--- /dev/null
+From 4d39931631eb0cfd53744e1eacf1b7689ea86cab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 18:13:20 -0300
+Subject: ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 33d0d843872c5ddbe28457a92fc6f2487315fb9f ]
+
+The SPI chip selects are represented as:
+
+cs-gpios = <&gpio4 11 GPIO_ACTIVE_LOW>, <&gpio4 13 GPIO_ACTIVE_LOW>;
+
+, which means that they are used in GPIO function instead of native
+SPI mode.
+
+Fix the IOMUX for the chip select 1 to use GPIO4_13 instead of
+the native CSPI_SSI function.
+
+Fixes: c605cbf5e135 ("ARM: dts: imx: add device tree support for Freescale imx50evk board")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx50-evk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts
+index 98b5faa06e27e..07b8870dfff13 100644
+--- a/arch/arm/boot/dts/imx50-evk.dts
++++ b/arch/arm/boot/dts/imx50-evk.dts
+@@ -65,7 +65,7 @@
+ MX50_PAD_CSPI_MISO__CSPI_MISO 0x00
+ MX50_PAD_CSPI_MOSI__CSPI_MOSI 0x00
+ MX50_PAD_CSPI_SS0__GPIO4_11 0xc4
+- MX50_PAD_ECSPI1_MOSI__CSPI_SS1 0xf4
++ MX50_PAD_ECSPI1_MOSI__GPIO4_13 0x84
+ >;
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 98da949d881183a60e680b17c5517078b79f2882 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Oct 2020 23:11:20 +0300
+Subject: arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
+
+From: Sergey Matyukevich <geomatsi@gmail.com>
+
+[ Upstream commit 7dd8f0ba88fce98e2953267a66af74c6f4792a56 ]
+
+Commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the
+KSZ9031 PHY") fixed micrel phy driver adding proper support for phy
+modes. Adapt imx6q-udoo board phy settings : explicitly set required
+delay configuration using "rgmii-id".
+
+Fixes: cbd54fe0b2bc ("ARM: dts: imx6dl-udoo: Add board support based off imx6q-udoo")
+Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+index c96c91d836785..fc4ae2e423bd7 100644
+--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+@@ -94,7 +94,7 @@
+ &fec {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_enet>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 9d5f6f55207d4cb2659d22cef3b07eaeaf3e90e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 10:26:50 +0530
+Subject: ASoC: qcom: lpass-platform: Fix memory leak
+
+From: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+
+[ Upstream commit bd6327fda2f3ded85b69b3c3125c99aaa51c7881 ]
+
+lpass_pcm_data is not freed in error paths. Free it in
+error paths to avoid memory leak.
+
+Fixes: 022d00ee0b55 ("ASoC: lpass-platform: Fix broken pcm data usage")
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: V Sujith Kumar Reddy <vsujithk@codeaurora.org>
+Signed-off-by: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+Link: https://lore.kernel.org/r/1605416210-14530-1-git-send-email-srivasam@codeaurora.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-platform.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
+index b8f8cb906d805..35c49fc9602b6 100644
+--- a/sound/soc/qcom/lpass-platform.c
++++ b/sound/soc/qcom/lpass-platform.c
+@@ -80,8 +80,10 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
+ else
+ dma_ch = 0;
+
+- if (dma_ch < 0)
++ if (dma_ch < 0) {
++ kfree(data);
+ return dma_ch;
++ }
+
+ drvdata->substream[dma_ch] = substream;
+
+@@ -102,6 +104,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
+ ret = snd_pcm_hw_constraint_integer(runtime,
+ SNDRV_PCM_HW_PARAM_PERIODS);
+ if (ret < 0) {
++ kfree(data);
+ dev_err(soc_runtime->dev, "setting constraints failed: %d\n",
+ ret);
+ return -EINVAL;
+--
+2.27.0
+
--- /dev/null
+From 2dbbe60612269152eab650049f29a2b0be93d714 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 03:09:05 +0530
+Subject: can: af_can: prevent potential access of uninitialized member in
+ can_rcv()
+
+From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+
+[ Upstream commit c8c958a58fc67f353289986850a0edf553435702 ]
+
+In can_rcv(), cfd->len is uninitialized when skb->len = 0, and this
+uninitialized cfd->len is accessed nonetheless by pr_warn_once().
+
+Fix this uninitialized variable access by checking cfd->len's validity
+condition (cfd->len > CAN_MAX_DLEN) separately after the skb->len's
+condition is checked, and appropriately modify the log messages that
+are generated as well.
+In case either of the required conditions fail, the skb is freed and
+NET_RX_DROP is returned, same as before.
+
+Fixes: 8cb68751c115 ("can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once")
+Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com
+Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Link: https://lore.kernel.org/r/20201103213906.24219-2-anant.thazhemadam@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/af_can.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 46c85731d16f0..e1cf5c300bacc 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -722,16 +722,25 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
+ {
+ struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
+
+- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU ||
+- cfd->len > CAN_MAX_DLEN)) {
+- pr_warn_once("PF_CAN: dropped non conform CAN skbuf: dev type %d, len %d, datalen %d\n",
++ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d\n",
++ dev->type, skb->len);
++ goto free_skb;
++ }
++
++ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
++ if (unlikely(cfd->len > CAN_MAX_DLEN)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d, datalen %d\n",
+ dev->type, skb->len, cfd->len);
+- kfree_skb(skb);
+- return NET_RX_DROP;
++ goto free_skb;
+ }
+
+ can_receive(skb, dev);
+ return NET_RX_SUCCESS;
++
++free_skb:
++ kfree_skb(skb);
++ return NET_RX_DROP;
+ }
+
+ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
+--
+2.27.0
+
--- /dev/null
+From 469a5332f6252531c8aba6dfb9157e8737e1146a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 03:09:06 +0530
+Subject: can: af_can: prevent potential access of uninitialized member in
+ canfd_rcv()
+
+From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+
+[ Upstream commit 9aa9379d8f868e91719333a7f063ccccc0579acc ]
+
+In canfd_rcv(), cfd->len is uninitialized when skb->len = 0, and this
+uninitialized cfd->len is accessed nonetheless by pr_warn_once().
+
+Fix this uninitialized variable access by checking cfd->len's validity
+condition (cfd->len > CANFD_MAX_DLEN) separately after the skb->len's
+condition is checked, and appropriately modify the log messages that
+are generated as well.
+In case either of the required conditions fail, the skb is freed and
+NET_RX_DROP is returned, same as before.
+
+Fixes: d4689846881d ("can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once")
+Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com
+Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Link: https://lore.kernel.org/r/20201103213906.24219-3-anant.thazhemadam@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/af_can.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index e1cf5c300bacc..ec04a33cd333c 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -748,16 +748,25 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
+ {
+ struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
+
+- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU ||
+- cfd->len > CANFD_MAX_DLEN)) {
+- pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n",
++ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n",
++ dev->type, skb->len);
++ goto free_skb;
++ }
++
++ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
++ if (unlikely(cfd->len > CANFD_MAX_DLEN)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d, datalen %d\n",
+ dev->type, skb->len, cfd->len);
+- kfree_skb(skb);
+- return NET_RX_DROP;
++ goto free_skb;
+ }
+
+ can_receive(skb, dev);
+ return NET_RX_SUCCESS;
++
++free_skb:
++ kfree_skb(skb);
++ return NET_RX_DROP;
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 09630f38f4da2e73c073e483ab058a2d231b71ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 21:51:47 +0000
+Subject: can: dev: can_restart(): post buffer from the right context
+
+From: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
+
+[ Upstream commit a1e654070a60d5d4f7cce59c38f4ca790bb79121 ]
+
+netif_rx() is meant to be called from interrupt contexts. can_restart() may be
+called by can_restart_work(), which is called from a worqueue, so it may run in
+process context. Use netif_rx_ni() instead.
+
+Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
+Co-developed-by: Loris Fauster <loris.fauster@ttcontrol.com>
+Signed-off-by: Loris Fauster <loris.fauster@ttcontrol.com>
+Signed-off-by: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
+Link: https://lore.kernel.org/r/4e84162b-fb31-3a73-fa9a-9438b4bd5234@acoro.eu
+[mkl: use netif_rx_ni() instead of netif_rx_any_context()]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index e79965a390aab..c483c4b787fee 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -578,7 +578,7 @@ static void can_restart(struct net_device *dev)
+ }
+ cf->can_id |= CAN_ERR_RESTARTED;
+
+- netif_rx(skb);
++ netif_rx_ni(skb);
+
+ stats->rx_packets++;
+ stats->rx_bytes += cf->can_dlc;
+--
+2.27.0
+
--- /dev/null
+From 0dd8edc040c420a53a9ad0d73387e8e00e794743 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2020 10:23:30 +0800
+Subject: can: m_can: m_can_handle_state_change(): fix state change
+
+From: Wu Bo <wubo.oduw@gmail.com>
+
+[ Upstream commit cd0d83eab2e0c26fe87a10debfedbb23901853c1 ]
+
+m_can_handle_state_change() is called with the new_state as an argument.
+
+In the switch statements for CAN_STATE_ERROR_ACTIVE, the comment and the
+following code indicate that a CAN_STATE_ERROR_WARNING is handled.
+
+This patch fixes this problem by changing the case to CAN_STATE_ERROR_WARNING.
+
+Signed-off-by: Wu Bo <wubo.oduw@gmail.com>
+Link: http://lore.kernel.org/r/20200129022330.21248-2-wubo.oduw@gmail.com
+Cc: Dan Murphy <dmurphy@ti.com>
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index ebad93ac8f118..680ee8345211f 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -671,7 +671,7 @@ static int m_can_handle_state_change(struct net_device *dev,
+ unsigned int ecr;
+
+ switch (new_state) {
+- case CAN_STATE_ERROR_ACTIVE:
++ case CAN_STATE_ERROR_WARNING:
+ /* error warning state */
+ priv->can.can_stats.error_warning++;
+ priv->can.state = CAN_STATE_ERROR_WARNING;
+@@ -700,7 +700,7 @@ static int m_can_handle_state_change(struct net_device *dev,
+ __m_can_get_berr_counter(dev, &bec);
+
+ switch (new_state) {
+- case CAN_STATE_ERROR_ACTIVE:
++ case CAN_STATE_ERROR_WARNING:
+ /* error warning state */
+ cf->can_id |= CAN_ERR_CRTL;
+ cf->data[1] = (bec.txerr > bec.rxerr) ?
+--
+2.27.0
+
--- /dev/null
+From d127bccd2d8cf68ec8c5af5818034f2deaf9685a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 21:16:55 +0200
+Subject: can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to
+ can_put_echo_skb()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 81c9c8e0adef3285336b942f93287c554c89e6c6 ]
+
+The driver has to first fill the skb with data and then handle it to
+can_put_echo_skb(). This patch moves the can_put_echo_skb() down, right before
+sending the skb out via USB.
+
+Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer")
+Cc: Remigiusz Kołłątaj <remigiusz.kollataj@mobica.com>
+Link: https://lore.kernel.org/r/20201111221204.1639007-1-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/mcba_usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
+index 070e1ba797369..a09e3f6c2c504 100644
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -337,8 +337,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
+ if (!ctx)
+ return NETDEV_TX_BUSY;
+
+- can_put_echo_skb(skb, priv->netdev, ctx->ndx);
+-
+ if (cf->can_id & CAN_EFF_FLAG) {
+ /* SIDH | SIDL | EIDH | EIDL
+ * 28 - 21 | 20 19 18 x x x 17 16 | 15 - 8 | 7 - 0
+@@ -368,6 +366,8 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
+ if (cf->can_id & CAN_RTR_FLAG)
+ usb_msg.dlc |= MCBA_DLC_RTR_MASK;
+
++ can_put_echo_skb(skb, priv->netdev, ctx->ndx);
++
+ err = mcba_usb_xmit(priv, (struct mcba_usb_msg *)&usb_msg, ctx);
+ if (err)
+ goto xmit_failed;
+--
+2.27.0
+
--- /dev/null
+From ca75a96b47b00ffd6b77f0c4f4ce3b998bb371dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 11:24:27 +0000
+Subject: can: peak_usb: fix potential integer overflow on shift of a int
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 8a68cc0d690c9e5730d676b764c6f059343b842c ]
+
+The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
+arithmetic and then assigned to a signed 64 bit variable. In the case where
+time_ref->adapter->ts_used_bits is 32 or more this can lead to an oveflow.
+Avoid this by shifting using the BIT_ULL macro instead.
+
+Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20201105112427.40688-1-colin.king@canonical.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index 9d78ba7776140..c9d86d50bf886 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -180,7 +180,7 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts,
+ if (time_ref->ts_dev_1 < time_ref->ts_dev_2) {
+ /* case when event time (tsw) wraps */
+ if (ts < time_ref->ts_dev_1)
+- delta_ts = 1 << time_ref->adapter->ts_used_bits;
++ delta_ts = BIT_ULL(time_ref->adapter->ts_used_bits);
+
+ /* Otherwise, sync time counter (ts_dev_2) has wrapped:
+ * handle case when event time (tsn) hasn't.
+@@ -192,7 +192,7 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts,
+ * tsn ts
+ */
+ } else if (time_ref->ts_dev_1 < ts) {
+- delta_ts = -(1 << time_ref->adapter->ts_used_bits);
++ delta_ts = -BIT_ULL(time_ref->adapter->ts_used_bits);
+ }
+
+ /* add delay between last sync and event timestamps */
+--
+2.27.0
+
--- /dev/null
+From 719da69a3953b67a42d852f718dedc517a7ecc83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Nov 2020 19:17:08 +0800
+Subject: can: ti_hecc: Fix memleak in ti_hecc_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 7968c7c79d3be8987feb8021f0c46e6866831408 ]
+
+In the error handling, we should goto the probe_exit_candev
+to free ndev to prevent memory leak.
+
+Fixes: dabf54dd1c63 ("can: ti_hecc: Convert TI HECC driver to DT only driver")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201114111708.3465543-1-zhangqilong3@huawei.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/ti_hecc.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
+index db6ea936dc3fc..81a3fdd5e0103 100644
+--- a/drivers/net/can/ti_hecc.c
++++ b/drivers/net/can/ti_hecc.c
+@@ -903,7 +903,8 @@ static int ti_hecc_probe(struct platform_device *pdev)
+ priv->base = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(priv->base)) {
+ dev_err(&pdev->dev, "hecc ioremap failed\n");
+- return PTR_ERR(priv->base);
++ err = PTR_ERR(priv->base);
++ goto probe_exit_candev;
+ }
+
+ /* handle hecc-ram memory */
+@@ -916,7 +917,8 @@ static int ti_hecc_probe(struct platform_device *pdev)
+ priv->hecc_ram = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(priv->hecc_ram)) {
+ dev_err(&pdev->dev, "hecc-ram ioremap failed\n");
+- return PTR_ERR(priv->hecc_ram);
++ err = PTR_ERR(priv->hecc_ram);
++ goto probe_exit_candev;
+ }
+
+ /* handle mbx memory */
+@@ -929,13 +931,14 @@ static int ti_hecc_probe(struct platform_device *pdev)
+ priv->mbx = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(priv->mbx)) {
+ dev_err(&pdev->dev, "mbx ioremap failed\n");
+- return PTR_ERR(priv->mbx);
++ err = PTR_ERR(priv->mbx);
++ goto probe_exit_candev;
+ }
+
+ irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+ if (!irq) {
+ dev_err(&pdev->dev, "No irq resource\n");
+- goto probe_exit;
++ goto probe_exit_candev;
+ }
+
+ priv->ndev = ndev;
+@@ -988,7 +991,7 @@ probe_exit_clk:
+ clk_put(priv->clk);
+ probe_exit_candev:
+ free_candev(ndev);
+-probe_exit:
++
+ return err;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 6828fe90d4e4111ed5dba4155907d5b0a17ca7ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 17:10:09 -0700
+Subject: Input: adxl34x - clean up a data type in adxl34x_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 33b6c39e747c552fa770eecebd1776f1f4a222b1 ]
+
+The "revid" is used to store negative error codes so it should be an int
+type.
+
+Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Michael Hennerich <michael.hennerich@analog.com>
+Link: https://lore.kernel.org/r/20201026072824.GA1620546@mwanda
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/adxl34x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
+index 2b2d02f408bbb..2e189646d8fe2 100644
+--- a/drivers/input/misc/adxl34x.c
++++ b/drivers/input/misc/adxl34x.c
+@@ -696,7 +696,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq,
+ struct input_dev *input_dev;
+ const struct adxl34x_platform_data *pdata;
+ int err, range, i;
+- unsigned char revid;
++ int revid;
+
+ if (!irq) {
+ dev_err(dev, "no IRQ?\n");
+--
+2.27.0
+
--- /dev/null
+From 7298b7bbff7ff4f89cbe789e0df5ca22d0994492 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Nov 2020 22:17:19 -0800
+Subject: libfs: fix error cast of negative value in simple_attr_write()
+
+From: Yicong Yang <yangyicong@hisilicon.com>
+
+[ Upstream commit 488dac0c9237647e9b8f788b6a342595bfa40bda ]
+
+The attr->set() receive a value of u64, but simple_strtoll() is used for
+doing the conversion. It will lead to the error cast if user inputs a
+negative value.
+
+Use kstrtoull() instead of simple_strtoll() to convert a string got from
+the user to an unsigned value. The former will return '-EINVAL' if it
+gets a negetive value, but the latter can't handle the situation
+correctly. Make 'val' unsigned long long as what kstrtoull() takes,
+this will eliminate the compile warning on no 64-bit architectures.
+
+Fixes: f7b88631a897 ("fs/libfs.c: fix simple_attr_write() on 32bit machines")
+Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Link: https://lkml.kernel.org/r/1605341356-11872-1-git-send-email-yangyicong@hisilicon.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/libfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/libfs.c b/fs/libfs.c
+index cb9310b091f5a..83618c21c2165 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -868,7 +868,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
+ size_t len, loff_t *ppos)
+ {
+ struct simple_attr *attr;
+- u64 val;
++ unsigned long long val;
+ size_t size;
+ ssize_t ret;
+
+@@ -886,7 +886,9 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
+ goto out;
+
+ attr->set_buf[size] = '\0';
+- val = simple_strtoll(attr->set_buf, NULL, 0);
++ ret = kstrtoull(attr->set_buf, 0, &val);
++ if (ret)
++ goto out;
+ ret = attr->set(attr->data, val);
+ if (ret == 0)
+ ret = len; /* on success, claim we got the whole input */
+--
+2.27.0
+
--- /dev/null
+From e4c0e32c03f2e4f0f5c3ce2b3d2639dd1ebb369e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 21:18:56 +0800
+Subject: MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit ac3b57adf87ad9bac7e33ca26bbbb13fae1ed62b ]
+
+If the clk_register fails, we should free h before
+function returns to prevent memleak.
+
+Fixes: 474402291a0ad ("MIPS: Alchemy: clock framework integration of onchip clocks")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/alchemy/common/clock.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c
+index a83c7b7e2eb1f..c5e49bb79c004 100644
+--- a/arch/mips/alchemy/common/clock.c
++++ b/arch/mips/alchemy/common/clock.c
+@@ -152,6 +152,7 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
+ {
+ struct clk_init_data id;
+ struct clk_hw *h;
++ struct clk *clk;
+
+ h = kzalloc(sizeof(*h), GFP_KERNEL);
+ if (!h)
+@@ -164,7 +165,13 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
+ id.ops = &alchemy_clkops_cpu;
+ h->init = &id;
+
+- return clk_register(NULL, h);
++ clk = clk_register(NULL, h);
++ if (IS_ERR(clk)) {
++ pr_err("failed to register clock\n");
++ kfree(h);
++ }
++
++ return clk;
+ }
+
+ /* AUXPLLs ************************************************************/
+--
+2.27.0
+
--- /dev/null
+From 53fee7547d9fd11a62fc3801bf9754fd52313542 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 12:44:40 -0700
+Subject: MIPS: export has_transparent_hugepage() for modules
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 31b4d8e172f614adc53ddecb4b6b2f6411a49b84 ]
+
+MIPS should export its local version of "has_transparent_hugepage"
+so that loadable modules (dax) can use it.
+
+Fixes this build error:
+ERROR: modpost: "has_transparent_hugepage" [drivers/dax/dax.ko] undefined!
+
+Fixes: fd8cfd300019 ("arch: fix has_transparent_hugepage()")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Cc: linux-mips@vger.kernel.org
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: Vishal Verma <vishal.l.verma@intel.com>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: linux-nvdimm@lists.01.org
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/mm/tlb-r4k.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
+index 0596505770dba..11985399c4695 100644
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -424,6 +424,7 @@ int has_transparent_hugepage(void)
+ }
+ return mask == PM_HUGE_MASK;
+ }
++EXPORT_SYMBOL(has_transparent_hugepage);
+
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+
+--
+2.27.0
+
--- /dev/null
+From 2236ed0132126cbf646b552ccffdbf49bcb39e2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 17:42:29 +0800
+Subject: perf lock: Don't free "lock_seq_stat" if read_count isn't zero
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit b0e5a05cc9e37763c7f19366d94b1a6160c755bc ]
+
+When execute command "perf lock report", it hits failure and outputs log
+as follows:
+
+ perf: builtin-lock.c:623: report_lock_release_event: Assertion `!(seq->read_count < 0)' failed.
+ Aborted
+
+This is an imbalance issue. The locking sequence structure
+"lock_seq_stat" contains the reader counter and it is used to check if
+the locking sequence is balance or not between acquiring and releasing.
+
+If the tool wrongly frees "lock_seq_stat" when "read_count" isn't zero,
+the "read_count" will be reset to zero when allocate a new structure at
+the next time; thus it causes the wrong counting for reader and finally
+results in imbalance issue.
+
+To fix this issue, if detects "read_count" is not zero (means still have
+read user in the locking sequence), goto the "end" tag to skip freeing
+structure "lock_seq_stat".
+
+Fixes: e4cef1f65061 ("perf lock: Fix state machine to recognize lock sequence")
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Link: https://lore.kernel.org/r/20201104094229.17509-2-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-lock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
+index fe69cd6b89e1a..6140b0548ad7d 100644
+--- a/tools/perf/builtin-lock.c
++++ b/tools/perf/builtin-lock.c
+@@ -620,7 +620,7 @@ static int report_lock_release_event(struct perf_evsel *evsel,
+ case SEQ_STATE_READ_ACQUIRED:
+ seq->read_count--;
+ BUG_ON(seq->read_count < 0);
+- if (!seq->read_count) {
++ if (seq->read_count) {
+ ls->nr_release++;
+ goto end;
+ }
+--
+2.27.0
+
--- /dev/null
+From 3b18929876931d6a79980ba5ce7d5223564d2c34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 08:50:09 -0600
+Subject: regulator: ti-abb: Fix array out of bound read access on the first
+ transition
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 2ba546ebe0ce2af47833d8912ced9b4a579f13cb ]
+
+At the start of driver initialization, we do not know what bias
+setting the bootloader has configured the system for and we only know
+for certain the very first time we do a transition.
+
+However, since the initial value of the comparison index is -EINVAL,
+this negative value results in an array out of bound access on the
+very first transition.
+
+Since we don't know what the setting is, we just set the bias
+configuration as there is nothing to compare against. This prevents
+the array out of bound access.
+
+NOTE: Even though we could use a more relaxed check of "< 0" the only
+valid values(ignoring cosmic ray induced bitflips) are -EINVAL, 0+.
+
+Fixes: 40b1936efebd ("regulator: Introduce TI Adaptive Body Bias(ABB) on-chip LDO driver")
+Link: https://lore.kernel.org/linux-mm/CA+G9fYuk4imvhyCN7D7T6PMDH6oNp6HDCRiTUKMQ6QXXjBa4ag@mail.gmail.com/
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Link: https://lore.kernel.org/r/20201118145009.10492-1-nm@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/ti-abb-regulator.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
+index 6d17357b3a248..5f5f63eb8c762 100644
+--- a/drivers/regulator/ti-abb-regulator.c
++++ b/drivers/regulator/ti-abb-regulator.c
+@@ -342,8 +342,17 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
+ return ret;
+ }
+
+- /* If data is exactly the same, then just update index, no change */
+ info = &abb->info[sel];
++ /*
++ * When Linux kernel is starting up, we are'nt sure of the
++ * Bias configuration that bootloader has configured.
++ * So, we get to know the actual setting the first time
++ * we are asked to transition.
++ */
++ if (abb->current_info_idx == -EINVAL)
++ goto just_set_abb;
++
++ /* If data is exactly the same, then just update index, no change */
+ oinfo = &abb->info[abb->current_info_idx];
+ if (!memcmp(info, oinfo, sizeof(*info))) {
+ dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__,
+@@ -351,6 +360,7 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
+ goto out;
+ }
+
++just_set_abb:
+ ret = ti_abb_set_opp(rdev, abb, info);
+
+ out:
+--
+2.27.0
+
pinctrl-rockchip-enable-gpio-pclk-for-rockchip_gpio_.patch
arm64-psci-avoid-printing-in-cpu_psci_cpu_die.patch
vfs-remove-lockdep-bogosity-in-__sb_start_write.patch
+input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch
+mips-export-has_transparent_hugepage-for-modules.patch
+arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch
+arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch
+perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch
+can-af_can-prevent-potential-access-of-uninitialized.patch
+can-af_can-prevent-potential-access-of-uninitialized.patch-7214
+can-dev-can_restart-post-buffer-from-the-right-conte.patch
+can-ti_hecc-fix-memleak-in-ti_hecc_probe.patch
+can-mcba_usb-mcba_usb_start_xmit-first-fill-skb-then.patch
+can-peak_usb-fix-potential-integer-overflow-on-shift.patch
+can-m_can-m_can_handle_state_change-fix-state-change.patch
+asoc-qcom-lpass-platform-fix-memory-leak.patch
+mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch
+regulator-ti-abb-fix-array-out-of-bound-read-access-.patch
+xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch
+libfs-fix-error-cast-of-negative-value-in-simple_att.patch
--- /dev/null
+From 399a64e7a1e83e925d86af8f14eea28ebfcb98f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 15:17:50 -0800
+Subject: xfs: revert "xfs: fix rmap key and record comparison functions"
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit eb8409071a1d47e3593cfe077107ac46853182ab ]
+
+This reverts commit 6ff646b2ceb0eec916101877f38da0b73e3a5b7f.
+
+Your maintainer committed a major braino in the rmap code by adding the
+attr fork, bmbt, and unwritten extent usage bits into rmap record key
+comparisons. While XFS uses the usage bits *in the rmap records* for
+cross-referencing metadata in xfs_scrub and xfs_repair, it only needs
+the owner and offset information to distinguish between reverse mappings
+of the same physical extent into the data fork of a file at multiple
+offsets. The other bits are not important for key comparisons for index
+lookups, and never have been.
+
+Eric Sandeen reports that this causes regressions in generic/299, so
+undo this patch before it does more damage.
+
+Reported-by: Eric Sandeen <sandeen@sandeen.net>
+Fixes: 6ff646b2ceb0 ("xfs: fix rmap key and record comparison functions")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c
+index cd689d21d3af8..9d9c9192584c9 100644
+--- a/fs/xfs/libxfs/xfs_rmap_btree.c
++++ b/fs/xfs/libxfs/xfs_rmap_btree.c
+@@ -262,8 +262,8 @@ xfs_rmapbt_key_diff(
+ else if (y > x)
+ return -1;
+
+- x = be64_to_cpu(kp->rm_offset);
+- y = xfs_rmap_irec_offset_pack(rec);
++ x = XFS_RMAP_OFF(be64_to_cpu(kp->rm_offset));
++ y = rec->rm_offset;
+ if (x > y)
+ return 1;
+ else if (y > x)
+@@ -294,8 +294,8 @@ xfs_rmapbt_diff_two_keys(
+ else if (y > x)
+ return -1;
+
+- x = be64_to_cpu(kp1->rm_offset);
+- y = be64_to_cpu(kp2->rm_offset);
++ x = XFS_RMAP_OFF(be64_to_cpu(kp1->rm_offset));
++ y = XFS_RMAP_OFF(be64_to_cpu(kp2->rm_offset));
+ if (x > y)
+ return 1;
+ else if (y > x)
+@@ -400,8 +400,8 @@ xfs_rmapbt_keys_inorder(
+ return 1;
+ else if (a > b)
+ return 0;
+- a = be64_to_cpu(k1->rmap.rm_offset);
+- b = be64_to_cpu(k2->rmap.rm_offset);
++ a = XFS_RMAP_OFF(be64_to_cpu(k1->rmap.rm_offset));
++ b = XFS_RMAP_OFF(be64_to_cpu(k2->rmap.rm_offset));
+ if (a <= b)
+ return 1;
+ return 0;
+@@ -430,8 +430,8 @@ xfs_rmapbt_recs_inorder(
+ return 1;
+ else if (a > b)
+ return 0;
+- a = be64_to_cpu(r1->rmap.rm_offset);
+- b = be64_to_cpu(r2->rmap.rm_offset);
++ a = XFS_RMAP_OFF(be64_to_cpu(r1->rmap.rm_offset));
++ b = XFS_RMAP_OFF(be64_to_cpu(r2->rmap.rm_offset));
+ if (a <= b)
+ return 1;
+ return 0;
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
