/drivers/net/wireless/ath/ath6kl/debug.c
++++ b/drivers/net/wireless/ath/ath6kl/debug.c
+@@ -1027,14 +1027,17 @@ static ssize_t ath6kl_lrssi_roam_write(struct file *file,
+ {
+ struct ath6kl *ar = file->private_data;
+ unsigned long lrssi_roam_threshold;
++ int ret;
+
+ if (kstrtoul_from_user(user_buf, count, 0, &lrssi_roam_threshold))
+ return -EINVAL;
+
+ ar->lrssi_roam_threshold = lrssi_roam_threshold;
+
+- ath6kl_wmi_set_roam_lrssi_cmd(ar->wmi, ar->lrssi_roam_threshold);
++ ret = ath6kl_wmi_set_roam_lrssi_cmd(ar->wmi, ar->lrssi_roam_threshold);
+
++ if (ret)
++ return ret;
+ return count;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
+index 987ebae8ea0e..183259e26bd1 100644
+--- a/drivers/net/wireless/ath/ath6kl/wmi.c
++++ b/drivers/net/wireless/ath/ath6kl/wmi.c
+@@ -776,10 +776,8 @@ int ath6kl_wmi_set_roam_lrssi_cmd(struct wmi *wmi, u8 lrssi)
+ cmd->info.params.roam_rssi_floor = DEF_LRSSI_ROAM_FLOOR;
+ cmd->roam_ctrl = WMI_SET_LRSSI_SCAN_PARAMS;
+
+- ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID,
++ return ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID,
+ NO_SYNC_WMIFLAG);
+-
+- return 0;
+ }
+
+ int ath6kl_wmi_force_roam_cmd(struct wmi *wmi, const u8 *bssid)
+--
+2.30.2
+
--- /dev/null
+From 9357f39fdfb5aab14a3d962f5fd5bede82281ded Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 May 2021 10:56:16 -0400
+Subject: btrfs: do not BUG_ON in link_to_fixup_dir
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit 91df99a6eb50d5a1bc70fff4a09a0b7ae6aab96d ]
+
+While doing error injection testing I got the following panic
+
+ kernel BUG at fs/btrfs/tree-log.c:1862!
+ invalid opcode: 0000 [#1] SMP NOPTI
+ CPU: 1 PID: 7836 Comm: mount Not tainted 5.13.0-rc1+ #305
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
+ RIP: 0010:link_to_fixup_dir+0xd5/0xe0
+ RSP: 0018:ffffb5800180fa30 EFLAGS: 00010216
+ RAX: fffffffffffffffb RBX: 00000000fffffffb RCX: ffff8f595287faf0
+ RDX: ffffb5800180fa37 RSI: ffff8f5954978800 RDI: 0000000000000000
+ RBP: ffff8f5953af9450 R08: 0000000000000019 R09: 0000000000000001
+ R10: 000151f408682970 R11: 0000000120021001 R12: ffff8f5954978800
+ R13: ffff8f595287faf0 R14: ffff8f5953c77dd0 R15: 0000000000000065
+ FS: 00007fc5284c8c40(0000) GS:ffff8f59bbd00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007fc5287f47c0 CR3: 000000011275e002 CR4: 0000000000370ee0
+ Call Trace:
+ replay_one_buffer+0x409/0x470
+ ? btree_read_extent_buffer_pages+0xd0/0x110
+ walk_up_log_tree+0x157/0x1e0
+ walk_log_tree+0xa6/0x1d0
+ btrfs_recover_log_trees+0x1da/0x360
+ ? replay_one_extent+0x7b0/0x7b0
+ open_ctree+0x1486/0x1720
+ btrfs_mount_root.cold+0x12/0xea
+ ? __kmalloc_track_caller+0x12f/0x240
+ legacy_get_tree+0x24/0x40
+ vfs_get_tree+0x22/0xb0
+ vfs_kern_mount.part.0+0x71/0xb0
+ btrfs_mount+0x10d/0x380
+ ? vfs_parse_fs_string+0x4d/0x90
+ legacy_get_tree+0x24/0x40
+ vfs_get_tree+0x22/0xb0
+ path_mount+0x433/0xa10
+ __x64_sys_mount+0xe3/0x120
+ do_syscall_64+0x3d/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+We can get -EIO or any number of legitimate errors from
+btrfs_search_slot(), panicing here is not the appropriate response. The
+error path for this code handles errors properly, simply return the
+error.
+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/tree-log.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 7b940264c7b9..1cd610ddbb24 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1770,8 +1770,6 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans,
+ ret = btrfs_update_inode(trans, root, inode);
+ } else if (ret == -EEXIST) {
+ ret = 0;
+- } else {
+- BUG(); /* Logic Error */
+ }
+ iput(inode);
+
+--
+2.30.2
+
--- /dev/null
+From bfe824e2904cdb193bb0d3b83ffe3da10a49c5d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:56:56 +0200
+Subject: char: hpet: add checks after calling ioremap
+
+From: Tom Seewald <tseewald@gmail.com>
+
+[ Upstream commit b11701c933112d49b808dee01cb7ff854ba6a77a ]
+
+The function hpet_resources() calls ioremap() two times, but in both
+cases it does not check if ioremap() returned a null pointer. Fix this
+by adding null pointer checks and returning an appropriate error.
+
+Signed-off-by: Tom Seewald <tseewald@gmail.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-30-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hpet.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
+index c0732f032248..68f02318cee3 100644
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -975,6 +975,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
+ if (ACPI_SUCCESS(status)) {
+ hdp->hd_phys_address = addr.address.minimum;
+ hdp->hd_address = ioremap(addr.address.minimum, addr.address.address_length);
++ if (!hdp->hd_address)
++ return AE_ERROR;
+
+ if (hpet_is_known(hdp)) {
+ iounmap(hdp->hd_address);
+@@ -988,6 +990,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
+ hdp->hd_phys_address = fixmem32->address;
+ hdp->hd_address = ioremap(fixmem32->address,
+ HPET_RANGE_SIZE);
++ if (!hdp->hd_address)
++ return AE_ERROR;
+
+ if (hpet_is_known(hdp)) {
+ iounmap(hdp->hd_address);
+--
+2.30.2
+
--- /dev/null
+From 83ba7053813d3421e5f9f481bad322b692d8f1d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:18 +0200
+Subject: dmaengine: qcom_hidma: comment platform_driver_register call
+
+From: Phillip Potter <phil@philpotter.co.uk>
+
+[ Upstream commit 4df2a8b0ad634d98a67e540a4e18a60f943e7d9f ]
+
+Place a comment in hidma_mgmt_init explaining why success must
+currently be assumed, due to the cleanup issue that would need to
+be considered were this module ever to be unloadable or were this
+platform_driver_register call ever to fail.
+
+Acked-By: Vinod Koul <vkoul@kernel.org>
+Acked-By: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
+Link: https://lore.kernel.org/r/20210503115736.2104747-52-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/qcom/hidma_mgmt.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/dma/qcom/hidma_mgmt.c b/drivers/dma/qcom/hidma_mgmt.c
+index d64edeb6771a..f9640e37b139 100644
+--- a/drivers/dma/qcom/hidma_mgmt.c
++++ b/drivers/dma/qcom/hidma_mgmt.c
+@@ -423,6 +423,20 @@ static int __init hidma_mgmt_init(void)
+ hidma_mgmt_of_populate_channels(child);
+ }
+ #endif
++ /*
++ * We do not check for return value here, as it is assumed that
++ * platform_driver_register must not fail. The reason for this is that
++ * the (potential) hidma_mgmt_of_populate_channels calls above are not
++ * cleaned up if it does fail, and to do this work is quite
++ * complicated. In particular, various calls of of_address_to_resource,
++ * of_irq_to_resource, platform_device_register_full, of_dma_configure,
++ * and of_msi_configure which then call other functions and so on, must
++ * be cleaned up - this is not a trivial exercise.
++ *
++ * Currently, this module is not intended to be unloaded, and there is
++ * no module_exit function defined which does the needed cleanup. For
++ * this reason, we have to assume success here.
++ */
+ platform_driver_register(&hidma_mgmt_driver);
+
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From 511b7c026c7e0078d13bc91c2a67436a12ab5c7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 May 2021 16:16:10 +0800
+Subject: drm/amd/amdgpu: fix refcount leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jingwen Chen <Jingwen.Chen2@amd.com>
+
+[ Upstream commit fa7e6abc75f3d491bc561734312d065dc9dc2a77 ]
+
+[Why]
+the gem object rfb->base.obj[0] is get according to num_planes
+in amdgpufb_create, but is not put according to num_planes
+
+[How]
+put rfb->base.obj[0] in amdgpu_fbdev_destroy according to num_planes
+
+Signed-off-by: Jingwen Chen <Jingwen.Chen2@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+index 69c5d22f29bd..d55ff59584c8 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+@@ -297,10 +297,13 @@ out:
+ static int amdgpu_fbdev_destroy(struct drm_device *dev, struct amdgpu_fbdev *rfbdev)
+ {
+ struct amdgpu_framebuffer *rfb = &rfbdev->rfb;
++ int i;
+
+ drm_fb_helper_unregister_fbi(&rfbdev->helper);
+
+ if (rfb->base.obj[0]) {
++ for (i = 0; i < rfb->base.format->num_planes; i++)
++ drm_gem_object_put(rfb->base.obj[0]);
+ amdgpufb_destroy_pinned_object(rfb->base.obj[0]);
+ rfb->base.obj[0] = NULL;
+ drm_framebuffer_unregister_private(&rfb->base);
+--
+2.30.2
+
--- /dev/null
+From fd57fecb026b3b64f0aef8f54af4fa21c1028498 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 May 2021 16:20:55 -0400
+Subject: drm/amd/display: Disconnect non-DP with no EDID
+
+From: Chris Park <Chris.Park@amd.com>
+
+[ Upstream commit 080039273b126eeb0185a61c045893a25dbc046e ]
+
+[Why]
+Active DP dongles return no EDID when dongle
+is connected, but VGA display is taken out.
+Current driver behavior does not remove the
+active display when this happens, and this is
+a gap between dongle DTP and dongle behavior.
+
+[How]
+For active DP dongles and non-DP scenario,
+disconnect sink on detection when no EDID
+is read due to timeout.
+
+Signed-off-by: Chris Park <Chris.Park@amd.com>
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Stylon Wang <stylon.wang@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index e3bedf4cc9c0..c9c81090d580 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -768,6 +768,24 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason)
+ dc_is_dvi_signal(link->connector_signal)) {
+ if (prev_sink != NULL)
+ dc_sink_release(prev_sink);
++ link_disconnect_sink(link);
++
++ return false;
++ }
++ /*
++ * Abort detection for DP connectors if we have
++ * no EDID and connector is active converter
++ * as there are no display downstream
++ *
++ */
++ if (dc_is_dp_sst_signal(link->connector_signal) &&
++ (link->dpcd_caps.dongle_type ==
++ DISPLAY_DONGLE_DP_VGA_CONVERTER ||
++ link->dpcd_caps.dongle_type ==
++ DISPLAY_DONGLE_DP_DVI_CONVERTER)) {
++ if (prev_sink)
++ dc_sink_release(prev_sink);
++ link_disconnect_sink(link);
+
+ return false;
+ }
+--
+2.30.2
+
--- /dev/null
+From 59a4b31226e4fa2283cbdf29347543b61a65d14d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 May 2021 10:56:07 +0800
+Subject: drm/amdgpu: Fix a use-after-free
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: xinhui pan <xinhui.pan@amd.com>
+
+[ Upstream commit 1e5c37385097c35911b0f8a0c67ffd10ee1af9a2 ]
+
+looks like we forget to set ttm->sg to NULL.
+Hit panic below
+
+[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
+[ 1235.989074] Call Trace:
+[ 1235.991751] sg_free_table+0x17/0x20
+[ 1235.995667] amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu]
+[ 1236.002288] amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu]
+[ 1236.008464] ttm_tt_destroy+0x1e/0x30 [ttm]
+[ 1236.013066] ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm]
+[ 1236.018783] ttm_bo_release+0x262/0xa50 [ttm]
+[ 1236.023547] ttm_bo_put+0x82/0xd0 [ttm]
+[ 1236.027766] amdgpu_bo_unref+0x26/0x50 [amdgpu]
+[ 1236.032809] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu]
+[ 1236.040400] kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu]
+[ 1236.046912] kfd_ioctl+0x463/0x690 [amdgpu]
+
+Signed-off-by: xinhui pan <xinhui.pan@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+index 757fa486aac4..50807d621eca 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -1277,6 +1277,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm)
+ if (gtt && gtt->userptr) {
+ amdgpu_ttm_tt_set_user_pages(ttm, NULL);
+ kfree(ttm->sg);
++ ttm->sg = NULL;
+ ttm->page_flags &= ~TTM_PAGE_FLAG_SG;
+ return;
+ }
+--
+2.30.2
+
--- /dev/null
+From 531c5b2fee01bb604bb9276cafc95ba5fac8c4c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:08 +0200
+Subject: isdn: mISDNinfineon: check/cleanup ioremap failure correctly in
+ setup_io
+
+From: Phillip Potter <phil@philpotter.co.uk>
+
+[ Upstream commit c446f0d4702d316e1c6bf621f70e79678d28830a ]
+
+Move hw->cfg.mode and hw->addr.mode assignments from hw->ci->cfg_mode
+and hw->ci->addr_mode respectively, to be before the subsequent checks
+for memory IO mode (and possible ioremap calls in this case).
+
+Also introduce ioremap error checks at both locations. This allows
+resources to be properly freed on ioremap failure, as when the caller
+of setup_io then subsequently calls release_io via its error path,
+release_io can now correctly determine the mode as it has been set
+before the ioremap call.
+
+Finally, refactor release_io function so that it will call
+release_mem_region in the memory IO case, regardless of whether or not
+hw->cfg.p/hw->addr.p are NULL. This means resources are then properly
+released on failure.
+
+This properly implements the original reverted commit (d721fe99f6ad)
+from the University of Minnesota, whilst also implementing the ioremap
+check for the hw->ci->cfg_mode if block as well.
+
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
+Link: https://lore.kernel.org/r/20210503115736.2104747-42-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/hardware/mISDN/mISDNinfineon.c | 24 ++++++++++++++-------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/isdn/hardware/mISDN/mISDNinfineon.c b/drivers/isdn/hardware/mISDN/mISDNinfineon.c
+index 3e01012be4ab..95a0d728eecc 100644
+--- a/drivers/isdn/hardware/mISDN/mISDNinfineon.c
++++ b/drivers/isdn/hardware/mISDN/mISDNinfineon.c
+@@ -645,17 +645,19 @@ static void
+ release_io(struct inf_hw *hw)
+ {
+ if (hw->cfg.mode) {
+- if (hw->cfg.p) {
++ if (hw->cfg.mode == AM_MEMIO) {
+ release_mem_region(hw->cfg.start, hw->cfg.size);
+- iounmap(hw->cfg.p);
++ if (hw->cfg.p)
++ iounmap(hw->cfg.p);
+ } else
+ release_region(hw->cfg.start, hw->cfg.size);
+ hw->cfg.mode = AM_NONE;
+ }
+ if (hw->addr.mode) {
+- if (hw->addr.p) {
++ if (hw->addr.mode == AM_MEMIO) {
+ release_mem_region(hw->addr.start, hw->addr.size);
+- iounmap(hw->addr.p);
++ if (hw->addr.p)
++ iounmap(hw->addr.p);
+ } else
+ release_region(hw->addr.start, hw->addr.size);
+ hw->addr.mode = AM_NONE;
+@@ -685,9 +687,12 @@ setup_io(struct inf_hw *hw)
+ (ulong)hw->cfg.start, (ulong)hw->cfg.size);
+ return err;
+ }
+- if (hw->ci->cfg_mode == AM_MEMIO)
+- hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size);
+ hw->cfg.mode = hw->ci->cfg_mode;
++ if (hw->ci->cfg_mode == AM_MEMIO) {
++ hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size);
++ if (!hw->cfg.p)
++ return -ENOMEM;
++ }
+ if (debug & DEBUG_HW)
+ pr_notice("%s: IO cfg %lx (%lu bytes) mode%d\n",
+ hw->name, (ulong)hw->cfg.start,
+@@ -712,9 +717,12 @@ setup_io(struct inf_hw *hw)
+ (ulong)hw->addr.start, (ulong)hw->addr.size);
+ return err;
+ }
+- if (hw->ci->addr_mode == AM_MEMIO)
+- hw->addr.p = ioremap(hw->addr.start, hw->addr.size);
+ hw->addr.mode = hw->ci->addr_mode;
++ if (hw->ci->addr_mode == AM_MEMIO) {
++ hw->addr.p = ioremap(hw->addr.start, hw->addr.size);
++ if (!hw->addr.p)
++ return -ENOMEM;
++ }
+ if (debug & DEBUG_HW)
+ pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n",
+ hw->name, (ulong)hw->addr.start,
+--
+2.30.2
+
--- /dev/null
+From 1f667a9cd3403e06471e312ccd8826f4cc2eb8d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:20 +0200
+Subject: libertas: register sysfs groups properly
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 7e79b38fe9a403b065ac5915465f620a8fb3de84 ]
+
+The libertas driver was trying to register sysfs groups "by hand" which
+causes them to be created _after_ the device is initialized and
+announced to userspace, which causes races and can prevent userspace
+tools from seeing the sysfs files correctly.
+
+Fix this up by using the built-in sysfs_groups pointers in struct
+net_device which were created for this very reason, fixing the race
+condition, and properly allowing for any error that might have occured
+to be handled properly.
+
+Cc: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-54-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/mesh.c | 28 +++-----------------
+ 1 file changed, 4 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas/mesh.c b/drivers/net/wireless/marvell/libertas/mesh.c
+index b0cb16ef8d1d..b313c78e2154 100644
+--- a/drivers/net/wireless/marvell/libertas/mesh.c
++++ b/drivers/net/wireless/marvell/libertas/mesh.c
+@@ -793,19 +793,6 @@ static const struct attribute_group mesh_ie_group = {
+ .attrs = mesh_ie_attrs,
+ };
+
+-static void lbs_persist_config_init(struct net_device *dev)
+-{
+- int ret;
+- ret = sysfs_create_group(&(dev->dev.kobj), &boot_opts_group);
+- ret = sysfs_create_group(&(dev->dev.kobj), &mesh_ie_group);
+-}
+-
+-static void lbs_persist_config_remove(struct net_device *dev)
+-{
+- sysfs_remove_group(&(dev->dev.kobj), &boot_opts_group);
+- sysfs_remove_group(&(dev->dev.kobj), &mesh_ie_group);
+-}
+-
+
+ /***************************************************************************
+ * Initializing and starting, stopping mesh
+@@ -1005,6 +992,10 @@ static int lbs_add_mesh(struct lbs_private *priv)
+ SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent);
+
+ mesh_dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
++ mesh_dev->sysfs_groups[0] = &lbs_mesh_attr_group;
++ mesh_dev->sysfs_groups[1] = &boot_opts_group;
++ mesh_dev->sysfs_groups[2] = &mesh_ie_group;
++
+ /* Register virtual mesh interface */
+ ret = register_netdev(mesh_dev);
+ if (ret) {
+@@ -1012,19 +1003,10 @@ static int lbs_add_mesh(struct lbs_private *priv)
+ goto err_free_netdev;
+ }
+
+- ret = sysfs_create_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group);
+- if (ret)
+- goto err_unregister;
+-
+- lbs_persist_config_init(mesh_dev);
+-
+ /* Everything successful */
+ ret = 0;
+ goto done;
+
+-err_unregister:
+- unregister_netdev(mesh_dev);
+-
+ err_free_netdev:
+ free_netdev(mesh_dev);
+
+@@ -1045,8 +1027,6 @@ void lbs_remove_mesh(struct lbs_private *priv)
+
+ netif_stop_queue(mesh_dev);
+ netif_carrier_off(mesh_dev);
+- sysfs_remove_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group);
+- lbs_persist_config_remove(mesh_dev);
+ unregister_netdev(mesh_dev);
+ priv->mesh_dev = NULL;
+ kfree(mesh_dev->ieee80211_ptr);
+--
+2.30.2
+
--- /dev/null
+From 04693bb1e40860cef39160778d1b4e9dcbf1b33b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:26 +0200
+Subject: media: dvb: Add check on sp8870_readreg return
+
+From: Alaa Emad <alaaemadhossney.ae@gmail.com>
+
+[ Upstream commit c6d822c56e7fd29e6fa1b1bb91b98f6a1e942b3c ]
+
+The function sp8870_readreg returns a negative value when i2c_transfer
+fails so properly check for this and return the error if it happens.
+
+Cc: Sean Young <sean@mess.org>
+Cc: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Alaa Emad <alaaemadhossney.ae@gmail.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-60-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/sp8870.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/dvb-frontends/sp8870.c b/drivers/media/dvb-frontends/sp8870.c
+index 8d31cf3f4f07..3a577788041d 100644
+--- a/drivers/media/dvb-frontends/sp8870.c
++++ b/drivers/media/dvb-frontends/sp8870.c
+@@ -293,7 +293,9 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe)
+ sp8870_writereg(state, 0xc05, reg0xc05);
+
+ // read status reg in order to clear pending irqs
+- sp8870_readreg(state, 0x200);
++ err = sp8870_readreg(state, 0x200);
++ if (err < 0)
++ return err;
+
+ // system controller start
+ sp8870_microcontroller_start(state);
+--
+2.30.2
+
--- /dev/null
+From b3ba1364f17c610cf5bc72a5ddc46ce568b1ae80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:28 +0200
+Subject: media: gspca: mt9m111: Check write_bridge for timeout
+
+From: Alaa Emad <alaaemadhossney.ae@gmail.com>
+
+[ Upstream commit 656025850074f5c1ba2e05be37bda57ba2b8d491 ]
+
+In mt9m111_probe, m5602_write_bridge can timeout and return a negative
+error value. The fix checks for this error and passes it upstream.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/gspca/m5602/m5602_mt9m111.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c
+index c9947c4a0f63..5f7216c3e34d 100644
+--- a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c
++++ b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c
+@@ -199,7 +199,7 @@ static const struct v4l2_ctrl_config mt9m111_greenbal_cfg = {
+ int mt9m111_probe(struct sd *sd)
+ {
+ u8 data[2] = {0x00, 0x00};
+- int i;
++ int i, err;
+ struct gspca_dev *gspca_dev = (struct gspca_dev *)sd;
+
+ if (force_sensor) {
+@@ -217,15 +217,17 @@ int mt9m111_probe(struct sd *sd)
+ /* Do the preinit */
+ for (i = 0; i < ARRAY_SIZE(preinit_mt9m111); i++) {
+ if (preinit_mt9m111[i][0] == BRIDGE) {
+- m5602_write_bridge(sd,
+- preinit_mt9m111[i][1],
+- preinit_mt9m111[i][2]);
++ err = m5602_write_bridge(sd,
++ preinit_mt9m111[i][1],
++ preinit_mt9m111[i][2]);
+ } else {
+ data[0] = preinit_mt9m111[i][2];
+ data[1] = preinit_mt9m111[i][3];
+- m5602_write_sensor(sd,
+- preinit_mt9m111[i][1], data, 2);
++ err = m5602_write_sensor(sd,
++ preinit_mt9m111[i][1], data, 2);
+ }
++ if (err < 0)
++ return err;
+ }
+
+ if (m5602_read_sensor(sd, MT9M111_SC_CHIPVER, data, 2))
+--
+2.30.2
+
--- /dev/null
+From 492c42c64e0f063d36c842a3ea192b2cff734465 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:30 +0200
+Subject: media: gspca: properly check for errors in po1030_probe()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit dacb408ca6f0e34df22b40d8dd5fae7f8e777d84 ]
+
+If m5602_write_sensor() or m5602_write_bridge() fail, do not continue to
+initialize the device but return the error to the calling funtion.
+
+Cc: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-64-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/gspca/m5602/m5602_po1030.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/usb/gspca/m5602/m5602_po1030.c b/drivers/media/usb/gspca/m5602/m5602_po1030.c
+index 37d2891e5f5b..81d8eb72ac41 100644
+--- a/drivers/media/usb/gspca/m5602/m5602_po1030.c
++++ b/drivers/media/usb/gspca/m5602/m5602_po1030.c
+@@ -159,6 +159,7 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = {
+ int po1030_probe(struct sd *sd)
+ {
+ u8 dev_id_h = 0, i;
++ int err;
+ struct gspca_dev *gspca_dev = (struct gspca_dev *)sd;
+
+ if (force_sensor) {
+@@ -177,10 +178,13 @@ int po1030_probe(struct sd *sd)
+ for (i = 0; i < ARRAY_SIZE(preinit_po1030); i++) {
+ u8 data = preinit_po1030[i][2];
+ if (preinit_po1030[i][0] == SENSOR)
+- m5602_write_sensor(sd,
+- preinit_po1030[i][1], &data, 1);
++ err = m5602_write_sensor(sd, preinit_po1030[i][1],
++ &data, 1);
+ else
+- m5602_write_bridge(sd, preinit_po1030[i][1], data);
++ err = m5602_write_bridge(sd, preinit_po1030[i][1],
++ data);
++ if (err < 0)
++ return err;
+ }
+
+ if (m5602_read_sensor(sd, PO1030_DEVID_H, &dev_id_h, 1))
+--
+2.30.2
+
--- /dev/null
+From e1be79bf5f49366ec08c07e7c94f3cb43fec3e31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:56:46 +0200
+Subject: net: caif: remove BUG_ON(dev == NULL) in caif_xmit
+
+From: Du Cheng <ducheng2@gmail.com>
+
+[ Upstream commit 65a67792e3416f7c5d7daa47d99334cbb19a7449 ]
+
+The condition of dev == NULL is impossible in caif_xmit(), hence it is
+for the removal.
+
+Explanation:
+The static caif_xmit() is only called upon via a function pointer
+`ndo_start_xmit` defined in include/linux/netdevice.h:
+```
+struct net_device_ops {
+ ...
+ netdev_tx_t (*ndo_start_xmit)(struct sk_buff *skb, struct net_device *dev);
+ ...
+}
+```
+
+The exhausive list of call points are:
+```
+drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
+ dev->netdev_ops->ndo_start_xmit(skb, dev);
+ ^ ^
+
+drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c
+ struct opa_vnic_adapter *adapter = opa_vnic_priv(netdev);
+ ^ ^
+ return adapter->rn_ops->ndo_start_xmit(skb, netdev); // adapter would crash first
+ ^ ^
+
+drivers/usb/gadget/function/f_ncm.c
+ ncm->netdev->netdev_ops->ndo_start_xmit(NULL, ncm->netdev);
+ ^ ^
+
+include/linux/netdevice.h
+static inline netdev_tx_t __netdev_start_xmit(...
+{
+ return ops->ndo_start_xmit(skb, dev);
+ ^
+}
+
+ const struct net_device_ops *ops = dev->netdev_ops;
+ ^
+ rc = __netdev_start_xmit(ops, skb, dev, more);
+ ^
+```
+
+In each of the enumerated scenarios, it is impossible for the NULL-valued dev to
+reach the caif_xmit() without crashing the kernel earlier, therefore `BUG_ON(dev ==
+NULL)` is rather useless, hence the removal.
+
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Du Cheng <ducheng2@gmail.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-20-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/caif/caif_serial.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
+index a0f954f36c09..94d5ce9419ca 100644
+--- a/drivers/net/caif/caif_serial.c
++++ b/drivers/net/caif/caif_serial.c
+@@ -279,7 +279,6 @@ static int caif_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ser_device *ser;
+
+- BUG_ON(dev == NULL);
+ ser = netdev_priv(dev);
+
+ /* Send flow off once, on high water mark */
+--
+2.30.2
+
--- /dev/null
+From e48367b84e7276f07a3d9a2ed2194cdd02abd9df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:56:42 +0200
+Subject: net: fujitsu: fix potential null-ptr-deref
+
+From: Anirudh Rayabharam <mail@anirudhrb.com>
+
+[ Upstream commit 52202be1cd996cde6e8969a128dc27ee45a7cb5e ]
+
+In fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer
+deref. To fix this, check the return value of ioremap and return -1
+to the caller in case of failure.
+
+Cc: "David S. Miller" <davem@davemloft.net>
+Acked-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-16-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
+index a69cd19a55ae..b8fc9bbeca2c 100644
+--- a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
++++ b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
+@@ -547,6 +547,11 @@ static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id)
+ return -1;
+
+ base = ioremap(link->resource[2]->start, resource_size(link->resource[2]));
++ if (!base) {
++ pcmcia_release_window(link, link->resource[2]);
++ return -1;
++ }
++
+ pcmcia_map_mem_page(link, link->resource[2], 0);
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From 0e2475798c56ae92096a1e3a8008d38c41f2fb75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 14:45:43 +0200
+Subject: openrisc: Define memory barrier mb
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 8b549c18ae81dbc36fb11e4aa08b8378c599ca95 ]
+
+This came up in the discussion of the requirements of qspinlock on an
+architecture. OpenRISC uses qspinlock, but it was noticed that the
+memmory barrier was not defined.
+
+Peter defined it in the mail thread writing:
+
+ As near as I can tell this should do. The arch spec only lists
+ this one instruction and the text makes it sound like a completion
+ barrier.
+
+This is correct so applying this patch.
+
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+[shorne@gmail.com:Turned the mail into a patch]
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/include/asm/barrier.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+ create mode 100644 arch/openrisc/include/asm/barrier.h
+
+diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h
+new file mode 100644
+index 000000000000..7538294721be
+--- /dev/null
++++ b/arch/openrisc/include/asm/barrier.h
+@@ -0,0 +1,9 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __ASM_BARRIER_H
++#define __ASM_BARRIER_H
++
++#define mb() asm volatile ("l.msync" ::: "memory")
++
++#include <asm-generic/barrier.h>
++
++#endif /* __ASM_BARRIER_H */
+--
+2.30.2
+
--- /dev/null
+From f42167857f745dd832332d778d9b41845b27cb4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 May 2021 23:30:47 +0530
+Subject: platform/x86: hp-wireless: add AMD's hardware id to the supported
+ list
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit f048630bdd55eb5379ef35f971639fe52fabe499 ]
+
+Newer AMD based laptops uses AMDI0051 as the hardware id to support the
+airplane mode button. Adding this to the supported list.
+
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Link: https://lore.kernel.org/r/20210514180047.1697543-1-Shyam-sundar.S-k@amd.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/hp-wireless.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/platform/x86/hp-wireless.c b/drivers/platform/x86/hp-wireless.c
+index d6ea5e998fb8..bb95bec0b110 100644
+--- a/drivers/platform/x86/hp-wireless.c
++++ b/drivers/platform/x86/hp-wireless.c
+@@ -30,12 +30,14 @@ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Alex Hung");
+ MODULE_ALIAS("acpi*:HPQ6001:*");
+ MODULE_ALIAS("acpi*:WSTADEF:*");
++MODULE_ALIAS("acpi*:AMDI0051:*");
+
+ static struct input_dev *hpwl_input_dev;
+
+ static const struct acpi_device_id hpwl_ids[] = {
+ {"HPQ6001", 0},
+ {"WSTADEF", 0},
++ {"AMDI0051", 0},
+ {"", 0},
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 0f7da7bb52c53edb8fc4dc5584043e265102a15d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Apr 2021 14:07:35 +0800
+Subject: platform/x86: hp_accel: Avoid invoking _INI to speed up resume
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit 79d341e26ebcdbc622348aaaab6f8f89b6fdb25f ]
+
+hp_accel can take almost two seconds to resume on some HP laptops.
+
+The bottleneck is on evaluating _INI, which is only needed to run once.
+
+Resolve the issue by only invoking _INI when it's necessary. Namely, on
+probe and on hibernation restore.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Acked-by: Éric Piel <eric.piel@trempplin-utc.net>
+Link: https://lore.kernel.org/r/20210430060736.590321-1-kai.heng.feng@canonical.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/lis3lv02d/lis3lv02d.h | 1 +
+ drivers/platform/x86/hp_accel.c | 22 +++++++++++++++++++++-
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h
+index c439c827eea8..0ef759671b54 100644
+--- a/drivers/misc/lis3lv02d/lis3lv02d.h
++++ b/drivers/misc/lis3lv02d/lis3lv02d.h
+@@ -284,6 +284,7 @@ struct lis3lv02d {
+ int regs_size;
+ u8 *reg_cache;
+ bool regs_stored;
++ bool init_required;
+ u8 odr_mask; /* ODR bit mask */
+ u8 whoami; /* indicates measurement precision */
+ s16 (*read_data) (struct lis3lv02d *lis3, int reg);
+diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
+index 7b12abe86b94..9c3c83ef445b 100644
+--- a/drivers/platform/x86/hp_accel.c
++++ b/drivers/platform/x86/hp_accel.c
+@@ -101,6 +101,9 @@ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids);
+ static int lis3lv02d_acpi_init(struct lis3lv02d *lis3)
+ {
+ struct acpi_device *dev = lis3->bus_priv;
++ if (!lis3->init_required)
++ return 0;
++
+ if (acpi_evaluate_object(dev->handle, METHOD_NAME__INI,
+ NULL, NULL) != AE_OK)
+ return -EINVAL;
+@@ -367,6 +370,7 @@ static int lis3lv02d_add(struct acpi_device *device)
+ }
+
+ /* call the core layer do its init */
++ lis3_dev.init_required = true;
+ ret = lis3lv02d_init_device(&lis3_dev);
+ if (ret)
+ return ret;
+@@ -414,11 +418,27 @@ static int lis3lv02d_suspend(struct device *dev)
+
+ static int lis3lv02d_resume(struct device *dev)
+ {
++ lis3_dev.init_required = false;
++ lis3lv02d_poweron(&lis3_dev);
++ return 0;
++}
++
++static int lis3lv02d_restore(struct device *dev)
++{
++ lis3_dev.init_required = true;
+ lis3lv02d_poweron(&lis3_dev);
+ return 0;
+ }
+
+-static SIMPLE_DEV_PM_OPS(hp_accel_pm, lis3lv02d_suspend, lis3lv02d_resume);
++static const struct dev_pm_ops hp_accel_pm = {
++ .suspend = lis3lv02d_suspend,
++ .resume = lis3lv02d_resume,
++ .freeze = lis3lv02d_suspend,
++ .thaw = lis3lv02d_resume,
++ .poweroff = lis3lv02d_suspend,
++ .restore = lis3lv02d_restore,
++};
++
+ #define HP_ACCEL_PM (&hp_accel_pm)
+ #else
+ #define HP_ACCEL_PM NULL
+--
+2.30.2
+
--- /dev/null
+From aaf722f894e9e4b095efb615731b27a87332a3dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 May 2021 13:15:21 +0300
+Subject: platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit bc1eca606d8084465e6f89fd646cc71defbad490 ]
+
+The intel_punit_ipc driver might be compiled as a module.
+When udev handles the event of the devices appearing
+the intel_punit_ipc module is missing.
+
+Append MODULE_DEVICE_TABLE for ACPI case to fix the loading issue.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210519101521.79338-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel_punit_ipc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c
+index 2efeab650345..d6a7039a0591 100644
+--- a/drivers/platform/x86/intel_punit_ipc.c
++++ b/drivers/platform/x86/intel_punit_ipc.c
+@@ -331,6 +331,7 @@ static const struct acpi_device_id punit_ipc_acpi_ids[] = {
+ { "INT34D4", 0 },
+ { }
+ };
++MODULE_DEVICE_TABLE(acpi, punit_ipc_acpi_ids);
+
+ static struct platform_driver intel_punit_ipc_driver = {
+ .probe = intel_punit_ipc_probe,
+--
+2.30.2
+
--- /dev/null
+From c758f1572522151012f23bed4bc66a237e17c73f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 May 2021 03:04:37 +0000
+Subject: scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
+
+From: Matt Wang <wwentao@vmware.com>
+
+[ Upstream commit 56f396146af278135c0ff958c79b5ee1bd22453d ]
+
+Commit 391e2f25601e ("[SCSI] BusLogic: Port driver to 64-bit")
+introduced a serious issue for 64-bit systems. With this commit,
+64-bit kernel will enumerate 8*15 non-existing disks. This is caused
+by the broken CCB structure. The change from u32 data to void *data
+increased CCB length on 64-bit system, which introduced an extra 4
+byte offset of the CDB. This leads to incorrect response to INQUIRY
+commands during enumeration.
+
+Fix disk enumeration failure by reverting the portion of the commit
+above which switched the data pointer from u32 to void.
+
+Link: https://lore.kernel.org/r/C325637F-1166-4340-8F0F-3BCCD59D4D54@vmware.com
+Acked-by: Khalid Aziz <khalid@gonehiking.org>
+Signed-off-by: Matt Wang <wwentao@vmware.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/BusLogic.c | 6 +++---
+ drivers/scsi/BusLogic.h | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
+index 0d4ffe0ae306..79b5c5457cc2 100644
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -3081,11 +3081,11 @@ static int blogic_qcmd_lck(struct scsi_cmnd *command,
+ ccb->opcode = BLOGIC_INITIATOR_CCB_SG;
+ ccb->datalen = count * sizeof(struct blogic_sg_seg);
+ if (blogic_multimaster_type(adapter))
+- ccb->data = (void *)((unsigned int) ccb->dma_handle +
++ ccb->data = (unsigned int) ccb->dma_handle +
+ ((unsigned long) &ccb->sglist -
+- (unsigned long) ccb));
++ (unsigned long) ccb);
+ else
+- ccb->data = ccb->sglist;
++ ccb->data = virt_to_32bit_virt(ccb->sglist);
+
+ scsi_for_each_sg(command, sg, count, i) {
+ ccb->sglist[i].segbytes = sg_dma_len(sg);
+diff --git a/drivers/scsi/BusLogic.h b/drivers/scsi/BusLogic.h
+index 8d47e2c88d24..1a33a4b28d45 100644
+--- a/drivers/scsi/BusLogic.h
++++ b/drivers/scsi/BusLogic.h
+@@ -821,7 +821,7 @@ struct blogic_ccb {
+ unsigned char cdblen; /* Byte 2 */
+ unsigned char sense_datalen; /* Byte 3 */
+ u32 datalen; /* Bytes 4-7 */
+- void *data; /* Bytes 8-11 */
++ u32 data; /* Bytes 8-11 */
+ unsigned char:8; /* Byte 12 */
+ unsigned char:8; /* Byte 13 */
+ enum blogic_adapter_status adapter_status; /* Byte 14 */
+--
+2.30.2
+
--- /dev/null
+From 945de060fe3b33810d099bf3f197a5a3cb5cc631 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:56:38 +0200
+Subject: serial: max310x: unregister uart driver in case of failure and abort
+
+From: Atul Gopinathan <atulgopinathan@gmail.com>
+
+[ Upstream commit 3890e3dea315f1a257d1b940a2a4e2fa16a7b095 ]
+
+The macro "spi_register_driver" invokes the function
+"__spi_register_driver()" which has a return type of int and can fail,
+returning a negative value in such a case. This is currently ignored and
+the init() function yields success even if the spi driver failed to
+register.
+
+Fix this by collecting the return value of "__spi_register_driver()" and
+also unregister the uart driver in case of failure.
+
+Cc: Jiri Slaby <jirislaby@kernel.org>
+Signed-off-by: Atul Gopinathan <atulgopinathan@gmail.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-12-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 0c35c3c5e373..c1ab0dbda8a9 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1480,10 +1480,12 @@ static int __init max310x_uart_init(void)
+ return ret;
+
+ #ifdef CONFIG_SPI_MASTER
+- spi_register_driver(&max310x_spi_driver);
++ ret = spi_register_driver(&max310x_spi_driver);
++ if (ret)
++ uart_unregister_driver(&max310x_uart);
+ #endif
+
+- return 0;
++ return ret;
+ }
+ module_init(max310x_uart_init);
+
+--
+2.30.2
+
i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch
i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch
perf-jevents-fix-getting-maximum-number-of-fds.patch
+platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch
+serial-max310x-unregister-uart-driver-in-case-of-fai.patch
+net-fujitsu-fix-potential-null-ptr-deref.patch
+net-caif-remove-bug_on-dev-null-in-caif_xmit.patch
+char-hpet-add-checks-after-calling-ioremap.patch
+alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch
+isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch
+ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch
+dmaengine-qcom_hidma-comment-platform_driver_registe.patch
+libertas-register-sysfs-groups-properly.patch
+asoc-cs43130-handle-errors-in-cs43130_probe-properly.patch
+media-dvb-add-check-on-sp8870_readreg-return.patch
+media-gspca-mt9m111-check-write_bridge-for-timeout.patch
+media-gspca-properly-check-for-errors-in-po1030_prob.patch
+scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch
+openrisc-define-memory-barrier-mb.patch
+btrfs-do-not-bug_on-in-link_to_fixup_dir.patch
+platform-x86-hp-wireless-add-amd-s-hardware-id-to-th.patch
+platform-x86-intel_punit_ipc-append-module_device_ta.patch
+smb3-incorrect-file-id-in-requests-compounded-with-o.patch
+drm-amd-display-disconnect-non-dp-with-no-edid.patch
+drm-amd-amdgpu-fix-refcount-leak.patch
+drm-amdgpu-fix-a-use-after-free.patch
--- /dev/null
+From ba544f0f60a133078e0b0fb8dbdc1b10ded27ceb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 May 2021 09:52:22 -0500
+Subject: SMB3: incorrect file id in requests compounded with open
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit c0d46717b95735b0eacfddbcca9df37a49de9c7a ]
+
+See MS-SMB2 3.2.4.1.4, file ids in compounded requests should be set to
+0xFFFFFFFFFFFFFFFF (we were treating it as u32 not u64 and setting
+it incorrectly).
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reported-by: Stefan Metzmacher <metze@samba.org>
+Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2pdu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 07d1c79a79ea..43478ec6fd67 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -3124,10 +3124,10 @@ smb2_new_read_req(void **buf, unsigned int *total_len,
+ * Related requests use info from previous read request
+ * in chain.
+ */
+- shdr->SessionId = 0xFFFFFFFF;
++ shdr->SessionId = 0xFFFFFFFFFFFFFFFF;
+ shdr->TreeId = 0xFFFFFFFF;
+- req->PersistentFileId = 0xFFFFFFFF;
+- req->VolatileFileId = 0xFFFFFFFF;
++ req->PersistentFileId = 0xFFFFFFFFFFFFFFFF;
++ req->VolatileFileId = 0xFFFFFFFFFFFFFFFF;
+ }
+ }
+ if (remaining_bytes > io_parms->length)
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
